diff --git a/.github/instructions/html-lang.instructions.md b/.github/instructions/html-lang.instructions.md
new file mode 100644
index 00000000..b2537c6f
--- /dev/null
+++ b/.github/instructions/html-lang.instructions.md
@@ -0,0 +1,23 @@
+---
+applyTo: '**/*.html'
+---
+
+# HTML Language Guide
+
+- Use 4 spaces per indentation level. No tabs.
+
+- Use double quotes for all HTML attributes. Ex: `<div class="my-class">`
+
+- Self-closing tags should include the trailing slash. Ex: `<img src="image.png" />`
+
+- Use semantic HTML5 elements where appropriate. Ex: `<header>`, `<nav>`, `<main>`, `<footer>`
+
+- Include ARIA roles and attributes to enhance accessibility. Ex: `role="button"`, `aria-label="Close"`
+
+- Keep inline styles to a minimum; prefer CSS classes for styling.
+
+- Use comments to separate major sections of the HTML document. Ex: `<!-- Header Section -->`
+
+- Use Jinja templating syntax consistently for dynamic content, settings, and configuration. Ex: `{{ variable }}`, `{% if condition %}`
+
+- Use bootstrap classes for layout, styling consistency, and data presentation. Ex: `class="container"`, `class="row"`, `class="col-md-6"`, `data-bs-toggle="modal"`
\ No newline at end of file
diff --git a/.github/instructions/javascript-lang.instructions.md b/.github/instructions/javascript-lang.instructions.md
index 43d67240..4f479744 100644
--- a/.github/instructions/javascript-lang.instructions.md
+++ b/.github/instructions/javascript-lang.instructions.md
@@ -18,4 +18,6 @@ applyTo: '**/*.js'
 
 - Do not use display:none. Instead add and remove the d-none class when hiding or showing elements.
 
-- Prefer inline html notifications or toast messages using Bootstrap alert classes over browser alert() calls.
\ No newline at end of file
+- Prefer inline html notifications or toast messages using Bootstrap alert classes over browser alert() calls.
+
+- Use bootstrap modals for confirmation dialogs instead of native browser confirm() calls.
diff --git a/.github/instructions/python-lang.instructions.md b/.github/instructions/python-lang.instructions.md
index eff15aef..4d6a94a6 100644
--- a/.github/instructions/python-lang.instructions.md
+++ b/.github/instructions/python-lang.instructions.md
@@ -4,12 +4,31 @@ applyTo: '**/*.py'
 
 # Python Language Guide
 
-- Files should start with a comment of the file name. Ex: `# functions_personal_agents.py`
+- All files MUST start with a comment of the file name. Ex: `# functions_personal_agents.py`
 
-- Imports should be grouped at the top of the document after the module docstring, unless otherwise indicated by the user or for performance reasons in which case the import should be as close as possible to the usage with a documented note as to why the import is not at the top of the file.
+## Rule: Follow Standard Python Conventions
 
+- Standard python conventions, such as the use of snake case, must be followed.
+
+## Rule: Imports Must Be Organized and at the Top
+
+- IMPORTANT: `from` and `import` statements MUST be grouped at the top of the document after the module docstring, unless otherwise indicated by the code writer or for performance reasons in which case the import should be as close as possible to the usage with a comment explaining why the import is not at the top of the file. CodeQL hammers us on this in the findings. If you find imports that are not at the top of the file, move them to the top and add a comment if there is a reason they cannot be moved. This also helps prevent multuple imports of the same module in different places which can lead to confusion and maintenance issues.
+
+## Rule: Indentation, Logging, and Decorators
 - Use 4 spaces per indentation level. No tabs.
 
 - Code and definitions should occur after the imports block.
 
-- Prefer log_event from functions_appinsights.py for logging activites.
\ No newline at end of file
+- All logging should used tag based prefixes. Ex: [GPTClient] or [SKLoader] to identify the source of the log message and make it easier to trace. Tags should be enclosed in square brackets. Tags should be generalized to the operation that is occurring. Any existins logging that is missing tags should have tags added.
+
+- Prefer using ```log_event``` from functions_appinsights.py for production-type logging activites.
+
+- Use ```debug_print``` from functions_debug.py for debug logging purposes. All method, calls, warnings and errors should be debug_logged. 
+
+- Files with routes MUST import ```from swagger_wrapper import swagger_route, get_auth_security``` and use the ```@swagger_route(security=get_auth_security())``` decorator for all route functions.
+
+- Unless otherwise indicated, all routes MUST include ```@login_required``` decorator. 
+
+- Always use f-strings for string interpolation. Ex: `f"User ID: {user_id}"` instead of `"User ID: {}".format(user_id)"`
+
+- Never use `except:` without specifying the exception type. Always catch specific exceptions or use `except Exception as ex:` to capture the exception details. This also avoids accidentally catching system-exiting exceptions like `KeyboardInterrupt` or `SystemExit`.
\ No newline at end of file
diff --git a/.github/instructions/ui_tests.instructions.md b/.github/instructions/ui_tests.instructions.md
new file mode 100644
index 00000000..dae1a778
--- /dev/null
+++ b/.github/instructions/ui_tests.instructions.md
@@ -0,0 +1,158 @@
+---
+applyTo: '**/*.html, **/*.js, **/*.css'
+---
+
+# UI Tests
+
+- Always create or update Azure Playwright UI tests when changing HTML, CSS, or JavaScript that affects rendering, user interaction, layout, client-side state, or browser workflows. Leverage the `azure-mgmt-playwright` Python library.
+
+## Location
+
+- Store all UI tests in the `ui_tests/` folder at the root of the project.
+- Keep reusable helpers, fixtures, authentication utilities, and page models inside `ui_tests/` so UI automation stays separate from `functional_tests/`.
+- Place screenshots, traces, and other test artifacts under a dedicated subfolder such as `ui_tests/artifacts/`.
+
+## When UI Tests Are Required
+
+### Always create or update UI tests for:
+- New pages, views, or templates.
+- HTML changes that affect structure, accessibility, forms, navigation, or conditional rendering.
+- CSS changes that affect layout, spacing, responsive behavior, visibility, theming, or visual regressions.
+- JavaScript changes that affect event handlers, DOM updates, modals, tabs, filtering, validation, async loading, or error handling.
+- Bug fixes involving display logic, user flows, or browser-side regressions.
+- Features that require proof that the browser experience works end to end.
+
+### Focus areas for coverage:
+- Rendering: page content, empty states, conditional sections, and accessibility attributes.
+- Interaction: clicks, typing, keyboard navigation, dialogs, dropdowns, and form submission.
+- Styling and layout: visible states, responsive breakpoints, overflow issues, and Bootstrap-driven behavior.
+- JavaScript behavior: dynamic updates, loading indicators, validation messages, and error states.
+
+## Required Technology
+
+- Use Azure Playwright for UI automation.
+- Use the `azure-mgmt-playwright` Python package when provisioning or connecting to Azure Playwright resources.
+- Use `DefaultAzureCredential` for authentication. Never hardcode credentials, API keys, or secrets in UI tests.
+- Write UI tests in Python unless the user explicitly requests another language.
+
+## Naming Conventions
+
+### File naming:
+- Use `test_{page_or_feature}_{scenario}.py` for executable UI tests.
+- Use descriptive names tied to the user-visible workflow being validated.
+
+### Examples:
+- `test_chat_sidebar_navigation.py`
+- `test_workspace_document_filters.py`
+- `test_group_workspace_modal_validation.py`
+- `test_public_workspace_responsive_layout.py`
+
+## Suggested Directory Structure
+
+```text
+ui_tests/
+	test_chat_sidebar_navigation.py
+	test_workspace_document_filters.py
+	conftest.py
+	auth_helpers.py
+	page_models/
+	fixtures/
+	artifacts/
+```
+
+## Test Design Requirements
+
+- Keep each test independent and runnable on its own.
+- Cover the complete browser workflow: navigation, setup, action, validation, and cleanup when needed.
+- Validate both expected success paths and visible failure states.
+- Prefer stable selectors such as `id`, `name`, `data-testid`, ARIA roles, labels, and text that is intentionally user-facing.
+- Avoid brittle selectors based on deeply nested CSS paths or Bootstrap implementation details.
+- If a UI change is responsive, validate at least desktop and mobile viewport behavior.
+- If a change is accessibility-sensitive, validate visible labels, roles, focus movement, and keyboard behavior where practical.
+
+## Python UI Test Template
+
+```python
+# test_chat_sidebar_navigation.py
+"""
+UI test for chat sidebar navigation.
+
+Version: [current version from config.py when applicable]
+Implemented in: [version when fix or feature was added]
+
+This test ensures that the sidebar navigation renders correctly,
+supports keyboard and mouse interaction, and updates the visible
+chat panel without browser errors.
+"""
+
+from pathlib import Path
+
+import pytest
+from playwright.sync_api import expect
+
+
+@pytest.mark.ui
+def test_chat_sidebar_navigation(page):
+	"""Validate that users can navigate between sidebar destinations."""
+	page.goto("http://127.0.0.1:5000")
+	page.get_by_role("button", name="Open navigation").click()
+	page.get_by_role("link", name="Workspaces").click()
+
+	expect(page.get_by_role("heading", name="Workspaces")).to_be_visible()
+	expect(page.get_by_text("Recent documents")).to_be_visible()
+```
+
+## Authentication and Environment Rules
+
+- Authenticate Azure dependencies with `DefaultAzureCredential`.
+- Read environment-specific values such as base URLs, tenant-specific settings, or test accounts from environment variables or secure configuration.
+- Never commit secrets, session tokens, storage keys, or passwords.
+- If a test requires signed-in state, create a reusable login helper in `ui_tests/` rather than duplicating login steps across files.
+
+## What to Validate in UI Tests
+
+### HTML changes:
+- Key headings, landmarks, labels, buttons, links, and form elements render correctly.
+- Conditional content appears or stays hidden at the right time.
+- Accessibility-related attributes remain intact.
+
+### CSS changes:
+- Elements are visible when expected and hidden only when intended.
+- Layout behaves correctly at the supported viewport sizes.
+- Important visual states such as error, loading, selected, disabled, and hover-adjacent states are testable.
+
+### JavaScript changes:
+- Event handlers trigger the correct visible behavior.
+- DOM updates complete after async actions.
+- Validation, toast messages, modals, drawers, and loading indicators behave correctly.
+- Browser console errors should be treated as failures when they are caused by the changed workflow.
+
+## Reuse and Maintainability
+
+- Extract repeated UI actions into helper functions or page model classes.
+- Keep assertions close to the action they validate so failures are easy to diagnose.
+- Use concise setup utilities for viewport, authentication, seeded test data, and navigation.
+- Prefer a small number of focused tests over one large brittle end-to-end script.
+
+## Execution Patterns
+
+### Typical workflow:
+- Start the local app or target environment.
+- Run only the relevant UI test file while iterating.
+- Run the broader affected UI suite before completing the change.
+
+### Example commands:
+```bash
+cd ui_tests
+pytest test_chat_sidebar_navigation.py
+pytest -m ui
+```
+
+## Best Practices
+
+- Write UI tests as part of the same change that updates the HTML, CSS, or JavaScript.
+- Keep test names and docstrings explicit about the user behavior being validated.
+- Capture screenshots or traces for failures when the workflow is difficult to diagnose.
+- Avoid sleeping for fixed durations; wait for meaningful UI conditions instead.
+- Verify user-visible outcomes, not just implementation details.
+- If a bug fix changes browser behavior, add a regression UI test that fails without the fix.
\ No newline at end of file
diff --git a/application/single_app/app_settings_cache.py b/application/single_app/app_settings_cache.py
index e7345efb..b9c4a3cc 100644
--- a/application/single_app/app_settings_cache.py
+++ b/application/single_app/app_settings_cache.py
@@ -6,6 +6,8 @@
 """
 import json
 import logging
+import threading
+import time
 from redis import Redis
 from azure.identity import DefaultAzureCredential
 
@@ -15,16 +17,43 @@
 
 _settings = None
 APP_SETTINGS_CACHE = {}
+APP_STREAM_SESSION_METADATA = {}
+APP_STREAM_SESSION_EVENTS = {}
 update_settings_cache = None
 get_settings_cache = None
+initialize_stream_session_cache = None
+set_stream_session_meta = None
+get_stream_session_meta = None
+append_stream_session_event = None
+get_stream_session_events = None
+delete_stream_session_cache = None
 app_cache_is_using_redis = False
+_app_cache_lock = threading.Lock()
+
+
+def _get_expiration_timestamp(ttl_seconds=None):
+    if ttl_seconds is None:
+        return None
+    return time.time() + max(int(ttl_seconds), 0)
+
+
+def _is_expired(entry):
+    if not entry:
+        return True
+    expires_at = entry.get('expires_at')
+    return expires_at is not None and expires_at <= time.time()
 
 def configure_app_cache(settings, redis_cache_endpoint=None):
-    global _settings, update_settings_cache, get_settings_cache, APP_SETTINGS_CACHE, app_cache_is_using_redis
+    global _settings, update_settings_cache, get_settings_cache, APP_SETTINGS_CACHE
+    global APP_STREAM_SESSION_METADATA, APP_STREAM_SESSION_EVENTS
+    global initialize_stream_session_cache, set_stream_session_meta, get_stream_session_meta
+    global append_stream_session_event, get_stream_session_events, delete_stream_session_cache
+    global app_cache_is_using_redis
     # Local import to avoid circular dependency: functions_keyvault imports app_settings_cache.
     from functions_appinsights import log_event
     _settings = settings
     use_redis = _settings.get('enable_redis_cache', False)
+    app_cache_is_using_redis = False
 
     if use_redis:
         app_cache_is_using_redis = True
@@ -83,8 +112,76 @@ def get_settings_cache_redis():
             cached = redis_client.get('APP_SETTINGS_CACHE')
             return json.loads(cached) if cached else {}
 
+        def get_stream_session_metadata_key(cache_key):
+            return f'STREAM_SESSION_META:{cache_key}'
+
+        def get_stream_session_events_key(cache_key):
+            return f'STREAM_SESSION_EVENTS:{cache_key}'
+
+        def initialize_stream_session_cache_redis(cache_key, metadata, ttl_seconds=None):
+            metadata_key = get_stream_session_metadata_key(cache_key)
+            events_key = get_stream_session_events_key(cache_key)
+            pipeline = redis_client.pipeline()
+            pipeline.delete(events_key)
+            pipeline.set(metadata_key, json.dumps(metadata))
+            if ttl_seconds is not None:
+                pipeline.expire(metadata_key, int(ttl_seconds))
+            pipeline.execute()
+
+        def set_stream_session_meta_redis(cache_key, metadata, ttl_seconds=None):
+            metadata_key = get_stream_session_metadata_key(cache_key)
+            events_key = get_stream_session_events_key(cache_key)
+            pipeline = redis_client.pipeline()
+            pipeline.set(metadata_key, json.dumps(metadata))
+            if ttl_seconds is not None:
+                pipeline.expire(metadata_key, int(ttl_seconds))
+                if redis_client.exists(events_key):
+                    pipeline.expire(events_key, int(ttl_seconds))
+            pipeline.execute()
+
+        def get_stream_session_meta_redis(cache_key):
+            cached = redis_client.get(get_stream_session_metadata_key(cache_key))
+            return json.loads(cached) if cached else None
+
+        def append_stream_session_event_redis(cache_key, event_text, ttl_seconds=None):
+            metadata_key = get_stream_session_metadata_key(cache_key)
+            events_key = get_stream_session_events_key(cache_key)
+            pipeline = redis_client.pipeline()
+            pipeline.rpush(events_key, event_text)
+            if ttl_seconds is not None:
+                pipeline.expire(events_key, int(ttl_seconds))
+                if redis_client.exists(metadata_key):
+                    pipeline.expire(metadata_key, int(ttl_seconds))
+            pipeline.execute()
+
+        def get_stream_session_events_redis(cache_key, start_index=0):
+            cached_events = redis_client.lrange(
+                get_stream_session_events_key(cache_key),
+                int(start_index or 0),
+                -1,
+            )
+            normalized_events = []
+            for event in cached_events:
+                if isinstance(event, bytes):
+                    normalized_events.append(event.decode('utf-8'))
+                else:
+                    normalized_events.append(event)
+            return normalized_events
+
+        def delete_stream_session_cache_redis(cache_key):
+            redis_client.delete(
+                get_stream_session_metadata_key(cache_key),
+                get_stream_session_events_key(cache_key),
+            )
+
         update_settings_cache = update_settings_cache_redis
         get_settings_cache = get_settings_cache_redis
+        initialize_stream_session_cache = initialize_stream_session_cache_redis
+        set_stream_session_meta = set_stream_session_meta_redis
+        get_stream_session_meta = get_stream_session_meta_redis
+        append_stream_session_event = append_stream_session_event_redis
+        get_stream_session_events = get_stream_session_events_redis
+        delete_stream_session_cache = delete_stream_session_cache_redis
 
     else:
         def update_settings_cache_mem(new_settings):
@@ -94,5 +191,78 @@ def update_settings_cache_mem(new_settings):
         def get_settings_cache_mem():
             return APP_SETTINGS_CACHE
 
+        def initialize_stream_session_cache_mem(cache_key, metadata, ttl_seconds=None):
+            expiration_timestamp = _get_expiration_timestamp(ttl_seconds)
+            with _app_cache_lock:
+                APP_STREAM_SESSION_METADATA[cache_key] = {
+                    'value': dict(metadata or {}),
+                    'expires_at': expiration_timestamp,
+                }
+                APP_STREAM_SESSION_EVENTS[cache_key] = {
+                    'value': [],
+                    'expires_at': expiration_timestamp,
+                }
+
+        def set_stream_session_meta_mem(cache_key, metadata, ttl_seconds=None):
+            expiration_timestamp = _get_expiration_timestamp(ttl_seconds)
+            with _app_cache_lock:
+                APP_STREAM_SESSION_METADATA[cache_key] = {
+                    'value': dict(metadata or {}),
+                    'expires_at': expiration_timestamp,
+                }
+                if cache_key not in APP_STREAM_SESSION_EVENTS or _is_expired(APP_STREAM_SESSION_EVENTS.get(cache_key)):
+                    APP_STREAM_SESSION_EVENTS[cache_key] = {
+                        'value': [],
+                        'expires_at': expiration_timestamp,
+                    }
+                elif expiration_timestamp is not None:
+                    APP_STREAM_SESSION_EVENTS[cache_key]['expires_at'] = expiration_timestamp
+
+        def get_stream_session_meta_mem(cache_key):
+            with _app_cache_lock:
+                entry = APP_STREAM_SESSION_METADATA.get(cache_key)
+                if _is_expired(entry):
+                    APP_STREAM_SESSION_METADATA.pop(cache_key, None)
+                    APP_STREAM_SESSION_EVENTS.pop(cache_key, None)
+                    return None
+                return dict(entry.get('value') or {})
+
+        def append_stream_session_event_mem(cache_key, event_text, ttl_seconds=None):
+            expiration_timestamp = _get_expiration_timestamp(ttl_seconds)
+            with _app_cache_lock:
+                entry = APP_STREAM_SESSION_EVENTS.get(cache_key)
+                if _is_expired(entry):
+                    entry = {
+                        'value': [],
+                        'expires_at': expiration_timestamp,
+                    }
+                    APP_STREAM_SESSION_EVENTS[cache_key] = entry
+                entry['value'].append(event_text)
+                if expiration_timestamp is not None:
+                    entry['expires_at'] = expiration_timestamp
+                metadata_entry = APP_STREAM_SESSION_METADATA.get(cache_key)
+                if metadata_entry and expiration_timestamp is not None:
+                    metadata_entry['expires_at'] = expiration_timestamp
+
+        def get_stream_session_events_mem(cache_key, start_index=0):
+            with _app_cache_lock:
+                entry = APP_STREAM_SESSION_EVENTS.get(cache_key)
+                if _is_expired(entry):
+                    APP_STREAM_SESSION_EVENTS.pop(cache_key, None)
+                    APP_STREAM_SESSION_METADATA.pop(cache_key, None)
+                    return []
+                return list((entry.get('value') or [])[int(start_index or 0):])
+
+        def delete_stream_session_cache_mem(cache_key):
+            with _app_cache_lock:
+                APP_STREAM_SESSION_METADATA.pop(cache_key, None)
+                APP_STREAM_SESSION_EVENTS.pop(cache_key, None)
+
         update_settings_cache = update_settings_cache_mem
-        get_settings_cache = get_settings_cache_mem
\ No newline at end of file
+        get_settings_cache = get_settings_cache_mem
+        initialize_stream_session_cache = initialize_stream_session_cache_mem
+        set_stream_session_meta = set_stream_session_meta_mem
+        get_stream_session_meta = get_stream_session_meta_mem
+        append_stream_session_event = append_stream_session_event_mem
+        get_stream_session_events = get_stream_session_events_mem
+        delete_stream_session_cache = delete_stream_session_cache_mem
\ No newline at end of file
diff --git a/application/single_app/config.py b/application/single_app/config.py
index 059e8706..0ff38f5f 100644
--- a/application/single_app/config.py
+++ b/application/single_app/config.py
@@ -94,7 +94,7 @@
 EXECUTOR_TYPE = 'thread'
 EXECUTOR_MAX_WORKERS = 30
 SESSION_TYPE = 'filesystem'
-VERSION = "0.239.150"
+VERSION = "0.239.185"
 
 SECRET_KEY = os.getenv('SECRET_KEY', 'dev-secret-key-change-in-production')
 
diff --git a/application/single_app/foundry_agent_runtime.py b/application/single_app/foundry_agent_runtime.py
index 36a99ec3..4de7f35a 100644
--- a/application/single_app/foundry_agent_runtime.py
+++ b/application/single_app/foundry_agent_runtime.py
@@ -2,15 +2,22 @@
 """Azure AI Foundry agent execution helpers."""
 
 import asyncio
+import json
 import logging
 import os
-from dataclasses import dataclass
-from typing import Any, Dict, Iterable, List, Optional
+from dataclasses import dataclass, field
+from typing import Any, AsyncIterator, Dict, Iterable, List, Optional
+from urllib.parse import quote
 
-from azure.identity import AzureAuthorityHosts
+import requests
+from azure.identity import (
+    AzureAuthorityHosts,
+    ClientSecretCredential as SyncClientSecretCredential,
+    DefaultAzureCredential as SyncDefaultAzureCredential,
+)
 from azure.identity.aio import (  # type: ignore
-    ClientSecretCredential,
-    DefaultAzureCredential,
+    ClientSecretCredential as AsyncClientSecretCredential,
+    DefaultAzureCredential as AsyncDefaultAzureCredential,
 )
 from semantic_kernel.agents import AzureAIAgent
 from semantic_kernel.contents.chat_message_content import ChatMessageContent
@@ -35,6 +42,24 @@ class FoundryAgentInvocationResult:
     metadata: Dict[str, Any]
 
 
+@dataclass
+class FoundryAgentStreamMessage:
+    """Represents a streaming content or metadata event from a Foundry runtime."""
+
+    content: str = ""
+    metadata: Dict[str, Any] = field(default_factory=dict)
+
+
+@dataclass
+class NewFoundryStreamState:
+    """Tracks new Foundry response state while processing an event stream."""
+
+    text_parts: List[str] = field(default_factory=list)
+    citations: List[Dict[str, Any]] = field(default_factory=list)
+    model: Optional[str] = None
+    metadata: Dict[str, Any] = field(default_factory=dict)
+
+
 class FoundryAgentInvocationError(RuntimeError):
     """Raised when the Foundry agent invocation cannot be completed."""
 
@@ -109,6 +134,93 @@ def invoke(
         self.last_run_model = result.model
         return result.message
 
+    async def invoke_stream(
+        self,
+        messages: Iterable[ChatMessageContent],
+    ) -> AsyncIterator[str]:
+        """Yield a single final chunk so Foundry agents can participate in stream mode."""
+
+        result = await execute_foundry_agent(
+            foundry_settings=self._foundry_settings,
+            global_settings=self._global_settings,
+            message_history=list(messages),
+            metadata={},
+        )
+        self.last_run_citations = result.citations
+        self.last_run_model = result.model
+        if result.message:
+            yield result.message
+
+
+class AzureAIFoundryNewChatCompletionAgent:
+    """Wrapper for the new Foundry application-based runtime."""
+
+    agent_type = "new_foundry"
+
+    def __init__(self, agent_config: Dict[str, Any], settings: Dict[str, Any]):
+        self.name = agent_config.get("name")
+        self.display_name = agent_config.get("display_name") or self.name
+        self.description = agent_config.get("description", "")
+        self.id = agent_config.get("id")
+        self.default_agent = agent_config.get("default_agent", False)
+        self.is_global = agent_config.get("is_global", False)
+        self.is_group = agent_config.get("is_group", False)
+        self.group_id = agent_config.get("group_id")
+        self.group_name = agent_config.get("group_name")
+        self.max_completion_tokens = agent_config.get("max_completion_tokens", -1)
+        self.last_run_citations: List[Dict[str, Any]] = []
+        self.last_run_model: Optional[str] = None
+        self._new_foundry_settings = (
+            (agent_config.get("other_settings") or {}).get("new_foundry") or {}
+        )
+        self._global_settings = settings or {}
+
+    def invoke(
+        self,
+        agent_message_history: Iterable[ChatMessageContent],
+        metadata: Optional[Dict[str, Any]] = None,
+    ) -> str:
+        """Synchronously invoke the new Foundry application runtime."""
+
+        metadata = metadata or {}
+        history = list(agent_message_history)
+        debug_print(
+            f"[NewFoundryAgent] Invoking application '{self.name}' with {len(history)} messages"
+        )
+
+        result = asyncio.run(
+            execute_new_foundry_agent(
+                foundry_settings=self._new_foundry_settings,
+                global_settings=self._global_settings,
+                message_history=history,
+                metadata=metadata,
+            )
+        )
+        self.last_run_citations = result.citations
+        self.last_run_model = result.model
+        return result.message
+
+    async def invoke_stream(
+        self,
+        messages: Iterable[ChatMessageContent],
+    ) -> AsyncIterator[FoundryAgentStreamMessage]:
+        """Yield incremental content for the new Foundry application runtime."""
+
+        async for stream_message in execute_new_foundry_agent_stream(
+            foundry_settings=self._new_foundry_settings,
+            global_settings=self._global_settings,
+            message_history=list(messages),
+            metadata={},
+        ):
+            if stream_message.metadata:
+                citations = stream_message.metadata.get("citations")
+                if isinstance(citations, list):
+                    self.last_run_citations = citations
+                model_value = stream_message.metadata.get("model")
+                if isinstance(model_value, str) and model_value.strip():
+                    self.last_run_model = model_value.strip()
+            yield stream_message
+
 
 async def execute_foundry_agent(
     *,
@@ -203,20 +315,218 @@ async def execute_foundry_agent(
             await credential.close()
 
 
+async def execute_new_foundry_agent(
+    *,
+    foundry_settings: Dict[str, Any],
+    global_settings: Dict[str, Any],
+    message_history: List[ChatMessageContent],
+    metadata: Dict[str, Any],
+) -> FoundryAgentInvocationResult:
+    """Invoke the new Foundry application runtime through its Responses protocol endpoint."""
+
+    application_name = _resolve_new_foundry_application_name(foundry_settings)
+    endpoint = _resolve_endpoint(foundry_settings, global_settings)
+    responses_api_version = (
+        foundry_settings.get("responses_api_version")
+        or foundry_settings.get("api_version")
+        or global_settings.get("azure_ai_foundry_api_version")
+    )
+    if not responses_api_version:
+        raise FoundryAgentInvocationError(
+            "New Foundry agents require a responses_api_version setting."
+        )
+
+    credential = _build_async_credential(foundry_settings, global_settings)
+    scope = _resolve_foundry_scope(foundry_settings, global_settings)
+    token = await credential.get_token(scope)
+    url = (
+        f"{endpoint.rstrip('/')}/applications/{quote(application_name, safe='')}/"
+        "protocols/openai/responses"
+    )
+    payload = _build_new_foundry_request_payload(message_history, metadata, stream=False)
+    headers = {
+        "Authorization": f"Bearer {token.token}",
+        "Content-Type": "application/json",
+    }
+
+    try:
+        response = await asyncio.to_thread(
+            requests.post,
+            url,
+            params={"api-version": responses_api_version},
+            headers=headers,
+            json=payload,
+            timeout=90,
+        )
+        response_payload = _parse_json_response(response)
+        if response.status_code >= 400:
+            raise FoundryAgentInvocationError(
+                _build_http_error_message("new Foundry response", response, response_payload)
+            )
+
+        result = _build_new_foundry_invocation_result(
+            response_payload=response_payload,
+            application_name=application_name,
+        )
+
+        log_event(
+            "[NewFoundryAgent] Invocation complete",
+            extra={
+                "application_name": application_name,
+                "endpoint": endpoint,
+                "model": result.model,
+                "message_length": len(result.message),
+            },
+        )
+
+        return result
+    finally:
+        await credential.close()
+
+
+async def execute_new_foundry_agent_stream(
+    *,
+    foundry_settings: Dict[str, Any],
+    global_settings: Dict[str, Any],
+    message_history: List[ChatMessageContent],
+    metadata: Dict[str, Any],
+) -> AsyncIterator[FoundryAgentStreamMessage]:
+    """Stream a new Foundry application response through the Responses API."""
+
+    application_name = _resolve_new_foundry_application_name(foundry_settings)
+    endpoint = _resolve_endpoint(foundry_settings, global_settings)
+    responses_api_version = (
+        foundry_settings.get("responses_api_version")
+        or foundry_settings.get("api_version")
+        or global_settings.get("azure_ai_foundry_api_version")
+    )
+    if not responses_api_version:
+        raise FoundryAgentInvocationError(
+            "New Foundry agents require a responses_api_version setting."
+        )
+
+    credential = _build_async_credential(foundry_settings, global_settings)
+    scope = _resolve_foundry_scope(foundry_settings, global_settings)
+    token = await credential.get_token(scope)
+    url = (
+        f"{endpoint.rstrip('/')}/applications/{quote(application_name, safe='')}/"
+        "protocols/openai/responses"
+    )
+    debug_print(f"Invoking new Foundry application '{application_name}' at {endpoint} with streaming to url {url} with api-version {responses_api_version}")
+    payload = _build_new_foundry_request_payload(message_history, metadata, stream=True)
+    headers = {
+        "Authorization": f"Bearer {token.token}",
+        "Content-Type": "application/json",
+    }
+    response: Optional[requests.Response] = None
+    state = NewFoundryStreamState()
+
+    try:
+        response = requests.post(
+            url,
+            params={"api-version": responses_api_version},
+            headers=headers,
+            json=payload,
+            timeout=(30, 90),
+            stream=True,
+        )
+        if response.status_code >= 400:
+            response_payload = _try_parse_json_response(response)
+            raise FoundryAgentInvocationError(
+                _build_http_error_message(
+                    "new Foundry stream",
+                    response,
+                    response_payload or {},
+                )
+            )
+
+        content_type = (response.headers.get("Content-Type") or "").lower()
+        if "text/event-stream" not in content_type:
+            response_payload = _parse_json_response(response)
+            result = _build_new_foundry_invocation_result(
+                response_payload=response_payload,
+                application_name=application_name,
+            )
+            if result.message:
+                yield FoundryAgentStreamMessage(content=result.message)
+            yield FoundryAgentStreamMessage(
+                metadata={
+                    **result.metadata,
+                    "citations": result.citations,
+                    "model": result.model,
+                }
+            )
+            return
+
+        for event_name, event_data in _iter_sse_events(response):
+            if event_data == "[DONE]":
+                break
+
+            event_payload = _parse_sse_json_payload(event_name, event_data)
+            event_type = str(event_payload.get("type") or event_name or "").strip()
+            if not event_type:
+                continue
+
+            if event_type in {"error", "response.error", "response.failed"}:
+                raise FoundryAgentInvocationError(
+                    _extract_new_foundry_event_error(event_payload)
+                )
+
+            delta_text = _extract_new_foundry_stream_delta(event_payload)
+            if delta_text:
+                state.text_parts.append(delta_text)
+                yield FoundryAgentStreamMessage(content=delta_text)
+
+            _update_new_foundry_stream_state(
+                state=state,
+                event_payload=event_payload,
+                application_name=application_name,
+            )
+
+        full_text = "".join(state.text_parts).strip()
+        if not full_text:
+            fallback_text = _extract_new_foundry_stream_text(state)
+            if fallback_text:
+                state.text_parts = [fallback_text]
+                yield FoundryAgentStreamMessage(content=fallback_text)
+
+        yield FoundryAgentStreamMessage(metadata=_build_new_foundry_stream_metadata(state, application_name))
+    finally:
+        if response is not None:
+            response.close()
+        await credential.close()
+
+
 def _resolve_endpoint(foundry_settings: Dict[str, Any], global_settings: Dict[str, Any]) -> str:
     endpoint = (
         foundry_settings.get("endpoint")
         or global_settings.get("azure_ai_foundry_endpoint")
         or os.getenv("AZURE_AI_AGENT_ENDPOINT")
     )
+    project_name = (foundry_settings.get("project_name") or "").strip()
     if endpoint:
-        return endpoint.rstrip("/")
+        endpoint = endpoint.rstrip("/")
+        if "/api/projects/" not in endpoint and project_name:
+            endpoint = f"{endpoint}/api/projects/{project_name}"
+        return endpoint
 
     raise FoundryAgentInvocationError(
         "Azure AI Foundry endpoint is not configured. Provide an endpoint in the agent's other_settings.azure_ai_foundry or global settings."
     )
 
 
+def _resolve_new_foundry_application_name(foundry_settings: Dict[str, Any]) -> str:
+    application_name = str(foundry_settings.get("application_name") or "").strip()
+    application_id = str(foundry_settings.get("application_id") or "").strip()
+    if not application_name and application_id:
+        application_name = application_id.split(":", 1)[0].strip()
+    if not application_name:
+        raise FoundryAgentInvocationError(
+            "New Foundry agents require application_name or application_id in other_settings.new_foundry."
+        )
+    return application_name
+
+
 def _build_async_credential(
     foundry_settings: Dict[str, Any],
     global_settings: Dict[str, Any],
@@ -261,7 +571,7 @@ def _build_async_credential(
             raise FoundryAgentInvocationError(
                 "Foundry service principals require tenant_id and client_id values."
             )
-        return ClientSecretCredential(
+        return AsyncClientSecretCredential(
             tenant_id=tenant_id,
             client_id=client_id,
             client_secret=resolved_secret,
@@ -274,7 +584,7 @@ def _build_async_credential(
             raise FoundryAgentInvocationError(
                 "Foundry service principals require tenant_id and client_id values."
             )
-        return ClientSecretCredential(
+        return AsyncClientSecretCredential(
             tenant_id=tenant_id,
             client_id=client_id,
             client_secret=resolved_secret,
@@ -283,14 +593,37 @@ def _build_async_credential(
 
     if auth_type == "managed_identity":
         if managed_identity_type == "user_assigned" and managed_identity_client_id:
-            return DefaultAzureCredential(
+            return AsyncDefaultAzureCredential(
                 authority=authority,
                 managed_identity_client_id=managed_identity_client_id,
             )
-        return DefaultAzureCredential(authority=authority)
+        return AsyncDefaultAzureCredential(authority=authority)
 
     # Fall back to default chained credentials (managed identity, CLI, etc.)
-    return DefaultAzureCredential(authority=authority)
+    return AsyncDefaultAzureCredential(authority=authority)
+
+
+def _resolve_foundry_scope(
+    foundry_settings: Dict[str, Any],
+    global_settings: Dict[str, Any],
+) -> str:
+    scope = str(
+        foundry_settings.get("foundry_scope")
+        or global_settings.get("azure_ai_foundry_scope")
+        or ""
+    ).strip()
+    if scope:
+        return scope
+
+    cloud_value = (
+        foundry_settings.get("cloud")
+        or global_settings.get("azure_ai_foundry_cloud")
+        or ""
+    )
+    normalized = str(cloud_value).strip().lower()
+    if normalized in ("usgov", "usgovernment", "gcc"):
+        return "https://ai.azure.us/.default"
+    return "https://ai.azure.com/.default"
 
 
 def _resolve_secret_value(value: str) -> str:
@@ -353,3 +686,626 @@ def _extract_citations(message: ChatMessageContent) -> List[Dict[str, Any]]:
         if extracted:
             return extracted
     return []
+
+
+def _build_new_foundry_request_payload(
+    message_history: List[ChatMessageContent],
+    metadata: Dict[str, Any],
+    stream: bool = False,
+) -> Dict[str, Any]:
+    input_items: List[Dict[str, Any]] = []
+    for message in message_history:
+        role_value = getattr(message, "role", "user")
+        role = str(role_value).strip().lower() or "user"
+        if role not in {"system", "user", "assistant", "developer"}:
+            role = "user"
+
+        text = _extract_message_text(message).strip()
+        if not text:
+            continue
+
+        input_items.append(
+            {
+                "type": "message",
+                "role": role,
+                "content": [
+                    {
+                        "type": "input_text",
+                        "text": text,
+                    }
+                ],
+            }
+        )
+
+    if not input_items:
+        raise FoundryAgentInvocationError(
+            "New Foundry invocation requires at least one message."
+        )
+
+    payload: Dict[str, Any] = {
+        "input": input_items,
+        "stream": stream,
+    }
+    normalized_metadata = {
+        key: str(value)
+        for key, value in (metadata or {}).items()
+        if value is not None
+    }
+    if normalized_metadata:
+        payload["metadata"] = normalized_metadata
+    return payload
+
+
+def _parse_json_response(response: requests.Response) -> Dict[str, Any]:
+    try:
+        payload = response.json()
+    except ValueError as exc:
+        raise FoundryAgentInvocationError(
+            f"Foundry endpoint returned non-JSON response: {response.text[:500]}"
+        ) from exc
+    if not isinstance(payload, dict):
+        raise FoundryAgentInvocationError("Foundry endpoint returned an unexpected payload.")
+    return payload
+
+
+def _try_parse_json_response(response: requests.Response) -> Optional[Dict[str, Any]]:
+    try:
+        payload = response.json()
+    except ValueError:
+        return None
+    return payload if isinstance(payload, dict) else None
+
+
+def _build_http_error_message(
+    operation: str,
+    response: requests.Response,
+    payload: Dict[str, Any],
+) -> str:
+    details = payload.get("error") if isinstance(payload, dict) else None
+    if isinstance(details, dict):
+        detail_text = details.get("message") or json.dumps(details)
+    else:
+        detail_text = details or response.text[:500]
+    return f"Failed {operation}: HTTP {response.status_code} {detail_text}"
+
+
+def _extract_new_foundry_response_text(payload: Dict[str, Any]) -> str:
+    texts: List[str] = []
+    for item in payload.get("output") or []:
+        if not isinstance(item, dict):
+            continue
+        if item.get("type") != "message":
+            continue
+        for content_item in item.get("content") or []:
+            if not isinstance(content_item, dict):
+                continue
+            block_type = content_item.get("type")
+            if block_type in {"output_text", "text", "input_text"}:
+                text = content_item.get("text") or content_item.get("value")
+                if isinstance(text, str) and text:
+                    texts.append(text)
+    if texts:
+        return "\n".join(texts).strip()
+
+    fallback = payload.get("output_text") or payload.get("text")
+    if isinstance(fallback, str):
+        return fallback.strip()
+    return ""
+
+
+def _extract_new_foundry_response_metadata(payload: Dict[str, Any]) -> Dict[str, Any]:
+    result_metadata = payload.get("metadata") or {}
+    if not isinstance(result_metadata, dict):
+        result_metadata = {}
+    else:
+        result_metadata = dict(result_metadata)
+
+    usage = _normalize_usage_payload(payload.get("usage"))
+    if usage:
+        result_metadata["usage"] = usage
+
+    conversation = payload.get("conversation")
+    if isinstance(conversation, dict):
+        result_metadata["conversation"] = conversation
+
+    response_id = payload.get("id")
+    if response_id:
+        result_metadata["response_id"] = response_id
+
+    return result_metadata
+
+
+def _build_new_foundry_invocation_result(
+    *,
+    response_payload: Dict[str, Any],
+    application_name: str,
+) -> FoundryAgentInvocationResult:
+    text = _extract_new_foundry_response_text(response_payload)
+    if not text:
+        raise FoundryAgentInvocationError(
+            "New Foundry application returned no assistant content."
+        )
+
+    citations = _extract_new_foundry_citations(response_payload)
+    model_value = str(response_payload.get("model") or application_name)
+    result_metadata = _extract_new_foundry_response_metadata(response_payload)
+    return FoundryAgentInvocationResult(
+        message=text,
+        model=model_value,
+        citations=citations,
+        metadata=result_metadata,
+    )
+
+
+def _extract_new_foundry_citations(payload: Dict[str, Any]) -> List[Dict[str, Any]]:
+    citations: List[Dict[str, Any]] = []
+    for item in payload.get("output") or []:
+        if not isinstance(item, dict):
+            continue
+        for content_item in item.get("content") or []:
+            if not isinstance(content_item, dict):
+                continue
+            for annotation in content_item.get("annotations") or []:
+                if not isinstance(annotation, dict):
+                    continue
+                url = annotation.get("url") or annotation.get("uri")
+                title = annotation.get("title") or annotation.get("name")
+                quote_text = annotation.get("quote") or annotation.get("text")
+                if url or title or quote_text:
+                    citations.append(
+                        {
+                            "url": url,
+                            "title": title,
+                            "quote": quote_text,
+                            "citation_type": annotation.get("type") or annotation.get("annotation_type"),
+                        }
+                    )
+    return citations
+
+
+def _extract_nested_version_value(version_source: Any) -> str:
+    if isinstance(version_source, dict):
+        latest = version_source.get("latest")
+        if isinstance(latest, dict):
+            latest_version = str(latest.get("version") or "").strip()
+            if latest_version:
+                return latest_version
+
+        direct_version = str(version_source.get("version") or "").strip()
+        if direct_version:
+            return direct_version
+
+        items = version_source.get("items") or version_source.get("data") or version_source.get("value")
+        if isinstance(items, list) and items:
+            for item in items:
+                item_version = _extract_nested_version_value(item)
+                if item_version:
+                    return item_version
+    elif isinstance(version_source, list):
+        for item in version_source:
+            item_version = _extract_nested_version_value(item)
+            if item_version:
+                return item_version
+    return ""
+
+
+def _extract_new_foundry_api_version(item: Dict[str, Any], properties: Dict[str, Any]) -> str:
+    return str(
+        item.get("responses_api_version")
+        or item.get("response_api_version")
+        or item.get("openai_api_version")
+        or item.get("api_version")
+        or properties.get("responses_api_version")
+        or properties.get("response_api_version")
+        or properties.get("openai_api_version")
+        or properties.get("api_version")
+        or ""
+    ).strip()
+
+
+def _normalize_usage_payload(usage_payload: Any) -> Optional[Dict[str, int]]:
+    if isinstance(usage_payload, dict):
+        prompt_tokens = int(usage_payload.get("input_tokens") or usage_payload.get("prompt_tokens") or 0)
+        completion_tokens = int(usage_payload.get("output_tokens") or usage_payload.get("completion_tokens") or 0)
+        total_tokens = int(usage_payload.get("total_tokens") or (prompt_tokens + completion_tokens))
+        return {
+            "prompt_tokens": prompt_tokens,
+            "completion_tokens": completion_tokens,
+            "total_tokens": total_tokens,
+        }
+    return None
+
+
+def _iter_sse_events(response: requests.Response):
+    event_name: Optional[str] = None
+    data_lines: List[str] = []
+
+    for raw_line in response.iter_lines(decode_unicode=True):
+        line = raw_line if isinstance(raw_line, str) else ""
+        if line == "":
+            if data_lines:
+                yield event_name, "\n".join(data_lines)
+            event_name = None
+            data_lines = []
+            continue
+        if line.startswith(":"):
+            continue
+        if line.startswith("event:"):
+            event_name = line[6:].strip()
+            continue
+        if line.startswith("data:"):
+            data_lines.append(line[5:].lstrip())
+
+    if data_lines:
+        yield event_name, "\n".join(data_lines)
+
+
+def _parse_sse_json_payload(event_name: Optional[str], event_data: str) -> Dict[str, Any]:
+    try:
+        payload = json.loads(event_data)
+    except ValueError as exc:
+        raise FoundryAgentInvocationError(
+            f"New Foundry stream returned invalid JSON payload: {event_data[:500]}"
+        ) from exc
+
+    if not isinstance(payload, dict):
+        raise FoundryAgentInvocationError("New Foundry stream returned an unexpected payload.")
+    if event_name and not payload.get("type"):
+        payload["type"] = event_name
+    return payload
+
+
+def _extract_new_foundry_event_error(event_payload: Dict[str, Any]) -> str:
+    error_payload = event_payload.get("error")
+    if isinstance(error_payload, dict):
+        message = error_payload.get("message") or json.dumps(error_payload)
+        return f"New Foundry stream failed: {message}"
+    if isinstance(error_payload, str) and error_payload.strip():
+        return f"New Foundry stream failed: {error_payload.strip()}"
+    return f"New Foundry stream failed: {json.dumps(event_payload, default=str)[:500]}"
+
+
+def _extract_new_foundry_stream_delta(event_payload: Dict[str, Any]) -> str:
+    event_type = str(event_payload.get("type") or "").strip()
+    if event_type != "response.output_text.delta":
+        return ""
+    delta_text = event_payload.get("delta")
+    return delta_text if isinstance(delta_text, str) else ""
+
+
+def _extract_response_payload_from_stream_event(event_payload: Dict[str, Any]) -> Optional[Dict[str, Any]]:
+    response_payload = event_payload.get("response")
+    if isinstance(response_payload, dict):
+        return response_payload
+    if isinstance(event_payload.get("output"), list):
+        return event_payload
+    return None
+
+
+def _extract_new_foundry_annotation(annotation: Any) -> Optional[Dict[str, Any]]:
+    if not isinstance(annotation, dict):
+        return None
+    url = annotation.get("url") or annotation.get("uri")
+    title = annotation.get("title") or annotation.get("name")
+    quote_text = annotation.get("quote") or annotation.get("text")
+    if not (url or title or quote_text):
+        return None
+    return {
+        "url": url,
+        "title": title,
+        "quote": quote_text,
+        "citation_type": annotation.get("type") or annotation.get("annotation_type"),
+    }
+
+
+def _merge_citations(existing: List[Dict[str, Any]], incoming: List[Dict[str, Any]]) -> List[Dict[str, Any]]:
+    merged = list(existing)
+    seen = {json.dumps(item, sort_keys=True, default=str) for item in existing}
+    for item in incoming:
+        key = json.dumps(item, sort_keys=True, default=str)
+        if key in seen:
+            continue
+        merged.append(item)
+        seen.add(key)
+    return merged
+
+
+def _update_new_foundry_stream_state(
+    *,
+    state: NewFoundryStreamState,
+    event_payload: Dict[str, Any],
+    application_name: str,
+) -> None:
+    response_payload = _extract_response_payload_from_stream_event(event_payload)
+    if response_payload:
+        state.model = str(response_payload.get("model") or state.model or application_name)
+        state.metadata.update(_extract_new_foundry_response_metadata(response_payload))
+        citations = _extract_new_foundry_citations(response_payload)
+        if citations:
+            state.citations = _merge_citations(state.citations, citations)
+        fallback_text = _extract_new_foundry_response_text(response_payload)
+        if fallback_text and not state.text_parts:
+            state.text_parts = [fallback_text]
+        return
+
+    event_type = str(event_payload.get("type") or "").strip()
+    if event_type == "response.output_text.annotation.added":
+        annotation = _extract_new_foundry_annotation(event_payload.get("annotation"))
+        if annotation:
+            state.citations = _merge_citations(state.citations, [annotation])
+        return
+
+    if event_type in {"response.output_item.added", "response.output_item.done"}:
+        item = event_payload.get("item")
+        if isinstance(item, dict):
+            item_citations = _extract_new_foundry_citations({"output": [item]})
+            if item_citations:
+                state.citations = _merge_citations(state.citations, item_citations)
+
+
+def _extract_new_foundry_stream_text(state: NewFoundryStreamState) -> str:
+    text = "".join(state.text_parts).strip()
+    if text:
+        return text
+    metadata_text = state.metadata.get("output_text")
+    return metadata_text.strip() if isinstance(metadata_text, str) else ""
+
+
+def _build_new_foundry_stream_metadata(
+    state: NewFoundryStreamState,
+    application_name: str,
+) -> Dict[str, Any]:
+    metadata = dict(state.metadata)
+    metadata["citations"] = state.citations
+    metadata["model"] = state.model or application_name
+    return metadata
+
+
+async def _list_foundry_agents_async(
+    *,
+    foundry_settings: Dict[str, Any],
+    global_settings: Dict[str, Any]
+) -> List[Dict[str, Any]]:
+    endpoint = _resolve_endpoint(foundry_settings, global_settings)
+    api_version = foundry_settings.get("api_version") or global_settings.get(
+        "azure_ai_foundry_api_version"
+    )
+    credential = _build_async_credential(foundry_settings, global_settings)
+    client = AzureAIAgent.create_client(
+        credential=credential,
+        endpoint=endpoint,
+        api_version=api_version,
+    )
+
+    async def resolve_agent_list():
+        agents_client = getattr(client, "agents", None)
+        if not agents_client:
+            raise FoundryAgentInvocationError("Foundry agents client not available.")
+        if hasattr(agents_client, "list_agents"):
+            return agents_client.list_agents()
+        if hasattr(agents_client, "list"):
+            return agents_client.list()
+        raise FoundryAgentInvocationError("Foundry agent list API not available.")
+
+    try:
+        result = await resolve_agent_list()
+        if hasattr(result, "__aiter__"):
+            items = []
+            async for item in result:
+                items.append(item)
+        elif isinstance(result, dict):
+            items = result.get("value") or result.get("data") or []
+        elif isinstance(result, list):
+            items = result
+        else:
+            items = getattr(result, "value", None) or getattr(result, "data", None) or []
+
+        normalized: List[Dict[str, Any]] = []
+        for item in items:
+            if isinstance(item, dict):
+                normalized.append({
+                    "id": item.get("id"),
+                    "name": item.get("name"),
+                    "display_name": item.get("display_name") or item.get("name"),
+                    "description": item.get("description") or "",
+                })
+                continue
+            normalized.append({
+                "id": getattr(item, "id", None),
+                "name": getattr(item, "name", None),
+                "display_name": getattr(item, "display_name", None) or getattr(item, "name", None),
+                "description": getattr(item, "description", None) or "",
+            })
+        return normalized
+    finally:
+        try:
+            await client.close()
+        finally:
+            await credential.close()
+
+
+def list_foundry_agents_from_endpoint(foundry_settings: Dict[str, Any], global_settings: Dict[str, Any]):
+    """Synchronously list Foundry agents using the provided endpoint configuration."""
+    return asyncio.run(
+        _list_foundry_agents_async(
+            foundry_settings=foundry_settings,
+            global_settings=global_settings,
+        )
+    )
+
+
+async def _list_new_foundry_agents_async(
+    *,
+    foundry_settings: Dict[str, Any],
+    global_settings: Dict[str, Any],
+) -> List[Dict[str, Any]]:
+    """List the latest new Foundry project agents/applications via the project REST API."""
+
+    endpoint = _resolve_endpoint(foundry_settings, global_settings)
+    api_version = (
+        foundry_settings.get("activity_api_version")
+        or foundry_settings.get("api_version")
+        or foundry_settings.get("responses_api_version")
+        or global_settings.get("azure_ai_foundry_api_version")
+        or "2025-11-15-preview"
+    )
+    credential = _build_async_credential(foundry_settings, global_settings)
+    scope = _resolve_foundry_scope(foundry_settings, global_settings)
+    token = await credential.get_token(scope)
+    url = f"{endpoint.rstrip('/')}/agents"
+    headers = {
+        "Authorization": f"Bearer {token.token}",
+        "Content-Type": "application/json",
+    }
+
+    try:
+        response = await asyncio.to_thread(
+            requests.get,
+            url,
+            params={"api-version": api_version},
+            headers=headers,
+            timeout=30,
+        )
+        payload = _parse_json_response(response)
+        if response.status_code >= 400:
+            raise FoundryAgentInvocationError(
+                _build_http_error_message("new Foundry agent list", response, payload)
+            )
+
+        items = payload.get("value") or payload.get("data") or payload.get("items") or []
+        normalized: List[Dict[str, Any]] = []
+        for item in items:
+            if not isinstance(item, dict):
+                continue
+
+            properties = item.get("properties") if isinstance(item.get("properties"), dict) else {}
+            version = str(
+                item.get("version")
+                or item.get("latest_version")
+                or item.get("latestVersion")
+                or item.get("agent_version")
+                or item.get("agentVersion")
+                or properties.get("version")
+                or properties.get("latest_version")
+                or properties.get("latestVersion")
+                or properties.get("agent_version")
+                or properties.get("agentVersion")
+                or _extract_nested_version_value(item.get("versions"))
+                or _extract_nested_version_value(properties.get("versions"))
+                or ""
+            ).strip()
+            name = str(
+                item.get("name")
+                or item.get("agent_name")
+                or item.get("agentName")
+                or properties.get("name")
+                or properties.get("agent_name")
+                or properties.get("agentName")
+                or ""
+            ).strip()
+            if not name:
+                continue
+
+            application_id = f"{name}:{version}" if version else name
+            display_name = str(
+                item.get("display_name")
+                or item.get("displayName")
+                or properties.get("display_name")
+                or properties.get("displayName")
+                or name
+            ).strip() or name
+            description = str(
+                item.get("description")
+                or properties.get("description")
+                or ""
+            ).strip()
+            responses_api_version = _extract_new_foundry_api_version(item, properties)
+
+            normalized.append(
+                {
+                    "id": application_id,
+                    "name": name,
+                    "display_name": display_name,
+                    "description": description,
+                    "application_id": application_id,
+                    "application_name": name,
+                    "application_version": version,
+                    "responses_api_version": responses_api_version,
+                }
+            )
+
+        return normalized
+    finally:
+        await credential.close()
+
+
+def list_new_foundry_agents_from_endpoint(foundry_settings: Dict[str, Any], global_settings: Dict[str, Any]):
+    """Synchronously list new Foundry agents/applications using the project REST API."""
+    return asyncio.run(
+        _list_new_foundry_agents_async(
+            foundry_settings=foundry_settings,
+            global_settings=global_settings,
+        )
+    )
+
+def resolve_foundry_project_base(endpoint, project_name):
+    if not endpoint:
+        raise ValueError("Missing Foundry endpoint")
+    base = endpoint.rstrip("/")
+    if "/api/projects/" in base:
+        return base
+    if project_name:
+        return f"{base}/api/projects/{project_name}"
+    raise ValueError("Foundry project name is required when endpoint does not include /api/projects/.")
+
+def resolve_foundry_project_api_version(api_version):
+    version = (api_version or "").strip()
+    if version and version.startswith("v"):
+        return version
+    return "v1"
+
+def resolve_authority(auth_settings):
+    management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+    if management_cloud == "government":
+        return "https://login.microsoftonline.us"
+    if management_cloud == "custom":
+        custom_authority = auth_settings.get("custom_authority") or ""
+        return custom_authority.strip() or None
+    return None
+
+def build_project_credential(auth_settings):
+    """Build a synchronous credential for sync discovery routes and SDK clients."""
+
+    auth_type = (auth_settings.get("type") or "managed_identity").lower()
+    if auth_type == "service_principal":
+        authority_override = resolve_authority(auth_settings)
+        return SyncClientSecretCredential(
+            tenant_id=auth_settings.get("tenant_id"),
+            client_id=auth_settings.get("client_id"),
+            client_secret=auth_settings.get("client_secret"),
+            authority=authority_override,
+        )
+    if auth_type == "api_key":
+        raise ValueError("API key auth is not supported for Foundry project discovery.")
+    managed_identity_client_id = auth_settings.get("managed_identity_client_id") or None
+    return SyncDefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
+
+def list_new_foundry_agents_from_project(endpoint_cfg):
+    connection = endpoint_cfg.get("connection", {}) or {}
+    auth = endpoint_cfg.get("auth", {}) or {}
+    foundry_settings = {
+        "endpoint": connection.get("endpoint"),
+        "project_name": connection.get("project_name") or "",
+        "activity_api_version": resolve_foundry_project_api_version(
+            connection.get("project_api_version") or connection.get("api_version") or "v1"
+        ),
+        "authentication_type": auth.get("type") or "managed_identity",
+        "managed_identity_type": auth.get("managed_identity_type") or "system_assigned",
+        "managed_identity_client_id": auth.get("managed_identity_client_id") or "",
+        "tenant_id": auth.get("tenant_id") or "",
+        "client_id": auth.get("client_id") or "",
+        "client_secret": auth.get("client_secret") or "",
+        "cloud": auth.get("management_cloud") or "",
+        "authority": auth.get("custom_authority") or "",
+    }
+    return list_new_foundry_agents_from_endpoint(foundry_settings, {})
diff --git a/application/single_app/functions_activity_logging.py b/application/single_app/functions_activity_logging.py
index efb6e780..68b34419 100644
--- a/application/single_app/functions_activity_logging.py
+++ b/application/single_app/functions_activity_logging.py
@@ -7,7 +7,7 @@
 import logging
 import uuid
 from datetime import datetime
-from typing import Optional
+from typing import Optional, Dict, Any
 from functions_appinsights import log_event
 from functions_debug import debug_print
 from config import cosmos_activity_logs_container
@@ -1395,8 +1395,70 @@ def log_retention_policy_force_push(
         debug_print(f"⚠️  Warning: Failed to log retention policy force push: {str(e)}")
 
 
-# === AGENT & ACTION ACTIVITY LOGGING ===
+def log_general_admin_action(
+    admin_user_id: str,
+    admin_email: str,
+    action: str,
+    description: Optional[str] = None,
+    additional_context: Optional[dict] = None
+) -> None:
+    """
+    Log a general admin action to the activity_logs container.
+
+    Args:
+        admin_user_id (str): User ID of the admin performing the action
+        admin_email (str): Email of the admin performing the action
+        action (str): Action name or identifier
+        description (str, optional): Human-readable description for display
+        additional_context (dict, optional): Additional context to store
+    """
+
+    try:
+        activity_record = {
+            'id': str(uuid.uuid4()),
+            'user_id': admin_user_id,
+            'activity_type': 'admin_action',
+            'timestamp': datetime.utcnow().isoformat(),
+            'created_at': datetime.utcnow().isoformat(),
+            'admin': {
+                'user_id': admin_user_id,
+                'email': admin_email
+            },
+            'action': action,
+            'description': description or action,
+            'workspace_type': 'admin',
+            'workspace_context': {
+                'action': action
+            }
+        }
+
+        if additional_context:
+            activity_record['additional_context'] = additional_context
+
+        cosmos_activity_logs_container.create_item(body=activity_record)
 
+        log_event(
+            message=f"Admin action logged: {action} by {admin_email}",
+            extra=activity_record,
+            level=logging.INFO
+        )
+        debug_print(f"✅ Admin action logged: {action} by {admin_email}")
+
+    except Exception as e:
+        log_event(
+            message=f"Error logging admin action: {str(e)}",
+            extra={
+                'admin_user_id': admin_user_id,
+                'admin_email': admin_email,
+                'action': action,
+                'error': str(e)
+            },
+            level=logging.ERROR
+        )
+        debug_print(f"⚠️  Warning: Failed to log admin action: {str(e)}")
+
+
+# === AGENT & ACTION ACTIVITY LOGGING ===
 def log_agent_creation(
     user_id: str,
     agent_id: str,
@@ -1722,3 +1784,177 @@ def log_action_deletion(
             level=logging.ERROR
         )
         debug_print(f"⚠️  Warning: Failed to log action deletion: {str(e)}")
+
+
+def _log_agent_template_activity(
+    user_id: str,
+    template_id: str,
+    template_name: str,
+    operation: str,
+    scope: str = 'personal',
+    actor: Optional[Dict[str, Any]] = None,
+    template_display_name: Optional[str] = None,
+    template_status: Optional[str] = None,
+    submitter: Optional[Dict[str, Any]] = None,
+    review_reason: Optional[str] = None,
+    review_notes: Optional[str] = None
+) -> None:
+    """Persist an agent template lifecycle activity entry."""
+    try:
+        activity_type_map = {
+            'submit': 'agent_template_submission',
+            'approve': 'agent_template_approval',
+            'reject': 'agent_template_rejection',
+            'delete': 'agent_template_deletion',
+        }
+        activity_type = activity_type_map.get(operation, f'agent_template_{operation}')
+        timestamp = datetime.utcnow().isoformat()
+
+        activity_record = {
+            'id': str(uuid.uuid4()),
+            'user_id': user_id,
+            'activity_type': activity_type,
+            'timestamp': timestamp,
+            'created_at': timestamp,
+            'entity_type': 'agent_template',
+            'operation': operation,
+            'entity': {
+                'id': template_id,
+                'name': template_name,
+                'display_name': template_display_name or template_name,
+                'status': template_status,
+            },
+            'workspace_type': scope,
+            'workspace_context': {},
+        }
+
+        if actor:
+            activity_record['actor'] = {
+                'user_id': actor.get('userId') or actor.get('user_id') or user_id,
+                'email': actor.get('email'),
+                'display_name': actor.get('displayName') or actor.get('display_name'),
+            }
+
+        if submitter:
+            activity_record['submitter'] = {
+                'user_id': submitter.get('userId') or submitter.get('user_id'),
+                'email': submitter.get('email'),
+                'display_name': submitter.get('displayName') or submitter.get('display_name'),
+            }
+
+        if review_reason:
+            activity_record['review_reason'] = review_reason
+        if review_notes:
+            activity_record['review_notes'] = review_notes
+
+        cosmos_activity_logs_container.create_item(body=activity_record)
+        log_event(
+            message=f"Agent template {operation}: {template_name} ({scope}) by user {user_id}",
+            extra=activity_record,
+            level=logging.INFO
+        )
+        debug_print(f"✅ Agent template {operation} logged: {template_name} ({scope})")
+    except Exception as e:
+        log_event(
+            message=f"Error logging agent template {operation}: {str(e)}",
+            extra={'user_id': user_id, 'template_id': template_id, 'scope': scope, 'error': str(e)},
+            level=logging.ERROR
+        )
+        debug_print(f"⚠️  Warning: Failed to log agent template {operation}: {str(e)}")
+
+
+def log_agent_template_submission(
+    user_id: str,
+    template_id: str,
+    template_name: str,
+    template_display_name: Optional[str] = None,
+    scope: str = 'personal',
+    template_status: Optional[str] = None,
+    submitter: Optional[Dict[str, Any]] = None
+) -> None:
+    _log_agent_template_activity(
+        user_id=user_id,
+        template_id=template_id,
+        template_name=template_name,
+        template_display_name=template_display_name,
+        template_status=template_status,
+        scope=scope,
+        operation='submit',
+        actor=submitter,
+        submitter=submitter,
+    )
+
+
+def log_agent_template_approval(
+    user_id: str,
+    template_id: str,
+    template_name: str,
+    template_display_name: Optional[str] = None,
+    scope: str = 'personal',
+    template_status: Optional[str] = None,
+    approver: Optional[Dict[str, Any]] = None,
+    submitter: Optional[Dict[str, Any]] = None,
+    review_notes: Optional[str] = None
+) -> None:
+    _log_agent_template_activity(
+        user_id=user_id,
+        template_id=template_id,
+        template_name=template_name,
+        template_display_name=template_display_name,
+        template_status=template_status,
+        scope=scope,
+        operation='approve',
+        actor=approver,
+        submitter=submitter,
+        review_notes=review_notes,
+    )
+
+
+def log_agent_template_rejection(
+    user_id: str,
+    template_id: str,
+    template_name: str,
+    template_display_name: Optional[str] = None,
+    scope: str = 'personal',
+    template_status: Optional[str] = None,
+    approver: Optional[Dict[str, Any]] = None,
+    submitter: Optional[Dict[str, Any]] = None,
+    review_reason: Optional[str] = None,
+    review_notes: Optional[str] = None
+) -> None:
+    _log_agent_template_activity(
+        user_id=user_id,
+        template_id=template_id,
+        template_name=template_name,
+        template_display_name=template_display_name,
+        template_status=template_status,
+        scope=scope,
+        operation='reject',
+        actor=approver,
+        submitter=submitter,
+        review_reason=review_reason,
+        review_notes=review_notes,
+    )
+
+
+def log_agent_template_deletion(
+    user_id: str,
+    template_id: str,
+    template_name: str,
+    template_display_name: Optional[str] = None,
+    scope: str = 'personal',
+    template_status: Optional[str] = None,
+    actor: Optional[Dict[str, Any]] = None,
+    submitter: Optional[Dict[str, Any]] = None
+) -> None:
+    _log_agent_template_activity(
+        user_id=user_id,
+        template_id=template_id,
+        template_name=template_name,
+        template_display_name=template_display_name,
+        template_status=template_status,
+        scope=scope,
+        operation='delete',
+        actor=actor,
+        submitter=submitter,
+    )
diff --git a/application/single_app/functions_agent_payload.py b/application/single_app/functions_agent_payload.py
index 2a7935a5..7a448606 100644
--- a/application/single_app/functions_agent_payload.py
+++ b/application/single_app/functions_agent_payload.py
@@ -4,7 +4,7 @@
 from copy import deepcopy
 from typing import Any, Dict, List
 
-_SUPPORTED_AGENT_TYPES = {"local", "aifoundry"}
+_SUPPORTED_AGENT_TYPES = {"local", "aifoundry", "new_foundry"}
 _APIM_FIELDS = [
     "azure_agent_apim_gpt_endpoint",
     "azure_agent_apim_gpt_subscription_key",
@@ -34,6 +34,9 @@
     "azure_agent_apim_gpt_endpoint",
     "azure_agent_apim_gpt_deployment",
     "azure_agent_apim_gpt_api_version",
+    "model_endpoint_id",
+    "model_id",
+    "model_provider",
 ]
 _STRING_DEFAULT_FIELDS = [
     "azure_openai_gpt_endpoint",
@@ -44,6 +47,9 @@
     "azure_agent_apim_gpt_subscription_key",
     "azure_agent_apim_gpt_deployment",
     "azure_agent_apim_gpt_api_version",
+    "model_endpoint_id",
+    "model_id",
+    "model_provider",
 ]
 _SERVER_MANAGED_FIELDS = [
     "_attachments",
@@ -74,6 +80,9 @@
     "azure_agent_apim_gpt_subscription_key": 1024,
     "azure_agent_apim_gpt_deployment": 256,
     "azure_agent_apim_gpt_api_version": 64,
+    "model_endpoint_id": 128,
+    "model_id": 128,
+    "model_provider": 32,
 }
 _FOUNDRY_FIELD_LENGTHS = {
     "agent_id": 128,
@@ -85,6 +94,21 @@
     "client_secret": 1024,
     "managed_identity_client_id": 64,
 }
+_NEW_FOUNDRY_FIELD_LENGTHS = {
+    "application_id": 256,
+    "application_name": 200,
+    "application_version": 64,
+    "endpoint": 2048,
+    "project_name": 256,
+    "responses_api_version": 64,
+    "activity_api_version": 64,
+    "authority": 2048,
+    "tenant_id": 64,
+    "client_id": 64,
+    "client_secret": 1024,
+    "managed_identity_client_id": 64,
+    "notes": 2000,
+}
 
 
 class AgentPayloadError(ValueError):
@@ -95,7 +119,15 @@ def is_azure_ai_foundry_agent(agent: Dict[str, Any]) -> bool:
     """Return True when the agent type is Azure AI Foundry."""
     agent_type = (agent or {}).get("agent_type", "local")
     if isinstance(agent_type, str):
-        return agent_type.strip().lower() == "aifoundry"
+        return agent_type.strip().lower() in {"aifoundry", "new_foundry"}
+    return False
+
+
+def is_new_foundry_agent(agent: Dict[str, Any]) -> bool:
+    """Return True when the agent type is the new Foundry experience."""
+    agent_type = (agent or {}).get("agent_type", "local")
+    if isinstance(agent_type, str):
+        return agent_type.strip().lower() == "new_foundry"
     return False
 
 
@@ -162,6 +194,21 @@ def _validate_foundry_field_lengths(foundry_settings: Dict[str, Any]) -> None:
             raise AgentPayloadError(f"azure_ai_foundry.{field} exceeds maximum length of {max_len}.")
 
 
+def _validate_new_foundry_field_lengths(new_foundry_settings: Dict[str, Any]) -> None:
+    for field, max_len in _NEW_FOUNDRY_FIELD_LENGTHS.items():
+        value = new_foundry_settings.get(field, "")
+        if isinstance(value, str) and len(value) > max_len:
+            raise AgentPayloadError(f"new_foundry.{field} exceeds maximum length of {max_len}.")
+
+
+def _strip_empty_values(payload: Dict[str, Any]) -> Dict[str, Any]:
+    return {
+        key: value
+        for key, value in payload.items()
+        if value not in (None, "")
+    }
+
+
 def _strip_server_managed_fields(payload: Dict[str, Any]) -> None:
     for field in _SERVER_MANAGED_FIELDS:
         payload.pop(field, None)
@@ -216,6 +263,83 @@ def sanitize_agent_payload(agent: Dict[str, Any]) -> Dict[str, Any]:
         foundry_settings["agent_id"] = agent_id
         _validate_foundry_field_lengths(foundry_settings)
         sanitized["other_settings"]["azure_ai_foundry"] = foundry_settings
+        sanitized["other_settings"].pop("new_foundry", None)
+    elif agent_type == "new_foundry":
+        sanitized["enable_agent_gpt_apim"] = False
+        for field in _APIM_FIELDS:
+            sanitized.pop(field, None)
+        sanitized["actions_to_load"] = []
+
+        new_foundry_settings = sanitized["other_settings"].get("new_foundry")
+        if not isinstance(new_foundry_settings, dict):
+            raise AgentPayloadError(
+                "New Foundry agents require other_settings.new_foundry."
+            )
+
+        application_id = str(new_foundry_settings.get("application_id", "")).strip()
+        application_name = str(new_foundry_settings.get("application_name", "")).strip()
+        application_version = str(new_foundry_settings.get("application_version", "")).strip()
+
+        if not application_id:
+            if application_name and application_version:
+                application_id = f"{application_name}:{application_version}"
+            elif application_name:
+                application_id = application_name
+
+        if not application_id:
+            raise AgentPayloadError(
+                "New Foundry agents require other_settings.new_foundry.application_id or application_name."
+            )
+
+        if ":" in application_id and not application_name:
+            parsed_name, parsed_version = application_id.split(":", 1)
+            application_name = application_name or parsed_name.strip()
+            application_version = application_version or parsed_version.strip()
+
+        new_foundry_settings["application_id"] = application_id
+        if application_name:
+            new_foundry_settings["application_name"] = application_name
+        if application_version:
+            new_foundry_settings["application_version"] = application_version
+
+        response_version = str(
+            new_foundry_settings.get("responses_api_version")
+            or sanitized.get("azure_openai_gpt_api_version")
+            or ""
+        ).strip()
+        if not response_version:
+            raise AgentPayloadError(
+                "New Foundry agents require other_settings.new_foundry.responses_api_version or azure_openai_gpt_api_version."
+            )
+        new_foundry_settings["responses_api_version"] = response_version
+
+        activity_version = str(new_foundry_settings.get("activity_api_version", "")).strip()
+        if activity_version:
+            new_foundry_settings["activity_api_version"] = activity_version
+
+        endpoint = str(
+            new_foundry_settings.get("endpoint")
+            or sanitized.get("azure_openai_gpt_endpoint")
+            or ""
+        ).strip()
+        if endpoint:
+            new_foundry_settings["endpoint"] = endpoint
+            sanitized["azure_openai_gpt_endpoint"] = endpoint
+
+        project_name = str(
+            new_foundry_settings.get("project_name")
+            or sanitized.get("azure_openai_gpt_deployment")
+            or ""
+        ).strip()
+        if project_name:
+            new_foundry_settings["project_name"] = project_name
+            sanitized["azure_openai_gpt_deployment"] = project_name
+
+        sanitized["azure_openai_gpt_api_version"] = response_version
+
+        _validate_new_foundry_field_lengths(new_foundry_settings)
+        sanitized["other_settings"]["new_foundry"] = _strip_empty_values(new_foundry_settings)
+        sanitized["other_settings"].pop("azure_ai_foundry", None)
     else:
         # Remove stale foundry metadata when toggling back to local agents.
         azure_foundry = sanitized["other_settings"].get("azure_ai_foundry")
@@ -223,5 +347,10 @@ def sanitize_agent_payload(agent: Dict[str, Any]) -> Dict[str, Any]:
             raise AgentPayloadError("azure_ai_foundry must be an object when provided.")
         if azure_foundry:
             sanitized["other_settings"].pop("azure_ai_foundry", None)
+        new_foundry = sanitized["other_settings"].get("new_foundry")
+        if new_foundry is not None and not isinstance(new_foundry, dict):
+            raise AgentPayloadError("new_foundry must be an object when provided.")
+        if new_foundry:
+            sanitized["other_settings"].pop("new_foundry", None)
 
     return sanitized
\ No newline at end of file
diff --git a/application/single_app/functions_agent_templates.py b/application/single_app/functions_agent_templates.py
index 10838fd6..f5cda8a3 100644
--- a/application/single_app/functions_agent_templates.py
+++ b/application/single_app/functions_agent_templates.py
@@ -17,7 +17,14 @@
 from flask import current_app
 
 from config import cosmos_agent_templates_container
+from functions_activity_logging import (
+    log_agent_template_submission,
+    log_agent_template_approval,
+    log_agent_template_rejection,
+    log_agent_template_deletion,
+)
 from functions_appinsights import log_event
+from functions_notifications import create_notification, delete_notifications_by_metadata
 
 STATUS_PENDING = "pending"
 STATUS_APPROVED = "approved"
@@ -25,6 +32,8 @@
 STATUS_ARCHIVED = "archived"
 ALLOWED_STATUSES = {STATUS_PENDING, STATUS_APPROVED, STATUS_REJECTED, STATUS_ARCHIVED}
 
+TEMPLATE_APPROVAL_ADMIN_NOTIFICATION_TYPES = ['agent_template_pending_admin']
+
 _MAX_TEMPLATE_FIELD_LENGTHS = {
     "title": 200,
     "display_name": 200,
@@ -115,6 +124,93 @@ def _sanitize_template(doc: Dict[str, Any], include_internal: bool = False) -> D
     return cleaned
 
 
+def _template_detail_link(doc: Dict[str, Any]) -> str:
+    scope = (doc.get('source_scope') or 'personal').lower()
+    if scope == 'global':
+        return '/approvals#agent-template-approvals'
+    if scope == 'group':
+        return '/group_workspaces'
+    return '/workspace'
+
+
+def _create_submitter_notification(
+    doc: Dict[str, Any],
+    notification_type: str,
+    title: str,
+    message: str,
+    metadata: Optional[Dict[str, Any]] = None
+) -> None:
+    submitter_id = doc.get('created_by')
+    if not submitter_id:
+        return
+
+    create_notification(
+        user_id=submitter_id,
+        notification_type=notification_type,
+        title=title,
+        message=message,
+        link_url=_template_detail_link(doc),
+        link_context={
+            'template_id': doc.get('id'),
+            'source_scope': doc.get('source_scope')
+        },
+        metadata={
+            'template_id': doc.get('id'),
+            'template_title': doc.get('title') or doc.get('display_name'),
+            'source_scope': doc.get('source_scope')
+        } | (metadata or {})
+    )
+
+
+def _submitter_info(doc: Dict[str, Any]) -> Dict[str, Any]:
+    return {
+        'userId': doc.get('created_by'),
+        'email': doc.get('created_by_email'),
+        'displayName': doc.get('created_by_name'),
+    }
+
+
+def _create_pending_notifications(doc: Dict[str, Any]) -> None:
+    title = doc.get('title') or doc.get('display_name') or 'Agent Template'
+    submitter_name = doc.get('created_by_name') or 'A user'
+
+    create_notification(
+        notification_type='agent_template_pending_admin',
+        title=f'Template Approval Required: {title}',
+        message=f"{submitter_name} submitted '{title}' for review.",
+        link_url='/approvals#agent-template-approvals',
+        link_context={
+            'template_id': doc.get('id')
+        },
+        metadata={
+            'template_id': doc.get('id'),
+            'template_title': title,
+            'submitter_email': doc.get('created_by_email'),
+            'submitter_name': submitter_name
+        },
+        assignment={
+            'roles': ['Admin']
+        }
+    )
+
+    _create_submitter_notification(
+        doc,
+        notification_type='agent_template_pending_submitter',
+        title=f'Template Submitted: {title}',
+        message=(
+            f"Your template '{title}' was submitted for admin review. "
+            'You will receive another notification when a decision is made.'
+        )
+    )
+
+
+def _clear_pending_admin_notifications(template_id: str) -> None:
+    delete_notifications_by_metadata(
+        metadata_filters={'template_id': template_id},
+        notification_types=TEMPLATE_APPROVAL_ADMIN_NOTIFICATION_TYPES
+    )
+
+
 def _validate_template_lengths(payload: Dict[str, Any]) -> None:
     for field, max_len in _MAX_TEMPLATE_FIELD_LENGTHS.items():
         value = payload.get(field, "")
@@ -237,6 +333,20 @@ def create_agent_template(payload: Dict[str, Any], user_info: Optional[Dict[str,
             "created_by": template.get('created_by'),
         },
     )
+
+    if not auto_approve:
+        _create_pending_notifications(template)
+
+    log_agent_template_submission(
+        user_id=template.get('created_by') or 'unknown',
+        template_id=template['id'],
+        template_name=template.get('title') or template.get('display_name') or 'Agent Template',
+        template_display_name=template.get('display_name'),
+        scope=template.get('source_scope') or 'personal',
+        template_status=template.get('status'),
+        submitter=_submitter_info(template),
+    )
+
     return _sanitize_template(template, include_internal=True)
 
 
@@ -309,6 +419,33 @@ def approve_agent_template(template_id: str, approver_info: Dict[str, Any], note
         "Agent template approved",
         extra={"template_id": template_id, "approved_by": doc['approved_by']},
     )
+
+    _clear_pending_admin_notifications(template_id)
+    _create_submitter_notification(
+        doc,
+        notification_type='agent_template_approved',
+        title=f"Template Approved: {doc.get('title') or doc.get('display_name') or 'Agent Template'}",
+        message=(
+            f"Your template '{doc.get('title') or doc.get('display_name') or 'Agent Template'}' "
+            f"was approved by {approver_info.get('displayName') or approver_info.get('email') or 'an admin'}."
+        ),
+        metadata={
+            'review_notes': notes
+        }
+    )
+
+    log_agent_template_approval(
+        user_id=approver_info.get('userId') or 'unknown',
+        template_id=template_id,
+        template_name=doc.get('title') or doc.get('display_name') or 'Agent Template',
+        template_display_name=doc.get('display_name'),
+        scope=doc.get('source_scope') or 'personal',
+        template_status=doc.get('status'),
+        approver=approver_info,
+        submitter=_submitter_info(doc),
+        review_notes=notes,
+    )
+
     return _sanitize_template(doc, include_internal=True)
 
 
@@ -334,12 +471,75 @@ def reject_agent_template(template_id: str, approver_info: Dict[str, Any], reaso
         "Agent template rejected",
         extra={"template_id": template_id, "approved_by": doc['approved_by']},
     )
+
+    _clear_pending_admin_notifications(template_id)
+    _create_submitter_notification(
+        doc,
+        notification_type='agent_template_rejected',
+        title=f"Template Declined: {doc.get('title') or doc.get('display_name') or 'Agent Template'}",
+        message=(
+            f"Your template '{doc.get('title') or doc.get('display_name') or 'Agent Template'}' "
+            f"was declined by {approver_info.get('displayName') or approver_info.get('email') or 'an admin'}. "
+            f"Reason provided: {reason}"
+        ),
+        metadata={
+            'rejection_reason': reason,
+            'review_notes': notes
+        }
+    )
+
+    log_agent_template_rejection(
+        user_id=approver_info.get('userId') or 'unknown',
+        template_id=template_id,
+        template_name=doc.get('title') or doc.get('display_name') or 'Agent Template',
+        template_display_name=doc.get('display_name'),
+        scope=doc.get('source_scope') or 'personal',
+        template_status=doc.get('status'),
+        approver=approver_info,
+        submitter=_submitter_info(doc),
+        review_reason=reason,
+        review_notes=notes,
+    )
+
     return _sanitize_template(doc, include_internal=True)
 
 
-def delete_agent_template(template_id: str) -> bool:
+def delete_agent_template(template_id: str, actor_info: Optional[Dict[str, Any]] = None) -> bool:
     try:
+        doc = get_agent_template(template_id)
+        if not doc:
+            return False
+
         cosmos_agent_templates_container.delete_item(item=template_id, partition_key=template_id)
+        _clear_pending_admin_notifications(template_id)
+
+        if actor_info:
+            actor_name = actor_info.get('displayName') or actor_info.get('email') or 'an admin'
+            _create_submitter_notification(
+                doc,
+                notification_type='agent_template_deleted',
+                title=f"Template Removed: {doc.get('title') or doc.get('display_name') or 'Agent Template'}",
+                message=(
+                    f"Your template '{doc.get('title') or doc.get('display_name') or 'Agent Template'}' "
+                    f"was removed by {actor_name}."
+                ),
+                metadata={
+                    'removed_by': actor_name,
+                    'previous_status': doc.get('status')
+                }
+            )
+
+        log_agent_template_deletion(
+            user_id=(actor_info or {}).get('userId') or doc.get('created_by') or 'unknown',
+            template_id=template_id,
+            template_name=doc.get('title') or doc.get('display_name') or 'Agent Template',
+            template_display_name=doc.get('display_name'),
+            scope=doc.get('source_scope') or 'personal',
+            template_status=doc.get('status'),
+            actor=actor_info,
+            submitter=_submitter_info(doc),
+        )
+
         log_event("Agent template deleted", extra={"template_id": template_id})
         return True
     except exceptions.CosmosResourceNotFoundError:
diff --git a/application/single_app/functions_appinsights.py b/application/single_app/functions_appinsights.py
index 41e535e5..1abcf6db 100644
--- a/application/single_app/functions_appinsights.py
+++ b/application/single_app/functions_appinsights.py
@@ -67,7 +67,7 @@ def log_event(
         if level >= logging.ERROR and exceptionTraceback:
             if logger and hasattr(logger, 'exception'):
                 if cache and cache.get('enable_debug_logging', False):
-                    print(f"DEBUG: [ERROR][Log] {message} -- {extra if extra else 'No Extra Dimensions'}")
+                    print(f"[DEBUG][ERROR][Log] {message} -- {extra if extra else 'No Extra Dimensions'}")
                 # Use logger.exception() for better exception capture in Application Insights
                 logger.exception(message, extra=extra, stacklevel=stacklevel, stack_info=includeStack, exc_info=True)
                 return
@@ -79,7 +79,7 @@ def log_event(
 
         #TODO: Find a way to cache get_settings() globally (and update it when changed) to enable debug printing. Cannot use debug_print due to circular import
         if cache and cache.get('enable_debug_logging', False):
-            print(f"DEBUG: [Log] {message} -- {extra if extra else 'No Extra Dimensions'}")  # Debug print to console
+            print(f"[DEBUG][Log] {message} -- {extra if extra else 'No Extra Dimensions'}")  # Debug print to console
         if extra:
             # For modern Azure Monitor, extra properties are automatically captured
             logger.log(
@@ -102,7 +102,7 @@ def log_event(
         # For Azure Monitor, ensure exception-level logs are properly categorized
         if level >= logging.ERROR and _azure_monitor_configured:
             # Add a debug print to verify exception logging is working
-            print(f"[Azure Monitor] Exception logged: {message[:100]}...")
+            print(f"[Azure Monitor][ERROR] Exception logged: {message[:100]}...")
 
     except Exception as e:
         # Fallback to basic logging if anything fails
@@ -117,7 +117,7 @@ def log_event(
                 fallback_message += f" | Extra: {extra}"
 
             fallback_logger.log(level, fallback_message)
-        except:
+        except Exception as ex:
             # If even basic logging fails, print to console
             print(f"[LOG] {message}")
             if extra:
diff --git a/application/single_app/functions_approvals.py b/application/single_app/functions_approvals.py
index 14b803cd..a6c73346 100644
--- a/application/single_app/functions_approvals.py
+++ b/application/single_app/functions_approvals.py
@@ -12,7 +12,7 @@
 from typing import Optional, List, Dict, Any
 from config import cosmos_approvals_container, cosmos_groups_container
 from functions_appinsights import log_event
-from functions_notifications import create_notification
+from functions_notifications import create_notification, delete_notifications_by_metadata
 from functions_group import find_group_by_id
 from functions_debug import debug_print
 
@@ -35,6 +35,8 @@
 TTL_AUTO_DENY_DAYS = 3
 TTL_AUTO_DENY_SECONDS = TTL_AUTO_DENY_DAYS * 24 * 60 * 60  # 3 days in seconds
 
+PENDING_APPROVAL_ADMIN_NOTIFICATION_TYPES = ['approval_request_pending']
+
 
 def create_approval_request(
     request_type: str,
@@ -92,7 +94,11 @@ def create_approval_request(
                 
                 # Set group to workspace for notification purposes
                 group = workspace
-            except:
+            except Exception as ex:
+                log_event("[Approvals] Workspace not found for approval request", {
+                    'group_id': group_id,
+                    'request_type': request_type
+                }, level=logging.ERROR)
                 raise ValueError(f"Workspace {group_id} not found")
         else:
             # Get group details for group-based approvals
@@ -149,6 +155,7 @@ def create_approval_request(
         
         # Create notifications for eligible approvers
         _create_approval_notifications(approval_request, group if request_type != TYPE_DELETE_USER_DOCUMENTS else None)
+        _create_requester_pending_notification(approval_request)
         
         return approval_request
         
@@ -319,6 +326,8 @@ def approve_request(
             'comment': comment
         })
         debug_print(f"Approved request: {approval}")    
+
+        _clear_pending_admin_notifications(approval_id)
         
         # Create notification for requester
         create_notification(
@@ -410,14 +419,20 @@ def deny_request(
             'comment': comment
         })
         debug_print(f"Request denied: {approval_id}")
+
+        _clear_pending_admin_notifications(approval_id)
         
         # Create notification for requester (only if not auto-denied)
         if not auto_denied:
+            reason_suffix = f" Reason provided: {comment}" if comment else ""
             create_notification(
                 user_id=approval['requester_id'],
                 notification_type='approval_request_denied',
                 title=f"Request Denied: {_format_request_type(approval['request_type'])}",
-                message=f"Your request for {approval['group_name']} was denied by {denier_name}.",
+                message=(
+                    f"Your request for {approval['group_name']} was denied by {denier_name}."
+                    f"{reason_suffix}"
+                ),
                 link_url='/approvals',
                 link_context={
                     'approval_id': approval_id
@@ -830,6 +845,50 @@ def _create_approval_notifications(
         # Don't raise - notifications are non-critical
 
 
+def _create_requester_pending_notification(approval: Dict[str, Any]) -> None:
+    """Notify the requester that their approval request is awaiting review."""
+    try:
+        create_notification(
+            user_id=approval['requester_id'],
+            notification_type='approval_request_pending_submitter',
+            title=f"Request Submitted: {_format_request_type(approval['request_type'])}",
+            message=(
+                f"Your request for {approval['group_name']} is pending approval. "
+                "You'll be notified when a reviewer makes a decision."
+            ),
+            link_url='/approvals',
+            link_context={
+                'approval_id': approval['id']
+            },
+            metadata={
+                'approval_id': approval['id'],
+                'request_type': approval['request_type'],
+                'group_id': approval['group_id']
+            }
+        )
+    except Exception as e:
+        log_event("[Approvals] Error notifying requester of pending approval", {
+            'error': str(e),
+            'approval_id': approval['id']
+        }, level=logging.WARNING)
+        debug_print(f"Error notifying requester of pending approval {approval['id']}: {e}")
+
+
+def _clear_pending_admin_notifications(approval_id: str) -> None:
+    """Remove stale pending-review notifications once an approval is resolved."""
+    try:
+        delete_notifications_by_metadata(
+            metadata_filters={'approval_id': approval_id},
+            notification_types=PENDING_APPROVAL_ADMIN_NOTIFICATION_TYPES
+        )
+    except Exception as e:
+        log_event("[Approvals] Error clearing pending admin notifications", {
+            'error': str(e),
+            'approval_id': approval_id
+        }, level=logging.WARNING)
+        debug_print(f"Error clearing pending admin notifications for {approval_id}: {e}")
+
+
 def _format_request_type(request_type: str) -> str:
     """
     Format request type for display.
diff --git a/application/single_app/functions_authentication.py b/application/single_app/functions_authentication.py
index 79487696..8bdf4b5c 100644
--- a/application/single_app/functions_authentication.py
+++ b/application/single_app/functions_authentication.py
@@ -6,6 +6,7 @@
 
 # Default redirect path for OAuth consent flow (must match your Azure AD app registration)
 REDIRECT_PATH = getattr(globals(), 'REDIRECT_PATH', '/getAToken')
+REQUESTED_SCOPES_SESSION_KEY = "requested_oauth_scopes"
 #REDIRECT_PATH = getattr(globals(), 'REDIRECT_PATH', '/.auth/login/aad/callback')
 
 def build_front_door_urls(front_door_url):
@@ -63,18 +64,93 @@ def _build_msal_app(cache=None, authority_override=None):
     )
 
 
+def _normalize_scopes(scopes=None):
+    """Return a de-duplicated scope list while preserving the original order."""
+    normalized_scopes = []
+    for scope in scopes or SCOPE:
+        if isinstance(scope, str) and scope and scope not in normalized_scopes:
+            normalized_scopes.append(scope)
+    return normalized_scopes or list(SCOPE)
+
+
+def set_requested_oauth_scopes(scopes=None):
+    """Persist the scopes required for the next interactive OAuth callback."""
+    session[REQUESTED_SCOPES_SESSION_KEY] = _normalize_scopes(scopes)
+
+
+def get_requested_oauth_scopes(clear_after_read=False):
+    """Return the currently requested OAuth scopes, optionally clearing them."""
+    stored_scopes = _normalize_scopes(session.get(REQUESTED_SCOPES_SESSION_KEY))
+    if clear_after_read:
+        session.pop(REQUESTED_SCOPES_SESSION_KEY, None)
+    return stored_scopes
+
+
+def clear_requested_oauth_scopes():
+    """Clear any interactive OAuth scope request state from the session."""
+    session.pop(REQUESTED_SCOPES_SESSION_KEY, None)
+
+
+def _build_redirect_url(host_url):
+    """Build the absolute redirect URL used for interactive OAuth flows."""
+    normalized_host_url = host_url.rstrip('/')
+    if not (
+        normalized_host_url.startswith('http://localhost')
+        or normalized_host_url.startswith('http://127.0.0.1')
+    ):
+        if not normalized_host_url.startswith('https://'):
+            normalized_host_url = 'https://' + normalized_host_url.split('://', 1)[-1]
+    return normalized_host_url + REDIRECT_PATH
+
+
+def _build_plugin_auth_response(
+    msal_app,
+    user_info,
+    scopes,
+    error,
+    message,
+    error_code=None,
+    error_description=None,
+    prompt=None,
+):
+    """Create a structured interactive authentication response for plugin callers."""
+    required_scopes = _normalize_scopes(scopes)
+    set_requested_oauth_scopes(required_scopes)
+
+    redirect_url = _build_redirect_url(request.host_url)
+    debug_print(f"[Auth] Redirect URL for {user_info.get('oid')}: {redirect_url}")
+    consent_url = get_consent_url(
+        msal_app=msal_app,
+        scopes=required_scopes,
+        redirect_uri=redirect_url,
+        prompt=prompt,
+    )
+    debug_print(f"[Auth] Interactive auth URL generated for scopes {required_scopes}")
+
+    return {
+        "error": error,
+        "message": message,
+        "consent_url": consent_url,
+        "auth_url": consent_url,
+        "scopes": required_scopes,
+        "error_code": error_code,
+        "error_description": error_description,
+    }
+
+
 # Helper: Generate a consent URL for user to grant permissions
-def get_consent_url(msal_app=None, scopes=None, redirect_uri=None, state=None, prompt="consent"):
+def get_consent_url(msal_app=None, scopes=None, redirect_uri=None, state=None, prompt=None):
     msal_app = _build_msal_app() if msal_app is None else msal_app
-    required_scopes = scopes or SCOPE
+    required_scopes = _normalize_scopes(scopes)
     # Use a default redirect URI if not provided
     redirect_uri = redirect_uri or REDIRECT_PATH
-    auth_url = msal_app.get_authorization_request_url(
-        required_scopes,
-        redirect_uri=redirect_uri,
-        state=state,
-        prompt=prompt
-    )
+    auth_request_kwargs = {
+        "redirect_uri": redirect_uri,
+        "state": state,
+    }
+    if prompt:
+        auth_request_kwargs["prompt"] = prompt
+    auth_url = msal_app.get_authorization_request_url(required_scopes, **auth_request_kwargs)
     return auth_url
 
 def get_valid_access_token(scopes=None):
@@ -87,7 +163,7 @@ def get_valid_access_token(scopes=None):
         debug_print("get_valid_access_token: No user in session.")
         return None # User not logged in
 
-    required_scopes = scopes or SCOPE # Use default SCOPE if none provided
+    required_scopes = _normalize_scopes(scopes) # Use default SCOPE if none provided
 
     msal_app = _build_msal_app(cache=_load_cache(), authority_override=get_graph_authority())
     user_info = session.get("user", {})
@@ -159,7 +235,7 @@ def get_valid_access_token_for_plugins(scopes=None):
             "error_description": "No user in session."
         }
 
-    required_scopes = scopes or SCOPE # Use default SCOPE if none provided
+    required_scopes = _normalize_scopes(scopes) # Use default SCOPE if none provided
 
     msal_app = _build_msal_app(cache=_load_cache(), authority_override=get_graph_authority())
     user_info = session.get("user", {})
@@ -195,51 +271,55 @@ def get_valid_access_token_for_plugins(scopes=None):
 
     if result and "access_token" in result:
         debug_print(f"get_valid_access_token: Token acquired silently for scopes: {required_scopes}")
+        clear_requested_oauth_scopes()
         return {"access_token": result['access_token']}
 
     # If we reach here, it means silent acquisition failed
-    debug_print("get_valid_access_token: acquire_token_silent failed. Needs re-authentication or received invalid grants.")
-    if result is None: # Assume invalid grants or no token
-        debug_print("result is None: get_valid_access_token: Consent required.")
-        host_url = request.host_url.rstrip('/')
-        # Only enforce https if not localhost or 127.0.0.1
-        if not (host_url.startswith('http://localhost') or host_url.startswith('http://127.0.0.1')):
-            if not host_url.startswith('https://'):
-                host_url = 'https://' + host_url.split('://', 1)[-1]
-        redirect_url = host_url + REDIRECT_PATH
-        logging.debug(f"Redirect URL for {user_info.get('oid')}: {redirect_url}")
-        consent_url = get_consent_url(msal_app=msal_app ,scopes=required_scopes, redirect_uri=redirect_url)
-        logging.debug(f"Consent URL: {consent_url}")
-        return {
-            "error": "consent_required",
-            "message": "User consent is required to access this resource. Present to the user so the consent url opens in a new tab.",
-            "consent_url": consent_url,
-            "scopes": required_scopes,
-            "error_code": None,
-            "error_description": "No token result; interactive authentication required."
-        }
+    debug_print("[Auth] acquire_token_silent_with_error failed. Evaluating interactive auth requirements.")
+    if result is None:
+        debug_print("[Auth] Silent token lookup returned no result. Interactive sign-in is required.")
+        return _build_plugin_auth_response(
+            msal_app,
+            user_info,
+            required_scopes,
+            error="interactive_auth_required",
+            message=(
+                "Interactive sign-in is required to access this Microsoft Graph resource. "
+                "If the permission is already granted, the auth flow should complete without prompting for consent."
+            ),
+            error_description="No token result; interactive authentication required.",
+        )
 
     error_code = result.get('error') if result else None
     error_desc = result.get('error_description') if result else None
-    debug_print(f"MSAL Error: {error_code}, Description: {error_desc}")
+    debug_print(f"[Auth] MSAL Error: {error_code}, Description: {error_desc}")
 
     if error_code == "invalid_grant" and error_desc and ("AADSTS65001" in error_desc or "consent_required" in error_desc):
-        host_url = request.host_url.rstrip('/')
-        if not (host_url.startswith('http://localhost') or host_url.startswith('http://127.0.0.1')):
-            if not host_url.startswith('https://'):
-                host_url = 'https://' + host_url.split('://', 1)[-1]
-        redirect_url = host_url + REDIRECT_PATH
-        logging.debug(f"Redirect URL for {user_info.get('oid')}: {redirect_url}")
-        consent_url = get_consent_url(msal_app=msal_app ,scopes=required_scopes, redirect_uri=redirect_url)
-        logging.debug(f"Consent URL: {consent_url}")
-        return {
-            "error": "consent_required",
-            "message": "User consent is required to access this resource. Present to the user so the consent url opens in a new tab.",
-            "consent_url": consent_url,
-            "scopes": required_scopes,
-            "error_code": error_code,
-            "error_description": error_desc
-        }
+        debug_print("[Auth] Entra explicitly reported missing consent for the requested scopes.")
+        return _build_plugin_auth_response(
+            msal_app,
+            user_info,
+            required_scopes,
+            error="consent_required",
+            message="User consent is required to access this Microsoft Graph resource.",
+            error_code=error_code,
+            error_description=error_desc,
+            prompt="consent",
+        )
+    if error_code in {"interaction_required", "login_required"}:
+        debug_print("[Auth] Entra requested an interactive sign-in without requiring new consent.")
+        return _build_plugin_auth_response(
+            msal_app,
+            user_info,
+            required_scopes,
+            error="interactive_auth_required",
+            message=(
+                "Interactive sign-in is required to refresh this Microsoft Graph session. "
+                "If permissions are already granted, the auth flow should complete without another consent prompt."
+            ),
+            error_code=error_code,
+            error_description=error_desc,
+        )
     else:
         return {
             "error": "token_acquisition_failed",
diff --git a/application/single_app/functions_content.py b/application/single_app/functions_content.py
index e9636bb7..4a9576e5 100644
--- a/application/single_app/functions_content.py
+++ b/application/single_app/functions_content.py
@@ -254,20 +254,16 @@ def chunk_text(text, chunk_size=2000, overlap=200):
         print(f"Error in chunk_text: {e}")
         raise e  # Re-raise the exception to propagate it
     
-def chunk_word_file_into_pages(di_pages):
+def chunk_word_file_into_pages(di_pages, chunk_size=WORD_CHUNK_SIZE):
     """
-    Chunks the content extracted from a Word document by Azure DI into smaller
-    chunks based on a target word count.
+    Chunk Azure DI Word pages into smaller word-based segments.
 
     Args:
-        di_pages (list): A list of dictionaries, where each dictionary represents
-                         a page extracted by Azure DI and contains at least a
-                         'page_number' and 'content' key.
+        di_pages (list): Pages returned from DI with page_number/content keys.
+        chunk_size (int): Target number of words per chunk (defaults to config).
 
     Returns:
-        list: A new list of dictionaries, where each dictionary represents a
-              smaller chunk with 'page_number' (representing the chunk sequence)
-              and 'content' (the chunked text).
+        list: A list of dicts with chunked content and sequence numbers.
     """
     new_pages = []
     current_chunk_content = []
@@ -284,7 +280,7 @@ def chunk_word_file_into_pages(di_pages):
             current_word_count += 1
 
             # If the chunk reaches the desired size, finalize it
-            if current_word_count >= WORD_CHUNK_SIZE:
+            if current_word_count >= chunk_size:
                 chunk_text = " ".join(current_chunk_content)
                 new_pages.append({
                     "page_number": new_page_number,
diff --git a/application/single_app/functions_conversation_metadata.py b/application/single_app/functions_conversation_metadata.py
index 7f829a5e..6fac1a55 100644
--- a/application/single_app/functions_conversation_metadata.py
+++ b/application/single_app/functions_conversation_metadata.py
@@ -276,11 +276,10 @@ def collect_conversation_metadata(user_message, conversation_id, user_id, active
         elif existing_primary.get('scope') == 'public':
             conversation_item['chat_type'] = 'public'
         elif existing_primary.get('scope') == 'personal':
-            conversation_item['chat_type'] = 'personal'
+            conversation_item['chat_type'] = 'personal_single_user'
     else:
-        # No documents used - model-only conversation, don't set chat_type
-        # This will result in no badges being shown
-        pass
+        # No documents used - model-only conversation, default to personal_single_user
+        conversation_item['chat_type'] = 'personal_single_user'
     
     # Collect and update tags with proper deduplication
     current_tags = {}
diff --git a/application/single_app/functions_documents.py b/application/single_app/functions_documents.py
index 87c9ba34..4dec6803 100644
--- a/application/single_app/functions_documents.py
+++ b/application/single_app/functions_documents.py
@@ -1,5 +1,6 @@
 # functions_documents.py that has some changes I need to merge into Development
 
+import traceback
 from config import *
 from functions_content import *
 from functions_settings import *
@@ -1089,7 +1090,6 @@ def to_seconds(ts: str) -> float:
             total += 1
         except Exception as e:
             debug_print(f"[VIDEO INDEXER] Failed to save chunk {chunk_num + 1}: {str(e)}")
-            import traceback
             debug_print(f"[VIDEO INDEXER] Chunk save traceback: {traceback.format_exc()}")
     
     debug_print(f"[VIDEO INDEXER] Chunk processing complete - Total chunks saved: {total}")
@@ -2614,7 +2614,7 @@ def detect_doc_type(document_id, user_id=None):
             pass
         else:
             return "personal", doc_item['user_id']
-    except:
+    except Exception as ex:
         pass
 
     try:
@@ -2623,7 +2623,7 @@ def detect_doc_type(document_id, user_id=None):
             partition_key=document_id
         )
         return "group", group_doc_item['group_id']
-    except:
+    except Exception as ex:
         pass
 
     try:
@@ -2632,7 +2632,7 @@ def detect_doc_type(document_id, user_id=None):
             partition_key=document_id
         )
         return "public", public_doc_item['public_workspace_id']
-    except:
+    except Exception as ex:
         pass
 
     return None
@@ -3542,7 +3542,6 @@ def analyze_image_with_vision_model(image_path, user_id, document_id, settings):
         
     except Exception as e:
         print(f"Error in vision analysis for {document_id}: {str(e)}")
-        import traceback
         traceback.print_exc()
         return None
 
@@ -3605,7 +3604,8 @@ def process_txt(document_id, user_id, temp_file_path, original_filename, enable_
     total_chunks_saved = 0
     total_embedding_tokens = 0
     embedding_model_name = None
-    target_words_per_chunk = 400
+    chunk_config = get_chunk_size_config(get_settings())
+    target_words_per_chunk = chunk_config.get('txt', {}).get('value', 400)
 
     if enable_enhanced_citations:
         args = {
@@ -3679,7 +3679,8 @@ def process_xml(document_id, user_id, temp_file_path, original_filename, enable_
     total_embedding_tokens = 0
     embedding_model_name = None
     # Character-based chunking for XML structure preservation
-    max_chunk_size_chars = 4000
+    chunk_config = get_chunk_size_config(get_settings())
+    max_chunk_size_chars = chunk_config.get('xml', {}).get('value', 4000)
 
     if enable_enhanced_citations:
         args = {
@@ -3774,7 +3775,8 @@ def process_yaml(document_id, user_id, temp_file_path, original_filename, enable
     total_embedding_tokens = 0
     embedding_model_name = None
     # Character-based chunking for YAML structure preservation
-    max_chunk_size_chars = 4000
+    chunk_config = get_chunk_size_config(get_settings())
+    max_chunk_size_chars = chunk_config.get('yaml', {}).get('value', 4000)
 
     if enable_enhanced_citations:
         args = {
@@ -3868,7 +3870,8 @@ def process_log(document_id, user_id, temp_file_path, original_filename, enable_
     total_chunks_saved = 0
     total_embedding_tokens = 0
     embedding_model_name = None
-    target_words_per_chunk = 1000  # Word-based chunking for better semantic grouping
+    chunk_config = get_chunk_size_config(get_settings())
+    target_words_per_chunk = chunk_config.get('log', {}).get('value', 1000)  # Word-based chunking for better semantic grouping
 
     if enable_enhanced_citations:
         args = {
@@ -3966,7 +3969,8 @@ def process_doc(document_id, user_id, temp_file_path, original_filename, enable_
 
     update_callback(status=f"Processing {original_filename.split('.')[-1].upper()} file...")
     total_chunks_saved = 0
-    target_words_per_chunk = 400  # Consistent with other text-based chunking
+    chunk_config = get_chunk_size_config(get_settings())
+    target_words_per_chunk = chunk_config.get('doc', {}).get('value', 400)  # Consistent with other text-based chunking
 
     if enable_enhanced_citations:
         args = {
@@ -4055,8 +4059,9 @@ def process_xml(document_id, user_id, temp_file_path, original_filename, enable_
 
     update_callback(status="Processing XML file...")
     total_chunks_saved = 0
-    # Character-based chunking for XML structure preservation
-    max_chunk_size_chars = 4000
+    # Character-based chunking for XML structure preservation, capped by embedding context
+    chunk_config = get_chunk_size_config(get_settings())
+    max_chunk_size_chars = chunk_config.get('xml', {}).get('value', 4000)
 
     if enable_enhanced_citations:
         args = {
@@ -4142,8 +4147,9 @@ def process_yaml(document_id, user_id, temp_file_path, original_filename, enable
 
     update_callback(status="Processing YAML file...")
     total_chunks_saved = 0
-    # Character-based chunking for YAML structure preservation
-    max_chunk_size_chars = 4000
+    # Character-based chunking for YAML structure preservation, capped by embedding context
+    chunk_config = get_chunk_size_config(get_settings())
+    max_chunk_size_chars = chunk_config.get('yaml', {}).get('value', 4000)
 
     if enable_enhanced_citations:
         args = {
@@ -4406,8 +4412,9 @@ def process_html(document_id, user_id, temp_file_path, original_filename, enable
     total_chunks_saved = 0
     total_embedding_tokens = 0
     embedding_model_name = None
-    target_chunk_words = 1200 # Target size based on requirement
-    min_chunk_words = 600 # Minimum size based on requirement
+    chunk_config = get_chunk_size_config(get_settings())
+    target_chunk_words = chunk_config.get('html', {}).get('value', 1200) # Target size based on requirement
+    min_chunk_words = max(1, int(target_chunk_words * 0.5)) # Minimum size based on requirement
 
     if enable_enhanced_citations:
         args = {
@@ -4536,8 +4543,9 @@ def process_md(document_id, user_id, temp_file_path, original_filename, enable_e
     total_chunks_saved = 0
     total_embedding_tokens = 0
     embedding_model_name = None
-    target_chunk_words = 1200 # Target size based on requirement
-    min_chunk_words = 600 # Minimum size based on requirement
+    chunk_config = get_chunk_size_config(get_settings())
+    target_chunk_words = chunk_config.get('md', {}).get('value', 1200) # Target size based on requirement
+    min_chunk_words = max(1, int(target_chunk_words * 0.5)) # Minimum size based on requirement
 
     if enable_enhanced_citations:
         args = {
@@ -4672,8 +4680,9 @@ def process_json(document_id, user_id, temp_file_path, original_filename, enable
     total_chunks_saved = 0
     total_embedding_tokens = 0
     embedding_model_name = None
+    chunk_config = get_chunk_size_config(get_settings())
     # Reflects character count limit for the splitter
-    max_chunk_size_chars = 4000 # As per original requirement
+    max_chunk_size_chars = chunk_config.get('json', {}).get('value', 4000)
 
     if enable_enhanced_citations:
         args = {
@@ -4808,7 +4817,10 @@ def process_single_tabular_sheet(df, document_id, user_id, file_name, update_cal
     total_chunks_saved = 0
     total_embedding_tokens = 0
     embedding_model_name = None
-    target_chunk_size_chars = 800 # Requirement: "800 size chunk" (assuming characters)
+    chunk_config = get_chunk_size_config(get_settings())
+    _, ext = os.path.splitext(file_name.lower())
+    config_key = 'csv' if ext == '.csv' else 'excel'
+    target_chunk_size_chars = chunk_config.get(config_key, {}).get('value', 800) # Requirement: "800 size chunk" (assuming characters)
 
     if df.empty:
         print(f"Skipping empty sheet/file: {file_name}")
@@ -5136,6 +5148,7 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
 
     # --- DI Processing Logic ---
     settings = get_settings() # Assuming get_settings is accessible
+    chunk_config = get_chunk_size_config(settings)
     di_limit_bytes = 500 * 1024 * 1024
     di_page_limit = 2000
     file_size = os.path.getsize(temp_file_path)
@@ -5252,7 +5265,6 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
                         
                 except Exception as e:
                     print(f"Warning: Error in vision analysis for {document_id}: {str(e)}")
-                    import traceback
                     traceback.print_exc()
                     # Don't fail the whole process, just update status
                     update_callback(status=f"Processing continues (vision analysis warning)")
@@ -5262,14 +5274,44 @@ def process_di_document(document_id, user_id, temp_file_path, original_filename,
         if is_word:
             update_callback(status=f"Chunking Word content from {chunk_effective_filename}...")
             try:
-                final_chunks_to_save = chunk_word_file_into_pages(di_pages=di_extracted_pages)
+                word_key = 'docx' if file_ext == '.docx' else 'doc'
+                target_word_chunk = chunk_config.get(word_key, {}).get('value', WORD_CHUNK_SIZE)
+                final_chunks_to_save = chunk_word_file_into_pages(
+                    di_pages=di_extracted_pages,
+                    chunk_size=target_word_chunk
+                )
                 num_final_chunks = len(final_chunks_to_save)
                 # Update number_of_pages again for Word to reflect final chunk count
                 update_callback(number_of_pages=num_final_chunks, status=f"Created {num_final_chunks} content chunks for {chunk_effective_filename}.")
             except Exception as e:
                  raise Exception(f"Error chunking Word content for {chunk_effective_filename}: {str(e)}")
         elif is_pdf or is_ppt:
-            final_chunks_to_save = di_extracted_pages # Use DI pages/slides directly
+            target_key = 'pdf' if is_pdf else 'pptx'
+            try:
+                target_size = int(chunk_config.get(target_key, {}).get('value', 1))
+            except Exception:
+                target_size = 1
+            target_size = max(1, target_size)
+
+            if target_size == 1:
+                final_chunks_to_save = di_extracted_pages # Use DI pages/slides directly
+            else:
+                final_chunks_to_save = []
+                for start in range(0, len(di_extracted_pages), target_size):
+                    slice_pages = di_extracted_pages[start:start + target_size]
+                    combined_content = "\n\n".join([page.get('content', '') or '' for page in slice_pages]).strip()
+                    if not combined_content:
+                        continue
+                    first_page_number = slice_pages[0].get('page_number', start + 1)
+                    final_chunks_to_save.append({
+                        "page_number": first_page_number,
+                        "content": combined_content
+                    })
+
+                update_callback(
+                    number_of_pages=len(final_chunks_to_save),
+                    status=f"Grouped {len(final_chunks_to_save)} chunk(s) for {chunk_effective_filename} using {target_size} page(s)/slide(s) per chunk."
+                )
         elif is_image:
             if di_extracted_pages:
                  if 'page_number' not in di_extracted_pages[0]: di_extracted_pages[0]['page_number'] = 1
@@ -5668,7 +5710,8 @@ def canceled_cb(evt):
     # 5) stitch and save transcript chunks
     full_text = ' '.join(all_phrases).strip()
     words = full_text.split()
-    chunk_size = 400
+    chunk_settings = get_chunk_size_config(settings)
+    chunk_size = chunk_settings.get('transcript', {}).get('value', 400)
     total_pages = max(1, math.ceil(len(words) / chunk_size))
     print(f"Creating {total_pages} transcript pages")
 
diff --git a/application/single_app/functions_global_agents.py b/application/single_app/functions_global_agents.py
index 87976510..7fecf1ee 100644
--- a/application/single_app/functions_global_agents.py
+++ b/application/single_app/functions_global_agents.py
@@ -111,6 +111,9 @@ def get_global_agents():
             agent.setdefault('is_global', True)
             agent.setdefault('is_group', False)
             agent.setdefault('agent_type', 'local')
+            agent.setdefault('model_endpoint_id', '')
+            agent.setdefault('model_id', '')
+            agent.setdefault('model_provider', '')
             # Remove empty reasoning_effort to prevent validation errors
             if agent.get('reasoning_effort') == '':
                 agent.pop('reasoning_effort', None)
@@ -147,6 +150,9 @@ def get_global_agent(agent_id):
         agent.setdefault('is_global', True)
         agent.setdefault('is_group', False)
         agent.setdefault('agent_type', 'local')
+        agent.setdefault('model_endpoint_id', '')
+        agent.setdefault('model_id', '')
+        agent.setdefault('model_provider', '')
         # Remove empty reasoning_effort to prevent validation errors
         if agent.get('reasoning_effort') == '':
             agent.pop('reasoning_effort', None)
@@ -203,6 +209,9 @@ def save_global_agent(agent_data, user_id=None):
         cleaned_agent['modified_by'] = user_id
         cleaned_agent['modified_at'] = now
         cleaned_agent['updated_at'] = now
+        cleaned_agent.setdefault('model_endpoint_id', '')
+        cleaned_agent.setdefault('model_id', '')
+        cleaned_agent.setdefault('model_provider', '')
         log_event(
             "Saving global agent.",
             extra={"agent_name": cleaned_agent.get('name', 'Unknown')},
@@ -210,13 +219,13 @@ def save_global_agent(agent_data, user_id=None):
         print(f"Saving global agent: {cleaned_agent.get('name', 'Unknown')}")
         
         # Use the new helper to store sensitive agent keys in Key Vault
-        agent_data = keyvault_agent_save_helper(agent_data, agent_data['id'], scope="global")
-        if agent_data.get('max_completion_tokens') is None:
-            agent_data['max_completion_tokens'] = -1  # Default value
+        cleaned_agent = keyvault_agent_save_helper(cleaned_agent, cleaned_agent['id'], scope="global")
+        if cleaned_agent.get('max_completion_tokens') is None:
+            cleaned_agent['max_completion_tokens'] = -1  # Default value
         
         # Remove empty reasoning_effort to avoid schema validation errors
-        if agent_data.get('reasoning_effort') == '':
-            agent_data.pop('reasoning_effort', None)
+        if cleaned_agent.get('reasoning_effort') == '':
+            cleaned_agent.pop('reasoning_effort', None)
 
         result = cosmos_global_agents_container.upsert_item(body=cleaned_agent)
         log_event(
diff --git a/application/single_app/functions_group.py b/application/single_app/functions_group.py
index dcf63420..e50b09f6 100644
--- a/application/single_app/functions_group.py
+++ b/application/single_app/functions_group.py
@@ -270,4 +270,28 @@ def check_group_status_allows_operation(group_doc, operation_type):
                                              f'This operation is not allowed when group status is "{status}".')
         return False, reason
     
-    return True, ""
\ No newline at end of file
+    return True, ""
+
+
+def get_group_model_endpoints(group_id: str):
+    """Return the model endpoint list stored on a group document."""
+    group_doc = find_group_by_id(group_id)
+    if not group_doc:
+        return []
+    endpoints = group_doc.get("model_endpoints")
+    if isinstance(endpoints, list):
+        return endpoints
+    return []
+
+
+def update_group_model_endpoints(group_id: str, endpoints):
+    """Persist the model endpoints list onto the group document."""
+    group_doc = find_group_by_id(group_id)
+    if not group_doc:
+        raise ValueError("Group not found")
+    if not isinstance(endpoints, list):
+        raise ValueError("model_endpoints must be a list")
+    group_doc["model_endpoints"] = endpoints
+    group_doc["modifiedDate"] = datetime.utcnow().isoformat()
+    cosmos_groups_container.upsert_item(group_doc)
+    return group_doc
\ No newline at end of file
diff --git a/application/single_app/functions_group_agents.py b/application/single_app/functions_group_agents.py
index 7cbb8324..ae79309b 100644
--- a/application/single_app/functions_group_agents.py
+++ b/application/single_app/functions_group_agents.py
@@ -116,6 +116,9 @@ def save_group_agent(group_id: str, agent_data: Dict[str, Any], user_id: Optiona
     payload.setdefault("azure_agent_apim_gpt_subscription_key", "")
     payload.setdefault("azure_agent_apim_gpt_deployment", "")
     payload.setdefault("azure_agent_apim_gpt_api_version", "")
+    payload.setdefault("model_endpoint_id", "")
+    payload.setdefault("model_id", "")
+    payload.setdefault("model_provider", "")
     
     # Remove empty reasoning_effort to avoid schema validation errors
     if payload.get("reasoning_effort") == "":
@@ -224,6 +227,9 @@ def _clean_agent(agent: Dict[str, Any]) -> Dict[str, Any]:
     cleaned.setdefault("is_global", False)
     cleaned.setdefault("is_group", True)
     cleaned.setdefault("agent_type", "local")
+    cleaned.setdefault("model_endpoint_id", "")
+    cleaned.setdefault("model_id", "")
+    cleaned.setdefault("model_provider", "")
     # Remove empty reasoning_effort to prevent validation errors
     if cleaned.get("reasoning_effort") == "":
         cleaned.pop("reasoning_effort", None)
diff --git a/application/single_app/functions_keyvault.py b/application/single_app/functions_keyvault.py
index fbf693c2..a523eeaa 100644
--- a/application/single_app/functions_keyvault.py
+++ b/application/single_app/functions_keyvault.py
@@ -26,6 +26,7 @@
     'action',
     'action-addset',
     'agent',
+    'model-endpoint',
     'other'
 ]
 
@@ -47,6 +48,10 @@
 SQL_PLUGIN_TYPES = {"sql_query", "sql_schema"}
 SQL_PLUGIN_SENSITIVE_ADDITIONAL_FIELDS = {"connection_string", "password"}
 SQL_PLUGIN_SENSITIVE_AUTH_FIELDS = {"client_secret"}
+MODEL_ENDPOINT_SENSITIVE_AUTH_FIELDS = {
+    "api_key": {"api_key"},
+    "client_secret": {"service_principal"},
+}
 REDACTED_SECRET_VALUE = "***REDACTED***"
 
 class SecretReturnType(Enum):
@@ -92,6 +97,11 @@ def _build_plugin_additional_field_secret_name(plugin_name, field_name):
     return f"{plugin_name}-{field_name}".replace("__", "-")
 
 
+def _build_model_endpoint_secret_name(field_name):
+    """Build a stable Key Vault secret base name for model endpoint auth fields."""
+    return f"model-endpoint-{field_name}".replace("_", "-")
+
+
 def _is_sql_plugin(plugin_dict):
     """Return True when the plugin manifest is a SQL action."""
     plugin_type = (plugin_dict or {}).get("type", "")
@@ -164,6 +174,23 @@ def redact_plugin_secret_values(plugin_dict, redaction_value=REDACTED_SECRET_VAL
 
     return redacted
 
+
+def redact_model_endpoint_secret_values(endpoint_dict, redaction_value=REDACTED_SECRET_VALUE):
+    """Return a copy of a model endpoint manifest with secret-bearing auth values redacted."""
+    if not isinstance(endpoint_dict, dict):
+        return endpoint_dict
+
+    redacted = dict(endpoint_dict)
+    auth = redacted.get("auth", {})
+    if isinstance(auth, dict):
+        new_auth = dict(auth)
+        for auth_field in MODEL_ENDPOINT_SENSITIVE_AUTH_FIELDS:
+            if new_auth.get(auth_field):
+                new_auth[auth_field] = redaction_value
+        redacted["auth"] = new_auth
+
+    return redacted
+
 def retrieve_secret_from_key_vault(secret_name, scope_value, scope="global", source="global"):
     """
     Retrieve a secret from Key Vault using a dynamic name based on source, scope, and scope_value.
@@ -619,6 +646,163 @@ def keyvault_plugin_get_helper(plugin_dict, scope_value, scope="global", return_
                     raise Exception(f"Failed to retrieve action additionalField secret '{k}' from Key Vault: {e}")
         updated['additionalFields'] = new_additional_fields
     return updated
+
+
+def keyvault_model_endpoint_save_helper(endpoint_dict, scope_value, scope="global", existing_endpoint=None):
+    """Store model endpoint auth secrets in Key Vault and replace them with references."""
+    if scope not in supported_scopes:
+        log_event(f"Scope '{scope}' is not supported. Supported scopes: {supported_scopes}", level=logging.ERROR)
+        raise ValueError(f"Scope '{scope}' is not supported. Supported scopes: {supported_scopes}")
+
+    settings = app_settings_cache.get_settings_cache()
+    enable_key_vault_secret_storage = settings.get("enable_key_vault_secret_storage", False)
+    key_vault_name = settings.get("key_vault_name", None)
+    if not enable_key_vault_secret_storage or not key_vault_name:
+        return endpoint_dict
+
+    updated = dict(endpoint_dict)
+    auth = updated.get("auth", {})
+    if not isinstance(auth, dict):
+        return updated
+
+    updated_auth = dict(auth)
+    updated["auth"] = updated_auth
+    auth_type = (updated_auth.get("type") or "managed_identity").lower()
+    source = "model-endpoint"
+
+    for auth_field, supported_auth_types in MODEL_ENDPOINT_SENSITIVE_AUTH_FIELDS.items():
+        existing_reference = _get_existing_secret_reference(existing_endpoint, ("auth", auth_field))
+        value = updated_auth.get(auth_field)
+
+        if auth_type not in supported_auth_types:
+            updated_auth.pop(auth_field, None)
+            continue
+
+        if value in (None, ""):
+            if existing_reference:
+                updated_auth[auth_field] = existing_reference
+            else:
+                updated_auth.pop(auth_field, None)
+            continue
+
+        if value == ui_trigger_word:
+            if existing_reference:
+                updated_auth[auth_field] = existing_reference
+            else:
+                updated_auth.pop(auth_field, None)
+            continue
+
+        if validate_secret_name_dynamic(value):
+            updated_auth[auth_field] = value
+            continue
+
+        secret_name = _build_model_endpoint_secret_name(auth_field)
+        updated_auth[auth_field] = store_secret_in_key_vault(
+            secret_name,
+            value,
+            scope_value,
+            source=source,
+            scope=scope,
+        )
+
+    return updated
+
+
+def keyvault_model_endpoint_get_helper(endpoint_dict, scope_value, scope="global", return_type=SecretReturnType.TRIGGER):
+    """Resolve model endpoint auth secrets from Key Vault for backend or frontend use."""
+    if scope not in supported_scopes:
+        log_event(f"Scope '{scope}' is not supported. Supported scopes: {supported_scopes}", level=logging.ERROR)
+        raise ValueError(f"Scope '{scope}' is not supported. Supported scopes: {supported_scopes}")
+
+    settings = app_settings_cache.get_settings_cache()
+    enable_key_vault_secret_storage = settings.get("enable_key_vault_secret_storage", False)
+    key_vault_name = settings.get("key_vault_name", None)
+    if not enable_key_vault_secret_storage or not key_vault_name:
+        return endpoint_dict
+
+    updated = dict(endpoint_dict)
+    auth = updated.get("auth", {})
+    if not isinstance(auth, dict):
+        return updated
+
+    updated_auth = dict(auth)
+    auth_updated = False
+    for auth_field in MODEL_ENDPOINT_SENSITIVE_AUTH_FIELDS:
+        value = updated_auth.get(auth_field)
+        if not value or not validate_secret_name_dynamic(value):
+            continue
+        if return_type == SecretReturnType.VALUE:
+            updated_auth[auth_field] = retrieve_secret_from_key_vault_by_full_name(value)
+        elif return_type == SecretReturnType.NAME:
+            updated_auth[auth_field] = value
+        else:
+            updated_auth[auth_field] = ui_trigger_word
+        auth_updated = True
+
+    if auth_updated:
+        updated["auth"] = updated_auth
+    return updated
+
+
+def keyvault_model_endpoint_delete_helper(endpoint_dict, scope_value, scope="global"):
+    """Delete Key Vault-backed model endpoint auth secrets referenced by an endpoint."""
+    if scope not in supported_scopes:
+        log_event(f"Scope '{scope}' is not supported. Supported scopes: {supported_scopes}", level=logging.WARNING)
+        raise ValueError(f"Scope '{scope}' is not supported. Supported scopes: {supported_scopes}")
+
+    settings = app_settings_cache.get_settings_cache()
+    enable_key_vault_secret_storage = settings.get("enable_key_vault_secret_storage", False)
+    key_vault_name = settings.get("key_vault_name", None)
+    if not enable_key_vault_secret_storage or not key_vault_name:
+        return endpoint_dict
+
+    auth = endpoint_dict.get("auth", {})
+    if not isinstance(auth, dict):
+        return endpoint_dict
+
+    key_vault_url = f"https://{key_vault_name}{KEY_VAULT_DOMAIN}"
+    client = SecretClient(vault_url=key_vault_url, credential=get_keyvault_credential())
+    for auth_field in MODEL_ENDPOINT_SENSITIVE_AUTH_FIELDS:
+        secret_name = auth.get(auth_field)
+        if not secret_name or not validate_secret_name_dynamic(secret_name):
+            continue
+        try:
+            log_event(
+                f"Deleting model endpoint auth secret '{auth_field}' for '{scope}' '{scope_value}'",
+                level=logging.INFO,
+            )
+            client.begin_delete_secret(secret_name)
+        except Exception as e:
+            log_event(
+                f"Error deleting model endpoint auth secret '{auth_field}' for '{scope}' '{scope_value}': {e}",
+                level=logging.ERROR,
+                exceptionTraceback=True,
+            )
+            raise Exception(f"Error deleting model endpoint auth secret '{auth_field}' for '{scope}' '{scope_value}': {e}")
+
+    return endpoint_dict
+
+
+def keyvault_model_endpoint_cleanup_helper(previous_endpoint, current_endpoint, scope_value, scope="global"):
+    """Delete obsolete Key Vault-backed endpoint auth secrets that are no longer referenced."""
+    previous_auth = (previous_endpoint or {}).get("auth", {})
+    current_auth = (current_endpoint or {}).get("auth", {})
+    if not isinstance(previous_auth, dict) or not isinstance(current_auth, dict):
+        return current_endpoint
+
+    obsolete_auth = {}
+    for auth_field in MODEL_ENDPOINT_SENSITIVE_AUTH_FIELDS:
+        previous_secret = previous_auth.get(auth_field)
+        current_secret = current_auth.get(auth_field)
+        if previous_secret and validate_secret_name_dynamic(previous_secret) and previous_secret != current_secret:
+            obsolete_auth[auth_field] = previous_secret
+
+    if obsolete_auth:
+        keyvault_model_endpoint_delete_helper({"auth": obsolete_auth}, scope_value, scope=scope)
+
+    return current_endpoint
+
+
 # Helper to delete plugin secrets from Key Vault
 def keyvault_plugin_delete_helper(plugin_dict, scope_value, scope="global"):
     """
diff --git a/application/single_app/functions_notifications.py b/application/single_app/functions_notifications.py
index 9bb4409c..80574160 100644
--- a/application/single_app/functions_notifications.py
+++ b/application/single_app/functions_notifications.py
@@ -24,6 +24,7 @@
 
 # Constants
 TTL_60_DAYS = 60 * 24 * 60 * 60  # 60 days in seconds (5184000)
+ASSIGNMENT_NOTIFICATIONS_PARTITION_KEY = 'assignment-notifications'
 
 # Notification type registry for extensibility
 NOTIFICATION_TYPES = {
@@ -54,10 +55,136 @@
     'system_announcement': {
         'icon': 'bi-megaphone',
         'color': 'info'
+    },
+    'approval_request_pending': {
+        'icon': 'bi-hourglass-split',
+        'color': 'warning'
+    },
+    'approval_request_pending_submitter': {
+        'icon': 'bi-hourglass',
+        'color': 'info'
+    },
+    'approval_request_approved': {
+        'icon': 'bi-check-circle',
+        'color': 'success'
+    },
+    'approval_request_denied': {
+        'icon': 'bi-x-circle',
+        'color': 'danger'
+    },
+    'agent_template_pending_admin': {
+        'icon': 'bi-layers',
+        'color': 'warning'
+    },
+    'agent_template_pending_submitter': {
+        'icon': 'bi-layers-half',
+        'color': 'info'
+    },
+    'agent_template_approved': {
+        'icon': 'bi-check2-square',
+        'color': 'success'
+    },
+    'agent_template_rejected': {
+        'icon': 'bi-x-octagon',
+        'color': 'danger'
+    },
+    'agent_template_deleted': {
+        'icon': 'bi-trash',
+        'color': 'secondary'
     }
 }
 
 
+def _get_notification_partition_key(notification):
+    """Resolve the Cosmos partition key for a notification document."""
+    if notification.get('scope') == 'assignment':
+        return ASSIGNMENT_NOTIFICATIONS_PARTITION_KEY
+
+    return (
+        notification.get('user_id')
+        or notification.get('group_id')
+        or notification.get('public_workspace_id')
+    )
+
+
+def _get_notification_display_message(notification):
+    """Normalize display text and backfill reviewer reasons from metadata when needed."""
+    message = str(notification.get('message') or '').strip()
+    metadata = notification.get('metadata') or {}
+    notification_type = notification.get('notification_type')
+
+    reason = None
+    if notification_type == 'approval_request_denied':
+        reason = str(metadata.get('comment') or '').strip()
+    elif notification_type == 'agent_template_rejected':
+        reason = str(metadata.get('rejection_reason') or '').strip()
+
+    if reason and reason not in message:
+        if message:
+            return f"{message} Reason provided: {reason}"
+        return f"Reason provided: {reason}"
+
+    return message
+
+
+def get_notifications_by_metadata(metadata_filters=None, notification_types=None):
+    """Fetch notifications matching metadata values and optional types."""
+    try:
+        query_parts = ["SELECT * FROM c WHERE 1=1"]
+        parameters = []
+
+        if notification_types:
+            type_clauses = []
+            for index, notification_type in enumerate(notification_types):
+                parameter_name = f"@notification_type_{index}"
+                type_clauses.append(f"c.notification_type = {parameter_name}")
+                parameters.append({"name": parameter_name, "value": notification_type})
+            query_parts.append(f"AND ({' OR '.join(type_clauses)})")
+
+        for key, value in (metadata_filters or {}).items():
+            if value is None:
+                continue
+            parameter_name = f"@metadata_{key}"
+            query_parts.append(f"AND c.metadata.{key} = {parameter_name}")
+            parameters.append({"name": parameter_name, "value": value})
+
+        return list(cosmos_notifications_container.query_items(
+            query=" ".join(query_parts),
+            parameters=parameters or None,
+            enable_cross_partition_query=True
+        ))
+    except Exception as e:
+        debug_print(f"Error fetching notifications by metadata: {e}")
+        return []
+
+
+def delete_notifications_by_metadata(metadata_filters=None, notification_types=None):
+    """Delete notifications matching metadata values and optional types."""
+    deleted_count = 0
+    notifications = get_notifications_by_metadata(
+        metadata_filters=metadata_filters,
+        notification_types=notification_types
+    )
+
+    for notification in notifications:
+        partition_key = _get_notification_partition_key(notification)
+        if not partition_key:
+            continue
+
+        try:
+            cosmos_notifications_container.delete_item(
+                item=notification['id'],
+                partition_key=partition_key
+            )
+            deleted_count += 1
+        except Exception as e:
+            debug_print(
+                f"Error deleting notification {notification.get('id')} by metadata: {e}"
+            )
+
+    return deleted_count
+
+
 def create_notification(
     user_id=None,
     group_id=None,
@@ -105,7 +232,7 @@ def create_notification(
             # Assignment-based notifications always use the special assignment partition
             # This allows role-based filtering across all users
             scope = 'assignment'
-            partition_key = 'assignment-notifications'
+            partition_key = ASSIGNMENT_NOTIFICATIONS_PARTITION_KEY
         else:
             # Legacy behavior - partition by specific workspace
             if group_id:
@@ -157,6 +284,17 @@ def create_notification(
         return None
 
 
+def broadcast_system_notification(title, message, metadata=None):
+    """Create a system announcement visible to all users regardless of role."""
+    return create_notification(
+        notification_type='system_announcement',
+        title=title,
+        message=message,
+        metadata=metadata or {},
+        assignment={'all_users': True}
+    )
+
+
 def create_group_notification(group_id, notification_type, title, message, link_url='', link_context=None, metadata=None):
     """
     Create a notification for all members of a group.
@@ -340,9 +478,13 @@ def get_user_notifications(user_id, page=1, per_page=20, include_read=True, incl
             
             # Check if user matches assignment criteria
             user_matches = False
+
+            # Broadcast to all users regardless of role/ownership
+            if assignment.get('all_users'):
+                user_matches = True
             
             # Check roles
-            if user_roles and assignment.get('roles'):
+            if not user_matches and user_roles and assignment.get('roles'):
                 for role in assignment.get('roles', []):
                     if role in user_roles:
                         user_matches = True
@@ -373,6 +515,7 @@ def get_user_notifications(user_id, page=1, per_page=20, include_read=True, incl
                 continue
             
             # Add UI metadata
+            notif['message'] = _get_notification_display_message(notif)
             notif['is_read'] = user_id in read_by
             notif['is_dismissed'] = user_id in dismissed_by
             notif['type_config'] = NOTIFICATION_TYPES.get(
@@ -469,7 +612,7 @@ def mark_notification_read(notification_id, user_id):
         notification = notifications[0]
         
         # Determine partition key
-        partition_key = notification.get('user_id') or notification.get('group_id') or notification.get('public_workspace_id')
+        partition_key = _get_notification_partition_key(notification)
         
         if not partition_key:
             debug_print(f"No partition key found for notification {notification_id}")
@@ -560,7 +703,7 @@ def dismiss_notification(notification_id, user_id):
         notification = notifications[0]
         
         # Determine partition key
-        partition_key = notification.get('user_id') or notification.get('group_id') or notification.get('public_workspace_id')
+        partition_key = _get_notification_partition_key(notification)
         
         if not partition_key:
             debug_print(f"No partition key found for notification {notification_id}")
@@ -640,7 +783,7 @@ def delete_notification(notification_id):
             return False
         
         notification = notifications[0]
-        partition_key = notification.get('user_id') or notification.get('group_id') or notification.get('public_workspace_id')
+        partition_key = _get_notification_partition_key(notification)
         
         if not partition_key:
             return False
diff --git a/application/single_app/functions_personal_agents.py b/application/single_app/functions_personal_agents.py
index 3c6c275e..5821d655 100644
--- a/application/single_app/functions_personal_agents.py
+++ b/application/single_app/functions_personal_agents.py
@@ -51,6 +51,9 @@ def get_personal_agents(user_id):
             cleaned_agent.setdefault('is_global', False)
             cleaned_agent.setdefault('is_group', False)
             cleaned_agent.setdefault('agent_type', 'local')
+            cleaned_agent.setdefault('model_endpoint_id', '')
+            cleaned_agent.setdefault('model_id', '')
+            cleaned_agent.setdefault('model_provider', '')
             # Remove empty reasoning_effort to prevent validation errors
             if cleaned_agent.get('reasoning_effort') == '':
                 cleaned_agent.pop('reasoning_effort', None)
@@ -89,6 +92,9 @@ def get_personal_agent(user_id, agent_id):
         cleaned_agent.setdefault('is_global', False)
         cleaned_agent.setdefault('is_group', False)
         cleaned_agent.setdefault('agent_type', 'local')
+        cleaned_agent.setdefault('model_endpoint_id', '')
+        cleaned_agent.setdefault('model_id', '')
+        cleaned_agent.setdefault('model_provider', '')
         # Remove empty reasoning_effort to prevent validation errors
         if cleaned_agent.get('reasoning_effort') == '':
             cleaned_agent.pop('reasoning_effort', None)
@@ -126,6 +132,9 @@ def save_personal_agent(user_id, agent_data):
             'azure_agent_apim_gpt_api_version'
         ]:
             cleaned_agent.setdefault(field, '')
+        cleaned_agent.setdefault('model_endpoint_id', '')
+        cleaned_agent.setdefault('model_id', '')
+        cleaned_agent.setdefault('model_provider', '')
         if 'id' not in cleaned_agent:
             cleaned_agent['id'] = str(f"{user_id}_{cleaned_agent.get('name', 'default')}")
 
@@ -170,6 +179,9 @@ def save_personal_agent(user_id, agent_data):
         cleaned_agent.setdefault('azure_agent_apim_gpt_deployment', '')
         cleaned_agent.setdefault('azure_agent_apim_gpt_api_version', '')
         cleaned_agent.setdefault('enable_agent_gpt_apim', False)
+        cleaned_agent.setdefault('model_endpoint_id', '')
+        cleaned_agent.setdefault('model_id', '')
+        cleaned_agent.setdefault('model_provider', '')
         cleaned_agent.setdefault('reasoning_effort', '')
         cleaned_agent.setdefault('actions_to_load', [])
         cleaned_agent.setdefault('other_settings', {})
diff --git a/application/single_app/functions_settings.py b/application/single_app/functions_settings.py
index a282f409..ff0e0359 100644
--- a/application/single_app/functions_settings.py
+++ b/application/single_app/functions_settings.py
@@ -37,13 +37,18 @@ def get_settings(use_cosmos=False):
             'is_global': True
         },
         'allow_user_agents': False,
+        'allow_user_custom_endpoints': False,
         'allow_user_custom_agent_endpoints': False,
         'allow_user_plugins': False,
         'allow_group_agents': False,
+        'allow_group_custom_endpoints': False,
         'allow_group_custom_agent_endpoints': False,
         'allow_ai_foundry_agents': False,
         'allow_group_ai_foundry_agents': False,
         'allow_personal_ai_foundry_agents': False,
+        'allow_new_foundry_agents': False,
+        'allow_group_new_foundry_agents': False,
+        'allow_personal_new_foundry_agents': False,
         'enable_agent_template_gallery': True,
         'agent_templates_allow_user_submission': True,
         'agent_templates_require_approval': True,
@@ -79,6 +84,22 @@ def get_settings(use_cosmos=False):
             "selected": [],
             "all": []
         },
+        'enable_multi_model_endpoints': False,
+        'model_endpoints': [],
+        'default_model_selection': {
+            'endpoint_id': '',
+            'model_id': '',
+            'provider': ''
+        },
+        'multi_endpoint_migrated_at': None,
+        'multi_endpoint_migration_notice': {
+            'enabled': False,
+            'message': (
+                'Multi-endpoint has been enabled and your existing AI endpoint was migrated. '
+                'Agents using the default connection may need to be updated to select a new model endpoint.'
+            ),
+            'created_at': None
+        },
         'azure_apim_gpt_endpoint': '',
         'azure_apim_gpt_subscription_key': '',
         'azure_apim_gpt_deployment': '',
@@ -216,6 +237,25 @@ def get_settings(use_cosmos=False):
         'enable_ai_search_apim': False,
         'azure_apim_ai_search_endpoint': '',
         'azure_apim_ai_search_subscription_key': '',
+        'enable_chunk_size_override': False,
+        'chunk_size': {
+            'txt': {'value': 400, 'unit': 'words'},
+            'log': {'value': 1000, 'unit': 'words'},
+            'doc': {'value': 400, 'unit': 'words'},
+            'docm': {'value': 400, 'unit': 'words'},
+            'docx': {'value': WORD_CHUNK_SIZE, 'unit': 'words'},
+            'html': {'value': 1200, 'unit': 'words'},
+            'md': {'value': 1200, 'unit': 'words'},
+            'xml': {'value': 4000, 'unit': 'characters'},
+            'yaml': {'value': 4000, 'unit': 'characters'},
+            'yml': {'value': 4000, 'unit': 'characters'},
+            'json': {'value': 4000, 'unit': 'characters'},
+            'csv': {'value': 800, 'unit': 'characters'},
+            'excel': {'value': 800, 'unit': 'characters'},
+            'transcript': {'value': 400, 'unit': 'words'},
+            'pdf': {'value': 1, 'unit': 'pages'},
+            'pptx': {'value': 1, 'unit': 'slides'}
+        },
         
         # Search Result Caching
         'enable_search_result_caching': True,
@@ -375,9 +415,10 @@ def get_settings(use_cosmos=False):
 
         # Merge default_settings in, to fill in any missing or nested keys
         merged = deep_merge_dicts(default_settings, settings_item)
+        migration_updated = apply_custom_endpoint_setting_migration(merged)
 
         # If merging added anything new, upsert back to Cosmos so future reads remain up to date
-        if merged != settings_item:
+        if merged != settings_item or migration_updated:
             cosmos_settings_container.upsert_item(merged)
             print("App Settings had missing keys and was updated in Cosmos DB.")
             return merged
@@ -412,6 +453,92 @@ def update_settings(new_settings):
         print(f"Error updating settings: {str(e)}")
         return False
 
+
+def get_chunk_size_defaults():
+    """Return the baseline chunk size configuration used when overrides are disabled."""
+    return {
+        'txt': {'value': 400, 'unit': 'words'},
+        'log': {'value': 1000, 'unit': 'words'},
+        'doc': {'value': 400, 'unit': 'words'},
+        'docm': {'value': 400, 'unit': 'words'},
+        'docx': {'value': WORD_CHUNK_SIZE, 'unit': 'words'},
+        'html': {'value': 1200, 'unit': 'words'},
+        'md': {'value': 1200, 'unit': 'words'},
+        'xml': {'value': 4000, 'unit': 'characters'},
+        'yaml': {'value': 4000, 'unit': 'characters'},
+        'yml': {'value': 4000, 'unit': 'characters'},
+        'json': {'value': 4000, 'unit': 'characters'},
+        'csv': {'value': 800, 'unit': 'characters'},
+        'excel': {'value': 800, 'unit': 'characters'},
+        'transcript': {'value': 400, 'unit': 'words'},
+        'pdf': {'value': 1, 'unit': 'pages'},
+        'pptx': {'value': 1, 'unit': 'slides'}
+    }
+
+
+def get_chunk_size_cap(settings=None):
+    """Return the maximum allowed chunk size (2x embedding context window, fallback 16,384)."""
+    fallback_cap = 16384
+    try:
+        settings = settings or get_settings()
+        embedding_model = settings.get('embedding_model', {}) if isinstance(settings, dict) else {}
+        selected_models = embedding_model.get('selected') or []
+
+        base_context = None
+        for model in selected_models:
+            if not isinstance(model, dict):
+                continue
+            for key in ['context_window', 'contextWindow', 'maxContextTokens', 'context_length', 'contextLength', 'maxTokens']:
+                value = model.get(key)
+                if value is not None:
+                    try:
+                        parsed_value = int(value)
+                        if parsed_value > 0:
+                            base_context = parsed_value
+                            break
+                    except Exception:
+                        continue
+            if base_context:
+                break
+
+        if base_context and base_context > 0:
+            return base_context * 2
+    except Exception:
+        pass
+
+    return fallback_cap
+
+
+def get_chunk_size_config(settings=None):
+    """
+    Compute the effective chunk size configuration, respecting defaults, caps, and the override toggle.
+    When overrides are disabled, defaults are returned regardless of stored values.
+    """
+    settings = settings or get_settings()
+    defaults = get_chunk_size_defaults()
+    use_custom = isinstance(settings, dict) and settings.get('enable_chunk_size_override', False)
+    stored = settings.get('chunk_size', {}) if isinstance(settings, dict) else {}
+    cap = get_chunk_size_cap(settings)
+
+    normalized = {}
+    for key, default_meta in defaults.items():
+        incoming_meta = stored.get(key, {}) if use_custom and isinstance(stored, dict) else {}
+        unit = incoming_meta.get('unit', default_meta['unit']) if isinstance(incoming_meta, dict) else default_meta['unit']
+        try:
+            raw_value = int(incoming_meta.get('value', default_meta['value'])) if isinstance(incoming_meta, dict) else int(default_meta['value'])
+        except Exception:
+            raw_value = default_meta['value']
+
+        value = max(1, raw_value)
+        value = min(value, cap)
+
+        normalized[key] = {
+            'value': value,
+            'unit': unit
+        }
+
+    return normalized
+
 def compare_versions(v1_str, v2_str):
     """
     Manually compares two version strings (e.g., "1.0.0", "1.1").
@@ -542,6 +669,179 @@ def deep_merge_dicts(default_dict, existing_dict):
             # For lists or other types, we skip overwriting.
     return existing_dict
 
+def apply_custom_endpoint_setting_migration(settings_item):
+    updated = False
+    if "allow_user_custom_endpoints" not in settings_item:
+        settings_item["allow_user_custom_endpoints"] = settings_item.get("allow_user_custom_agent_endpoints", False)
+        updated = True
+    if "allow_group_custom_endpoints" not in settings_item:
+        settings_item["allow_group_custom_endpoints"] = settings_item.get("allow_group_custom_agent_endpoints", False)
+        updated = True
+
+    if settings_item.get("allow_user_custom_agent_endpoints") != settings_item.get("allow_user_custom_endpoints"):
+        settings_item["allow_user_custom_agent_endpoints"] = settings_item.get("allow_user_custom_endpoints", False)
+        updated = True
+    if settings_item.get("allow_group_custom_agent_endpoints") != settings_item.get("allow_group_custom_endpoints"):
+        settings_item["allow_group_custom_agent_endpoints"] = settings_item.get("allow_group_custom_endpoints", False)
+        updated = True
+
+    return updated
+
+def normalize_model_endpoints(endpoints):
+    """Normalize model endpoints with stable IDs and enabled flags."""
+    if not isinstance(endpoints, list):
+        return [], False
+
+    normalized = []
+    changed = False
+
+    for endpoint in endpoints:
+        if not isinstance(endpoint, dict):
+            continue
+        endpoint_copy = json.loads(json.dumps(endpoint))
+        endpoint_copy.pop("has_api_key", None)
+        endpoint_copy.pop("has_client_secret", None)
+        connection = endpoint_copy.get("connection") or {}
+
+        if not endpoint_copy.get("id"):
+            fallback_id = endpoint_copy.get("name") or connection.get("endpoint")
+            if fallback_id:
+                endpoint_copy["id"] = fallback_id
+                changed = True
+
+        if endpoint_copy.get("enabled") is None:
+            endpoint_copy["enabled"] = True
+            changed = True
+
+        models = endpoint_copy.get("models") or []
+        normalized_models = []
+        for model in models:
+            if not isinstance(model, dict):
+                continue
+            model_copy = json.loads(json.dumps(model))
+            if not model_copy.get("id"):
+                model_id = (
+                    model_copy.get("deploymentName")
+                    or model_copy.get("deployment")
+                    or model_copy.get("modelName")
+                    or model_copy.get("name")
+                )
+                if model_id:
+                    model_copy["id"] = model_id
+                    changed = True
+            if model_copy.get("enabled") is None:
+                model_copy["enabled"] = True
+                changed = True
+            normalized_models.append(model_copy)
+
+        endpoint_copy["models"] = normalized_models
+        normalized.append(endpoint_copy)
+
+    return normalized, changed
+
+
+def is_frontend_visible_model_endpoint_provider(provider):
+    """Return whether the provider should be exposed in user-facing endpoint UIs."""
+    normalized_provider = (provider or "aoai").lower()
+    return normalized_provider in {"aoai", "aifoundry", "new_foundry"}
+
+
+def merge_model_endpoint_auth(existing_auth, incoming_auth):
+    """Merge endpoint auth settings while preserving stored secrets when inputs are blank."""
+    if not isinstance(existing_auth, dict):
+        existing_auth = {}
+    if not isinstance(incoming_auth, dict):
+        incoming_auth = {}
+
+    merged = dict(existing_auth)
+    for key, value in incoming_auth.items():
+        if value in (None, ""):
+            continue
+        merged[key] = value
+    return merged
+
+
+def merge_model_endpoint_payload(existing_endpoint, incoming_endpoint):
+    """Merge an incoming endpoint payload with an existing saved endpoint."""
+    if not isinstance(existing_endpoint, dict):
+        return incoming_endpoint if isinstance(incoming_endpoint, dict) else {}
+    if not isinstance(incoming_endpoint, dict):
+        return dict(existing_endpoint)
+
+    merged = dict(existing_endpoint)
+    for key, value in incoming_endpoint.items():
+        if key == "auth":
+            merged["auth"] = merge_model_endpoint_auth(existing_endpoint.get("auth"), value)
+            continue
+        if value in (None, ""):
+            continue
+        merged[key] = value
+    return merged
+
+
+def merge_model_endpoints_with_existing(incoming_endpoints, existing_endpoints):
+    """Merge endpoint lists by endpoint ID so edits preserve stored auth values."""
+    if not isinstance(incoming_endpoints, list):
+        return []
+
+    existing_by_id = {}
+    if isinstance(existing_endpoints, list):
+        existing_by_id = {
+            endpoint.get("id"): endpoint
+            for endpoint in existing_endpoints
+            if isinstance(endpoint, dict) and endpoint.get("id")
+        }
+
+    merged = []
+    incoming_endpoint_ids = set()
+    for endpoint in incoming_endpoints:
+        if not isinstance(endpoint, dict):
+            continue
+        endpoint_id = endpoint.get("id")
+        if endpoint_id:
+            incoming_endpoint_ids.add(endpoint_id)
+        existing_endpoint = existing_by_id.get(endpoint_id)
+        merged.append(merge_model_endpoint_payload(existing_endpoint or {}, endpoint))
+
+    if isinstance(existing_endpoints, list):
+        for endpoint in existing_endpoints:
+            if not isinstance(endpoint, dict):
+                continue
+            endpoint_id = endpoint.get("id")
+            if endpoint_id in incoming_endpoint_ids:
+                continue
+            if is_frontend_visible_model_endpoint_provider(endpoint.get("provider")):
+                continue
+            merged.append(json.loads(json.dumps(endpoint)))
+
+    return merged
+
+
+def sanitize_model_endpoints_for_frontend(endpoints):
+    """Return model endpoint configs with secrets stripped for frontend use."""
+    normalized, _ = normalize_model_endpoints(endpoints)
+    if not isinstance(normalized, list):
+        return []
+
+    sanitized = []
+    for endpoint in normalized:
+        if not isinstance(endpoint, dict):
+            continue
+        if not is_frontend_visible_model_endpoint_provider(endpoint.get("provider")):
+            continue
+        endpoint_copy = json.loads(json.dumps(endpoint))
+        auth = endpoint_copy.get("auth") or {}
+        has_api_key = bool(auth.get("api_key"))
+        has_client_secret = bool(auth.get("client_secret"))
+        auth.pop("api_key", None)
+        auth.pop("client_secret", None)
+        endpoint_copy["auth"] = auth
+        endpoint_copy["has_api_key"] = has_api_key
+        endpoint_copy["has_client_secret"] = has_client_secret
+        sanitized.append(endpoint_copy)
+
+    return sanitized
+
 def encrypt_key(key):
     cipher_suite = Fernet(app.config['SECRET_KEY'])
     encrypted_key = cipher_suite.encrypt(key.encode())
@@ -574,6 +874,9 @@ def get_user_settings(user_id):
                 "previous_type": previous_type,
             })
         
+        if 'personal_model_endpoints' not in doc['settings']:
+            doc['settings']['personal_model_endpoints'] = []
+        
         # Try to update email/display_name if missing and available in session
         user = session.get("user", {})
         email = user.get("preferred_username") or user.get("email")
@@ -606,6 +909,7 @@ def get_user_settings(user_id):
         email = user.get("preferred_username") or user.get("email")
         display_name = user.get("name")
         doc = {"id": user_id, "settings": {}}
+        doc["settings"]["personal_model_endpoints"] = []
         if email:
             doc["email"] = email
         if display_name:
@@ -804,6 +1108,9 @@ def sanitize_settings_for_user(full_settings: dict) -> dict:
     for k, v in full_settings.items():
         if any(term in k.lower() for term in sensitive_terms):
             continue
+        if k in ('model_endpoints', 'personal_model_endpoints') and isinstance(v, list):
+            sanitized[k] = sanitize_model_endpoints_for_frontend(v)
+            continue
         if isinstance(v, dict):
             sanitized[k] = sanitize_settings_for_user(v)
         elif isinstance(v, list):
@@ -835,7 +1142,7 @@ def sanitize_settings_for_logging(full_settings: dict) -> dict:
         return full_settings
     
     sanitized = {}
-    sensitive_key_terms = ["key", "base64", "image", "storage_account_url"]
+    sensitive_key_terms = ["key", "base64", "image", "storage_account_url", "_secret"]
     
     for k, v in full_settings.items():
         # Skip keys with sensitive terms
diff --git a/application/single_app/functions_thoughts.py b/application/single_app/functions_thoughts.py
index c6ffe9dd..b7721253 100644
--- a/application/single_app/functions_thoughts.py
+++ b/application/single_app/functions_thoughts.py
@@ -2,8 +2,8 @@
 
 import uuid
 import time
-from datetime import datetime, timezone
-from config import cosmos_thoughts_container, cosmos_archived_thoughts_container, cosmos_messages_container
+from datetime import datetime, timedelta, timezone
+from config import cosmos_thoughts_container, cosmos_archived_thoughts_container
 from functions_appinsights import log_event
 from functions_settings import get_settings
 
@@ -136,27 +136,33 @@ def get_thoughts_for_message(conversation_id, message_id, user_id):
         return []
 
 
-def get_pending_thoughts(conversation_id, user_id):
+def get_pending_thoughts(conversation_id, user_id, message_id=None):
     """Return the latest thoughts for a conversation that are still in-progress.
 
     Used by the polling endpoint.  Retrieves thoughts created within the last
-    5 minutes for the conversation, grouped by the most recent message_id.
+    5 minutes for the conversation. When a message_id is provided, only
+    thoughts for that assistant message are returned.
     """
     try:
-        five_minutes_ago = datetime.now(timezone.utc)
-        from datetime import timedelta
-        five_minutes_ago = (five_minutes_ago - timedelta(minutes=5)).isoformat()
+        five_minutes_ago = (datetime.now(timezone.utc) - timedelta(minutes=5)).isoformat()
 
-        query = (
-            "SELECT * FROM c "
-            "WHERE c.conversation_id = @conv_id "
-            "AND c.timestamp >= @since "
-            "ORDER BY c.timestamp DESC"
-        )
+        query_parts = [
+            "SELECT * FROM c ",
+            "WHERE c.conversation_id = @conv_id ",
+            "AND c.timestamp >= @since ",
+        ]
         params = [
             {"name": "@conv_id", "value": conversation_id},
             {"name": "@since", "value": five_minutes_ago},
         ]
+
+        if message_id:
+            query_parts.append("AND c.message_id = @msg_id ")
+            params.append({"name": "@msg_id", "value": message_id})
+
+        query_parts.append("ORDER BY c.timestamp DESC")
+        query = ''.join(query_parts)
+
         results = list(cosmos_thoughts_container.query_items(
             query=query,
             parameters=params,
@@ -166,14 +172,16 @@ def get_pending_thoughts(conversation_id, user_id):
         if not results:
             return []
 
-        # Group by the most recent message_id
-        latest_message_id = results[0].get('message_id')
-        latest_thoughts = [
-            t for t in results if t.get('message_id') == latest_message_id
-        ]
-        # Return in ascending step_index order
-        latest_thoughts.sort(key=lambda t: t.get('step_index', 0))
-        return latest_thoughts
+        if message_id:
+            pending_thoughts = results
+        else:
+            latest_message_id = results[0].get('message_id')
+            pending_thoughts = [
+                t for t in results if t.get('message_id') == latest_message_id
+            ]
+
+        pending_thoughts.sort(key=lambda t: t.get('step_index', 0))
+        return pending_thoughts
     except Exception as e:
         log_event(f"get_pending_thoughts failed: {e}", level="WARNING")
         return []
diff --git a/application/single_app/requirements.txt b/application/single_app/requirements.txt
index ac378dde..8039c4c1 100644
--- a/application/single_app/requirements.txt
+++ b/application/single_app/requirements.txt
@@ -6,7 +6,7 @@ Flask-WTF==1.2.1
 gunicorn>=23.0.0
 Werkzeug==3.1.5
 requests==2.32.4
-openai>=1.98.0,<2.0.0
+openai>=1.98.0
 docx2txt==0.8
 Markdown==3.3.4
 bleach==6.1.0
@@ -22,6 +22,8 @@ threadpoolctl==3.5.0
 azure-search-documents==11.5.3
 python-dotenv==0.21.0
 azure-ai-formrecognizer==3.3.3
+azure-ai-projects>=1.0.0,<2.0.0
+azure-ai-agents>=1.0.0
 pyjwt>=2.9.0
 markdown2==2.5.3
 azure-mgmt-cognitiveservices==13.6.0
@@ -42,6 +44,7 @@ pillow==12.1.1
 ffmpeg-binaries-compat==1.0.1
 ffmpeg-python==0.2.0
 semantic-kernel>=1.39.4
+protobuf>=5,<6 # support for broken SK >=1.40.0 versions, can be removed once SK releases a fixed version
 redis>=5.0,<6.0
 pyodbc>=4.0.0
 PyMySQL>=1.0.0
diff --git a/application/single_app/route_backend_agent_templates.py b/application/single_app/route_backend_agent_templates.py
index 282b157c..25a87a8d 100644
--- a/application/single_app/route_backend_agent_templates.py
+++ b/application/single_app/route_backend_agent_templates.py
@@ -179,7 +179,7 @@ def admin_reject_agent_template(template_id):
 @swagger_route(security=get_auth_security())
 def admin_delete_agent_template(template_id):
     try:
-        deleted = delete_agent_template(template_id)
+        deleted = delete_agent_template(template_id, actor_info=get_current_user_info())
     except Exception:
         return jsonify({'error': 'Failed to delete template.'}), 500
 
diff --git a/application/single_app/route_backend_agents.py b/application/single_app/route_backend_agents.py
index 2f631af7..bd31d4a8 100644
--- a/application/single_app/route_backend_agents.py
+++ b/application/single_app/route_backend_agents.py
@@ -21,6 +21,7 @@
 from functions_debug import debug_print
 from functions_authentication import *
 from functions_appinsights import log_event
+from functions_group import get_group_model_endpoints, require_active_group
 from json_schema_validation import validate_agent
 from swagger_wrapper import swagger_route, get_auth_security
 from functions_activity_logging import (
@@ -31,6 +32,92 @@
 
 bpa = Blueprint('admin_agents', __name__)
 
+
+def _build_user_selectable_agents(user_id, requested_agent=None):
+    """Build the set of agents the current user is allowed to select."""
+    settings = get_settings()
+    requested_agent = requested_agent or {}
+    candidates = []
+
+    for agent in get_personal_agents(user_id):
+        candidate = dict(agent)
+        candidate['is_global'] = False
+        candidate['is_group'] = False
+        candidate['group_id'] = None
+        candidate['group_name'] = None
+        candidates.append(candidate)
+
+    merge_global = settings.get('per_user_semantic_kernel', False) and settings.get('merge_global_semantic_kernel_with_workspace', False)
+    if merge_global or requested_agent.get('is_global'):
+        for agent in get_global_agents():
+            candidate = dict(agent)
+            candidate['is_global'] = True
+            candidate['is_group'] = False
+            candidate['group_id'] = None
+            candidate['group_name'] = None
+            candidates.append(candidate)
+
+    requested_group_id = str(requested_agent.get('group_id') or '').strip()
+    if requested_agent.get('is_group') and not requested_group_id:
+        try:
+            requested_group_id = require_active_group(user_id)
+        except Exception:
+            requested_group_id = ''
+
+    if requested_group_id:
+        requested_group_name = requested_agent.get('group_name')
+        for agent in get_group_agents(requested_group_id):
+            candidate = dict(agent)
+            candidate['is_global'] = False
+            candidate['is_group'] = True
+            candidate['group_id'] = requested_group_id
+            if requested_group_name and not candidate.get('group_name'):
+                candidate['group_name'] = requested_group_name
+            candidates.append(candidate)
+
+    return candidates
+
+
+def _find_matching_user_selected_agent(candidates, requested_agent):
+    """Return the canonical agent record matching the requested selection payload."""
+    if not isinstance(requested_agent, dict):
+        return None
+
+    requested_name = str(requested_agent.get('name') or '').strip()
+    requested_id = str(requested_agent.get('id') or '').strip()
+    requested_is_global = bool(requested_agent.get('is_global', False))
+    requested_is_group = bool(requested_agent.get('is_group', False))
+    requested_group_id = str(requested_agent.get('group_id') or '').strip()
+
+    def scope_matches(candidate):
+        candidate_is_global = bool(candidate.get('is_global', False))
+        candidate_is_group = bool(candidate.get('is_group', False))
+        if requested_is_group:
+            if not candidate_is_group:
+                return False
+            if requested_group_id:
+                return str(candidate.get('group_id') or '') == requested_group_id
+            return True
+        if requested_is_global:
+            return candidate_is_global and not candidate_is_group
+        return not candidate_is_global and not candidate_is_group
+
+    if requested_id:
+        match = next(
+            (candidate for candidate in candidates if str(candidate.get('id') or '') == requested_id and scope_matches(candidate)),
+            None,
+        )
+        if match:
+            return match
+
+    if requested_name:
+        return next(
+            (candidate for candidate in candidates if candidate.get('name') == requested_name and scope_matches(candidate)),
+            None,
+        )
+
+    return None
+
 # === AGENT GUID GENERATION ENDPOINT ===
 @bpa.route('/api/agents/generate_id', methods=['GET'])
 @swagger_route(
@@ -48,6 +135,9 @@ def generate_agent_id():
 )
 @login_required
 def get_user_agents():
+    settings = get_settings()
+    if not settings.get('allow_user_agents', False):
+        return jsonify([])
     user_id = get_current_user_id()
     # Ensure migration is complete (will migrate any remaining legacy data)
     ensure_migration_complete(user_id)
@@ -62,7 +152,6 @@ def get_user_agents():
         agent.setdefault('agent_type', 'local')
 
     # Check global/merge toggles
-    settings = get_settings()
     per_user = settings.get('per_user_semantic_kernel', False)
     merge_global = settings.get('merge_global_semantic_kernel_with_workspace', False)
     if per_user and merge_global:
@@ -103,7 +192,7 @@ def set_user_agents():
     agents = request.json if isinstance(request.json, list) else []
     settings = get_settings()
     # If custom endpoints are not allowed, strip deployment settings for endpoint, key, and api-revision
-    if not settings.get('allow_user_custom_agent_endpoints', False):
+    if not settings.get('allow_user_custom_endpoints', False):
         for agent in agents:
             # APIM fields
             for k in ['azure_agent_apim_gpt_endpoint', 'azure_agent_apim_gpt_subscription_key', 'azure_agent_apim_gpt_api_revision']:
@@ -213,6 +302,7 @@ def delete_user_agent(agent_name):
 @login_required
 @user_required
 @enabled_required('enable_group_workspaces')
+@enabled_required('allow_group_agents')
 def get_group_agents_route():
     user_id = get_current_user_id()
     try:
@@ -238,6 +328,7 @@ def get_group_agents_route():
 @login_required
 @user_required
 @enabled_required('enable_group_workspaces')
+@enabled_required('allow_group_agents')
 def get_group_agent_route(agent_id):
     user_id = get_current_user_id()
     try:
@@ -265,6 +356,7 @@ def get_group_agent_route(agent_id):
 @login_required
 @user_required
 @enabled_required('enable_group_workspaces')
+@enabled_required('allow_group_agents')
 def create_group_agent_route():
     user_id = get_current_user_id()
     try:
@@ -286,6 +378,18 @@ def create_group_agent_route():
     except (ValueError, AgentPayloadError) as exc:
         return jsonify({'error': str(exc)}), 400
 
+    settings = get_settings()
+    if not settings.get('allow_group_custom_endpoints', False):
+        for key in [
+            'azure_agent_apim_gpt_endpoint',
+            'azure_agent_apim_gpt_subscription_key',
+            'azure_agent_apim_gpt_api_revision',
+            'azure_openai_gpt_endpoint',
+            'azure_openai_gpt_key',
+            'azure_openai_gpt_api_revision'
+        ]:
+            cleaned_payload.pop(key, None)
+
     for key in ('group_id', 'last_updated', 'is_global', 'is_group'):
         cleaned_payload.pop(key, None)
 
@@ -304,6 +408,7 @@ def create_group_agent_route():
 @login_required
 @user_required
 @enabled_required('enable_group_workspaces')
+@enabled_required('allow_group_agents')
 def update_group_agent_route(agent_id):
     user_id = get_current_user_id()
     try:
@@ -345,6 +450,18 @@ def update_group_agent_route(agent_id):
     except AgentPayloadError as exc:
         return jsonify({'error': str(exc)}), 400
 
+    settings = get_settings()
+    if not settings.get('allow_group_custom_endpoints', False):
+        for key in [
+            'azure_agent_apim_gpt_endpoint',
+            'azure_agent_apim_gpt_subscription_key',
+            'azure_agent_apim_gpt_api_revision',
+            'azure_openai_gpt_endpoint',
+            'azure_openai_gpt_key',
+            'azure_openai_gpt_api_revision'
+        ]:
+            cleaned_payload.pop(key, None)
+
     try:
         saved = save_group_agent(active_group, cleaned_payload, user_id=user_id)
     except Exception as exc:
@@ -360,6 +477,7 @@ def update_group_agent_route(agent_id):
 @login_required
 @user_required
 @enabled_required('enable_group_workspaces')
+@enabled_required('allow_group_agents')
 def delete_group_agent_route(agent_id):
     user_id = get_current_user_id()
     try:
@@ -397,23 +515,31 @@ def set_user_selected_agent():
     selected_agent = data.get('selected_agent')
     if not selected_agent:
         return jsonify({'error': 'selected_agent is required.'}), 400
+    if not isinstance(selected_agent, dict):
+        return jsonify({'error': 'selected_agent must be an object.'}), 400
+
+    candidates = _build_user_selectable_agents(user_id, requested_agent=selected_agent)
+    matched_agent = _find_matching_user_selected_agent(candidates, selected_agent)
+    if not matched_agent:
+        return jsonify({'error': 'Selected agent is not available for this user or scope.'}), 400
+
     user_settings = get_user_settings(user_id)
     settings_to_update = user_settings.get('settings', {})
-    agent_name = (selected_agent.get('name') or '').strip()
+    agent_name = (matched_agent.get('name') or '').strip()
     if not agent_name:
         return jsonify({'error': 'selected_agent.name is required.'}), 400
     agent = {
-        "id": selected_agent.get('id'),
+        "id": matched_agent.get('id'),
         "name": agent_name,
-        "display_name": selected_agent.get('display_name'),
-        "is_global": selected_agent.get('is_global', False),
-        "is_group": selected_agent.get('is_group', False),
-        "group_id": selected_agent.get('group_id'),
-        "group_name": selected_agent.get('group_name')
+        "display_name": matched_agent.get('display_name', matched_agent.get('name')),
+        "is_global": matched_agent.get('is_global', False),
+        "is_group": matched_agent.get('is_group', False),
+        "group_id": matched_agent.get('group_id'),
+        "group_name": matched_agent.get('group_name')
     }
     settings_to_update['selected_agent'] = agent
     update_user_settings(user_id, settings_to_update)
-    log_event("User selected agent set", extra={"user_id": user_id, "selected_agent": selected_agent})
+    log_event("User selected agent set", extra={"user_id": user_id, "selected_agent": agent})
     return jsonify({'success': True})
 
 @bpa.route('/api/user/agent/settings', methods=['GET'])
@@ -422,7 +548,23 @@ def set_user_selected_agent():
 )
 @login_required
 def get_global_agent_settings_for_users():
-    return get_global_agent_settings(include_admin_extras=False)
+    user_id = get_current_user_id()
+    return get_global_agent_settings(include_admin_extras=False, user_id=user_id)
+
+@bpa.route('/api/group/agent/settings', methods=['GET'])
+@swagger_route(
+    security=get_auth_security()
+)
+@login_required
+@user_required
+@enabled_required('enable_group_workspaces')
+def get_group_agent_settings():
+    user_id = get_current_user_id()
+    try:
+        group_id = require_active_group(user_id)
+    except ValueError as exc:
+        return jsonify({'error': str(exc)}), 400
+    return get_global_agent_settings(include_admin_extras=False, user_id=user_id, group_id=group_id)
 
 # === ADMIN AGENTS ENDPOINTS ===
 @bpa.route('/api/admin/agent/settings', methods=['GET'])
@@ -751,9 +893,50 @@ def orchestration_settings():
             log_event(f"Error updating orchestration settings: {e}", level=logging.ERROR, exceptionTraceback=True)
             return jsonify({'error': 'Failed to update orchestration settings.'}), 500
 
-def get_global_agent_settings(include_admin_extras=False):    
+def build_combined_model_endpoints(settings, user_id=None, group_id=None):
+    endpoints = []
+    global_endpoints = settings.get("model_endpoints", []) or []
+    for endpoint in global_endpoints:
+        enriched = dict(endpoint)
+        enriched["scope"] = "global"
+        endpoints.append(enriched)
+
+    allow_user_custom_endpoints = settings.get("allow_user_custom_endpoints", False)
+    allow_group_custom_endpoints = settings.get("allow_group_custom_endpoints", False)
+
+    if group_id:
+        if allow_group_custom_endpoints:
+            group_endpoints = get_group_model_endpoints(group_id)
+            for endpoint in group_endpoints:
+                enriched = dict(endpoint)
+                enriched["scope"] = "group"
+                enriched["group_id"] = group_id
+                endpoints.append(enriched)
+    elif user_id:
+        if allow_user_custom_endpoints:
+            user_settings = get_user_settings(user_id)
+            personal = user_settings.get("settings", {}).get("personal_model_endpoints", [])
+            for endpoint in personal:
+                enriched = dict(endpoint)
+                enriched["scope"] = "user"
+                endpoints.append(enriched)
+
+    return sanitize_model_endpoints_for_frontend(endpoints)
+
+
+def get_global_agent_settings(include_admin_extras=False, user_id=None, group_id=None):    
     settings = get_settings()
     agents = get_global_agents()
+    combined_endpoints = []
+    base_endpoints = settings.get("model_endpoints", []) or []
+    multi_flag = settings.get("enable_multi_model_endpoints", False)
+    allow_custom = settings.get("allow_user_custom_endpoints", False) or settings.get("allow_group_custom_endpoints", False)
+    should_include_endpoints = multi_flag or base_endpoints or allow_custom
+
+    if should_include_endpoints:
+        combined_endpoints = build_combined_model_endpoints(settings, user_id=user_id, group_id=group_id)
+
+    effective_multi_flag = bool(multi_flag or combined_endpoints)
     
     # Return selected_agent and any other relevant settings for admin UI
     return jsonify({
@@ -775,8 +958,16 @@ def get_global_agent_settings(include_admin_extras=False):
         "azure_apim_gpt_deployment": settings.get("azure_apim_gpt_deployment", ""),
         "gpt_model": settings.get("gpt_model", {}),
         "allow_user_agents": settings.get("allow_user_agents", False),
-        "allow_user_custom_agent_endpoints": settings.get("allow_user_custom_agent_endpoints", False),
+        "allow_user_custom_endpoints": settings.get("allow_user_custom_endpoints", False),
         "allow_group_agents": settings.get("allow_group_agents", False),
-        "allow_group_custom_agent_endpoints": settings.get("allow_group_custom_agent_endpoints", False),
+        "allow_group_custom_endpoints": settings.get("allow_group_custom_endpoints", False),
+        "allow_ai_foundry_agents": settings.get("allow_ai_foundry_agents", False),
+        "allow_group_ai_foundry_agents": settings.get("allow_group_ai_foundry_agents", False),
+        "allow_personal_ai_foundry_agents": settings.get("allow_personal_ai_foundry_agents", False),
+        "allow_new_foundry_agents": settings.get("allow_new_foundry_agents", False),
+        "allow_group_new_foundry_agents": settings.get("allow_group_new_foundry_agents", False),
+        "allow_personal_new_foundry_agents": settings.get("allow_personal_new_foundry_agents", False),
+        "enable_multi_model_endpoints": effective_multi_flag,
+        "model_endpoints": combined_endpoints,
     })
     
\ No newline at end of file
diff --git a/application/single_app/route_backend_chats.py b/application/single_app/route_backend_chats.py
index 33ce24aa..6015a6ad 100644
--- a/application/single_app/route_backend_chats.py
+++ b/application/single_app/route_backend_chats.py
@@ -7,15 +7,22 @@
 from semantic_kernel.connectors.ai.chat_completion_client_base import ChatCompletionClientBase
 from semantic_kernel_fact_memory_store import FactMemoryStore
 from semantic_kernel_loader import initialize_semantic_kernel
+from semantic_kernel_plugins.plugin_invocation_thoughts import (
+    format_plugin_invocation_thought,
+    register_plugin_invocation_thought_callback,
+)
 from semantic_kernel_plugins.plugin_invocation_logger import get_plugin_logger
-from foundry_agent_runtime import FoundryAgentInvocationError, execute_foundry_agent
+from foundry_agent_runtime import FoundryAgentInvocationError, execute_foundry_agent, resolve_authority
 import builtins
 import asyncio, types
 import ast
+import inspect
 import json
 import os
+import app_settings_cache
 import queue
 import re
+from urllib.parse import urlparse
 import threading
 from typing import Any, Dict, List, Mapping, Optional
 from config import *
@@ -33,6 +40,7 @@
 from functions_activity_logging import log_chat_activity, log_conversation_creation, log_token_usage
 from flask import current_app
 from swagger_wrapper import swagger_route, get_auth_security
+from azure.identity import DefaultAzureCredential, get_bearer_token_provider
 from functions_thoughts import ThoughtTracker
 
 
@@ -240,7 +248,6 @@ def get_kernel_agents():
     log_event(f"[SKChat] get_kernel_agents - g.kernel_agents: {type(g_agents)} ({len(g_agents) if g_agents else 0} agents), builtins.kernel_agents: {type(builtins_agents)} ({len(builtins_agents) if builtins_agents else 0} agents)", level=logging.INFO)
     return g_agents or builtins_agents
 
-
 def is_personal_chat_conversation(conversation_item):
     """Return True when a conversation belongs to personal chat scope."""
     chat_type = str((conversation_item or {}).get('chat_type') or '').strip().lower()
@@ -289,7 +296,18 @@ def finish(self):
     def iter_events(self):
         """Yield queued SSE events until the worker finishes."""
         while True:
-            next_item = self._queue.get()
+            try:
+                next_item = self._queue.get(timeout=15)
+            except queue.Empty:
+                with self._state_lock:
+                    consumer_attached = self._consumer_attached
+
+                if not consumer_attached:
+                    break
+
+                yield ': keep-alive\n\n'
+                continue
+
             if next_item is self._sentinel:
                 break
             yield next_item
@@ -310,6 +328,209 @@ def detach_consumer(self):
                 break
 
 
+def _extract_sse_event_payload(event_text):
+    """Parse JSON data lines from a raw SSE event string."""
+    if not isinstance(event_text, str):
+        return None
+
+    data_lines = [
+        line[5:].lstrip()
+        for line in event_text.splitlines()
+        if line.startswith('data:')
+    ]
+    if not data_lines:
+        return None
+
+    try:
+        return json.loads('\n'.join(data_lines))
+    except (TypeError, ValueError):
+        return None
+
+
+class ActiveConversationStreamSession:
+    """Keep an in-flight stream replayable for reconnecting consumers."""
+
+    HEARTBEAT_EVENT = ': keep-alive\n\n'
+
+    def __init__(self, user_id, conversation_id, heartbeat_interval_seconds=15, session_ttl_seconds=600):
+        self.user_id = user_id
+        self.conversation_id = conversation_id
+        self.heartbeat_interval_seconds = heartbeat_interval_seconds
+        self.session_ttl_seconds = session_ttl_seconds
+        self.cache_key = f'{user_id}:{conversation_id}'
+        self._condition = threading.Condition()
+        self._accepting_events = True
+
+    def _build_metadata(self, active):
+        return {
+            'user_id': self.user_id,
+            'conversation_id': self.conversation_id,
+            'active': bool(active),
+            'heartbeat_interval_seconds': self.heartbeat_interval_seconds,
+            'updated_at': datetime.utcnow().isoformat(),
+        }
+
+    def initialize(self):
+        """Initialize the stream session cache state for a new live response."""
+        app_settings_cache.initialize_stream_session_cache(
+            self.cache_key,
+            self._build_metadata(active=True),
+            ttl_seconds=self.session_ttl_seconds,
+        )
+
+    def publish(self, event_text):
+        """Append an SSE event to the replay history and notify listeners."""
+        if event_text is None:
+            return False
+
+        with self._condition:
+            if not self._accepting_events:
+                return False
+
+        payload = _extract_sse_event_payload(event_text)
+        is_terminal_event = isinstance(payload, dict) and (payload.get('done') or payload.get('error'))
+
+        app_settings_cache.append_stream_session_event(
+            self.cache_key,
+            event_text,
+            ttl_seconds=self.session_ttl_seconds,
+        )
+        app_settings_cache.set_stream_session_meta(
+            self.cache_key,
+            self._build_metadata(active=not is_terminal_event),
+            ttl_seconds=self.session_ttl_seconds,
+        )
+
+        with self._condition:
+            self._condition.notify_all()
+            return True
+
+    def close(self):
+        """Mark the session as closed once the worker has no more events."""
+        with self._condition:
+            self._accepting_events = False
+            self._condition.notify_all()
+
+        app_settings_cache.set_stream_session_meta(
+            self.cache_key,
+            self._build_metadata(active=False),
+            ttl_seconds=self.session_ttl_seconds,
+        )
+
+    def is_active(self):
+        metadata = app_settings_cache.get_stream_session_meta(self.cache_key) or {}
+        return bool(metadata.get('active'))
+
+    def is_expired(self, ttl_seconds):
+        metadata = app_settings_cache.get_stream_session_meta(self.cache_key)
+        return metadata is None
+
+    def iter_events(self, start_index=0):
+        """Yield replayed and live SSE events, with heartbeat comments while idle."""
+        next_index = max(int(start_index or 0), 0)
+        last_heartbeat_at = time.time()
+
+        while True:
+            pending_events = app_settings_cache.get_stream_session_events(
+                self.cache_key,
+                start_index=next_index,
+            ) or []
+            if pending_events:
+                for event_to_yield in pending_events:
+                    next_index += 1
+                    last_heartbeat_at = time.time()
+                    yield event_to_yield
+                continue
+
+            metadata = app_settings_cache.get_stream_session_meta(self.cache_key)
+            if not metadata:
+                return
+
+            heartbeat_interval_seconds = int(
+                metadata.get('heartbeat_interval_seconds') or self.heartbeat_interval_seconds
+            )
+            if not metadata.get('active'):
+                return
+
+            remaining_heartbeat_seconds = max(
+                heartbeat_interval_seconds - (time.time() - last_heartbeat_at),
+                0.25,
+            )
+            with self._condition:
+                self._condition.wait(timeout=min(1.0, remaining_heartbeat_seconds))
+
+            if (time.time() - last_heartbeat_at) >= heartbeat_interval_seconds:
+                last_heartbeat_at = time.time()
+                yield self.HEARTBEAT_EVENT
+
+
+class ActiveConversationStreamRegistry:
+    """Track live chat streams per user and conversation for reconnect support."""
+
+    def __init__(self, completed_session_ttl_seconds=600, heartbeat_interval_seconds=15):
+        self.completed_session_ttl_seconds = completed_session_ttl_seconds
+        self.heartbeat_interval_seconds = heartbeat_interval_seconds
+        self._sessions = {}
+        self._lock = threading.Lock()
+
+    def _cleanup_locked(self):
+        expired_keys = [
+            key for key, session in self._sessions.items()
+            if session.is_expired(self.completed_session_ttl_seconds)
+        ]
+        for key in expired_keys:
+            self._sessions.pop(key, None)
+
+    def start_session(self, user_id, conversation_id):
+        if not user_id or not conversation_id:
+            return None
+
+        with self._lock:
+            self._cleanup_locked()
+            key = (user_id, conversation_id)
+            existing_session = self._sessions.get(key)
+            if existing_session and existing_session.is_active():
+                existing_session.close()
+
+            session = ActiveConversationStreamSession(
+                user_id=user_id,
+                conversation_id=conversation_id,
+                heartbeat_interval_seconds=self.heartbeat_interval_seconds,
+                session_ttl_seconds=self.completed_session_ttl_seconds,
+            )
+            self._sessions[key] = session
+            session.initialize()
+            return session
+
+    def get_session(self, user_id, conversation_id, active_only=False):
+        if not user_id or not conversation_id:
+            return None
+
+        with self._lock:
+            self._cleanup_locked()
+            key = (user_id, conversation_id)
+            session = self._sessions.get(key)
+            if not session:
+                metadata = app_settings_cache.get_stream_session_meta(f'{user_id}:{conversation_id}')
+                if not metadata:
+                    return None
+                session = ActiveConversationStreamSession(
+                    user_id=user_id,
+                    conversation_id=conversation_id,
+                    heartbeat_interval_seconds=int(
+                        metadata.get('heartbeat_interval_seconds') or self.heartbeat_interval_seconds
+                    ),
+                    session_ttl_seconds=self.completed_session_ttl_seconds,
+                )
+                self._sessions[key] = session
+            if active_only and not session.is_active():
+                return None
+            return session
+
+
+CHAT_STREAM_REGISTRY = ActiveConversationStreamRegistry()
+
+
 def get_new_plugin_invocations(invocations, baseline_count):
     """Return only the plugin invocations created after the baseline count."""
     if not invocations:
@@ -2061,21 +2282,39 @@ def determine_tabular_source_hint(document_scope, active_group_id=None, active_p
 
 
 def register_route_backend_chats(app):
-    def build_background_stream_response(event_generator_factory):
+    def build_background_stream_response(event_generator_factory, stream_session=None):
         """Run SSE generation in background execution so it survives disconnects."""
         stream_bridge = BackgroundStreamBridge()
 
+        def publish_background_event(event_text):
+            if event_text is None:
+                return False
+
+            if stream_session:
+                stream_session.publish(event_text)
+
+            return stream_bridge.push(event_text)
+
         @copy_current_request_context
         def stream_worker():
             try:
-                for event in event_generator_factory():
-                    stream_bridge.push(event)
+                generator_signature = inspect.signature(event_generator_factory)
+                if 'publish_background_event' in generator_signature.parameters:
+                    event_iterator = event_generator_factory(
+                        publish_background_event=publish_background_event
+                    )
+                else:
+                    event_iterator = event_generator_factory()
+
+                for event in event_iterator:
+                    publish_background_event(event)
             except Exception as e:
                 debug_print(f"[STREAM BACKGROUND] Worker error: {e}")
-                stream_bridge.push(
-                    f"data: {json.dumps({'error': f'Internal server error: {str(e)}'})}\n\n"
-                )
+                error_event = f"data: {json.dumps({'error': f'Internal server error: {str(e)}'})}\n\n"
+                publish_background_event(error_event)
             finally:
+                if stream_session:
+                    stream_session.close()
                 stream_bridge.finish()
 
         executor = current_app.extensions.get('executor')
@@ -2125,6 +2364,9 @@ def chat_api():
                     'error': 'User not authenticated'
                 }), 401
 
+            # Extract agent_info early to guide GPT initialization decisions
+            request_agent_info = data.get('agent_info')
+
             # Extract from request
             user_message = data.get('message', '')
             conversation_id = data.get('conversation_id')
@@ -2150,7 +2392,7 @@ def parse_json_string(candidate: str) -> Any:
                 except Exception as exc:
                     log_event(
                         f"[result_requires_message_reload] Failed to parse JSON: {str(exc)} | candidate: {trimmed[:200]}",
-                        level=logging.DEBUG
+                        level=logging.WARNING
                     )
                     return None
 
@@ -2198,6 +2440,7 @@ def result_requires_message_reload(result: Any) -> bool:
                 if isinstance(result, dict):
                     return dict_requires_reload(result)
                 return False
+
             active_group_id = data.get('active_group_id')
             active_group_ids = data.get('active_group_ids', [])
             # Backwards compat: if new list not provided, wrap single ID
@@ -2274,11 +2517,38 @@ def result_requires_message_reload(result: Any) -> bool:
             # GPT & Image generation APIM or direct
             gpt_model = ""
             gpt_client = None
+            gpt_provider = None
+            gpt_endpoint = None
+            gpt_auth = None
+            gpt_api_version = None
             enable_gpt_apim = settings.get('enable_gpt_apim', False)
             enable_image_gen_apim = settings.get('enable_image_gen_apim', False)
-
+            should_use_default_model = (
+                bool(request_agent_info)
+                and settings.get('enable_multi_model_endpoints', False)
+                and not data.get('model_id')
+                and not data.get('model_endpoint_id')
+            )
             try:
-                if enable_gpt_apim:
+                multi_endpoint_config = None
+                if should_use_default_model:
+                    try:
+                        multi_endpoint_config = resolve_default_model_gpt_config(settings)
+                        if multi_endpoint_config:
+                            debug_print("[GPTClient] Using default multi-endpoint model for agent request.")
+                    except Exception as default_exc:
+                        log_event(
+                            f"[GPTClient] Default model selection unavailable: {default_exc}",
+                            level=logging.WARNING,
+                            exceptionTraceback=True
+                        )
+                if multi_endpoint_config is None and request_agent_info:
+                    debug_print("[GPTClient] Skipping multi-endpoint resolution because agent_info is provided.")
+                elif multi_endpoint_config is None:
+                    multi_endpoint_config = resolve_multi_endpoint_gpt_config(settings, data, enable_gpt_apim)
+                if multi_endpoint_config:
+                    gpt_client, gpt_model, gpt_provider, gpt_endpoint, gpt_auth, gpt_api_version = multi_endpoint_config
+                elif enable_gpt_apim:
                     # read raw comma-delimited deployments
                     raw = settings.get('azure_apim_gpt_deployment', '')
                     if not raw:
@@ -2303,10 +2573,16 @@ def result_requires_message_reload(result: Any) -> bool:
 
                     # otherwise you must pass model_deployment in the request
                     else:
-                        raise ValueError(
-                            "Multiple APIM GPT deployments configured; please include "
-                            "'model_deployment' in your request."
-                        )
+                        if request_agent_info:
+                            gpt_model = apim_models[0]
+                            debug_print(
+                                "[GPTClient] Agent request without model_deployment; defaulting to first APIM deployment."
+                            )
+                        else:
+                            raise ValueError(
+                                "Multiple APIM GPT deployments configured; please include "
+                                "'model_deployment' in your request."
+                            )
 
                     # initialize the APIM client
                     gpt_client = AzureOpenAI(
@@ -2371,7 +2647,8 @@ def result_requires_message_reload(result: Any) -> bool:
                     'title': 'New Conversation',
                     'context': [],
                     'tags': [],
-                    'strict': False
+                    'strict': False,
+                    'chat_type': 'new'
                 }
                 cosmos_conversations_container.upsert_item(conversation_item)
                 
@@ -2399,7 +2676,8 @@ def result_requires_message_reload(result: Any) -> bool:
                         'title': 'New Conversation', # Or maybe fetch title differently?
                         'context': [],
                         'tags': [],
-                        'strict': False
+                        'strict': False,
+                        'chat_type': 'new'
                     }
                     # Optionally log that a conversation was expected but not found
                     debug_print(f"Warning: Conversation ID {conversation_id} not found, creating new.")
@@ -2423,12 +2701,12 @@ def result_requires_message_reload(result: Any) -> bool:
             # Determine the actual chat context based on existing conversation or document usage
             # For existing conversations, use the chat_type from conversation metadata
             # For new conversations, it will be determined during metadata collection
-            actual_chat_type = 'personal'  # Default
+            actual_chat_type = 'personal_single_user'  # Default
             
             if conversation_item.get('chat_type'):
                 # Use existing chat_type from conversation metadata
                 actual_chat_type = conversation_item['chat_type']
-                debug_print(f"Using existing chat_type from conversation: {actual_chat_type}")
+                debug_print(f"[ChatType] Using existing chat_type from conversation: {actual_chat_type}")
             elif conversation_item.get('context'):
                 # Fallback: determine from existing context
                 primary_context = next((ctx for ctx in conversation_item['context'] if ctx.get('type') == 'primary'), None)
@@ -2438,20 +2716,30 @@ def result_requires_message_reload(result: Any) -> bool:
                     elif primary_context.get('scope') == 'public':
                         actual_chat_type = 'public'
                     elif primary_context.get('scope') == 'personal':
-                        actual_chat_type = 'personal'
-                    debug_print(f"Determined chat_type from existing primary context: {actual_chat_type}")
+                        actual_chat_type = 'personal_single_user'
+                    debug_print(f"[ChatType] Determined chat_type from existing primary context: {actual_chat_type}")
                 else:
-                    # No primary context exists - model-only conversation
-                    actual_chat_type = None  # This will result in no badges
-                    debug_print(f"No primary context found - model-only conversation")
+                    # No primary context exists - default to personal_single_user
+                    actual_chat_type = 'personal_single_user'
+                    debug_print(f"[ChatType] No primary context found - defaulted to personal_single_user")
             else:
                 # New conversation - will be determined by document usage during metadata collection
                 # For now, use the legacy logic as fallback
                 if document_scope == 'group' or (active_group_id and chat_type == 'group'):
-                    actual_chat_type = 'group'
+                    actual_chat_type = 'group-single-user'
                 elif document_scope == 'public':
                     actual_chat_type = 'public'
-                debug_print(f"New conversation - using legacy logic: {actual_chat_type}")
+                else:
+                    actual_chat_type = 'personal_single_user'
+                debug_print(f"[ChatType] New conversation - using legacy logic: {actual_chat_type}")
+
+            # Capture conversation-level group context for downstream agent/model resolution
+            conversation_primary_context = next((ctx for ctx in conversation_item.get('context', []) if ctx.get('type') == 'primary'), None)
+            conversation_group_id = None
+            if conversation_primary_context and conversation_primary_context.get('scope') == 'group':
+                conversation_group_id = conversation_primary_context.get('id')
+            if conversation_group_id:
+                g.conversation_group_id = conversation_group_id
         # region 2 - Append User Message
             # ---------------------------------------------------------------------
             # 2) Append the user message to conversation immediately (or use existing for retry)
@@ -2605,7 +2893,7 @@ def result_requires_message_reload(result: Any) -> bool:
                                     item=user_id, partition_key=user_id
                                 )
                                 selected_agent_info = user_settings_doc.get('settings', {}).get('selected_agent')
-                            except:
+                            except Exception as ex:
                                 pass
                         
                         if not selected_agent_info:
@@ -3231,7 +3519,7 @@ def result_requires_message_reload(result: Any) -> bool:
                 elif document_scope == 'public':
                     message_chat_type = 'public'  
                 else:
-                    message_chat_type = 'personal'
+                        message_chat_type = 'personal_single_user'
             else:
                 # No documents used for this message - only model knowledge
                 message_chat_type = 'Model'
@@ -4175,7 +4463,6 @@ async def run_sk_call(callable_obj, *args, **kwargs):
             enable_semantic_kernel = settings.get('enable_semantic_kernel', False)
             
             # Check if agent_info is provided in request (e.g., from retry with agent selection)
-            request_agent_info = data.get('agent_info')
             force_enable_agents = bool(request_agent_info)  # Force enable agents if agent_info provided
             
             user_enable_agents = user_settings.get('enable_agents', True)  # Default to True for backward compatibility
@@ -4183,7 +4470,12 @@ async def run_sk_call(callable_obj, *args, **kwargs):
             if force_enable_agents:
                 user_enable_agents = True
                 g.force_enable_agents = True  # Store in Flask g for SK loader to check
-                g.request_agent_name = request_agent_info.get('name') if isinstance(request_agent_info, dict) else request_agent_info
+                if isinstance(request_agent_info, dict):
+                    g.request_agent_info = request_agent_info
+                    g.request_agent_name = request_agent_info.get('name')
+                else:
+                    g.request_agent_info = {'name': request_agent_info}
+                    g.request_agent_name = request_agent_info
                 log_event(f"[SKChat] agent_info provided in request - forcing agent enablement for this request", level=logging.INFO)
             
             enable_key_vault_secret_storage = settings.get('enable_key_vault_secret_storage', False)
@@ -4229,8 +4521,12 @@ async def run_sk_call(callable_obj, *args, **kwargs):
                     log_event(f"[SKChat] Using agent from request agent_info: {agent_name_to_select}")
                 # Priority 2: Use user settings
                 elif per_user_semantic_kernel:
-                    agent_name_to_select = user_settings.get('selected_agent')
-                    log_event(f"[SKChat] Per-user mode: selected_agent from user_settings: {agent_name_to_select}")
+                    selected_agent_info = user_settings.get('selected_agent')
+                    if isinstance(selected_agent_info, dict):
+                        agent_name_to_select = selected_agent_info.get('name')
+                    else:
+                        agent_name_to_select = selected_agent_info
+                    log_event(f"[SKChat] Per-user mode: selected_agent from user_settings: {selected_agent_info}")
                 # Priority 3: Use global settings
                 else:
                     global_selected_agent_info = settings.get('global_selected_agent')
@@ -4342,19 +4638,14 @@ def orchestrator_error(e):
                     thought_tracker.add_thought('generation', f"Sending to '{agent_deployment_name}'")
 
                     # Register callback to write plugin thoughts to Cosmos in real-time
-                    callback_key = f"{user_id}:{conversation_id}"
                     plugin_logger = get_plugin_logger()
-
-                    def on_plugin_invocation(inv):
-                        duration_str = f" ({int(inv.duration_ms)}ms)" if inv.duration_ms else ""
-                        tool_name = f"{inv.plugin_name}.{inv.function_name}"
-                        thought_tracker.add_thought(
-                            'agent_tool_call',
-                            f"Agent called {tool_name}{duration_str}",
-                            detail=f"success={inv.success}"
-                        )
-
-                    plugin_logger.register_callback(callback_key, on_plugin_invocation)
+                    callback_key = register_plugin_invocation_thought_callback(
+                        plugin_logger,
+                        thought_tracker,
+                        user_id,
+                        conversation_id,
+                        actor_label='Agent'
+                    )
 
                     agent_invoke_start_time = time.time()
 
@@ -4471,7 +4762,7 @@ def agent_error(e):
                     if isinstance(selected_agent_type, str):
                         selected_agent_type = selected_agent_type.lower()
 
-                    if selected_agent_type == 'aifoundry':
+                    if selected_agent_type in ('aifoundry', 'new_foundry'):
                         def invoke_foundry_agent():
                             foundry_metadata = {
                                 'conversation_id': conversation_id,
@@ -4492,7 +4783,8 @@ def invoke_foundry_agent():
                         def foundry_agent_success(result):
                             msg = str(result)
                             notice = None
-                            agent_used = getattr(selected_agent, 'name', 'Azure AI Foundry Agent')
+                            foundry_label = 'New Foundry Application' if selected_agent_type == 'new_foundry' else 'Azure AI Foundry Agent'
+                            agent_used = getattr(selected_agent, 'name', foundry_label)
                             actual_model_deployment = (
                                 getattr(selected_agent, 'last_run_model', None)
                                 or getattr(selected_agent, 'deployment_name', None)
@@ -4521,8 +4813,8 @@ def foundry_agent_success(result):
                                         serializable = {'value': str(citation)}
                                     agent_citations_list.append({
                                         'tool_name': agent_used,
-                                        'function_name': 'azure_ai_foundry_citation',
-                                        'plugin_name': 'azure_ai_foundry',
+                                        'function_name': 'foundry_citation',
+                                        'plugin_name': 'new_foundry' if selected_agent_type == 'new_foundry' else 'azure_ai_foundry',
                                         'function_arguments': serializable,
                                         'function_result': serializable,
                                         'timestamp': datetime.utcnow().isoformat(),
@@ -4552,11 +4844,12 @@ def foundry_agent_success(result):
                         def foundry_agent_error(e):
                             plugin_logger.deregister_callbacks(callback_key)
                             log_event(
-                                f"Error during Azure AI Foundry agent invocation: {str(e)}",
+                                f"Error during {selected_agent_type} agent invocation: {str(e)}",
                                 extra={
                                     'conversation_id': conversation_id,
                                     'user_id': user_id,
-                                    'agent_id': getattr(selected_agent, 'id', None)
+                                    'agent_id': getattr(selected_agent, 'id', None),
+                                    'agent_type': selected_agent_type,
                                 },
                                 level=logging.ERROR,
                                 exceptionTraceback=True
@@ -4578,39 +4871,52 @@ def foundry_agent_error(e):
 
                 if kernel:
                     def invoke_kernel():
+                        plugin_logger = get_plugin_logger()
+                        callback_key = register_plugin_invocation_thought_callback(
+                            plugin_logger,
+                            thought_tracker,
+                            user_id,
+                            conversation_id,
+                            actor_label='Kernel'
+                        )
                         chat_history = "\n".join([
                             f"{msg['role']}: {msg['content']}" for msg in conversation_history_for_api
                         ])
-                        chat_func = None
-                        if hasattr(kernel, 'plugins'):
-                            for plugin in kernel.plugins.values():
-                                if hasattr(plugin, 'functions') and 'chat' in plugin.functions:
-                                    chat_func = plugin.functions['chat']
-                                    break
-                        if chat_func:
-                            return asyncio.run(run_sk_call(kernel.invoke, chat_func, input=chat_history))
-                        else:
-                            log_event(
-                                "No dedicated chat action/plugin found. Trying kernel-native chatcompletion via service lookup.",
-                                extra=extra, 
-                                level=logging.WARNING
-                            )
-                            chat_service = kernel.get_service(type=ChatCompletionClientBase)
-                            if chat_service is not None:
-                                chat_hist = ChatHistory()
-                                for msg in conversation_history_for_api:
-                                    chat_hist.add_message({"role": msg["role"], "content": msg["content"]})
-                                settings_obj = PromptExecutionSettings()
-                                async def run_chatcompletion():
-                                    return await chat_service.get_chat_message_contents(chat_hist, settings_obj)
-                                chat_result = asyncio.run(run_chatcompletion())
-                                if chat_result and hasattr(chat_result[0], 'content'):
-                                    return chat_result[0].content
-                                else:
-                                    return str(chat_result)
+                        try:
+                            chat_func = None
+                            if hasattr(kernel, 'plugins'):
+                                for plugin in kernel.plugins.values():
+                                    if hasattr(plugin, 'functions') and 'chat' in plugin.functions:
+                                        chat_func = plugin.functions['chat']
+                                        break
+                            if chat_func:
+                                return asyncio.run(run_sk_call(kernel.invoke, chat_func, input=chat_history))
                             else:
-                                log_event("No chat completion service found in kernel. Falling back to GPT.", extra=extra, level=logging.WARNING)
-                                raise Exception("No chat completion service found in kernel.")
+                                log_event(
+                                    "No dedicated chat action/plugin found. Trying kernel-native chatcompletion via service lookup.",
+                                    extra=extra, 
+                                    level=logging.WARNING
+                                )
+                                chat_service = kernel.get_service(type=ChatCompletionClientBase)
+                                if chat_service is not None:
+                                    chat_hist = ChatHistory()
+                                    for msg in conversation_history_for_api:
+                                        chat_hist.add_message({"role": msg["role"], "content": msg["content"]})
+                                    settings_obj = PromptExecutionSettings()
+
+                                    async def run_chatcompletion():
+                                        return await chat_service.get_chat_message_contents(chat_hist, settings_obj)
+
+                                    chat_result = asyncio.run(run_chatcompletion())
+                                    if chat_result and hasattr(chat_result[0], 'content'):
+                                        return chat_result[0].content
+                                    else:
+                                        return str(chat_result)
+                                else:
+                                    log_event("No chat completion service found in kernel. Falling back to GPT.", extra=extra, level=logging.WARNING)
+                                    raise Exception("No chat completion service found in kernel.")
+                        finally:
+                            plugin_logger.deregister_callbacks(callback_key)
                     def kernel_success(result):
                         msg = '[SK fallback] Running in kernel only mode. Ask your administrator to configure Semantic Kernel for richer responses.'
                         return (str(result), "kernel", "kernel", msg)
@@ -4652,7 +4958,6 @@ def invoke_gpt_fallback():
                 try:
                     response = gpt_client.chat.completions.create(**api_params)
                 except Exception as e:
-                    # Check if error is related to reasoning_effort parameter
                     error_str = str(e).lower()
                     if reasoning_effort and reasoning_effort != 'none' and (
                         'reasoning_effort' in error_str or 
@@ -4660,9 +4965,27 @@ def invoke_gpt_fallback():
                         'invalid_request_error' in error_str
                     ):
                         debug_print(f"Reasoning effort not supported by {gpt_model}, retrying without reasoning_effort...")
-                        # Retry without reasoning_effort
                         api_params.pop('reasoning_effort', None)
                         response = gpt_client.chat.completions.create(**api_params)
+                    elif gpt_provider in ('aifoundry', 'new_foundry') and 'api version not supported' in error_str:
+                        debug_print("Foundry API version not supported. Retrying with fallback versions...")
+                        api_params.pop('reasoning_effort', None)
+                        fallback_versions = get_foundry_api_version_candidates(gpt_api_version, settings)
+                        response = None
+                        last_error = None
+                        for candidate in fallback_versions:
+                            if candidate == gpt_api_version:
+                                continue
+                            try:
+                                debug_print(f"[SKChat] Foundry retry api_version={candidate}")
+                                retry_client = build_multi_endpoint_client(gpt_auth or {}, gpt_provider, gpt_endpoint, candidate)
+                                response = retry_client.chat.completions.create(**api_params)
+                                break
+                            except Exception as retry_exc:
+                                last_error = retry_exc
+                                debug_print(f"[SKChat] Foundry retry failed for api_version={candidate}: {retry_exc}")
+                        if response is None and last_error is not None:
+                            raise last_error
                     else:
                         raise
                 
@@ -4983,6 +5306,7 @@ def chat_stream_api():
         """
         from flask import Response, stream_with_context
         import json
+        from queue import Queue, Empty
         
         # IMPORTANT: Parse JSON and get user_id BEFORE entering the generator
         # because request context may not be available inside the generator
@@ -4997,6 +5321,8 @@ def chat_stream_api():
         compatibility_mode = bool(data.get('image_generation')) or bool(
             data.get('retry_user_message_id') or data.get('edited_user_message_id')
         )
+        requested_conversation_id = data.get('conversation_id')
+        stream_session = CHAT_STREAM_REGISTRY.start_session(user_id, requested_conversation_id)
 
         request_message = (data.get('message') or '').strip()
         request_preview = request_message[:120] + '...' if len(request_message) > 120 else request_message
@@ -5095,9 +5421,9 @@ def generate_compatibility_response():
 
         if compatibility_mode:
             debug_print("[Streaming] Routing request through compatibility bridge")
-            return build_background_stream_response(generate_compatibility_response)
+            return build_background_stream_response(generate_compatibility_response, stream_session=stream_session)
         
-        def generate():
+        def generate(publish_background_event=None):
             try:
                 # Import debug_print for use in generator
                 from functions_debug import debug_print
@@ -5138,6 +5464,7 @@ def generate():
                 classifications_to_send = data.get('classifications')
                 chat_type = data.get('chat_type', 'user')
                 reasoning_effort = data.get('reasoning_effort')  # Extract reasoning effort for reasoning models
+                request_agent_info = data.get('agent_info')
 
                 debug_print(
                     "[Streaming] Parsed request payload | "
@@ -5254,9 +5581,26 @@ def generate():
                 gpt_model = ""
                 gpt_client = None
                 enable_gpt_apim = settings.get('enable_gpt_apim', False)
+                should_use_default_model = (
+                    bool(request_agent_info)
+                    and settings.get('enable_multi_model_endpoints', False)
+                    and not data.get('model_id')
+                    and not data.get('model_endpoint_id')
+                )
                 
                 try:
-                    if enable_gpt_apim:
+                    default_model_config = None
+                    if should_use_default_model:
+                        try:
+                            default_model_config = resolve_default_model_gpt_config(settings)
+                            if default_model_config:
+                                debug_print("[GPTClient] Using default multi-endpoint model for agent streaming request.")
+                        except Exception as default_exc:
+                            debug_print(f"[GPTClient] Default model selection unavailable: {default_exc}")
+
+                    if default_model_config:
+                        gpt_client, gpt_model, _, _, _, _ = default_model_config
+                    elif enable_gpt_apim:
                         raw = settings.get('azure_apim_gpt_deployment', '')
                         if not raw:
                             yield f"data: {json.dumps({'error': 'APIM deployment not configured'})}\n\n"
@@ -5331,7 +5675,8 @@ def generate():
                         'title': 'New Conversation',
                         'context': [],
                         'tags': [],
-                        'strict': False
+                        'strict': False,
+                        'chat_type': 'new'
                     }
                     cosmos_conversations_container.upsert_item(conversation_item)
                     debug_print(f"[Streaming] Created new conversation {conversation_id}")
@@ -5349,15 +5694,26 @@ def generate():
                             'title': 'New Conversation',
                             'context': [],
                             'tags': [],
-                            'strict': False
+                            'strict': False,
+                            'chat_type': 'new'
                         }
                         cosmos_conversations_container.upsert_item(conversation_item)
                         debug_print(f"[Streaming] Conversation {conversation_id} not found; created replacement")
                 
                 # Determine chat type
-                actual_chat_type = 'personal'
+                actual_chat_type = 'personal_single_user'
                 if conversation_item.get('chat_type'):
                     actual_chat_type = conversation_item['chat_type']
+                    if actual_chat_type == 'personal':
+                        actual_chat_type = 'personal_single_user'
+
+                # Capture conversation-level group context for downstream agent/model resolution
+                conversation_primary_context = next((ctx for ctx in conversation_item.get('context', []) if ctx.get('type') == 'primary'), None)
+                conversation_group_id = None
+                if conversation_primary_context and conversation_primary_context.get('scope') == 'group':
+                    conversation_group_id = conversation_primary_context.get('id')
+                if conversation_group_id:
+                    g.conversation_group_id = conversation_group_id
                 
                 # Save user message
                 user_message_id = f"{conversation_id}_user_{int(time.time())}_{random.randint(1000,9999)}"
@@ -5541,10 +5897,30 @@ def generate():
                     user_id=user_id
                 )
 
+                def serialize_thought_event(step_type, content, step_index, message_id=None):
+                    return f"data: {json.dumps({'type': 'thought', 'message_id': message_id or assistant_message_id, 'step_index': step_index, 'step_type': step_type, 'content': content})}\n\n"
+
                 def emit_thought(step_type, content, detail=None):
                     """Add a thought to Cosmos and return an SSE event string."""
                     thought_tracker.add_thought(step_type, content, detail)
-                    return f"data: {json.dumps({'type': 'thought', 'step_index': thought_tracker.current_index - 1, 'step_type': step_type, 'content': content})}\n\n"
+                    return serialize_thought_event(step_type, content, thought_tracker.current_index - 1)
+
+                def publish_live_plugin_thought(thought_payload):
+                    if not callable(publish_background_event):
+                        return
+
+                    step_index = thought_payload.get('step_index')
+                    if step_index is None:
+                        return
+
+                    publish_background_event(
+                        serialize_thought_event(
+                            thought_payload.get('step_type', 'agent_tool_call'),
+                            thought_payload.get('content', ''),
+                            step_index,
+                            message_id=thought_payload.get('message_id') or assistant_message_id,
+                        )
+                    )
 
                 # Content Safety check (matching non-streaming path)
                 blocked = False
@@ -5982,7 +6358,7 @@ def emit_thought(step_type, content, detail=None):
                     elif document_scope == 'public':
                         message_chat_type = 'public'
                     else:
-                        message_chat_type = 'personal'
+                        message_chat_type = 'personal_single_user'
                 else:
                     message_chat_type = 'Model'
                 
@@ -6169,6 +6545,7 @@ def emit_thought(step_type, content, detail=None):
                 
                 # Check if agents are enabled and should be used
                 selected_agent = None
+                selected_agent_metadata = None
                 agent_name_used = None
                 agent_display_name_used = None
                 use_agent_streaming = False
@@ -6185,6 +6562,15 @@ def emit_thought(step_type, content, detail=None):
                             selected_agent_info = user_settings.get('selected_agent')
                             if isinstance(selected_agent_info, dict):
                                 agent_name_to_select = selected_agent_info.get('name')
+                                selected_agent_metadata = {
+                                    'selected_agent': selected_agent_info.get('name'),
+                                    'agent_display_name': selected_agent_info.get('display_name'),
+                                    'is_global': selected_agent_info.get('is_global', False),
+                                    'is_group': selected_agent_info.get('is_group', False),
+                                    'group_id': selected_agent_info.get('group_id'),
+                                    'group_name': selected_agent_info.get('group_name'),
+                                    'agent_id': selected_agent_info.get('id')
+                                }
                             elif isinstance(selected_agent_info, str):
                                 agent_name_to_select = selected_agent_info
                             debug_print(f"[Streaming] Per-user agent name to select: {agent_name_to_select}")
@@ -6192,6 +6578,15 @@ def emit_thought(step_type, content, detail=None):
                             global_selected_agent_info = settings.get('global_selected_agent')
                             if global_selected_agent_info:
                                 agent_name_to_select = global_selected_agent_info.get('name')
+                                selected_agent_metadata = {
+                                    'selected_agent': global_selected_agent_info.get('name'),
+                                    'agent_display_name': global_selected_agent_info.get('display_name'),
+                                    'is_global': global_selected_agent_info.get('is_global', False),
+                                    'is_group': global_selected_agent_info.get('is_group', False),
+                                    'group_id': global_selected_agent_info.get('group_id'),
+                                    'group_name': global_selected_agent_info.get('group_name'),
+                                    'agent_id': global_selected_agent_info.get('id')
+                                }
                             debug_print(f"[Streaming] Global agent name to select: {agent_name_to_select}")
                         
                         # Find the agent
@@ -6222,6 +6617,16 @@ def emit_thought(step_type, content, detail=None):
                             use_agent_streaming = True
                             agent_name_used = getattr(selected_agent, 'name', 'agent')
                             agent_display_name_used = getattr(selected_agent, 'display_name', agent_name_used)
+                            if not selected_agent_metadata:
+                                selected_agent_metadata = {
+                                    'selected_agent': agent_name_used,
+                                    'agent_display_name': agent_display_name_used,
+                                    'is_global': getattr(selected_agent, 'is_global', False),
+                                    'is_group': getattr(selected_agent, 'is_group', False),
+                                    'group_id': getattr(selected_agent, 'group_id', None),
+                                    'group_name': getattr(selected_agent, 'group_name', None),
+                                    'agent_id': getattr(selected_agent, 'id', None)
+                                }
                             actual_model_used = getattr(selected_agent, 'deployment_name', None) or gpt_model
                             debug_print(f"--- Streaming from Agent: {agent_name_used} (model: {actual_model_used}) ---")
                         else:
@@ -6242,6 +6647,11 @@ def emit_thought(step_type, content, detail=None):
                     f"selected_agent={getattr(selected_agent, 'name', None) if selected_agent else None} | "
                     f"model={gpt_model}"
                 )
+                stream_selected_agent_type = (
+                    str(getattr(selected_agent, 'agent_type', 'local') or 'local').lower()
+                    if selected_agent
+                    else 'local'
+                )
                 
                 try:
                     if use_agent_streaming and selected_agent:
@@ -6251,25 +6661,19 @@ def emit_thought(step_type, content, detail=None):
                         debug_print(f"--- Streaming from Agent: {agent_name_used} ---")
 
                         # Register callback to persist plugin thoughts to Cosmos in real-time
-                        callback_key = f"{user_id}:{conversation_id}"
                         plugin_logger_cb = get_plugin_logger()
+                        callback_key = register_plugin_invocation_thought_callback(
+                            plugin_logger_cb,
+                            thought_tracker,
+                            user_id,
+                            conversation_id,
+                            actor_label='Agent',
+                            live_thought_callback=publish_live_plugin_thought,
+                        )
                         debug_print(
                             f"[Streaming][Plugin Callback] Registering callback for key={callback_key}"
                         )
 
-                        def on_plugin_invocation_streaming(inv):
-                            duration_str = f" ({int(inv.duration_ms)}ms)" if inv.duration_ms else ""
-                            tool_name = f"{inv.plugin_name}.{inv.function_name}"
-                            debug_print(
-                                f"[Streaming][Plugin Callback] Received invocation {tool_name}{duration_str} | success={inv.success}"
-                            )
-                            thought_tracker.add_thought(
-                                'agent_tool_call',
-                                f"Agent called {tool_name}{duration_str}"
-                            )
-
-                        plugin_logger_cb.register_callback(callback_key, on_plugin_invocation_streaming)
-
                         # Import required classes
                         from semantic_kernel.contents.chat_message_content import ChatMessageContent
                         
@@ -6282,34 +6686,7 @@ def on_plugin_invocation_streaming(inv):
                             )
                             for msg in conversation_history_for_api
                         ]
-                        
-                        agent_stream_start_time = time.time()
-
-                        # Stream agent responses - collect chunks first then yield
-                        async def stream_agent_async():
-                            """Collect all streaming chunks from agent"""
-                            chunks = []
-                            usage_data = None
-                            
-                            # invoke_stream doesn't need a thread parameter - it works like invoke but streams
-                            async for response in selected_agent.invoke_stream(messages=agent_message_history):
-                                # Extract content from StreamingChatMessageContent
-                                if hasattr(response, 'content') and response.content:
-                                    chunks.append(str(response.content))
-                                elif isinstance(response, str):
-                                    chunks.append(response)
-                                else:
-                                    # Fallback: convert to string
-                                    chunks.append(str(response))
-                                
-                                # Check for usage metadata in the last response
-                                # Don't break early - keep collecting all chunks
-                                if hasattr(response, 'metadata') and isinstance(response.metadata, dict):
-                                    usage = response.metadata.get('usage')
-                                    if usage:
-                                        usage_data = usage  # Keep updating, last one wins
-                            
-                            return chunks, usage_data
+                        stream_usage = None
                         
                         # Execute async streaming
                         try:
@@ -6324,8 +6701,31 @@ async def stream_agent_async():
                             asyncio.set_event_loop(loop)
                         
                         try:
-                            # Run streaming and collect chunks and usage
-                            chunks, stream_usage = loop.run_until_complete(stream_agent_async())
+                            agent_stream = selected_agent.invoke_stream(messages=agent_message_history)
+                            while True:
+                                try:
+                                    response = loop.run_until_complete(agent_stream.__anext__())
+                                except StopAsyncIteration:
+                                    break
+
+                                response_metadata = getattr(response, 'metadata', None)
+                                if isinstance(response_metadata, dict):
+                                    usage = response_metadata.get('usage')
+                                    if usage:
+                                        stream_usage = usage
+                                    response_model = response_metadata.get('model')
+                                    if isinstance(response_model, str) and response_model.strip():
+                                        actual_model_used = response_model.strip()
+
+                                chunk_content = None
+                                if hasattr(response, 'content') and response.content:
+                                    chunk_content = str(response.content)
+                                elif isinstance(response, str) and response:
+                                    chunk_content = response
+
+                                if chunk_content:
+                                    accumulated_content += chunk_content
+                                    yield f"data: {json.dumps({'content': chunk_content})}\n\n"
                         except Exception as stream_error:
                             plugin_logger_cb.deregister_callbacks(callback_key)
                             debug_print(
@@ -6337,6 +6737,11 @@ async def stream_agent_async():
                             yield f"data: {json.dumps({'error': f'Agent streaming failed: {str(stream_error)}'})}\n\n"
                             return
 
+                        actual_model_used = (
+                            getattr(selected_agent, 'last_run_model', None)
+                            or actual_model_used
+                        )
+
                         # Emit responded thought with total duration from user message
                         agent_stream_total_duration_s = round(time.time() - request_start_time, 1)
                         yield emit_thought('generation', f"'{actual_model_used}' responded ({agent_stream_total_duration_s}s from initial message)")
@@ -6347,26 +6752,18 @@ async def stream_agent_async():
                             f"[Streaming][Plugin Callback] Deregistered callback after successful stream for key={callback_key}"
                         )
 
-                        # Emit SSE-only events for streaming UI (Cosmos writes already done by callback)
                         agent_plugin_invocations = plugin_logger_cb.get_invocations_for_conversation(user_id, conversation_id)
-                        for inv in agent_plugin_invocations:
-                            duration_str = f" ({int(inv.duration_ms)}ms)" if inv.duration_ms else ""
-                            tool_name = f"{inv.plugin_name}.{inv.function_name}"
-                            content = f"Agent called {tool_name}{duration_str}"
-                            yield f"data: {json.dumps({'type': 'thought', 'step_index': thought_tracker.current_index, 'step_type': 'agent_tool_call', 'content': content})}\n\n"
-                            thought_tracker.current_index += 1
-
-                        # Yield chunks to frontend
-                        for chunk_content in chunks:
-                            accumulated_content += chunk_content
-                            yield f"data: {json.dumps({'content': chunk_content})}\n\n"
 
                         # Try to capture token usage from stream metadata
                         if stream_usage:
-                            # stream_usage is a CompletionUsage object, not a dict
-                            prompt_tokens = getattr(stream_usage, 'prompt_tokens', 0)
-                            completion_tokens = getattr(stream_usage, 'completion_tokens', 0)
-                            total_tokens = getattr(stream_usage, 'total_tokens', None)
+                            if isinstance(stream_usage, dict):
+                                prompt_tokens = int(stream_usage.get('prompt_tokens') or 0)
+                                completion_tokens = int(stream_usage.get('completion_tokens') or 0)
+                                total_tokens = stream_usage.get('total_tokens')
+                            else:
+                                prompt_tokens = getattr(stream_usage, 'prompt_tokens', 0)
+                                completion_tokens = getattr(stream_usage, 'completion_tokens', 0)
+                                total_tokens = getattr(stream_usage, 'total_tokens', None)
 
                             # Calculate total if not provided
                             if total_tokens is None or total_tokens == 0:
@@ -6454,6 +6851,26 @@ def make_json_serializable(obj):
                                 'user_id': inv.user_id
                             }
                             agent_citations_list.append(citation)
+
+                        foundry_citations = getattr(selected_agent, 'last_run_citations', []) or []
+                        if stream_selected_agent_type in ('aifoundry', 'new_foundry') and foundry_citations:
+                            foundry_plugin_name = 'new_foundry' if stream_selected_agent_type == 'new_foundry' else 'azure_ai_foundry'
+                            foundry_label = agent_name_used or ('New Foundry Application' if stream_selected_agent_type == 'new_foundry' else 'Azure AI Foundry Agent')
+                            for citation in foundry_citations:
+                                yield emit_thought('agent_tool_call', 'Agent retrieved citation from Azure AI Foundry')
+                                try:
+                                    serializable = json.loads(json.dumps(citation, default=str))
+                                except (TypeError, ValueError):
+                                    serializable = {'value': str(citation)}
+                                agent_citations_list.append({
+                                    'tool_name': foundry_label,
+                                    'function_name': 'foundry_citation',
+                                    'plugin_name': foundry_plugin_name,
+                                    'function_arguments': serializable,
+                                    'function_result': serializable,
+                                    'timestamp': datetime.utcnow().isoformat(),
+                                    'success': True
+                                })
                         
                         debug_print(f"[Agent Streaming] Captured {len(agent_citations_list)} citations")
                         final_model_used = actual_model_used
@@ -6608,8 +7025,8 @@ def make_json_serializable(obj):
                             hybrid_search_enabled=hybrid_search_enabled,
                             image_gen_enabled=False,
                             selected_documents=combined_documents if combined_documents else None,
-                            selected_agent=None,
-                            selected_agent_details=None,
+                            selected_agent=agent_name_used if use_agent_streaming else None,
+                            selected_agent_details=selected_agent_metadata if use_agent_streaming else None,
                             search_results=search_results if search_results else None,
                             conversation_item=conversation_item
                         )
@@ -6705,7 +7122,7 @@ def make_json_serializable(obj):
                         }
                         try:
                             cosmos_messages_container.upsert_item(assistant_doc)
-                        except:
+                        except Exception as ex:
                             pass
                     
                     yield f"data: {json.dumps({'error': error_msg, 'partial_content': accumulated_content})}\n\n"
@@ -6717,7 +7134,48 @@ def make_json_serializable(obj):
                 debug_print(f"[STREAM API ERROR] Full traceback:\n{error_traceback}")
                 yield f"data: {json.dumps({'error': f'Internal server error: {str(e)}'})}\n\n"
         
-        return build_background_stream_response(generate)
+        return build_background_stream_response(generate, stream_session=stream_session)
+
+    @app.route('/api/chat/stream/status/<conversation_id>', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def chat_stream_status_api(conversation_id):
+        """Report whether a conversation has a live stream that can be reattached."""
+        user_id = get_current_user_id()
+        if not user_id:
+            return jsonify({'error': 'User not authenticated'}), 401
+
+        stream_session = CHAT_STREAM_REGISTRY.get_session(user_id, conversation_id, active_only=True)
+        return jsonify({
+            'conversation_id': conversation_id,
+            'pending': bool(stream_session),
+            'reattachable': bool(stream_session),
+        })
+
+    @app.route('/api/chat/stream/reattach/<conversation_id>', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def chat_stream_reattach_api(conversation_id):
+        """Replay and continue an in-flight stream for a previously opened conversation."""
+        user_id = get_current_user_id()
+        if not user_id:
+            return jsonify({'error': 'User not authenticated'}), 401
+
+        stream_session = CHAT_STREAM_REGISTRY.get_session(user_id, conversation_id, active_only=True)
+        if not stream_session:
+            return jsonify({'error': 'No active stream is available for this conversation'}), 404
+
+        return Response(
+            stream_with_context(stream_session.iter_events()),
+            mimetype='text/event-stream',
+            headers={
+                'Cache-Control': 'no-cache',
+                'X-Accel-Buffering': 'no',
+                'Connection': 'keep-alive'
+            }
+        )
 
     @app.route('/api/message/<message_id>/mask', methods=['POST'])
     @swagger_route(security=get_auth_security())
@@ -6777,7 +7235,7 @@ def mask_message_api(message_id):
                         )
                         if conversation.get('user_id') != user_id:
                             return jsonify({'error': 'You can only mask messages from your own conversations'}), 403
-                    except:
+                    except Exception as ex:
                         return jsonify({'error': 'Conversation not found'}), 404
                 elif message_user_id != user_id:
                     return jsonify({'error': 'You can only mask your own messages'}), 403
@@ -7334,4 +7792,4 @@ def perform_web_search(
         level=logging.INFO,
     )
     
-    return True  # Search succeeded
\ No newline at end of file
+    return True  # Search succeeded
diff --git a/application/single_app/route_backend_control_center.py b/application/single_app/route_backend_control_center.py
index a28f756b..75d16094 100644
--- a/application/single_app/route_backend_control_center.py
+++ b/application/single_app/route_backend_control_center.py
@@ -14,6 +14,117 @@
 import json
 from functions_debug import debug_print
 
+
+def normalize_token_filter_value(value):
+    """Normalize optional token filter values from query params or request JSON."""
+    if value is None:
+        return None
+
+    normalized = str(value).strip()
+    if not normalized or normalized.lower() == 'all':
+        return None
+
+    return normalized
+
+
+def extract_token_filters(source):
+    """Extract supported token filters from a query string or JSON payload."""
+    if not source:
+        return {}
+
+    token_source = source
+    nested_filters = source.get('token_filters') if hasattr(source, 'get') else None
+    if isinstance(nested_filters, dict):
+        token_source = nested_filters
+
+    token_filters = {
+        'user_id': normalize_token_filter_value(token_source.get('user_id')),
+        'workspace_type': normalize_token_filter_value(token_source.get('workspace_type')),
+        'group_id': normalize_token_filter_value(token_source.get('group_id')),
+        'public_workspace_id': normalize_token_filter_value(token_source.get('public_workspace_id')),
+        'model': normalize_token_filter_value(token_source.get('model')),
+        'token_type': normalize_token_filter_value(token_source.get('token_type'))
+    }
+
+    if token_filters['workspace_type'] not in {None, 'personal', 'group', 'public'}:
+        token_filters['workspace_type'] = None
+
+    if token_filters['token_type'] not in {None, 'embedding', 'chat', 'web_search'}:
+        token_filters['token_type'] = None
+
+    if token_filters['group_id'] and not token_filters['workspace_type']:
+        token_filters['workspace_type'] = 'group'
+
+    if token_filters['public_workspace_id'] and not token_filters['workspace_type']:
+        token_filters['workspace_type'] = 'public'
+
+    return token_filters
+
+
+def append_token_usage_filters(query_conditions, parameters, token_filters):
+    """Append optional token usage filters to the Cosmos query state."""
+    if not token_filters:
+        return
+
+    user_id = token_filters.get('user_id')
+    if user_id:
+        query_conditions.append("c.user_id = @token_user_id")
+        parameters.append({"name": "@token_user_id", "value": user_id})
+
+    workspace_type = token_filters.get('workspace_type')
+    if workspace_type:
+        query_conditions.append("c.workspace_type = @token_workspace_type")
+        parameters.append({"name": "@token_workspace_type", "value": workspace_type})
+
+    group_id = token_filters.get('group_id')
+    if group_id:
+        query_conditions.append("c.workspace_context.group_id = @token_group_id")
+        parameters.append({"name": "@token_group_id", "value": group_id})
+
+    public_workspace_id = token_filters.get('public_workspace_id')
+    if public_workspace_id:
+        query_conditions.append("c.workspace_context.public_workspace_id = @token_public_workspace_id")
+        parameters.append({"name": "@token_public_workspace_id", "value": public_workspace_id})
+
+    model = token_filters.get('model')
+    if model:
+        query_conditions.append("c.usage.model = @token_model")
+        parameters.append({"name": "@token_model", "value": model})
+
+    token_type = token_filters.get('token_type')
+    if token_type:
+        query_conditions.append("c.token_type = @token_type")
+        parameters.append({"name": "@token_type", "value": token_type})
+
+
+def build_token_usage_query_context(start_date, end_date, token_filters=None):
+    """Build shared WHERE-clause state for token usage queries."""
+    parameters = [
+        {"name": "@start_date", "value": start_date.isoformat()},
+        {"name": "@end_date", "value": end_date.isoformat()}
+    ]
+    query_conditions = [
+        "c.activity_type = 'token_usage'",
+        "((c.timestamp >= @start_date AND c.timestamp <= @end_date) OR (c.created_at >= @start_date AND c.created_at <= @end_date))"
+    ]
+
+    append_token_usage_filters(query_conditions, parameters, token_filters or {})
+    return " AND ".join(query_conditions), parameters
+
+
+def get_distinct_token_filter_values(query):
+    """Run a DISTINCT VALUE token filter query and return sorted non-empty values."""
+    try:
+        values = list(cosmos_activity_logs_container.query_items(
+            query=query,
+            enable_cross_partition_query=True
+        ))
+        unique_values = sorted({str(value).strip() for value in values if value})
+        return [value for value in unique_values if value]
+    except Exception as ex:
+        debug_print(f"[Token Filters] Error loading distinct values: {ex}")
+        return []
+
 def enhance_user_with_activity(user, force_refresh=False):
     """
     Enhance user data with activity information and computed fields.
@@ -74,7 +185,7 @@ def enhance_user_with_activity(user, force_refresh=False):
                         enhanced['access_status'] = 'allow'  # Expired, should be auto-restored
                     else:
                         enhanced['access_status'] = f"deny_until_{datetime_to_allow}"
-                except:
+                except Exception as ex:
                     enhanced['access_status'] = 'deny'
             else:
                 enhanced['access_status'] = 'deny'
@@ -91,7 +202,7 @@ def enhance_user_with_activity(user, force_refresh=False):
                         enhanced['file_upload_status'] = 'allow'  # Expired, should be auto-restored
                     else:
                         enhanced['file_upload_status'] = f"deny_until_{datetime_to_allow}"
-                except:
+                except Exception as ex:
                     enhanced['file_upload_status'] = 'deny'
             else:
                 enhanced['file_upload_status'] = 'deny'
@@ -158,7 +269,7 @@ def enhance_user_with_activity(user, force_refresh=False):
                         try:
                             date_obj = datetime.fromisoformat(last_updated.replace('Z', '+00:00'))
                             last_day_conversation = date_obj.strftime('%m/%d/%Y')
-                        except:
+                        except Exception as ex:
                             last_day_conversation = 'Invalid date'
             
             enhanced['activity']['chat_metrics']['last_day_conversation'] = last_day_conversation or 'Never'
@@ -1053,7 +1164,7 @@ def enhance_group_with_activity(group, force_refresh=False):
         debug_print(f"Error enhancing group data: {e}")
         return group  # Return original group data if enhancement fails
 
-def get_activity_trends_data(start_date, end_date):
+def get_activity_trends_data(start_date, end_date, token_filters=None):
     """
     Get aggregated activity data for the specified date range from existing containers.
     Returns daily activity counts by type using real application data.
@@ -1332,17 +1443,20 @@ def get_activity_trends_data(start_date, end_date):
         try:
             debug_print("🔍 [ACTIVITY TRENDS DEBUG] Querying token usage...")
             
-            token_usage_query = """
+            token_where_clause, token_parameters = build_token_usage_query_context(
+                start_date,
+                end_date,
+                token_filters=token_filters
+            )
+            token_usage_query = f"""
                 SELECT c.timestamp, c.created_at, c.token_type, c.usage.total_tokens as token_count
                 FROM c
-                WHERE c.activity_type = 'token_usage'
-                AND ((c.timestamp >= @start_date AND c.timestamp <= @end_date)
-                   OR (c.created_at >= @start_date AND c.created_at <= @end_date))
+                WHERE {token_where_clause}
             """
             
             token_activities = list(cosmos_activity_logs_container.query_items(
                 query=token_usage_query,
-                parameters=parameters,
+                parameters=token_parameters,
                 enable_cross_partition_query=True
             ))
             
@@ -1451,7 +1565,7 @@ def get_activity_trends_data(start_date, end_date):
             'tokens': {}
         }
 
-def get_raw_activity_trends_data(start_date, end_date, charts):
+def get_raw_activity_trends_data(start_date, end_date, charts, token_filters=None):
     """
     Get raw detailed activity data for export instead of aggregated counts.
     Returns individual records with user information for each activity type.
@@ -1979,21 +2093,27 @@ def get_document_storage_size(doc, cosmos_container, container_name, folder_pref
         if 'tokens' in charts:
             debug_print("🔍 [RAW ACTIVITY DEBUG] Getting token usage records from activity logs...")
             try:
-                tokens_query = """
+                token_where_clause, token_parameters = build_token_usage_query_context(
+                    start_date,
+                    end_date,
+                    token_filters=token_filters
+                )
+                tokens_query = f"""
                     SELECT c.timestamp, c.created_at, c.user_id, c.token_type,
+                           c.workspace_type,
+                           c.workspace_context.group_id as group_id,
+                           c.workspace_context.public_workspace_id as public_workspace_id,
                            c.usage.model as model_name,
                            c.usage.prompt_tokens as prompt_tokens, 
                            c.usage.completion_tokens as completion_tokens, 
                            c.usage.total_tokens as total_tokens
                     FROM c 
-                    WHERE c.activity_type = 'token_usage'
-                    AND ((c.timestamp >= @start_date AND c.timestamp <= @end_date)
-                       OR (c.created_at >= @start_date AND c.created_at <= @end_date))
+                    WHERE {token_where_clause}
                 """
                 
                 token_activities = list(cosmos_activity_logs_container.query_items(
                     query=tokens_query,
-                    parameters=parameters,
+                    parameters=token_parameters,
                     enable_cross_partition_query=True
                 ))
                 
@@ -2020,6 +2140,9 @@ def get_document_storage_size(doc, cosmos_container, container_name, folder_pref
                                 'email': user_info['email'],
                                 'user_id': user_id,
                                 'token_type': token_type,
+                                'workspace_type': token_log.get('workspace_type', ''),
+                                'group_id': token_log.get('group_id', ''),
+                                'public_workspace_id': token_log.get('public_workspace_id', ''),
                                 'model_name': token_log.get('model_name', 'Unknown'),
                                 'prompt_tokens': prompt_tokens,
                                 'completion_tokens': completion_tokens,
@@ -2563,7 +2686,7 @@ def api_update_group_status(group_id):
             # Get the group
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Get admin user info
@@ -2646,7 +2769,7 @@ def api_get_group_details_admin(group_id):
             # Get the group
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Enhance with activity data
@@ -2685,7 +2808,7 @@ def api_delete_group_admin(group_id):
             # Validate group exists
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Create approval request
@@ -2750,7 +2873,7 @@ def api_delete_group_documents_admin(group_id):
             # Validate group exists
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Create approval request
@@ -2798,7 +2921,7 @@ def api_get_group_members_admin(group_id):
             # Get the group
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Get member list with user details
@@ -2851,7 +2974,7 @@ def api_admin_take_group_ownership(group_id):
             # Validate group exists
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Create approval request
@@ -2920,7 +3043,7 @@ def api_admin_transfer_group_ownership(group_id):
             # Get the group
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Find the new owner in members list
@@ -3001,7 +3124,7 @@ def api_admin_add_group_member(group_id):
             # Get the group
             try:
                 group = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Group not found'}), 404
             
             # Check if user already exists (skip duplicate)
@@ -3436,7 +3559,7 @@ def api_update_public_workspace_status(workspace_id):
             # Get the workspace
             try:
                 workspace = cosmos_public_workspaces_container.read_item(item=workspace_id, partition_key=workspace_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Public workspace not found'}), 404
             
             # Get admin user info
@@ -3747,7 +3870,7 @@ def api_get_public_workspace_members(workspace_id):
                             'displayName': user.get('display_name', user.get('email', '')),
                             'role': 'admin'
                         })
-                    except:
+                    except Exception as ex:
                         pass
             
             # Add document managers - documentManagers is an array of objects with userId, email, displayName
@@ -3774,7 +3897,7 @@ def api_get_public_workspace_members(workspace_id):
                             'displayName': user.get('display_name', user.get('email', '')),
                             'role': 'documentManager'
                         })
-                    except:
+                    except Exception as ex:
                         pass
             
             return jsonify({
@@ -3817,7 +3940,7 @@ def api_admin_add_workspace_member(workspace_id):
             # Get the workspace
             try:
                 workspace = cosmos_public_workspaces_container.read_item(item=workspace_id, partition_key=workspace_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Public workspace not found'}), 404
             
             # Check if user already exists
@@ -3930,7 +4053,7 @@ def api_admin_add_workspace_member_single(workspace_id):
             # Get the workspace
             try:
                 workspace = cosmos_public_workspaces_container.read_item(item=workspace_id, partition_key=workspace_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Public workspace not found'}), 404
             
             # Check if user already exists
@@ -4228,7 +4351,7 @@ def api_admin_take_workspace_ownership(workspace_id):
             # Validate workspace exists
             try:
                 workspace = cosmos_public_workspaces_container.read_item(item=workspace_id, partition_key=workspace_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Workspace not found'}), 404
             
             # Get old owner info
@@ -4310,7 +4433,7 @@ def api_update_public_workspace_ownership(workspace_id):
             # Get the workspace
             try:
                 workspace = cosmos_public_workspaces_container.read_item(item=workspace_id, partition_key=workspace_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Workspace not found'}), 404
             
             # Get new owner user details
@@ -4321,7 +4444,7 @@ def api_update_public_workspace_ownership(workspace_id):
                 )
                 new_owner_email = new_owner_user.get('email', 'unknown')
                 new_owner_name = new_owner_user.get('display_name', new_owner_email)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'New owner user not found'}), 404
             
             # Check if new owner is a member of the workspace
@@ -4429,7 +4552,7 @@ def api_delete_public_workspace_documents_admin(workspace_id):
             # Validate workspace exists
             try:
                 workspace = cosmos_public_workspaces_container.read_item(item=workspace_id, partition_key=workspace_id)
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Public workspace not found'}), 404
             
             # Create approval request
@@ -4497,7 +4620,7 @@ def api_delete_public_workspace_admin(workspace_id):
                     item=workspace_id,
                     partition_key=workspace_id
                 )
-            except:
+            except Exception as ex:
                 return jsonify({'error': 'Public workspace not found'}), 404
             
             # Create approval request
@@ -4566,14 +4689,17 @@ def api_get_activity_trends():
                 start_date = (end_date - timedelta(days=days)).replace(hour=0, minute=0, second=0, microsecond=0)
                 debug_print(f"🔍 [Activity Trends API] Request for {days} days: {start_date} to {end_date}")
             
+            token_filters = extract_token_filters(request.args)
+
             # Get activity data
-            activity_data = get_activity_trends_data(start_date, end_date)
+            activity_data = get_activity_trends_data(start_date, end_date, token_filters=token_filters)
             
             debug_print(f"🔍 [Activity Trends API] Returning data: {activity_data}")
             
             return jsonify({
                 'success': True,
                 'activity_data': activity_data,
+                'token_filters': token_filters,
                 'period': f"{days} days",
                 'start_date': start_date.isoformat(),
                 'end_date': end_date.isoformat()
@@ -4585,6 +4711,103 @@ def api_get_activity_trends():
             return jsonify({'error': 'Failed to retrieve activity trends'}), 500
 
 
+    @app.route('/api/admin/control-center/token-filters', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @control_center_required('dashboard')
+    def api_get_token_filter_options():
+        """Return distinct token filter options for the control center dashboard."""
+        try:
+            user_ids = get_distinct_token_filter_values(
+                "SELECT DISTINCT VALUE c.user_id FROM c WHERE c.activity_type = 'token_usage' AND IS_DEFINED(c.user_id)"
+            )
+            models = get_distinct_token_filter_values(
+                "SELECT DISTINCT VALUE c.usage.model FROM c WHERE c.activity_type = 'token_usage' AND IS_DEFINED(c.usage.model)"
+            )
+            group_ids = get_distinct_token_filter_values(
+                "SELECT DISTINCT VALUE c.workspace_context.group_id FROM c WHERE c.activity_type = 'token_usage' AND IS_DEFINED(c.workspace_context.group_id)"
+            )
+            public_workspace_ids = get_distinct_token_filter_values(
+                "SELECT DISTINCT VALUE c.workspace_context.public_workspace_id FROM c WHERE c.activity_type = 'token_usage' AND IS_DEFINED(c.workspace_context.public_workspace_id)"
+            )
+
+            user_options = []
+            for user_id in user_ids:
+                try:
+                    user_doc = cosmos_user_settings_container.read_item(item=user_id, partition_key=user_id)
+                    display_name = user_doc.get('display_name', '')
+                    email = user_doc.get('email', '')
+                    label = display_name or email or user_id
+                    user_options.append({
+                        'id': user_id,
+                        'display_name': display_name,
+                        'email': email,
+                        'label': label
+                    })
+                except Exception:
+                    user_options.append({
+                        'id': user_id,
+                        'display_name': '',
+                        'email': '',
+                        'label': user_id
+                    })
+
+            group_options = []
+            for group_id in group_ids:
+                try:
+                    group_doc = cosmos_groups_container.read_item(item=group_id, partition_key=group_id)
+                    group_options.append({
+                        'id': group_id,
+                        'name': group_doc.get('name', group_id)
+                    })
+                except Exception:
+                    group_options.append({
+                        'id': group_id,
+                        'name': group_id
+                    })
+
+            public_workspace_options = []
+            for workspace_id in public_workspace_ids:
+                try:
+                    workspace_doc = cosmos_public_workspaces_container.read_item(item=workspace_id, partition_key=workspace_id)
+                    public_workspace_options.append({
+                        'id': workspace_id,
+                        'name': workspace_doc.get('name', workspace_id)
+                    })
+                except Exception:
+                    public_workspace_options.append({
+                        'id': workspace_id,
+                        'name': workspace_id
+                    })
+
+            user_options.sort(key=lambda item: item.get('label', '').lower())
+            group_options.sort(key=lambda item: item.get('name', '').lower())
+            public_workspace_options.sort(key=lambda item: item.get('name', '').lower())
+
+            return jsonify({
+                'success': True,
+                'filters': {
+                    'users': user_options,
+                    'groups': group_options,
+                    'public_workspaces': public_workspace_options,
+                    'models': [{'value': model, 'label': model} for model in models],
+                    'workspace_types': [
+                        {'value': 'personal', 'label': 'Personal'},
+                        {'value': 'group', 'label': 'Group'},
+                        {'value': 'public', 'label': 'Public'}
+                    ],
+                    'token_types': [
+                        {'value': 'embedding', 'label': 'Embedding'},
+                        {'value': 'chat', 'label': 'Chat'},
+                        {'value': 'web_search', 'label': 'Web Search'}
+                    ]
+                }
+            })
+        except Exception as ex:
+            debug_print(f"[Token Filters] Error loading token filter options: {ex}")
+            return jsonify({'error': 'Failed to retrieve token filter options'}), 500
+
+
 
     @app.route('/api/admin/control-center/activity-trends/export', methods=['POST'])
     @swagger_route(security=get_auth_security())
@@ -4597,12 +4820,13 @@ def api_export_activity_trends():
         """
         try:
             debug_print("🔍 [ACTIVITY TRENDS DEBUG] Starting CSV export process")
-            data = request.get_json()
+            data = request.get_json() or {}
             debug_print(f"🔍 [ACTIVITY TRENDS DEBUG] Request data: {data}")            # Parse request parameters
             charts = data.get('charts', ['logins', 'chats', 'documents'])  # Default to all charts
             time_window = data.get('time_window', '30')  # Default to 30 days
             start_date = data.get('start_date')  # For custom range
             end_date = data.get('end_date')  # For custom range
+            token_filters = extract_token_filters(data)
             debug_print(f"🔍 [ACTIVITY TRENDS DEBUG] Parsed params - charts: {charts}, time_window: {time_window}, start_date: {start_date}, end_date: {end_date}")            # Determine date range
             debug_print("🔍 [ACTIVITY TRENDS DEBUG] Determining date range")
             if time_window == 'custom' and start_date and end_date:
@@ -4627,7 +4851,8 @@ def api_export_activity_trends():
             raw_data = get_raw_activity_trends_data(
                 start_date_obj,
                 end_date_obj,
-                charts
+                charts,
+                token_filters=token_filters
             )
             debug_print(f"🔍 [ACTIVITY TRENDS DEBUG] Raw data retrieved: {len(raw_data) if raw_data else 0} chart types")
             
@@ -4722,8 +4947,9 @@ def api_export_activity_trends():
                     elif chart_type == 'tokens':
                         debug_print(f"🔍 [CSV DEBUG] Writing token usage headers for {chart_type}")
                         writer.writerow([
-                            'Display Name', 'Email', 'User ID', 'Token Type', 'Model Name', 
-                            'Prompt Tokens', 'Completion Tokens', 'Total Tokens', 'Timestamp'
+                            'Display Name', 'Email', 'User ID', 'Workspace Type', 'Group ID',
+                            'Public Workspace ID', 'Token Type', 'Model Name', 'Prompt Tokens',
+                            'Completion Tokens', 'Total Tokens', 'Timestamp'
                         ])
                         record_count = 0
                         for record in raw_data[chart_type]:
@@ -4735,6 +4961,9 @@ def api_export_activity_trends():
                                 record.get('display_name', ''),
                                 record.get('email', ''),
                                 record.get('user_id', ''),
+                                record.get('workspace_type', ''),
+                                record.get('group_id', ''),
+                                record.get('public_workspace_id', ''),
                                 record.get('token_type', ''),
                                 record.get('model_name', ''),
                                 record.get('prompt_tokens', ''),
@@ -4784,13 +5013,14 @@ def api_chat_activity_trends():
         Create a new chat conversation with activity trends data as CSV message.
         """
         try:
-            data = request.get_json()
+            data = request.get_json() or {}
             
             # Parse request parameters
             charts = data.get('charts', ['logins', 'chats', 'documents'])  # Default to all charts
             time_window = data.get('time_window', '30')  # Default to 30 days
             start_date = data.get('start_date')  # For custom range
             end_date = data.get('end_date')  # For custom range
+            token_filters = extract_token_filters(data)
             
             # Determine date range
             if time_window == 'custom' and start_date and end_date:
@@ -4808,8 +5038,9 @@ def api_chat_activity_trends():
             
             # Get activity data using existing function
             activity_data = get_activity_trends_data(
-                start_date_obj.strftime('%Y-%m-%d'),
-                end_date_obj.strftime('%Y-%m-%d')
+                start_date_obj,
+                end_date_obj,
+                token_filters=token_filters
             )
             
             # Prepare CSV data
@@ -4948,7 +5179,7 @@ def api_refresh_control_center_data():
             from flask import request
             try:
                 request_data = request.get_json(force=True) or {}
-            except:
+            except Exception as ex:
                 # Handle case where no JSON body is sent
                 request_data = {}
                 
@@ -5572,6 +5803,8 @@ def api_get_activity_logs():
                 filtered_logs = []
                 for log in logs:
                     # Search in various fields
+                    usage = log.get('usage', {})
+                    workspace_context = log.get('workspace_context', {})
                     searchable_text = ' '.join([
                         str(log.get('activity_type', '')),
                         str(log.get('user_id', '')),
@@ -5579,7 +5812,10 @@ def api_get_activity_logs():
                         str(log.get('conversation', {}).get('title', '')),
                         str(log.get('document', {}).get('file_name', '')),
                         str(log.get('token_type', '')),
-                        str(log.get('workspace_type', ''))
+                        str(log.get('workspace_type', '')),
+                        str(usage.get('model', '')),
+                        str(workspace_context.get('group_id', '')),
+                        str(workspace_context.get('public_workspace_id', ''))
                     ]).lower()
                     
                     if search_term in searchable_text:
@@ -5606,7 +5842,7 @@ def api_get_activity_logs():
                             'email': user_doc.get('email', ''),
                             'display_name': user_doc.get('display_name', '')
                         }
-                    except:
+                    except Exception as ex:
                         user_map[user_id] = {
                             'email': '',
                             'display_name': ''
@@ -6225,7 +6461,7 @@ def _execute_take_workspace_ownership(approval, executor_id, executor_email, exe
                     )
                     old_owner_email = old_owner_user.get('email', 'unknown')
                     old_owner_name = old_owner_user.get('display_name', old_owner_email)
-                except:
+                except Exception as ex:
                     old_owner_email = 'unknown'
                     old_owner_name = 'unknown'
             
@@ -6256,7 +6492,7 @@ def _execute_take_workspace_ownership(approval, executor_id, executor_email, exe
                                 'email': admin_user.get('email', 'unknown'),
                                 'displayName': admin_user.get('display_name', 'unknown')
                             })
-                        except:
+                        except Exception as ex:
                             pass
             workspace['admins'] = new_admins
             
@@ -6279,7 +6515,7 @@ def _execute_take_workspace_ownership(approval, executor_id, executor_email, exe
                                 'email': dm_user.get('email', 'unknown'),
                                 'displayName': dm_user.get('display_name', 'unknown')
                             })
-                        except:
+                        except Exception as ex:
                             pass
             workspace['documentManagers'] = new_dms
             
@@ -6450,7 +6686,7 @@ def _execute_transfer_workspace_ownership(approval, executor_id, executor_email,
                     )
                     old_owner_email = old_owner_user.get('email', 'unknown')
                     old_owner_name = old_owner_user.get('display_name', old_owner_email)
-                except:
+                except Exception as ex:
                     old_owner_email = 'unknown'
                     old_owner_name = 'unknown'
             
@@ -6481,7 +6717,7 @@ def _execute_transfer_workspace_ownership(approval, executor_id, executor_email,
                                 'email': admin_user.get('email', 'unknown'),
                                 'displayName': admin_user.get('display_name', 'unknown')
                             })
-                        except:
+                        except Exception as ex:
                             pass
             workspace['admins'] = new_admins
             
@@ -6504,7 +6740,7 @@ def _execute_transfer_workspace_ownership(approval, executor_id, executor_email,
                                 'email': dm_user.get('email', 'unknown'),
                                 'displayName': dm_user.get('display_name', 'unknown')
                             })
-                        except:
+                        except Exception as ex:
                             pass
             workspace['documentManagers'] = new_dms
             
diff --git a/application/single_app/route_backend_conversations.py b/application/single_app/route_backend_conversations.py
index 58c2fd41..bc4dd6cd 100644
--- a/application/single_app/route_backend_conversations.py
+++ b/application/single_app/route_backend_conversations.py
@@ -12,6 +12,31 @@
 from functions_activity_logging import log_conversation_creation, log_conversation_deletion, log_conversation_archival
 from functions_thoughts import archive_thoughts_for_conversation, delete_thoughts_for_conversation
 
+def normalize_chat_type(conversation_item):
+    chat_type = conversation_item.get('chat_type')
+    if chat_type:
+        if chat_type == 'personal':
+            conversation_item['chat_type'] = 'personal_single_user'
+            return conversation_item['chat_type'], True
+        return chat_type, False
+
+    primary_context = next(
+        (ctx for ctx in conversation_item.get('context', []) if ctx.get('type') == 'primary'),
+        None
+    )
+    if primary_context:
+        if primary_context.get('scope') == 'group':
+            chat_type = 'group-single-user'
+        elif primary_context.get('scope') == 'public':
+            chat_type = 'public'
+        else:
+            chat_type = 'personal_single_user'
+    else:
+        chat_type = 'personal_single_user'
+
+    conversation_item['chat_type'] = chat_type
+    return chat_type, True
+
 def register_route_backend_conversations(app):
 
     @app.route('/api/get_messages', methods=['GET'])
@@ -316,6 +341,7 @@ def create_conversation():
             'strict': False,
             'is_pinned': False,
             'is_hidden': False,
+            'chat_type': 'new',
             'has_unread_assistant_response': False,
             'last_unread_assistant_message_id': None,
             'last_unread_assistant_at': None,
@@ -805,6 +831,10 @@ def get_conversation_metadata_api(conversation_id):
             if conversation_item.get('user_id') != user_id:
                 return jsonify({'error': 'Forbidden'}), 403
             
+            _, updated = normalize_chat_type(conversation_item)
+            if updated:
+                cosmos_conversations_container.upsert_item(conversation_item)
+
             # Return the full conversation metadata
             return jsonify({
                 "conversation_id": conversation_id,
@@ -1133,8 +1163,8 @@ def search_conversations():
                 filtered_in = []
                 
                 for c in conversations:
-                    # Default to 'personal' if chat_type is not defined (legacy conversations)
-                    chat_type = c.get('chat_type', 'personal')
+                    # Default to 'personal_single_user' if chat_type is not defined (legacy conversations)
+                    chat_type = c.get('chat_type', 'personal_single_user')
                     if chat_type in chat_types:
                         filtered_in.append(c)
                     else:
@@ -1145,7 +1175,7 @@ def search_conversations():
                 
                 # Show some examples of filtered out chat types
                 if filtered_out:
-                    unique_types = set(c.get('chat_type', 'None/personal') for c in filtered_out[:10])
+                    unique_types = set(c.get('chat_type', 'None/personal_single_user') for c in filtered_out[:10])
                     debug_print(f"   Filtered out chat_types (sample): {unique_types}")
             
             # Filter by classifications if specified
@@ -1256,7 +1286,7 @@ def search_conversations():
                             'title': conversation.get('title', 'Untitled'),
                             'last_updated': conversation.get('last_updated', ''),
                             'classification': conversation.get('classification', []),
-                            'chat_type': conversation.get('chat_type', 'personal'),
+                            'chat_type': conversation.get('chat_type', 'personal_single_user'),
                             'is_pinned': conversation.get('is_pinned', False),
                             'is_hidden': conversation.get('is_hidden', False)
                         },
@@ -1406,7 +1436,7 @@ def delete_message(message_id):
                     )
                     if conversation.get('user_id') != user_id:
                         return jsonify({'error': 'You can only delete messages from your own conversations'}), 403
-                except:
+                except Exception as ex:
                     return jsonify({'error': 'Conversation not found'}), 404
             elif message_user_id != user_id:
                 return jsonify({'error': 'You can only delete your own messages'}), 403
@@ -1605,7 +1635,7 @@ def retry_message(message_id):
                     )
                     if conversation.get('user_id') != user_id:
                         return jsonify({'error': 'You can only retry messages from your own conversations'}), 403
-                except:
+                except Exception as ex:
                     return jsonify({'error': 'Conversation not found'}), 404
             elif message_user_id != user_id:
                 return jsonify({'error': 'You can only retry your own messages'}), 403
@@ -1824,7 +1854,7 @@ def edit_message(message_id):
                     )
                     if conversation.get('user_id') != user_id:
                         return jsonify({'error': 'You can only edit messages from your own conversations'}), 403
-                except:
+                except Exception as ex:
                     return jsonify({'error': 'Conversation not found'}), 404
             elif message_user_id != user_id:
                 return jsonify({'error': 'You can only edit your own messages'}), 403
@@ -2033,7 +2063,7 @@ def switch_attempt(message_id):
                     )
                     if conversation.get('user_id') != user_id:
                         return jsonify({'error': 'You can only switch attempts in your own conversations'}), 403
-                except:
+                except Exception as ex:
                     return jsonify({'error': 'Conversation not found'}), 404
             elif message_user_id != user_id:
                 return jsonify({'error': 'You can only switch attempts in your own conversations'}), 403
diff --git a/application/single_app/route_backend_documents.py b/application/single_app/route_backend_documents.py
index 0e9d490b..bd4d7e43 100644
--- a/application/single_app/route_backend_documents.py
+++ b/application/single_app/route_backend_documents.py
@@ -276,7 +276,7 @@ def api_user_upload_document():
                         file.seek(0, 2)  # Seek to end
                         file_size = file.tell()
                         file.seek(0)  # Reset to beginning
-                    except:
+                    except Exception as ex:
                         file_size = 0
                         
                     log_document_upload(
diff --git a/application/single_app/route_backend_models.py b/application/single_app/route_backend_models.py
index 176d112c..bd981d43 100644
--- a/application/single_app/route_backend_models.py
+++ b/application/single_app/route_backend_models.py
@@ -2,20 +2,331 @@
 
 from config import *
 from functions_authentication import *
+from functions_group import assert_group_role, get_group_model_endpoints, require_active_group, update_group_model_endpoints
+from functions_keyvault import SecretReturnType, keyvault_model_endpoint_cleanup_helper, keyvault_model_endpoint_delete_helper, keyvault_model_endpoint_get_helper, keyvault_model_endpoint_save_helper
 from functions_settings import *
+from foundry_agent_runtime import list_foundry_agents_from_endpoint, list_new_foundry_agents_from_endpoint, resolve_foundry_project_base, resolve_foundry_project_api_version, build_project_credential, resolve_authority
+from functions_debug import debug_print
 from swagger_wrapper import swagger_route, get_auth_security
+from azure.identity import DefaultAzureCredential, ClientSecretCredential, get_bearer_token_provider
 import re
+import requests
 
 
 def register_route_backend_models(app):
     """
     Register backend routes for fetching Azure OpenAI models.
     """
+    def resolve_scoped_model_endpoints(user_id, scope):
+        settings = get_settings()
+        endpoints = []
+        if scope == "group":
+            if settings.get("allow_group_custom_endpoints", False):
+                group_id = require_active_group(user_id)
+                endpoints.extend(get_group_model_endpoints(group_id))
+        elif scope == "user":
+            if settings.get("allow_user_custom_endpoints", False):
+                user_settings = get_user_settings(user_id)
+                endpoints.extend(user_settings.get("settings", {}).get("personal_model_endpoints", []))
+        endpoints.extend(settings.get("model_endpoints", []) or [])
+        return endpoints
+
+    def resolve_endpoint_by_id(user_id, scope, endpoint_id):
+        endpoints = resolve_scoped_model_endpoints(user_id, scope)
+        return next((endpoint for endpoint in endpoints if endpoint.get("id") == endpoint_id), None)
+
+    def resolve_endpoint_scope_value(endpoint_cfg, fallback_endpoint_id=""):
+        endpoint_id = (fallback_endpoint_id or endpoint_cfg.get("id") or "").strip()
+        if not endpoint_id:
+            raise ValueError("Endpoint ID is required to resolve stored secrets.")
+        return endpoint_id
+
+    def resolve_request_endpoint_payload(payload, scope="global"):
+        user_id = get_current_user_id()
+        endpoint_id = str(payload.get("endpoint_id") or payload.get("id") or "").strip()
+        persisted_endpoint = resolve_endpoint_by_id(user_id, scope, endpoint_id) if endpoint_id else None
+        merged_payload = merge_model_endpoint_payload(persisted_endpoint or {}, payload)
+        if endpoint_id:
+            merged_payload["id"] = endpoint_id
+
+        scope_value = merged_payload.get("id") or endpoint_id
+        if scope_value:
+            merged_payload = keyvault_model_endpoint_get_helper(
+                merged_payload,
+                resolve_endpoint_scope_value(merged_payload, scope_value),
+                scope=scope,
+                return_type=SecretReturnType.VALUE,
+            )
+        return merged_payload
+
+    def build_foundry_settings_from_endpoint(endpoint_cfg):
+        connection = endpoint_cfg.get("connection", {}) or {}
+        auth = endpoint_cfg.get("auth", {}) or {}
+        return {
+            "endpoint": connection.get("endpoint"),
+            "api_version": connection.get("project_api_version") or connection.get("api_version") or "v1",
+            "responses_api_version": connection.get("openai_api_version") or connection.get("api_version") or "",
+            "activity_api_version": connection.get("project_api_version") or connection.get("api_version") or "",
+            "project_name": connection.get("project_name") or "",
+            "authentication_type": auth.get("type") or "managed_identity",
+            "managed_identity_type": auth.get("managed_identity_type") or "system_assigned",
+            "managed_identity_client_id": auth.get("managed_identity_client_id") or "",
+            "tenant_id": auth.get("tenant_id") or "",
+            "client_id": auth.get("client_id") or "",
+            "client_secret": auth.get("client_secret") or "",
+            "cloud": auth.get("management_cloud") or "",
+            "authority": auth.get("custom_authority") or "",
+        }
+
+    def resolve_foundry_scope(auth_settings):
+        management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+        if management_cloud == "government":
+            return "https://ai.azure.us/.default"
+        if management_cloud == "custom":
+            custom_scope = (auth_settings.get("foundry_scope") or "").strip()
+            if not custom_scope:
+                raise ValueError("Foundry scope is required for custom cloud configurations.")
+            return custom_scope
+        return "https://ai.azure.com/.default"
+
+    def build_foundry_token(auth_settings):
+        management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+        scope = resolve_foundry_scope(auth_settings)
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        debug_print(f"[Models] Foundry token auth_type={auth_type}, scope={scope}, cloud={management_cloud}")
+        credential = build_project_credential(auth_settings)
+        token = credential.get_token(scope)
+        return token.token
+
+
+    def build_cognitive_services_client(subscription_id, auth_settings):
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+        debug_print(f"[Models] Building ARM client auth_type={auth_type}, subscription_id={subscription_id}, cloud={management_cloud}")
+        if auth_type == "service_principal":
+            authority_override = resolve_authority(auth_settings)
+            credential = ClientSecretCredential(
+                tenant_id=auth_settings.get("tenant_id"),
+                client_id=auth_settings.get("client_id"),
+                client_secret=auth_settings.get("client_secret"),
+                authority=authority_override
+            )
+        elif auth_type == "api_key":
+            debug_print("[Models] API key auth requested for model discovery (not supported).")
+            raise ValueError("API key auth is not supported for model discovery.")
+        else:
+            managed_identity_client_id = auth_settings.get("managed_identity_client_id") or None
+            credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
+
+        if AZURE_ENVIRONMENT in ("usgovernment", "custom"):
+            return CognitiveServicesManagementClient(
+                credential=credential,
+                subscription_id=subscription_id,
+                base_url=resource_manager,
+                credential_scopes=credential_scopes
+            )
+
+        return CognitiveServicesManagementClient(
+            credential=credential,
+            subscription_id=subscription_id
+        )
+
+    def build_inference_client(endpoint, api_version, auth_settings, provider="aoai"):
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        if auth_type == "api_key":
+            api_key = auth_settings.get("api_key")
+            if not api_key:
+                raise ValueError("API key is required for API key authentication.")
+            return AzureOpenAI(
+                api_version=api_version,
+                azure_endpoint=endpoint,
+                api_key=api_key
+            )
+
+        if auth_type == "service_principal":
+            authority_override = resolve_authority(auth_settings)
+            credential = ClientSecretCredential(
+                tenant_id=auth_settings.get("tenant_id"),
+                client_id=auth_settings.get("client_id"),
+                client_secret=auth_settings.get("client_secret"),
+                authority=authority_override
+            )
+        else:
+            managed_identity_client_id = auth_settings.get("managed_identity_client_id") or None
+            credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
+
+        scope = cognitive_services_scope
+        if provider in ("aifoundry", "new_foundry"):
+            scope = resolve_foundry_scope(auth_settings)
+        debug_print(f"[Models] Inference token scope={scope} provider={provider}")
+        token_provider = get_bearer_token_provider(credential, scope)
+        return AzureOpenAI(
+            api_version=api_version,
+            azure_endpoint=endpoint,
+            azure_ad_token_provider=token_provider
+        )
+
+    def fetch_foundry_project_deployments(endpoint, api_version, auth_settings, project_name=None):
+        if not endpoint:
+            raise ValueError("Missing Foundry project endpoint")
+
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        if auth_type == "api_key":
+            debug_print("[Models] API key auth requested for Foundry project discovery (not supported).")
+            raise ValueError("API key auth is not supported for Foundry project model discovery.")
+
+        token = build_foundry_token(auth_settings)
+        headers = {
+            "Authorization": f"Bearer {token}"
+        }
+
+        base = resolve_foundry_project_base(endpoint, project_name)
+        params = {
+            "api-version": resolve_foundry_project_api_version(api_version),
+            "deploymentType": "ModelDeployment"
+        }
+        url = f"{base}/deployments"
+        debug_print(f"[Models] Foundry project deployments URL={url}")
+
+        response = requests.get(url, headers=headers, params=params, timeout=30)
+        response.raise_for_status()
+        payload = response.json()
+        return payload.get("value", [])
+
+    def extract_provisioning_state(deployment):
+        properties = getattr(deployment, "properties", None) or {}
+        if isinstance(properties, dict):
+            return properties.get("provisioningState") or properties.get("provisioning_state")
+        return getattr(properties, "provisioning_state", None) or getattr(properties, "provisioningState", None)
+
+    def is_deployment_enabled(deployment):
+        state = extract_provisioning_state(deployment)
+        if not state:
+            return True
+        return str(state).lower() == "succeeded"
+
+    def handle_fetch_model_list(scope="global"):
+        data = request.get_json() or {}
+        data = resolve_request_endpoint_payload(data, scope=scope)
+        provider = (data.get("provider") or "aoai").lower()
+        connection = data.get("connection") or {}
+        auth_settings = data.get("auth") or {}
+        management = data.get("management") or {}
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        debug_print(
+            "[Models] Fetch model list request"
+            f" provider={provider} auth_type={auth_type}"
+            f" endpoint={connection.get('endpoint') or ''}"
+            f" subscription_id_present={bool(management.get('subscription_id'))}"
+            f" resource_group_present={bool(management.get('resource_group'))}"
+        )
+
+        try:
+            if provider in ("aifoundry", "new_foundry"):
+                endpoint = connection.get("endpoint")
+                api_version = connection.get("project_api_version") or connection.get("api_version") or "v1"
+                project_name = connection.get("project_name")
+                debug_print(f"[Models] Foundry fetch project endpoint={endpoint or ''} api_version={api_version}")
+                deployments = fetch_foundry_project_deployments(endpoint, api_version, auth_settings, project_name=project_name)
+                mapped = []
+                for item in deployments:
+                    deployment_name = item.get("name") or item.get("deploymentName")
+                    if not deployment_name:
+                        continue
+                    model_name = item.get("modelName")
+                    if not model_name and isinstance(item.get("model"), dict):
+                        model_name = item["model"].get("name")
+                    mapped.append({
+                        "deploymentName": deployment_name,
+                        "modelName": model_name or ""
+                    })
+                return jsonify({"models": mapped})
+
+            if provider == "aoai":
+                subscription_id = management.get("subscription_id")
+                resource_group = management.get("resource_group")
+                endpoint = connection.get("endpoint") or ""
+                account_name = endpoint.split('.')[0].replace("https://", "").replace("http://", "")
+                debug_print(
+                    f"[Models] AOAI fetch account_name={account_name}"
+                    f" subscription_id={subscription_id or ''}"
+                    f" resource_group={resource_group or ''}"
+                )
+                if not subscription_id or not resource_group or not account_name:
+                    raise ValueError("Azure OpenAI model discovery requires subscription ID, resource group, and endpoint.")
+
+                client = build_cognitive_services_client(subscription_id, auth_settings)
+                deployments = client.deployments.list(
+                    resource_group_name=resource_group,
+                    account_name=account_name
+                )
+
+                mapped = []
+                for deployment in deployments:
+                    if not is_deployment_enabled(deployment):
+                        continue
+                    model_name = deployment.properties.model.name
+                    if model_name and (
+                        "gpt" in model_name.lower() or
+                        re.search(r"o\d+", model_name.lower())
+                    ) and "image" not in model_name.lower():
+                        mapped.append({
+                            "deploymentName": deployment.name,
+                            "modelName": model_name
+                        })
+                return jsonify({"models": mapped})
+
+            return jsonify({"error": "Model provider not found."}), 400
+        except Exception as e:
+            debug_print(f"[Models] Fetch model list error: {str(e)}")
+            return jsonify({"error": str(e)}), 400
+
+    def handle_test_model_connection(scope="global"):
+        data = request.get_json() or {}
+        data = resolve_request_endpoint_payload(data, scope=scope)
+        provider = (data.get("provider") or "aoai").lower()
+        connection = data.get("connection") or {}
+        auth_settings = data.get("auth") or {}
+        model = data.get("model") or {}
+
+        endpoint = connection.get("endpoint") or ""
+        api_version = connection.get("openai_api_version") or connection.get("api_version") or ""
+        deployment_name = model.get("deploymentName") or ""
+
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        debug_print(
+            "[Models] Test model request"
+            f" provider={provider} auth_type={auth_type}"
+            f" endpoint={endpoint} deployment={deployment_name}"
+        )
+
+        if not endpoint or not api_version or not deployment_name:
+            return jsonify({"error": "Endpoint, API version, and deployment name are required."}), 400
+
+        try:
+            if provider not in ("aoai", "aifoundry", "new_foundry"):
+                return jsonify({"error": "Model provider not found."}), 400
+
+            gpt_client = build_inference_client(endpoint, api_version, auth_settings, provider=provider)
+            response = gpt_client.chat.completions.create(
+                model=deployment_name,
+                messages=[{"role": "system", "content": "Testing access."}]
+            )
+
+            if response:
+                return jsonify({"success": True}), 200
+
+            return jsonify({"error": "No response returned from model."}), 400
+
+        except Exception as e:
+            debug_print(f"[Models] Test model error: {str(e)}")
+            return jsonify({"error": str(e)}), 400
 
     @app.route('/api/models/gpt', methods=['GET'])
     @swagger_route(security=get_auth_security())
     @login_required
     @user_required
+    @admin_required
     def get_gpt_models():
         """
         Fetch available GPT-like Azure OpenAI deployments using Azure Management API.
@@ -56,6 +367,8 @@ def get_gpt_models():
             )
 
             for d in deployments:
+                if not is_deployment_enabled(d):
+                    continue
                 model_name = d.properties.model.name
                 if model_name and (
                     "gpt" in model_name.lower() or
@@ -76,6 +389,7 @@ def get_gpt_models():
     @swagger_route(security=get_auth_security())
     @login_required
     @user_required
+    @admin_required
     def get_embedding_models():
         """
         Fetch available embedding Azure OpenAI deployments using Azure Management API.
@@ -115,6 +429,8 @@ def get_embedding_models():
                 account_name=account_name
             )
             for d in deployments:
+                if not is_deployment_enabled(d):
+                    continue
                 model_name = d.properties.model.name
                 if model_name and (
                     "embedding" in model_name.lower() or
@@ -134,6 +450,7 @@ def get_embedding_models():
     @swagger_route(security=get_auth_security())
     @login_required
     @user_required
+    @admin_required
     def get_image_models():
         """
         Fetch available DALL-E image generation Azure OpenAI deployments using Azure Management API.
@@ -173,6 +490,8 @@ def get_image_models():
                 account_name=account_name
             )
             for d in deployments:
+                if not is_deployment_enabled(d):
+                    continue
                 model_name = d.properties.model.name
                 if model_name and (
                     "dall-e" in model_name.lower() or
@@ -185,4 +504,371 @@ def get_image_models():
         except Exception as e:
             return jsonify({"error": str(e)}), 500
 
-        return jsonify({"models": models})
\ No newline at end of file
+        return jsonify({"models": models})
+
+
+    @app.route('/api/models/test-connection', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @admin_required
+    def test_model_inference_connection():
+        data = request.get_json() or {}
+        data = resolve_request_endpoint_payload(data, scope="global")
+        provider = (data.get("provider") or "aoai").lower()
+        connection = data.get("connection") or {}
+        management = data.get("management") or {}
+        auth_settings = data.get("auth") or {}
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        debug_print(
+            "[Models] Test connection request"
+            f" provider={provider} auth_type={auth_type}"
+            f" endpoint={connection.get('endpoint') or ''}"
+            f" subscription_id_present={bool(management.get('subscription_id'))}"
+            f" resource_group_present={bool(management.get('resource_group'))}"
+        )
+
+        try:
+            if provider in ("aifoundry", "new_foundry"):
+                endpoint = connection.get("endpoint")
+                api_version = connection.get("project_api_version") or connection.get("api_version") or "v1"
+                project_name = connection.get("project_name")
+                debug_print(f"[Models] Foundry test project endpoint={endpoint or ''} api_version={api_version}")
+                deployments = fetch_foundry_project_deployments(endpoint, api_version, auth_settings, project_name=project_name)
+                return jsonify({"success": True, "count": len(deployments)})
+
+            if provider == "aoai":
+                subscription_id = management.get("subscription_id")
+                resource_group = management.get("resource_group")
+                endpoint = connection.get("endpoint") or ""
+                account_name = endpoint.split('.')[0].replace("https://", "").replace("http://", "")
+                debug_print(
+                    f"[Models] AOAI test account_name={account_name}"
+                    f" subscription_id={subscription_id or ''}"
+                    f" resource_group={resource_group or ''}"
+                )
+                if not subscription_id or not resource_group or not account_name:
+                    raise ValueError("Azure OpenAI model discovery requires subscription ID, resource group, and endpoint.")
+
+                client = build_cognitive_services_client(subscription_id, auth_settings)
+                deployments = client.deployments.list(
+                    resource_group_name=resource_group,
+                    account_name=account_name
+                )
+
+                count = 0
+                for deployment in deployments:
+                    model_name = deployment.properties.model.name
+                    if model_name and (
+                        "gpt" in model_name.lower() or
+                        re.search(r"o\d+", model_name.lower())
+                    ) and "image" not in model_name.lower():
+                        count += 1
+                return jsonify({"success": True, "count": count})
+
+            return jsonify({"error": "Model provider not found."}), 400
+        except Exception as e:
+            debug_print(f"[Models] Test connection error: {str(e)}")
+            return jsonify({"error": str(e)}), 400
+
+
+    @app.route('/api/models/fetch', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @admin_required
+    def fetch_model_list():
+        return handle_fetch_model_list(scope="global")
+
+
+    @app.route('/api/user/model-endpoints', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('allow_user_custom_endpoints')
+    def get_user_model_endpoints():
+        user_id = get_current_user_id()
+        user_settings = get_user_settings(user_id)
+        endpoints = user_settings.get("settings", {}).get("personal_model_endpoints", [])
+        return jsonify({
+            "endpoints": sanitize_model_endpoints_for_frontend(endpoints)
+        })
+
+
+    @app.route('/api/user/model-endpoints', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('allow_user_custom_endpoints')
+    def save_user_model_endpoints():
+        user_id = get_current_user_id()
+        data = request.get_json() or {}
+        incoming = data.get("endpoints", [])
+        if not isinstance(incoming, list):
+            return jsonify({"error": "endpoints must be a list."}), 400
+
+        user_settings = get_user_settings(user_id)
+        existing = user_settings.get("settings", {}).get("personal_model_endpoints", [])
+
+        merged = merge_model_endpoints_with_existing(incoming, existing)
+
+        normalized, _ = normalize_model_endpoints(merged)
+        existing_by_id = {
+            endpoint.get("id"): endpoint
+            for endpoint in existing
+            if isinstance(endpoint, dict) and endpoint.get("id")
+        }
+        saved_endpoints = [
+            keyvault_model_endpoint_save_helper(
+                endpoint,
+                resolve_endpoint_scope_value(endpoint),
+                scope="user",
+                existing_endpoint=existing_by_id.get(endpoint.get("id")),
+            )
+            for endpoint in normalized
+        ]
+
+        for endpoint in saved_endpoints:
+            if not isinstance(endpoint, dict):
+                continue
+            endpoint_id = endpoint.get("id")
+            if not endpoint_id:
+                continue
+            keyvault_model_endpoint_cleanup_helper(
+                existing_by_id.get(endpoint_id),
+                endpoint,
+                endpoint_id,
+                scope="user",
+            )
+
+        saved_endpoint_ids = {
+            endpoint.get("id")
+            for endpoint in saved_endpoints
+            if isinstance(endpoint, dict) and endpoint.get("id")
+        }
+        for endpoint in existing:
+            if not isinstance(endpoint, dict):
+                continue
+            endpoint_id = endpoint.get("id")
+            if endpoint_id and endpoint_id not in saved_endpoint_ids:
+                keyvault_model_endpoint_delete_helper(endpoint, endpoint_id, scope="user")
+
+        update_user_settings(user_id, {"personal_model_endpoints": saved_endpoints})
+        return jsonify({"success": True})
+
+
+    @app.route('/api/group/model-endpoints', methods=['GET'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('enable_group_workspaces')
+    @enabled_required('allow_group_custom_endpoints')
+    def get_group_model_endpoints_route():
+        user_id = get_current_user_id()
+        try:
+            group_id = require_active_group(user_id)
+        except ValueError as exc:
+            return jsonify({"error": str(exc)}), 400
+        endpoints = get_group_model_endpoints(group_id)
+        return jsonify({
+            "endpoints": sanitize_model_endpoints_for_frontend(endpoints)
+        })
+
+
+    @app.route('/api/group/model-endpoints', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('enable_group_workspaces')
+    @enabled_required('allow_group_custom_endpoints')
+    def save_group_model_endpoints():
+        user_id = get_current_user_id()
+        data = request.get_json() or {}
+        incoming = data.get("endpoints", [])
+        if not isinstance(incoming, list):
+            return jsonify({"error": "endpoints must be a list."}), 400
+
+        try:
+            group_id = require_active_group(user_id)
+            assert_group_role(user_id, group_id)
+        except ValueError as exc:
+            return jsonify({"error": str(exc)}), 400
+        except LookupError as exc:
+            return jsonify({"error": str(exc)}), 404
+        except PermissionError as exc:
+            return jsonify({"error": str(exc)}), 403
+
+        existing = get_group_model_endpoints(group_id)
+
+        merged = merge_model_endpoints_with_existing(incoming, existing)
+
+        normalized, _ = normalize_model_endpoints(merged)
+        existing_by_id = {
+            endpoint.get("id"): endpoint
+            for endpoint in existing
+            if isinstance(endpoint, dict) and endpoint.get("id")
+        }
+        saved_endpoints = [
+            keyvault_model_endpoint_save_helper(
+                endpoint,
+                resolve_endpoint_scope_value(endpoint),
+                scope="group",
+                existing_endpoint=existing_by_id.get(endpoint.get("id")),
+            )
+            for endpoint in normalized
+        ]
+
+        for endpoint in saved_endpoints:
+            if not isinstance(endpoint, dict):
+                continue
+            endpoint_id = endpoint.get("id")
+            if not endpoint_id:
+                continue
+            keyvault_model_endpoint_cleanup_helper(
+                existing_by_id.get(endpoint_id),
+                endpoint,
+                endpoint_id,
+                scope="group",
+            )
+
+        saved_endpoint_ids = {
+            endpoint.get("id")
+            for endpoint in saved_endpoints
+            if isinstance(endpoint, dict) and endpoint.get("id")
+        }
+        for endpoint in existing:
+            if not isinstance(endpoint, dict):
+                continue
+            endpoint_id = endpoint.get("id")
+            if endpoint_id and endpoint_id not in saved_endpoint_ids:
+                keyvault_model_endpoint_delete_helper(endpoint, endpoint_id, scope="group")
+
+        update_group_model_endpoints(group_id, saved_endpoints)
+        return jsonify({"success": True})
+
+
+    @app.route('/api/models/foundry/agents', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def list_foundry_agents():
+        user_id = get_current_user_id()
+        data = request.get_json() or {}
+        endpoint_id = (data.get("endpoint_id") or "").strip()
+        scope = (data.get("scope") or "global").lower()
+        if scope not in ("global", "user", "group"):
+            scope = "global"
+        if not endpoint_id:
+            return jsonify({"error": "endpoint_id is required."}), 400
+
+        if scope == "group":
+            try:
+                group_id = require_active_group(user_id)
+                assert_group_role(user_id, group_id)
+            except ValueError as exc:
+                return jsonify({"error": str(exc)}), 400
+            except LookupError as exc:
+                return jsonify({"error": str(exc)}), 404
+            except PermissionError as exc:
+                return jsonify({"error": str(exc)}), 403
+
+        endpoint_cfg = resolve_endpoint_by_id(user_id, scope, endpoint_id)
+        if not endpoint_cfg:
+            return jsonify({"error": "Model endpoint not found."}), 404
+        endpoint_cfg = keyvault_model_endpoint_get_helper(
+            endpoint_cfg,
+            resolve_endpoint_scope_value(endpoint_cfg, endpoint_id),
+            scope=scope,
+            return_type=SecretReturnType.VALUE,
+        )
+        provider = (endpoint_cfg.get("provider") or "aoai").lower()
+        if provider not in ("aifoundry", "new_foundry"):
+            return jsonify({"error": "Selected endpoint is not a Foundry endpoint."}), 400
+
+        foundry_settings = build_foundry_settings_from_endpoint(endpoint_cfg)
+        try:
+            if provider == "new_foundry":
+                agents = list_new_foundry_agents_from_endpoint(foundry_settings, get_settings())
+            else:
+                agents = list_foundry_agents_from_endpoint(foundry_settings, get_settings())
+        except Exception as exc:
+            debug_print(f"[Models] Foundry agent list error: {str(exc)}")
+            return jsonify({"error": str(exc)}), 400
+
+        connection = endpoint_cfg.get("connection", {}) or {}
+        responses_api_version = ""
+        if provider == "new_foundry":
+            responses_api_version = str(
+                connection.get("openai_api_version")
+                or connection.get("api_version")
+                or ""
+            ).strip()
+
+        return jsonify({
+            "agents": agents,
+            "provider": provider,
+            "responses_api_version": responses_api_version,
+        })
+
+
+    @app.route('/api/models/test-model', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @admin_required
+    def test_model_connection():
+        return handle_test_model_connection(scope="global")
+
+
+    @app.route('/api/user/models/fetch', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def fetch_model_list_user():
+        return handle_fetch_model_list(scope="user")
+
+
+    @app.route('/api/user/models/test-model', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    def test_model_connection_user():
+        return handle_test_model_connection(scope="user")
+
+
+    @app.route('/api/group/models/fetch', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('enable_group_workspaces')
+    def fetch_model_list_group():
+        user_id = get_current_user_id()
+        try:
+            group_id = require_active_group(user_id)
+            assert_group_role(user_id, group_id)
+        except ValueError as exc:
+            return jsonify({"error": str(exc)}), 400
+        except LookupError as exc:
+            return jsonify({"error": str(exc)}), 404
+        except PermissionError as exc:
+            return jsonify({"error": str(exc)}), 403
+        return handle_fetch_model_list(scope="group")
+
+
+    @app.route('/api/group/models/test-model', methods=['POST'])
+    @swagger_route(security=get_auth_security())
+    @login_required
+    @user_required
+    @enabled_required('enable_group_workspaces')
+    def test_model_connection_group():
+        user_id = get_current_user_id()
+        try:
+            group_id = require_active_group(user_id)
+            assert_group_role(user_id, group_id)
+        except ValueError as exc:
+            return jsonify({"error": str(exc)}), 400
+        except LookupError as exc:
+            return jsonify({"error": str(exc)}), 404
+        except PermissionError as exc:
+            return jsonify({"error": str(exc)}), 403
+        return handle_test_model_connection(scope="group")
\ No newline at end of file
diff --git a/application/single_app/route_backend_public_workspaces.py b/application/single_app/route_backend_public_workspaces.py
index 6d14f357..d87fdc26 100644
--- a/application/single_app/route_backend_public_workspaces.py
+++ b/application/single_app/route_backend_public_workspaces.py
@@ -637,7 +637,7 @@ def api_update_public_member_role(ws_id, member_id):
                     details = get_user_details_from_graph(member_id)
                     member_name = details.get("displayName", "")
                     member_email = details.get("email", "")
-                except:
+                except Exception as ex:
                     pass
 
         # clear any existing
diff --git a/application/single_app/route_backend_thoughts.py b/application/single_app/route_backend_thoughts.py
index a7624a3f..bab0fd9a 100644
--- a/application/single_app/route_backend_thoughts.py
+++ b/application/single_app/route_backend_thoughts.py
@@ -31,6 +31,7 @@ def api_get_message_thoughts(conversation_id, message_id):
             for t in thoughts:
                 sanitized.append({
                     'id': t.get('id'),
+                    'message_id': t.get('message_id'),
                     'step_index': t.get('step_index'),
                     'step_type': t.get('step_type'),
                     'content': t.get('content'),
@@ -62,11 +63,13 @@ def api_get_pending_thoughts(conversation_id):
             return jsonify({'thoughts': [], 'enabled': False}), 200
 
         try:
-            thoughts = get_pending_thoughts(conversation_id, user_id)
+            message_id = request.args.get('message_id')
+            thoughts = get_pending_thoughts(conversation_id, user_id, message_id=message_id)
             sanitized = []
             for t in thoughts:
                 sanitized.append({
                     'id': t.get('id'),
+                    'message_id': t.get('message_id'),
                     'step_index': t.get('step_index'),
                     'step_type': t.get('step_type'),
                     'content': t.get('content'),
diff --git a/application/single_app/route_backend_users.py b/application/single_app/route_backend_users.py
index ad3ae5f4..2fdee39f 100644
--- a/application/single_app/route_backend_users.py
+++ b/application/single_app/route_backend_users.py
@@ -146,6 +146,7 @@ def user_settings():
                     'activeGroupOid', 'layoutPreference', 'splitSizesPreference', 'dockedSidebarHidden', 
                     'darkModeEnabled', 'preferredModelDeployment', 'agents', 'plugins', "selected_agent", 
                     'navLayout', 'profileImage', 'enable_agents', 'streamingEnabled', 'reasoningEffortSettings',
+                    'preferredModelId', 'dismissedMultiEndpointNotice',
                     # Public directory and workspace settings
                     'publicDirectorySavedLists', 'publicDirectorySettings', 'activePublicWorkspaceOid',
                     # Chat UI settings
diff --git a/application/single_app/route_enhanced_citations.py b/application/single_app/route_enhanced_citations.py
index 44fc4fcb..60675f41 100644
--- a/application/single_app/route_enhanced_citations.py
+++ b/application/single_app/route_enhanced_citations.py
@@ -468,7 +468,7 @@ def get_document(user_id, doc_id):
             doc_response, status_code = backend_get_document(user_id, doc_id)
             if status_code == 200:
                 return doc_response, status_code
-        except:
+        except Exception as ex:
             pass
     
     # Try group workspaces if enabled
@@ -484,9 +484,9 @@ def get_document(user_id, doc_id):
                         doc_response, status_code = backend_get_document(user_id, doc_id, group_id=group_id)
                         if status_code == 200:
                             return doc_response, status_code
-                    except:
+                    except Exception as ex:
                         continue
-        except:
+        except Exception as ex:
             pass
     
     # Try public workspaces if enabled
@@ -500,9 +500,9 @@ def get_document(user_id, doc_id):
                     doc_response, status_code = backend_get_document(user_id, doc_id, public_workspace_id=workspace_id)
                     if status_code == 200:
                         return doc_response, status_code
-                except:
+                except Exception as ex:
                     continue
-        except:
+        except Exception as ex:
             pass
     
     # If document not found in any workspace
diff --git a/application/single_app/route_frontend_admin_settings.py b/application/single_app/route_frontend_admin_settings.py
index b9e69c51..89317db3 100644
--- a/application/single_app/route_frontend_admin_settings.py
+++ b/application/single_app/route_frontend_admin_settings.py
@@ -3,11 +3,13 @@
 from config import *
 from functions_documents import *
 from functions_authentication import *
+from functions_keyvault import keyvault_model_endpoint_cleanup_helper, keyvault_model_endpoint_delete_helper, keyvault_model_endpoint_save_helper, redact_model_endpoint_secret_values
 from functions_settings import *
-from functions_activity_logging import log_web_search_consent_acceptance
+from functions_activity_logging import log_web_search_consent_acceptance, log_general_admin_action
+from functions_notifications import broadcast_system_notification
 from functions_logging import *
 from swagger_wrapper import swagger_route, get_auth_security
-from datetime import datetime, timedelta
+from datetime import datetime, timedelta, timezone
 
 ALLOWED_PIL_IMAGE_UPLOAD_FORMATS = ('PNG', 'JPEG')
 
@@ -34,7 +36,8 @@ def register_route_frontend_admin_settings(app):
     @admin_required
     def admin_settings():
         settings = get_settings()
-
+        admin_user = session.get('user', {})
+        admin_email = admin_user.get('preferred_username', admin_user.get('email', 'unknown'))
         # --- Refined Default Checks (Good Practice) ---
         # Ensure models have default structure if missing/empty in DB
         if 'gpt_model' not in settings or not isinstance(settings.get('gpt_model'), dict) or 'selected' not in settings.get('gpt_model', {}):
@@ -43,6 +46,33 @@ def admin_settings():
             settings['embedding_model'] = {'selected': [], 'all': []}
         if 'image_gen_model' not in settings or not isinstance(settings.get('image_gen_model'), dict) or 'selected' not in settings.get('image_gen_model', {}):
             settings['image_gen_model'] = {'selected': [], 'all': []}
+        if 'enable_multi_model_endpoints' not in settings:
+            settings['enable_multi_model_endpoints'] = False
+        if 'model_endpoints' not in settings or not isinstance(settings.get('model_endpoints'), list):
+            settings['model_endpoints'] = []
+        if 'default_model_selection' not in settings or not isinstance(settings.get('default_model_selection'), dict):
+            settings['default_model_selection'] = {
+                'endpoint_id': '',
+                'model_id': '',
+                'provider': ''
+            }
+        if 'multi_endpoint_migrated_at' not in settings:
+            settings['multi_endpoint_migrated_at'] = None
+        if 'multi_endpoint_migration_notice' not in settings or not isinstance(settings.get('multi_endpoint_migration_notice'), dict):
+            settings['multi_endpoint_migration_notice'] = {
+                'enabled': False,
+                'message': (
+                    'Multi-endpoint has been enabled and your existing AI endpoint was migrated. '
+                    'Agents using the default connection may need to be updated to select a new model endpoint.'
+                ),
+                'created_at': None
+            }
+
+        normalized_endpoints, endpoints_changed = normalize_model_endpoints(settings.get('model_endpoints', []))
+        if endpoints_changed:
+            update_settings({'model_endpoints': normalized_endpoints})
+        settings['model_endpoints'] = normalized_endpoints
+        frontend_model_endpoints = sanitize_model_endpoints_for_frontend(normalized_endpoints)
 
         # (get_settings should handle this, but explicit check is safe)
         if 'require_member_of_create_group' not in settings:
@@ -160,14 +190,14 @@ def admin_settings():
                 
         if 'allow_user_agents' not in settings:
             settings['allow_user_agents'] = False
-        if 'allow_user_custom_agent_endpoints' not in settings:
-            settings['allow_user_custom_agent_endpoints'] = False
+        if 'allow_user_custom_endpoints' not in settings:
+            settings['allow_user_custom_endpoints'] = settings.get('allow_user_custom_agent_endpoints', False)
         if 'allow_user_plugins' not in settings:
             settings['allow_user_plugins'] = False
         if 'allow_group_agents' not in settings:
             settings['allow_group_agents'] = False
-        if 'allow_group_custom_agent_endpoints' not in settings:
-            settings['allow_group_custom_agent_endpoints'] = False
+        if 'allow_group_custom_endpoints' not in settings:
+            settings['allow_group_custom_endpoints'] = settings.get('allow_group_custom_agent_endpoints', False)
         if 'allow_group_plugins' not in settings:
             settings['allow_group_plugins'] = False
         if 'enable_agent_template_gallery' not in settings:
@@ -285,15 +315,21 @@ def admin_settings():
             # Get user settings for profile and navigation
             user_id = get_current_user_id()
             user_settings = get_user_settings(user_id)
+            settings_for_template = dict(settings)
+            settings_for_template['model_endpoints'] = frontend_model_endpoints
 
             return render_template(
                 'admin_settings.html',
-                app_settings=settings,  # Admin needs unsanitized settings to view/edit all configuration
-                settings=settings,
+                app_settings=settings_for_template,
+                settings=settings_for_template,
                 user_settings=user_settings,
                 update_available=update_available,
                 latest_version=latest_version,
-                download_url=download_url
+                download_url=download_url,
+                chunk_size_defaults=get_chunk_size_defaults(),
+                chunk_size_settings=settings.get('chunk_size', {}),
+                chunk_size_cap=get_chunk_size_cap(settings),
+                chunk_size_effective=get_chunk_size_config(settings)
                 # You don't need to pass deployments separately if they are added to settings['..._model']['all']
                 # gpt_deployments=gpt_deployments,
                 # embedding_deployments=embedding_deployments,
@@ -343,8 +379,6 @@ def admin_settings():
                 flash('Web search requires consent before it can be enabled.', 'warning')
 
             if enable_web_search and web_search_consent_accepted and not settings.get('web_search_consent_accepted'):
-                admin_user = session.get('user', {})
-                admin_email = admin_user.get('preferred_username', admin_user.get('email', 'unknown'))
                 log_web_search_consent_acceptance(
                     user_id=user_id,
                     admin_email=admin_email,
@@ -458,6 +492,205 @@ def admin_settings():
                 log_event(f"Error parsing Image Gen model data: {e}", level=logging.ERROR)
                 image_gen_model_obj = settings.get('image_gen_model', {'selected': [], 'all': []}) # Fallback
 
+            enable_multi_model_endpoints = form_data.get('enable_multi_model_endpoints') == 'on'
+            model_endpoints_json = form_data.get('model_endpoints_json', '[]')
+            existing_model_endpoints = settings.get('model_endpoints', []) or []
+            parsed_model_endpoints = []
+            try:
+                parsed_model_endpoints_raw = json.loads(model_endpoints_json) if model_endpoints_json else []
+                if isinstance(parsed_model_endpoints_raw, list):
+                    parsed_model_endpoints = parsed_model_endpoints_raw
+                else:
+                    raise ValueError("Invalid format: model_endpoints must be a list.")
+            except (json.JSONDecodeError, ValueError) as e:
+                print(f"Error processing model_endpoints_json: {e}")
+                flash(f"Error processing model endpoints: {e}. Changes for endpoints not saved.", 'danger')
+                parsed_model_endpoints = settings.get('model_endpoints', [])
+
+            existing_multi_endpoints_enabled = settings.get('enable_multi_model_endpoints', False)
+            should_migrate_endpoints = enable_multi_model_endpoints and not existing_multi_endpoints_enabled
+            migration_notice = settings.get('multi_endpoint_migration_notice', {
+                'enabled': False,
+                'message': (
+                    'Multi-endpoint has been enabled and your existing AI endpoint was migrated. '
+                    'Agents using the default connection may need to be updated to select a new model endpoint.'
+                ),
+                'created_at': None
+            })
+            migrated_at = settings.get('multi_endpoint_migrated_at')
+
+            if should_migrate_endpoints and not parsed_model_endpoints:
+                default_endpoint_id = str(uuid.uuid4())
+                migrated_models = []
+                for model in gpt_model_obj.get('selected', []):
+                    deployment_name = model.get('deploymentName') or model.get('deployment') or ''
+                    model_name = model.get('modelName') or model.get('name') or ''
+                    if not deployment_name:
+                        continue
+                    migrated_models.append({
+                        'id': str(uuid.uuid4()),
+                        'deploymentName': deployment_name,
+                        'modelName': model_name,
+                        'displayName': deployment_name,
+                        'description': '',
+                        'enabled': True
+                    })
+
+                legacy_auth_type = settings.get('azure_openai_gpt_authentication_type', 'key')
+                migrated_auth_type = 'api_key' if legacy_auth_type == 'key' else legacy_auth_type
+
+                parsed_model_endpoints = [{
+                    'id': default_endpoint_id,
+                    'name': 'Migrated Azure OpenAI Endpoint',
+                    'provider': 'aoai',
+                    'enabled': True,
+                    'auth': {
+                        'type': migrated_auth_type,
+                        'managed_identity_type': 'system_assigned',
+                        'managed_identity_client_id': '',
+                        'tenant_id': '',
+                        'client_id': '',
+                        'client_secret': '',
+                        'api_key': settings.get('azure_openai_gpt_key', '')
+                    },
+                    'connection': {
+                        'endpoint': settings.get('azure_openai_gpt_endpoint', ''),
+                        'api_version': settings.get('azure_openai_gpt_api_version', '')
+                    },
+                    'management': {
+                        'subscription_id': settings.get('azure_openai_gpt_subscription_id', ''),
+                        'resource_group': settings.get('azure_openai_gpt_resource_group', ''),
+                        'location': ''
+                    },
+                    'models': migrated_models
+                }]
+                debug_print(f"Migrated {len(migrated_models)} models to new multi-endpoint configuration.")
+                debug_print(
+                    f"Migrated Model Endpoints: {json.dumps([redact_model_endpoint_secret_values(endpoint) for endpoint in parsed_model_endpoints], indent=2)}"
+                )
+                log_event(f"Migrated {len(migrated_models)} models to new multi-endpoint configuration.", level=logging.INFO)
+                log_event(
+                    f"Migrated Model Endpoints: {json.dumps([redact_model_endpoint_secret_values(endpoint) for endpoint in parsed_model_endpoints], indent=2)}",
+                    level=logging.INFO,
+                )
+                log_general_admin_action(
+                    admin_user_id=admin_user,
+                    admin_email=admin_email,
+                    action='Enabled and migrated multi-model endpoints',
+                    description=f'Migrated {len(migrated_models)} models to multi-endpoint configuration.'
+                )
+
+
+                migrated_at = datetime.now(timezone.utc).isoformat()
+                migration_notice['enabled'] = True
+                migration_notice['created_at'] = migrated_at
+
+            parsed_model_endpoints = merge_model_endpoints_with_existing(parsed_model_endpoints, existing_model_endpoints)
+            parsed_model_endpoints, _ = normalize_model_endpoints(parsed_model_endpoints)
+
+            existing_endpoints_by_id = {
+                endpoint.get('id'): endpoint
+                for endpoint in existing_model_endpoints
+                if isinstance(endpoint, dict) and endpoint.get('id')
+            }
+            parsed_model_endpoints = [
+                keyvault_model_endpoint_save_helper(
+                    endpoint,
+                    endpoint.get('id'),
+                    scope='global',
+                    existing_endpoint=existing_endpoints_by_id.get(endpoint.get('id')),
+                )
+                for endpoint in parsed_model_endpoints
+            ]
+
+            for endpoint in parsed_model_endpoints:
+                if not isinstance(endpoint, dict):
+                    continue
+                endpoint_id = endpoint.get('id')
+                if not endpoint_id:
+                    continue
+                keyvault_model_endpoint_cleanup_helper(
+                    existing_endpoints_by_id.get(endpoint_id),
+                    endpoint,
+                    endpoint_id,
+                    scope='global',
+                )
+
+            saved_endpoint_ids = {
+                endpoint.get('id')
+                for endpoint in parsed_model_endpoints
+                if isinstance(endpoint, dict) and endpoint.get('id')
+            }
+            for endpoint in existing_model_endpoints:
+                if not isinstance(endpoint, dict):
+                    continue
+                endpoint_id = endpoint.get('id')
+                if endpoint_id and endpoint_id not in saved_endpoint_ids:
+                    keyvault_model_endpoint_delete_helper(endpoint, endpoint_id, scope='global')
+
+            default_model_selection_json = form_data.get('default_model_selection_json', '{}')
+            parsed_default_model_selection = {}
+            try:
+                parsed_default_model_selection_raw = (
+                    json.loads(default_model_selection_json) if default_model_selection_json else {}
+                )
+                if isinstance(parsed_default_model_selection_raw, dict):
+                    parsed_default_model_selection = parsed_default_model_selection_raw
+                else:
+                    raise ValueError("Invalid format: default_model_selection must be an object.")
+            except (json.JSONDecodeError, ValueError) as e:
+                print(f"Error processing default_model_selection_json: {e}")
+                flash(f"Error processing default model selection: {e}. Changes not saved.", 'danger')
+                parsed_default_model_selection = settings.get('default_model_selection', {})
+
+            normalized_default_model_selection = {
+                'endpoint_id': str(parsed_default_model_selection.get('endpoint_id') or '').strip(),
+                'model_id': str(parsed_default_model_selection.get('model_id') or '').strip(),
+                'provider': str(parsed_default_model_selection.get('provider') or '').strip().lower()
+            }
+
+            if not enable_multi_model_endpoints:
+                normalized_default_model_selection = {
+                    'endpoint_id': '',
+                    'model_id': '',
+                    'provider': ''
+                }
+            elif normalized_default_model_selection['endpoint_id'] and normalized_default_model_selection['model_id']:
+                endpoint_cfg = next(
+                    (e for e in parsed_model_endpoints if e.get('id') == normalized_default_model_selection['endpoint_id']),
+                    None
+                )
+                if not endpoint_cfg or not endpoint_cfg.get('enabled', True):
+                    flash('Default model endpoint is not available. Please select a valid endpoint.', 'warning')
+                    normalized_default_model_selection = {
+                        'endpoint_id': '',
+                        'model_id': '',
+                        'provider': ''
+                    }
+                else:
+                    models = endpoint_cfg.get('models', []) or []
+                    model_cfg = next(
+                        (m for m in models if m.get('id') == normalized_default_model_selection['model_id']),
+                        None
+                    )
+                    if not model_cfg or not model_cfg.get('enabled', True):
+                        flash('Default model is not available. Please select a valid model.', 'warning')
+                        normalized_default_model_selection = {
+                            'endpoint_id': '',
+                            'model_id': '',
+                            'provider': ''
+                        }
+                    else:
+                        endpoint_provider = (endpoint_cfg.get('provider') or '').strip().lower()
+                        if endpoint_provider:
+                            normalized_default_model_selection['provider'] = endpoint_provider
+            else:
+                normalized_default_model_selection = {
+                    'endpoint_id': '',
+                    'model_id': '',
+                    'provider': ''
+                }
+
             # --- Extract banner fields from form_data ---
             classification_banner_enabled = form_data.get('classification_banner_enabled') == 'on'
             classification_banner_text = form_data.get('classification_banner_text', '').strip()
@@ -665,6 +898,45 @@ def is_valid_url(url):
                 flash('Invalid Front Door URL format. Please provide a valid HTTP/HTTPS URL.', 'danger')
                 front_door_url = ''
 
+            # --- Chunk Size Overrides ---
+            chunk_size_defaults = get_chunk_size_defaults()
+            existing_chunk_sizes = settings.get('chunk_size', {}) if isinstance(settings, dict) else {}
+            chunk_size_cap = get_chunk_size_cap(settings)
+            enable_chunk_size_override = form_data.get('enable_chunk_size_override') == 'on'
+            normalized_chunk_sizes = {}
+            chunk_size_warning_keys = []
+
+            for key, meta in chunk_size_defaults.items():
+                field_name = f"chunk_size_{key}"
+                incoming_raw = form_data.get(field_name, '')
+                stored_meta = existing_chunk_sizes.get(key, {}) if isinstance(existing_chunk_sizes, dict) else {}
+
+                try:
+                    parsed_value = int(incoming_raw) if incoming_raw not in [None, ''] else int(stored_meta.get('value', meta.get('value', 1)))
+                except Exception:
+                    parsed_value = meta.get('value', 1)
+
+                sanitized_value = max(1, parsed_value)
+                if sanitized_value > chunk_size_cap:
+                    chunk_size_warning_keys.append(key.upper())
+                sanitized_value = min(sanitized_value, chunk_size_cap)
+
+                normalized_chunk_sizes[key] = {
+                    'value': sanitized_value,
+                    'unit': stored_meta.get('unit', meta.get('unit', 'words'))
+                }
+
+            chunk_size_changed = (
+                enable_chunk_size_override != settings.get('enable_chunk_size_override', False)
+                or normalized_chunk_sizes != existing_chunk_sizes
+            )
+
+            if chunk_size_warning_keys:
+                flash(
+                    f"Chunk sizes capped at {chunk_size_cap} for: {', '.join(chunk_size_warning_keys)}.",
+                    'warning'
+                )
+
             # --- Construct new_settings Dictionary ---
             new_settings = {
                 # Logging
@@ -705,6 +977,11 @@ def is_valid_url(url):
                 'azure_openai_gpt_resource_group': form_data.get('azure_openai_gpt_resource_group', '').strip(),
                 'azure_openai_gpt_key': form_data.get('azure_openai_gpt_key', '').strip(), # Consider encryption/decryption here if needed
                 'gpt_model': gpt_model_obj,
+                'enable_multi_model_endpoints': enable_multi_model_endpoints,
+                'model_endpoints': parsed_model_endpoints,
+                'default_model_selection': normalized_default_model_selection,
+                'multi_endpoint_migrated_at': migrated_at,
+                'multi_endpoint_migration_notice': migration_notice,
                 'azure_apim_gpt_endpoint': form_data.get('azure_apim_gpt_endpoint', '').strip(),
                 'azure_apim_gpt_subscription_key': form_data.get('azure_apim_gpt_subscription_key', '').strip(),
                 'azure_apim_gpt_deployment': form_data.get('azure_apim_gpt_deployment', '').strip(),
@@ -866,6 +1143,8 @@ def is_valid_url(url):
                 'enable_ai_search_apim': form_data.get('enable_ai_search_apim') == 'on',
                 'azure_apim_ai_search_endpoint': form_data.get('azure_apim_ai_search_endpoint', '').strip(),
                 'azure_apim_ai_search_subscription_key': form_data.get('azure_apim_ai_search_subscription_key', '').strip(),
+                'enable_chunk_size_override': enable_chunk_size_override,
+                'chunk_size': normalized_chunk_sizes,
 
                 # Extract (Doc Intelligence Direct & APIM)
                 'azure_document_intelligence_endpoint': form_data.get('azure_document_intelligence_endpoint', '').strip(),
@@ -1197,6 +1476,34 @@ def is_valid_url(url):
                 else:
                     print("ERROR: Could not fetch settings after update to ensure logo/favicon files.")
 
+                if chunk_size_changed:
+                    try:
+                        log_general_admin_action(
+                            admin_user_id=user_id,
+                            admin_email=admin_email,
+                            action='chunk_size_settings_updated',
+                            description='Updated chunk size overrides for document processing.',
+                            additional_context={
+                                'override_enabled': enable_chunk_size_override,
+                                'chunk_size_cap': chunk_size_cap,
+                                'chunk_sizes': normalized_chunk_sizes
+                            }
+                        )
+                    except Exception as e:
+                        print(f"Warning logging chunk size admin action: {e}")
+
+                    try:
+                        broadcast_system_notification(
+                            title="Document chunk sizes updated",
+                            message="Admins updated chunk size defaults. New uploads will use the latest limits.",
+                            metadata={
+                                'override_enabled': enable_chunk_size_override,
+                                'chunk_size_cap': chunk_size_cap
+                            }
+                        )
+                    except Exception as e:
+                        print(f"Warning sending chunk size notification: {e}")
+
             else:
                 flash("Failed to update admin settings.", "danger")
 
diff --git a/application/single_app/route_frontend_authentication.py b/application/single_app/route_frontend_authentication.py
index 022ecf84..20fea742 100644
--- a/application/single_app/route_frontend_authentication.py
+++ b/application/single_app/route_frontend_authentication.py
@@ -2,7 +2,7 @@
 
 from unittest import result
 from config import *
-from functions_authentication import _build_msal_app, _load_cache, _save_cache
+from functions_authentication import _build_msal_app, _load_cache, _save_cache, clear_requested_oauth_scopes, get_requested_oauth_scopes
 from functions_debug import debug_print
 from swagger_wrapper import swagger_route, get_auth_security
 
@@ -35,6 +35,7 @@ def login():
         # Clear potentially stale cache/user info before starting new login
         session.pop("user", None)
         session.pop("token_cache", None)
+        clear_requested_oauth_scopes()
 
         # Use helper to build app (cache not strictly needed here, but consistent)
         msal_app = _build_msal_app()
@@ -104,9 +105,10 @@ def authorized():
         
         print(f"Token exchange using redirect_uri: {redirect_uri}")
 
+        requested_scopes = get_requested_oauth_scopes(clear_after_read=True)
         result = msal_app.acquire_token_by_authorization_code(
             code=code,
-            scopes=SCOPE, # Request the same scopes again
+            scopes=requested_scopes,
             redirect_uri=redirect_uri
         )
 
@@ -194,9 +196,10 @@ def authorized_api():
         else:
             redirect_uri = url_for('authorized', _external=True, _scheme='https')
 
+        requested_scopes = get_requested_oauth_scopes(clear_after_read=True)
         result = msal_app.acquire_token_by_authorization_code(
             code=code,
-            scopes=SCOPE, # Request the same scopes again
+            scopes=requested_scopes,
             redirect_uri=redirect_uri
         )
 
diff --git a/application/single_app/route_frontend_chats.py b/application/single_app/route_frontend_chats.py
index 67a41879..3e83ab78 100644
--- a/application/single_app/route_frontend_chats.py
+++ b/application/single_app/route_frontend_chats.py
@@ -32,6 +32,8 @@ def chats():
         enable_enhanced_citations = public_settings.get("enable_enhanced_citations", False)
         enable_document_classification = public_settings.get("enable_document_classification", False)
         enable_extract_meta_data = public_settings.get("enable_extract_meta_data", False)
+        enable_multi_model_endpoints = public_settings.get("enable_multi_model_endpoints", False)
+        multi_endpoint_notice = public_settings.get("multi_endpoint_migration_notice", {})
         active_group_id = user_settings_dict.get("activeGroupOid", "")
         active_group_name = ""
         if active_group_id:
@@ -44,6 +46,26 @@ def chats():
         
         categories_list = public_settings.get("document_classification_categories","")
 
+        multi_endpoint_models = []
+        if enable_multi_model_endpoints:
+            endpoints = public_settings.get("model_endpoints", []) or []
+            for endpoint in endpoints:
+                if not endpoint.get("enabled", True):
+                    continue
+                for model in endpoint.get("models", []) or []:
+                    if not model.get("enabled", True):
+                        continue
+                    multi_endpoint_models.append({
+                        "id": model.get("id"),
+                        "display_name": model.get("displayName") or model.get("deploymentName") or model.get("modelName") or "",
+                        "deployment_name": model.get("deploymentName") or "",
+                        "endpoint_id": endpoint.get("id"),
+                        "provider": endpoint.get("provider")
+                    })
+
+        if not user_id:
+            return redirect(url_for('login'))
+        
         # Get user display name from user settings
         user_display_name = user_settings.get('display_name', '')
 
@@ -77,6 +99,9 @@ def chats():
             enable_document_classification=enable_document_classification,
             document_classification_categories=categories_list,
             enable_extract_meta_data=enable_extract_meta_data,
+            enable_multi_model_endpoints=enable_multi_model_endpoints,
+            multi_endpoint_notice=multi_endpoint_notice,
+            multi_endpoint_models=multi_endpoint_models,
             user_id=user_id,
             user_display_name=user_display_name,
             user_groups=user_groups_simple,
@@ -302,7 +327,7 @@ def upload_file():
                         last_msgs = list(cosmos_messages_container.query_items(query=last_msg_query, partition_key=conversation_id))
                         if last_msgs:
                             previous_thread_id = last_msgs[0].get('thread_id')
-                    except:
+                    except Exception as ex:
                         pass
 
                     current_thread_id = str(uuid.uuid4())
@@ -370,7 +395,7 @@ def upload_file():
                         last_msgs = list(cosmos_messages_container.query_items(query=last_msg_query, partition_key=conversation_id))
                         if last_msgs:
                             previous_thread_id = last_msgs[0].get('thread_id')
-                    except:
+                    except Exception as ex:
                         pass
 
                     current_thread_id = str(uuid.uuid4())
@@ -415,7 +440,7 @@ def upload_file():
                     last_msgs = list(cosmos_messages_container.query_items(query=last_msg_query, partition_key=conversation_id))
                     if last_msgs:
                         previous_thread_id = last_msgs[0].get('thread_id')
-                except:
+                except Exception as ex:
                     pass
 
                 current_thread_id = str(uuid.uuid4())
diff --git a/application/single_app/route_frontend_control_center.py b/application/single_app/route_frontend_control_center.py
index c5f3f44b..23c5ab1f 100644
--- a/application/single_app/route_frontend_control_center.py
+++ b/application/single_app/route_frontend_control_center.py
@@ -58,6 +58,7 @@ def control_center():
             return redirect(url_for('admin_settings'))
     
     @app.route('/approvals', methods=['GET'])
+    @swagger_route(security=get_auth_security())
     @login_required
     @user_required
     def approvals():
@@ -73,11 +74,13 @@ def approvals():
             # Get user settings for profile and navigation
             user_id = get_current_user_id()
             user_settings = get_user_settings(user_id)
+            user_roles = (session.get('user', {}) or {}).get('roles', [])
             
             return render_template('approvals.html', 
                                  app_settings=public_settings, 
                                  settings=public_settings,
-                                 user_settings=user_settings)
+                                 user_settings=user_settings,
+                                 has_agent_template_admin_access='Admin' in user_roles)
         except Exception as e:
             import traceback
             error_trace = traceback.format_exc()
diff --git a/application/single_app/route_frontend_group_workspaces.py b/application/single_app/route_frontend_group_workspaces.py
index 850cc8d0..e92d5a98 100644
--- a/application/single_app/route_frontend_group_workspaces.py
+++ b/application/single_app/route_frontend_group_workspaces.py
@@ -2,6 +2,7 @@
 
 from config import *
 from functions_authentication import *
+from functions_group import get_group_model_endpoints
 from functions_settings import *
 from swagger_wrapper import swagger_route, get_auth_security
 
@@ -15,8 +16,9 @@ def group_workspaces():
         """Render the Group workspaces page for the current active group."""
         user_id = get_current_user_id()
         settings = get_settings()
+        user_settings = get_user_settings(user_id)
         public_settings = sanitize_settings_for_user(settings)
-        active_group_id = settings.get("activeGroupOid")
+        active_group_id = user_settings.get("settings", {}).get("activeGroupOid")
         enable_document_classification = settings.get('enable_document_classification', False)
         enable_file_sharing = settings.get('enable_file_sharing', False)
         enable_extract_meta_data = settings.get('enable_extract_meta_data', False)
@@ -51,7 +53,26 @@ def group_workspaces():
             enable_audio=enable_audio_file_support in [True, 'True', 'true']
         ))
         allowed_extensions_str = "Allowed: " + ", ".join(allowed_extensions)
-        
+
+        group_model_endpoints = sanitize_model_endpoints_for_frontend(
+            get_group_model_endpoints(active_group_id) if active_group_id else []
+        )
+        global_model_endpoints = sanitize_model_endpoints_for_frontend(
+            settings.get("model_endpoints", [])
+        )
+
+        # Build allowed extensions string
+        allowed_extensions = [
+            "txt", "pdf", "doc", "docm", "docx", "xlsx", "xls", "xlsm","csv", "pptx", "html",
+            "jpg", "jpeg", "png", "bmp", "tiff", "tif", "heif", "md", "json",
+            "xml", "yaml", "yml", "log"
+        ]
+        if enable_video_file_support in [True, 'True', 'true']:
+            allowed_extensions += ["mp4", "mov", "avi", "wmv", "mkv", "webm"]
+        if enable_audio_file_support in [True, 'True', 'true']:
+            allowed_extensions += ["mp3", "wav", "ogg", "aac", "flac", "m4a"]
+        allowed_extensions_str = "Allowed: " + ", ".join(allowed_extensions)
+
         return render_template(
             'group_workspaces.html', 
             settings=public_settings, 
@@ -61,7 +82,9 @@ def group_workspaces():
             enable_audio_file_support=enable_audio_file_support,
             enable_file_sharing=enable_file_sharing,
             legacy_docs_count=legacy_count,
-            allowed_extensions=allowed_extensions_str
+            allowed_extensions=allowed_extensions_str,
+            group_model_endpoints=group_model_endpoints,
+            global_model_endpoints=global_model_endpoints
         )
 
     @app.route('/set_active_group', methods=['POST'])
diff --git a/application/single_app/route_frontend_profile.py b/application/single_app/route_frontend_profile.py
index f03c92bb..96dd996f 100644
--- a/application/single_app/route_frontend_profile.py
+++ b/application/single_app/route_frontend_profile.py
@@ -115,7 +115,7 @@ def get_user_activity_trends():
                             dt = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
                             date_key = dt.strftime('%Y-%m-%d')
                             logins_by_date[date_key] += 1
-                        except:
+                        except Exception as ex:
                             pass
             except Exception as e:
                 debug_print(f"Error fetching login trends: {e}")
@@ -146,7 +146,7 @@ def get_user_activity_trends():
                             dt = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
                             date_key = dt.strftime('%Y-%m-%d')
                             conversations_by_date[date_key] += 1
-                        except:
+                        except Exception as ex:
                             pass
             except Exception as e:
                 debug_print(f"Error fetching conversation trends: {e}")
@@ -173,7 +173,7 @@ def get_user_activity_trends():
                             dt = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
                             date_key = dt.strftime('%Y-%m-%d')
                             conversations_delete_by_date[date_key] += 1
-                        except:
+                        except Exception as ex:
                             pass
             except Exception as e:
                 debug_print(f"Error fetching conversation deletion trends: {e}")
@@ -204,7 +204,7 @@ def get_user_activity_trends():
                             dt = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
                             date_key = dt.strftime('%Y-%m-%d')
                             documents_upload_by_date[date_key] += 1
-                        except:
+                        except Exception as ex:
                             pass
             except Exception as e:
                 debug_print(f"Error fetching document upload trends: {e}")
@@ -231,7 +231,7 @@ def get_user_activity_trends():
                             dt = datetime.fromisoformat(timestamp.replace('Z', '+00:00'))
                             date_key = dt.strftime('%Y-%m-%d')
                             documents_delete_by_date[date_key] += 1
-                        except:
+                        except Exception as ex:
                             pass
             except Exception as e:
                 debug_print(f"Error fetching document delete trends: {e}")
@@ -265,7 +265,7 @@ def get_user_activity_trends():
                             usage = record.get('usage', {})
                             total_tokens = usage.get('total_tokens', 0)
                             tokens_by_date[date_key] += total_tokens
-                        except:
+                        except Exception as ex:
                             pass
             except Exception as e:
                 debug_print(f"Error fetching token usage trends: {e}")
diff --git a/application/single_app/route_frontend_workspace.py b/application/single_app/route_frontend_workspace.py
index 2ca1aad9..98ccb65a 100644
--- a/application/single_app/route_frontend_workspace.py
+++ b/application/single_app/route_frontend_workspace.py
@@ -14,6 +14,7 @@ def register_route_frontend_workspace(app):
     def workspace():
         user_id = get_current_user_id()
         settings = get_settings()
+        user_settings = get_user_settings(user_id)
         public_settings = sanitize_settings_for_user(settings)
         enable_document_classification = settings.get('enable_document_classification', False)
         enable_file_sharing = settings.get('enable_file_sharing', False)
@@ -50,6 +51,12 @@ def workspace():
         ))
         allowed_extensions_str = "Allowed: " + ", ".join(allowed_extensions)
         
+        personal_endpoints = user_settings.get("settings", {}).get("personal_model_endpoints", [])
+        personal_model_endpoints = sanitize_model_endpoints_for_frontend(personal_endpoints)
+        global_model_endpoints = sanitize_model_endpoints_for_frontend(
+            settings.get("model_endpoints", [])
+        )
+
         return render_template(
             'workspace.html', 
             settings=public_settings, 
@@ -59,7 +66,9 @@ def workspace():
             enable_audio_file_support=enable_audio_file_support,
             enable_file_sharing=enable_file_sharing,
             legacy_docs_count=legacy_count,
-            allowed_extensions=allowed_extensions_str
+            allowed_extensions=allowed_extensions_str,
+            personal_model_endpoints=personal_model_endpoints,
+            global_model_endpoints=global_model_endpoints
         )
 
     
\ No newline at end of file
diff --git a/application/single_app/semantic_kernel_loader.py b/application/single_app/semantic_kernel_loader.py
index c2a7cc1e..1b5b4504 100644
--- a/application/single_app/semantic_kernel_loader.py
+++ b/application/single_app/semantic_kernel_loader.py
@@ -7,13 +7,16 @@
 
 import logging
 import builtins
+import os
+from azure.identity import AzureAuthorityHosts, ClientSecretCredential, DefaultAzureCredential, get_bearer_token_provider
 from agent_orchestrator_groupchat import OrchestratorAgent, SCGroupChatManager
 from semantic_kernel import Kernel
 from semantic_kernel.agents import Agent
 from semantic_kernel.connectors.ai.prompt_execution_settings import PromptExecutionSettings
 from semantic_kernel.connectors.ai.function_choice_behavior import FunctionChoiceBehavior
-from semantic_kernel.core_plugins import TimePlugin, HttpPlugin
-from semantic_kernel.core_plugins.wait_plugin import WaitPlugin
+from semantic_kernel.core_plugins import HttpPlugin
+from semantic_kernel_plugins.time_plugin import TimePlugin
+from semantic_kernel_plugins.wait_plugin import WaitPlugin
 from semantic_kernel_plugins.math_plugin import MathPlugin
 from semantic_kernel_plugins.text_plugin import TextPlugin
 from semantic_kernel.functions.kernel_plugin import KernelPlugin
@@ -21,7 +24,10 @@
 from semantic_kernel_plugins.fact_memory_plugin import FactMemoryPlugin
 from semantic_kernel_plugins.tabular_processing_plugin import TabularProcessingPlugin
 from functions_settings import get_settings, get_user_settings
-from foundry_agent_runtime import AzureAIFoundryChatCompletionAgent
+from foundry_agent_runtime import (
+    AzureAIFoundryChatCompletionAgent,
+    AzureAIFoundryNewChatCompletionAgent,
+)
 from functions_appinsights import log_event, get_appinsights_logger
 from functions_authentication import get_current_user_id
 from semantic_kernel_plugins.plugin_health_checker import PluginHealthChecker, PluginErrorRecovery
@@ -30,12 +36,12 @@
 from semantic_kernel_plugins.smart_http_plugin import SmartHttpPlugin
 from functions_debug import debug_print
 from flask import g
-from functions_keyvault import validate_secret_name_dynamic, retrieve_secret_from_key_vault, retrieve_secret_from_key_vault_by_full_name, SecretReturnType
+from functions_keyvault import SecretReturnType, keyvault_model_endpoint_get_helper, retrieve_secret_from_key_vault, retrieve_secret_from_key_vault_by_full_name, validate_secret_name_dynamic
 from functions_global_actions import get_global_actions
 from functions_global_agents import get_global_agents
 from functions_group_agents import get_group_agent, get_group_agents
 from functions_group_actions import get_group_actions
-from functions_group import require_active_group
+from functions_group import get_group_model_endpoints, require_active_group
 from functions_personal_actions import get_personal_actions, ensure_migration_complete as ensure_actions_migration_complete
 from functions_personal_agents import get_personal_agents, ensure_migration_complete as ensure_agents_migration_complete
 from semantic_kernel_plugins.plugin_loader import discover_plugins
@@ -101,6 +107,42 @@ def first_if_comma(val):
             return val.split(",")[0].strip()
         return val
 
+def find_agent_by_scope(agents_cfg, selected_agent_data):
+    if not isinstance(selected_agent_data, dict) or not agents_cfg:
+        return None
+
+    selected_agent_name = selected_agent_data.get("name")
+    selected_agent_id = selected_agent_data.get("id")
+    is_global_flag = selected_agent_data.get("is_global", False)
+    is_group_flag = selected_agent_data.get("is_group", False)
+    selected_agent_group_id = selected_agent_data.get("group_id")
+
+    def scope_matches(candidate):
+        if is_group_flag:
+            if not candidate.get("is_group", False):
+                return False
+            return selected_agent_group_id is None or candidate.get("group_id") == selected_agent_group_id
+        if is_global_flag:
+            return candidate.get("is_global", False) and not candidate.get("is_group", False)
+        return not candidate.get("is_global", False) and not candidate.get("is_group", False)
+
+    if selected_agent_id:
+        found = next((a for a in agents_cfg if a.get("id") == selected_agent_id and scope_matches(a)), None)
+        if found:
+            return found
+
+    if selected_agent_name:
+        return next((a for a in agents_cfg if a.get("name") == selected_agent_name and scope_matches(a)), None)
+
+    return None
+
+
+def resolve_foundry_endpoint_from_settings(foundry_settings, settings):
+    endpoint = (foundry_settings or {}).get("endpoint")
+    if endpoint:
+        return endpoint
+    return settings.get("azure_ai_foundry_endpoint") or os.getenv("AZURE_AI_AGENT_ENDPOINT")
+
 def resolve_agent_config(agent, settings):
     debug_print(f"[SK Loader] resolve_agent_config called for agent: {agent.get('name')}")
     debug_print(f"[SK Loader] Agent config: {agent}")
@@ -119,20 +161,20 @@ def resolve_agent_config(agent, settings):
     user_apim_enabled = agent.get("enable_agent_gpt_apim") in [True, 1, "true", "True"]
     global_apim_enabled = settings.get("enable_gpt_apim", False)
     per_user_enabled = settings.get('per_user_semantic_kernel', False)
-    allow_user_custom_agent_endpoints = settings.get('allow_user_custom_agent_endpoints', False)
-    allow_group_custom_agent_endpoints = settings.get('allow_group_custom_agent_endpoints', False)
+    allow_user_custom_endpoints = settings.get('allow_user_custom_endpoints', False) or settings.get('allow_user_custom_agent_endpoints', False)
+    allow_group_custom_endpoints = settings.get('allow_group_custom_endpoints', False) or settings.get('allow_user_custom_agent_endpoints', False)
     is_group_agent = agent.get("is_group", False)
     is_global_agent = agent.get("is_global", False)
 
     if is_group_agent:
-        allow_custom_agent_endpoints = allow_group_custom_agent_endpoints
+        allow_custom_agent_endpoints = allow_group_custom_endpoints
     elif is_global_agent:
         allow_custom_agent_endpoints = False
     else:
-        allow_custom_agent_endpoints = allow_user_custom_agent_endpoints
+        allow_custom_agent_endpoints = allow_user_custom_endpoints
 
     debug_print(f"[SK Loader] user_apim_enabled: {user_apim_enabled}, global_apim_enabled: {global_apim_enabled}, per_user_enabled: {per_user_enabled}")
-    debug_print(f"[SK Loader] allow_user_custom_agent_endpoints: {allow_user_custom_agent_endpoints}, allow_group_custom_agent_endpoints: {allow_group_custom_agent_endpoints}, allow_custom_agent_endpoints_resolved: {allow_custom_agent_endpoints}")
+    debug_print(f"[SK Loader] allow_user_custom_endpoints: {allow_user_custom_endpoints}, allow_group_custom_endpoints: {allow_group_custom_endpoints}, allow_custom_agent_endpoints_resolved: {allow_custom_agent_endpoints}")
     debug_print(f"[SK Loader] Max completion tokens from agent: {agent.get('max_completion_tokens')}")
 
     def resolve_secret_value_if_needed(value, scope_value, source, scope):
@@ -233,8 +275,232 @@ def get_global_gpt():
     def merge_fields(primary, fallback):
         return tuple(p if p not in [None, ""] else f for p, f in zip(primary, fallback))
 
+    def resolve_authority(auth_settings):
+        management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+        if management_cloud in ("government", "usgovernment", "usgov"):
+            return AzureAuthorityHosts.AZURE_GOVERNMENT
+        custom_authority = auth_settings.get("custom_authority") or ""
+        if custom_authority:
+            return custom_authority
+        return AzureAuthorityHosts.AZURE_PUBLIC_CLOUD
+
+    def resolve_foundry_scope(auth_settings, endpoint=None):
+        custom_scope = (auth_settings.get("foundry_scope") or "").strip()
+        if custom_scope:
+            return custom_scope
+
+        management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+        if management_cloud in ("government", "usgovernment", "usgov"):
+            return "https://ai.azure.us/.default"
+        if management_cloud == "china":
+            return "https://ai.azure.cn/.default"
+        if management_cloud == "germany":
+            return "https://ai.azure.de/.default"
+
+        endpoint_value = (endpoint or "").lower()
+        if "azure.us" in endpoint_value:
+            return "https://ai.azure.us/.default"
+        if "azure.cn" in endpoint_value:
+            return "https://ai.azure.cn/.default"
+        if "azure.de" in endpoint_value:
+            return "https://ai.azure.de/.default"
+        return "https://ai.azure.com/.default"
+
+    def build_token_provider(auth_settings, provider="aoai", endpoint=None):
+        auth_type = (auth_settings.get("type") or "managed_identity").lower()
+        authority = resolve_authority(auth_settings)
+        if auth_type == "service_principal":
+            credential = ClientSecretCredential(
+                tenant_id=auth_settings.get("tenant_id"),
+                client_id=auth_settings.get("client_id"),
+                client_secret=auth_settings.get("client_secret"),
+                authority=authority,
+            )
+        else:
+            managed_identity_client_id = auth_settings.get("managed_identity_client_id") or None
+            credential = DefaultAzureCredential(
+                managed_identity_client_id=managed_identity_client_id,
+                authority=authority,
+            )
+
+        scope = "https://cognitiveservices.azure.com/.default"
+        if provider in ("aifoundry", "new_foundry"):
+            scope = resolve_foundry_scope(auth_settings, endpoint=endpoint)
+
+        return get_bearer_token_provider(credential, scope)
+
+    def resolve_global_gpt_token_provider(global_key):
+        auth_type = (settings.get("azure_openai_gpt_authentication_type") or "key").lower()
+        if auth_type in ("key", "api_key"):
+            return None
+        if global_key:
+            return None
+        if auth_type in ("managed_identity", "service_principal"):
+            auth_settings = {
+                "type": auth_type,
+                "tenant_id": settings.get("azure_openai_gpt_tenant_id") or settings.get("azure_openai_tenant_id"),
+                "client_id": settings.get("azure_openai_gpt_client_id") or settings.get("azure_openai_client_id"),
+                "client_secret": settings.get("azure_openai_gpt_client_secret") or settings.get("azure_openai_client_secret"),
+                "managed_identity_client_id": settings.get("azure_openai_gpt_managed_identity_client_id") or settings.get("azure_openai_managed_identity_client_id"),
+                "management_cloud": settings.get("management_cloud") or settings.get("azure_management_cloud") or "public",
+                "custom_authority": settings.get("custom_authority") or settings.get("azure_custom_authority") or "",
+            }
+            try:
+                return build_token_provider(auth_settings, provider="aoai")
+            except Exception as e:
+                log_event(
+                    f"[SK Loader] Failed to build global GPT token provider: {e}",
+                    level=logging.ERROR,
+                    exceptionTraceback=True,
+                )
+        return None
+
+    def resolve_multi_endpoint_agent_config():
+        endpoint_id = (agent.get("model_endpoint_id") or "").strip()
+        model_id = (agent.get("model_id") or "").strip()
+        if not endpoint_id or not model_id:
+            return None
+
+        endpoints = []
+        if is_group_agent:
+            if allow_custom_agent_endpoints:
+                group_id = require_active_group(get_current_user_id())
+                endpoints.extend([{**endpoint, "_endpoint_scope": "group"} for endpoint in get_group_model_endpoints(group_id)])
+        elif not is_global_agent:
+            if allow_custom_agent_endpoints:
+                user_settings = get_user_settings(get_current_user_id())
+                endpoints.extend([
+                    {**endpoint, "_endpoint_scope": "user"}
+                    for endpoint in user_settings.get("settings", {}).get("personal_model_endpoints", [])
+                ])
+        endpoints.extend([{**endpoint, "_endpoint_scope": "global"} for endpoint in (settings.get("model_endpoints", []) or [])])
+
+        endpoint_cfg = next((e for e in endpoints if e.get("id") == endpoint_id), None)
+        if not endpoint_cfg or not endpoint_cfg.get("enabled", True):
+            return None
+
+        endpoint_scope = endpoint_cfg.get("_endpoint_scope", "global")
+        endpoint_cfg = dict(endpoint_cfg)
+        endpoint_cfg.pop("_endpoint_scope", None)
+        endpoint_cfg = keyvault_model_endpoint_get_helper(
+            endpoint_cfg,
+            endpoint_cfg.get("id") or endpoint_id,
+            scope=endpoint_scope,
+            return_type=SecretReturnType.VALUE,
+        )
+
+        models = endpoint_cfg.get("models", []) or []
+        model_cfg = next((m for m in models if m.get("id") == model_id), None)
+        if not model_cfg or not model_cfg.get("enabled", True):
+            return None
+
+        provider = (endpoint_cfg.get("provider") or "aoai").lower()
+        connection = endpoint_cfg.get("connection", {}) or {}
+        auth = endpoint_cfg.get("auth", {}) or {}
+        deployment = model_cfg.get("deploymentName") or model_cfg.get("deployment") or ""
+        api_version = connection.get("openai_api_version") or connection.get("api_version")
+        endpoint = connection.get("endpoint")
+        return {
+            "provider": provider,
+            "endpoint": endpoint,
+            "api_version": api_version,
+            "deployment": deployment,
+            "auth": auth,
+            "model": model_cfg,
+        }
+
+    def resolve_foundry_endpoint_config():
+        foundry_settings_key = "new_foundry" if agent_type == "new_foundry" else "azure_ai_foundry"
+        allowed_providers = {"aifoundry"}
+        if agent_type == "new_foundry":
+            allowed_providers.add("new_foundry")
+        endpoint_id = (agent.get("model_endpoint_id") or "").strip()
+        if not endpoint_id:
+            foundry_settings = other_settings.get(foundry_settings_key, {}) or {}
+            endpoint_id = (foundry_settings.get("endpoint_id") or "").strip()
+        if not endpoint_id:
+            return None
+
+        endpoints = []
+        if is_group_agent:
+            if allow_custom_agent_endpoints:
+                group_id = require_active_group(get_current_user_id())
+                endpoints.extend([{**endpoint, "_endpoint_scope": "group"} for endpoint in get_group_model_endpoints(group_id)])
+        elif not is_global_agent:
+            if allow_custom_agent_endpoints:
+                user_settings = get_user_settings(get_current_user_id())
+                endpoints.extend([
+                    {**endpoint, "_endpoint_scope": "user"}
+                    for endpoint in user_settings.get("settings", {}).get("personal_model_endpoints", [])
+                ])
+        endpoints.extend([{**endpoint, "_endpoint_scope": "global"} for endpoint in (settings.get("model_endpoints", []) or [])])
+
+        endpoint_cfg = next((e for e in endpoints if e.get("id") == endpoint_id), None)
+        if not endpoint_cfg or not endpoint_cfg.get("enabled", True):
+            return None
+        if (endpoint_cfg.get("provider") or "aoai").lower() not in allowed_providers:
+            return None
+        endpoint_scope = endpoint_cfg.get("_endpoint_scope", "global")
+        endpoint_cfg = dict(endpoint_cfg)
+        endpoint_cfg.pop("_endpoint_scope", None)
+        endpoint_cfg = keyvault_model_endpoint_get_helper(
+            endpoint_cfg,
+            endpoint_cfg.get("id") or endpoint_id,
+            scope=endpoint_scope,
+            return_type=SecretReturnType.VALUE,
+        )
+        return endpoint_cfg
+
+    def enrich_foundry_settings(foundry_settings, endpoint_cfg):
+        provider = (endpoint_cfg.get("provider") or "aoai").lower() if endpoint_cfg else "aoai"
+        if provider not in {"aifoundry", "new_foundry"}:
+            return foundry_settings
+        connection = endpoint_cfg.get("connection", {}) or {}
+        auth = endpoint_cfg.get("auth", {}) or {}
+        foundry_settings["endpoint_id"] = endpoint_cfg.get("id") or foundry_settings.get("endpoint_id")
+        foundry_settings["endpoint"] = connection.get("endpoint") or foundry_settings.get("endpoint")
+        foundry_settings["project_name"] = connection.get("project_name") or foundry_settings.get("project_name")
+        if agent_type == "new_foundry":
+            stored_responses_api_version = (
+                foundry_settings.get("responses_api_version")
+                or agent.get("azure_openai_gpt_api_version")
+            )
+            foundry_settings["responses_api_version"] = (
+                stored_responses_api_version
+                or connection.get("openai_api_version")
+                or connection.get("api_version")
+            )
+        else:
+            foundry_settings["api_version"] = (
+                connection.get("project_api_version")
+                or connection.get("api_version")
+                or foundry_settings.get("api_version")
+            )
+        foundry_settings["authentication_type"] = auth.get("type") or foundry_settings.get("authentication_type")
+        foundry_settings["managed_identity_type"] = auth.get("managed_identity_type") or foundry_settings.get("managed_identity_type")
+        foundry_settings["managed_identity_client_id"] = auth.get("managed_identity_client_id") or foundry_settings.get("managed_identity_client_id")
+        foundry_settings["tenant_id"] = auth.get("tenant_id") or foundry_settings.get("tenant_id")
+        foundry_settings["client_id"] = auth.get("client_id") or foundry_settings.get("client_id")
+        if auth.get("client_secret"):
+            foundry_settings["client_secret"] = auth.get("client_secret")
+        foundry_settings["cloud"] = auth.get("management_cloud") or foundry_settings.get("cloud")
+        foundry_settings["authority"] = auth.get("custom_authority") or foundry_settings.get("authority")
+        return foundry_settings
+
     # If per-user mode is not enabled, ignore all user/agent-specific config fields
-    if agent_type == "aifoundry":
+    if agent_type in {"aifoundry", "new_foundry"}:
+        foundry_settings_key = "new_foundry" if agent_type == "new_foundry" else "azure_ai_foundry"
+        foundry_settings = other_settings.get(foundry_settings_key, {}) or {}
+        endpoint_cfg = resolve_foundry_endpoint_config()
+        if endpoint_cfg:
+            foundry_settings = enrich_foundry_settings(foundry_settings, endpoint_cfg)
+            other_settings[foundry_settings_key] = foundry_settings
+            agent["azure_openai_gpt_endpoint"] = foundry_settings.get("endpoint", "")
+            agent["azure_openai_gpt_api_version"] = foundry_settings.get(
+                "responses_api_version" if agent_type == "new_foundry" else "api_version",
+                "",
+            )
+            agent["azure_openai_gpt_deployment"] = foundry_settings.get("project_name", agent.get("azure_openai_gpt_deployment", ""))
         return {
             "name": agent.get("name"),
             "display_name": agent.get("display_name", agent.get("name")),
@@ -245,19 +511,59 @@ def merge_fields(primary, fallback):
             "is_group": agent.get("is_group", False),
             "group_id": agent.get("group_id"),
             "group_name": agent.get("group_name"),
-            "agent_type": "aifoundry",
+            "agent_type": agent_type,
             "other_settings": other_settings,
             "max_completion_tokens": agent.get("max_completion_tokens", -1),
         }
 
+    multi_endpoint_config = resolve_multi_endpoint_agent_config()
+
     if not per_user_enabled:
         try:
+            token_provider = None
+            if multi_endpoint_config and multi_endpoint_config.get("provider") in ("aoai", "aifoundry", "new_foundry"):
+                auth = multi_endpoint_config.get("auth", {}) or {}
+                auth_type = (auth.get("type") or "managed_identity").lower()
+                provider = multi_endpoint_config.get("provider")
+                endpoint = multi_endpoint_config.get("endpoint")
+                deployment = multi_endpoint_config.get("deployment")
+                api_version = multi_endpoint_config.get("api_version")
+                key = auth.get("api_key") or ""
+                if auth_type != "api_key":
+                    token_provider = build_token_provider(auth, provider=provider, endpoint=endpoint)
+                return {
+                    "endpoint": endpoint,
+                    "key": key,
+                    "deployment": deployment,
+                    "api_version": api_version,
+                    "instructions": agent.get("instructions", ""),
+                    "actions_to_load": agent.get("actions_to_load", []),
+                    "additional_settings": agent.get("additional_settings", {}),
+                    "name": agent.get("name"),
+                    "display_name": agent.get("display_name", agent.get("name")),
+                    "description": agent.get("description", ""),
+                    "id": agent.get("id", ""),
+                    "default_agent": agent.get("default_agent", False),
+                    "is_global": agent.get("is_global", False),
+                    "is_group": agent.get("is_group", False),
+                    "group_id": agent.get("group_id"),
+                    "group_name": agent.get("group_name"),
+                    "enable_agent_gpt_apim": False,
+                    "max_completion_tokens": agent.get("max_completion_tokens", -1),
+                    "agent_type": agent_type or "local",
+                    "other_settings": other_settings,
+                    "token_provider": token_provider,
+                    "model_endpoint_id": agent.get("model_endpoint_id", ""),
+                    "model_id": agent.get("model_id", ""),
+                    "model_provider": provider,
+                }
             if global_apim_enabled:
                 g_apim = get_global_apim()
                 endpoint, key, deployment, api_version = g_apim
             else:
                 g_gpt = get_global_gpt()
                 endpoint, key, deployment, api_version = g_gpt
+                token_provider = resolve_global_gpt_token_provider(key)
             return {
                 "endpoint": endpoint,
                 "key": key,
@@ -279,6 +585,7 @@ def merge_fields(primary, fallback):
                 "max_completion_tokens": agent.get("max_completion_tokens", -1),
                 "agent_type": agent_type or "local",
                 "other_settings": other_settings,
+                "token_provider": token_provider,
             }
         except Exception as e:
             log_event(f"[SK Loader] Error resolving agent config: {e}", level=logging.ERROR, exceptionTraceback=True)
@@ -291,6 +598,45 @@ def merge_fields(primary, fallback):
     can_use_agent_endpoints = allow_custom_agent_endpoints
     user_apim_allowed = user_apim_enabled and can_use_agent_endpoints
 
+    if multi_endpoint_config and multi_endpoint_config.get("provider") in ("aoai", "aifoundry", "new_foundry"):
+        auth = multi_endpoint_config.get("auth", {}) or {}
+        auth_type = (auth.get("type") or "managed_identity").lower()
+        provider = multi_endpoint_config.get("provider")
+        endpoint = multi_endpoint_config.get("endpoint")
+        deployment = multi_endpoint_config.get("deployment")
+        api_version = multi_endpoint_config.get("api_version")
+        key = auth.get("api_key") or ""
+        token_provider = None
+        if auth_type != "api_key":
+            token_provider = build_token_provider(auth, provider=provider, endpoint=endpoint)
+        result = {
+            "endpoint": endpoint,
+            "key": key,
+            "deployment": deployment,
+            "api_version": api_version,
+            "instructions": agent.get("instructions", ""),
+            "actions_to_load": agent.get("actions_to_load", []),
+            "additional_settings": agent.get("additional_settings", {}),
+            "name": agent.get("name"),
+            "display_name": agent.get("display_name", agent.get("name")),
+            "description": agent.get("description", ""),
+            "id": agent.get("id", ""),
+            "default_agent": agent.get("default_agent", False),
+            "is_global": agent.get("is_global", False),
+            "is_group": agent.get("is_group", False),
+            "group_id": agent.get("group_id"),
+            "group_name": agent.get("group_name"),
+            "enable_agent_gpt_apim": False,
+            "max_completion_tokens": agent.get("max_completion_tokens", -1),
+            "agent_type": agent_type or "local",
+            "other_settings": other_settings,
+            "token_provider": token_provider,
+            "model_endpoint_id": agent.get("model_endpoint_id", ""),
+            "model_id": agent.get("model_id", ""),
+            "model_provider": provider,
+        }
+        return result
+
     # 1. User APIM enabled and any user APIM values set: use user APIM (merge with global APIM if needed)
     if user_apim_allowed and any_filled(*u_apim):
         debug_print(f"[SK Loader] Using user APIM with global fallback")
@@ -317,6 +663,8 @@ def merge_fields(primary, fallback):
         debug_print(f"[SK Loader] Using global GPT config (fallback)")
         endpoint, key, deployment, api_version = g_gpt
 
+    token_provider = resolve_global_gpt_token_provider(key)
+
     result = {
         "endpoint": endpoint,
         "key": key,
@@ -338,9 +686,13 @@ def merge_fields(primary, fallback):
         "max_completion_tokens": agent.get("max_completion_tokens", -1),  # -1 meant use model default determined by the service, 35-trubo is 4096, 4o is 16384, 4.1 is at least 32768
         "agent_type": agent_type or "local",
         "other_settings": other_settings,
+        "token_provider": token_provider,
     }
 
-    print(f"[SK Loader] Final resolved config for {agent.get('name')}: endpoint={bool(endpoint)}, key={bool(key)}, deployment={deployment}")
+    print(
+        f"[SK Loader] Final resolved config for {agent.get('name')}: "
+        f"endpoint={bool(endpoint)}, key={bool(key)}, token_provider={bool(token_provider)}, deployment={deployment}"
+    )
     return result
 
 def load_time_plugin(kernel: Kernel):
@@ -943,8 +1295,66 @@ def load_single_agent_for_kernel(kernel, agent_cfg, settings, context_obj, redis
     chat_service = None
     apim_enabled = settings.get("enable_gpt_apim", False)
 
-    if agent_type == "aifoundry":
-        foundry_agent = AzureAIFoundryChatCompletionAgent(agent_config, settings)
+    def create_chat_completion_service():
+        token_provider = agent_config.get("token_provider")
+        resolved_api_key = agent_config.get("key") or ""
+        if token_provider:
+            try:
+                return AzureChatCompletion(
+                    service_id=service_id,
+                    deployment_name=agent_config["deployment"],
+                    endpoint=agent_config["endpoint"],
+                    api_key=resolved_api_key,
+                    api_version=agent_config["api_version"],
+                    azure_ad_token_provider=token_provider,
+                )
+            except TypeError:
+                try:
+                    return AzureChatCompletion(
+                        service_id=service_id,
+                        deployment_name=agent_config["deployment"],
+                        endpoint=agent_config["endpoint"],
+                        api_key=resolved_api_key,
+                        api_version=agent_config["api_version"],
+                        ad_token_provider=token_provider,
+                    )
+                except TypeError as exc:
+                    log_event(
+                        f"[SK Loader] Token provider not supported by AzureChatCompletion: {exc}",
+                        level=logging.ERROR,
+                        exceptionTraceback=True,
+                    )
+                    return None
+        return AzureChatCompletion(
+            service_id=service_id,
+            deployment_name=agent_config["deployment"],
+            endpoint=agent_config["endpoint"],
+            api_key=resolved_api_key,
+            api_version=agent_config["api_version"],
+        )
+
+    if agent_type in {"aifoundry", "new_foundry"}:
+        foundry_settings_key = "new_foundry" if agent_type == "new_foundry" else "azure_ai_foundry"
+        foundry_settings = (agent_config.get("other_settings") or {}).get(foundry_settings_key) or {}
+        endpoint = resolve_foundry_endpoint_from_settings(foundry_settings, settings)
+        if not endpoint:
+            log_event(
+                f"[SK Loader] Foundry endpoint missing for agent: {agent_config.get('name')} ({mode_label})",
+                {
+                    "agent_name": agent_config.get("name"),
+                    "agent_id": agent_config.get("id"),
+                    "is_global": agent_config.get("is_global", False),
+                    "is_group": agent_config.get("is_group", False),
+                    "group_id": agent_config.get("group_id"),
+                },
+                level=logging.WARNING,
+            )
+            return kernel, None
+
+        if agent_type == "new_foundry":
+            foundry_agent = AzureAIFoundryNewChatCompletionAgent(agent_config, settings)
+        else:
+            foundry_agent = AzureAIFoundryChatCompletionAgent(agent_config, settings)
         agent_objs[agent_config["name"]] = foundry_agent
         log_event(
             f"[SK Loader] Registered Foundry agent: {agent_config['name']} ({mode_label})",
@@ -952,6 +1362,7 @@ def load_single_agent_for_kernel(kernel, agent_cfg, settings, context_obj, redis
                 "agent_name": agent_config["name"],
                 "agent_id": agent_config.get("id"),
                 "is_global": agent_config.get("is_global", False),
+                "agent_type": agent_type,
             },
             level=logging.INFO,
         )
@@ -959,7 +1370,10 @@ def load_single_agent_for_kernel(kernel, agent_cfg, settings, context_obj, redis
 
     log_event(f"[SK Loader] Agent config resolved for {agent_cfg.get('name')} - endpoint: {bool(agent_config.get('endpoint'))}, key: {bool(agent_config.get('key'))}, deployment: {agent_config.get('deployment')}, max_completion_tokens: {agent_config.get('max_completion_tokens')}", level=logging.INFO)
     
-    if AzureChatCompletion and agent_config["endpoint"] and agent_config["key"] and agent_config["deployment"]:
+    token_provider_present = bool(agent_config.get("token_provider"))
+    has_auth = bool(agent_config.get("key")) or token_provider_present
+
+    if AzureChatCompletion and agent_config["endpoint"] and has_auth and agent_config["deployment"]:
         print(f"[SK Loader] Azure config valid for {agent_config['name']}, creating chat service...")
         if apim_enabled:
             log_event(
@@ -972,14 +1386,7 @@ def load_single_agent_for_kernel(kernel, agent_cfg, settings, context_obj, redis
                 },
                 level=logging.INFO
             )
-            chat_service = AzureChatCompletion(
-                service_id=service_id,
-                deployment_name=agent_config["deployment"],
-                endpoint=agent_config["endpoint"],
-                api_key=agent_config["key"],
-                api_version=agent_config["api_version"],
-                # default_headers={"Ocp-Apim-Subscription-Key": agent_config["key"]}
-            )
+            chat_service = create_chat_completion_service()
         else:
             log_event(
                 f"[SK Loader] Initializing GPT Direct AzureChatCompletion for agent: {agent_config['name']} ({mode_label})",
@@ -991,14 +1398,19 @@ def load_single_agent_for_kernel(kernel, agent_cfg, settings, context_obj, redis
                 },
                 level=logging.INFO
             )
-            chat_service = AzureChatCompletion(
-                service_id=service_id,
-                deployment_name=agent_config["deployment"],
-                endpoint=agent_config["endpoint"],
-                api_key=agent_config["key"],
-                api_version=agent_config["api_version"],
-                # default_headers={"Ocp-Apim-Subscription-Key": agent_config["key"]}
+            chat_service = create_chat_completion_service()
+        if not chat_service:
+            log_event(
+                f"[SK Loader] AzureChatCompletion could not be created for agent: {agent_config['name']} ({mode_label})",
+                {
+                    "agent_name": agent_config["name"],
+                    "aoai_endpoint": agent_config.get("endpoint"),
+                    "aoai_deployment": agent_config.get("deployment"),
+                },
+                level=logging.ERROR,
+                exceptionTraceback=True,
             )
+            return None, None
         if agent_config.get('max_completion_tokens', -1) > 0:
             print(f"[SK Loader] Using {agent_config['max_completion_tokens']} max_completion_tokens for {agent_config['name']}")
             chat_service = set_prompt_settings_for_agent(chat_service, agent_config)
@@ -1019,6 +1431,7 @@ def load_single_agent_for_kernel(kernel, agent_cfg, settings, context_obj, redis
         print(f"  - AzureChatCompletion available: {bool(AzureChatCompletion)}")
         print(f"  - endpoint: {bool(agent_config.get('endpoint'))}")
         print(f"  - key: {bool(agent_config.get('key'))}")
+        print(f"  - token_provider: {token_provider_present}")
         print(f"  - deployment: {bool(agent_config.get('deployment'))}")
         log_event(
             f"[SK Loader] AzureChatCompletion or configuration not resolved for agent: {agent_config['name']} ({mode_label})",
@@ -1026,6 +1439,7 @@ def load_single_agent_for_kernel(kernel, agent_cfg, settings, context_obj, redis
                 "agent_name": agent_config["name"],
                 "aoai_endpoint": agent_config["endpoint"],
                 "aoai_key": f"{agent_config['key'][:3]}..." if agent_config["key"] else None,
+                "token_provider": token_provider_present,
                 "aoai_deployment": agent_config["deployment"],
             },
             level=logging.ERROR,
@@ -1376,8 +1790,10 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
     enable_agents = user_settings.get('enable_agents', True)  # Default to True for backward compatibility
     
     # Check if request has forced agent enablement (e.g., retry with specific agent)
+    # import g here as it is not used in global mode
     from flask import g
     force_enable_agents = getattr(g, 'force_enable_agents', False)
+    request_agent_info = getattr(g, 'request_agent_info', None)
     request_agent_name = getattr(g, 'request_agent_name', None)
     
     if force_enable_agents:
@@ -1387,9 +1803,11 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
     selected_agent = user_settings.get('selected_agent')
     
     # Override selected_agent if request specifies one
-    if request_agent_name:
-        selected_agent = request_agent_name
-        log_event(f"[SK Loader] Using agent from request: {request_agent_name}", level=logging.INFO)
+    if request_agent_info:
+        if not isinstance(request_agent_info, dict):
+            request_agent_info = {"name": request_agent_info}
+        selected_agent = request_agent_info
+        log_event(f"[SK Loader] Using agent from request: {request_agent_info}", level=logging.INFO)
     
     # If agents are disabled or no agent is selected, skip agent loading entirely
     if not enable_agents:
@@ -1437,9 +1855,28 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
     # Append selected group agent (if any) to the candidate list so downstream selection logic can resolve it
     selected_agent_data = selected_agent if isinstance(selected_agent, dict) else {}
     selected_agent_is_group = selected_agent_data.get('is_group', False)
+    selected_agent_group_id = selected_agent_data.get('group_id')
+    conversation_group_id = getattr(g, "conversation_group_id", None)
+    allow_user_agents = settings.get('allow_user_agents', False)
+    allow_group_agents = settings.get('allow_group_agents', False)
+
+    if selected_agent_is_group and not allow_group_agents:
+        log_event(
+            "[SK Loader] Group agents are disabled; skipping group agent load.",
+            level=logging.WARNING
+        )
+        load_core_plugins_only(kernel, settings)
+        return kernel, None
+    if not selected_agent_is_group and not allow_user_agents:
+        log_event(
+            "[SK Loader] User agents are disabled; skipping personal agent load.",
+            level=logging.WARNING
+        )
+        load_core_plugins_only(kernel, settings)
+        return kernel, None
+
     if selected_agent_is_group:
         resolved_group_id = selected_agent_data.get('group_id')
-        active_group_id = None
         
         # Group agent MUST have a group_id
         if not resolved_group_id:
@@ -1463,6 +1900,7 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
                 load_core_plugins_only(kernel, settings)
                 return kernel, None
         except ValueError as err:
+            active_group_id = None
             debug_print(f"[SK Loader] No active group available while loading group agent: {err}")
             log_event(
                 "[SK Loader] Group agent selected but no active group in settings.",
@@ -1488,7 +1926,16 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
                 group_agent_cfg['is_group'] = True
                 group_agent_cfg.setdefault('group_id', resolved_group_id)
                 group_agent_cfg['group_name'] = selected_agent_data.get('group_name')
-                agents_cfg.append(group_agent_cfg)
+                if not any(
+                    agent.get('id') == group_agent_cfg.get('id')
+                    or (
+                        agent.get('name') == group_agent_cfg.get('name')
+                        and bool(agent.get('is_group', False))
+                        and str(agent.get('group_id') or '') == str(resolved_group_id)
+                    )
+                    for agent in agents_cfg
+                ):
+                    agents_cfg.append(group_agent_cfg)
                 log_event(
                     f"[SK Loader] Added group agent '{group_agent_cfg.get('name')}' from group {resolved_group_id} to candidate list.",
                     level=logging.INFO
@@ -1518,7 +1965,7 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
             key = f"global_{agent['name']}"
             all_agents[key] = agent
             
-        # Add personal and group agents with scoped prefixes
+        # Add workspace agents with scoped prefixes
         for agent in agents_cfg:
             prefix = "group" if agent.get('is_group') else "personal"
             scoped_name = agent.get('name') or agent.get('id') or 'unnamed'
@@ -1595,13 +2042,20 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
     # Get selected agent from user settings (this still needs to be in user settings for UI state)
     user_settings = get_user_settings(user_id).get('settings', {})
     selected_agent = user_settings.get('selected_agent')
+    if request_agent_info:
+        selected_agent = request_agent_info if isinstance(request_agent_info, dict) else {"name": request_agent_info}
     debug_print(f"[SK Loader] User settings selected_agent: {selected_agent}")
     debug_print(f"[SK Loader] Type of selected_agent: {type(selected_agent)}")
     if isinstance(selected_agent, dict):
         selected_agent_name = selected_agent.get('name')
+        selected_agent_id = selected_agent.get('id')
         is_global_flag = selected_agent.get('is_global', False)
+        is_group_flag = selected_agent.get('is_group', False)
+        selected_agent_group_id = selected_agent.get('group_id')
         debug_print(f"[SK Loader] Selected agent name: {selected_agent_name}")
         debug_print(f"[SK Loader] Selected agent is_global flag: {is_global_flag}")
+        debug_print(f"[SK Loader] Selected agent is_group flag: {is_group_flag}")
+        debug_print(f"[SK Loader] Selected agent group_id: {selected_agent_group_id}")
     else:
         debug_print(f"[SK Loader] User {user_id} selected_agent is not a dict: {selected_agent}. Using None.")
         log_event(
@@ -1609,29 +2063,36 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
             level=logging.ERROR
         )
         selected_agent_name = None
+        selected_agent_id = None
         is_global_flag = False
+        is_group_flag = False
+        selected_agent_group_id = None
     debug_print(f"[SK Loader] Selected agent name: {selected_agent_name}")
     debug_print(f"[SK Loader] Selected agent global flag: {is_global_flag}")
     agent_cfg = None
     # Try user-selected agent
     if selected_agent_name:
-        debug_print(f"[SK Loader] Looking for agent named '{selected_agent_name}' with is_global={is_global_flag}")
-        debug_print(f"[SK Loader] Available agents: {[{a.get('name'): a.get('is_global', False)} for a in agents_cfg]}")
-        
-        # First try to find exact match including is_global flag
-        found = next((a for a in agents_cfg if a.get('name') == selected_agent_name and a.get('is_global', False) == is_global_flag), None)
+        debug_print(
+            f"[SK Loader] Looking for agent named '{selected_agent_name}' with is_global={is_global_flag}, is_group={is_group_flag}"
+        )
+        debug_print(
+            f"[SK Loader] Available agents: [{', '.join([str({'name': a.get('name'), 'is_global': a.get('is_global', False), 'is_group': a.get('is_group', False), 'group_id': a.get('group_id')}) for a in agents_cfg])}]"
+        )
+
+        found = find_agent_by_scope(agents_cfg, {
+            "name": selected_agent_name,
+            "id": selected_agent_id,
+            "is_global": is_global_flag,
+            "is_group": is_group_flag,
+            "group_id": selected_agent_group_id
+        })
         if found:
-            debug_print(f"[SK Loader] User {user_id} Found EXACT match for agent: {selected_agent_name} (is_global={is_global_flag})")
+            debug_print(f"[SK Loader] User {user_id} Found scoped match for agent: {selected_agent_name}")
             agent_cfg = found
         else:
-            # Fallback: try to find by name only
-            found = next((a for a in agents_cfg if a.get('name') == selected_agent_name), None)
-            if found:
-                debug_print(f"[SK Loader] User {user_id} Found NAME-ONLY match for agent: {selected_agent_name} (requested is_global={is_global_flag}, found is_global={found.get('is_global', False)})")
-                agent_cfg = found
-            else:
-                debug_print(f"[SK Loader] User {user_id} NO agent found matching user-selected agent: {selected_agent_name}")
+            debug_print(f"[SK Loader] User {user_id} NO agent found matching user-selected agent: {selected_agent_name}")
         
+        #TODO: Fix this logging
         if found:
             print(f"[SK Loader] User {user_id} Found user-selected agent: {selected_agent_name}")
             logging.debug(f"[SK Loader] User {user_id} Found user-selected agent: {selected_agent_name}")
@@ -1662,7 +2123,7 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
                     level=logging.WARNING
                 )
 
-    # If still not found, DON'T use first agent - only load when explicitly selected
+    # If still not found, stop here instead of masking the loading issue with a fallback.
     if agent_cfg is None and agents_cfg:
         debug_print(f"[SK Loader] User {user_id} Agent selection final status: agent_cfg is None")
         debug_print(f"[SK Loader] User {user_id} Available agents: {[{a.get('name'): a.get('is_global', False)} for a in agents_cfg]}")
@@ -1689,6 +2150,8 @@ def load_user_semantic_kernel(kernel: Kernel, settings, user_id: str, redis_clie
     agent_cfg['agent_type'] = agent_type
     if agent_type == 'local':
         kernel, agent_objs = load_single_agent_for_kernel(kernel, agent_cfg, settings, g, redis_client=redis_client, mode_label="per-user")
+    elif agent_type in ('aifoundry', 'new_foundry'):
+        kernel, agent_objs = load_single_agent_for_kernel(kernel, agent_cfg, settings, g, redis_client=redis_client, mode_label="per-user")
     else:
         log_event(
             f"[SK Loader] Unsupported agent_type '{agent_type}' for agent '{agent_cfg.get('name')}'. Defaulting to local path.",
diff --git a/application/single_app/semantic_kernel_plugins/fact_memory_plugin.py b/application/single_app/semantic_kernel_plugins/fact_memory_plugin.py
index 9f8f33c4..3086a08d 100644
--- a/application/single_app/semantic_kernel_plugins/fact_memory_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/fact_memory_plugin.py
@@ -4,14 +4,18 @@
 - Exposes methods for use as a Semantic Kernel plugin (does not need to derive from BasePlugin).
 - Read/inject logic is handled separately by orchestration utility.
 """
-from semantic_kernel_fact_memory_store import FactMemoryStore
 from typing import Optional, List
+
 from semantic_kernel.functions import kernel_function
+from semantic_kernel_fact_memory_store import FactMemoryStore
+
+from semantic_kernel_plugins.plugin_invocation_logger import auto_wrap_plugin_functions
 
 
 class FactMemoryPlugin:
     def __init__(self, store: Optional[FactMemoryStore] = None):
         self.store = store or FactMemoryStore()
+        auto_wrap_plugin_functions(self, self.__class__.__name__)
 
     @kernel_function(
         description="""
diff --git a/application/single_app/semantic_kernel_plugins/logged_plugin_loader.py b/application/single_app/semantic_kernel_plugins/logged_plugin_loader.py
index f7c9e38c..928f7851 100644
--- a/application/single_app/semantic_kernel_plugins/logged_plugin_loader.py
+++ b/application/single_app/semantic_kernel_plugins/logged_plugin_loader.py
@@ -66,16 +66,8 @@ def load_plugin_from_manifest(self, manifest: Dict[str, Any],
                 debug_print(f"[Logged Plugin Loader] Enabling invocation logging for {plugin_name}")
                 plugin_instance.enable_invocation_logging(True)
             
-            # Auto-wrap plugin functions with logging
-            if isinstance(plugin_instance, BasePlugin):
-                log_event(f"[Logged Plugin Loader] Wrapping functions for BasePlugin", 
-                         extra={"plugin_name": plugin_name}, 
-                         level=logging.DEBUG)
-                self._wrap_plugin_functions(plugin_instance, plugin_name)
-            else:
-                log_event(f"[Logged Plugin Loader] Plugin is not a BasePlugin", 
-                         extra={"plugin_name": plugin_name, "plugin_type": type(plugin_instance).__name__}, 
-                         level=logging.WARNING)
+            # Auto-wrap plugin functions with logging for any plugin instance exposing kernel functions.
+            self._wrap_plugin_functions(plugin_instance, plugin_name)
             
             # Register the plugin with the kernel
             self._register_plugin_with_kernel(plugin_instance, plugin_name)
@@ -285,7 +277,7 @@ def _wrap_plugin_functions(self, plugin_instance, plugin_name: str):
                  extra={"plugin_name": plugin_name}, 
                  level=logging.DEBUG)
         
-        if not hasattr(plugin_instance, 'is_logging_enabled') or not plugin_instance.is_logging_enabled():
+        if hasattr(plugin_instance, 'is_logging_enabled') and not plugin_instance.is_logging_enabled():
             log_event(f"[Logged Plugin Loader] Plugin does not have logging enabled", 
                      extra={"plugin_name": plugin_name}, 
                      level=logging.WARNING)
@@ -294,77 +286,27 @@ def _wrap_plugin_functions(self, plugin_instance, plugin_name: str):
         log_event(f"[Logged Plugin Loader] Starting to wrap functions for plugin", 
                  extra={"plugin_name": plugin_name}, 
                  level=logging.DEBUG)
-        wrapped_count = 0
-        
-        # Debug: List all attributes
-        all_attrs = [attr for attr in dir(plugin_instance) if not attr.startswith('_')]
-        log_event(f"[Logged Plugin Loader] Plugin attribute analysis", 
-                 extra={
-                     "plugin_name": plugin_name, 
-                     "total_public_attributes": len(all_attrs),
-                     "sample_attributes": all_attrs[:10]
-                 }, 
-                 level=logging.DEBUG)
-        
-        # Find and wrap all kernel functions
+        wrapped_before = 0
         for attr_name in dir(plugin_instance):
-            if attr_name.startswith('_'):
-                continue
-                
             attr = getattr(plugin_instance, attr_name)
-            
-            # Debug: Check each callable attribute
-            if callable(attr):
-                has_sk_function = hasattr(attr, '__sk_function__')
-                sk_function_value = getattr(attr, '__sk_function__', None) if has_sk_function else None
-                log_event(f"[Logged Plugin Loader] Function analysis", 
-                         extra={
-                             "plugin_name": plugin_name,
-                             "function_name": attr_name,
-                             "callable": True,
-                             "has_sk_function": has_sk_function,
-                             "sk_function_value": sk_function_value
-                         }, 
-                         level=logging.DEBUG)
-            
-            # Check if it's a kernel function
-            is_kernel_function = False
-            
-            # Standard check for __sk_function__ attribute
-            if (callable(attr) and 
-                hasattr(attr, '__sk_function__') and 
-                attr.__sk_function__):
-                is_kernel_function = True
-            
-            # For OpenAPI plugins, also check if this is one of the known API operation functions
-            elif (callable(attr) and 
-                  attr_name in ['listAPIs', 'getMetrics', 'getProviders', 'getProvider', 'getAPI', 'getServiceAPI', 'getServices'] and
-                  hasattr(plugin_instance, 'base_url')):  # OpenAPI plugins have base_url
-                is_kernel_function = True
-                log_event(f"[Logged Plugin Loader] Detected OpenAPI function for enhanced logging", 
-                         extra={"plugin_name": plugin_name, "function_name": attr_name}, 
-                         level=logging.DEBUG)
-            
-            if is_kernel_function:
-                # Create a logged wrapper
-                logged_method = self._create_logged_method(attr, plugin_name, attr_name)
-                
-                # Replace the method on the instance
-                setattr(plugin_instance, attr_name, logged_method)
-                
-                wrapped_count += 1
-                log_event(f"[Logged Plugin Loader] Wrapped function with logging", 
-                         extra={"plugin_name": plugin_name, "function_name": attr_name}, 
-                         level=logging.INFO)
-        
-        # DISABLED: OpenAPI kernel plugin wrapping to prevent excessive logging
-        # Plugin logging is now handled by the @plugin_function_logger decorator system
-        log_event(f"[Logged Plugin Loader] Skipping OpenAPI kernel function wrapping to avoid duplication with decorator logging", 
-                 extra={"plugin_name": plugin_name}, 
-                 level=logging.DEBUG)
+            if callable(attr) and getattr(attr, '__plugin_invocation_logger_wrapped__', False):
+                wrapped_before += 1
+
+        auto_wrap_plugin_functions(plugin_instance, plugin_name)
+
+        wrapped_after = 0
+        for attr_name in dir(plugin_instance):
+            attr = getattr(plugin_instance, attr_name)
+            if callable(attr) and getattr(attr, '__plugin_invocation_logger_wrapped__', False):
+                wrapped_after += 1
         
         log_event(f"[Logged Plugin Loader] Function wrapping completed", 
-                 extra={"plugin_name": plugin_name, "wrapped_count": wrapped_count}, 
+                 extra={
+                     "plugin_name": plugin_name,
+                     "wrapped_before": wrapped_before,
+                     "wrapped_after": wrapped_after,
+                     "newly_wrapped": max(wrapped_after - wrapped_before, 0)
+                 }, 
                  level=logging.INFO)
     
     def _create_logged_method(self, original_method, plugin_name: str, function_name: str):
diff --git a/application/single_app/semantic_kernel_plugins/math_plugin.py b/application/single_app/semantic_kernel_plugins/math_plugin.py
index 159f6d78..32ff9007 100644
--- a/application/single_app/semantic_kernel_plugins/math_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/math_plugin.py
@@ -1,11 +1,14 @@
-# Copyright (c) Microsoft. All rights reserved.
+# math_plugin.py
 
 from typing import Annotated
-from semantic_kernel_plugins.plugin_invocation_logger import plugin_function_logger
+
+from semantic_kernel.core_plugins.math_plugin import MathPlugin as SKMathPlugin
 from semantic_kernel.functions.kernel_function_decorator import kernel_function
 
+from semantic_kernel_plugins.plugin_invocation_logger import auto_wrap_plugin_functions
+
 
-class MathPlugin:
+class MathPlugin(SKMathPlugin):
     """Description: MathPlugin provides a set of functions to make Math calculations.
 
     Usage:
@@ -16,40 +19,11 @@ class MathPlugin:
         {{math.Subtract}} => Returns the difference of input and amount (provided in the KernelArguments)
     """
 
-    def _parse_number(self, val: int | float | str) -> float:
-        """Helper to parse a value as a float (supports int, float, str)."""
-        if isinstance(val, (int, float)):
-            return float(val)
-        try:
-            return float(val)
-        except Exception as ex:
-            raise ValueError(f"Cannot convert {val!r} to float for math operation") from ex
-
-    @kernel_function(name="Add")
-    def add(
-        self,
-        input: Annotated[int | float | str, "The first number to add"],
-        amount: Annotated[int | float | str, "The second number to add"],
-    ) -> Annotated[float, "The result"]:
-        """Returns the addition result of the values provided (supports float and int)."""
-        x = self._parse_number(input)
-        y = self._parse_number(amount)
-        return x + y
-
-    @kernel_function(name="Subtract")
-    @plugin_function_logger("MathPlugin")
-    def subtract(
-        self,
-        input: Annotated[int | float | str, "The number to subtract from"],
-        amount: Annotated[int | float | str, "The number to subtract"],
-    ) -> Annotated[float, "The result"]:
-        """Returns the difference of numbers provided (supports float and int)."""
-        x = self._parse_number(input)
-        y = self._parse_number(amount)
-        return x - y
+    def __init__(self):
+        super().__init__()
+        auto_wrap_plugin_functions(self, self.__class__.__name__)
 
     @kernel_function(name="Multiply")
-    @plugin_function_logger("MathPlugin")
     def multiply(
         self,
         input: Annotated[int | float | str, "The first number to multiply"],
@@ -61,7 +35,6 @@ def multiply(
         return x * y
 
     @kernel_function(name="Divide")
-    @plugin_function_logger("MathPlugin")
     def divide(
         self,
         input: Annotated[int | float | str, "The numerator"],
@@ -75,7 +48,6 @@ def divide(
         return x / y
 
     @kernel_function(name="Power")
-    @plugin_function_logger("MathPlugin")
     def power(
         self,
         input: Annotated[int | float | str, "The base number"],
@@ -87,7 +59,6 @@ def power(
         return x**y
 
     @kernel_function(name="SquareRoot")
-    @plugin_function_logger("MathPlugin")
     def square_root(
         self,
         input: Annotated[int | float | str, "The number to calculate the square root of"],
@@ -99,7 +70,6 @@ def square_root(
         return x**0.5
     
     @kernel_function(name="Modulus")
-    @plugin_function_logger("MathPlugin")
     def modulus(
         self,
         input: Annotated[int | float | str, "The dividend"],
diff --git a/application/single_app/semantic_kernel_plugins/msgraph_plugin.py b/application/single_app/semantic_kernel_plugins/msgraph_plugin.py
index 0eeef419..e1b2023e 100644
--- a/application/single_app/semantic_kernel_plugins/msgraph_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/msgraph_plugin.py
@@ -1,16 +1,31 @@
-from typing import Dict, Any, List
-from semantic_kernel_plugins.base_plugin import BasePlugin
+# msgraph_plugin.py
+
+from typing import Any, Dict, List, Optional, Tuple
+from urllib.parse import quote
+
+import requests
+from requests import RequestException
+
+from functions_authentication import get_valid_access_token_for_plugins
+from functions_debug import debug_print
 from semantic_kernel.functions import kernel_function
+from semantic_kernel_plugins.base_plugin import BasePlugin
 from semantic_kernel_plugins.plugin_invocation_logger import plugin_function_logger
-import requests
-from flask import session
-from functions_authentication import get_valid_access_token
+
 
 class MSGraphPlugin(BasePlugin):
-    def __init__(self, manifest: Dict[str, Any]):
-        self.manifest = manifest
-        self._metadata = manifest.get('metadata', {})
-        # You can add more config here if needed
+    DEFAULT_ENDPOINT = "https://graph.microsoft.com"
+    DEFAULT_TIMEOUT_SECONDS = 30
+    MAX_ITEMS_PER_RESULT = 25
+    MAX_PAGES_PER_REQUEST = 5
+
+    def __init__(self, manifest: Optional[Dict[str, Any]] = None):
+        super().__init__(manifest)
+        self.manifest = manifest or {}
+        self._metadata = self.manifest.get("metadata", {})
+        self._endpoint = self.manifest.get("endpoint", self.DEFAULT_ENDPOINT).rstrip("/")
+        scope_overrides = self.manifest.get("scopes") or self._metadata.get("scopes") or {}
+        self._scope_overrides = scope_overrides if isinstance(scope_overrides, dict) else {}
 
     @property
     def display_name(self) -> str:
@@ -21,75 +36,608 @@ def metadata(self) -> Dict[str, Any]:
         return {
             "name": self.manifest.get("name", "msgraph_plugin"),
             "type": "msgraph",
-            "description": "Plugin for interacting with Microsoft Graph API. Supports calendar lookup, user profile, and security info.",
+            "description": (
+                "Plugin for interacting with Microsoft Graph API. Supports user profile, "
+                "calendar, mailbox timezone settings, mail, directory, drive, and security alert operations."
+            ),
             "methods": [
                 {
                     "name": "get_my_profile",
-                    "description": "Get information about the signed-in user.",
+                    "description": "Get the signed-in user's profile details.",
+                    "parameters": [
+                        {
+                            "name": "select_fields",
+                            "type": "str",
+                            "description": "Optional comma-separated Graph fields to include.",
+                            "required": False,
+                        }
+                    ],
+                    "returns": {"type": "dict", "description": "User profile information from Microsoft Graph."},
+                },
+                {
+                    "name": "get_my_timezone",
+                    "description": "Get the signed-in user's Microsoft 365 mailbox time zone and related formatting settings. Use this before answering timezone-sensitive questions.",
                     "parameters": [],
-                    "returns": {"type": "dict", "description": "User profile info from MS Graph."}
+                    "returns": {"type": "dict", "description": "Mailbox timezone, date format, and time format settings from Microsoft Graph."},
                 },
                 {
                     "name": "get_my_events",
                     "description": "Get upcoming calendar events for the signed-in user.",
                     "parameters": [
-                        {"name": "top", "type": "int", "description": "Number of events to return.", "required": False}
+                        {"name": "top", "type": "int", "description": "Maximum number of events to return.", "required": False},
+                        {
+                            "name": "start_datetime",
+                            "type": "str",
+                            "description": "Optional ISO datetime. If provided with end_datetime, uses calendarView.",
+                            "required": False,
+                        },
+                        {
+                            "name": "end_datetime",
+                            "type": "str",
+                            "description": "Optional ISO datetime. If provided with start_datetime, uses calendarView.",
+                            "required": False,
+                        },
+                        {
+                            "name": "select_fields",
+                            "type": "str",
+                            "description": "Optional comma-separated Graph fields to include.",
+                            "required": False,
+                        },
+                    ],
+                    "returns": {"type": "dict", "description": "Calendar event results from Microsoft Graph."},
+                },
+                {
+                    "name": "get_my_messages",
+                    "description": "Get recent mail messages for the signed-in user.",
+                    "parameters": [
+                        {"name": "top", "type": "int", "description": "Maximum number of messages to return.", "required": False},
+                        {"name": "folder", "type": "str", "description": "Optional mail folder name, such as inbox.", "required": False},
+                        {"name": "unread_only", "type": "bool", "description": "If true, only unread messages are returned.", "required": False},
+                        {
+                            "name": "select_fields",
+                            "type": "str",
+                            "description": "Optional comma-separated Graph fields to include.",
+                            "required": False,
+                        },
                     ],
-                    "returns": {"type": "dict", "description": "List of events from MS Graph."}
+                    "returns": {"type": "dict", "description": "Mail message results from Microsoft Graph."},
+                },
+                {
+                    "name": "search_users",
+                    "description": "Search directory users by name or email prefix.",
+                    "parameters": [
+                        {"name": "query", "type": "str", "description": "Search text for display name or email.", "required": True},
+                        {"name": "top", "type": "int", "description": "Maximum number of users to return.", "required": False},
+                        {
+                            "name": "select_fields",
+                            "type": "str",
+                            "description": "Optional comma-separated Graph fields to include.",
+                            "required": False,
+                        },
+                    ],
+                    "returns": {"type": "dict", "description": "Matching users from Microsoft Graph."},
+                },
+                {
+                    "name": "get_user_by_email",
+                    "description": "Get a directory user by exact email address or UPN.",
+                    "parameters": [
+                        {"name": "email", "type": "str", "description": "Exact email address or user principal name.", "required": True},
+                        {
+                            "name": "select_fields",
+                            "type": "str",
+                            "description": "Optional comma-separated Graph fields to include.",
+                            "required": False,
+                        },
+                    ],
+                    "returns": {"type": "dict", "description": "User match information from Microsoft Graph."},
+                },
+                {
+                    "name": "list_drive_items",
+                    "description": "List OneDrive items from the root or a child path for the signed-in user.",
+                    "parameters": [
+                        {"name": "path", "type": "str", "description": "Optional path below the drive root.", "required": False},
+                        {"name": "top", "type": "int", "description": "Maximum number of items to return.", "required": False},
+                        {
+                            "name": "select_fields",
+                            "type": "str",
+                            "description": "Optional comma-separated Graph fields to include.",
+                            "required": False,
+                        },
+                    ],
+                    "returns": {"type": "dict", "description": "Drive item results from Microsoft Graph."},
                 },
                 {
                     "name": "get_my_security_alerts",
-                    "description": "Get recent security alerts for the signed-in user (requires SecurityEvents.Read.All).",
+                    "description": "Get recent security alerts for the signed-in user. Requires elevated Graph permissions.",
                     "parameters": [
-                        {"name": "top", "type": "int", "description": "Number of alerts to return.", "required": False}
+                        {"name": "top", "type": "int", "description": "Maximum number of alerts to return.", "required": False}
                     ],
-                    "returns": {"type": "dict", "description": "List of security alerts from MS Graph."}
-                }
-            ]
+                    "returns": {"type": "dict", "description": "Security alert results from Microsoft Graph."},
+                },
+            ],
         }
 
     def get_functions(self) -> List[str]:
-        return ["get_my_profile", "get_my_events", "get_my_security_alerts"]
+        return [
+            "get_my_profile",
+            "get_my_timezone",
+            "get_my_events",
+            "get_my_messages",
+            "search_users",
+            "get_user_by_email",
+            "list_drive_items",
+            "get_my_security_alerts",
+        ]
+
+    def _get_scopes(self, operation_name: str, default_scopes: List[str]) -> List[str]:
+        configured_scopes = self._scope_overrides.get(operation_name)
+        if isinstance(configured_scopes, str) and configured_scopes.strip():
+            return [configured_scopes.strip()]
+        if isinstance(configured_scopes, list):
+            normalized_scopes = [scope.strip() for scope in configured_scopes if isinstance(scope, str) and scope.strip()]
+            if normalized_scopes:
+                return normalized_scopes
+        return default_scopes
+
+    def _get_token(self, operation_name: str, default_scopes: List[str]) -> Tuple[Optional[str], List[str], Optional[Dict[str, Any]]]:
+        scopes = self._get_scopes(operation_name, default_scopes)
+        token_result = get_valid_access_token_for_plugins(scopes=scopes)
+        if isinstance(token_result, dict) and token_result.get("access_token"):
+            return token_result["access_token"], scopes, None
+
+        error_payload = token_result if isinstance(token_result, dict) else {
+            "error": "token_acquisition_failed",
+            "message": "Failed to acquire Microsoft Graph access token.",
+        }
+        error_payload.setdefault("operation", operation_name)
+        error_payload.setdefault("scopes", scopes)
+        return None, scopes, error_payload
+
+    def _normalize_top(self, top: int) -> int:
+        try:
+            normalized_top = int(top)
+        except (TypeError, ValueError):
+            return 5
+        return max(1, min(normalized_top, self.MAX_ITEMS_PER_RESULT))
+
+    def _sanitize_select_fields(self, select_fields: str) -> Optional[str]:
+        if not select_fields:
+            return None
+
+        allowed_chars = set("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_./")
+        fields = []
+        for raw_field in select_fields.split(","):
+            field = raw_field.strip()
+            if field and all(char in allowed_chars for char in field):
+                fields.append(field)
+
+        return ",".join(fields) if fields else None
+
+    def _sanitize_filter_value(self, value: str) -> str:
+        return value.replace("'", "''").strip()
+
+    def _build_odata_params(
+        self,
+        top: int = 5,
+        select_fields: str = "",
+        filter_query: str = "",
+        order_by: str = "",
+        search_query: str = "",
+        extra_params: Optional[Dict[str, Any]] = None,
+    ) -> Tuple[Dict[str, Any], Dict[str, str]]:
+        params: Dict[str, Any] = {"$top": self._normalize_top(top)}
+        headers: Dict[str, str] = {}
+
+        normalized_select = self._sanitize_select_fields(select_fields)
+        if normalized_select:
+            params["$select"] = normalized_select
+
+        if filter_query.strip():
+            params["$filter"] = filter_query.strip()
+
+        if order_by.strip():
+            params["$orderby"] = order_by.strip()
 
-    def _get_token(self, scopes=None):
-        # Use the existing authentication helper to get a valid token for Graph
-        scopes = scopes or [f"{self.manifest.get('endpoint', 'https://graph.microsoft.com').rstrip('/')}/.default"]
-        token = get_valid_access_token(scopes=scopes)
-        if not token:
-            raise Exception("Could not acquire MS Graph access token. User may need to re-authenticate.")
-        return token
+        if search_query.strip():
+            params["$search"] = search_query.strip()
+            headers["ConsistencyLevel"] = "eventual"
+
+        if extra_params:
+            for key, value in extra_params.items():
+                if value is not None and value != "":
+                    params[key] = value
+
+        return params, headers
+
+    def _build_graph_error(
+        self,
+        operation_name: str,
+        scopes: List[str],
+        response: Optional[requests.Response] = None,
+        exception: Optional[Exception] = None,
+        fallback_message: str = "Microsoft Graph request failed.",
+    ) -> Dict[str, Any]:
+        error_payload: Dict[str, Any] = {
+            "error": "graph_request_failed",
+            "message": fallback_message,
+            "operation": operation_name,
+            "scopes": scopes,
+        }
+
+        if response is not None:
+            error_payload["status_code"] = response.status_code
+            try:
+                graph_body = response.json()
+            except ValueError:
+                graph_body = None
+
+            graph_error = graph_body.get("error", {}) if isinstance(graph_body, dict) else {}
+            graph_message = graph_error.get("message") or response.text.strip() or fallback_message
+            graph_code = graph_error.get("code") or error_payload["error"]
+
+            error_payload["error"] = graph_code
+            error_payload["message"] = graph_message
+
+            if response.status_code == 429:
+                error_payload["error"] = "throttled"
+                error_payload["retry_after_seconds"] = response.headers.get("Retry-After")
+            elif response.status_code == 401:
+                error_payload["error"] = "unauthorized"
+            elif response.status_code == 403:
+                error_payload["error"] = "forbidden"
+            elif response.status_code == 404:
+                error_payload["error"] = "not_found"
+
+        if exception is not None:
+            error_payload["details"] = str(exception)
+
+        debug_print(f"[MSGraphPlugin] {operation_name} failed: {error_payload}")
+        return error_payload
+
+    def _shape_graph_result(self, operation_name: str, payload: Any, max_items: int) -> Dict[str, Any]:
+        if isinstance(payload, dict) and isinstance(payload.get("value"), list):
+            items = payload.get("value", [])
+            next_link = payload.get("@odata.nextLink")
+            limited_items = items[:max_items]
+            return {
+                "operation": operation_name,
+                "count": len(limited_items),
+                "value": limited_items,
+                "next_link": next_link,
+                "truncated": len(items) > max_items,
+            }
+
+        if isinstance(payload, dict):
+            shaped_payload = dict(payload)
+            shaped_payload.setdefault("operation", operation_name)
+            return shaped_payload
+
+        return {
+            "operation": operation_name,
+            "value": payload,
+        }
+
+    def _perform_graph_request(
+        self,
+        operation_name: str,
+        method: str,
+        path: str,
+        default_scopes: List[str],
+        params: Optional[Dict[str, Any]] = None,
+        json_body: Optional[Dict[str, Any]] = None,
+        paginate: bool = False,
+        max_items: int = 5,
+        additional_headers: Optional[Dict[str, str]] = None,
+    ) -> Dict[str, Any]:
+        token, scopes, token_error = self._get_token(operation_name, default_scopes)
+        if token_error:
+            debug_print(f"[MSGraphPlugin] {operation_name} token acquisition failed: {token_error}")
+            return token_error
+
+        url = path if path.startswith("http") else f"{self._endpoint}{path}"
+        normalized_max_items = self._normalize_top(max_items)
+        headers = {
+            "Authorization": f"Bearer {token}",
+            "Accept": "application/json",
+        }
+        if additional_headers:
+            headers.update(additional_headers)
+
+        collected_items: List[Any] = []
+        next_url = url
+        next_params = dict(params or {})
+        pages_fetched = 0
+        last_next_link = None
+
+        while next_url and pages_fetched < self.MAX_PAGES_PER_REQUEST:
+            request_params = next_params if next_url == url else None
+            try:
+                debug_print(f"[MSGraphPlugin] {operation_name} requesting {next_url} params={request_params}")
+                response = requests.request(
+                    method.upper(),
+                    next_url,
+                    headers=headers,
+                    params=request_params,
+                    json=json_body,
+                    timeout=self.DEFAULT_TIMEOUT_SECONDS,
+                )
+            except requests.Timeout as ex:
+                return self._build_graph_error(
+                    operation_name,
+                    scopes,
+                    exception=ex,
+                    fallback_message="Microsoft Graph request timed out.",
+                )
+            except RequestException as ex:
+                return self._build_graph_error(
+                    operation_name,
+                    scopes,
+                    exception=ex,
+                    fallback_message="Microsoft Graph request could not be completed.",
+                )
+
+            pages_fetched += 1
+            if response.status_code >= 400:
+                return self._build_graph_error(operation_name, scopes, response=response)
+
+            try:
+                payload = response.json()
+            except ValueError as ex:
+                return self._build_graph_error(
+                    operation_name,
+                    scopes,
+                    response=response,
+                    exception=ex,
+                    fallback_message="Microsoft Graph returned a non-JSON response.",
+                )
+
+            if paginate and isinstance(payload, dict) and isinstance(payload.get("value"), list):
+                remaining_capacity = max(0, normalized_max_items - len(collected_items))
+                page_items = payload.get("value", [])
+                collected_items.extend(page_items[:remaining_capacity])
+                last_next_link = payload.get("@odata.nextLink")
+                if len(collected_items) >= normalized_max_items or not last_next_link:
+                    return {
+                        "operation": operation_name,
+                        "count": len(collected_items),
+                        "value": collected_items,
+                        "next_link": last_next_link,
+                        "truncated": bool(last_next_link) or len(page_items) > remaining_capacity,
+                    }
+                next_url = last_next_link
+                next_params = {}
+                continue
+
+            return self._shape_graph_result(operation_name, payload, normalized_max_items)
+
+        return {
+            "operation": operation_name,
+            "count": len(collected_items),
+            "value": collected_items,
+            "next_link": last_next_link,
+            "truncated": bool(last_next_link),
+        }
 
     @plugin_function_logger("MSGraphPlugin")
     @kernel_function(description="Get information about the signed-in user.")
-    def get_my_profile(self) -> dict:
-        token = self._get_token(["User.Read"])
-        headers = {"Authorization": f"Bearer {token}"}
-        base = self.manifest.get("endpoint", "https://graph.microsoft.com").rstrip("/")
-        url = base + "/v1.0/me"
-        resp = requests.get(url, headers=headers)
-        resp.raise_for_status()
-        return resp.json()
+    def get_my_profile(self, select_fields: str = "") -> dict:
+        params, headers = self._build_odata_params(
+            top=1,
+            select_fields=select_fields or "id,displayName,givenName,surname,mail,userPrincipalName,jobTitle,department,officeLocation,mobilePhone,businessPhones",
+        )
+        params.pop("$top", None)
+        return self._perform_graph_request(
+            "get_my_profile",
+            "GET",
+            "/v1.0/me",
+            ["User.Read"],
+            params=params,
+            additional_headers=headers,
+        )
+
+    @plugin_function_logger("MSGraphPlugin")
+    @kernel_function(description="Get the signed-in user's Microsoft 365 mailbox timezone settings. Use this before answering timezone-sensitive date and time questions.")
+    def get_my_timezone(self) -> dict:
+        result = self._perform_graph_request(
+            "get_my_timezone",
+            "GET",
+            "/v1.0/me/mailboxSettings",
+            ["MailboxSettings.Read"],
+        )
+        if not isinstance(result, dict) or result.get("error"):
+            return result
+
+        working_hours = result.get("workingHours") if isinstance(result.get("workingHours"), dict) else {}
+        return {
+            "operation": "get_my_timezone",
+            "time_zone": result.get("timeZone") or "",
+            "date_format": result.get("dateFormat") or "",
+            "time_format": result.get("timeFormat") or "",
+            "language": result.get("language") or {},
+            "working_hours_time_zone": working_hours.get("timeZone") or {},
+            "message": (
+                "Use the user's mailbox time_zone instead of assuming UTC when answering "
+                "user-facing date and time questions."
+            ),
+        }
 
     @plugin_function_logger("MSGraphPlugin")
     @kernel_function(description="Get upcoming calendar events for the signed-in user.")
-    def get_my_events(self, top: int = 5) -> dict:
-        token = self._get_token(["Calendars.Read"])
-        headers = {"Authorization": f"Bearer {token}"}
-        params = {"$top": top}
-        base = self.manifest.get("endpoint", "https://graph.microsoft.com").rstrip("/")
-        url = base + "/v1.0/me/events"
-        resp = requests.get(url, headers=headers, params=params)
-        resp.raise_for_status()
-        return resp.json()
+    def get_my_events(
+        self,
+        top: int = 5,
+        start_datetime: str = "",
+        end_datetime: str = "",
+        select_fields: str = "",
+    ) -> dict:
+        use_calendar_view = bool(start_datetime.strip() or end_datetime.strip())
+        if use_calendar_view and not (start_datetime.strip() and end_datetime.strip()):
+            return {
+                "error": "invalid_parameters",
+                "message": "Both start_datetime and end_datetime are required when filtering calendar events by time range.",
+                "operation": "get_my_events",
+            }
+
+        params, headers = self._build_odata_params(
+            top=top,
+            select_fields=select_fields or "id,subject,start,end,location,organizer,isAllDay,webLink",
+            order_by="start/dateTime",
+            extra_params={
+                "startDateTime": start_datetime.strip() or None,
+                "endDateTime": end_datetime.strip() or None,
+            },
+        )
+        path = "/v1.0/me/calendarView" if use_calendar_view else "/v1.0/me/events"
+        return self._perform_graph_request(
+            "get_my_events",
+            "GET",
+            path,
+            ["Calendars.Read"],
+            params=params,
+            paginate=True,
+            max_items=top,
+            additional_headers=headers,
+        )
+
+    @plugin_function_logger("MSGraphPlugin")
+    @kernel_function(description="Get recent mail messages for the signed-in user.")
+    def get_my_messages(
+        self,
+        top: int = 5,
+        folder: str = "inbox",
+        unread_only: bool = False,
+        select_fields: str = "",
+    ) -> dict:
+        filter_query = "isRead eq false" if unread_only else ""
+        params, headers = self._build_odata_params(
+            top=top,
+            select_fields=select_fields or "id,subject,from,receivedDateTime,isRead,importance,webLink",
+            filter_query=filter_query,
+            order_by="receivedDateTime desc",
+        )
+        normalized_folder = (folder or "").strip().strip("/")
+        if normalized_folder:
+            path = f"/v1.0/me/mailFolders/{quote(normalized_folder, safe='')}/messages"
+        else:
+            path = "/v1.0/me/messages"
+        return self._perform_graph_request(
+            "get_my_messages",
+            "GET",
+            path,
+            ["Mail.Read"],
+            params=params,
+            paginate=True,
+            max_items=top,
+            additional_headers=headers,
+        )
+
+    @plugin_function_logger("MSGraphPlugin")
+    @kernel_function(description="Search directory users by name or email prefix.")
+    def search_users(self, query: str, top: int = 5, select_fields: str = "") -> dict:
+        normalized_query = (query or "").strip()
+        if not normalized_query:
+            return {
+                "error": "invalid_parameters",
+                "message": "query is required to search users.",
+                "operation": "search_users",
+            }
+
+        safe_query = self._sanitize_filter_value(normalized_query)
+        filter_query = (
+            f"startswith(displayName,'{safe_query}') or "
+            f"startswith(givenName,'{safe_query}') or "
+            f"startswith(surname,'{safe_query}') or "
+            f"startswith(mail,'{safe_query}') or "
+            f"startswith(userPrincipalName,'{safe_query}')"
+        )
+        params, headers = self._build_odata_params(
+            top=top,
+            select_fields=select_fields or "id,displayName,mail,userPrincipalName,jobTitle,department,officeLocation",
+            filter_query=filter_query,
+            order_by="displayName",
+        )
+        return self._perform_graph_request(
+            "search_users",
+            "GET",
+            "/v1.0/users",
+            ["User.ReadBasic.All"],
+            params=params,
+            paginate=True,
+            max_items=top,
+            additional_headers=headers,
+        )
+
+    @plugin_function_logger("MSGraphPlugin")
+    @kernel_function(description="Get a directory user by exact email address or user principal name.")
+    def get_user_by_email(self, email: str, select_fields: str = "") -> dict:
+        normalized_email = (email or "").strip()
+        if not normalized_email:
+            return {
+                "error": "invalid_parameters",
+                "message": "email is required to look up a user.",
+                "operation": "get_user_by_email",
+            }
+
+        safe_email = self._sanitize_filter_value(normalized_email)
+        filter_query = f"mail eq '{safe_email}' or userPrincipalName eq '{safe_email}'"
+        params, headers = self._build_odata_params(
+            top=1,
+            select_fields=select_fields or "id,displayName,mail,userPrincipalName,jobTitle,department,officeLocation",
+            filter_query=filter_query,
+        )
+        result = self._perform_graph_request(
+            "get_user_by_email",
+            "GET",
+            "/v1.0/users",
+            ["User.ReadBasic.All"],
+            params=params,
+            paginate=False,
+            max_items=1,
+            additional_headers=headers,
+        )
+        if isinstance(result, dict) and isinstance(result.get("value"), list):
+            result["value"] = result.get("value", [])[:1]
+            result["count"] = len(result["value"])
+        return result
+
+    @plugin_function_logger("MSGraphPlugin")
+    @kernel_function(description="List OneDrive items from the drive root or a child path for the signed-in user.")
+    def list_drive_items(self, path: str = "", top: int = 10, select_fields: str = "") -> dict:
+        normalized_path = (path or "").strip().strip("/")
+        params, headers = self._build_odata_params(
+            top=top,
+            select_fields=select_fields or "id,name,webUrl,lastModifiedDateTime,size,folder,file,parentReference",
+            order_by="name",
+        )
+        if normalized_path:
+            graph_path = f"/v1.0/me/drive/root:/{quote(normalized_path, safe='/')}:/children"
+        else:
+            graph_path = "/v1.0/me/drive/root/children"
+        return self._perform_graph_request(
+            "list_drive_items",
+            "GET",
+            graph_path,
+            ["Files.Read"],
+            params=params,
+            paginate=True,
+            max_items=top,
+            additional_headers=headers,
+        )
 
     @plugin_function_logger("MSGraphPlugin")
     @kernel_function(description="Get recent security alerts for the signed-in user.")
     def get_my_security_alerts(self, top: int = 5) -> dict:
-        token = self._get_token(["SecurityEvents.Read.All"])
-        headers = {"Authorization": f"Bearer {token}"}
-        params = {"$top": top}
-        base = self.manifest.get("endpoint", "https://graph.microsoft.com").rstrip("/")
-        url = base + "/v1.0/security/alerts"
-        resp = requests.get(url, headers=headers, params=params)
-        resp.raise_for_status()
-        return resp.json()
+        params, headers = self._build_odata_params(
+            top=top,
+            order_by="createdDateTime desc",
+        )
+        return self._perform_graph_request(
+            "get_my_security_alerts",
+            "GET",
+            "/v1.0/security/alerts",
+            ["SecurityEvents.Read.All"],
+            params=params,
+            paginate=True,
+            max_items=top,
+            additional_headers=headers,
+        )
diff --git a/application/single_app/semantic_kernel_plugins/plugin_health_checker.py b/application/single_app/semantic_kernel_plugins/plugin_health_checker.py
index 962d0cf2..4e64797b 100644
--- a/application/single_app/semantic_kernel_plugins/plugin_health_checker.py
+++ b/application/single_app/semantic_kernel_plugins/plugin_health_checker.py
@@ -129,7 +129,7 @@ def check_plugin_health(plugin_instance: BasePlugin, plugin_name: str) -> Dict[s
                         getattr(attr, '__module__', '').startswith('semantic_kernel')
                     ):
                         kernel_functions.append(attr_name)
-                except:
+                except Exception as ex:
                     continue
             
             health_report['info']['kernel_functions'] = kernel_functions
diff --git a/application/single_app/semantic_kernel_plugins/plugin_invocation_logger.py b/application/single_app/semantic_kernel_plugins/plugin_invocation_logger.py
index bddf9cda..7dd66517 100644
--- a/application/single_app/semantic_kernel_plugins/plugin_invocation_logger.py
+++ b/application/single_app/semantic_kernel_plugins/plugin_invocation_logger.py
@@ -20,6 +20,21 @@
 from functions_debug import debug_print
 
 
+@dataclass
+class PluginInvocationStart:
+    """Data class for tracking plugin invocation starts."""
+    plugin_name: str
+    function_name: str
+    parameters: Dict[str, Any]
+    user_id: Optional[str]
+    timestamp: str
+    conversation_id: Optional[str] = None
+
+    def to_dict(self) -> Dict[str, Any]:
+        """Convert to dictionary for logging."""
+        return asdict(self)
+
+
 @dataclass
 class PluginInvocation:
     """Data class for tracking plugin invocations."""
@@ -53,7 +68,12 @@ def __init__(self):
         self.max_history = 1000  # Keep last 1000 invocations in memory
         self.logger = get_appinsights_logger() or logging.getLogger(__name__)
         self._callbacks: Dict[str, List[Callable[[PluginInvocation], None]]] = {}
+        self._start_callbacks: Dict[str, List[Callable[[PluginInvocationStart], None]]] = {}
         self._callback_lock = threading.Lock()
+
+    def log_invocation_start(self, invocation_start: PluginInvocationStart):
+        """Fire callbacks for the start of a plugin invocation."""
+        self._fire_start_callbacks(invocation_start)
         
     def log_invocation(self, invocation: PluginInvocation):
         """Log a plugin invocation to Application Insights and local history."""
@@ -295,10 +315,29 @@ def register_callback(self, key, callback):
                 self._callbacks[key] = []
             self._callbacks[key].append(callback)
 
+    def register_start_callback(self, key, callback):
+        """Register a callback fired when a plugin invocation starts for the given key."""
+        with self._callback_lock:
+            if key not in self._start_callbacks:
+                self._start_callbacks[key] = []
+            self._start_callbacks[key].append(callback)
+
     def deregister_callbacks(self, key):
-        """Remove all callbacks for the given key."""
+        """Remove all completion and start callbacks for the given key."""
         with self._callback_lock:
             self._callbacks.pop(key, None)
+            self._start_callbacks.pop(key, None)
+
+    def _fire_start_callbacks(self, invocation_start):
+        """Fire matching callbacks for the start of a plugin invocation."""
+        key = f"{invocation_start.user_id}:{invocation_start.conversation_id}"
+        with self._callback_lock:
+            callbacks = list(self._start_callbacks.get(key, []))
+        for cb in callbacks:
+            try:
+                cb(invocation_start)
+            except Exception as e:
+                log_event(f"Plugin invocation start callback error: {e}", level="WARNING")
 
     def _fire_callbacks(self, invocation):
         """Fire matching callbacks for this invocation's user+conversation."""
@@ -321,24 +360,51 @@ def get_plugin_logger() -> PluginInvocationLogger:
     return _plugin_logger
 
 
-def log_plugin_invocation(plugin_name: str, function_name: str, 
-                         parameters: Dict[str, Any], result: Any,
-                         start_time: float, end_time: float, 
-                         success: bool = True, error_message: Optional[str] = None,
-                         conversation_id: Optional[str] = None):
-    """Convenience function to log a plugin invocation."""
+def _resolve_invocation_context(conversation_id: Optional[str] = None):
+    """Resolve user and conversation context for plugin invocation logging."""
     try:
         user_id = get_current_user_id()
     except Exception:
         user_id = None
-    
-    # Try to get conversation_id from Flask context if not provided
+
     if conversation_id is None:
         try:
             from flask import g
             conversation_id = getattr(g, 'conversation_id', None)
         except Exception:
             conversation_id = None
+
+    return user_id, conversation_id
+
+
+def log_plugin_invocation_started(
+    plugin_name: str,
+    function_name: str,
+    parameters: Dict[str, Any],
+    conversation_id: Optional[str] = None,
+):
+    """Convenience function to log the start of a plugin invocation."""
+    user_id, resolved_conversation_id = _resolve_invocation_context(conversation_id)
+
+    invocation_start = PluginInvocationStart(
+        plugin_name=plugin_name,
+        function_name=function_name,
+        parameters=parameters,
+        user_id=user_id,
+        conversation_id=resolved_conversation_id,
+        timestamp=datetime.utcnow().isoformat(),
+    )
+
+    _plugin_logger.log_invocation_start(invocation_start)
+
+
+def log_plugin_invocation(plugin_name: str, function_name: str, 
+                         parameters: Dict[str, Any], result: Any,
+                         start_time: float, end_time: float, 
+                         success: bool = True, error_message: Optional[str] = None,
+                         conversation_id: Optional[str] = None):
+    """Convenience function to log a plugin invocation."""
+    user_id, resolved_conversation_id = _resolve_invocation_context(conversation_id)
     
     invocation = PluginInvocation(
         plugin_name=plugin_name,
@@ -349,7 +415,7 @@ def log_plugin_invocation(plugin_name: str, function_name: str,
         end_time=end_time,
         duration_ms=(end_time - start_time) * 1000,
         user_id=user_id,
-        conversation_id=conversation_id,
+        conversation_id=resolved_conversation_id,
         timestamp=datetime.utcnow().isoformat(),
         success=success,
         error_message=error_message
@@ -447,14 +513,26 @@ def _log_failure(function_name: str, error: Exception, duration_ms: float):
                 level=logging.ERROR
             )
 
+        def _resolve_function_name(wrapper_func: Callable) -> str:
+            return (
+                getattr(wrapper_func, '__kernel_function_name__', None)
+                or getattr(func, '__kernel_function_name__', None)
+                or getattr(func, '__name__', 'unknown')
+            )
+
         if is_async_callable:
             @functools.wraps(func)
             async def wrapper(*args, **kwargs):
                 start_time = time.time()
-                function_name = func.__name__
+                function_name = _resolve_function_name(wrapper)
                 _log_start(function_name)
                 parameters = _build_parameters(args, kwargs)
                 _log_parameters(function_name, parameters)
+                log_plugin_invocation_started(
+                    plugin_name=plugin_name,
+                    function_name=function_name,
+                    parameters=parameters,
+                )
 
                 try:
                     result = await func(*args, **kwargs)
@@ -495,10 +573,15 @@ async def wrapper(*args, **kwargs):
             @functools.wraps(func)
             def wrapper(*args, **kwargs):
                 start_time = time.time()
-                function_name = func.__name__
+                function_name = _resolve_function_name(wrapper)
                 _log_start(function_name)
                 parameters = _build_parameters(args, kwargs)
                 _log_parameters(function_name, parameters)
+                log_plugin_invocation_started(
+                    plugin_name=plugin_name,
+                    function_name=function_name,
+                    parameters=parameters,
+                )
 
                 try:
                     result = func(*args, **kwargs)
@@ -581,6 +664,8 @@ async def _await_and_log(awaitable_result):
 
                     raise
 
+        setattr(wrapper, '__plugin_invocation_logger_wrapped__', True)
+
         return wrapper
     return decorator
 
@@ -593,13 +678,21 @@ def wrap_kernel_function(original_func: Callable, plugin_name: str) -> Callable:
 def auto_wrap_plugin_functions(plugin_instance, plugin_name: str):
     """Automatically wrap all kernel_function decorated methods in a plugin instance."""
     for attr_name in dir(plugin_instance):
+        if attr_name.startswith('_'):
+            continue
+
         attr = getattr(plugin_instance, attr_name)
-        
+
         # Check if it's a method with the kernel_function decorator
-        if (callable(attr) and 
-            hasattr(attr, '__annotations__') and 
-            hasattr(attr, '__sk_function__')):  # SK functions have this attribute
-            
+        if not callable(attr):
+            continue
+
+        if getattr(attr, '__plugin_invocation_logger_wrapped__', False):
+            continue
+
+        if getattr(attr, '__kernel_function__', False) or getattr(attr, '__sk_function__', False):
             # Wrap the method
             wrapped_method = plugin_function_logger(plugin_name)(attr)
-            setattr(plugin_instance, attr_name, wrapped_method)
+            object.__setattr__(plugin_instance, attr_name, wrapped_method)
+
+    return plugin_instance
diff --git a/application/single_app/semantic_kernel_plugins/plugin_invocation_thoughts.py b/application/single_app/semantic_kernel_plugins/plugin_invocation_thoughts.py
new file mode 100644
index 00000000..c400ed11
--- /dev/null
+++ b/application/single_app/semantic_kernel_plugins/plugin_invocation_thoughts.py
@@ -0,0 +1,198 @@
+# plugin_invocation_thoughts.py
+"""Helpers for turning plugin invocations into thought records."""
+
+
+EXCLUDED_PARAMETER_NAMES = {
+    'conversation_id',
+    'group_id',
+    'public_workspace_id',
+    'scope_id',
+    'thread_id',
+    'user_id',
+}
+
+
+def _get_parameter_value(parameters, *names):
+    for name in names:
+        if name in parameters:
+            return parameters[name]
+    return None
+
+
+def _format_value(value, max_length=60):
+    if value is None:
+        return None
+
+    rendered_value = str(value)
+    if len(rendered_value) > max_length:
+        return f"{rendered_value[: max_length - 3]}..."
+    return rendered_value
+
+
+def _format_duration_suffix(invocation):
+    duration_ms = getattr(invocation, 'duration_ms', None)
+    return f" ({int(duration_ms)}ms)" if duration_ms else ""
+
+
+def _format_success_suffix(invocation):
+    return " failed" if not getattr(invocation, 'success', True) else ""
+
+
+def _format_generic_parameter_summary(parameters):
+    rendered_items = []
+    for parameter_name, parameter_value in (parameters or {}).items():
+        if parameter_name in EXCLUDED_PARAMETER_NAMES:
+            continue
+
+        rendered_value = _format_value(parameter_value, max_length=24)
+        if rendered_value is None:
+            continue
+
+        rendered_items.append(f"{parameter_name}={rendered_value}")
+        if len(rendered_items) == 2:
+            break
+
+    if not rendered_items:
+        return ""
+    return f" [{', '.join(rendered_items)}]"
+
+
+def _format_wait_content(invocation, actor_label, parameters):
+    seconds = _get_parameter_value(parameters, 'input', 'seconds', 'arg_0')
+    rendered_seconds = _format_value(seconds, max_length=20) or 'the requested interval'
+    return f"{actor_label} invoked wait for {rendered_seconds} seconds{_format_duration_suffix(invocation)}{_format_success_suffix(invocation)}"
+
+
+def _format_math_content(invocation, actor_label, parameters):
+    function_name = getattr(invocation, 'function_name', '')
+    result = getattr(invocation, 'result', None)
+    input_value = _format_value(_get_parameter_value(parameters, 'input', 'arg_0'), max_length=20)
+    amount_value = _format_value(_get_parameter_value(parameters, 'amount', 'arg_1'), max_length=20)
+    exponent_value = _format_value(_get_parameter_value(parameters, 'exponent', 'arg_1'), max_length=20)
+    symbol_map = {
+        'Add': ('+', amount_value),
+        'Subtract': ('-', amount_value),
+        'Multiply': ('*', amount_value),
+        'Divide': ('/', amount_value),
+        'Modulus': ('%', amount_value),
+        'Power': ('^', exponent_value),
+    }
+
+    if function_name == 'SquareRoot':
+        math_summary = f"sqrt({input_value})"
+    elif function_name in symbol_map and input_value is not None and symbol_map[function_name][1] is not None:
+        operator_symbol, right_hand_value = symbol_map[function_name]
+        math_summary = f"{input_value} {operator_symbol} {right_hand_value}"
+    else:
+        math_summary = function_name
+
+    rendered_result = _format_value(result, max_length=30)
+    result_suffix = f" = {rendered_result}" if rendered_result is not None and getattr(invocation, 'success', True) else ""
+    return f"{actor_label} performed math: {math_summary}{result_suffix}{_format_duration_suffix(invocation)}{_format_success_suffix(invocation)}"
+
+
+def _format_plugin_content(invocation, actor_label, parameters):
+    plugin_name = getattr(invocation, 'plugin_name', '')
+    function_name = getattr(invocation, 'function_name', '')
+
+    if plugin_name == 'WaitPlugin' and function_name == 'wait':
+        return _format_wait_content(invocation, actor_label, parameters)
+
+    if plugin_name == 'MathPlugin':
+        return _format_math_content(invocation, actor_label, parameters)
+
+    parameter_summary = _format_generic_parameter_summary(parameters)
+    return (
+        f"{actor_label} executed {plugin_name}.{function_name}"
+        f"{parameter_summary}{_format_duration_suffix(invocation)}{_format_success_suffix(invocation)}"
+    )
+
+
+def _format_plugin_detail(invocation, parameters):
+    detail_parts = []
+
+    for parameter_name, parameter_value in (parameters or {}).items():
+        if parameter_name in EXCLUDED_PARAMETER_NAMES:
+            continue
+
+        rendered_value = _format_value(parameter_value, max_length=80)
+        if rendered_value is None:
+            continue
+
+        detail_parts.append(f"{parameter_name}={rendered_value}")
+
+    result = getattr(invocation, 'result', None)
+    rendered_result = _format_value(result, max_length=120)
+    if rendered_result is not None and getattr(invocation, 'success', True):
+        detail_parts.append(f"result={rendered_result}")
+
+    error_message = getattr(invocation, 'error_message', None)
+    if error_message:
+        detail_parts.append(f"error={_format_value(error_message, max_length=120)}")
+
+    detail_parts.append(f"success={getattr(invocation, 'success', True)}")
+    return '; '.join(detail_parts)
+
+
+def format_plugin_invocation_start_thought(invocation_start):
+    """Build a concise thought payload for an in-flight plugin invocation."""
+    plugin_name = getattr(invocation_start, 'plugin_name', 'Plugin')
+    function_name = getattr(invocation_start, 'function_name', 'function')
+    parameters = getattr(invocation_start, 'parameters', {}) or {}
+    detail = '; '.join(
+        f"{parameter_name}={_format_value(parameter_value, max_length=80)}"
+        for parameter_name, parameter_value in parameters.items()
+        if parameter_name not in EXCLUDED_PARAMETER_NAMES and _format_value(parameter_value, max_length=80) is not None
+    )
+    return {
+        'step_type': 'agent_tool_call',
+        'content': f"Invoking {plugin_name}.{function_name}",
+        'detail': detail or None,
+    }
+
+
+def format_plugin_invocation_thought(invocation, actor_label='Agent'):
+    """Build a thought payload from a logged plugin invocation."""
+    parameters = getattr(invocation, 'parameters', {}) or {}
+    return {
+        'step_type': 'agent_tool_call',
+        'content': _format_plugin_content(invocation, actor_label, parameters),
+        'detail': _format_plugin_detail(invocation, parameters),
+    }
+
+
+def register_plugin_invocation_thought_callback(
+    plugin_logger,
+    thought_tracker,
+    user_id,
+    conversation_id,
+    actor_label='Agent',
+    live_thought_callback=None,
+):
+    """Register a logger callback that writes plugin invocation thoughts."""
+    callback_key = f"{user_id}:{conversation_id}"
+
+    def add_and_publish_live_thought(thought_payload):
+        thought_tracker.add_thought(
+            thought_payload['step_type'],
+            thought_payload['content'],
+            detail=thought_payload['detail']
+        )
+
+        if callable(live_thought_callback):
+            live_payload = dict(thought_payload)
+            live_payload['message_id'] = getattr(thought_tracker, 'message_id', None)
+            live_payload['step_index'] = thought_tracker.current_index - 1
+            live_thought_callback(live_payload)
+
+    def on_plugin_invocation_start(invocation_start):
+        thought_payload = format_plugin_invocation_start_thought(invocation_start)
+        add_and_publish_live_thought(thought_payload)
+
+    def on_plugin_invocation(invocation):
+        thought_payload = format_plugin_invocation_thought(invocation, actor_label=actor_label)
+        add_and_publish_live_thought(thought_payload)
+
+    plugin_logger.register_start_callback(callback_key, on_plugin_invocation_start)
+    plugin_logger.register_callback(callback_key, on_plugin_invocation)
+    return callback_key
\ No newline at end of file
diff --git a/application/single_app/semantic_kernel_plugins/smart_http_plugin.py b/application/single_app/semantic_kernel_plugins/smart_http_plugin.py
index 2292e7bc..6ec0444e 100644
--- a/application/single_app/semantic_kernel_plugins/smart_http_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/smart_http_plugin.py
@@ -343,7 +343,7 @@ def _process_json_content(self, json_content: str) -> str:
             parsed = json.loads(json_content)
             formatted = json.dumps(parsed, indent=2, ensure_ascii=False)
             return self._truncate_content(formatted, "JSON content")
-        except:
+        except Exception as ex:
             return self._truncate_content(json_content, "Raw JSON content")
     
     def _clean_text(self, text: str) -> str:
diff --git a/application/single_app/semantic_kernel_plugins/sql_query_plugin.py b/application/single_app/semantic_kernel_plugins/sql_query_plugin.py
index 084c4c9b..6eba26f8 100644
--- a/application/single_app/semantic_kernel_plugins/sql_query_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/sql_query_plugin.py
@@ -577,5 +577,5 @@ def __del__(self):
         if hasattr(self, '_connection') and self._connection:
             try:
                 self._connection.close()
-            except:
+            except Exception as ex:
                 pass
diff --git a/application/single_app/semantic_kernel_plugins/sql_schema_plugin.py b/application/single_app/semantic_kernel_plugins/sql_schema_plugin.py
index 380b9a5f..0b2f2898 100644
--- a/application/single_app/semantic_kernel_plugins/sql_schema_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/sql_schema_plugin.py
@@ -612,5 +612,5 @@ def __del__(self):
         if hasattr(self, '_connection') and self._connection:
             try:
                 self._connection.close()
-            except:
+            except Exception as ex:
                 pass
diff --git a/application/single_app/semantic_kernel_plugins/text_plugin.py b/application/single_app/semantic_kernel_plugins/text_plugin.py
index b2b21288..d814eb4f 100644
--- a/application/single_app/semantic_kernel_plugins/text_plugin.py
+++ b/application/single_app/semantic_kernel_plugins/text_plugin.py
@@ -1,78 +1,13 @@
-# Copyright (c) Microsoft. All rights reserved.
+# text_plugin.py
 
-from semantic_kernel.functions.kernel_function_decorator import kernel_function
-from semantic_kernel.kernel_pydantic import KernelBaseModel
+from semantic_kernel.core_plugins.text_plugin import TextPlugin as SKTextPlugin
 
+from semantic_kernel_plugins.plugin_invocation_logger import auto_wrap_plugin_functions
 
-class TextPlugin(KernelBaseModel):
-    """TextPlugin provides a set of functions to manipulate strings.
 
-    Usage:
-        kernel.add_plugin(TextPlugin(), plugin_name="text")
+class TextPlugin(SKTextPlugin):
+    """Text plugin with invocation logging for all kernel functions."""
 
-    Examples:
-        KernelArguments["input"] = "  hello world  "
-        {{text.trim $input}} => "hello world"
-
-        KernelArguments["input"] = "  hello world  "
-        {{text.trimStart $input}} => "hello world  "
-
-        KernelArguments["input"] = "  hello world  "
-        {{text.trimEnd $input}} => "  hello world"
-
-        KernelArguments["input"] = "hello world"
-        {{text.uppercase $input}} => "HELLO WORLD"
-
-        KernelArguments["input"] = "HELLO WORLD"
-        {{text.lowercase $input}} => "hello world"
-    """
-
-    @kernel_function(description="Trim whitespace from the start and end of a string.")
-    def trim(self, input: str) -> str:
-        """Trim whitespace from the start and end of a string.
-
-        Example:
-            KernelArguments["input"] = "  hello world  "
-            {{text.trim $input}} => "hello world"
-        """
-        return input.strip()
-
-    @kernel_function(description="Trim whitespace from the start of a string.")
-    def trim_start(self, input: str) -> str:
-        """Trim whitespace from the start of a string.
-
-        Example:
-             KernelArguments["input"] = "  hello world  "
-             {{input.trim $input}} => "hello world  "
-        """
-        return input.lstrip()
-
-    @kernel_function(description="Trim whitespace from the end of a string.")
-    def trim_end(self, input: str) -> str:
-        """Trim whitespace from the end of a string.
-
-        Example:
-             KernelArguments["input"] = "  hello world  "
-             {{input.trim $input}} => "  hello world"
-        """
-        return input.rstrip()
-
-    @kernel_function(description="Convert a string to uppercase.")
-    def uppercase(self, input: str) -> str:
-        """Convert a string to uppercase.
-
-        Example:
-            KernelArguments["input"] = "hello world"
-             {{input.uppercase $input}} => "HELLO WORLD"
-        """
-        return input.upper()
-
-    @kernel_function(description="Convert a string to lowercase.")
-    def lowercase(self, input: str) -> str:
-        """Convert a string to lowercase.
-
-        Example:
-             KernelArguments["input"] = "HELLO WORLD"
-             {{input.lowercase $input}} => "hello world"
-        """
-        return input.lower()
\ No newline at end of file
+    def __init__(self, **data):
+        super().__init__(**data)
+        auto_wrap_plugin_functions(self, self.__class__.__name__)
\ No newline at end of file
diff --git a/application/single_app/semantic_kernel_plugins/time_plugin.py b/application/single_app/semantic_kernel_plugins/time_plugin.py
new file mode 100644
index 00000000..4873e83a
--- /dev/null
+++ b/application/single_app/semantic_kernel_plugins/time_plugin.py
@@ -0,0 +1,14 @@
+# time_plugin.py
+"""Logged wrapper for the Semantic Kernel TimePlugin."""
+
+from semantic_kernel.core_plugins.time_plugin import TimePlugin as SKTimePlugin
+
+from semantic_kernel_plugins.plugin_invocation_logger import auto_wrap_plugin_functions
+
+
+class TimePlugin(SKTimePlugin):
+    """Time plugin with invocation logging for all kernel functions."""
+
+    def __init__(self, **data):
+        super().__init__(**data)
+        auto_wrap_plugin_functions(self, self.__class__.__name__)
\ No newline at end of file
diff --git a/application/single_app/semantic_kernel_plugins/wait_plugin.py b/application/single_app/semantic_kernel_plugins/wait_plugin.py
new file mode 100644
index 00000000..03e2096a
--- /dev/null
+++ b/application/single_app/semantic_kernel_plugins/wait_plugin.py
@@ -0,0 +1,14 @@
+# wait_plugin.py
+"""Logged wrapper for the Semantic Kernel WaitPlugin."""
+
+from semantic_kernel.core_plugins.wait_plugin import WaitPlugin as SKWaitPlugin
+
+from semantic_kernel_plugins.plugin_invocation_logger import auto_wrap_plugin_functions
+
+
+class WaitPlugin(SKWaitPlugin):
+    """Wait plugin with invocation logging for all kernel functions."""
+
+    def __init__(self, **data):
+        super().__init__(**data)
+        auto_wrap_plugin_functions(self, self.__class__.__name__)
\ No newline at end of file
diff --git a/application/single_app/static/css/chats.css b/application/single_app/static/css/chats.css
index 8bdd0711..0a742d80 100644
--- a/application/single_app/static/css/chats.css
+++ b/application/single_app/static/css/chats.css
@@ -52,8 +52,8 @@
 
 .chat-toolbar {
   display: flex;
-  flex-wrap: wrap;
-  align-items: center;
+  flex-wrap: nowrap;
+  align-items: flex-end;
   gap: 0.75rem;
 }
 
@@ -68,32 +68,32 @@
 }
 
 .chat-toolbar-actions {
-  flex: 1 1 320px;
+  flex: 1 1 auto;
   flex-wrap: wrap;
 }
 
 .chat-toolbar-controls {
-  flex: 1 1 540px;
-  flex-wrap: wrap;
+  flex: 0 1 auto;
+  flex-wrap: nowrap;
   justify-content: flex-end;
-  align-items: center;
+  align-items: flex-end;
   margin-left: auto;
 }
 
 .chat-toolbar-toggles {
   flex: 0 0 auto;
-  flex-wrap: wrap;
+  flex-wrap: nowrap;
   justify-content: flex-end;
 }
 
 .chat-toolbar-selectors {
-  flex: 1 1 460px;
-  flex-wrap: wrap;
+  flex: 0 1 auto;
+  flex-wrap: nowrap;
   justify-content: flex-end;
 }
 
 .chat-toolbar-selector {
-  flex: 1 1 200px;
+  flex: 0 1 200px;
   min-width: 180px;
   max-width: 280px;
 }
@@ -183,26 +183,54 @@
 }
 
 @media (max-width: 1200px) {
-  .chat-toolbar-controls,
-  .chat-toolbar-selectors {
+  .chat-toolbar {
+    flex-wrap: wrap;
+    align-items: center;
+  }
+
+  .chat-toolbar-actions {
+    flex: 1 1 100%;
+  }
+
+  .chat-toolbar-controls {
+    flex: 1 1 100%;
+    flex-wrap: wrap;
     justify-content: flex-start;
     margin-left: 0;
   }
+
+  .chat-toolbar-selectors {
+    flex: 1 1 auto;
+    flex-wrap: wrap;
+    justify-content: flex-start;
+  }
+
+  .chat-toolbar-toggles {
+    justify-content: flex-start;
+  }
 }
 
 @media (max-width: 768px) {
+  .chat-toolbar {
+    flex-wrap: wrap;
+    align-items: center;
+  }
+
   .chat-toolbar-controls {
     flex-basis: 100%;
+    flex-wrap: wrap;
     justify-content: flex-start;
     margin-left: 0;
   }
 
   .chat-toolbar-selectors {
     flex-basis: 100%;
+    flex-wrap: wrap;
   }
 
   .chat-toolbar-toggles {
     width: 100%;
+    flex-wrap: wrap;
   }
 
   .chat-toolbar-selector {
diff --git a/application/single_app/static/css/sidebar.css b/application/single_app/static/css/sidebar.css
index 932051c6..1b3f7eb8 100644
--- a/application/single_app/static/css/sidebar.css
+++ b/application/single_app/static/css/sidebar.css
@@ -1,5 +1,11 @@
 /* Sidebar Navigation Styles */
 
+:root {
+  --sidebar-width: 260px;
+  --sidebar-min-width: 100px;
+  --sidebar-max-width: 800px;
+}
+
 /* Base body adjustments for sidebar layout */
 body.sidebar-nav-enabled {
   padding-left: 0 !important; /* Remove body padding since we're using margin on containers */
@@ -28,8 +34,8 @@ body.sidebar-nav-enabled nav.navbar {
 body.sidebar-nav-enabled .main-content,
 body.sidebar-nav-enabled .container,
 body.sidebar-nav-enabled .container-fluid {
-  margin-left: 260px !important; /* Same as sidebar width */
-  max-width: calc(100% - 260px) !important; /* Prevent overflow */
+  margin-left: var(--sidebar-width) !important; /* Same as sidebar width */
+  max-width: calc(100% - var(--sidebar-width)) !important; /* Prevent overflow */
   margin-right: 0 !important;
   width: auto !important;
   transition: margin-left 0.3s ease-in-out;
@@ -148,6 +154,25 @@ body.sidebar-nav-enabled.has-classification-banner .container-fluid {
   padding-bottom: 0.25rem !important;
 }
 
+.sidebar-resize-handle {
+  position: absolute;
+  top: 0;
+  right: -4px;
+  width: 10px;
+  height: 100%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  cursor: col-resize;
+  z-index: 1051;
+  color: var(--bs-border-color, #dee2e6);
+}
+
+.sidebar-resize-handle i {
+  pointer-events: none;
+  font-size: 0.9rem;
+}
+
 .sidebar-conversation-item {
   cursor: pointer;
   padding: 8px 12px;
diff --git a/application/single_app/static/js/admin/admin_agent_templates.js b/application/single_app/static/js/admin/admin_agent_templates.js
index 4bea4924..ff939cc0 100644
--- a/application/single_app/static/js/admin/admin_agent_templates.js
+++ b/application/single_app/static/js/admin/admin_agent_templates.js
@@ -35,8 +35,15 @@ let currentFilter = "pending";
 let templates = [];
 let selectedTemplate = null;
 let reviewModal = null;
+let deleteConfirmModal = null;
+let deleteConfirmError = null;
+let deleteConfirmName = null;
+let confirmDeleteBtn = null;
 let currentPage = 1;
 let searchQuery = "";
+let pendingDeleteRequest = null;
+let restoreReviewModalAfterDelete = false;
+let deleteConfirmed = false;
 const PAGE_SIZE = 10;
 
 function init() {
@@ -48,6 +55,8 @@ function init() {
     reviewModal = bootstrap.Modal.getOrCreateInstance(modalEl);
   }
 
+  ensureDeleteConfirmModal();
+
   if (!window.appSettings?.enable_agent_template_gallery) {
     if (disabledAlert) disabledAlert.classList.remove("d-none");
     renderEmptyState("Template gallery is disabled.");
@@ -96,7 +105,7 @@ function attachTableHandlers() {
     const deleteBtn = event.target.closest(".agent-template-inline-delete");
     if (deleteBtn) {
       const templateId = deleteBtn.dataset.templateId;
-      confirmAndDelete(templateId);
+      requestDeleteConfirmation(templateId);
     }
   });
 }
@@ -110,11 +119,63 @@ function attachModalHandlers() {
   rejectBtn.addEventListener("click", () => handleRejection());
   deleteBtn.addEventListener("click", () => {
     if (selectedTemplate?.id) {
-      confirmAndDelete(selectedTemplate.id, true);
+      requestDeleteConfirmation(selectedTemplate.id, true);
     }
   });
 }
 
+function ensureDeleteConfirmModal() {
+  if (!window.bootstrap) {
+    return;
+  }
+
+  let confirmModalEl = document.getElementById("agentTemplateDeleteConfirmModal");
+  if (!confirmModalEl) {
+    document.body.insertAdjacentHTML(
+      "beforeend",
+      `
+        <div class="modal fade" id="agentTemplateDeleteConfirmModal" tabindex="-1" aria-labelledby="agentTemplateDeleteConfirmModalLabel" aria-hidden="true">
+          <div class="modal-dialog modal-dialog-centered">
+            <div class="modal-content">
+              <div class="modal-header">
+                <h5 class="modal-title" id="agentTemplateDeleteConfirmModalLabel">Delete Template Submission</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+              </div>
+              <div class="modal-body">
+                <p class="mb-3">Are you sure you want to delete <span class="fw-semibold" id="agent-template-delete-confirm-name">this template</span>? This action cannot be undone.</p>
+                <div id="agent-template-delete-confirm-error" class="alert alert-danger d-none mb-0" role="alert"></div>
+              </div>
+              <div class="modal-footer">
+                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Cancel</button>
+                <button type="button" class="btn btn-danger" id="agent-template-confirm-delete-btn">
+                  <i class="bi bi-trash"></i>
+                  Delete Template
+                </button>
+              </div>
+            </div>
+          </div>
+        </div>
+      `,
+    );
+    confirmModalEl = document.getElementById("agentTemplateDeleteConfirmModal");
+  }
+
+  deleteConfirmModal = bootstrap.Modal.getOrCreateInstance(confirmModalEl);
+  deleteConfirmError = document.getElementById("agent-template-delete-confirm-error");
+  deleteConfirmName = document.getElementById("agent-template-delete-confirm-name");
+  confirmDeleteBtn = document.getElementById("agent-template-confirm-delete-btn");
+
+  if (confirmDeleteBtn && !confirmDeleteBtn.dataset.bound) {
+    confirmDeleteBtn.addEventListener("click", () => executePendingDelete());
+    confirmDeleteBtn.dataset.bound = "true";
+  }
+
+  if (!confirmModalEl.dataset.bound) {
+    confirmModalEl.addEventListener("hidden.bs.modal", handleDeleteConfirmModalHidden);
+    confirmModalEl.dataset.bound = "true";
+  }
+}
+
 function attachSearchHandler() {
   if (!searchInput) {
     return;
@@ -476,29 +537,119 @@ function setModalButtonsDisabled(disabled) {
   });
 }
 
-async function confirmAndDelete(templateId, closeModal = false) {
+function requestDeleteConfirmation(templateId, closeModal = false) {
   if (!templateId) {
     return;
   }
-  if (!confirm('Delete this template? This action cannot be undone.')) {
+
+  ensureDeleteConfirmModal();
+  if (!deleteConfirmModal) {
+    showToast("Delete confirmation is unavailable.", "danger");
+    return;
+  }
+
+  const templateName = getTemplateName(templateId);
+  pendingDeleteRequest = {
+    templateId,
+    closeModal,
+  };
+  restoreReviewModalAfterDelete = closeModal;
+  deleteConfirmed = false;
+  hideDeleteConfirmError();
+  setDeleteConfirmBusy(false);
+  if (deleteConfirmName) {
+    deleteConfirmName.textContent = templateName;
+  }
+
+  if (closeModal && reviewModal) {
+    modalEl?.addEventListener("hidden.bs.modal", showDeleteConfirmAfterReviewModal, { once: true });
+    reviewModal.hide();
+    return;
+  }
+
+  deleteConfirmModal.show();
+}
+
+function showDeleteConfirmAfterReviewModal() {
+  deleteConfirmModal?.show();
+}
+
+function handleDeleteConfirmModalHidden() {
+  hideDeleteConfirmError();
+  setDeleteConfirmBusy(false);
+
+  if (restoreReviewModalAfterDelete && !deleteConfirmed && selectedTemplate?.id === pendingDeleteRequest?.templateId) {
+    reviewModal?.show();
+  }
+
+  pendingDeleteRequest = null;
+  restoreReviewModalAfterDelete = false;
+  deleteConfirmed = false;
+}
+
+function hideDeleteConfirmError() {
+  if (!deleteConfirmError) {
+    return;
+  }
+  deleteConfirmError.classList.add("d-none");
+  deleteConfirmError.textContent = "";
+}
+
+function showDeleteConfirmError(message) {
+  if (!deleteConfirmError) {
+    showToast(message, "danger");
+    return;
+  }
+  deleteConfirmError.classList.remove("d-none");
+  deleteConfirmError.textContent = message;
+}
+
+function setDeleteConfirmBusy(disabled) {
+  if (confirmDeleteBtn) {
+    confirmDeleteBtn.disabled = disabled;
+  }
+}
+
+function getTemplateName(templateId) {
+  if (selectedTemplate?.id === templateId) {
+    return selectedTemplate.title || selectedTemplate.display_name || "this template";
+  }
+
+  const matchingTemplate = templates.find((template) => template.id === templateId);
+  return matchingTemplate?.title || matchingTemplate?.display_name || "this template";
+}
+
+async function executePendingDelete() {
+  const templateId = pendingDeleteRequest?.templateId;
+  const closeModal = pendingDeleteRequest?.closeModal;
+
+  if (!templateId) {
     return;
   }
+
   try {
+    setDeleteConfirmBusy(true);
+    hideDeleteConfirmError();
     const response = await fetch(`/api/admin/agent-templates/${templateId}`, {
-      method: 'DELETE'
+      method: "DELETE"
     });
     const data = await response.json().catch(() => ({}));
     if (!response.ok) {
-      throw new Error(data.error || 'Failed to delete template.');
+      throw new Error(data.error || "Failed to delete template.");
     }
-    showToast('Template deleted.', 'success');
+
+    deleteConfirmed = true;
+    showToast("Template deleted.", "success");
     if (closeModal) {
-      reviewModal?.hide();
+      selectedTemplate = null;
     }
+    deleteConfirmModal?.hide();
     loadTemplatesForFilter(currentFilter);
   } catch (error) {
-    console.error('Failed to delete template', error);
-    showToast(error.message || 'Failed to delete template.', 'danger');
+    console.error("Failed to delete template", error);
+    showDeleteConfirmError(error.message || "Failed to delete template.");
+  } finally {
+    setDeleteConfirmBusy(false);
   }
 }
 
diff --git a/application/single_app/static/js/admin/admin_model_endpoints.js b/application/single_app/static/js/admin/admin_model_endpoints.js
new file mode 100644
index 00000000..6177a74b
--- /dev/null
+++ b/application/single_app/static/js/admin/admin_model_endpoints.js
@@ -0,0 +1,894 @@
+// admin_model_endpoints.js
+
+import { showToast } from "../chat/chat-toast.js";
+
+const enableMultiEndpointToggle = document.getElementById("enable_multi_model_endpoints");
+const migrationWarning = document.getElementById("multi-endpoint-warning");
+const endpointsWrapper = document.getElementById("model-endpoints-wrapper");
+const endpointsTbody = document.getElementById("model-endpoints-tbody");
+const addEndpointBtn = document.getElementById("add-model-endpoint-btn");
+const endpointsInput = document.getElementById("model_endpoints_json");
+const defaultModelSelect = document.getElementById("default-model-selection");
+const defaultModelInput = document.getElementById("default_model_selection_json");
+const defaultModelWrapper = document.getElementById("default-model-selection-wrapper");
+
+const endpointModalEl = document.getElementById("modelEndpointModal");
+const endpointModal = endpointModalEl && window.bootstrap ? bootstrap.Modal.getOrCreateInstance(endpointModalEl) : null;
+
+const endpointIdInput = document.getElementById("model-endpoint-id");
+const endpointNameInput = document.getElementById("model-endpoint-name");
+const endpointProviderSelect = document.getElementById("model-endpoint-provider");
+const endpointUrlInput = document.getElementById("model-endpoint-endpoint");
+const endpointProjectGroup = document.getElementById("model-endpoint-project-group");
+const endpointProjectInput = document.getElementById("model-endpoint-project-name");
+const endpointProjectApiVersionGroup = document.getElementById("model-endpoint-project-api-version-group");
+const endpointProjectApiVersionInput = document.getElementById("model-endpoint-project-api-version");
+const endpointOpenAiApiVersionGroup = document.getElementById("model-endpoint-openai-api-version-group");
+const endpointOpenAiApiVersionInput = document.getElementById("model-endpoint-openai-api-version");
+const endpointSubscriptionGroup = document.getElementById("model-endpoint-subscription-group");
+const endpointResourceGroup = document.getElementById("model-endpoint-resource-group-group");
+const endpointSubscriptionInput = document.getElementById("model-endpoint-subscription-id");
+const endpointResourceGroupInput = document.getElementById("model-endpoint-resource-group");
+const endpointAuthTypeSelect = document.getElementById("model-endpoint-auth-type");
+const endpointManagementCloudGroup = document.getElementById("model-endpoint-management-cloud-group");
+const endpointManagementCloudSelect = document.getElementById("model-endpoint-management-cloud");
+const endpointCustomAuthorityGroup = document.getElementById("model-endpoint-custom-authority-group");
+const endpointCustomAuthorityInput = document.getElementById("model-endpoint-custom-authority");
+const endpointFoundryScopeGroup = document.getElementById("model-endpoint-foundry-scope-group");
+const endpointFoundryScopeInput = document.getElementById("model-endpoint-foundry-scope");
+const apiKeyNote = document.getElementById("model-endpoint-api-key-note");
+
+const miTypeGroup = document.getElementById("model-endpoint-mi-type-group");
+const miClientGroup = document.getElementById("model-endpoint-mi-client-group");
+const tenantGroup = document.getElementById("model-endpoint-tenant-group");
+const clientGroup = document.getElementById("model-endpoint-client-group");
+const secretGroup = document.getElementById("model-endpoint-secret-group");
+const apiKeyGroup = document.getElementById("model-endpoint-key-group");
+
+const miTypeSelect = document.getElementById("model-endpoint-mi-type");
+const miClientIdInput = document.getElementById("model-endpoint-mi-client-id");
+const tenantIdInput = document.getElementById("model-endpoint-tenant-id");
+const clientIdInput = document.getElementById("model-endpoint-client-id");
+const clientSecretInput = document.getElementById("model-endpoint-client-secret");
+const apiKeyInput = document.getElementById("model-endpoint-api-key");
+
+const fetchBtn = document.getElementById("model-endpoint-fetch-btn");
+const saveBtn = document.getElementById("model-endpoint-save-btn");
+const modelsListEl = document.getElementById("model-endpoint-models-list");
+const addModelBtn = document.getElementById("model-endpoint-add-model-btn");
+
+let modelEndpoints = Array.isArray(window.modelEndpoints) ? [...window.modelEndpoints] : [];
+let modalModels = [];
+let pendingDeleteEndpointId = null;
+let pendingDeleteTimeout = null;
+let defaultModelSelection = window.defaultModelSelection && typeof window.defaultModelSelection === "object"
+    ? { ...window.defaultModelSelection }
+    : {};
+
+const DEFAULT_AOAI_OPENAI_API_VERSION = "2024-05-01-preview";
+
+function generateId() {
+    if (window.crypto && window.crypto.randomUUID) {
+        return window.crypto.randomUUID();
+    }
+    return `id_${Math.random().toString(36).slice(2)}_${Date.now()}`;
+}
+
+function setElementVisibility(element, isVisible) {
+    if (!element) {
+        return;
+    }
+    element.classList.toggle("d-none", !isVisible);
+}
+
+function updateHiddenInput() {
+    if (!endpointsInput) {
+        return;
+    }
+    endpointsInput.value = JSON.stringify(modelEndpoints || []);
+}
+
+function normalizeDefaultModelSelection(selection) {
+    if (!selection || typeof selection !== "object") {
+        return {
+            endpoint_id: "",
+            model_id: "",
+            provider: ""
+        };
+    }
+    return {
+        endpoint_id: String(selection.endpoint_id || "").trim(),
+        model_id: String(selection.model_id || "").trim(),
+        provider: String(selection.provider || "").trim().toLowerCase()
+    };
+}
+
+function updateDefaultModelInput() {
+    if (!defaultModelInput) {
+        return;
+    }
+    defaultModelInput.value = JSON.stringify(defaultModelSelection || {});
+}
+
+function markModified() {
+    if (typeof window.markFormAsModified === "function") {
+        window.markFormAsModified();
+    }
+}
+
+function formatProviderLabel(provider) {
+    if (provider === "aifoundry") {
+        return "Foundry (classic)";
+    }
+    if (provider === "new_foundry") {
+        return "New Foundry";
+    }
+    return "Azure OpenAI";
+}
+
+function getDefaultOpenAiApiVersion(provider) {
+    return provider === "new_foundry" ? "" : DEFAULT_AOAI_OPENAI_API_VERSION;
+}
+
+function syncOpenAiApiVersionForProvider() {
+    if (!endpointOpenAiApiVersionInput) {
+        return;
+    }
+
+    const provider = endpointProviderSelect?.value || "aoai";
+    const currentValue = endpointOpenAiApiVersionInput.value.trim();
+    if (provider === "new_foundry") {
+        if (!currentValue || currentValue === DEFAULT_AOAI_OPENAI_API_VERSION) {
+            endpointOpenAiApiVersionInput.value = "";
+        }
+        return;
+    }
+
+    if (!currentValue) {
+        endpointOpenAiApiVersionInput.value = getDefaultOpenAiApiVersion(provider);
+    }
+}
+
+function collectSelectedModels(endpoint) {
+    const models = endpoint?.models || [];
+    const selected = models.filter((model) => model?.enabled);
+    if (!selected.length) {
+        return "No models selected";
+    }
+    const names = selected.map((model) => model.displayName || model.deploymentName || model.modelName || "Unnamed");
+    return names.join(", ");
+}
+
+function renderEndpoints() {
+    if (!endpointsTbody) {
+        return;
+    }
+
+    endpointsTbody.innerHTML = "";
+
+    if (!modelEndpoints.length) {
+        endpointsTbody.innerHTML = `
+            <tr>
+                <td colspan="5" class="text-center text-muted py-3">No endpoints configured yet.</td>
+            </tr>
+        `;
+        updateHiddenInput();
+        buildDefaultModelOptions();
+        return;
+    }
+
+    modelEndpoints.forEach((endpoint) => {
+        const row = document.createElement("tr");
+        const selectedModels = collectSelectedModels(endpoint);
+        const statusLabel = endpoint.enabled ? "Enabled" : "Disabled";
+        const statusClass = endpoint.enabled ? "success" : "secondary";
+        const toggleLabel = endpoint.enabled ? "Disable" : "Enable";
+
+        row.innerHTML = `
+            <td>
+                <div class="fw-semibold">${escapeHtml(endpoint.name || "Unnamed Endpoint")}</div>
+                <div class="text-muted small">${escapeHtml(endpoint.connection?.endpoint || "")}</div>
+            </td>
+            <td>${escapeHtml(formatProviderLabel(endpoint.provider))}</td>
+            <td>
+                <span title="${escapeHtml(selectedModels)}">${escapeHtml(selectedModels)}</span>
+            </td>
+            <td><span class="badge bg-${statusClass}">${statusLabel}</span></td>
+            <td class="text-end">
+                <div class="btn-group btn-group-sm" role="group">
+                    <button type="button" class="btn btn-outline-primary" data-action="edit" data-endpoint-id="${endpoint.id}">Edit</button>
+                    <button type="button" class="btn btn-outline-${endpoint.enabled ? "warning" : "success"}" data-action="toggle" data-endpoint-id="${endpoint.id}">${toggleLabel}</button>
+                    <button type="button" class="btn btn-outline-danger" data-action="delete" data-endpoint-id="${endpoint.id}">Delete</button>
+                </div>
+            </td>
+        `;
+
+        endpointsTbody.appendChild(row);
+    });
+
+    updateHiddenInput();
+    buildDefaultModelOptions();
+}
+
+function buildDefaultModelOptions() {
+    if (!defaultModelSelect) {
+        return;
+    }
+
+    defaultModelSelect.innerHTML = "";
+
+    const emptyOption = document.createElement("option");
+    emptyOption.value = "";
+    emptyOption.textContent = "No default model selected";
+    defaultModelSelect.appendChild(emptyOption);
+
+    modelEndpoints.forEach((endpoint) => {
+        const models = Array.isArray(endpoint.models) ? endpoint.models : [];
+        const endpointLabel = endpoint.name || endpoint.connection?.endpoint || "Endpoint";
+        const provider = (endpoint.provider || "aoai").toLowerCase();
+        const providerLabel = formatProviderLabel(provider);
+        const endpointEnabled = endpoint.enabled !== false;
+
+        models.forEach((model) => {
+            const modelId = model.id
+                || model.deploymentName
+                || model.deployment
+                || model.modelName
+                || model.name
+                || generateId();
+            if (!model.id) {
+                model.id = modelId;
+            }
+            const modelEnabled = model.enabled !== false;
+            const modelLabel = model.displayName || model.deploymentName || model.modelName || "Unnamed model";
+            const option = document.createElement("option");
+            option.value = `${endpoint.id}:${modelId}`;
+            option.dataset.endpointId = endpoint.id || "";
+            option.dataset.modelId = modelId || "";
+            option.dataset.provider = provider;
+            option.disabled = !(endpointEnabled && modelEnabled);
+            option.textContent = `${endpointLabel} — ${modelLabel} (${providerLabel})`;
+            if (option.disabled) {
+                option.textContent += " (disabled)";
+            }
+            defaultModelSelect.appendChild(option);
+        });
+    });
+
+    applyDefaultModelSelection(defaultModelSelection);
+}
+
+function applyDefaultModelSelection(selection) {
+    if (!defaultModelSelect) {
+        return;
+    }
+
+    defaultModelSelection = normalizeDefaultModelSelection(selection);
+
+    const hasSelection = defaultModelSelection.endpoint_id && defaultModelSelection.model_id;
+    const matchingOption = Array.from(defaultModelSelect.options).find((option) => {
+        return option.dataset.endpointId === defaultModelSelection.endpoint_id
+            && option.dataset.modelId === defaultModelSelection.model_id;
+    });
+
+    if (!hasSelection) {
+        defaultModelSelect.value = "";
+        updateDefaultModelInput();
+        return;
+    }
+
+    if (!matchingOption || matchingOption.disabled) {
+        showToast("Default model selection is no longer available. Please choose a new default.", "warning");
+        defaultModelSelection = {
+            endpoint_id: "",
+            model_id: "",
+            provider: ""
+        };
+        defaultModelSelect.value = "";
+        updateDefaultModelInput();
+        return;
+    }
+
+    defaultModelSelect.value = matchingOption.value;
+    updateDefaultModelInput();
+}
+
+function handleDefaultModelChange() {
+    if (!defaultModelSelect) {
+        return;
+    }
+
+    const selectedOption = defaultModelSelect.selectedOptions[0];
+    if (!selectedOption || !selectedOption.value) {
+        defaultModelSelection = {
+            endpoint_id: "",
+            model_id: "",
+            provider: ""
+        };
+    } else {
+        defaultModelSelection = {
+            endpoint_id: selectedOption.dataset.endpointId || "",
+            model_id: selectedOption.dataset.modelId || "",
+            provider: selectedOption.dataset.provider || ""
+        };
+    }
+    updateDefaultModelInput();
+    markModified();
+}
+
+function updateAuthVisibility() {
+    const authType = endpointAuthTypeSelect?.value || "managed_identity";
+    const provider = endpointProviderSelect?.value || "aoai";
+    const isApiKey = authType === "api_key";
+    const isFoundry = provider === "aifoundry" || provider === "new_foundry";
+    setElementVisibility(endpointProjectGroup, isFoundry);
+    setElementVisibility(endpointProjectApiVersionGroup, isFoundry);
+    setElementVisibility(endpointOpenAiApiVersionGroup, true);
+    setElementVisibility(endpointSubscriptionGroup, provider === "aoai" && !isApiKey);
+    setElementVisibility(endpointResourceGroup, provider === "aoai" && !isApiKey);
+    setElementVisibility(miTypeGroup, authType === "managed_identity");
+    setElementVisibility(miClientGroup, authType === "managed_identity" && (miTypeSelect?.value === "user_assigned"));
+    setElementVisibility(tenantGroup, authType === "service_principal");
+    setElementVisibility(clientGroup, authType === "service_principal");
+    setElementVisibility(secretGroup, authType === "service_principal");
+    setElementVisibility(apiKeyGroup, authType === "api_key");
+    setElementVisibility(endpointManagementCloudGroup, authType === "service_principal" && isFoundry);
+    setElementVisibility(endpointCustomAuthorityGroup, authType === "service_principal" && isFoundry && endpointManagementCloudSelect?.value === "custom");
+    setElementVisibility(endpointFoundryScopeGroup, authType === "service_principal" && isFoundry && endpointManagementCloudSelect?.value === "custom");
+    setElementVisibility(apiKeyNote, authType === "api_key");
+    setElementVisibility(addModelBtn, authType === "api_key");
+    setElementVisibility(fetchBtn, authType !== "api_key");
+}
+
+function resetModal() {
+    if (endpointIdInput) endpointIdInput.value = "";
+    if (endpointNameInput) endpointNameInput.value = "";
+    if (endpointProviderSelect) endpointProviderSelect.value = "aoai";
+    if (endpointUrlInput) endpointUrlInput.value = "";
+    if (endpointProjectInput) endpointProjectInput.value = "";
+    if (endpointProjectApiVersionInput) endpointProjectApiVersionInput.value = "v1";
+    if (endpointOpenAiApiVersionInput) endpointOpenAiApiVersionInput.value = getDefaultOpenAiApiVersion("aoai");
+    if (endpointSubscriptionInput) endpointSubscriptionInput.value = "";
+    if (endpointResourceGroupInput) endpointResourceGroupInput.value = "";
+    if (endpointAuthTypeSelect) endpointAuthTypeSelect.value = "managed_identity";
+    if (endpointManagementCloudSelect) endpointManagementCloudSelect.value = "public";
+    if (endpointCustomAuthorityInput) endpointCustomAuthorityInput.value = "";
+    if (endpointFoundryScopeInput) endpointFoundryScopeInput.value = "";
+    if (miTypeSelect) miTypeSelect.value = "system_assigned";
+    if (miClientIdInput) miClientIdInput.value = "";
+    if (tenantIdInput) tenantIdInput.value = "";
+    if (clientIdInput) clientIdInput.value = "";
+    if (clientSecretInput) clientSecretInput.value = "";
+    if (apiKeyInput) apiKeyInput.value = "";
+    if (clientSecretInput) clientSecretInput.placeholder = "";
+    if (apiKeyInput) apiKeyInput.placeholder = "";
+
+    modalModels = [];
+    if (modelsListEl) modelsListEl.innerHTML = "<p class=\"text-muted\">Fetch models to begin selection.</p>";
+
+    updateAuthVisibility();
+}
+
+function openModalForEndpoint(endpoint) {
+    if (!endpointModal) {
+        return;
+    }
+
+    resetModal();
+
+    if (endpoint) {
+        if (endpointIdInput) endpointIdInput.value = endpoint.id || "";
+        if (endpointNameInput) endpointNameInput.value = endpoint.name || "";
+        if (endpointProviderSelect) endpointProviderSelect.value = endpoint.provider || "aoai";
+        if (endpointUrlInput) endpointUrlInput.value = endpoint.connection?.endpoint || "";
+        if (endpointProjectInput) endpointProjectInput.value = endpoint.connection?.project_name || "";
+        if (endpointProjectApiVersionInput) {
+            endpointProjectApiVersionInput.value = endpoint.connection?.project_api_version || endpoint.connection?.api_version || "v1";
+        }
+        if (endpointOpenAiApiVersionInput) {
+            endpointOpenAiApiVersionInput.value = endpoint.connection?.openai_api_version || endpoint.connection?.api_version || getDefaultOpenAiApiVersion(endpoint.provider || "aoai");
+        }
+        if (endpointSubscriptionInput) endpointSubscriptionInput.value = endpoint.management?.subscription_id || "";
+        if (endpointResourceGroupInput) endpointResourceGroupInput.value = endpoint.management?.resource_group || "";
+        if (endpointAuthTypeSelect) endpointAuthTypeSelect.value = endpoint.auth?.type || "managed_identity";
+        if (endpointManagementCloudSelect) endpointManagementCloudSelect.value = endpoint.auth?.management_cloud || "public";
+        if (endpointCustomAuthorityInput) endpointCustomAuthorityInput.value = endpoint.auth?.custom_authority || "";
+        if (endpointFoundryScopeInput) endpointFoundryScopeInput.value = endpoint.auth?.foundry_scope || "";
+        if (miTypeSelect) miTypeSelect.value = endpoint.auth?.managed_identity_type || "system_assigned";
+        if (miClientIdInput) miClientIdInput.value = endpoint.auth?.managed_identity_client_id || "";
+        if (tenantIdInput) tenantIdInput.value = endpoint.auth?.tenant_id || "";
+        if (clientIdInput) clientIdInput.value = endpoint.auth?.client_id || "";
+        if (clientSecretInput) {
+            clientSecretInput.value = endpoint.auth?.client_secret || "";
+            if (!clientSecretInput.value && endpoint.has_client_secret) {
+                clientSecretInput.placeholder = "Stored";
+            }
+        }
+        if (apiKeyInput) {
+            apiKeyInput.value = endpoint.auth?.api_key || "";
+            if (!apiKeyInput.value && endpoint.has_api_key) {
+                apiKeyInput.placeholder = "Stored";
+            }
+        }
+        modalModels = Array.isArray(endpoint.models) ? [...endpoint.models] : [];
+        renderModalModels(modalModels);
+    }
+
+    updateAuthVisibility();
+    endpointModal.show();
+}
+
+function renderModalModels(models) {
+    if (!modelsListEl) {
+        return;
+    }
+
+    if (!models || !models.length) {
+        modelsListEl.innerHTML = "<p class=\"text-muted\">No models loaded yet.</p>";
+        return;
+    }
+
+    const fragment = document.createDocumentFragment();
+    models.forEach((model) => {
+        const wrapper = document.createElement("div");
+        wrapper.className = "border rounded p-2 mb-2";
+        const deploymentName = model.deploymentName || "";
+        const modelName = model.modelName || "";
+        const displayName = model.displayName || deploymentName;
+        const description = model.description || "";
+        const deploymentReadonly = model.isDiscovered ? "readonly" : "";
+        const modelId = model.id || generateId();
+        model.id = modelId;
+
+        wrapper.innerHTML = `
+            <div class="form-check mb-2">
+                <input class="form-check-input" type="checkbox" data-model-id="${modelId}" ${model.enabled ? "checked" : ""}>
+                <label class="form-check-label">
+                    ${escapeHtml(deploymentName)} ${modelName ? `<span class=\"text-muted\">(${escapeHtml(modelName)})</span>` : ""}
+                </label>
+            </div>
+            <div class="row g-2">
+                <div class="col-md-4">
+                    <label class="form-label small">Deployment Name</label>
+                    <input type="text" class="form-control form-control-sm" data-deployment-name-for="${modelId}" value="${escapeHtml(deploymentName)}" ${deploymentReadonly}>
+                </div>
+                <div class="col-md-6">
+                    <label class="form-label small">Display Name</label>
+                    <input type="text" class="form-control form-control-sm" data-display-name-for="${modelId}" value="${escapeHtml(displayName)}">
+                </div>
+                <div class="col-md-6">
+                    <label class="form-label small">Description (optional)</label>
+                    <input type="text" class="form-control form-control-sm" data-description-for="${modelId}" value="${escapeHtml(description)}">
+                </div>
+            </div>
+            <div class="d-flex gap-2 mt-2">
+                <button type="button" class="btn btn-sm btn-outline-secondary" data-action="test-model" data-model-id="${modelId}">Test Connection</button>
+                <button type="button" class="btn btn-sm btn-outline-danger" data-action="remove-model" data-model-id="${modelId}">Remove</button>
+            </div>
+        `;
+        fragment.appendChild(wrapper);
+    });
+
+    modelsListEl.innerHTML = "";
+    modelsListEl.appendChild(fragment);
+}
+
+function collectModalModels() {
+    if (!modelsListEl) {
+        return [];
+    }
+
+    const updated = modalModels.map((model) => ({ ...model }));
+    updated.forEach((model) => {
+        const checkbox = modelsListEl.querySelector(`input[data-model-id="${model.id}"]`);
+        const deploymentInput = modelsListEl.querySelector(`input[data-deployment-name-for="${model.id}"]`);
+        const displayInput = modelsListEl.querySelector(`input[data-display-name-for="${model.id}"]`);
+        const descriptionInput = modelsListEl.querySelector(`input[data-description-for="${model.id}"]`);
+        model.enabled = checkbox ? checkbox.checked : model.enabled;
+        model.deploymentName = deploymentInput ? deploymentInput.value.trim() : model.deploymentName;
+        model.displayName = displayInput ? displayInput.value.trim() : model.displayName;
+        model.description = descriptionInput ? descriptionInput.value.trim() : model.description;
+    });
+    return updated;
+}
+
+async function testModelConnection(model) {
+    const payload = buildEndpointPayload();
+    if (!payload || !model?.deploymentName) {
+        showToast("Model deployment name is required for testing.", "warning");
+        return;
+    }
+
+    const requestBody = {
+        ...payload,
+        model: {
+            deploymentName: model.deploymentName
+        }
+    };
+
+    try {
+        const response = await fetch("/api/models/test-model", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(requestBody)
+        });
+        const data = await response.json().catch(() => ({}));
+        if (!response.ok) {
+            throw new Error(data.error || "Connection test failed.");
+        }
+        showToast("Model connection successful.", "success");
+    } catch (error) {
+        console.error("Model connection failed", error);
+        showToast(error.message || "Model connection failed.", "danger");
+    }
+}
+
+async function fetchModels() {
+    const payload = buildEndpointPayload();
+    if (!payload) {
+        return;
+    }
+
+    modalModels = collectModalModels();
+
+    try {
+        const response = await fetch("/api/models/fetch", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(payload)
+        });
+        const data = await response.json().catch(() => ({}));
+        if (!response.ok) {
+            throw new Error(data.error || "Failed to fetch models.");
+        }
+
+        const models = Array.isArray(data.models) ? data.models : [];
+        const existingMap = new Map();
+        modalModels.forEach((model) => {
+            const key = (model.deploymentName || "").trim().toLowerCase();
+            if (key) {
+                existingMap.set(key, model);
+            }
+        });
+
+        let addedCount = 0;
+        models.forEach((model) => {
+            const deploymentName = (model.deploymentName || model.deployment || "").trim();
+            if (!deploymentName) {
+                return;
+            }
+            const key = deploymentName.toLowerCase();
+            if (existingMap.has(key)) {
+                return;
+            }
+            modalModels.push({
+                id: generateId(),
+                deploymentName,
+                modelName: model.modelName || model.name || "",
+                displayName: deploymentName,
+                description: "",
+                enabled: false,
+                isDiscovered: true
+            });
+            existingMap.set(key, true);
+            addedCount += 1;
+        });
+        renderModalModels(modalModels);
+        showToast(`Fetched ${models.length} models. Added ${addedCount} new.`, "success");
+    } catch (error) {
+        console.error("Model fetch failed", error);
+        showToast(error.message || "Failed to fetch models.", "danger");
+    }
+}
+
+function buildEndpointPayload() {
+    if (!endpointNameInput || !endpointUrlInput || !endpointOpenAiApiVersionInput) {
+        return null;
+    }
+    const endpointId = endpointIdInput?.value.trim() || "";
+    const name = endpointNameInput.value.trim();
+    const endpoint = endpointUrlInput.value.trim();
+    const projectName = endpointProjectInput?.value.trim() || "";
+    const projectApiVersion = endpointProjectApiVersionInput?.value.trim() || "v1";
+    const openAiApiVersion = endpointOpenAiApiVersionInput.value.trim();
+    const provider = endpointProviderSelect?.value || "aoai";
+    const subscriptionId = endpointSubscriptionInput?.value.trim() || "";
+    const resourceGroup = endpointResourceGroupInput?.value.trim() || "";
+    const authType = endpointAuthTypeSelect?.value || "managed_identity";
+
+    if (!name || !endpoint || !openAiApiVersion) {
+        showToast("Endpoint name, URL, and OpenAI API version are required.", "warning");
+        return null;
+    }
+
+    if ((provider === "aifoundry" || provider === "new_foundry") && !projectApiVersion) {
+        showToast("Project API version is required for Foundry project discovery.", "warning");
+        return null;
+    }
+
+    if ((provider === "aifoundry" || provider === "new_foundry") && !endpoint.includes("/api/projects/") && !projectName) {
+        showToast("Foundry project name is required when the endpoint does not include /api/projects/.", "warning");
+        return null;
+    }
+
+    if (provider === "aoai" && authType !== "api_key" && (!subscriptionId || !resourceGroup)) {
+        showToast("Subscription ID and resource group are required for Azure OpenAI model discovery.", "warning");
+        return null;
+    }
+
+    const auth = {
+        type: authType,
+        managed_identity_type: miTypeSelect?.value || "system_assigned",
+        managed_identity_client_id: miClientIdInput?.value.trim() || "",
+        tenant_id: tenantIdInput?.value.trim() || "",
+        client_id: clientIdInput?.value.trim() || "",
+        client_secret: clientSecretInput?.value.trim() || "",
+        api_key: apiKeyInput?.value.trim() || "",
+        management_cloud: endpointManagementCloudSelect?.value || "public",
+        custom_authority: endpointCustomAuthorityInput?.value.trim() || "",
+        foundry_scope: endpointFoundryScopeInput?.value.trim() || ""
+    };
+
+    if (authType === "service_principal" && (!auth.tenant_id || !auth.client_id || !auth.client_secret)) {
+        showToast("Tenant ID, Client ID, and Client Secret are required for service principal auth.", "warning");
+        return null;
+    }
+
+    if ((provider === "aifoundry" || provider === "new_foundry") && authType === "service_principal" && auth.management_cloud === "custom") {
+        if (!auth.custom_authority) {
+            showToast("Custom authority is required when Management Cloud is set to Custom.", "warning");
+            return null;
+        }
+        if (!auth.foundry_scope) {
+            showToast("Foundry scope is required when Management Cloud is set to Custom.", "warning");
+            return null;
+        }
+    }
+
+    if (authType === "api_key" && !auth.api_key) {
+        showToast("API key is required for API key authentication.", "warning");
+        return null;
+    }
+
+    const management = provider === "aoai" ? {
+        subscription_id: subscriptionId,
+        resource_group: resourceGroup
+    } : {};
+
+    const connection = {
+        endpoint,
+        openai_api_version: openAiApiVersion
+    };
+
+    if (provider === "aifoundry" || provider === "new_foundry") {
+        connection.project_api_version = projectApiVersion;
+        if (projectName) {
+            connection.project_name = projectName;
+        }
+    }
+
+    return {
+        id: endpointId,
+        provider,
+        name,
+        connection,
+        management,
+        auth
+    };
+}
+
+function saveEndpoint() {
+    try {
+        const payload = buildEndpointPayload();
+        if (!payload) {
+            return;
+        }
+
+        const models = collectModalModels();
+        const endpointId = endpointIdInput?.value || generateId();
+        const existingEndpoint = modelEndpoints.find((endpoint) => endpoint.id === endpointId);
+        const authType = payload.auth?.type || "managed_identity";
+        const hasApiKey = authType === "api_key" && (Boolean(payload.auth?.api_key) || Boolean(existingEndpoint?.has_api_key));
+        const hasClientSecret = authType === "service_principal" && (Boolean(payload.auth?.client_secret) || Boolean(existingEndpoint?.has_client_secret));
+
+        const endpointData = {
+            id: endpointId,
+            name: payload.name,
+            provider: payload.provider,
+            enabled: true,
+            auth: payload.auth,
+            connection: payload.connection,
+            management: payload.management,
+            models,
+            has_api_key: hasApiKey,
+            has_client_secret: hasClientSecret
+        };
+
+        const existingIndex = modelEndpoints.findIndex((endpoint) => endpoint.id === endpointId);
+        if (existingIndex >= 0) {
+            modelEndpoints[existingIndex] = endpointData;
+        } else {
+            modelEndpoints.push(endpointData);
+        }
+
+        renderEndpoints();
+        markModified();
+        endpointModal?.hide();
+        showToast("Please save your settings to persist changes.", "warning");
+    } catch (error) {
+        console.error("Failed to save endpoint", error);
+        showToast(error?.message || "Failed to save endpoint.", "danger");
+    }
+}
+
+function addManualModel() {
+    modalModels.push({
+        id: generateId(),
+        deploymentName: "",
+        modelName: "",
+        displayName: "",
+        description: "",
+        enabled: true,
+        isDiscovered: false
+    });
+    renderModalModels(modalModels);
+}
+
+function handleModelListClick(event) {
+    const button = event.target.closest("button[data-action]");
+    if (!button) {
+        return;
+    }
+    const action = button.dataset.action;
+    const modelId = button.dataset.modelId;
+    modalModels = collectModalModels();
+    const model = modalModels.find((item) => item.id === modelId);
+    if (!model) {
+        return;
+    }
+
+    if (action === "remove-model") {
+        modalModels = modalModels.filter((item) => item.id !== modelId);
+        renderModalModels(modalModels);
+        return;
+    }
+
+    if (action === "test-model") {
+        testModelConnection(model);
+    }
+}
+
+function handleTableClick(event) {
+    const button = event.target.closest("button[data-action]");
+    if (!button) {
+        return;
+    }
+    const action = button.dataset.action;
+    const endpointId = button.dataset.endpointId;
+    const endpoint = modelEndpoints.find((item) => item.id === endpointId);
+    if (!endpoint) {
+        return;
+    }
+
+    if (action === "edit") {
+        openModalForEndpoint(endpoint);
+        return;
+    }
+
+    if (action === "toggle") {
+        endpoint.enabled = !endpoint.enabled;
+        renderEndpoints();
+        markModified();
+        return;
+    }
+
+    if (action === "delete") {
+        if (pendingDeleteEndpointId === endpointId) {
+            modelEndpoints = modelEndpoints.filter((item) => item.id !== endpointId);
+            renderEndpoints();
+            markModified();
+            pendingDeleteEndpointId = null;
+            if (pendingDeleteTimeout) {
+                clearTimeout(pendingDeleteTimeout);
+                pendingDeleteTimeout = null;
+            }
+            showToast("Endpoint deleted.", "success");
+            return;
+        }
+        pendingDeleteEndpointId = endpointId;
+        showToast("Click delete again to confirm removal.", "warning");
+        if (pendingDeleteTimeout) {
+            clearTimeout(pendingDeleteTimeout);
+        }
+        pendingDeleteTimeout = setTimeout(() => {
+            pendingDeleteEndpointId = null;
+            pendingDeleteTimeout = null;
+        }, 5000);
+    }
+}
+
+function handleToggleChange() {
+    const enabled = !!enableMultiEndpointToggle?.checked;
+    // setElementVisibility(endpointsWrapper, enabled);
+    setElementVisibility(defaultModelWrapper, enabled);
+
+    if (enabled) {
+        setElementVisibility(migrationWarning, true);
+        showToast("Multi-endpoint enabled. Existing AI endpoint will be migrated when you save settings.", "warning");
+    }
+    markModified();
+}
+
+function escapeHtml(value) {
+    const div = document.createElement("div");
+    div.textContent = value || "";
+    return div.innerHTML;
+}
+
+function init() {
+    if (!enableMultiEndpointToggle) {
+        return;
+    }
+
+    renderEndpoints();
+    updateAuthVisibility();
+    setElementVisibility(endpointsWrapper, enableMultiEndpointToggle.checked);
+    setElementVisibility(defaultModelWrapper, enableMultiEndpointToggle.checked);
+
+    enableMultiEndpointToggle.addEventListener("change", handleToggleChange);
+
+    if (endpointAuthTypeSelect) {
+        endpointAuthTypeSelect.addEventListener("change", updateAuthVisibility);
+    }
+    if (endpointProviderSelect) {
+        endpointProviderSelect.addEventListener("change", () => {
+            updateAuthVisibility();
+            syncOpenAiApiVersionForProvider();
+        });
+    }
+    if (miTypeSelect) {
+        miTypeSelect.addEventListener("change", updateAuthVisibility);
+    }
+    if (endpointManagementCloudSelect) {
+        endpointManagementCloudSelect.addEventListener("change", updateAuthVisibility);
+    }
+
+    if (addEndpointBtn) {
+        addEndpointBtn.addEventListener("click", () => openModalForEndpoint(null));
+    }
+
+    if (addModelBtn) {
+        addModelBtn.addEventListener("click", addManualModel);
+    }
+
+    if (endpointsTbody) {
+        endpointsTbody.addEventListener("click", handleTableClick);
+    }
+
+    if (modelsListEl) {
+        modelsListEl.addEventListener("click", handleModelListClick);
+    }
+
+    if (fetchBtn) {
+        fetchBtn.addEventListener("click", fetchModels);
+    }
+    if (saveBtn) {
+        saveBtn.addEventListener("click", (event) => {
+            event.preventDefault();
+            saveEndpoint();
+        });
+    }
+
+    if (defaultModelSelect) {
+        defaultModelSelect.addEventListener("change", handleDefaultModelChange);
+    }
+
+    updateHiddenInput();
+    buildDefaultModelOptions();
+}
+
+if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", init);
+} else {
+    init();
+}
diff --git a/application/single_app/static/js/admin/admin_settings.js b/application/single_app/static/js/admin/admin_settings.js
index 21c989fd..af9f7a86 100644
--- a/application/single_app/static/js/admin/admin_settings.js
+++ b/application/single_app/static/js/admin/admin_settings.js
@@ -69,6 +69,9 @@ document.addEventListener('DOMContentLoaded', () => {
     
     // --- NEW: External Links Setup ---
     setupExternalLinks(); // Initialize external links section
+
+    // --- NEW: Chunk size controls ---
+    setupChunkSizeControls();
     
     // --- Setup form change tracking ---
     setupFormChangeTracking();
@@ -1211,6 +1214,69 @@ function updateExternalLinksJsonInput() {
     return "[]";
 }
 
+function setupChunkSizeControls() {
+    const overrideToggle = document.getElementById('enable_chunk_size_override');
+    const fieldsContainer = document.getElementById('chunk-size-fields');
+    const capWarning = document.getElementById('chunk-size-cap-warning');
+    const capWarningText = document.getElementById('chunk-size-cap-warning-text');
+    const capInput = document.getElementById('chunk_size_cap');
+    const chunkInputs = document.querySelectorAll('.chunk-size-input');
+
+    if (!overrideToggle || !fieldsContainer || !chunkInputs || chunkInputs.length === 0) {
+        return;
+    }
+
+    const capValue = capInput ? parseInt(capInput.value, 10) : null;
+
+    const updateCapWarning = () => {
+        if (!capValue || Number.isNaN(capValue)) {
+            if (capWarning) capWarning.classList.add('d-none');
+            return;
+        }
+
+        const exceeding = [];
+        chunkInputs.forEach(input => {
+            const raw = parseInt(input.value || '0', 10);
+            if (!Number.isNaN(raw) && raw > capValue) {
+                exceeding.push(input.dataset.label || input.name || 'A chunk size');
+            }
+        });
+
+        if (capWarning && capWarningText) {
+            if (exceeding.length > 0 && overrideToggle.checked) {
+                capWarningText.textContent = `${exceeding.join(', ')} will be reduced to ${capValue} because of the cap.`;
+                capWarning.classList.remove('d-none');
+            } else {
+                capWarning.classList.add('d-none');
+            }
+        }
+    };
+
+    const updateVisibility = (suppressChange = false) => {
+        const enabled = overrideToggle.checked;
+        fieldsContainer.classList.toggle('d-none', !enabled);
+        if (!enabled && capWarning) {
+            capWarning.classList.add('d-none');
+        } else {
+            updateCapWarning();
+        }
+        if (!suppressChange) {
+            markFormAsModified();
+        }
+    };
+
+    overrideToggle.addEventListener('change', updateVisibility);
+    chunkInputs.forEach(input => {
+        input.addEventListener('input', () => {
+            updateCapWarning();
+            markFormAsModified();
+        });
+    });
+
+    // Initial state
+    updateVisibility(true);
+}
+
 function setupToggles() {
     // --- Enable Agents (Semantic Kernel) Toggle ---
     const agentsMainContent = document.getElementById('agents-main-content');
@@ -1397,9 +1463,9 @@ function setupToggles() {
 
     // --- Agent Settings Toggles (corrected) ---
     const allowUserAgentsToggle = document.getElementById('toggle-allow-user-agents');
-    const allowUserCustomAgentEndpointsToggle = document.getElementById('toggle-allow-user-custom-agent-endpoints');
+    const allowUserCustomAgentEndpointsToggle = document.getElementById('toggle-allow-user-custom-endpoints');
     const allowGroupAgentsToggle = document.getElementById('toggle-allow-group-agents');
-    const allowGroupCustomAgentEndpointsToggle = document.getElementById('toggle-allow-group-custom-agent-endpoints');
+    const allowGroupCustomAgentEndpointsToggle = document.getElementById('toggle-allow-group-custom-endpoints');
     let agentSettingsFeedbackDiv = document.getElementById('agent-settings-feedback');
     if (!agentSettingsFeedbackDiv) {
         agentSettingsFeedbackDiv = document.createElement('div');
@@ -1426,9 +1492,9 @@ function setupToggles() {
             if (!resp.ok) throw new Error('Failed to fetch agent settings');
             const settings = await resp.json();
             if (allowUserAgentsToggle) allowUserAgentsToggle.checked = !!settings.allow_user_agents;
-            if (allowUserCustomAgentEndpointsToggle) allowUserCustomAgentEndpointsToggle.checked = !!settings.allow_user_custom_agent_endpoints;
+            if (allowUserCustomAgentEndpointsToggle) allowUserCustomAgentEndpointsToggle.checked = !!settings.allow_user_custom_endpoints;
             if (allowGroupAgentsToggle) allowGroupAgentsToggle.checked = !!settings.allow_group_agents;
-            if (allowGroupCustomAgentEndpointsToggle) allowGroupCustomAgentEndpointsToggle.checked = !!settings.allow_group_custom_agent_endpoints;
+            if (allowGroupCustomAgentEndpointsToggle) allowGroupCustomAgentEndpointsToggle.checked = !!settings.allow_group_custom_endpoints;
         } catch (err) {
             showAgentSettingsFeedback('Error loading agent settings: ' + err.message, 'danger');
         }
@@ -1442,9 +1508,9 @@ function setupToggles() {
     function saveAgentSetting(settingName, value) {
         const toggleMap = {
             'allow_user_agents': allowUserAgentsToggle,
-            'allow_user_custom_agent_endpoints': allowUserCustomAgentEndpointsToggle,
+            'allow_user_custom_endpoints': allowUserCustomAgentEndpointsToggle,
             'allow_group_agents': allowGroupAgentsToggle,
-            'allow_group_custom_agent_endpoints': allowGroupCustomAgentEndpointsToggle
+            'allow_group_custom_endpoints': allowGroupCustomAgentEndpointsToggle
         };
         const toggle = toggleMap[settingName];
         if (toggle) toggle.disabled = true;
@@ -1476,7 +1542,7 @@ function setupToggles() {
     }
     if (allowUserCustomAgentEndpointsToggle) {
         allowUserCustomAgentEndpointsToggle.addEventListener('change', () => {
-            saveAgentSetting('allow_user_custom_agent_endpoints', allowUserCustomAgentEndpointsToggle.checked);
+            saveAgentSetting('allow_user_custom_endpoints', allowUserCustomAgentEndpointsToggle.checked);
         });
     }
     if (allowGroupAgentsToggle) {
@@ -1486,7 +1552,7 @@ function setupToggles() {
     }
     if (allowGroupCustomAgentEndpointsToggle) {
         allowGroupCustomAgentEndpointsToggle.addEventListener('change', () => {
-            saveAgentSetting('allow_group_custom_agent_endpoints', allowGroupCustomAgentEndpointsToggle.checked);
+            saveAgentSetting('allow_group_custom_endpoints', allowGroupCustomAgentEndpointsToggle.checked);
         });
     }
 
@@ -3974,6 +4040,8 @@ function markFormAsModified() {
     updateSaveButtonState();
 }
 
+window.markFormAsModified = markFormAsModified;
+
 /**
  * Update the save button appearance based on form state
  */
diff --git a/application/single_app/static/js/agent_modal_stepper.js b/application/single_app/static/js/agent_modal_stepper.js
index 800751be..56a76fa9 100644
--- a/application/single_app/static/js/agent_modal_stepper.js
+++ b/application/single_app/static/js/agent_modal_stepper.js
@@ -5,17 +5,21 @@ import * as agentsCommon from "./agents_common.js";
 import { getModelSupportedLevels } from "./chat/chat-reasoning.js";
 
 export class AgentModalStepper {
-  constructor(isAdmin = false) {
+  constructor(isAdmin = false, options = {}) {
     this.currentStep = 1;
     this.maxSteps = 6;
     this.isEditMode = false;
     this.isAdmin = isAdmin; // Track if this is admin context
+    this.workspaceScope = options.workspaceScope || (isAdmin ? 'admin' : 'user');
+    this.settingsEndpoint = options.settingsEndpoint || (isAdmin ? '/api/admin/agent/settings' : '/api/user/agent/settings');
     this.currentAgentType = 'local';
     this.originalAgent = null;  // Track original state for change detection
     this.actionsToSelect = null; // Store actions to select when they're loaded
     this.updateStepIndicatorTimeout = null; // For debouncing step indicator updates
     this.templateSubmitButton = document.getElementById('agent-modal-submit-template-btn');
     this.foundryPlaceholderInstructions = 'Placeholder instructions: Azure AI Foundry agent manages its own prompt.';
+    this.foundryEndpoints = [];
+    this.foundryAgents = [];
     
     this.bindEvents();
 
@@ -54,6 +58,19 @@ export class AgentModalStepper {
         r.addEventListener('change', (e) => this.handleAgentTypeChange(e.target.value));
       });
     }
+
+    const foundryEndpointSelect = document.getElementById('agent-foundry-endpoint-select');
+    const foundryFetchBtn = document.getElementById('agent-foundry-fetch-btn');
+    const foundryAgentSelect = document.getElementById('agent-foundry-agent-select');
+    if (foundryEndpointSelect) {
+      foundryEndpointSelect.addEventListener('change', () => this.applyFoundryEndpointSelection());
+    }
+    if (foundryFetchBtn) {
+      foundryFetchBtn.addEventListener('click', () => this.fetchFoundryAgents());
+    }
+    if (foundryAgentSelect) {
+      foundryAgentSelect.addEventListener('change', () => this.applyFoundryAgentSelection());
+    }
     
     // Set up display name to generated name conversion
     this.setupNameGeneration();
@@ -62,6 +79,61 @@ export class AgentModalStepper {
     this.setupModelChangeListener();
   }
 
+  isClassicFoundryType(agentType = this.currentAgentType) {
+    return (agentType || '').toLowerCase() === 'aifoundry';
+  }
+
+  isNewFoundryType(agentType = this.currentAgentType) {
+    return (agentType || '').toLowerCase() === 'new_foundry';
+  }
+
+  isAnyFoundryType(agentType = this.currentAgentType) {
+    return this.isClassicFoundryType(agentType) || this.isNewFoundryType(agentType);
+  }
+
+  getCurrentFoundryProvider(agentType = this.currentAgentType) {
+    return this.isNewFoundryType(agentType) ? 'new_foundry' : 'aifoundry';
+  }
+
+  matchesFoundryEndpointProvider(provider) {
+    const normalizedProvider = (provider || '').toLowerCase();
+    if (!normalizedProvider) {
+      return false;
+    }
+    return normalizedProvider === this.getCurrentFoundryProvider();
+  }
+
+  getAgentTypeLabel(agentType = this.currentAgentType) {
+    if (this.isNewFoundryType(agentType)) {
+      return 'New Foundry';
+    }
+    if (this.isClassicFoundryType(agentType)) {
+      return 'Foundry (classic)';
+    }
+    return 'Local (Semantic Kernel)';
+  }
+
+  getCurrentFoundrySettings(agentType = this.currentAgentType) {
+    const otherSettings = this.currentAgent?.other_settings || {};
+    if (this.isNewFoundryType(agentType)) {
+      return otherSettings.new_foundry || {};
+    }
+    if (this.isClassicFoundryType(agentType)) {
+      return otherSettings.azure_ai_foundry || {};
+    }
+    return {};
+  }
+
+  shouldPreserveCurrentFoundrySelection(endpointId) {
+    if (!endpointId || !this.currentAgent || !this.isAnyFoundryType()) {
+      return false;
+    }
+
+    const currentFoundrySettings = this.getCurrentFoundrySettings();
+    const currentEndpointId = this.currentAgent.model_endpoint_id || currentFoundrySettings.endpoint_id || '';
+    return currentEndpointId === endpointId;
+  }
+
   setupNameGeneration() {
     const displayNameInput = document.getElementById('agent-display-name');
     const generatedNameInput = document.getElementById('agent-name');
@@ -79,23 +151,48 @@ export class AgentModalStepper {
     const globalModelSelect = document.getElementById('agent-global-model-select');
     if (globalModelSelect) {
       globalModelSelect.addEventListener('change', () => {
+        this.updateModelEndpointSelection();
         this.updateReasoningEffortForModel();
       });
     }
   }
 
+  updateModelEndpointSelection() {
+    const globalModelSelect = document.getElementById('agent-global-model-select');
+    const modelEndpointInput = document.getElementById('agent-model-endpoint-id');
+    const modelIdInput = document.getElementById('agent-model-id');
+    const modelProviderInput = document.getElementById('agent-model-provider');
+    if (!globalModelSelect) {
+      return;
+    }
+
+    const selectedOption = globalModelSelect.options[globalModelSelect.selectedIndex];
+    if (modelEndpointInput) {
+      modelEndpointInput.value = selectedOption?.dataset?.endpointId || '';
+    }
+    if (modelIdInput) {
+      modelIdInput.value = selectedOption?.value || '';
+    }
+    if (modelProviderInput) {
+      modelProviderInput.value = selectedOption?.dataset?.provider || '';
+    }
+  }
+
   handleAgentTypeChange(agentType) {
     this.currentAgentType = agentType || 'local';
     this.applyAgentTypeVisibility();
     // Clear actions if switching to foundry
-    if (this.currentAgentType === 'aifoundry') {
+    if (this.isAnyFoundryType()) {
       this.clearSelectedActions();
+      this.loadFoundryEndpoints();
     }
     this.populateSummary();
   }
 
   applyAgentTypeVisibility() {
-    const isFoundry = this.currentAgentType === 'aifoundry';
+    const isFoundry = this.isAnyFoundryType();
+    const isClassicFoundry = this.isClassicFoundryType();
+    const isNewFoundry = this.isNewFoundryType();
     const foundryFields = document.getElementById('agent-foundry-fields');
     const modelGroup = document.getElementById('agent-global-model-group');
     const customToggle = document.getElementById('agent-custom-connection-toggle');
@@ -108,11 +205,25 @@ export class AgentModalStepper {
     const instructionsContainer = document.getElementById('agent-instructions-container');
     const instructionsFoundryNote = document.getElementById('agent-instructions-foundry-note');
     const instructionsInput = document.getElementById('agent-instructions');
+    const advancedFoundryNote = document.getElementById('agent-advanced-foundry-note');
+    const localAgentAdvancedSettings = document.getElementById('local-agent-advanced-settings');
+    const foundryModeNote = document.getElementById('agent-foundry-mode-note');
+    const foundryFetchBtnLabel = document.getElementById('agent-foundry-fetch-btn-label');
+    const foundrySelectLabel = document.getElementById('agent-foundry-select-label');
+    const foundrySelectHelp = document.getElementById('agent-foundry-select-help');
+    const classicOnly = document.getElementById('agent-classic-foundry-only');
+    const classicOnlyFields = document.getElementById('agent-classic-foundry-fields');
+    const classicApiVersionGroup = document.getElementById('agent-classic-foundry-api-version-group');
+    const newFoundryOnly = document.getElementById('agent-new-foundry-only');
 
     if (foundryFields) foundryFields.classList.toggle('d-none', !isFoundry);
     if (modelGroup) modelGroup.classList.toggle('d-none', isFoundry);
     if (customToggle) customToggle.classList.toggle('d-none', isFoundry);
     if (customFields) customFields.classList.toggle('d-none', isFoundry);
+    if (classicOnly) classicOnly.classList.toggle('d-none', !isClassicFoundry);
+    if (classicOnlyFields) classicOnlyFields.classList.toggle('d-none', !isClassicFoundry);
+    if (classicApiVersionGroup) classicApiVersionGroup.classList.toggle('d-none', !isClassicFoundry);
+    if (newFoundryOnly) newFoundryOnly.classList.toggle('d-none', !isNewFoundry);
 
     if (instructionsContainer) instructionsContainer.classList.toggle('d-none', isFoundry);
     if (instructionsFoundryNote) instructionsFoundryNote.classList.toggle('d-none', !isFoundry);
@@ -137,12 +248,47 @@ export class AgentModalStepper {
       summaryActionsSection.classList.toggle('d-none', isFoundry);
     }
 
+    if (advancedFoundryNote) {
+      advancedFoundryNote.classList.toggle('d-none', !isFoundry);
+    }
+    if (localAgentAdvancedSettings) {
+      localAgentAdvancedSettings.classList.toggle('d-none', isFoundry);
+    }
+
     // Update helper text
     const helper = document.getElementById('agent-type-helper');
     if (helper) {
-      helper.textContent = isFoundry
-        ? 'Foundry agents use Azure-managed tools. Actions step is disabled.'
-        : 'Local agents can attach actions and use SK plugins.';
+      if (isNewFoundry) {
+        helper.textContent = 'New Foundry applications use the Responses protocol endpoint. Actions are disabled.';
+      } else if (isClassicFoundry) {
+        helper.textContent = 'Classic Foundry agents use Azure-managed tools. Actions are disabled.';
+      } else {
+        helper.textContent = 'Local agents can attach actions and use SK plugins.';
+      }
+    }
+
+    if (foundryFetchBtnLabel) {
+      foundryFetchBtnLabel.textContent = isNewFoundry ? 'Fetch Applications' : 'Fetch Agents';
+    }
+
+    if (foundrySelectLabel) {
+      foundrySelectLabel.textContent = isNewFoundry ? 'New Foundry Application' : 'Foundry Agent';
+    }
+
+    if (foundrySelectHelp) {
+      if (isNewFoundry) {
+        foundrySelectHelp.textContent = 'Fetch a new Foundry application to populate the application name, version, and identifier fields.';
+      } else {
+        foundrySelectHelp.textContent = 'Select a classic Foundry agent to import its identity.';
+      }
+    }
+
+    if (foundryModeNote) {
+      if (isNewFoundry) {
+        foundryModeNote.textContent = 'New Foundry applications are invoked through the application Responses endpoint and use Foundry-managed tools.';
+      } else if (isClassicFoundry) {
+        foundryModeNote.textContent = 'Classic Foundry agents use Azure-managed tools and the existing SDK-backed invocation path.';
+      }
     }
   }
 
@@ -284,6 +430,8 @@ export class AgentModalStepper {
     
     // Load models for the modal
     this.loadModelsForModal();
+    this.loadFoundryEndpoints();
+    this.updateModelEndpointSelection();
     
     // Show the Bootstrap modal
     const modalEl = document.getElementById('agentModal');
@@ -344,6 +492,22 @@ export class AgentModalStepper {
     const instructions = document.getElementById('agent-instructions');
     const modelSelect = document.getElementById('agent-global-model-select');
     const customConnection = document.getElementById('agent-custom-connection');
+    const modelEndpointId = document.getElementById('agent-model-endpoint-id');
+    const modelId = document.getElementById('agent-model-id');
+    const modelProvider = document.getElementById('agent-model-provider');
+    const foundryEndpointSelect = document.getElementById('agent-foundry-endpoint-select');
+    const foundryAgentSelect = document.getElementById('agent-foundry-agent-select');
+    const foundryEndpointInput = document.getElementById('agent-foundry-endpoint');
+    const foundryApiVersionInput = document.getElementById('agent-foundry-api-version');
+    const foundryDeploymentInput = document.getElementById('agent-foundry-deployment');
+    const foundryAgentIdInput = document.getElementById('agent-foundry-agent-id');
+    const foundryResponsesApiVersionInput = document.getElementById('agent-new-foundry-responses-api-version');
+    const foundryApplicationIdInput = document.getElementById('agent-new-foundry-application-id');
+    const foundryApplicationNameInput = document.getElementById('agent-new-foundry-application-name');
+    const foundryApplicationVersionInput = document.getElementById('agent-new-foundry-application-version');
+    const foundryActivityApiVersionInput = document.getElementById('agent-new-foundry-activity-api-version');
+    const foundryNotesInput = document.getElementById('agent-foundry-notes');
+    const foundryStatus = document.getElementById('agent-foundry-fetch-status');
     
     if (displayName) displayName.value = '';
     if (generatedName) generatedName.value = '';
@@ -351,6 +515,22 @@ export class AgentModalStepper {
     if (instructions) instructions.value = '';
     if (modelSelect) modelSelect.selectedIndex = 0;
     if (customConnection) customConnection.checked = false;
+    if (modelEndpointId) modelEndpointId.value = '';
+    if (modelId) modelId.value = '';
+    if (modelProvider) modelProvider.value = '';
+    if (foundryEndpointSelect) foundryEndpointSelect.selectedIndex = 0;
+    if (foundryAgentSelect) foundryAgentSelect.selectedIndex = 0;
+    if (foundryEndpointInput) foundryEndpointInput.value = '';
+    if (foundryApiVersionInput) foundryApiVersionInput.value = '';
+    if (foundryDeploymentInput) foundryDeploymentInput.value = '';
+    if (foundryAgentIdInput) foundryAgentIdInput.value = '';
+    if (foundryResponsesApiVersionInput) foundryResponsesApiVersionInput.value = '';
+    if (foundryApplicationIdInput) foundryApplicationIdInput.value = '';
+    if (foundryApplicationNameInput) foundryApplicationNameInput.value = '';
+    if (foundryApplicationVersionInput) foundryApplicationVersionInput.value = '';
+    if (foundryActivityApiVersionInput) foundryActivityApiVersionInput.value = '';
+    if (foundryNotesInput) foundryNotesInput.value = '';
+    if (foundryStatus) foundryStatus.textContent = '';
     
     // Clear any selected actions
     this.clearSelectedActions();
@@ -365,12 +545,12 @@ export class AgentModalStepper {
 
   async loadModelsForModal() {
     try {
-      const endpoint = '/api/user/agent/settings';
-      const { models, selectedModel } = await agentsCommon.fetchAndGetAvailableModels(endpoint, this.currentAgent);
+      const { models, selectedModel } = await agentsCommon.fetchAndGetAvailableModels(this.settingsEndpoint, this.currentAgent);
       const globalModelSelect = document.getElementById('agent-global-model-select');
       
       if (globalModelSelect) {
         agentsCommon.populateGlobalModelDropdown(globalModelSelect, models, selectedModel);
+        this.updateModelEndpointSelection();
         
         // Update reasoning effort options based on selected model
         this.updateReasoningEffortForModel();
@@ -385,6 +565,217 @@ export class AgentModalStepper {
     }
   }
 
+  async loadFoundryEndpoints() {
+    const endpointSelect = document.getElementById('agent-foundry-endpoint-select');
+    if (!endpointSelect) {
+      return;
+    }
+
+    try {
+      const resp = await fetch(this.settingsEndpoint);
+      if (!resp.ok) {
+        throw new Error('Failed to load Foundry endpoints');
+      }
+      const settings = await resp.json();
+      const endpoints = Array.isArray(settings.model_endpoints) ? settings.model_endpoints : [];
+      this.foundryEndpoints = endpoints.filter(endpoint => this.matchesFoundryEndpointProvider(endpoint.provider));
+
+      endpointSelect.innerHTML = '<option value="">Select a configured endpoint...</option>';
+      this.foundryEndpoints.forEach(endpoint => {
+        const opt = document.createElement('option');
+        opt.value = endpoint.id || '';
+        opt.textContent = endpoint.name || endpoint.connection?.endpoint || 'Foundry Endpoint';
+        if (endpoint.scope) {
+          opt.dataset.scope = endpoint.scope;
+        }
+        endpointSelect.appendChild(opt);
+      });
+
+      const existingEndpointId =
+        (this.currentAgent && (
+          this.currentAgent.model_endpoint_id
+          || this.currentAgent.other_settings?.azure_ai_foundry?.endpoint_id
+          || this.currentAgent.other_settings?.new_foundry?.endpoint_id
+        )) || '';
+      if (existingEndpointId) {
+        endpointSelect.value = existingEndpointId;
+      }
+      this.applyFoundryEndpointSelection();
+    } catch (error) {
+      console.error('Failed to load Foundry endpoints:', error);
+    }
+  }
+
+  applyFoundryEndpointSelection() {
+    const endpointSelect = document.getElementById('agent-foundry-endpoint-select');
+    const endpointInput = document.getElementById('agent-foundry-endpoint');
+    const apiVersionInput = document.getElementById('agent-foundry-api-version');
+    const deploymentInput = document.getElementById('agent-foundry-deployment');
+    const endpointIdInput = document.getElementById('agent-model-endpoint-id');
+    const providerInput = document.getElementById('agent-model-provider');
+    const statusEl = document.getElementById('agent-foundry-fetch-status');
+    const applicationIdInput = document.getElementById('agent-new-foundry-application-id');
+    const applicationVersionInput = document.getElementById('agent-new-foundry-application-version');
+    const applicationNameInput = document.getElementById('agent-new-foundry-application-name');
+
+    if (!endpointSelect) {
+      return;
+    }
+
+    const endpointId = endpointSelect.value || '';
+    if (endpointIdInput) endpointIdInput.value = endpointId;
+    if (providerInput) providerInput.value = endpointId ? this.getCurrentFoundryProvider() : '';
+
+    const selected = this.foundryEndpoints.find(endpoint => endpoint.id === endpointId);
+    if (selected) {
+      const currentFoundrySettings = this.getCurrentFoundrySettings();
+      const preserveCurrentSelection = this.shouldPreserveCurrentFoundrySelection(endpointId);
+      if (endpointInput) {
+        endpointInput.value = selected.connection?.endpoint || '';
+      }
+      if (apiVersionInput) {
+        apiVersionInput.value = selected.connection?.project_api_version || selected.connection?.api_version || 'v1';
+      }
+      if (deploymentInput) {
+        deploymentInput.value = selected.connection?.project_name || '';
+      }
+      const responsesApiVersionInput = document.getElementById('agent-new-foundry-responses-api-version');
+      if (responsesApiVersionInput) {
+        const endpointResponsesApiVersion = selected.connection?.openai_api_version || selected.connection?.api_version || '';
+        const storedResponsesApiVersion = currentFoundrySettings.responses_api_version || '';
+        responsesApiVersionInput.value = preserveCurrentSelection && storedResponsesApiVersion
+          ? storedResponsesApiVersion
+          : endpointResponsesApiVersion;
+      }
+      const agentSelect = document.getElementById('agent-foundry-agent-select');
+      if (agentSelect) {
+        agentSelect.innerHTML = '<option value="">Select an agent...</option>';
+      }
+      if (applicationIdInput) applicationIdInput.value = preserveCurrentSelection ? (currentFoundrySettings.application_id || '') : '';
+      if (applicationVersionInput) applicationVersionInput.value = preserveCurrentSelection ? (currentFoundrySettings.application_version || '') : '';
+      if (applicationNameInput) {
+        if (preserveCurrentSelection) {
+          applicationNameInput.value = currentFoundrySettings.application_name || applicationNameInput.value || '';
+        } else if (!this.currentAgent) {
+          applicationNameInput.value = '';
+        }
+      }
+      this.foundryAgents = [];
+      if (statusEl) {
+        statusEl.textContent = '';
+      }
+    }
+  }
+
+  async fetchFoundryAgents() {
+    const endpointSelect = document.getElementById('agent-foundry-endpoint-select');
+    const agentSelect = document.getElementById('agent-foundry-agent-select');
+    const statusEl = document.getElementById('agent-foundry-fetch-status');
+    if (!endpointSelect || !agentSelect) {
+      return;
+    }
+
+    const endpointId = endpointSelect.value || '';
+    const scope = endpointSelect.options[endpointSelect.selectedIndex]?.dataset?.scope || 'global';
+    if (!endpointId) {
+      showToast(`Select a ${this.isNewFoundryType() ? 'New Foundry' : 'Foundry'} endpoint before fetching ${this.isNewFoundryType() ? 'applications' : 'agents'}.`, 'warning');
+      return;
+    }
+
+    try {
+      if (statusEl) {
+        statusEl.textContent = 'Fetching agents...';
+      }
+      const response = await fetch('/api/models/foundry/agents', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ endpoint_id: endpointId, scope })
+      });
+      const payload = await response.json().catch(() => ({}));
+      if (!response.ok) {
+        throw new Error(payload.error || 'Failed to fetch Foundry agents');
+      }
+      this.foundryAgents = Array.isArray(payload.agents) ? payload.agents : [];
+      const responsesApiVersionInput = document.getElementById('agent-new-foundry-responses-api-version');
+      const fetchedResponsesApiVersion = payload.responses_api_version || '';
+      if (this.isNewFoundryType() && responsesApiVersionInput && fetchedResponsesApiVersion) {
+        responsesApiVersionInput.value = fetchedResponsesApiVersion;
+      }
+      agentSelect.innerHTML = '<option value="">Select an agent...</option>';
+      this.foundryAgents.forEach(agent => {
+        const opt = document.createElement('option');
+        const applicationValue = agent.application_id || agent.id || '';
+        const optionValue = this.isNewFoundryType() ? applicationValue : (agent.id || '');
+        const versionSuffix = agent.application_version ? ` (v${agent.application_version})` : '';
+        opt.value = optionValue;
+        opt.textContent = this.isNewFoundryType()
+          ? `${agent.display_name || agent.application_name || agent.name || applicationValue}${versionSuffix}`
+          : (agent.display_name || agent.name || agent.id || '');
+        agentSelect.appendChild(opt);
+      });
+      if (statusEl) {
+        statusEl.textContent = `${this.foundryAgents.length} ${this.isNewFoundryType() ? 'application' : 'agent'}(s) found.`;
+      }
+    } catch (error) {
+      console.error('Failed to fetch Foundry agents:', error);
+      if (statusEl) {
+        statusEl.textContent = '';
+      }
+      showToast(error.message || 'Failed to fetch Foundry agents.', 'danger');
+    }
+  }
+
+  applyFoundryAgentSelection() {
+    const agentSelect = document.getElementById('agent-foundry-agent-select');
+    const agentIdInput = document.getElementById('agent-foundry-agent-id');
+    if (!agentSelect) {
+      return;
+    }
+
+    const selectedId = agentSelect.value || '';
+    if (agentIdInput && this.isClassicFoundryType()) {
+      agentIdInput.value = selectedId;
+    }
+    const selected = this.foundryAgents.find(agent => {
+      if (this.isNewFoundryType()) {
+        return (agent.application_id || agent.id || '') === selectedId;
+      }
+      return (agent.id || '') === selectedId;
+    });
+    if (!selected) {
+      return;
+    }
+
+    if (this.isNewFoundryType()) {
+      const applicationIdInput = document.getElementById('agent-new-foundry-application-id');
+      const applicationNameInput = document.getElementById('agent-new-foundry-application-name');
+      const applicationVersionInput = document.getElementById('agent-new-foundry-application-version');
+      const responsesApiVersionInput = document.getElementById('agent-new-foundry-responses-api-version');
+      if (applicationIdInput) {
+        applicationIdInput.value = selected.application_id || selected.id || '';
+      }
+      if (applicationNameInput) {
+        applicationNameInput.value = selected.application_name || selected.name || '';
+      }
+      if (applicationVersionInput) {
+        applicationVersionInput.value = selected.application_version || '';
+      }
+      if (responsesApiVersionInput && selected.responses_api_version) {
+        responsesApiVersionInput.value = selected.responses_api_version;
+      }
+    }
+
+    const displayNameInput = document.getElementById('agent-display-name');
+    const descriptionInput = document.getElementById('agent-description');
+    if (displayNameInput && !displayNameInput.value.trim()) {
+      displayNameInput.value = selected.display_name || selected.application_name || selected.name || '';
+      this.updateGeneratedName();
+    }
+    if (descriptionInput && !descriptionInput.value.trim()) {
+      descriptionInput.value = selected.description || '';
+    }
+  }
+
   populateFields(agent) {
     // Use shared logic to determine if custom connection should be enabled
     const customConnection = document.getElementById('agent-custom-connection');
@@ -445,18 +836,30 @@ export class AgentModalStepper {
     }
 
     // Foundry-specific fields
-    if (agent.agent_type === 'aifoundry') {
+    if (this.isAnyFoundryType(agent.agent_type)) {
       const other = agent.other_settings || {};
-      const foundry = (other && other.azure_ai_foundry) || {};
+      const foundry = this.isNewFoundryType(agent.agent_type)
+        ? ((other && other.new_foundry) || {})
+        : ((other && other.azure_ai_foundry) || {});
       const endpointEl = document.getElementById('agent-foundry-endpoint');
       const apiEl = document.getElementById('agent-foundry-api-version');
       const depEl = document.getElementById('agent-foundry-deployment');
       const idEl = document.getElementById('agent-foundry-agent-id');
       const notesEl = document.getElementById('agent-foundry-notes');
+      const responsesApiEl = document.getElementById('agent-new-foundry-responses-api-version');
+      const applicationIdEl = document.getElementById('agent-new-foundry-application-id');
+      const applicationNameEl = document.getElementById('agent-new-foundry-application-name');
+      const applicationVersionEl = document.getElementById('agent-new-foundry-application-version');
+      const activityVersionEl = document.getElementById('agent-new-foundry-activity-api-version');
       if (endpointEl) endpointEl.value = agent.azure_openai_gpt_endpoint || '';
-      if (apiEl) apiEl.value = agent.azure_openai_gpt_api_version || '';
+      if (apiEl) apiEl.value = foundry.api_version || agent.azure_openai_gpt_api_version || '';
       if (depEl) depEl.value = agent.azure_openai_gpt_deployment || '';
       if (idEl) idEl.value = foundry.agent_id || '';
+      if (responsesApiEl) responsesApiEl.value = foundry.responses_api_version || agent.azure_openai_gpt_api_version || '';
+      if (applicationIdEl) applicationIdEl.value = foundry.application_id || '';
+      if (applicationNameEl) applicationNameEl.value = foundry.application_name || '';
+      if (applicationVersionEl) applicationVersionEl.value = foundry.application_version || '';
+      if (activityVersionEl) activityVersionEl.value = foundry.activity_api_version || '';
       if (notesEl) notesEl.value = foundry.notes || '';
       // ensure actions cleared for UI
       this.clearSelectedActions();
@@ -491,7 +894,7 @@ export class AgentModalStepper {
       skipBtn.innerHTML = `<span class="spinner-border spinner-border-sm me-2" role="status" aria-hidden="true"></span>Skipping...`;
     }
     try {
-      if (this.currentAgentType !== 'aifoundry') {
+      if (!this.isAnyFoundryType()) {
         await this.loadAvailableActions();
       }
       this.goToStep(this.maxSteps);
@@ -536,7 +939,7 @@ export class AgentModalStepper {
     }
 
     if (stepNumber === 2) {
-      const isFoundry = this.currentAgentType === 'aifoundry';
+      const isFoundry = this.isAnyFoundryType();
       const customConnectionToggle = document.getElementById('agent-custom-connection-toggle');
       const modelGroup = document.getElementById('agent-global-model-group');
 
@@ -544,8 +947,10 @@ export class AgentModalStepper {
         if (isFoundry) {
           customConnectionToggle.classList.add('d-none');
         } else if (!this.isAdmin) {
-          const allowUserCustom = appSettings?.allow_user_custom_agent_endpoints;
-          customConnectionToggle.classList.toggle('d-none', !allowUserCustom);
+          const allowCustomEndpoints = this.workspaceScope === 'group'
+            ? appSettings?.allow_group_custom_endpoints
+            : appSettings?.allow_user_custom_endpoints;
+          customConnectionToggle.classList.toggle('d-none', !allowCustomEndpoints);
         } else {
           customConnectionToggle.classList.remove('d-none');
         }
@@ -558,7 +963,7 @@ export class AgentModalStepper {
     
     // Load actions when reaching step 4
     if (stepNumber === 4) {
-      if (this.currentAgentType !== 'aifoundry') {
+      if (!this.isAnyFoundryType()) {
         this.loadAvailableActions();
       }
     }
@@ -699,37 +1104,51 @@ export class AgentModalStepper {
         break;
         
       case 2: // Model & Connection
-        if (this.currentAgentType === 'aifoundry') {
+        if (this.isAnyFoundryType()) {
           const endpoint = document.getElementById('agent-foundry-endpoint');
-          const apiVersion = document.getElementById('agent-foundry-api-version');
           const deployment = document.getElementById('agent-foundry-deployment');
-          const agentId = document.getElementById('agent-foundry-agent-id');
           if (!endpoint || !endpoint.value.trim()) {
-            this.showError('Azure AI Foundry endpoint is required.');
+            this.showError('A Foundry project endpoint is required.');
             endpoint?.focus();
             return false;
           }
-          if (!apiVersion || !apiVersion.value.trim()) {
-            this.showError('Azure AI Foundry API version is required.');
-            apiVersion?.focus();
-            return false;
-          }
           if (!deployment || !deployment.value.trim()) {
-            this.showError('Foundry deployment/project is required.');
+            this.showError('A Foundry project name is required.');
             deployment?.focus();
             return false;
           }
-          if (!agentId || !agentId.value.trim()) {
-            this.showError('Foundry agent ID is required.');
-            agentId?.focus();
-            return false;
+          if (this.isClassicFoundryType()) {
+            const apiVersion = document.getElementById('agent-foundry-api-version');
+            const agentId = document.getElementById('agent-foundry-agent-id');
+            if (!apiVersion || !apiVersion.value.trim()) {
+              this.showError('Classic Foundry API version is required.');
+              apiVersion?.focus();
+              return false;
+            }
+            if (!agentId || !agentId.value.trim()) {
+              this.showError('Foundry agent ID is required.');
+              agentId?.focus();
+              return false;
+            }
+          } else {
+            const responsesApiVersion = document.getElementById('agent-new-foundry-responses-api-version');
+            const applicationName = document.getElementById('agent-new-foundry-application-name');
+            if (!responsesApiVersion || !responsesApiVersion.value.trim()) {
+              this.showError('Select a New Foundry endpoint that provides an OpenAI API version before continuing.');
+              return false;
+            }
+            if (!applicationName || !applicationName.value.trim()) {
+              this.showError('Provide or fetch an application name for New Foundry.');
+              applicationName?.focus();
+              return false;
+            }
           }
         }
         break;
         
       case 3: // Instructions
         const instructions = document.getElementById('agent-instructions');
-          if (this.currentAgentType !== 'aifoundry') {
+          if (!this.isAnyFoundryType()) {
             if (!instructions || !instructions.value.trim()) {
               this.showError('Please provide instructions for the agent.');
               if (instructions) instructions.focus();
@@ -744,7 +1163,7 @@ export class AgentModalStepper {
         break;
         
       case 4: // Actions
-        if (this.currentAgentType !== 'aifoundry') {
+        if (!this.isAnyFoundryType()) {
           // Actions validation would go here if needed
         }
         break;
@@ -850,10 +1269,15 @@ export class AgentModalStepper {
   }
 
   getFormModelName() {
-    if (this.currentAgentType === 'aifoundry') {
+    if (this.isClassicFoundryType()) {
       const foundryDeployment = document.getElementById('agent-foundry-deployment');
       return foundryDeployment?.value?.trim() || '-';
     }
+    if (this.isNewFoundryType()) {
+      const applicationName = document.getElementById('agent-new-foundry-application-name');
+      const applicationId = document.getElementById('agent-new-foundry-application-id');
+      return applicationName?.value?.trim() || applicationId?.value?.trim() || '-';
+    }
     const customConnection = document.getElementById('agent-custom-connection')?.checked || false;
     let modelName = '-';
     if (customConnection) {
@@ -900,8 +1324,12 @@ export class AgentModalStepper {
     document.getElementById('summary-custom-connection').textContent = customConnection;
     const typeBadge = document.getElementById('summary-agent-type-badge');
     if (typeBadge) {
-      typeBadge.textContent = agentType === 'aifoundry' ? 'Azure AI Foundry' : 'Local (Semantic Kernel)';
-      typeBadge.className = agentType === 'aifoundry' ? 'badge bg-warning text-dark' : 'badge bg-info';
+      typeBadge.textContent = this.getAgentTypeLabel(agentType);
+      typeBadge.className = this.isNewFoundryType(agentType)
+        ? 'badge bg-primary'
+        : this.isClassicFoundryType(agentType)
+          ? 'badge bg-warning text-dark'
+          : 'badge bg-info';
     }
     
     // Update instructions
@@ -917,7 +1345,7 @@ export class AgentModalStepper {
     const actionsListContainer = document.getElementById('summary-actions-list');
     const actionsEmptyContainer = document.getElementById('summary-actions-empty');
     
-    if (this.currentAgentType === 'aifoundry') {
+    if (this.isAnyFoundryType()) {
       // Hide actions entirely for Foundry
       const actionsSection = document.getElementById('summary-actions-section');
       if (actionsSection) actionsSection.style.display = 'none';
@@ -1468,7 +1896,7 @@ export class AgentModalStepper {
       }
       
       // Add selected actions (skip for Foundry)
-      if (agentData.agent_type === 'aifoundry') {
+      if (this.isAnyFoundryType(agentData.agent_type)) {
         agentData.actions_to_load = [];
       } else {
         agentData.actions_to_load = this.getSelectedActionIds();
@@ -1531,17 +1959,29 @@ export class AgentModalStepper {
     const agentTypeInput = document.querySelector('input[name="agent-type"]:checked');
     const selectedAgentType = agentTypeInput ? agentTypeInput.value : 'local';
 
+    const modelSelect = document.getElementById('agent-global-model-select');
+    const selectedModelOption = modelSelect ? modelSelect.options[modelSelect.selectedIndex] : null;
+    const modelEndpointInput = document.getElementById('agent-model-endpoint-id');
+    const modelIdInput = document.getElementById('agent-model-id');
+    const modelProviderInput = document.getElementById('agent-model-provider');
+    const modelEndpointId = modelEndpointInput?.value || selectedModelOption?.dataset?.endpointId || '';
+    const modelId = modelIdInput?.value || selectedModelOption?.value || '';
+    const modelProvider = modelProviderInput?.value || selectedModelOption?.dataset?.provider || '';
+
     const formData = {
       display_name: document.getElementById('agent-display-name')?.value || '',
       name: document.getElementById('agent-name')?.value || '',
       description: document.getElementById('agent-description')?.value || '',
       instructions: document.getElementById('agent-instructions')?.value || '',
-      model: document.getElementById('agent-global-model-select')?.value || '',
+      model: modelSelect?.value || '',
       custom_connection: document.getElementById('agent-custom-connection')?.checked || false,
       other_settings: document.getElementById('agent-additional-settings')?.value || '{}',
       max_completion_tokens: parseInt(document.getElementById('agent-max-completion-tokens')?.value.trim()) || null,
       reasoning_effort: document.getElementById('agent-reasoning-effort')?.value || '',
-      agent_type: selectedAgentType
+      agent_type: selectedAgentType,
+      model_endpoint_id: modelEndpointId,
+      model_id: modelId,
+      model_provider: modelProvider
     };
 
     if (selectedAgentType === 'aifoundry') {
@@ -1563,6 +2003,7 @@ export class AgentModalStepper {
       otherSettingsObj.azure_ai_foundry = {
         ...(otherSettingsObj.azure_ai_foundry || {}),
         agent_id: document.getElementById('agent-foundry-agent-id')?.value?.trim() || '',
+        endpoint_id: modelEndpointId || '',
         ...(notesVal ? { notes: notesVal } : {})
       };
       formData.other_settings = JSON.stringify(otherSettingsObj);
@@ -1570,6 +2011,49 @@ export class AgentModalStepper {
       // Foundry agents cannot have actions
       formData.actions_to_load = [];
       formData.enable_agent_gpt_apim = false;
+      formData.model_endpoint_id = modelEndpointId;
+      formData.model_id = '';
+      formData.model_provider = 'aifoundry';
+      return formData;
+    }
+
+    if (selectedAgentType === 'new_foundry') {
+      formData.azure_openai_gpt_endpoint = document.getElementById('agent-foundry-endpoint')?.value?.trim() || '';
+      formData.azure_openai_gpt_deployment = document.getElementById('agent-foundry-deployment')?.value?.trim() || '';
+      formData.azure_openai_gpt_api_version = document.getElementById('agent-new-foundry-responses-api-version')?.value?.trim() || '';
+      formData.instructions = document.getElementById('agent-instructions')?.value?.trim() || this.foundryPlaceholderInstructions;
+
+      let otherSettingsObj = {};
+      try {
+        otherSettingsObj = JSON.parse(formData.other_settings || '{}');
+      } catch (e) {
+        otherSettingsObj = {};
+      }
+      otherSettingsObj = otherSettingsObj || {};
+
+      const notesVal = document.getElementById('agent-foundry-notes')?.value || '';
+      const applicationId = document.getElementById('agent-new-foundry-application-id')?.value?.trim() || '';
+      const applicationName = document.getElementById('agent-new-foundry-application-name')?.value?.trim() || '';
+      const applicationVersion = document.getElementById('agent-new-foundry-application-version')?.value?.trim() || '';
+      const activityApiVersion = document.getElementById('agent-new-foundry-activity-api-version')?.value?.trim() || '';
+
+      otherSettingsObj.new_foundry = {
+        ...(otherSettingsObj.new_foundry || {}),
+        application_id: applicationId,
+        application_name: applicationName,
+        application_version: applicationVersion,
+        endpoint_id: modelEndpointId || '',
+        responses_api_version: formData.azure_openai_gpt_api_version,
+        ...(activityApiVersion ? { activity_api_version: activityApiVersion } : {}),
+        ...(notesVal ? { notes: notesVal } : {}),
+      };
+      formData.other_settings = JSON.stringify(otherSettingsObj);
+
+      formData.actions_to_load = [];
+      formData.enable_agent_gpt_apim = false;
+      formData.model_endpoint_id = modelEndpointId;
+      formData.model_id = '';
+      formData.model_provider = 'new_foundry';
       return formData;
     }
     
@@ -1603,11 +2087,15 @@ export class AgentModalStepper {
         if (gptApiVersion) formData.azure_openai_gpt_api_version = gptApiVersion;
         formData.enable_agent_gpt_apim = false;
       }
+      formData.model_endpoint_id = '';
+      formData.model_id = '';
+      formData.model_provider = '';
     } else {
       // Using global model - need to set at least one deployment field
       // We'll use the selected model as the deployment name for now
       if (formData.model) {
-        formData.azure_openai_gpt_deployment = formData.model;
+        const deploymentName = selectedModelOption?.dataset?.deploymentName || formData.model;
+        formData.azure_openai_gpt_deployment = deploymentName;
       }
     }
     
diff --git a/application/single_app/static/js/agents_common.js b/application/single_app/static/js/agents_common.js
index e3543a0d..4f2b991b 100644
--- a/application/single_app/static/js/agents_common.js
+++ b/application/single_app/static/js/agents_common.js
@@ -33,21 +33,40 @@ export function attachAdvancedToggleHandler(toggleEl, modalElements) {
  */
 export function setAgentModalFields(agent, opts = {}) {
 	const root = opts.modalRoot || document;
-	root.getElementById('agent-name').value = agent.name || '';
-	root.getElementById('agent-display-name').value = agent.display_name || '';
-	root.getElementById('agent-description').value = agent.description || '';
-	root.getElementById('agent-gpt-endpoint').value = agent.azure_openai_gpt_endpoint || '';
-	root.getElementById('agent-gpt-key').value = agent.azure_openai_gpt_key || '';
-	root.getElementById('agent-gpt-deployment').value = agent.azure_openai_gpt_deployment || '';
-	root.getElementById('agent-gpt-api-version').value = agent.azure_openai_gpt_api_version || '';
-	root.getElementById('agent-apim-endpoint').value = agent.azure_agent_apim_gpt_endpoint || '';
-	root.getElementById('agent-apim-subscription-key').value = agent.azure_agent_apim_gpt_subscription_key || '';
-	root.getElementById('agent-apim-deployment').value = agent.azure_agent_apim_gpt_deployment || '';
-	root.getElementById('agent-apim-api-version').value = agent.azure_agent_apim_gpt_api_version || '';
-	root.getElementById('agent-enable-apim').checked = !!agent.enable_agent_gpt_apim;
-	root.getElementById('agent-instructions').value = agent.instructions || '';
-	root.getElementById('agent-additional-settings').value = agent.other_settings ? JSON.stringify(agent.other_settings, null, 2) : '{}';
-	root.getElementById('agent-max-completion-tokens').value = agent.max_completion_tokens || '';
+	const setValue = (id, value) => {
+		const el = root.getElementById(id);
+		if (el) {
+			el.value = value ?? '';
+		}
+	};
+	const setChecked = (id, value) => {
+		const el = root.getElementById(id);
+		if (el) {
+			el.checked = !!value;
+		}
+	};
+
+	setValue('agent-name', agent.name || '');
+	setValue('agent-display-name', agent.display_name || '');
+	setValue('agent-description', agent.description || '');
+	setValue('agent-gpt-endpoint', agent.azure_openai_gpt_endpoint || '');
+	setValue('agent-gpt-key', agent.azure_openai_gpt_key || '');
+	setValue('agent-gpt-deployment', agent.azure_openai_gpt_deployment || '');
+	setValue('agent-gpt-api-version', agent.azure_openai_gpt_api_version || '');
+	setValue('agent-apim-endpoint', agent.azure_agent_apim_gpt_endpoint || '');
+	setValue('agent-apim-subscription-key', agent.azure_agent_apim_gpt_subscription_key || '');
+	setValue('agent-apim-deployment', agent.azure_agent_apim_gpt_deployment || '');
+	setValue('agent-apim-api-version', agent.azure_agent_apim_gpt_api_version || '');
+	setChecked('agent-enable-apim', agent.enable_agent_gpt_apim);
+	setValue('agent-model-endpoint-id', agent.model_endpoint_id || '');
+	setValue('agent-model-id', agent.model_id || '');
+	setValue('agent-model-provider', agent.model_provider || '');
+	setValue('agent-instructions', agent.instructions || '');
+	setValue(
+		'agent-additional-settings',
+		agent.other_settings ? JSON.stringify(agent.other_settings, null, 2) : '{}'
+	);
+	setValue('agent-max-completion-tokens', agent.max_completion_tokens || '');
 	
 	// Set reasoning effort if available
 	const reasoningEffortSelect = root.getElementById('agent-reasoning-effort');
@@ -64,9 +83,17 @@ export function setAgentModalFields(agent, opts = {}) {
  */
 export function getAgentModalFields(opts = {}) {
 	const root = opts.modalRoot || document;
+	const getValue = (id) => {
+		const el = root.getElementById(id);
+		return el ? el.value.trim() : '';
+	};
+	const getChecked = (id) => {
+		const el = root.getElementById(id);
+		return el ? el.checked : false;
+	};
 	let additionalSettings = {};
 	try {
-		const settingsRaw = root.getElementById('agent-additional-settings').value.trim();
+		const settingsRaw = getValue('agent-additional-settings');
 		if (settingsRaw) additionalSettings = JSON.parse(settingsRaw);
 	} catch (e) {
 		showToast('error', 'Additional Settings must be a valid JSON object.');
@@ -89,20 +116,23 @@ export function getAgentModalFields(opts = {}) {
 	}
 
 	return {
-		name: root.getElementById('agent-name').value.trim(),
-		display_name: root.getElementById('agent-display-name').value.trim(),
-		description: root.getElementById('agent-description').value.trim(),
-		azure_openai_gpt_endpoint: root.getElementById('agent-gpt-endpoint').value.trim(),
-		azure_openai_gpt_key: root.getElementById('agent-gpt-key').value.trim(),
-		azure_openai_gpt_deployment: root.getElementById('agent-gpt-deployment').value.trim(),
-		azure_openai_gpt_api_version: root.getElementById('agent-gpt-api-version').value.trim(),
-		azure_agent_apim_gpt_endpoint: root.getElementById('agent-apim-endpoint').value.trim(),
-		azure_agent_apim_gpt_subscription_key: root.getElementById('agent-apim-subscription-key').value.trim(),
-		azure_agent_apim_gpt_deployment: root.getElementById('agent-apim-deployment').value.trim(),
-		azure_agent_apim_gpt_api_version: root.getElementById('agent-apim-api-version').value.trim(),
-		enable_agent_gpt_apim: root.getElementById('agent-enable-apim').checked,
-		instructions: root.getElementById('agent-instructions').value.trim(),
-		max_completion_tokens: parseInt(root.getElementById('agent-max-completion-tokens').value.trim()) || null,
+		name: getValue('agent-name'),
+		display_name: getValue('agent-display-name'),
+		description: getValue('agent-description'),
+		azure_openai_gpt_endpoint: getValue('agent-gpt-endpoint'),
+		azure_openai_gpt_key: getValue('agent-gpt-key'),
+		azure_openai_gpt_deployment: getValue('agent-gpt-deployment'),
+		azure_openai_gpt_api_version: getValue('agent-gpt-api-version'),
+		azure_agent_apim_gpt_endpoint: getValue('agent-apim-endpoint'),
+		azure_agent_apim_gpt_subscription_key: getValue('agent-apim-subscription-key'),
+		azure_agent_apim_gpt_deployment: getValue('agent-apim-deployment'),
+		azure_agent_apim_gpt_api_version: getValue('agent-apim-api-version'),
+		model_endpoint_id: getValue('agent-model-endpoint-id'),
+		model_id: getValue('agent-model-id'),
+		model_provider: getValue('agent-model-provider'),
+		enable_agent_gpt_apim: getChecked('agent-enable-apim'),
+		instructions: getValue('agent-instructions'),
+		max_completion_tokens: parseInt(getValue('agent-max-completion-tokens')) || null,
 		actions_to_load: actions_to_load,
 		other_settings: additionalSettings,
 		agent_type: (opts.agent && opts.agent.agent_type) || 'local'
@@ -366,6 +396,41 @@ export function shouldEnableCustomConnection(agent) {
 export function getAvailableModels({ apimEnabled, settings, agent }) {
 	let models = [];
 	let selectedModel = null;
+	const endpoints = Array.isArray(settings?.model_endpoints) ? settings.model_endpoints : [];
+	const multiEndpointEnabled = (settings && settings.enable_multi_model_endpoints) || endpoints.length > 0;
+	if (multiEndpointEnabled && endpoints.length) {
+		const agentType = (agent && agent.agent_type) ? agent.agent_type : 'local';
+		endpoints.forEach(endpoint => {
+			if (!endpoint || endpoint.enabled === false) return;
+			const provider = (endpoint.provider || 'aoai').toLowerCase();
+			if (agentType === 'aifoundry' && provider !== 'aifoundry') {
+				return;
+			}
+			if (agentType === 'new_foundry' && provider !== 'new_foundry') {
+				return;
+			}
+			const endpointId = endpoint.id || '';
+			const endpointModels = endpoint.models || [];
+			endpointModels.forEach(model => {
+				if (!model || model.enabled === false) return;
+				const modelId = model.id || model.deploymentName || model.deployment || model.modelName || model.name || '';
+				const deploymentName = model.deploymentName || model.deployment || '';
+				const modelName = model.modelName || model.name || '';
+				const displayName = model.displayName || deploymentName || modelName || modelId;
+				if (!displayName) return;
+				models.push({
+					id: modelId,
+					deployment: deploymentName,
+					name: modelName,
+					display_name: displayName,
+					endpoint_id: endpointId,
+					provider
+				});
+			});
+		});
+		selectedModel = agent && (agent.model_id || agent.azure_openai_gpt_deployment) ? (agent.model_id || agent.azure_openai_gpt_deployment) : null;
+		return { models, selectedModel };
+	}
 	if (apimEnabled) {
 		// azure_apim_gpt_deployment is a string, could be comma separated
 		let apimDeployments = (settings && settings.azure_apim_gpt_deployment) || '';
@@ -395,7 +460,7 @@ export function getAvailableModels({ apimEnabled, settings, agent }) {
  * Fetches settings from endpoint and returns available models, selected model, and apimEnabled
  * @param {string} endpoint - API endpoint to fetch settings
  * @param {Object} agent - Current agent object
- * @returns {Promise<{models: Array, selectedModel: string, apimEnabled: boolean}>}
+ * @returns {Promise<{models: Array, selectedModel: string, apimEnabled: boolean, enableMultiModelEndpoints: boolean}>}
  */
 export async function fetchAndGetAvailableModels(endpoint, agent) {
 	try {
@@ -404,10 +469,12 @@ export async function fetchAndGetAvailableModels(endpoint, agent) {
 		const settings = await resp.json();
 		// Check APIM enabled (support both enable_gpt_apim and enable_apim)
 		const apimEnabled = settings.enable_gpt_apim || false;
+		const endpoints = Array.isArray(settings.model_endpoints) ? settings.model_endpoints : [];
+		const enableMultiModelEndpoints = (settings.enable_multi_model_endpoints || false) || endpoints.length > 0;
 		const { models, selectedModel } = getAvailableModels({ apimEnabled, settings, agent });
-		return { models, selectedModel, apimEnabled };
+		return { models, selectedModel, apimEnabled, enableMultiModelEndpoints };
 	} catch (e) {
-		return { models: [], selectedModel: null, apimEnabled: false };
+		return { models: [], selectedModel: null, apimEnabled: false, enableMultiModelEndpoints: false };
 	}
 }
 
@@ -460,8 +527,17 @@ export function populateGlobalModelDropdown(selectEl, models, selectedModel) {
 	}
 	models.forEach(model => {
 		let opt = document.createElement('option');
-		opt.value = model.name || model.deployment || model.id || '';
+		opt.value = model.id || model.name || model.deployment || '';
 		opt.textContent = model.display_name || model.name || model.deployment || model.id || '';
+		if (model.endpoint_id) {
+			opt.dataset.endpointId = model.endpoint_id;
+		}
+		if (model.provider) {
+			opt.dataset.provider = model.provider;
+		}
+		if (model.deployment) {
+			opt.dataset.deploymentName = model.deployment;
+		}
 		if (selectedModel && (model.name === selectedModel || model.deployment === selectedModel || model.id === selectedModel)) {
 			opt.selected = true;
 		}
@@ -480,8 +556,9 @@ export async function fetchUserAgents() {
 	return await res.json();
 }
 
-export async function fetchGroupAgentsForActiveGroup() {
-	if (typeof window === 'undefined' || !window.activeGroupId) {
+export async function fetchGroupAgentsForActiveGroup(activeGroupId = null, activeGroupName = null) {
+	const resolvedGroupId = activeGroupId || (typeof window !== 'undefined' ? window.activeGroupId : null);
+	if (!resolvedGroupId) {
 		return [];
 	}
 	try {
@@ -492,12 +569,12 @@ export async function fetchGroupAgentsForActiveGroup() {
 		}
 		const payload = await res.json().catch(() => ({ agents: [] }));
 		const agents = Array.isArray(payload.agents) ? payload.agents : [];
-		const activeGroupName = (typeof window !== 'undefined' && window.activeGroupName) ? window.activeGroupName : '';
+		const resolvedGroupName = activeGroupName || ((typeof window !== 'undefined' && window.activeGroupName) ? window.activeGroupName : '');
 		return agents.map(agent => ({
 			...agent,
 			is_group: true,
-			group_id: agent.group_id || window.activeGroupId,
-			group_name: agent.group_name || activeGroupName || null
+			group_id: agent.group_id || resolvedGroupId,
+			group_name: agent.group_name || resolvedGroupName || null
 		}));
 	} catch (error) {
 		console.error('Failed to fetch group agents:', error);
diff --git a/application/single_app/static/js/chat/chat-agents.js b/application/single_app/static/js/chat/chat-agents.js
index af18ff21..b892e31b 100644
--- a/application/single_app/static/js/chat/chat-agents.js
+++ b/application/single_app/static/js/chat/chat-agents.js
@@ -46,6 +46,47 @@ function initializeAgentSelector() {
     return agentSelectorController;
 }
 
+function sanitizeGroupId(groupId) {
+    if (!groupId && groupId !== 0) return null;
+    const normalized = String(groupId).trim();
+    if (!normalized) return null;
+    const lower = normalized.toLowerCase();
+    if (lower === 'none' || lower === 'null' || lower === 'undefined') return null;
+    return normalized;
+}
+
+function getActiveConversationContext() {
+    const activeItem = document.querySelector('.conversation-item.active');
+    const chatType = activeItem?.getAttribute('data-chat-type') || '';
+    const chatState = activeItem?.getAttribute('data-chat-state') || '';
+    const itemGroupId = sanitizeGroupId(activeItem?.getAttribute('data-group-id'));
+
+    return {
+        chatType,
+        chatState,
+        groupId: itemGroupId
+    };
+}
+
+function getActiveConversationScope() {
+    const activeItem = document.querySelector('.conversation-item.active');
+    const chatType = activeItem?.getAttribute('data-chat-type') || '';
+    const chatState = activeItem?.getAttribute('data-chat-state') || '';
+    if (chatType === 'new') {
+        return null;
+    }
+    if (chatState === 'new') {
+        return null;
+    }
+    if (!chatType) {
+        return 'personal';
+    }
+    if (chatType.startsWith('group')) {
+        return 'group';
+    }
+    return 'personal';
+}
+
 /**
  * Check if agents are currently enabled
  * @returns {boolean} True if agents are active
@@ -96,16 +137,46 @@ export async function populateAgentDropdown() {
     initializeAgentSelector();
 
     try {
+        const conversationScope = getActiveConversationScope();
+        const { chatType, chatState, groupId: conversationGroupId } = getActiveConversationContext();
+        const activeConversation = document.querySelector('.conversation-item.active');
+        const userActiveGroupId = sanitizeGroupId(await getUserSetting('activeGroupOid'));
+        const workspaceGroupId = sanitizeGroupId(window.groupWorkspaceContext?.activeGroupId || window.activeGroupId);
+
+        // Only allow group agents when a group context exists or no conversation is selected.
+        const allowGroupAgents = !activeConversation
+            || conversationScope === 'group'
+            || !!conversationGroupId
+            || chatState === 'new'
+            || chatType === 'new';
+
+        const activeGroupId = allowGroupAgents
+            ? (conversationGroupId || userActiveGroupId || workspaceGroupId || null)
+            : null;
         const [userAgents, selectedAgent] = await Promise.all([
             fetchUserAgents(),
             fetchSelectedAgent()
         ]);
-        const groupAgents = await fetchGroupAgentsForActiveGroup();
-        const combinedAgents = [...userAgents, ...groupAgents];
-        const personalAgents = combinedAgents.filter(agent => !agent.is_global && !agent.is_group);
-        const activeGroupAgents = combinedAgents.filter(agent => agent.is_group);
-        const globalAgents = combinedAgents.filter(agent => agent.is_global);
-        const orderedAgents = [...personalAgents, ...activeGroupAgents, ...globalAgents];
+        const groupAgents = activeGroupId ? await fetchGroupAgentsForActiveGroup(activeGroupId) : [];
+        const personalAgents = userAgents.filter(agent => !agent.is_global && !agent.is_group);
+        const globalAgents = userAgents.filter(agent => agent.is_global);
+        let orderedAgents = [];
+        const includeGroupAgents = allowGroupAgents && groupAgents.length > 0;
+
+        if (!conversationScope) {
+            orderedAgents = includeGroupAgents
+                ? [...personalAgents, ...groupAgents, ...globalAgents]
+                : [...personalAgents, ...globalAgents];
+        } else if (conversationScope === 'group') {
+            orderedAgents = includeGroupAgents
+                ? [...groupAgents, ...globalAgents]
+                : [...globalAgents];
+        } else {
+            // Personal scope: show personal first; only add group agents when explicitly allowed
+            orderedAgents = includeGroupAgents
+                ? [...personalAgents, ...groupAgents, ...globalAgents]
+                : [...personalAgents, ...globalAgents];
+        }
         populateAgentSelect(agentSelect, orderedAgents, selectedAgent);
         agentSelectorController?.refresh();
         agentSelect.onchange = async function () {
diff --git a/application/single_app/static/js/chat/chat-conversation-details.js b/application/single_app/static/js/chat/chat-conversation-details.js
index 484128af..48516251 100644
--- a/application/single_app/static/js/chat/chat-conversation-details.js
+++ b/application/single_app/static/js/chat/chat-conversation-details.js
@@ -539,23 +539,21 @@ function formatClassifications(classifications) {
 
 function formatChatType(chatType, context = []) {
   // Use the actual chat_type value from the metadata
-  if (chatType === 'personal') {
-    return '<span class="badge bg-primary">personal</span>';
+  if (chatType === 'personal' || chatType === 'personal_single_user') {
+    return '<span class="text-muted">personal</span>';
+  } else if (chatType === 'new') {
+    return '<span class="badge bg-secondary">new</span>';
   } else if (chatType === 'group' || chatType.startsWith('group')) {
     // For group chats, try to find the group name from context
     const primaryContext = context.find(c => c.type === 'primary' && c.scope === 'group');
     const groupName = primaryContext ? primaryContext.name || 'Group' : 'Group';
-    
-    // Determine if single-user or multi-user based on chat_type
-    const userType = chatType.includes('multi-user') ? 'multi-user' : 'single-user';
-    
-    return `
-      <span class="badge bg-info me-1">group - ${groupName}</span>
-      <span class="badge bg-secondary">${userType}</span>
-    `;
+
+    return `<span class="badge bg-info" title="${escapeHtml(groupName)}">${escapeHtml(groupName)}</span>`;
+  } else if (chatType && chatType.startsWith('public')) {
+    return '<span class="badge bg-success">public</span>';
   } else {
     // Fallback for unknown types
-    return `<span class="badge bg-secondary">${chatType}</span>`;
+    return `<span class="text-muted">${escapeHtml(chatType)}</span>`;
   }
 }
 
diff --git a/application/single_app/static/js/chat/chat-conversations.js b/application/single_app/static/js/chat/chat-conversations.js
index 34c035be..403d42e0 100644
--- a/application/single_app/static/js/chat/chat-conversations.js
+++ b/application/single_app/static/js/chat/chat-conversations.js
@@ -10,6 +10,8 @@ import {
 } from "./chat-sidebar-conversations.js";
 import { toggleConversationInfoButton } from "./chat-conversation-info-button.js";
 import { restoreScopeLockState, resetScopeLock } from "./chat-documents.js";
+import { loadUserSettings } from "./chat-layout.js";
+import { setUserSetting } from "../agents_common.js";
 
 const newConversationBtn = document.getElementById("new-conversation-btn");
 const deleteSelectedBtn = document.getElementById("delete-selected-btn");
@@ -25,6 +27,71 @@ const chatbox = document.getElementById("chatbox");
 let selectedConversations = new Set();
 
 let currentlyEditingId = null; // Track which item is being edited
+
+async function ensureActiveGroupForConversation() {
+  const activeItem = document.querySelector('.conversation-item.active');
+  if (!activeItem) return null;
+
+  const chatType = activeItem.getAttribute('data-chat-type') || '';
+  if (!chatType.startsWith('group')) return null;
+
+  const convoGroupId = activeItem.getAttribute('data-group-id') || null;
+  if (!convoGroupId) return null;
+
+  try {
+    const settings = await loadUserSettings();
+    const currentActiveGroupId = settings?.activeGroupOid || null;
+    if (currentActiveGroupId && String(currentActiveGroupId) === String(convoGroupId)) {
+      return convoGroupId;
+    }
+
+    await setUserSetting('activeGroupOid', convoGroupId);
+    return convoGroupId;
+  } catch (error) {
+    console.warn('Failed to align active group with conversation context:', error);
+    return convoGroupId;
+  }
+}
+
+async function refreshAgentsForActiveConversation() {
+  try {
+    await ensureActiveGroupForConversation();
+    const agentsModule = await import('./chat-agents.js');
+    const enableAgentsBtn = document.getElementById("enable-agents-btn");
+    if (enableAgentsBtn && enableAgentsBtn.classList.contains('active')) {
+      await agentsModule.populateAgentDropdown();
+    }
+  } catch (error) {
+    console.warn('Failed to refresh agent dropdown:', error);
+  }
+}
+
+async function refreshModelSelection() {
+  const modelSelect = document.getElementById("model-select");
+  if (!modelSelect) return;
+
+  try {
+    const settings = await loadUserSettings();
+    const preferredModelId = settings?.preferredModelId;
+    const preferredModelDeployment = settings?.preferredModelDeployment;
+    const optionValues = new Set(Array.from(modelSelect.options).map(option => option.value));
+
+    if (preferredModelId && optionValues.has(preferredModelId)) {
+      modelSelect.value = preferredModelId;
+    } else if (preferredModelDeployment && optionValues.has(preferredModelDeployment)) {
+      modelSelect.value = preferredModelDeployment;
+    }
+
+    modelSelect.dispatchEvent(new Event('change'));
+  } catch (error) {
+    console.warn('Failed to refresh model selection:', error);
+  }
+}
+
+async function refreshAgentsAndModelsForActiveConversation() {
+  await refreshAgentsForActiveConversation();
+  await refreshModelSelection();
+}
 let selectionModeActive = false; // Track if selection mode is active
 let selectionModeTimer = null; // Timer for auto-hiding checkboxes
 let showHiddenConversations = false; // Track if hidden conversations should be shown
@@ -185,6 +252,8 @@ document.addEventListener('DOMContentLoaded', () => {
       }
     });
   }
+
+  void refreshAgentsAndModelsForActiveConversation();
 });
 
 // Function to enter selection mode
@@ -485,23 +554,30 @@ export function createConversationItem(convo) {
   // Use the actual chat_type from conversation metadata if available
   console.log(`createConversationItem: Processing conversation ${convo.id}, chat_type="${convo.chat_type}"`);
   
-  if (convo.chat_type) {
-    convoItem.setAttribute("data-chat-type", convo.chat_type);
-    console.log(`createConversationItem: Set data-chat-type to "${convo.chat_type}"`);
+  const normalizedChatType = convo.chat_type === 'personal' ? 'personal_single_user' : convo.chat_type;
+  if (normalizedChatType) {
+    convoItem.setAttribute("data-chat-type", normalizedChatType);
+    console.log(`createConversationItem: Set data-chat-type to "${normalizedChatType}"`);
     
     // For group chats, try to find group name from context
-    if (convo.chat_type.startsWith('group') && convo.context && convo.context.length > 0) {
+    if (normalizedChatType.startsWith('group') && convo.context && convo.context.length > 0) {
       const primaryContext = convo.context.find(c => c.type === 'primary' && c.scope === 'group');
       if (primaryContext) {
         convoItem.setAttribute("data-group-name", primaryContext.name || 'Group');
+        if (primaryContext.id) {
+          convoItem.setAttribute("data-group-id", primaryContext.id);
+        }
         console.log(`createConversationItem: Set data-group-name to "${primaryContext.name || 'Group'}"`);
       }
-    } else if (convo.chat_type.startsWith('public') && convo.context && convo.context.length > 0) {
+    } else if (normalizedChatType.startsWith('public') && convo.context && convo.context.length > 0) {
       const primaryContext = convo.context.find(c => c.type === 'primary' && c.scope === 'public');
       if (primaryContext) {
         convoItem.setAttribute("data-group-name", primaryContext.name || 'Workspace');
+        convoItem.removeAttribute("data-group-id");
         console.log(`createConversationItem: Set data-group-name to "${primaryContext.name || 'Workspace'}"`);
       }
+    } else {
+      convoItem.removeAttribute("data-group-id");
     }
   } else {
     console.log(`createConversationItem: No chat_type found, determining from context`);
@@ -513,23 +589,31 @@ export function createConversationItem(convo) {
         if (primaryContext.scope === 'group') {
           convoItem.setAttribute("data-group-name", primaryContext.name || 'Group');
           convoItem.setAttribute("data-chat-type", "group-single-user"); // Default to single-user for now
+          if (primaryContext.id) {
+            convoItem.setAttribute("data-group-id", primaryContext.id);
+          }
           console.log(`createConversationItem: Set to group-single-user with name "${primaryContext.name || 'Group'}"`);
         } else if (primaryContext.scope === 'public') {
           convoItem.setAttribute("data-group-name", primaryContext.name || 'Workspace');
           convoItem.setAttribute("data-chat-type", "public");
+          convoItem.removeAttribute("data-group-id");
           console.log(`createConversationItem: Set to public with name "${primaryContext.name || 'Workspace'}"`);
         } else if (primaryContext.scope === 'personal') {
-          convoItem.setAttribute("data-chat-type", "personal");
-          console.log(`createConversationItem: Set to personal`);
+          convoItem.setAttribute("data-chat-type", "personal_single_user");
+          convoItem.removeAttribute("data-group-id");
+          console.log(`createConversationItem: Set to personal_single_user`);
         }
       } else {
-        // No primary context - this is a model-only conversation
-        // Don't set data-chat-type so no badges will be shown
-        console.log(`createConversationItem: No primary context - model-only conversation (no badges)`);
+        // No primary context - default to personal_single_user
+        convoItem.setAttribute("data-chat-type", "personal_single_user");
+        convoItem.removeAttribute("data-group-id");
+        console.log(`createConversationItem: No primary context - defaulted to personal_single_user`);
       }
     } else {
-      // No context at all - model-only conversation
-      console.log(`createConversationItem: No context - model-only conversation (no badges)`);
+      // No context at all - default to personal_single_user
+      convoItem.setAttribute("data-chat-type", "personal_single_user");
+      convoItem.removeAttribute("data-group-id");
+      console.log(`createConversationItem: No context - defaulted to personal_single_user`);
     }
   }
 
@@ -922,10 +1006,19 @@ export function addConversationToList(conversationId, title = null, classificati
     title: title || "New Conversation", // Default title
     last_updated: new Date().toISOString(),
     classification: classifications, // Include classifications
+    chat_type: "new", // Temporary chat type until metadata is fetched
     has_unread_assistant_response: false,
   };
 
   const convoItem = createConversationItem(convo);
+  convoItem.dataset.chatState = "new";
+  const rawGroupId = window.groupWorkspaceContext?.activeGroupId || window.activeGroupId || null;
+  const normalizedGroupId = rawGroupId && !['none', 'null', 'undefined'].includes(String(rawGroupId).toLowerCase())
+    ? rawGroupId
+    : null;
+  if (normalizedGroupId) {
+    convoItem.setAttribute("data-group-id", normalizedGroupId);
+  }
   convoItem.classList.add("active"); // Mark the new one as active
   conversationsList.prepend(convoItem); // Add to the top
   
@@ -933,6 +1026,8 @@ export function addConversationToList(conversationId, title = null, classificati
   if (document.getElementById("sidebar-conversations-list")) {
     loadSidebarConversations();
   }
+
+  void refreshAgentsAndModelsForActiveConversation();
 }
 
 // Select a conversation, load messages, update UI
@@ -988,20 +1083,27 @@ export async function selectConversation(conversationId) {
       
       // Update conversation item with accurate chat_type from metadata
       if (metadata.chat_type) {
-        convoItem.setAttribute("data-chat-type", metadata.chat_type);
-        console.log(`selectConversation: Updated data-chat-type to "${metadata.chat_type}"`);
+        const normalizedChatType = metadata.chat_type === 'personal' ? 'personal_single_user' : metadata.chat_type;
+        convoItem.setAttribute("data-chat-type", normalizedChatType);
+        console.log(`selectConversation: Updated data-chat-type to "${normalizedChatType}"`);
+
+        convoItem.removeAttribute("data-chat-state");
         
         // Clear any existing group name first
         convoItem.removeAttribute("data-group-name");
+        convoItem.removeAttribute("data-group-id");
         
         // If it's a group chat, also update group name
-        if (metadata.chat_type.startsWith('group') && metadata.context && metadata.context.length > 0) {
+        if (normalizedChatType.startsWith('group') && metadata.context && metadata.context.length > 0) {
           const primaryContext = metadata.context.find(c => c.type === 'primary' && c.scope === 'group');
           if (primaryContext) {
             convoItem.setAttribute("data-group-name", primaryContext.name || 'Group');
+            if (primaryContext.id) {
+              convoItem.setAttribute("data-group-id", primaryContext.id);
+            }
             console.log(`selectConversation: Set data-group-name to "${primaryContext.name || 'Group'}"`);
           }
-        } else if (metadata.chat_type.startsWith('public') && metadata.context && metadata.context.length > 0) {
+        } else if (normalizedChatType.startsWith('public') && metadata.context && metadata.context.length > 0) {
           const primaryContext = metadata.context.find(c => c.type === 'primary' && c.scope === 'public');
           if (primaryContext) {
             convoItem.setAttribute("data-group-name", primaryContext.name || 'Workspace');
@@ -1016,6 +1118,8 @@ export async function selectConversation(conversationId) {
         // Clear any existing attributes first
         convoItem.removeAttribute("data-chat-type");
         convoItem.removeAttribute("data-group-name");
+        convoItem.removeAttribute("data-group-id");
+        convoItem.removeAttribute("data-chat-state");
         
         if (metadata.context && metadata.context.length > 0) {
           const primaryContext = metadata.context.find(c => c.type === 'primary');
@@ -1024,23 +1128,27 @@ export async function selectConversation(conversationId) {
             if (primaryContext.scope === 'group') {
               convoItem.setAttribute("data-group-name", primaryContext.name || 'Group');
               convoItem.setAttribute("data-chat-type", "group-single-user"); // Default to single-user for now
+              if (primaryContext.id) {
+                convoItem.setAttribute("data-group-id", primaryContext.id);
+              }
               console.log(`selectConversation: Set to group-single-user with name "${primaryContext.name || 'Group'}"`);
             } else if (primaryContext.scope === 'public') {
               convoItem.setAttribute("data-group-name", primaryContext.name || 'Workspace');
               convoItem.setAttribute("data-chat-type", "public");
               console.log(`selectConversation: Set to public with name "${primaryContext.name || 'Workspace'}"`);
             } else if (primaryContext.scope === 'personal') {
-              convoItem.setAttribute("data-chat-type", "personal");
-              console.log(`selectConversation: Set to personal`);
+              convoItem.setAttribute("data-chat-type", "personal_single_user");
+              console.log(`selectConversation: Set to personal_single_user`);
             }
           } else {
-            // No primary context - this is a model-only conversation
-            // Don't set data-chat-type so no badges will be shown
-            console.log(`selectConversation: No primary context - model-only conversation (no badges)`);
+            // No primary context - default to personal_single_user
+            convoItem.setAttribute("data-chat-type", "personal_single_user");
+            console.log(`selectConversation: No primary context - defaulted to personal_single_user`);
           }
         } else {
-          // No context at all - model-only conversation
-          console.log(`selectConversation: No context - model-only conversation (no badges)`);
+          // No context at all - default to personal_single_user
+          convoItem.setAttribute("data-chat-type", "personal_single_user");
+          console.log(`selectConversation: No context - defaulted to personal_single_user`);
         }
       }
 
@@ -1110,7 +1218,13 @@ export async function selectConversation(conversationId) {
     addChatTypeBadges(convoItem, currentConversationClassificationsEl);
   }
 
-  loadMessages(conversationId);
+  await loadMessages(conversationId);
+  try {
+    const streamingModule = await import('./chat-streaming.js');
+    await streamingModule.reattachStreamingConversation(conversationId);
+  } catch (error) {
+    console.warn('Failed to reattach active stream for conversation:', error);
+  }
   markConversationRead(conversationId, { force: true, suppressErrorToast: true }).catch(error => {
     console.warn('Failed to clear unread state for conversation:', error);
   });
@@ -1124,6 +1238,12 @@ export async function selectConversation(conversationId) {
     setSidebarActiveConversation(conversationId);
   }
 
+  try {
+    await refreshAgentsAndModelsForActiveConversation();
+  } catch (error) {
+    console.warn('Failed to refresh agent or model dropdown:', error);
+  }
+
   updateConversationUrl(conversationId);
 
   // Clear any "edit mode" state if switching conversations
@@ -1758,42 +1878,35 @@ function addChatTypeBadges(convoItem, classificationsEl) {
   
   // Debug logging
   console.log(`addChatTypeBadges: chatType="${chatType}", groupName="${groupName}"`);
-  
-  // Only show badges if there's a valid chat type (meaning documents were used for primary context)
-  // Don't show badges for Model-only conversations
-  if (chatType === 'personal') {
-    // Personal workspace was used
-    const personalBadge = document.createElement("span");
-    personalBadge.classList.add("badge", "bg-primary");
-    personalBadge.textContent = "personal";
-    
-    // Add some spacing between classification badges and chat type badges
+
+  const appendBadgeSpacer = () => {
     if (classificationsEl.children.length > 0) {
       const spacer = document.createElement("span");
       spacer.innerHTML = "&nbsp;&nbsp;";
       classificationsEl.appendChild(spacer);
     }
-    
-    classificationsEl.appendChild(personalBadge);
+  };
+
+  const getShortGroupLabel = (name) => {
+    const normalizedName = (name || "").trim();
+    if (!normalizedName) {
+      return "group";
+    }
+    return normalizedName.slice(0, 8);
+  };
+  
+  // Only show badges if there's a valid chat type (meaning documents were used for primary context)
+  // Don't show badges for Model-only conversations
+  if (chatType === 'personal' || chatType === 'personal_single_user') {
+    return;
   } else if (chatType && chatType.startsWith('group')) {
     // Group workspace was used
     const groupBadge = document.createElement("span");
-    groupBadge.classList.add("badge", "bg-info", "me-1");
-    groupBadge.textContent = groupName ? `group - ${groupName}` : 'group';
-    
-    const userTypeBadge = document.createElement("span");
-    userTypeBadge.classList.add("badge", "bg-secondary");
-    userTypeBadge.textContent = chatType.includes('multi-user') ? 'multi-user' : 'single-user';
-    
-    // Add some spacing between classification badges and chat type badges
-    if (classificationsEl.children.length > 0) {
-      const spacer = document.createElement("span");
-      spacer.innerHTML = "&nbsp;&nbsp;";
-      classificationsEl.appendChild(spacer);
-    }
-    
+    groupBadge.classList.add("badge", "bg-info");
+    groupBadge.textContent = (groupName || 'group').trim() || 'group';
+
+    appendBadgeSpacer();
     classificationsEl.appendChild(groupBadge);
-    classificationsEl.appendChild(userTypeBadge);
   } else if (chatType && chatType.startsWith('public')) {
     // Public workspace was used
     const publicBadge = document.createElement("span");
@@ -1801,16 +1914,12 @@ function addChatTypeBadges(convoItem, classificationsEl) {
     publicBadge.textContent = groupName ? `public - ${groupName}` : 'public';
     
     // Add some spacing between classification badges and chat type badges
-    if (classificationsEl.children.length > 0) {
-      const spacer = document.createElement("span");
-      spacer.innerHTML = "&nbsp;&nbsp;";
-      classificationsEl.appendChild(spacer);
-    }
+    appendBadgeSpacer();
     
     classificationsEl.appendChild(publicBadge);
   } else {
-    // If chatType is unknown/null or model-only, don't add any workspace badges
-    console.log(`addChatTypeBadges: No badges added for chatType="${chatType}" (likely model-only conversation)`);
+    // If chatType is unknown/null/new or model-only, don't add any workspace badges
+    console.log(`addChatTypeBadges: No badges added for chatType="${chatType}" (likely model-only or new conversation)`);
   }
 }
 
diff --git a/application/single_app/static/js/chat/chat-messages.js b/application/single_app/static/js/chat/chat-messages.js
index dc3a2afc..40ea9c95 100644
--- a/application/single_app/static/js/chat/chat-messages.js
+++ b/application/single_app/static/js/chat/chat-messages.js
@@ -468,7 +468,7 @@ export function loadMessages(conversationId) {
   // Clear search highlights when loading a different conversation
   clearSearchHighlight();
   
-  fetch(`/conversation/${conversationId}/messages`)
+  return fetch(`/conversation/${conversationId}/messages`)
     .then((response) => response.json())
     .then((data) => {
       const chatbox = document.getElementById("chatbox");
@@ -1416,7 +1416,17 @@ export function actuallySendMessage(finalMessageToSend) {
   // Update send button visibility after clearing input
   updateSendButtonVisibility();
 
-  const modelDeployment = modelSelect?.value;
+  let modelDeployment = modelSelect?.value;
+  let modelId = null;
+  let modelEndpointId = null;
+  let modelProvider = null;
+  if (window.appSettings?.enable_multi_model_endpoints && modelSelect) {
+    const selectedOption = modelSelect.options[modelSelect.selectedIndex];
+    modelId = selectedOption?.value || null;
+    modelEndpointId = selectedOption?.dataset?.endpointId || null;
+    modelProvider = selectedOption?.dataset?.provider || null;
+    modelDeployment = selectedOption?.dataset?.deploymentName || null;
+  }
 
   // ... (keep existing logic for hybridSearchEnabled, selectedDocumentId, classificationsToSend, imageGenEnabled)
   let hybridSearchEnabled = false;
@@ -1556,6 +1566,9 @@ export function actuallySendMessage(finalMessageToSend) {
     active_group_id: finalGroupId,
     active_public_workspace_id: finalPublicWorkspaceId,
     model_deployment: modelDeployment,
+    model_id: modelId,
+    model_endpoint_id: modelEndpointId,
+    model_provider: modelProvider,
     prompt_info: promptInfo,
     agent_info: agentInfo,
     reasoning_effort: getCurrentReasoningEffort()
@@ -2346,8 +2359,13 @@ document.addEventListener('DOMContentLoaded', function() {
 if (modelSelect) {
   modelSelect.addEventListener("change", function() {
     const selectedModel = modelSelect.value;
-    console.log(`Saving preferred model: ${selectedModel}`);
-    saveUserSetting({ 'preferredModelDeployment': selectedModel });
+    if (window.appSettings?.enable_multi_model_endpoints) {
+      console.log(`Saving preferred model ID: ${selectedModel}`);
+      saveUserSetting({ preferredModelId: selectedModel });
+    } else {
+      console.log(`Saving preferred model deployment: ${selectedModel}`);
+      saveUserSetting({ preferredModelDeployment: selectedModel });
+    }
   });
 }
 
diff --git a/application/single_app/static/js/chat/chat-onload.js b/application/single_app/static/js/chat/chat-onload.js
index 0477c0b7..c503c100 100644
--- a/application/single_app/static/js/chat/chat-onload.js
+++ b/application/single_app/static/js/chat/chat-onload.js
@@ -81,14 +81,33 @@ window.addEventListener('DOMContentLoaded', async () => {
   try {
       const userSettings = await userSettingsPromise;
       
-      // Set the preferred model if available
-      if (userSettings && userSettings.preferredModelDeployment) {
-          const modelSelect = document.getElementById("model-select");
-          if (modelSelect) {
-              console.log(`Setting preferred model: ${userSettings.preferredModelDeployment}`);
-              modelSelect.value = userSettings.preferredModelDeployment;
+        // Set the preferred model if available
+        const preferredModelId = userSettings?.preferredModelId;
+        const preferredModelDeployment = userSettings?.preferredModelDeployment;
+        const modelSelect = document.getElementById("model-select");
+        if (modelSelect) {
+          if (preferredModelId) {
+            console.log(`Setting preferred model ID: ${preferredModelId}`);
+            modelSelect.value = preferredModelId;
+          } else if (preferredModelDeployment) {
+            console.log(`Setting preferred model deployment: ${preferredModelDeployment}`);
+            modelSelect.value = preferredModelDeployment;
           }
-      }
+        }
+
+        // Multi-endpoint migration notice
+        const notice = window.multiEndpointNotice || {};
+        const noticeEl = document.getElementById("multi-endpoint-notice");
+        const dismissBtn = document.getElementById("dismiss-multi-endpoint-notice");
+        if (notice?.enabled && noticeEl && !userSettings?.dismissedMultiEndpointNotice) {
+          noticeEl.classList.remove("d-none");
+          if (dismissBtn) {
+            dismissBtn.addEventListener("click", async () => {
+              noticeEl.classList.add("d-none");
+              await saveUserSetting({ dismissedMultiEndpointNotice: true });
+            });
+          }
+        }
 
       initializeModelSelector();
       initializeReasoningToggle(userSettings);
diff --git a/application/single_app/static/js/chat/chat-retry.js b/application/single_app/static/js/chat/chat-retry.js
index 757977a6..8a32028f 100644
--- a/application/single_app/static/js/chat/chat-retry.js
+++ b/application/single_app/static/js/chat/chat-retry.js
@@ -15,21 +15,40 @@ async function populateRetryAgentDropdown() {
     try {
         // Import agent functions dynamically
         const agentsModule = await import('../agents_common.js');
-        const { fetchUserAgents, fetchGroupAgentsForActiveGroup, fetchSelectedAgent, populateAgentSelect } = agentsModule;
+        const { fetchUserAgents, fetchGroupAgentsForActiveGroup, fetchSelectedAgent, populateAgentSelect, getUserSetting } = agentsModule;
         
         // Fetch available agents
+        const activeItem = document.querySelector('.conversation-item.active');
+        const chatType = activeItem?.getAttribute('data-chat-type') || '';
+        const chatState = activeItem?.getAttribute('data-chat-state') || '';
+        const conversationScope = (chatState === 'new' || chatType === 'new')
+            ? null
+            : (chatType ? (chatType.startsWith('group') ? 'group' : 'personal') : 'personal');
+        const itemGroupId = activeItem?.getAttribute('data-group-id') || null;
+        const userActiveGroupId = await getUserSetting('activeGroupOid');
+        const rawGroupId = conversationScope === 'group'
+            ? (itemGroupId || window.groupWorkspaceContext?.activeGroupId || userActiveGroupId || window.activeGroupId || null)
+            : (chatState === 'new' ? (itemGroupId || userActiveGroupId || window.activeGroupId || null) : null);
+        const activeGroupId = rawGroupId && !['none', 'null', 'undefined'].includes(String(rawGroupId).toLowerCase())
+            ? rawGroupId
+            : null;
         const [userAgents, selectedAgent] = await Promise.all([
             fetchUserAgents(),
             fetchSelectedAgent()
         ]);
-        const groupAgents = await fetchGroupAgentsForActiveGroup();
+        const groupAgents = activeGroupId ? await fetchGroupAgentsForActiveGroup(activeGroupId) : [];
         
         // Combine and order agents
-        const combinedAgents = [...userAgents, ...groupAgents];
-        const personalAgents = combinedAgents.filter(agent => !agent.is_global && !agent.is_group);
-        const activeGroupAgents = combinedAgents.filter(agent => agent.is_group);
-        const globalAgents = combinedAgents.filter(agent => agent.is_global);
-        const orderedAgents = [...personalAgents, ...activeGroupAgents, ...globalAgents];
+        const personalAgents = userAgents.filter(agent => !agent.is_global && !agent.is_group);
+        const globalAgents = userAgents.filter(agent => agent.is_global);
+        let orderedAgents = [];
+        if (!conversationScope) {
+            orderedAgents = [...personalAgents, ...groupAgents, ...globalAgents];
+        } else if (conversationScope === 'group') {
+            orderedAgents = [...groupAgents, ...globalAgents];
+        } else {
+            orderedAgents = [...personalAgents, ...globalAgents];
+        }
         
         // Populate retry agent select using shared function
         populateAgentSelect(retryAgentSelect, orderedAgents, selectedAgent);
diff --git a/application/single_app/static/js/chat/chat-sidebar-conversations.js b/application/single_app/static/js/chat/chat-sidebar-conversations.js
index a12b2e1c..e8a1e5fa 100644
--- a/application/single_app/static/js/chat/chat-sidebar-conversations.js
+++ b/application/single_app/static/js/chat/chat-sidebar-conversations.js
@@ -169,6 +169,14 @@ function createSidebarConversationItem(convo) {
   if (groupName) {
     convoItem.setAttribute("data-group-name", groupName);
   }
+
+  const getShortGroupLabel = (name) => {
+    const normalizedName = (name || '').trim();
+    if (!normalizedName) {
+      return 'group';
+    }
+    return normalizedName.slice(0, 8);
+  };
   
   const isPinned = convo.is_pinned || false;
   const isHidden = convo.is_hidden || false;
@@ -224,10 +232,11 @@ function createSidebarConversationItem(convo) {
     }
 
     const isGroupConversation = (convo.chat_type && convo.chat_type.startsWith('group')) || groupName;
+
     if (isGroupConversation) {
       const badge = document.createElement('span');
       badge.classList.add('badge', 'bg-info', 'sidebar-conversation-group-badge');
-      badge.textContent = 'group';
+      badge.textContent = getShortGroupLabel(groupName);
       badge.title = groupName ? `Group conversation: ${groupName}` : 'Group conversation';
       titleWrapper.appendChild(badge);
     }
diff --git a/application/single_app/static/js/chat/chat-streaming.js b/application/single_app/static/js/chat/chat-streaming.js
index 700eec6f..be64ac3c 100644
--- a/application/single_app/static/js/chat/chat-streaming.js
+++ b/application/single_app/static/js/chat/chat-streaming.js
@@ -5,9 +5,9 @@ import { hideLoadingIndicatorInChatbox, showLoadingIndicatorInChatbox } from './
 import { showToast } from './chat-toast.js';
 import { updateSidebarConversationTitle } from './chat-sidebar-conversations.js';
 import { applyScopeLock } from './chat-documents.js';
-import { handleStreamingThought } from './chat-thoughts.js';
+import { beginStreamingThoughtSession, clearStreamingThoughtSession, handleStreamingThought, markStreamingThoughtContentStarted, stopThoughtPolling } from './chat-thoughts.js';
 
-let currentEventSource = null;
+let currentStreamController = null;
 
 function parseSseEventPayload(eventBlock) {
     const dataLines = eventBlock
@@ -23,55 +23,50 @@ function parseSseEventPayload(eventBlock) {
         .join('\n');
 }
 
-export function sendMessageWithStreaming(messageData, tempUserMessageId, currentConversationId, options = {}) {
+function createStreamingPlaceholder(statusLabel = 'Streaming...') {
+    const tempAiMessageId = `temp_ai_${Date.now()}_${Math.floor(Math.random() * 10000)}`;
+    appendMessage('AI', `<span class="text-muted"><i class="bi bi-three-dots-vertical"></i> ${statusLabel}</span>`, null, tempAiMessageId);
+    beginStreamingThoughtSession(tempAiMessageId);
+    return tempAiMessageId;
+}
+
+function clearCurrentStreamController(controller) {
+    if (currentStreamController === controller) {
+        currentStreamController = null;
+    }
+}
+
+function consumeStreamingResponse(requestFactory, tempAiMessageId, tempUserMessageId, options = {}) {
     const {
         onDone = null,
         onError = null,
         onFinally = null,
     } = options;
-    
-    // Close any existing connection
-    if (currentEventSource) {
-        currentEventSource.close();
-        currentEventSource = null;
+
+    if (currentStreamController) {
+        currentStreamController.abort('replaced');
     }
-    
-    // Create a unique message ID for the AI response
-    const tempAiMessageId = `temp_ai_${Date.now()}`;
+
+    const abortController = new AbortController();
+    currentStreamController = abortController;
     let accumulatedContent = '';
     let hasStreamedContent = false;
     let streamError = false;
-    let streamErrorMessage = '';
     let streamCompleted = false;
-    
-    // Create placeholder message with streaming indicator
-    appendMessage('AI', '<span class="text-muted"><i class="bi bi-three-dots-vertical"></i> Streaming...</span>', null, tempAiMessageId);
-    
-    // Create timeout (5 minutes)
-    const streamTimeout = setTimeout(() => {
-        if (currentEventSource) {
-            currentEventSource.close();
-            currentEventSource = null;
-            streamError = true;
-            streamErrorMessage = 'Stream timeout (5 minutes exceeded)';
-            handleStreamError(tempAiMessageId, accumulatedContent, streamErrorMessage);
-        }
-    }, 5 * 60 * 1000); // 5 minutes
-    
-    // Use fetch to POST, then read the streaming response
-    fetch('/api/chat/stream', {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/json',
-        },
-        credentials: 'same-origin',
-        body: JSON.stringify(messageData)
-    }).then(response => {
+
+    requestFactory(abortController.signal).then(response => {
         if (!response.ok) {
+            if (response.status === 404) {
+                throw new Error('No active stream is available for this conversation.');
+            }
             return response.json().then(errData => {
                 throw new Error(errData.error || `HTTP error! status: ${response.status}`);
             });
         }
+
+        if (!response.body) {
+            throw new Error('Streaming response body is unavailable.');
+        }
         
         // Read the streaming response
         const reader = response.body.getReader();
@@ -80,10 +75,11 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
 
         function processStreamData(data) {
             if (data.error) {
-                clearTimeout(streamTimeout);
+                stopThoughtPolling();
                 streamError = true;
-                streamErrorMessage = data.error;
+                clearStreamingThoughtSession(tempAiMessageId);
                 handleStreamError(tempAiMessageId, data.partial_content || accumulatedContent, data.error);
+                clearCurrentStreamController(abortController);
                 if (typeof onError === 'function') {
                     onError(data.error, data);
                 }
@@ -95,7 +91,7 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
 
             if (data.type === 'thought') {
                 if (!hasStreamedContent && !streamCompleted) {
-                    handleStreamingThought(data);
+                    handleStreamingThought(data, tempAiMessageId);
                 }
                 return false;
             }
@@ -107,8 +103,9 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
             }
 
             if (data.done) {
-                clearTimeout(streamTimeout);
+                stopThoughtPolling();
                 streamCompleted = true;
+                clearStreamingThoughtSession(tempAiMessageId);
 
                 finalizeStreamingMessage(
                     tempAiMessageId,
@@ -124,7 +121,7 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
                     onFinally();
                 }
 
-                currentEventSource = null;
+                clearCurrentStreamController(abortController);
                 return true;
             }
 
@@ -175,12 +172,13 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
         function readStream() {
             reader.read().then(({ done, value }) => {
                 if (done) {
-                    clearTimeout(streamTimeout);
+                    stopThoughtPolling();
 
                     sseBuffer += decoder.decode();
                     const processedFinalEvent = processSseBuffer(true);
 
                     if (!processedFinalEvent && !streamCompleted && !streamError) {
+                        clearStreamingThoughtSession(tempAiMessageId);
                         handleStreamError(
                             tempAiMessageId,
                             accumulatedContent,
@@ -207,9 +205,20 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
                 
                 readStream(); // Continue reading
             }).catch(err => {
-                clearTimeout(streamTimeout);
+                if (abortController.signal.aborted) {
+                    clearStreamingThoughtSession(tempAiMessageId);
+                    clearCurrentStreamController(abortController);
+                    if (typeof onFinally === 'function') {
+                        onFinally();
+                    }
+                    return;
+                }
+
+                stopThoughtPolling();
                 console.error('Stream reading error:', err);
+                clearStreamingThoughtSession(tempAiMessageId);
                 handleStreamError(tempAiMessageId, accumulatedContent, err.message);
+                clearCurrentStreamController(abortController);
                 if (typeof onError === 'function') {
                     onError(err.message, err);
                 }
@@ -222,9 +231,20 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
         readStream();
         
     }).catch(error => {
-        clearTimeout(streamTimeout);
+        if (abortController.signal.aborted) {
+            clearStreamingThoughtSession(tempAiMessageId);
+            clearCurrentStreamController(abortController);
+            if (typeof onFinally === 'function') {
+                onFinally();
+            }
+            return;
+        }
+
+        stopThoughtPolling();
         console.error('Streaming request error:', error);
         showToast(`Error: ${error.message}`, 'error');
+        clearStreamingThoughtSession(tempAiMessageId);
+        clearCurrentStreamController(abortController);
         
         // Remove placeholder message
         const msgElement = document.querySelector(`[data-message-id="${tempAiMessageId}"]`);
@@ -240,15 +260,64 @@ export function sendMessageWithStreaming(messageData, tempUserMessageId, current
             onFinally();
         }
     });
-    
+
     return true; // Indicates streaming was initiated
 }
 
+export function sendMessageWithStreaming(messageData, tempUserMessageId, currentConversationId, options = {}) {
+    const tempAiMessageId = createStreamingPlaceholder('Streaming...');
+
+    return consumeStreamingResponse(
+        signal => fetch('/api/chat/stream', {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            credentials: 'same-origin',
+            body: JSON.stringify(messageData),
+            signal,
+        }),
+        tempAiMessageId,
+        tempUserMessageId,
+        options,
+    );
+}
+
+export async function reattachStreamingConversation(conversationId) {
+    if (!conversationId) {
+        return false;
+    }
+
+    try {
+        const statusResponse = await fetch(`/api/chat/stream/status/${conversationId}`, {
+            credentials: 'same-origin',
+        });
+        const statusData = await statusResponse.json().catch(() => ({}));
+        if (!statusResponse.ok || !statusData.pending) {
+            return false;
+        }
+
+        const tempAiMessageId = createStreamingPlaceholder('Reconnecting...');
+        return consumeStreamingResponse(
+            signal => fetch(`/api/chat/stream/reattach/${conversationId}`, {
+                method: 'GET',
+                credentials: 'same-origin',
+                signal,
+            }),
+            tempAiMessageId,
+            null,
+        );
+    } catch (error) {
+        console.warn('Failed to reattach streaming conversation:', error);
+        return false;
+    }
+}
+
 function updateStreamingMessage(messageId, content) {
     const messageElement = document.querySelector(`[data-message-id="${messageId}"]`);
     if (!messageElement) return;
 
-    messageElement.dataset.streamingHasContent = 'true';
+    markStreamingThoughtContentStarted(messageId);
     
     const contentElement = messageElement.querySelector('.message-text');
     if (contentElement) {
@@ -398,9 +467,9 @@ function finalizeStreamingMessage(messageId, userMessageId, finalData) {
 }
 
 export function cancelStreaming() {
-    if (currentEventSource) {
-        currentEventSource.close();
-        currentEventSource = null;
+    if (currentStreamController) {
+        currentStreamController.abort('cancelled');
+        currentStreamController = null;
         showToast('Streaming cancelled', 'info');
     }
 }
diff --git a/application/single_app/static/js/chat/chat-thoughts.js b/application/single_app/static/js/chat/chat-thoughts.js
index 59e8653a..e5ada65f 100644
--- a/application/single_app/static/js/chat/chat-thoughts.js
+++ b/application/single_app/static/js/chat/chat-thoughts.js
@@ -5,6 +5,9 @@ import { escapeHtml } from './chat-utils.js';
 
 let thoughtPollingInterval = null;
 let lastSeenThoughtIndex = -1;
+let lastSeenThoughtMessageId = null;
+let activeStreamingThoughtTargetId = null;
+let activeStreamingServerMessageId = null;
 
 // ---------------------------------------------------------------------------
 // Icon map: step_type → Bootstrap Icon class
@@ -21,6 +24,40 @@ function getThoughtIcon(stepType) {
     return iconMap[stepType] || 'bi-stars';
 }
 
+function buildPendingThoughtsUrl(conversationId, messageId = null) {
+    const queryParams = new URLSearchParams();
+
+    if (messageId) {
+        queryParams.set('message_id', messageId);
+    }
+
+    const queryString = queryParams.toString();
+    if (!queryString) {
+        return `/api/conversations/${conversationId}/thoughts/pending`;
+    }
+
+    return `/api/conversations/${conversationId}/thoughts/pending?${queryString}`;
+}
+
+function getStreamingMessageElement(messageId) {
+    if (!messageId) {
+        return null;
+    }
+
+    return document.querySelector(`[data-message-id="${messageId}"]`);
+}
+
+function resetStreamingPlaceholderState(messageElement) {
+    if (!messageElement) {
+        return;
+    }
+
+    delete messageElement.dataset.streamingServerMessageId;
+    delete messageElement.dataset.streamingHasContent;
+    delete messageElement.dataset.streamingThoughtIndex;
+    delete messageElement.dataset.streamingThoughtSignature;
+}
+
 // ---------------------------------------------------------------------------
 // Polling (non-streaming mode)
 // ---------------------------------------------------------------------------
@@ -29,25 +66,33 @@ function getThoughtIcon(stepType) {
  * Start polling for pending thoughts while waiting for a non-streaming response.
  * @param {string} conversationId - The current conversation ID.
  */
-export function startThoughtPolling(conversationId) {
+function startThoughtPollingWithHandler(conversationId, thoughtHandler, messageId = null) {
     if (!conversationId) return;
     if (!window.appSettings?.enable_thoughts) return;
 
     stopThoughtPolling(); // clear any previous interval
     lastSeenThoughtIndex = -1;
+    lastSeenThoughtMessageId = messageId || null;
 
     thoughtPollingInterval = setInterval(() => {
-        fetch(`/api/conversations/${conversationId}/thoughts/pending`, {
+        fetch(buildPendingThoughtsUrl(conversationId, messageId), {
             credentials: 'same-origin'
         })
             .then(r => r.json())
             .then(data => {
                 if (data.thoughts && data.thoughts.length > 0) {
                     const latest = data.thoughts[data.thoughts.length - 1];
-                    if (latest.step_index > lastSeenThoughtIndex) {
+                    const latestStepIndex = Number(latest.step_index);
+                    const latestMessageId = latest.message_id || messageId || null;
+
+                    if (latestMessageId && lastSeenThoughtMessageId && latestMessageId !== lastSeenThoughtMessageId) {
+                        lastSeenThoughtIndex = -1;
+                    }
+
+                    if (latestMessageId !== lastSeenThoughtMessageId || !Number.isFinite(latestStepIndex) || latestStepIndex > lastSeenThoughtIndex) {
+                        lastSeenThoughtMessageId = latestMessageId;
                         lastSeenThoughtIndex = latest.step_index;
-                        const icon = getThoughtIcon(latest.step_type);
-                        updateLoadingIndicatorText(latest.content, icon);
+                        thoughtHandler(latest);
                     }
                 }
             })
@@ -55,6 +100,51 @@ export function startThoughtPolling(conversationId) {
     }, 2000);
 }
 
+
+export function startThoughtPolling(conversationId, messageId = null) {
+    startThoughtPollingWithHandler(conversationId, latest => {
+        const icon = getThoughtIcon(latest.step_type);
+        updateLoadingIndicatorText(latest.content, icon);
+    }, messageId);
+}
+
+
+export function startStreamingThoughtPolling(conversationId, messageId = null) {
+    startThoughtPollingWithHandler(conversationId, latest => {
+        handleStreamingThought(latest);
+    }, messageId);
+}
+
+export function beginStreamingThoughtSession(targetMessageId) {
+    activeStreamingThoughtTargetId = targetMessageId || null;
+    activeStreamingServerMessageId = null;
+
+    resetStreamingPlaceholderState(getStreamingMessageElement(activeStreamingThoughtTargetId));
+}
+
+export function clearStreamingThoughtSession(targetMessageId = null) {
+    if (targetMessageId && activeStreamingThoughtTargetId && activeStreamingThoughtTargetId !== targetMessageId) {
+        return;
+    }
+
+    const messageIdToReset = targetMessageId || activeStreamingThoughtTargetId;
+    resetStreamingPlaceholderState(getStreamingMessageElement(messageIdToReset));
+
+    activeStreamingThoughtTargetId = null;
+    activeStreamingServerMessageId = null;
+}
+
+export function markStreamingThoughtContentStarted(targetMessageId) {
+    const messageElement = getStreamingMessageElement(targetMessageId);
+    if (!messageElement) {
+        return;
+    }
+
+    messageElement.dataset.streamingHasContent = 'true';
+    delete messageElement.dataset.streamingThoughtIndex;
+    delete messageElement.dataset.streamingThoughtSignature;
+}
+
 /**
  * Stop the thought polling interval.
  */
@@ -64,6 +154,7 @@ export function stopThoughtPolling() {
         thoughtPollingInterval = null;
     }
     lastSeenThoughtIndex = -1;
+    lastSeenThoughtMessageId = null;
 }
 
 // ---------------------------------------------------------------------------
@@ -74,17 +165,65 @@ export function stopThoughtPolling() {
  * Handle a streaming thought event received via SSE.
  * Updates the streaming message placeholder with a styled thought indicator.
  * When actual content starts streaming, updateStreamingMessage() will overwrite this.
- * @param {object} thoughtData - { step_index, step_type, content }
+ * @param {object} thoughtData - { message_id, step_index, step_type, content }
+ * @param {string|null} targetMessageId - Temporary DOM message ID for the active stream.
  */
-export function handleStreamingThought(thoughtData) {
-    // Find the streaming message's content area
-    const messageElement = document.querySelector('[data-message-id^="temp_ai_"]');
+export function handleStreamingThought(thoughtData, targetMessageId = null) {
+    if (targetMessageId && targetMessageId !== activeStreamingThoughtTargetId) {
+        beginStreamingThoughtSession(targetMessageId);
+    }
+
+    if (!activeStreamingThoughtTargetId) {
+        return;
+    }
+
+    if (thoughtData.message_id) {
+        if (activeStreamingServerMessageId && activeStreamingServerMessageId !== thoughtData.message_id) {
+            return;
+        }
+
+        activeStreamingServerMessageId = thoughtData.message_id;
+    }
+
+    const messageElement = getStreamingMessageElement(activeStreamingThoughtTargetId);
     if (!messageElement) return;
 
     if (messageElement.dataset.streamingHasContent === 'true') {
         return;
     }
 
+    const thoughtStepIndex = Number(thoughtData.step_index);
+    const lastRenderedStepIndex = Number(messageElement.dataset.streamingThoughtIndex ?? -1);
+    const thoughtSignature = [
+        thoughtData.message_id || '',
+        Number.isFinite(thoughtStepIndex) ? thoughtStepIndex : '',
+        thoughtData.step_type || '',
+        thoughtData.content || ''
+    ].join('::');
+
+    if (thoughtData.message_id && messageElement.dataset.streamingServerMessageId && messageElement.dataset.streamingServerMessageId !== thoughtData.message_id) {
+        return;
+    }
+
+    if (Number.isFinite(thoughtStepIndex) && thoughtStepIndex < lastRenderedStepIndex) {
+        return;
+    }
+
+    if (messageElement.dataset.streamingThoughtSignature === thoughtSignature) {
+        return;
+    }
+
+    if (activeStreamingServerMessageId) {
+        messageElement.dataset.streamingServerMessageId = activeStreamingServerMessageId;
+    }
+
+    if (Number.isFinite(thoughtStepIndex)) {
+        messageElement.dataset.streamingThoughtIndex = String(thoughtStepIndex);
+    } else {
+        delete messageElement.dataset.streamingThoughtIndex;
+    }
+    messageElement.dataset.streamingThoughtSignature = thoughtSignature;
+
     const contentElement = messageElement.querySelector('.message-text');
     if (!contentElement) return;
 
diff --git a/application/single_app/static/js/control-center.js b/application/single_app/static/js/control-center.js
index 7e79d22a..3a95de45 100644
--- a/application/single_app/static/js/control-center.js
+++ b/application/single_app/static/js/control-center.js
@@ -171,6 +171,7 @@ class ControlCenter {
         this.documentsChart = null;
         this.tokensChart = null;
         this.currentTrendDays = 30;
+        this.tokenFilters = this.getDefaultTokenFilters();
         
         // Activity Logs state
         this.activityLogsPage = 1;
@@ -200,6 +201,7 @@ class ControlCenter {
         }
         
         // Always load activity trends (available to all Control Center users)
+        this.loadTokenFilterOptions();
         this.loadActivityTrends();
     }
     
@@ -319,6 +321,12 @@ class ControlCenter {
             () => this.changeTrendPeriod(90));
         document.getElementById('trend-custom')?.addEventListener('click', 
             () => this.toggleCustomDateRange());
+        document.getElementById('tokenWorkspaceTypeFilter')?.addEventListener('change',
+            () => this.handleTokenWorkspaceTypeChange());
+        document.getElementById('tokenApplyFiltersBtn')?.addEventListener('click',
+            () => this.applyTokenFilters());
+        document.getElementById('tokenResetFiltersBtn')?.addEventListener('click',
+            () => this.resetTokenFilters());
         
         // Custom date range handlers
         document.getElementById('applyCustomRange')?.addEventListener('click', 
@@ -1344,6 +1352,149 @@ class ControlCenter {
         const i = Math.floor(Math.log(bytes) / Math.log(k));
         return parseFloat((bytes / Math.pow(k, i)).toFixed(1)) + ' ' + sizes[i];
     }
+
+    getDefaultTokenFilters() {
+        return {
+            userId: 'all',
+            workspaceType: 'all',
+            groupId: 'all',
+            publicWorkspaceId: 'all',
+            model: 'all',
+            tokenType: 'all'
+        };
+    }
+
+    getTokenFilterRequestPayload() {
+        const tokenFilterMap = {
+            user_id: this.tokenFilters.userId,
+            workspace_type: this.tokenFilters.workspaceType,
+            group_id: this.tokenFilters.groupId,
+            public_workspace_id: this.tokenFilters.publicWorkspaceId,
+            model: this.tokenFilters.model,
+            token_type: this.tokenFilters.tokenType
+        };
+
+        return Object.fromEntries(
+            Object.entries(tokenFilterMap).filter(([, value]) => value && value !== 'all')
+        );
+    }
+
+    populateTokenFilterSelect(selectId, options, defaultLabel, valueKey = 'value', labelKey = 'label') {
+        const select = document.getElementById(selectId);
+        if (!select) {
+            return;
+        }
+
+        const optionMarkup = (options || []).map(option => {
+            const value = option[valueKey] ?? '';
+            const label = option[labelKey] ?? value;
+            return `<option value="${this.escapeHtml(String(value))}">${this.escapeHtml(String(label))}</option>`;
+        }).join('');
+
+        select.innerHTML = `<option value="all">${this.escapeHtml(defaultLabel)}</option>${optionMarkup}`;
+    }
+
+    setTokenFilterControlValues() {
+        const controlValues = {
+            tokenUserFilter: this.tokenFilters.userId,
+            tokenWorkspaceTypeFilter: this.tokenFilters.workspaceType,
+            tokenGroupFilter: this.tokenFilters.groupId,
+            tokenPublicWorkspaceFilter: this.tokenFilters.publicWorkspaceId,
+            tokenModelFilter: this.tokenFilters.model,
+            tokenTypeFilter: this.tokenFilters.tokenType
+        };
+
+        Object.entries(controlValues).forEach(([controlId, value]) => {
+            const select = document.getElementById(controlId);
+            if (!select) {
+                return;
+            }
+
+            const optionExists = Array.from(select.options).some(option => option.value === value);
+            select.value = optionExists ? value : 'all';
+        });
+
+        this.handleTokenWorkspaceTypeChange(false);
+    }
+
+    async loadTokenFilterOptions() {
+        try {
+            const response = await fetch('/api/admin/control-center/token-filters');
+            const data = await response.json();
+
+            if (!response.ok) {
+                throw new Error(data.error || 'Failed to load token filter options');
+            }
+
+            const filters = data.filters || {};
+            this.populateTokenFilterSelect('tokenUserFilter', filters.users, 'All users', 'id', 'label');
+            this.populateTokenFilterSelect('tokenWorkspaceTypeFilter', filters.workspace_types, 'All workspaces');
+            this.populateTokenFilterSelect('tokenGroupFilter', filters.groups, 'All groups', 'id', 'name');
+            this.populateTokenFilterSelect('tokenPublicWorkspaceFilter', filters.public_workspaces, 'All public workspaces', 'id', 'name');
+            this.populateTokenFilterSelect('tokenModelFilter', filters.models, 'All models');
+            this.populateTokenFilterSelect('tokenTypeFilter', filters.token_types, 'All token types');
+            this.setTokenFilterControlValues();
+        } catch (error) {
+            console.error('Failed to load token filter options:', error);
+            showToast('Failed to load token filter options.', 'warning');
+        }
+    }
+
+    handleTokenWorkspaceTypeChange(clearDependentFilters = true) {
+        const workspaceTypeSelect = document.getElementById('tokenWorkspaceTypeFilter');
+        const groupContainer = document.getElementById('tokenGroupFilterContainer');
+        const publicWorkspaceContainer = document.getElementById('tokenPublicWorkspaceFilterContainer');
+        const groupSelect = document.getElementById('tokenGroupFilter');
+        const publicWorkspaceSelect = document.getElementById('tokenPublicWorkspaceFilter');
+        const workspaceType = workspaceTypeSelect ? workspaceTypeSelect.value : 'all';
+
+        if (groupContainer) {
+            groupContainer.classList.toggle('d-none', workspaceType !== 'group');
+        }
+        if (publicWorkspaceContainer) {
+            publicWorkspaceContainer.classList.toggle('d-none', workspaceType !== 'public');
+        }
+
+        if (clearDependentFilters) {
+            if (workspaceType !== 'group' && groupSelect) {
+                groupSelect.value = 'all';
+            }
+            if (workspaceType !== 'public' && publicWorkspaceSelect) {
+                publicWorkspaceSelect.value = 'all';
+            }
+        }
+    }
+
+    syncTokenFiltersFromControls() {
+        const nextFilters = this.getDefaultTokenFilters();
+        nextFilters.userId = document.getElementById('tokenUserFilter')?.value || 'all';
+        nextFilters.workspaceType = document.getElementById('tokenWorkspaceTypeFilter')?.value || 'all';
+        nextFilters.groupId = document.getElementById('tokenGroupFilter')?.value || 'all';
+        nextFilters.publicWorkspaceId = document.getElementById('tokenPublicWorkspaceFilter')?.value || 'all';
+        nextFilters.model = document.getElementById('tokenModelFilter')?.value || 'all';
+        nextFilters.tokenType = document.getElementById('tokenTypeFilter')?.value || 'all';
+
+        if (nextFilters.workspaceType !== 'group') {
+            nextFilters.groupId = 'all';
+        }
+        if (nextFilters.workspaceType !== 'public') {
+            nextFilters.publicWorkspaceId = 'all';
+        }
+
+        this.tokenFilters = nextFilters;
+        this.setTokenFilterControlValues();
+    }
+
+    applyTokenFilters() {
+        this.syncTokenFiltersFromControls();
+        this.loadActivityTrends();
+    }
+
+    resetTokenFilters() {
+        this.tokenFilters = this.getDefaultTokenFilters();
+        this.setTokenFilterControlValues();
+        this.loadActivityTrends();
+    }
     
     // Activity Trends Methods
     async loadActivityTrends() {
@@ -1352,11 +1503,20 @@ class ControlCenter {
                 console.log('🔍 [Frontend Debug] Loading activity trends for', this.currentTrendDays, 'days');
             }
             
-            // Build API URL with custom date range if specified
-            let apiUrl = `/api/admin/control-center/activity-trends?days=${this.currentTrendDays}`;
+            const params = new URLSearchParams({
+                days: this.currentTrendDays
+            });
+
             if (this.customStartDate && this.customEndDate) {
-                apiUrl += `&start_date=${this.customStartDate}&end_date=${this.customEndDate}`;
+                params.append('start_date', this.customStartDate);
+                params.append('end_date', this.customEndDate);
             }
+
+            Object.entries(this.getTokenFilterRequestPayload()).forEach(([key, value]) => {
+                params.append(key, value);
+            });
+
+            const apiUrl = `/api/admin/control-center/activity-trends?${params.toString()}`;
             
             const response = await fetch(apiUrl);
             if (appSettings?.enable_debug_logging) {
@@ -2170,6 +2330,11 @@ class ControlCenter {
                 charts: selectedCharts,
                 time_window: timeWindow
             };
+
+            const tokenFilters = this.getTokenFilterRequestPayload();
+            if (Object.keys(tokenFilters).length > 0) {
+                exportData.token_filters = tokenFilters;
+            }
             
             // Add custom dates if selected
             if (timeWindow === 'custom') {
@@ -2400,7 +2565,21 @@ class ControlCenter {
                 const tokenType = log.token_type || 'unknown';
                 const totalTokens = log.usage?.total_tokens || 0;
                 const model = log.usage?.model || 'N/A';
-                return `Type: ${tokenType}<br>Tokens: ${totalTokens.toLocaleString()}<br><small class="text-muted">Model: ${model}</small>`;
+                const tokenScopeDetails = [];
+                if (log.workspace_type) {
+                    tokenScopeDetails.push(`Workspace: ${this.capitalizeFirst(log.workspace_type)}`);
+                }
+                if (log.workspace_context?.group_id) {
+                    tokenScopeDetails.push(`Group: ${this.escapeHtml(log.workspace_context.group_id)}`);
+                }
+                if (log.workspace_context?.public_workspace_id) {
+                    tokenScopeDetails.push(`Public Workspace: ${this.escapeHtml(log.workspace_context.public_workspace_id)}`);
+                }
+
+                const tokenScopeMarkup = tokenScopeDetails.length > 0
+                    ? `<br><small class="text-muted">${tokenScopeDetails.join(' · ')}</small>`
+                    : '';
+                return `Type: ${this.escapeHtml(tokenType)}<br>Tokens: ${totalTokens.toLocaleString()}<br><small class="text-muted">Model: ${this.escapeHtml(model)}</small>${tokenScopeMarkup}`;
                 
             case 'group_status_change':
                 const groupName = log.group?.group_name || 'Unknown Group';
@@ -2794,6 +2973,11 @@ class ControlCenter {
                 charts: selectedCharts,
                 time_window: timeWindow
             };
+
+            const tokenFilters = this.getTokenFilterRequestPayload();
+            if (Object.keys(tokenFilters).length > 0) {
+                chatData.token_filters = tokenFilters;
+            }
             
             // Add custom dates if selected
             if (timeWindow === 'custom') {
diff --git a/application/single_app/static/js/sidebar-resize.js b/application/single_app/static/js/sidebar-resize.js
new file mode 100644
index 00000000..e858dd92
--- /dev/null
+++ b/application/single_app/static/js/sidebar-resize.js
@@ -0,0 +1,80 @@
+// Adds a draggable resize handle for the sidebar
+document.addEventListener('DOMContentLoaded', () => {
+  const sidebar = document.getElementById('sidebar-nav');
+  const handle = document.getElementById('sidebar-resize-handle');
+  if (!sidebar || !handle) return;
+
+  const root = document.documentElement;
+  const userAccount = document.getElementById('sidebar-user-account');
+
+  const parsePx = (value, fallback) => {
+    const parsed = parseInt(String(value).replace('px', '').trim(), 10);
+    return Number.isFinite(parsed) ? parsed : fallback;
+  };
+
+  const getVar = (name, fallback) => {
+    const fromStyle = getComputedStyle(root).getPropertyValue(name);
+    if (fromStyle && fromStyle.trim()) return parsePx(fromStyle, fallback);
+    return fallback;
+  };
+
+  const minWidth = getVar('--sidebar-min-width', 220);
+  const maxWidth = getVar('--sidebar-max-width', 420);
+
+  const applyWidth = (widthPx) => {
+    const clamped = Math.min(Math.max(widthPx, minWidth), maxWidth);
+    root.style.setProperty('--sidebar-width', `${clamped}px`);
+    sidebar.style.width = `${clamped}px`;
+    if (userAccount) {
+      userAccount.style.width = `${clamped}px`;
+    }
+  };
+
+  // Restore stored width if available
+  const stored = localStorage.getItem('sidebarWidth');
+  if (stored) {
+    const parsed = parseInt(stored, 10);
+    if (Number.isFinite(parsed)) {
+      applyWidth(parsed);
+    }
+  }
+
+  let isDragging = false;
+
+  const onMouseMove = (e) => {
+    if (!isDragging) return;
+    const newWidth = e.clientX;
+    applyWidth(newWidth);
+  };
+
+  const stopDrag = () => {
+    if (!isDragging) return;
+    isDragging = false;
+    document.removeEventListener('mousemove', onMouseMove);
+    document.removeEventListener('mouseup', stopDrag);
+    const currentWidth = parsePx(getComputedStyle(sidebar).width, minWidth);
+    localStorage.setItem('sidebarWidth', String(currentWidth));
+  };
+
+  handle.addEventListener('mousedown', (e) => {
+    e.preventDefault();
+    isDragging = true;
+    document.addEventListener('mousemove', onMouseMove);
+    document.addEventListener('mouseup', stopDrag);
+  });
+
+  handle.addEventListener('keydown', (e) => {
+    const step = 10;
+    if (e.key === 'ArrowLeft') {
+      e.preventDefault();
+      const current = parsePx(getComputedStyle(sidebar).width, minWidth);
+      applyWidth(current - step);
+      localStorage.setItem('sidebarWidth', String(parsePx(getComputedStyle(sidebar).width, minWidth)));
+    } else if (e.key === 'ArrowRight') {
+      e.preventDefault();
+      const current = parsePx(getComputedStyle(sidebar).width, minWidth);
+      applyWidth(current + step);
+      localStorage.setItem('sidebarWidth', String(parsePx(getComputedStyle(sidebar).width, minWidth)));
+    }
+  });
+});
diff --git a/application/single_app/static/js/workspace/group_agents.js b/application/single_app/static/js/workspace/group_agents.js
index 608f029e..69165b74 100644
--- a/application/single_app/static/js/workspace/group_agents.js
+++ b/application/single_app/static/js/workspace/group_agents.js
@@ -164,7 +164,8 @@ function renderAgentsGrid(list) {
         const found = agents.find(x => x.id === (a.id || a.name || a) || x.name === (a.name || a));
         openAgentModal(found || null);
       } : null,
-      onDelete: canManage ? a => deleteGroupAgent(a.id || a.name || a) : null
+      onDelete: canManage ? a => deleteGroupAgent(a.id || a.name || a) : null,
+      canManage
     });
     agentsGridView.appendChild(col);
   });
@@ -308,7 +309,7 @@ function overrideAgentStepper(stepper) {
 
 function getAgentStepper() {
   if (!agentStepper) {
-    agentStepper = overrideAgentStepper(new AgentModalStepper(false));
+    agentStepper = overrideAgentStepper(new AgentModalStepper(false, { settingsEndpoint: '/api/group/agent/settings', workspaceScope: 'group' }));
     window.agentModalStepper = agentStepper;
   }
   return agentStepper;
@@ -328,7 +329,7 @@ async function openAgentModal(agent = null) {
       document.getElementById("agent-apim-fields"),
       document.getElementById("agent-gpt-fields"),
       () => agentsCommon.loadGlobalModelsForModal({
-        endpoint: "/api/user/agent/settings",
+        endpoint: "/api/group/agent/settings",
         agent,
         globalModelSelect: document.getElementById("agent-global-model-select"),
         isGlobal: false,
diff --git a/application/single_app/static/js/workspace/view-utils.js b/application/single_app/static/js/workspace/view-utils.js
index 3b78bc15..216a8ffe 100644
--- a/application/single_app/static/js/workspace/view-utils.js
+++ b/application/single_app/static/js/workspace/view-utils.js
@@ -221,7 +221,11 @@ function buildAgentViewHtml(agent) {
     const name = escapeHtml(agent.name || "");
     const description = escapeHtml(agent.description || "No description available.");
     const model = escapeHtml(agent.azure_openai_gpt_deployment || agent.model || "Default");
-    const agentType = agent.agent_type === "aifoundry" ? "Azure AI Foundry" : "Local (Semantic Kernel)";
+    const agentType = agent.agent_type === "new_foundry"
+        ? "New Foundry"
+        : agent.agent_type === "aifoundry"
+            ? "Foundry (classic)"
+            : "Local (Semantic Kernel)";
     const rawInstructions = agent.instructions || "No instructions defined.";
     // Render instructions as Markdown (marked + DOMPurify are loaded globally in base.html)
     const renderedInstructions = (typeof marked !== 'undefined' && typeof DOMPurify !== 'undefined')
diff --git a/application/single_app/static/js/workspace/workspace_agents.js b/application/single_app/static/js/workspace/workspace_agents.js
index 623be234..822ca331 100644
--- a/application/single_app/static/js/workspace/workspace_agents.js
+++ b/application/single_app/static/js/workspace/workspace_agents.js
@@ -84,12 +84,12 @@ function renderAgentsTable(agentsList) {
     const truncatedDesc = truncateDescription(description, 90);
     const isGlobal = agent.is_global;
 
-    // Action buttons — Chat + View always, Edit/Delete for non-global
-    let actionButtons = `<button class="btn btn-sm btn-primary chat-agent-btn me-1" data-name="${escapeHtml(agent.name)}" title="Chat with this agent">
-        <i class="bi bi-chat-dots me-1"></i>Chat
-      </button>
-      <button class="btn btn-sm btn-outline-info view-agent-btn me-1" data-name="${escapeHtml(agent.name)}" title="View details">
+    // Match group workspace ordering in table view: View, Chat, Edit, Delete.
+    let actionButtons = `<button class="btn btn-sm btn-outline-info view-agent-btn me-1" data-name="${escapeHtml(agent.name)}" title="View details">
         <i class="bi bi-eye"></i>
+      </button>
+      <button class="btn btn-sm btn-primary chat-agent-btn me-1" data-name="${escapeHtml(agent.name)}" title="Chat with this agent">
+        <i class="bi bi-chat-dots me-1"></i>Chat
       </button>`;
 
     if (!isGlobal) {
@@ -331,7 +331,7 @@ async function deleteAgent(name) {
 // --- Execution: Event Wiring & Initial Load ---
 
 function initializeWorkspaceAgentUI() {
-  window.agentModalStepper = new AgentModalStepper(false);
+  window.agentModalStepper = new AgentModalStepper(false, { settingsEndpoint: '/api/user/agent/settings' });
   attachAgentTableEvents();
 
   // Set up view toggle
diff --git a/application/single_app/static/js/workspace/workspace_model_endpoints.js b/application/single_app/static/js/workspace/workspace_model_endpoints.js
new file mode 100644
index 00000000..3f9e3337
--- /dev/null
+++ b/application/single_app/static/js/workspace/workspace_model_endpoints.js
@@ -0,0 +1,689 @@
+// workspace_model_endpoints.js
+
+import { showToast } from "../chat/chat-toast.js";
+
+const enableMultiEndpointToggle = document.getElementById("enable_multi_model_endpoints");
+const endpointsWrapper = document.getElementById("model-endpoints-wrapper");
+const endpointsTbody = document.getElementById("model-endpoints-tbody");
+const addEndpointBtn = document.getElementById("add-model-endpoint-btn");
+
+const endpointModalEl = document.getElementById("modelEndpointModal");
+const endpointModal = endpointModalEl && window.bootstrap ? bootstrap.Modal.getOrCreateInstance(endpointModalEl) : null;
+
+const endpointIdInput = document.getElementById("model-endpoint-id");
+const endpointNameInput = document.getElementById("model-endpoint-name");
+const endpointProviderSelect = document.getElementById("model-endpoint-provider");
+const endpointUrlInput = document.getElementById("model-endpoint-endpoint");
+const endpointProjectGroup = document.getElementById("model-endpoint-project-group");
+const endpointProjectInput = document.getElementById("model-endpoint-project-name");
+const endpointProjectApiVersionGroup = document.getElementById("model-endpoint-project-api-version-group");
+const endpointProjectApiVersionInput = document.getElementById("model-endpoint-project-api-version");
+const endpointOpenAiApiVersionGroup = document.getElementById("model-endpoint-openai-api-version-group");
+const endpointOpenAiApiVersionInput = document.getElementById("model-endpoint-openai-api-version");
+const endpointSubscriptionGroup = document.getElementById("model-endpoint-subscription-group");
+const endpointResourceGroup = document.getElementById("model-endpoint-resource-group-group");
+const endpointSubscriptionInput = document.getElementById("model-endpoint-subscription-id");
+const endpointResourceGroupInput = document.getElementById("model-endpoint-resource-group");
+const endpointAuthTypeSelect = document.getElementById("model-endpoint-auth-type");
+const endpointManagementCloudGroup = document.getElementById("model-endpoint-management-cloud-group");
+const endpointManagementCloudSelect = document.getElementById("model-endpoint-management-cloud");
+const endpointCustomAuthorityGroup = document.getElementById("model-endpoint-custom-authority-group");
+const endpointCustomAuthorityInput = document.getElementById("model-endpoint-custom-authority");
+const endpointFoundryScopeGroup = document.getElementById("model-endpoint-foundry-scope-group");
+const endpointFoundryScopeInput = document.getElementById("model-endpoint-foundry-scope");
+const apiKeyNote = document.getElementById("model-endpoint-api-key-note");
+
+const miTypeGroup = document.getElementById("model-endpoint-mi-type-group");
+const miClientGroup = document.getElementById("model-endpoint-mi-client-group");
+const tenantGroup = document.getElementById("model-endpoint-tenant-group");
+const clientGroup = document.getElementById("model-endpoint-client-group");
+const secretGroup = document.getElementById("model-endpoint-secret-group");
+const apiKeyGroup = document.getElementById("model-endpoint-key-group");
+
+const miTypeSelect = document.getElementById("model-endpoint-mi-type");
+const miClientIdInput = document.getElementById("model-endpoint-mi-client-id");
+const tenantIdInput = document.getElementById("model-endpoint-tenant-id");
+const clientIdInput = document.getElementById("model-endpoint-client-id");
+const clientSecretInput = document.getElementById("model-endpoint-client-secret");
+const apiKeyInput = document.getElementById("model-endpoint-api-key");
+
+const fetchBtn = document.getElementById("model-endpoint-fetch-btn");
+const saveBtn = document.getElementById("model-endpoint-save-btn");
+const modelsListEl = document.getElementById("model-endpoint-models-list");
+const addModelBtn = document.getElementById("model-endpoint-add-model-btn");
+
+const scope = window.modelEndpointScope || "user";
+const endpointsApi = scope === "group" ? "/api/group/model-endpoints" : "/api/user/model-endpoints";
+const modelsFetchApi = scope === "group" ? "/api/group/models/fetch" : "/api/user/models/fetch";
+const modelsTestApi = scope === "group" ? "/api/group/models/test-model" : "/api/user/models/test-model";
+
+let workspaceEndpoints = Array.isArray(window.workspaceModelEndpoints) ? [...window.workspaceModelEndpoints] : [];
+let modalModels = [];
+
+function generateId() {
+    if (window.crypto && window.crypto.randomUUID) {
+        return window.crypto.randomUUID();
+    }
+    return `id_${Math.random().toString(36).slice(2)}_${Date.now()}`;
+}
+
+function setElementVisibility(element, isVisible) {
+    if (!element) {
+        return;
+    }
+    element.classList.toggle("d-none", !isVisible);
+}
+
+function formatProviderLabel(provider) {
+    if (provider === "aifoundry") {
+        return "Foundry (classic)";
+    }
+    if (provider === "new_foundry") {
+        return "New Foundry";
+    }
+    return "Azure OpenAI";
+}
+
+function collectSelectedModels(endpoint) {
+    const models = endpoint?.models || [];
+    const selected = models.filter((model) => model?.enabled);
+    if (!selected.length) {
+        return "No models selected";
+    }
+    const names = selected.map((model) => model.displayName || model.deploymentName || model.modelName || "Unnamed");
+    return names.join(", ");
+}
+
+function renderEndpoints() {
+    if (!endpointsTbody) {
+        return;
+    }
+
+    endpointsTbody.innerHTML = "";
+
+    if (!workspaceEndpoints.length) {
+        endpointsTbody.innerHTML = `
+            <tr>
+                <td colspan="5" class="text-center text-muted py-3">No endpoints configured yet.</td>
+            </tr>
+        `;
+        return;
+    }
+
+    workspaceEndpoints.forEach((endpoint) => {
+        const row = document.createElement("tr");
+        const selectedModels = collectSelectedModels(endpoint);
+        const statusLabel = endpoint.enabled ? "Enabled" : "Disabled";
+        const statusClass = endpoint.enabled ? "success" : "secondary";
+        const toggleLabel = endpoint.enabled ? "Disable" : "Enable";
+
+        row.innerHTML = `
+            <td>
+                <div class="fw-semibold">${escapeHtml(endpoint.name || "Unnamed Endpoint")}</div>
+                <div class="text-muted small">${escapeHtml(endpoint.connection?.endpoint || "")}</div>
+            </td>
+            <td>${escapeHtml(formatProviderLabel(endpoint.provider))}</td>
+            <td>
+                <span title="${escapeHtml(selectedModels)}">${escapeHtml(selectedModels)}</span>
+            </td>
+            <td><span class="badge bg-${statusClass}">${statusLabel}</span></td>
+            <td class="text-end">
+                <div class="btn-group btn-group-sm" role="group">
+                    <button type="button" class="btn btn-outline-primary" data-action="edit" data-endpoint-id="${endpoint.id}">Edit</button>
+                    <button type="button" class="btn btn-outline-${endpoint.enabled ? "warning" : "success"}" data-action="toggle" data-endpoint-id="${endpoint.id}">${toggleLabel}</button>
+                    <button type="button" class="btn btn-outline-danger" data-action="delete" data-endpoint-id="${endpoint.id}">Delete</button>
+                </div>
+            </td>
+        `;
+
+        endpointsTbody.appendChild(row);
+    });
+}
+
+function updateAuthVisibility() {
+    const authType = endpointAuthTypeSelect?.value || "managed_identity";
+    const provider = endpointProviderSelect?.value || "aoai";
+    const isApiKey = authType === "api_key";
+    const isFoundry = provider === "aifoundry" || provider === "new_foundry";
+    setElementVisibility(endpointProjectGroup, isFoundry);
+    setElementVisibility(endpointProjectApiVersionGroup, isFoundry);
+    setElementVisibility(endpointOpenAiApiVersionGroup, true);
+    setElementVisibility(endpointSubscriptionGroup, provider === "aoai" && !isApiKey);
+    setElementVisibility(endpointResourceGroup, provider === "aoai" && !isApiKey);
+    setElementVisibility(miTypeGroup, authType === "managed_identity");
+    setElementVisibility(miClientGroup, authType === "managed_identity" && (miTypeSelect?.value === "user_assigned"));
+    setElementVisibility(tenantGroup, authType === "service_principal");
+    setElementVisibility(clientGroup, authType === "service_principal");
+    setElementVisibility(secretGroup, authType === "service_principal");
+    setElementVisibility(apiKeyGroup, authType === "api_key");
+    setElementVisibility(endpointManagementCloudGroup, authType === "service_principal" && isFoundry);
+    setElementVisibility(endpointCustomAuthorityGroup, authType === "service_principal" && isFoundry && endpointManagementCloudSelect?.value === "custom");
+    setElementVisibility(endpointFoundryScopeGroup, authType === "service_principal" && isFoundry && endpointManagementCloudSelect?.value === "custom");
+    setElementVisibility(apiKeyNote, authType === "api_key");
+    setElementVisibility(addModelBtn, authType === "api_key");
+    setElementVisibility(fetchBtn, authType !== "api_key");
+}
+
+function resetModal() {
+    if (endpointIdInput) endpointIdInput.value = "";
+    if (endpointNameInput) endpointNameInput.value = "";
+    if (endpointProviderSelect) endpointProviderSelect.value = "aoai";
+    if (endpointUrlInput) endpointUrlInput.value = "";
+    if (endpointProjectInput) endpointProjectInput.value = "";
+    if (endpointProjectApiVersionInput) endpointProjectApiVersionInput.value = "v1";
+    if (endpointOpenAiApiVersionInput) endpointOpenAiApiVersionInput.value = "2024-05-01-preview";
+    if (endpointSubscriptionInput) endpointSubscriptionInput.value = "";
+    if (endpointResourceGroupInput) endpointResourceGroupInput.value = "";
+    if (endpointAuthTypeSelect) endpointAuthTypeSelect.value = "managed_identity";
+    if (endpointManagementCloudSelect) endpointManagementCloudSelect.value = "public";
+    if (endpointCustomAuthorityInput) endpointCustomAuthorityInput.value = "";
+    if (endpointFoundryScopeInput) endpointFoundryScopeInput.value = "";
+    if (miTypeSelect) miTypeSelect.value = "system_assigned";
+    if (miClientIdInput) miClientIdInput.value = "";
+    if (tenantIdInput) tenantIdInput.value = "";
+    if (clientIdInput) clientIdInput.value = "";
+    if (clientSecretInput) clientSecretInput.value = "";
+    if (apiKeyInput) apiKeyInput.value = "";
+    if (clientSecretInput) clientSecretInput.placeholder = "";
+    if (apiKeyInput) apiKeyInput.placeholder = "";
+
+    modalModels = [];
+    if (modelsListEl) modelsListEl.innerHTML = "<p class=\"text-muted\">Fetch models to begin selection.</p>";
+
+    updateAuthVisibility();
+}
+
+function openModalForEndpoint(endpoint) {
+    if (!endpointModal) {
+        return;
+    }
+
+    resetModal();
+
+    if (endpoint) {
+        if (endpointIdInput) endpointIdInput.value = endpoint.id || "";
+        if (endpointNameInput) endpointNameInput.value = endpoint.name || "";
+        if (endpointProviderSelect) endpointProviderSelect.value = endpoint.provider || "aoai";
+        if (endpointUrlInput) endpointUrlInput.value = endpoint.connection?.endpoint || "";
+        if (endpointProjectInput) endpointProjectInput.value = endpoint.connection?.project_name || "";
+        if (endpointProjectApiVersionInput) {
+            endpointProjectApiVersionInput.value = endpoint.connection?.project_api_version || endpoint.connection?.api_version || "v1";
+        }
+        if (endpointOpenAiApiVersionInput) {
+            endpointOpenAiApiVersionInput.value = endpoint.connection?.openai_api_version || endpoint.connection?.api_version || "2024-05-01-preview";
+        }
+        if (endpointSubscriptionInput) endpointSubscriptionInput.value = endpoint.management?.subscription_id || "";
+        if (endpointResourceGroupInput) endpointResourceGroupInput.value = endpoint.management?.resource_group || "";
+        if (endpointAuthTypeSelect) endpointAuthTypeSelect.value = endpoint.auth?.type || "managed_identity";
+        if (endpointManagementCloudSelect) endpointManagementCloudSelect.value = endpoint.auth?.management_cloud || "public";
+        if (endpointCustomAuthorityInput) endpointCustomAuthorityInput.value = endpoint.auth?.custom_authority || "";
+        if (endpointFoundryScopeInput) endpointFoundryScopeInput.value = endpoint.auth?.foundry_scope || "";
+        if (miTypeSelect) miTypeSelect.value = endpoint.auth?.managed_identity_type || "system_assigned";
+        if (miClientIdInput) miClientIdInput.value = endpoint.auth?.managed_identity_client_id || "";
+        if (tenantIdInput) tenantIdInput.value = endpoint.auth?.tenant_id || "";
+        if (clientIdInput) clientIdInput.value = endpoint.auth?.client_id || "";
+        if (clientSecretInput) {
+            clientSecretInput.value = endpoint.auth?.client_secret || "";
+            if (!clientSecretInput.value && endpoint.has_client_secret) {
+                clientSecretInput.placeholder = "Stored";
+            }
+        }
+        if (apiKeyInput) {
+            apiKeyInput.value = endpoint.auth?.api_key || "";
+            if (!apiKeyInput.value && endpoint.has_api_key) {
+                apiKeyInput.placeholder = "Stored";
+            }
+        }
+        modalModels = Array.isArray(endpoint.models) ? [...endpoint.models] : [];
+        renderModalModels(modalModels);
+    }
+
+    updateAuthVisibility();
+    endpointModal.show();
+}
+
+function renderModalModels(models) {
+    if (!modelsListEl) {
+        return;
+    }
+
+    if (!models || !models.length) {
+        modelsListEl.innerHTML = "<p class=\"text-muted\">No models loaded yet.</p>";
+        return;
+    }
+
+    const fragment = document.createDocumentFragment();
+    models.forEach((model) => {
+        const wrapper = document.createElement("div");
+        wrapper.className = "border rounded p-2 mb-2";
+        const deploymentName = model.deploymentName || "";
+        const modelName = model.modelName || "";
+        const displayName = model.displayName || deploymentName;
+        const description = model.description || "";
+        const modelId = model.id || generateId();
+        model.id = modelId;
+
+        wrapper.innerHTML = `
+            <div class="form-check">
+                <input class="form-check-input" type="checkbox" data-model-id="${modelId}" ${model.enabled ? "checked" : ""} />
+                <label class="form-check-label fw-semibold">${escapeHtml(displayName)}</label>
+            </div>
+            <div class="row g-2 mt-2">
+                <div class="col-md-4">
+                    <label class="form-label small">Deployment</label>
+                    <input class="form-control form-control-sm" data-deployment-name-for="${modelId}" value="${escapeHtml(deploymentName)}" />
+                </div>
+                <div class="col-md-4">
+                    <label class="form-label small">Display Name</label>
+                    <input class="form-control form-control-sm" data-display-name-for="${modelId}" value="${escapeHtml(displayName)}" />
+                </div>
+                <div class="col-md-4">
+                    <label class="form-label small">Model Name</label>
+                    <input class="form-control form-control-sm" value="${escapeHtml(modelName)}" disabled />
+                </div>
+            </div>
+            <div class="mt-2">
+                <label class="form-label small">Description</label>
+                <textarea class="form-control form-control-sm" rows="2" data-description-for="${modelId}">${escapeHtml(description)}</textarea>
+            </div>
+        `;
+
+        fragment.appendChild(wrapper);
+    });
+
+    modelsListEl.innerHTML = "";
+    modelsListEl.appendChild(fragment);
+}
+
+function collectModalModels() {
+    if (!modelsListEl) {
+        return [];
+    }
+
+    const updated = modalModels.map((model) => ({ ...model }));
+    updated.forEach((model) => {
+        const checkbox = modelsListEl.querySelector(`input[data-model-id="${model.id}"]`);
+        const deploymentInput = modelsListEl.querySelector(`input[data-deployment-name-for="${model.id}"]`);
+        const displayInput = modelsListEl.querySelector(`input[data-display-name-for="${model.id}"]`);
+        const descriptionInput = modelsListEl.querySelector(`textarea[data-description-for="${model.id}"]`);
+        model.enabled = checkbox ? checkbox.checked : model.enabled;
+        model.deploymentName = deploymentInput ? deploymentInput.value.trim() : model.deploymentName;
+        model.displayName = displayInput ? displayInput.value.trim() : model.displayName;
+        model.description = descriptionInput ? descriptionInput.value.trim() : model.description;
+    });
+    return updated;
+}
+
+async function testModelConnection(model) {
+    const payload = buildEndpointPayload();
+    if (!payload || !model?.deploymentName) {
+        showToast("Model deployment name is required for testing.", "warning");
+        return;
+    }
+
+    const requestBody = {
+        ...payload,
+        model: {
+            deploymentName: model.deploymentName
+        }
+    };
+
+    try {
+        const response = await fetch(modelsTestApi, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(requestBody)
+        });
+        const data = await response.json().catch(() => ({}));
+        if (!response.ok) {
+            throw new Error(data.error || "Connection test failed.");
+        }
+        showToast("Model connection successful.", "success");
+    } catch (error) {
+        console.error("Model connection failed", error);
+        showToast(error.message || "Model connection failed.", "danger");
+    }
+}
+
+async function fetchModels() {
+    const payload = buildEndpointPayload();
+    if (!payload) {
+        return;
+    }
+
+    modalModels = collectModalModels();
+
+    try {
+        const response = await fetch(modelsFetchApi, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(payload)
+        });
+        const data = await response.json().catch(() => ({}));
+        if (!response.ok) {
+            throw new Error(data.error || "Failed to fetch models.");
+        }
+
+        const models = Array.isArray(data.models) ? data.models : [];
+        const existingMap = new Map();
+        modalModels.forEach((model) => {
+            const key = (model.deploymentName || "").trim().toLowerCase();
+            if (key) {
+                existingMap.set(key, model);
+            }
+        });
+
+        let addedCount = 0;
+        models.forEach((model) => {
+            const deploymentName = (model.deploymentName || model.deployment || "").trim();
+            if (!deploymentName) {
+                return;
+            }
+            const key = deploymentName.toLowerCase();
+            if (existingMap.has(key)) {
+                return;
+            }
+            modalModels.push({
+                id: generateId(),
+                deploymentName,
+                modelName: model.modelName || model.name || "",
+                displayName: deploymentName,
+                description: "",
+                enabled: false,
+                isDiscovered: true
+            });
+            existingMap.set(key, true);
+            addedCount += 1;
+        });
+        renderModalModels(modalModels);
+        showToast(`Fetched ${models.length} models. Added ${addedCount} new.`, "success");
+    } catch (error) {
+        console.error("Model fetch failed", error);
+        showToast(error.message || "Failed to fetch models.", "danger");
+    }
+}
+
+function buildEndpointPayload() {
+    if (!endpointNameInput || !endpointUrlInput || !endpointOpenAiApiVersionInput) {
+        return null;
+    }
+    const endpointId = endpointIdInput?.value.trim() || "";
+    const name = endpointNameInput.value.trim();
+    const endpoint = endpointUrlInput.value.trim();
+    const projectName = endpointProjectInput?.value.trim() || "";
+    const projectApiVersion = endpointProjectApiVersionInput?.value.trim() || "v1";
+    const openAiApiVersion = endpointOpenAiApiVersionInput.value.trim();
+    const provider = endpointProviderSelect?.value || "aoai";
+    const subscriptionId = endpointSubscriptionInput?.value.trim() || "";
+    const resourceGroup = endpointResourceGroupInput?.value.trim() || "";
+    const authType = endpointAuthTypeSelect?.value || "managed_identity";
+
+    if (!name || !endpoint || !openAiApiVersion) {
+        showToast("Endpoint name, URL, and OpenAI API version are required.", "warning");
+        return null;
+    }
+
+    if ((provider === "aifoundry" || provider === "new_foundry") && !projectApiVersion) {
+        showToast("Project API version is required for Foundry project discovery.", "warning");
+        return null;
+    }
+
+    if ((provider === "aifoundry" || provider === "new_foundry") && !endpoint.includes("/api/projects/") && !projectName) {
+        showToast("Foundry project name is required when the endpoint does not include /api/projects/.", "warning");
+        return null;
+    }
+
+    if (provider === "aoai" && authType !== "api_key" && (!subscriptionId || !resourceGroup)) {
+        showToast("Subscription ID and resource group are required for Azure OpenAI model discovery.", "warning");
+        return null;
+    }
+
+    const auth = {
+        type: authType,
+        managed_identity_type: miTypeSelect?.value || "system_assigned",
+        managed_identity_client_id: miClientIdInput?.value.trim() || "",
+        tenant_id: tenantIdInput?.value.trim() || "",
+        client_id: clientIdInput?.value.trim() || "",
+        client_secret: clientSecretInput?.value.trim() || "",
+        api_key: apiKeyInput?.value.trim() || "",
+        management_cloud: endpointManagementCloudSelect?.value || "public",
+        custom_authority: endpointCustomAuthorityInput?.value.trim() || "",
+        foundry_scope: endpointFoundryScopeInput?.value.trim() || ""
+    };
+
+    if (authType === "service_principal" && (!auth.tenant_id || !auth.client_id || !auth.client_secret)) {
+        showToast("Tenant ID, Client ID, and Client Secret are required for service principal auth.", "warning");
+        return null;
+    }
+
+    if ((provider === "aifoundry" || provider === "new_foundry") && authType === "service_principal" && auth.management_cloud === "custom") {
+        if (!auth.custom_authority) {
+            showToast("Custom authority is required when Management Cloud is set to Custom.", "warning");
+            return null;
+        }
+        if (!auth.foundry_scope) {
+            showToast("Foundry scope is required when Management Cloud is set to Custom.", "warning");
+            return null;
+        }
+    }
+
+    if (authType === "api_key" && !auth.api_key) {
+        showToast("API key is required for API key authentication.", "warning");
+        return null;
+    }
+
+    const management = provider === "aoai" ? {
+        subscription_id: subscriptionId,
+        resource_group: resourceGroup
+    } : {};
+
+    const connection = {
+        endpoint,
+        openai_api_version: openAiApiVersion
+    };
+
+    if (provider === "aifoundry" || provider === "new_foundry") {
+        connection.project_api_version = projectApiVersion;
+        if (projectName) {
+            connection.project_name = projectName;
+        }
+    }
+
+    return {
+        id: endpointId,
+        provider,
+        name,
+        connection,
+        management,
+        auth
+    };
+}
+
+function saveEndpoint() {
+    try {
+        const payload = buildEndpointPayload();
+        if (!payload) {
+            return;
+        }
+
+        const models = collectModalModels();
+        const endpointId = endpointIdInput?.value || generateId();
+        const existingEndpoint = workspaceEndpoints.find((endpoint) => endpoint.id === endpointId);
+        const authType = payload.auth?.type || "managed_identity";
+        const hasApiKey = authType === "api_key" && (Boolean(payload.auth?.api_key) || Boolean(existingEndpoint?.has_api_key));
+        const hasClientSecret = authType === "service_principal" && (Boolean(payload.auth?.client_secret) || Boolean(existingEndpoint?.has_client_secret));
+
+        const endpointData = {
+            id: endpointId,
+            name: payload.name,
+            provider: payload.provider,
+            enabled: true,
+            auth: payload.auth,
+            connection: payload.connection,
+            management: payload.management,
+            models,
+            has_api_key: hasApiKey,
+            has_client_secret: hasClientSecret
+        };
+
+        const existingIndex = workspaceEndpoints.findIndex((endpoint) => endpoint.id === endpointId);
+        if (existingIndex >= 0) {
+            workspaceEndpoints[existingIndex] = endpointData;
+        } else {
+            workspaceEndpoints.push(endpointData);
+        }
+
+        persistEndpoints();
+        renderEndpoints();
+        endpointModal.hide();
+        showToast("Endpoint saved successfully.", "success");
+    } catch (error) {
+        console.error("Error saving endpoint", error);
+        showToast(error.message || "Failed to save endpoint.", "danger");
+    }
+}
+
+function persistEndpoints() {
+    fetch(endpointsApi, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ endpoints: workspaceEndpoints })
+    }).catch((error) => {
+        console.error("Failed to save endpoints", error);
+        showToast("Failed to save endpoints.", "danger");
+    });
+}
+
+function toggleEndpoint(endpointId) {
+    const endpoint = workspaceEndpoints.find((item) => item.id === endpointId);
+    if (!endpoint) {
+        return;
+    }
+    endpoint.enabled = !endpoint.enabled;
+    persistEndpoints();
+    renderEndpoints();
+}
+
+function deleteEndpoint(endpointId) {
+    workspaceEndpoints = workspaceEndpoints.filter((item) => item.id !== endpointId);
+    persistEndpoints();
+    renderEndpoints();
+}
+
+function handleTableClick(event) {
+    const target = event.target.closest("button[data-action]");
+    if (!target) {
+        return;
+    }
+    const action = target.dataset.action;
+    const endpointId = target.dataset.endpointId;
+    if (!endpointId) {
+        return;
+    }
+
+    if (action === "edit") {
+        const endpoint = workspaceEndpoints.find((item) => item.id === endpointId);
+        openModalForEndpoint(endpoint);
+        return;
+    }
+    if (action === "toggle") {
+        toggleEndpoint(endpointId);
+        return;
+    }
+    if (action === "delete") {
+        deleteEndpoint(endpointId);
+    }
+}
+
+function addManualModel() {
+    modalModels = collectModalModels();
+    modalModels.push({
+        id: generateId(),
+        deploymentName: "",
+        modelName: "",
+        displayName: "",
+        description: "",
+        enabled: true
+    });
+    renderModalModels(modalModels);
+}
+
+function escapeHtml(value) {
+    if (!value) return "";
+    return value.replace(/[&<>"']/g, (char) => ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#39;"
+    }[char] || char));
+}
+
+async function loadEndpoints() {
+    try {
+        const response = await fetch(endpointsApi);
+        const payload = await response.json().catch(() => ({}));
+        if (!response.ok) {
+            throw new Error(payload.error || "Failed to load endpoints");
+        }
+        workspaceEndpoints = Array.isArray(payload.endpoints) ? payload.endpoints : [];
+        renderEndpoints();
+    } catch (error) {
+        console.error("Failed to load endpoints", error);
+        showToast(error.message || "Failed to load endpoints.", "danger");
+    }
+}
+
+function initialize() {
+    if (enableMultiEndpointToggle) {
+        enableMultiEndpointToggle.checked = Boolean(window.enableMultiModelEndpoints);
+    }
+    if (endpointsWrapper) {
+        endpointsWrapper.classList.toggle("d-none", !window.enableMultiModelEndpoints);
+    }
+
+    renderEndpoints();
+    loadEndpoints();
+
+    if (addEndpointBtn) {
+        addEndpointBtn.addEventListener("click", () => openModalForEndpoint(null));
+    }
+
+    if (endpointsTbody) {
+        endpointsTbody.addEventListener("click", handleTableClick);
+    }
+
+    if (endpointProviderSelect) {
+        endpointProviderSelect.addEventListener("change", updateAuthVisibility);
+    }
+
+    if (endpointAuthTypeSelect) {
+        endpointAuthTypeSelect.addEventListener("change", updateAuthVisibility);
+    }
+
+    if (endpointManagementCloudSelect) {
+        endpointManagementCloudSelect.addEventListener("change", updateAuthVisibility);
+    }
+
+    if (miTypeSelect) {
+        miTypeSelect.addEventListener("change", updateAuthVisibility);
+    }
+
+    if (fetchBtn) {
+        fetchBtn.addEventListener("click", fetchModels);
+    }
+
+    if (saveBtn) {
+        saveBtn.addEventListener("click", saveEndpoint);
+    }
+
+    if (addModelBtn) {
+        addModelBtn.addEventListener("click", addManualModel);
+    }
+}
+
+if (document.readyState === "loading") {
+    document.addEventListener("DOMContentLoaded", initialize);
+} else {
+    initialize();
+}
diff --git a/application/single_app/static/json/schemas/agent.schema.json b/application/single_app/static/json/schemas/agent.schema.json
index 402304c8..64f91251 100644
--- a/application/single_app/static/json/schemas/agent.schema.json
+++ b/application/single_app/static/json/schemas/agent.schema.json
@@ -57,6 +57,18 @@
         "azure_agent_apim_gpt_api_version": {
           "type": "string"
         },
+        "model_endpoint_id": {
+          "type": "string",
+          "description": "Selected model endpoint ID when using multi-endpoint routing."
+        },
+        "model_id": {
+          "type": "string",
+          "description": "Selected model ID from the multi-endpoint catalog."
+        },
+        "model_provider": {
+          "type": "string",
+          "description": "Model provider for the selected multi-endpoint model (aoai, aifoundry, or new_foundry)."
+        },
         "enable_agent_gpt_apim": {
           "type": "boolean"
         },
@@ -81,7 +93,7 @@
         },
         "agent_type": {
           "type": "string",
-          "enum": ["local", "aifoundry"],
+          "enum": ["local", "aifoundry", "new_foundry"],
           "description": "Type of agent to instantiate."
         },
         "instructions": {
@@ -140,6 +152,29 @@
               }
             }
           }
+        },
+        {
+          "if": {
+            "properties": {
+              "agent_type": { "const": "new_foundry" }
+            }
+          },
+          "then": {
+            "required": [
+              "azure_openai_gpt_api_version",
+              "other_settings"
+            ],
+            "properties": {
+              "actions_to_load": {
+                "type": "array",
+                "maxItems": 0,
+                "description": "New Foundry agents manage tools within Azure and must not specify local plugins."
+              },
+              "other_settings": {
+                "$ref": "#/definitions/NewFoundrySettingsWrapper"
+              }
+            }
+          }
         }
       ]
     },
@@ -149,6 +184,9 @@
       "properties": {
         "azure_ai_foundry": {
           "$ref": "#/definitions/AzureAIFoundrySettings"
+        },
+        "new_foundry": {
+          "$ref": "#/definitions/NewFoundrySettings"
         }
       }
     },
@@ -175,6 +213,54 @@
         }
       },
       "required": ["agent_id"]
+    },
+    "NewFoundrySettingsWrapper": {
+      "type": "object",
+      "required": ["new_foundry"],
+      "properties": {
+        "new_foundry": {
+          "$ref": "#/definitions/NewFoundrySettings"
+        }
+      }
+    },
+    "NewFoundrySettings": {
+      "type": "object",
+      "additionalProperties": true,
+      "properties": {
+        "application_id": {
+          "type": "string",
+          "description": "Application identifier for the new Foundry experience. Usually application_name:version."
+        },
+        "application_name": {
+          "type": "string",
+          "description": "Application name from the new Foundry portal."
+        },
+        "application_version": {
+          "type": "string",
+          "description": "Application version from the new Foundry portal."
+        },
+        "endpoint": {
+          "type": "string",
+          "description": "Project endpoint root for the new Foundry application."
+        },
+        "project_name": {
+          "type": "string",
+          "description": "Foundry project name when endpoint does not already include /api/projects/."
+        },
+        "responses_api_version": {
+          "type": "string",
+          "description": "API version used for the protocols/openai/responses call."
+        },
+        "activity_api_version": {
+          "type": "string",
+          "description": "Optional API version for the activity protocol endpoint."
+        },
+        "notes": {
+          "type": "string",
+          "description": "Optional helper text for administrators managing new Foundry applications."
+        }
+      },
+      "required": ["application_id", "responses_api_version"]
     }
   }
 }
diff --git a/application/single_app/swagger_wrapper.py b/application/single_app/swagger_wrapper.py
index 564973a9..ce4a358a 100644
--- a/application/single_app/swagger_wrapper.py
+++ b/application/single_app/swagger_wrapper.py
@@ -1160,7 +1160,7 @@ def _extract_file_tag(view_func) -> str:
             # Fallback for other module names
             tag_name = ' '.join(word.capitalize() for word in module_name.split('_'))
             return f"📄 {tag_name}"
-    except:
+    except Exception as ex:
         return "📄 Unknown Module"
 
 def _extract_tags_from_route_path(route_path: str) -> List[str]:
diff --git a/application/single_app/templates/_agent_modal.html b/application/single_app/templates/_agent_modal.html
index 80f068ca..a859aed9 100644
--- a/application/single_app/templates/_agent_modal.html
+++ b/application/single_app/templates/_agent_modal.html
@@ -26,8 +26,13 @@ <h5 class="modal-title mb-0" id="agentModalLabel">Add Agent</h5>
             </div>
             <div class="form-check form-check-inline">
               <input class="form-check-input" type="radio" name="agent-type" id="agent-type-aifoundry" value="aifoundry">
-              <label class="form-check-label" for="agent-type-aifoundry">Azure AI Foundry</label>
-              <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Azure AI Foundry agents run in Azure AI Foundry, leverage Azure AI services, and use tools. They are created in a Foundry resource by a person with Azure AI User RBAC role."></i>
+              <label class="form-check-label" for="agent-type-aifoundry">Foundry (classic)</label>
+              <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Classic Foundry agents use the existing Azure AI Foundry agent experience and are invoked through the current SDK-backed path."></i>
+            </div>
+            <div class="form-check form-check-inline">
+              <input class="form-check-input" type="radio" name="agent-type" id="agent-type-new-foundry" value="new_foundry">
+              <label class="form-check-label" for="agent-type-new-foundry">New Foundry</label>
+              <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="New Foundry agents use the application-based experience and are invoked through the Responses protocol endpoint."></i>
             </div>
           </div>
           <div class="form-text" id="agent-type-helper">Choose the provider for this agent. Foundry agents cannot attach local actions.</div>
@@ -83,131 +88,177 @@ <h6 class="mb-3">Basic Information</h6>
         <div class="agent-step d-none" id="agent-step-2">
           <h6 class="mb-3">Model & Connection</h6>
 
-          <!-- Foundry-specific fields (shown only when agent_type = aifoundry) -->
+          <!-- Foundry-specific fields (shown only when agent_type is classic or new Foundry) -->
           <div id="agent-foundry-fields" class="d-none">
-            <div class="alert alert-warning py-2 small" role="note">
-              Azure AI Foundry agents use Azure-managed tools; local actions are disabled for this agent type.
+            <div class="alert alert-warning py-2 small" role="note" id="agent-foundry-mode-note">
+              Foundry-managed tools are used for this agent type and local actions are disabled.
             </div>
             <div class="mb-3">
-              <label for="agent-foundry-endpoint" class="form-label">Azure AI Foundry Endpoint <span class="text-danger" title="Required">*</span></label>
-              <input type="text" class="form-control" id="agent-foundry-endpoint" placeholder="https://&lt;resource&gt;.openai.azure.com/" />
+              <label for="agent-foundry-endpoint-select" class="form-label">Foundry Endpoint</label>
+              <select class="form-select" id="agent-foundry-endpoint-select">
+                <option value="">Select a configured endpoint...</option>
+              </select>
+              <div class="form-text">Endpoints come from global and workspace configurations.</div>
+            </div>
+            <div class="mb-3 d-flex flex-wrap gap-2 align-items-center">
+              <button type="button" class="btn btn-outline-primary btn-sm" id="agent-foundry-fetch-btn">
+                <i class="bi bi-cloud-download me-1"></i><span id="agent-foundry-fetch-btn-label">Fetch Agents</span>
+              </button>
+              <span class="text-muted small" id="agent-foundry-fetch-status"></span>
             </div>
             <div class="mb-3">
-              <label for="agent-foundry-api-version" class="form-label">Azure AI Foundry API Version <span class="text-danger" title="Required">*</span></label>
-              <input type="text" class="form-control" id="agent-foundry-api-version" placeholder="v1" />
+              <label for="agent-foundry-agent-select" class="form-label" id="agent-foundry-select-label">Foundry Agent</label>
+              <select class="form-select" id="agent-foundry-agent-select">
+                <option value="">Select an agent...</option>
+              </select>
+              <div class="form-text" id="agent-foundry-select-help">Select a classic Foundry agent to import its identity.</div>
             </div>
             <div class="mb-3">
-              <label for="agent-foundry-deployment" class="form-label">Foundry Deployment / Project <span class="text-danger" title="Required">*</span></label>
-              <input type="text" class="form-control" id="agent-foundry-deployment" placeholder="deployment or project identifier" />
+              <label for="agent-foundry-endpoint" class="form-label">Foundry Project Endpoint <span class="text-danger" title="Required">*</span></label>
+              <input type="text" class="form-control" id="agent-foundry-endpoint" placeholder="https://&lt;resource&gt;.services.ai.azure.com/ or full /api/projects/... endpoint" />
             </div>
             <div class="mb-3">
-              <label for="agent-foundry-agent-id" class="form-label">Foundry Agent ID <span class="text-danger" title="Required">*</span></label>
-              <input type="text" class="form-control" id="agent-foundry-agent-id" placeholder="GUID from Azure AI Foundry" />
+              <label for="agent-foundry-deployment" class="form-label">Foundry Project Name <span class="text-danger" title="Required">*</span></label>
+              <input type="text" class="form-control" id="agent-foundry-deployment" placeholder="project identifier" />
+            </div>
+            <div class="mb-3" id="agent-classic-foundry-api-version-group">
+              <label for="agent-foundry-api-version" class="form-label">Classic Foundry API Version <span class="text-danger" title="Required">*</span></label>
+              <input type="text" class="form-control" id="agent-foundry-api-version" placeholder="v1" />
+            </div>
+            <div id="agent-classic-foundry-fields">
+              <div class="mb-3">
+                <label for="agent-foundry-agent-id" class="form-label">Foundry Agent ID <span class="text-danger" title="Required">*</span></label>
+                <input type="text" class="form-control" id="agent-foundry-agent-id" placeholder="ID from classic Foundry. Typically starts with asst_" />
+              </div>
+            </div>
+            <div id="agent-new-foundry-only" class="d-none">
+              <div class="mb-3">
+                <label for="agent-new-foundry-responses-api-version" class="form-label">Responses API Version <span class="text-danger" title="Required">*</span></label>
+                <input type="text" class="form-control" id="agent-new-foundry-responses-api-version" placeholder="Fetched or inherited from endpoint" />
+                <div class="form-text">This is populated from the selected endpoint or fetch response when available, but you can override it if your Foundry project requires a different supported Responses API version.</div>
+              </div>
+              <input type="hidden" id="agent-new-foundry-application-id" />
+              <input type="hidden" id="agent-new-foundry-application-version" />
+              <div class="mb-3">
+                  <label for="agent-new-foundry-application-name" class="form-label">Application Name</label>
+                  <input type="text" class="form-control" id="agent-new-foundry-application-name" placeholder="application-name" />
+                  <div class="form-text" id="agent-new-foundry-application-help">Fetch an application above to populate the published version automatically. The runtime invokes the application by name, so you do not need to type a version manually.</div>
+              </div>
+              <div class="mb-3">
+                <label for="agent-new-foundry-activity-api-version" class="form-label">Activity Protocol API Version</label>
+                <input type="text" class="form-control" id="agent-new-foundry-activity-api-version" placeholder="Optional for phase 1" />
+                <div class="form-text">Optional for now. Phase 1 uses the Responses endpoint; activity polling can be added later.</div>
+              </div>
             </div>
             <div class="mb-3">
               <label for="agent-foundry-notes" class="form-label">Admin Notes (optional)</label>
-              <textarea class="form-control" id="agent-foundry-notes" rows="2" placeholder="Internal notes for this Foundry agent"></textarea>
+              <textarea class="form-control" id="agent-foundry-notes" rows="2" placeholder="Internal notes for this Foundry configuration"></textarea>
             </div>
           </div>
-          
+
           <!-- Model Selection -->
           <div class="mb-3" id="agent-global-model-group">
             <label for="agent-global-model-select" class="form-label">Select Model <span class="text-danger" title="Required">*</span></label>
             <select class="form-select" id="agent-global-model-select">
               <option value="">Loading models...</option>
             </select>
+            <input type="hidden" id="agent-model-endpoint-id" />
+            <input type="hidden" id="agent-model-id" />
+            <input type="hidden" id="agent-model-provider" />
           </div>
 
-          <!-- Custom Connection Toggle -->
-          <div class="d-flex align-items-center mb-3" id="agent-custom-connection-toggle">
-            <label for="agent-custom-connection" class="form-label mb-0 me-2">Custom Connection</label>
-            <div class="form-check form-switch">
-              <input class="form-check-input" type="checkbox" id="agent-custom-connection" />
-              <label class="form-check-label" for="agent-custom-connection"></label>
-            </div>
-            <div class="form-text ms-2">Override global model connection settings</div>
-          </div>
-
-          <!-- Custom Connection Fields (shown only when custom connection is ON) -->
-          <div id="agent-custom-connection-fields" class="d-none">
-            <div class="alert alert-info py-2 small" role="note">
-              <strong>Note:</strong> If a value is not provided for an inheritable property, it will be inherited from the selected model.
-            </div>
-            
-            <div class="d-flex align-items-center mb-3">
-              <label for="agent-enable-apim" class="form-label mb-0 me-2">Enable APIM Integration</label>
+          {% if not settings.enable_multi_model_endpoints %}
+            <!-- Custom Connection Toggle -->
+            <div class="d-flex align-items-center mb-3" id="agent-custom-connection-toggle">
+              <label for="agent-custom-connection" class="form-label mb-0 me-2">Custom Connection</label>
               <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" id="agent-enable-apim" />
-                <label class="form-check-label" for="agent-enable-apim"></label>
+                <input class="form-check-input" type="checkbox" id="agent-custom-connection" />
+                <label class="form-check-label" for="agent-custom-connection"></label>
               </div>
+              <div class="form-text ms-2">Override global model connection settings</div>
             </div>
-            
-            <div id="agent-gpt-fields">
-              <div class="mb-3">
-                <label for="agent-gpt-endpoint" class="form-label">Azure OpenAI GPT Endpoint</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-gpt-endpoint" placeholder="https://" />
-              </div>
-              <div class="mb-3">
-                <label for="agent-gpt-key" class="form-label">Azure OpenAI GPT Key</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-gpt-key" />
-              </div>
-              <div class="mb-3">
-                <label for="agent-gpt-deployment" class="form-label">GPT Deployment</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-gpt-deployment" />
-              </div>
-              <div class="mb-3">
-                <label for="agent-gpt-api-version" class="form-label">GPT API Version</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-gpt-api-version" />
-              </div>
-              <div class="mb-3">
-                <label for="agent-reasoning-effort" class="form-label">Reasoning Effort</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="Controls how much reasoning the model applies. Higher effort = deeper analysis but slower.">Optional</span>
-                <select class="form-select" id="agent-reasoning-effort">
-                  <option value="">Inherit from model default</option>
-                  <option value="none">None - Fastest responses</option>
-                  <option value="minimal">Minimal - Light reasoning</option>
-                  <option value="low">Low - Balanced (recommended)</option>
-                  <option value="medium">Medium - Enhanced thinking</option>
-                  <option value="high">High - Maximum analysis</option>
-                </select>
-                <div class="form-text">Only applies to models that support reasoning (e.g., gpt-5, o1, o3)</div>
-              </div>
-            </div>
-            
-            <div id="agent-apim-fields" class="d-none">
-              <div class="mb-3">
-                <label for="agent-apim-endpoint" class="form-label">APIM GPT Endpoint</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-apim-endpoint" placeholder="https://" />
+
+            <!-- Custom Connection Fields (shown only when custom connection is ON) -->
+            <div id="agent-custom-connection-fields" class="d-none">
+              <div class="alert alert-info py-2 small" role="note">
+                <strong>Note:</strong> If a value is not provided for an inheritable property, it will be inherited from the selected model.
               </div>
-              <div class="mb-3">
-                <label for="agent-apim-subscription-key" class="form-label">APIM Subscription Key</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-apim-subscription-key" />
+
+              <div class="d-flex align-items-center mb-3">
+                <label for="agent-enable-apim" class="form-label mb-0 me-2">Enable APIM Integration</label>
+                <div class="form-check form-switch">
+                  <input class="form-check-input" type="checkbox" id="agent-enable-apim" />
+                  <label class="form-check-label" for="agent-enable-apim"></label>
+                </div>
               </div>
-              <div class="mb-3">
-                <label for="agent-apim-deployment" class="form-label">APIM Deployment</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-apim-deployment" />
+
+              <div id="agent-gpt-fields">
+                <div class="mb-3">
+                  <label for="agent-gpt-endpoint" class="form-label">Azure OpenAI GPT Endpoint</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-gpt-endpoint" placeholder="https://" />
+                </div>
+                <div class="mb-3">
+                  <label for="agent-gpt-key" class="form-label">Azure OpenAI GPT Key</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-gpt-key" />
+                </div>
+                <div class="mb-3">
+                  <label for="agent-gpt-deployment" class="form-label">GPT Deployment</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-gpt-deployment" />
+                </div>
+                <div class="mb-3">
+                  <label for="agent-gpt-api-version" class="form-label">GPT API Version</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-gpt-api-version" />
+                </div>
+                <div class="mb-3">
+                  <label for="agent-reasoning-effort" class="form-label">Reasoning Effort</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="Controls how much reasoning the model applies. Higher effort = deeper analysis but slower.">Optional</span>
+                  <select class="form-select" id="agent-reasoning-effort">
+                    <option value="">Inherit from model default</option>
+                    <option value="none">None - Fastest responses</option>
+                    <option value="minimal">Minimal - Light reasoning</option>
+                    <option value="low">Low - Balanced (recommended)</option>
+                    <option value="medium">Medium - Enhanced thinking</option>
+                    <option value="high">High - Maximum analysis</option>
+                  </select>
+                  <div class="form-text">Only applies to models that support reasoning (e.g., gpt-5, o1, o3)</div>
+                </div>
               </div>
-              <div class="mb-3">
-                <label for="agent-apim-api-version" class="form-label">APIM API Version</label>
-                <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
-                <input type="text" class="form-control" id="agent-apim-api-version" />
+
+              <div id="agent-apim-fields" class="d-none">
+                <div class="mb-3">
+                  <label for="agent-apim-endpoint" class="form-label">APIM GPT Endpoint</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-apim-endpoint" placeholder="https://" />
+                </div>
+                <div class="mb-3">
+                  <label for="agent-apim-subscription-key" class="form-label">APIM Subscription Key</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-apim-subscription-key" />
+                </div>
+                <div class="mb-3">
+                  <label for="agent-apim-deployment" class="form-label">APIM Deployment</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-apim-deployment" />
+                </div>
+                <div class="mb-3">
+                  <label for="agent-apim-api-version" class="form-label">APIM API Version</label>
+                  <span class="badge bg-secondary ms-1" data-bs-toggle="tooltip" title="This property is inheritable from the selected model.">Inheritable</span>
+                  <input type="text" class="form-control" id="agent-apim-api-version" />
+                </div>
               </div>
             </div>
-          </div>
+          {% endif %}
         </div>
 
         <!-- Step 3: Instructions -->
         <div class="agent-step d-none" id="agent-step-3">
           <h6 class="mb-3">Instructions</h6>
           <div class="alert alert-info d-none" id="agent-instructions-foundry-note" role="alert">
-            Instructions are managed in Azure AI Foundry.
+            Instructions are managed in Foundry for this agent type.
           </div>
           <div class="mb-3" id="agent-instructions-container">
             <label for="agent-instructions" class="form-label">Agent Instructions <span class="text-danger" title="Required">*</span></label>
@@ -222,7 +273,7 @@ <h6 class="mb-3">Instructions</h6>
         <!-- Step 4: Action Selection -->
         <div class="agent-step d-none" id="agent-step-4">
           <div id="agent-actions-disabled" class="alert alert-info d-none" role="alert">
-            Actions are not available for Azure AI Foundry agents. Foundry-managed tools are used automatically.
+            Actions are not available for Foundry agents. Foundry-managed tools are used automatically.
           </div>
           <!-- Header Section -->
           <div class="card border-0 shadow-sm mb-4">
@@ -257,7 +308,7 @@ <h6 class="mb-0">Available Actions</h6>
                   </select>
                 </div>
               </div>
-              
+
               <!-- Search Results Info -->
               <div class="mb-3">
                 <div class="d-flex justify-content-between align-items-center">
@@ -270,7 +321,7 @@ <h6 class="mb-0">Available Actions</h6>
                   </div>
                 </div>
               </div>
-              
+
               <!-- Quick Action Buttons -->
               <div class="mb-3">
                 <div class="btn-group btn-group-sm" role="group" aria-label="Quick actions">
@@ -287,11 +338,11 @@ <h6 class="mb-0">Available Actions</h6>
               </div>
             </div>
           </div>
-          
+
           <div id="agent-actions-container" class="row g-3">
             <!-- Action cards will be populated by JavaScript -->
           </div>
-          
+
           <!-- No Results Message -->
           <div id="agent-no-actions-message" class="text-center py-5 d-none">
             <div class="card border-0 bg-light">
@@ -325,27 +376,32 @@ <h6 class="mb-0">Available Actions</h6>
         <!-- Step 5: Advanced -->
         <div class="agent-step d-none" id="agent-step-5">
           <h6 class="mb-3">Advanced Settings</h6>
-          <div class="mb-3">
-            <label for="agent-additional-settings" class="form-label">Additional Settings (JSON)</label>
-            <textarea class="form-control" id="agent-additional-settings" rows="6" placeholder='{"example": "value"}'></textarea>
-            <div class="form-text">Optional additional configuration settings for this agent in JSON format.</div>
+          <div class="alert alert-info d-none" id="agent-advanced-foundry-note" role="alert">
+            Advanced options are managed by Foundry and are not available for Foundry agents.
           </div>
-          <div class="mb-3">
-            <div class="d-flex align-items-center mb-3">
-              <label for="agent-power-user-toggle" class="form-label mb-0 me-2">Show Agent Power User Settings</label>
-              <div class="form-check form-switch">
-                <input class="form-check-input" type="checkbox" id="agent-power-user-toggle" />
-                <label class="form-check-label" for="agent-power-user-toggle"></label>
-              </div>
+          <div id="local-agent-advanced-settings">
+            <div class="mb-3">
+              <label for="agent-additional-settings" class="form-label">Additional Settings (JSON)</label>
+              <textarea class="form-control" id="agent-additional-settings" rows="6" placeholder='{"example": "value"}'></textarea>
+              <div class="form-text">Optional additional configuration settings for this agent in JSON format.</div>
             </div>
-            <div class="d-none" id="agent-power-user-settings">
-              <label for="max-completion-tokens" class="form-label">Max Completion Tokens</label>
-              <input type="number" value="-1" class="form-control" id="agent-max-completion-tokens" placeholder="e.g., 4096, Use -1 for default" min="-1" />
-              <div class="form-text">
-                Specify the maximum number of tokens the model can generate in a single response. 
-                Set to -1 to use the model's default limit.
-                Setting a higher cap only allows the model to generate longer answers—it does not force the extra tokens.
-                Use this control mainly to keep answers concise or to shorten responses for sensitive channels.
+            <div class="mb-3">
+              <div class="d-flex align-items-center mb-3">
+                <label for="agent-power-user-toggle" class="form-label mb-0 me-2">Show Agent Power User Settings</label>
+                <div class="form-check form-switch">
+                  <input class="form-check-input" type="checkbox" id="agent-power-user-toggle" />
+                  <label class="form-check-label" for="agent-power-user-toggle"></label>
+                </div>
+              </div>
+              <div class="d-none" id="agent-power-user-settings">
+                <label for="max-completion-tokens" class="form-label">Max Completion Tokens</label>
+                <input type="number" value="-1" class="form-control" id="agent-max-completion-tokens" placeholder="e.g., 4096, Use -1 for default" min="-1" />
+                <div class="form-text">
+                  Specify the maximum number of tokens the model can generate in a single response. 
+                  Set to -1 to use the model's default limit.
+                  Setting a higher cap only allows the model to generate longer answers—it does not force the extra tokens.
+                  Use this control mainly to keep answers concise or to shorten responses for sensitive channels.
+                </div>
               </div>
             </div>
           </div>
diff --git a/application/single_app/templates/_multiendpoint_modal.html b/application/single_app/templates/_multiendpoint_modal.html
new file mode 100644
index 00000000..c505dd6d
--- /dev/null
+++ b/application/single_app/templates/_multiendpoint_modal.html
@@ -0,0 +1,133 @@
+<!-- Model Endpoint Modal -->
+<div class="modal fade" id="modelEndpointModal" tabindex="-1" aria-labelledby="modelEndpointModalLabel" aria-hidden="true">
+    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <h5 class="modal-title" id="modelEndpointModalLabel">Model Endpoint</h5>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <input type="hidden" id="model-endpoint-id" />
+
+                <div class="row g-3">
+                    <div class="col-md-6">
+                        <label for="model-endpoint-name" class="form-label">Endpoint Name</label>
+                        <input type="text" class="form-control" id="model-endpoint-name" />
+                    </div>
+                    <div class="col-md-6">
+                        <label for="model-endpoint-provider" class="form-label">Provider</label>
+                        <select class="form-select" id="model-endpoint-provider">
+                            <option value="aoai">Azure OpenAI</option>
+                            <option value="aifoundry">Foundry (classic)</option>
+                            <option value="new_foundry">New Foundry</option>
+                        </select>
+                        <div class="form-text">
+                            For APIM, choose the matching provider with API key auth. If using classic Foundry, use Foundry (classic). If using the application-based runtime, use New Foundry.
+                        </div>
+                    </div>
+                    <div class="col-md-6">
+                        <label for="model-endpoint-endpoint" class="form-label">Endpoint Fully Qualified Domain Name (FQDN)</label>
+                        <input type="text" class="form-control" id="model-endpoint-endpoint" />
+                    </div>
+                    <div class="col-md-3" id="model-endpoint-project-api-version-group">
+                        <label for="model-endpoint-project-api-version" class="form-label">Project API Version</label>
+                        <input type="text" class="form-control" id="model-endpoint-project-api-version" />
+                        <div class="form-text">Project API versions use the v1 format (for example, v1).</div>
+                    </div>
+                    <div class="col-md-3" id="model-endpoint-openai-api-version-group">
+                        <label for="model-endpoint-openai-api-version" class="form-label">OpenAI API Version</label>
+                        <input type="text" class="form-control" id="model-endpoint-openai-api-version" />
+                        <div class="form-text">OpenAI API versions use a dated format. For New Foundry, this value is used for Responses API calls and is inherited by the agent modal. No default is applied for New Foundry, so enter the supported version for your Foundry project explicitly.</div>
+                    </div>
+                    <div class="col-md-6" id="model-endpoint-project-group">
+                        <label for="model-endpoint-project-name" class="form-label">Foundry Project Name</label>
+                        <input type="text" class="form-control" id="model-endpoint-project-name" />
+                    </div>
+                    <div class="col-md-6" id="model-endpoint-subscription-group">
+                        <label for="model-endpoint-subscription-id" class="form-label">Subscription ID</label>
+                        <input type="text" class="form-control" id="model-endpoint-subscription-id" />
+                    </div>
+                    <div class="col-md-6" id="model-endpoint-resource-group-group">
+                        <label for="model-endpoint-resource-group" class="form-label">Resource Group</label>
+                        <input type="text" class="form-control" id="model-endpoint-resource-group" />
+                    </div>
+                    <div class="col-md-6">
+                        <label for="model-endpoint-auth-type" class="form-label">Authentication Type</label>
+                        <select class="form-select" id="model-endpoint-auth-type">
+                            <option value="managed_identity">Managed Identity</option>
+                            <option value="service_principal">Service Principal</option>
+                            <option value="api_key">API Key</option>
+                        </select>
+                    </div>
+                    <div class="col-md-6" id="model-endpoint-management-cloud-group">
+                        <label for="model-endpoint-management-cloud" class="form-label">Management Cloud</label>
+                        <select class="form-select" id="model-endpoint-management-cloud">
+                            <option value="public">Public</option>
+                            <option value="government">Azure Government</option>
+                            <option value="custom">Custom</option>
+                        </select>
+                    </div>
+                    <div class="col-md-12" id="model-endpoint-custom-authority-group">
+                        <label for="model-endpoint-custom-authority" class="form-label">Custom Authority</label>
+                        <input type="text" class="form-control" id="model-endpoint-custom-authority" placeholder="https://login.microsoftonline.us or custom authority" />
+                    </div>
+                    <div class="col-md-12" id="model-endpoint-foundry-scope-group">
+                        <label for="model-endpoint-foundry-scope" class="form-label">Foundry Scope</label>
+                        <input type="text" class="form-control" id="model-endpoint-foundry-scope" placeholder="https://ai.azure.com/.default" />
+                    </div>
+                </div>
+
+                <div class="row g-3 mt-1">
+                    <div class="col-md-6" id="model-endpoint-mi-type-group">
+                        <label for="model-endpoint-mi-type" class="form-label">Managed Identity Type</label>
+                        <select class="form-select" id="model-endpoint-mi-type">
+                            <option value="system_assigned">System Assigned</option>
+                            <option value="user_assigned">User Assigned</option>
+                        </select>
+                    </div>
+                    <div class="col-md-6" id="model-endpoint-mi-client-group">
+                        <label for="model-endpoint-mi-client-id" class="form-label">Managed Identity Client ID</label>
+                        <input type="text" class="form-control" id="model-endpoint-mi-client-id" />
+                    </div>
+                    <div class="col-md-4" id="model-endpoint-tenant-group">
+                        <label for="model-endpoint-tenant-id" class="form-label">Tenant ID</label>
+                        <input type="text" class="form-control" id="model-endpoint-tenant-id" />
+                    </div>
+                    <div class="col-md-4" id="model-endpoint-client-group">
+                        <label for="model-endpoint-client-id" class="form-label">Client ID</label>
+                        <input type="text" class="form-control" id="model-endpoint-client-id" />
+                    </div>
+                    <div class="col-md-4" id="model-endpoint-secret-group">
+                        <label for="model-endpoint-client-secret" class="form-label">Client Secret</label>
+                        <input type="password" class="form-control" id="model-endpoint-client-secret" />
+                    </div>
+                    <div class="col-md-6" id="model-endpoint-key-group">
+                        <label for="model-endpoint-api-key" class="form-label">API Key</label>
+                        <input type="password" class="form-control" id="model-endpoint-api-key" />
+                    </div>
+                </div>
+
+                <div id="model-endpoint-api-key-note" class="alert alert-info mt-3 d-none">
+                    <i class="bi bi-info-circle me-2"></i>
+                    API key authentication is for inference only. Use a managed identity or service principal for model discovery.
+                </div>
+
+                <div class="d-flex gap-2 mt-4">
+                    <button type="button" class="btn btn-outline-primary" id="model-endpoint-fetch-btn">Fetch Models</button>
+                </div>
+
+                <div class="mt-3">
+                    <h6>Available Models</h6>
+                    <button type="button" class="btn btn-sm btn-outline-primary mt-2 d-none" id="model-endpoint-add-model-btn">
+                        <i class="bi bi-plus-circle me-1"></i>Add Model
+                    </button>
+                    <div id="model-endpoint-models-list" class="mt-2"></div>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Cancel</button>
+                <button type="button" class="btn btn-primary" id="model-endpoint-save-btn">Save Endpoint</button>
+            </div>
+        </div>
+    </div>
+</div>
diff --git a/application/single_app/templates/_sidebar_nav.html b/application/single_app/templates/_sidebar_nav.html
index 33a89b04..2cc2959a 100644
--- a/application/single_app/templates/_sidebar_nav.html
+++ b/application/single_app/templates/_sidebar_nav.html
@@ -1,5 +1,9 @@
 {# Sidebar Navigation Partial #}
-<div id="sidebar-nav" class="d-flex flex-column vh-100 bg-light border-end sidebar-expanded" style="width: 260px; min-width: 220px; position: fixed; left: 0; top: 0; z-index: 1040; transition: transform 0.3s ease;">
+<div id="sidebar-nav" class="d-flex flex-column vh-100 bg-light border-end sidebar-expanded" style="width: var(--sidebar-width, 260px); min-width: var(--sidebar-min-width, 220px); position: fixed; left: 0; top: 0; z-index: 1040; transition: transform 0.3s ease;">
+
+  <div id="sidebar-resize-handle" class="sidebar-resize-handle" aria-label="Resize sidebar" role="separator" tabindex="0">
+    <i class="bi bi-grip-vertical"></i>
+  </div>
   
   <!-- Collapse/Expand button -->
   <button type="button" id="sidebar-toggle-btn" class="btn btn-sm btn-outline-secondary position-absolute d-none d-sm-block"
@@ -855,8 +859,8 @@
       
       /* Fixed user account section */
       #sidebar-user-account {
-        width: 260px;
-        min-width: 220px;
+        width: var(--sidebar-width, 260px);
+        min-width: var(--sidebar-min-width, 220px);
         transition: inherit;
         backdrop-filter: blur(10px);
         -webkit-backdrop-filter: blur(10px);
diff --git a/application/single_app/templates/_sidebar_short_nav.html b/application/single_app/templates/_sidebar_short_nav.html
index 34413abc..d690709c 100644
--- a/application/single_app/templates/_sidebar_short_nav.html
+++ b/application/single_app/templates/_sidebar_short_nav.html
@@ -1,5 +1,9 @@
 {# Sidebar Navigation Partial - Short version without brand/logo #}
-<div id="sidebar-nav" class="d-flex flex-column bg-light border-end sidebar-expanded" style="width: 260px; min-width: 220px; position: fixed; left: 0; top: {% if app_settings.classification_banner_enabled and app_settings.classification_banner_text %}102px{% else %}58px{% endif %}; height: calc(100vh - {% if app_settings.classification_banner_enabled and app_settings.classification_banner_text %}102px{% else %}62px{% endif %}); z-index: 1040; transition: transform 0.3s ease;">
+<div id="sidebar-nav" class="d-flex flex-column bg-light border-end sidebar-expanded" style="width: var(--sidebar-width, 260px); min-width: var(--sidebar-min-width, 220px); position: fixed; left: 0; top: {% if app_settings.classification_banner_enabled and app_settings.classification_banner_text %}102px{% else %}58px{% endif %}; height: calc(100vh - {% if app_settings.classification_banner_enabled and app_settings.classification_banner_text %}102px{% else %}62px{% endif %}); z-index: 1040; transition: transform 0.3s ease;">
+
+  <div id="sidebar-resize-handle" class="sidebar-resize-handle" aria-label="Resize sidebar" role="separator" tabindex="0">
+    <i class="bi bi-grip-vertical"></i>
+  </div>
   
   <div id="sidebar-content" class="flex-grow-1 d-flex flex-column" style="padding-bottom: 80px; overflow-y: auto;">
     <ul class="nav flex-column">
@@ -252,8 +256,8 @@
       
       /* Fixed user account section */
       #sidebar-user-account {
-        width: 260px;
-        min-width: 220px;
+        width: var(--sidebar-width, 260px);
+        min-width: var(--sidebar-min-width, 220px);
         transition: inherit;
         backdrop-filter: blur(10px);
         -webkit-backdrop-filter: blur(10px);
diff --git a/application/single_app/templates/admin_settings.html b/application/single_app/templates/admin_settings.html
index 76e366f0..505bc71c 100644
--- a/application/single_app/templates/admin_settings.html
+++ b/application/single_app/templates/admin_settings.html
@@ -85,69 +85,6 @@
 {% endblock %}
 
 {% block content %}
-<div class="modal fade" id="agentTemplateReviewModal" tabindex="-1" aria-labelledby="agentTemplateReviewModalLabel" aria-hidden="true">
-    <div class="modal-dialog modal-lg modal-dialog-scrollable">
-        <div class="modal-content">
-            <div class="modal-header">
-                <div class="me-3">
-                    <h5 class="modal-title mb-0" id="agentTemplateReviewModalLabel">Agent Template</h5>
-                    <small class="text-muted d-block" id="agent-template-review-subtitle"></small>
-                </div>
-                <span class="badge bg-secondary" id="agent-template-review-status">Pending</span>
-                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
-            </div>
-            <div class="modal-body">
-                <div id="agent-template-review-error" class="alert alert-danger d-none"></div>
-                <div class="mb-3">
-                    <label class="fw-semibold text-muted small">Helper Text</label>
-                    <p class="mb-1" id="agent-template-review-helper">-</p>
-                    <div class="small text-muted" id="agent-template-review-meta"></div>
-                </div>
-                <div class="mb-3 d-flex flex-wrap gap-2" id="agent-template-review-tags"></div>
-                <div class="mb-3">
-                    <label class="fw-semibold text-muted small">Description</label>
-                    <p id="agent-template-review-description" class="mb-0"></p>
-                </div>
-                <div class="mb-3">
-                    <label class="fw-semibold text-muted small">Instructions</label>
-                    <pre class="bg-dark text-white rounded p-3" id="agent-template-review-instructions"></pre>
-                </div>
-                <div class="mb-3 d-none" id="agent-template-review-settings-wrapper">
-                    <label class="fw-semibold text-muted small">Additional Settings</label>
-                    <pre class="bg-light border rounded p-3" id="agent-template-review-settings"></pre>
-                </div>
-                <div class="mb-3 d-none" id="agent-template-review-actions-wrapper">
-                    <label class="fw-semibold text-muted small">Recommended Actions</label>
-                    <div id="agent-template-review-actions" class="d-flex flex-wrap gap-2"></div>
-                </div>
-                <div class="mb-3">
-                    <label for="agent-template-review-notes" class="form-label">Reviewer notes (optional)</label>
-                    <textarea class="form-control" id="agent-template-review-notes" rows="2" placeholder="Add guidance for the submitter or other admins..."></textarea>
-                </div>
-                <div class="mb-3">
-                    <label for="agent-template-reject-reason" class="form-label">Rejection reason</label>
-                    <textarea class="form-control" id="agent-template-reject-reason" rows="2" placeholder="Required when rejecting a template." aria-describedby="agent-template-reject-help"></textarea>
-                    <div class="form-text" id="agent-template-reject-help">Write clear, descriptive feedback so any admin can explain the rejection to the submitter, and plan to notify the user directly.</div>
-                </div>
-            </div>
-            <div class="modal-footer">
-                <button type="button" class="btn btn-outline-danger me-auto" id="agent-template-delete-btn">
-                    <i class="bi bi-trash"></i>
-                    Delete
-                </button>
-                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
-                <button type="button" class="btn btn-outline-danger" id="agent-template-reject-btn">
-                    <i class="bi bi-x-circle"></i>
-                    Reject
-                </button>
-                <button type="button" class="btn btn-success" id="agent-template-approve-btn">
-                    <i class="bi bi-check-circle"></i>
-                    Approve
-                </button>
-            </div>
-        </div>
-    </div>
-</div>
 <div id="index-warning-user" class="alert alert-warning" style="display:none;">
     <strong>⚠️ User-index schema mismatch:</strong>
     Missing fields: <span id="missing-fields-user"></span>
@@ -719,14 +656,14 @@ <h6 class="mb-2">Workspace Feature Toggles</h6>
                                     <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to create and manage group-level agents that can be shared within workgroups and teams."></i>
                                 </div>
                                 <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-custom-agent-endpoints" name="allow_user_custom_agent_endpoints" {% if settings.allow_user_custom_agent_endpoints %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-allow-user-custom-agent-endpoints">Allow User Custom Agent Endpoints</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom API endpoints for their personal agents to connect to external services and models."></i>
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-user-custom-endpoints" name="allow_user_custom_endpoints" {% if settings.allow_user_custom_endpoints %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-allow-user-custom-endpoints">Allow User Custom Endpoints</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom endpoints for their personal workspace agents and model endpoints."></i>
                                 </div>
                                 <div class="form-check form-switch mb-2">
-                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-custom-agent-endpoints" name="allow_group_custom_agent_endpoints" {% if settings.allow_group_custom_agent_endpoints %}checked{% endif %}>
-                                    <label class="form-check-label ms-2" for="toggle-allow-group-custom-agent-endpoints">Allow Group Custom Agent Endpoints</label>
-                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom API endpoints for group-level agents to connect to shared external services and models."></i>
+                                    <input class="form-check-input" type="checkbox" role="switch" id="toggle-allow-group-custom-endpoints" name="allow_group_custom_endpoints" {% if settings.allow_group_custom_endpoints %}checked{% endif %}>
+                                    <label class="form-check-label ms-2" for="toggle-allow-group-custom-endpoints">Allow Group Custom Endpoints</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Allow users to configure custom endpoints for group workspace agents and model endpoints."></i>
                                 </div>
                                 <div class="form-check form-switch mb-2">
                                     <input class="form-check-input" type="checkbox" role="switch" id="toggle-merge-global-sk" name="merge_global_semantic_kernel_with_workspace" {% if settings.merge_global_semantic_kernel_with_workspace %}checked{% endif %}>
@@ -797,22 +734,8 @@ <h4>Global  Agents</h4>
                 {% endif %}
                 </div>
 
-                <!-- Agent Template Submissions Section -->
-                <div class="card p-3 mb-4" id="agent-templates-admin-panel">
-                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-3 mb-3">
-                        <div>
-                            <h5 class="mb-1">
-                                <i class="bi bi-layers me-2"></i>Agent Template Gallery
-                            </h5>
-                            <p class="text-muted small mb-0">Approve community templates before they appear in the gallery.</p>
-                        </div>
-                        <div class="btn-group btn-group-sm" role="group" id="agent-template-status-filters">
-                            <button type="button" class="btn btn-outline-secondary active" data-status="pending">Pending</button>
-                            <button type="button" class="btn btn-outline-secondary" data-status="approved">Approved</button>
-                            <button type="button" class="btn btn-outline-secondary" data-status="rejected">Rejected</button>
-                            <button type="button" class="btn btn-outline-secondary" data-status="all">All</button>
-                        </div>
-                    </div>
+                {% if settings.enable_agent_template_gallery %}
+                <div class="card p-3 mb-4">
                     <div class="row g-3 mb-3">
                         <div class="col-xl-6">
                             <div class="form-check form-switch mb-0">
@@ -829,55 +752,19 @@ <h5 class="mb-1">
                             </div>
                         </div>
                     </div>
-                    <div class="row g-3 align-items-end mb-3">
-                        <div class="col-lg-6">
-                            <label for="agent-template-search" class="form-label mb-1">Search templates</label>
-                            <div class="input-group">
-                                <span class="input-group-text"><i class="bi bi-search"></i></span>
-                                <input type="search" class="form-control" id="agent-template-search" placeholder="Search by template name or submitter">
-                            </div>
-                        </div>
-                        <div class="col-lg-6">
-                            <div class="form-text">Matches template titles, display names, and submitter names/emails.</div>
-                        </div>
-                    </div>
-                    <div class="alert alert-info d-none" id="agent-templates-disabled-alert">
-                        <div class="d-flex gap-2 align-items-start">
-                            <i class="bi bi-info-circle"></i>
-                            <div>
-                                <strong>Template gallery is disabled.</strong>
-                                <div>Enable it under Global Agent Feature Toggles (and allow submissions) to collect templates.</div>
-                            </div>
+                    <div class="d-flex flex-column flex-lg-row justify-content-between align-items-lg-center gap-3">
+                        <div>
+                            <h5 class="mb-1">
+                                <i class="bi bi-layers me-2"></i>Agent Template Approvals
+                            </h5>
+                            <p class="text-muted small mb-0">Template submissions are now reviewed from the shared approvals page.</p>
                         </div>
-                    </div>
-                    <div class="table-responsive">
-                        <table class="table align-middle" id="agent-templates-table">
-                            <thead>
-                                <tr>
-                                    <th>Template</th>
-                                    <th>Status</th>
-                                    <th>Submitted By</th>
-                                    <th>Updated</th>
-                                    <th class="text-end">Actions</th>
-                                </tr>
-                            </thead>
-                            <tbody id="agent-template-table-body">
-                                <tr>
-                                    <td colspan="5" class="text-center text-muted py-4">
-                                        <div class="spinner-border spinner-border-sm me-2" role="status"><span class="visually-hidden">Loading...</span></div>
-                                        Loading templates...
-                                    </td>
-                                </tr>
-                            </tbody>
-                        </table>
-                    </div>
-                    <div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2 mt-2">
-                        <div class="text-muted small" id="agent-template-pagination-summary"></div>
-                        <nav id="agent-template-pagination-nav" aria-label="Template pagination">
-                            <ul class="pagination pagination-sm mb-0" id="agent-template-pagination"></ul>
-                        </nav>
+                        <a class="btn btn-outline-primary align-self-start align-self-lg-center" href="/approvals#agent-template-approvals">
+                            <i class="bi bi-box-arrow-up-right me-1"></i>Open Approvals Queue
+                        </a>
                     </div>
                 </div>
+                {% endif %}
 
                 <!-- Actions Configuration Section -->
                 <div class="card p-3 mb-4" id="actions-configuration">
@@ -1450,146 +1337,64 @@ <h5>
                     Configure all AI model settings including GPT for text generation, embeddings for semantic search, and image generation capabilities.
                 </p>
 
-                <!-- GPT Configuration Section -->
-                <div class="card p-3 mb-4" id="gpt-configuration">
+                <div class="card p-3 mb-4" id="multi-endpoint-configuration">
                     <h5 class="card-title">
-                        <i class="bi bi-chat-text me-2"></i>GPT Configuration
+                        <i class="bi bi-hdd-network me-2"></i>Model Endpoints
                     </h5>
                     <p class="text-muted small">
-                        Configure your GPT model settings. These are used for generating AI text responses.
+                        Manage multiple AI model endpoints (Azure OpenAI and Azure AI Foundry). When enabled, model selection in chat is driven by these endpoints.
                     </p>
 
-                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                    <input type="checkbox" class="form-check-input me-2" id="enable_gpt_apim" name="enable_gpt_apim" {%
-                        if settings.enable_gpt_apim %}checked{% endif %}>
-                    <label class="form-check-label" for="enable_gpt_apim">Use APIM instead of direct to Azure OpenAI
-                        endpoint</label>
-                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route GPT model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
-                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="APIM provides an additional layer for security, monitoring, and rate limiting. When using APIM, you'll need to manually specify your model names and will not be able to fetch models automatically."></i>
-                </div>
-
-                <div id="non_apim_gpt_settings" {% if settings.enable_gpt_apim %}style="display: none;" {% endif %}>
-                    <div class="card p-3 mb-3">
-                        <div class="mb-3">
-                            <label for="azure_openai_gpt_endpoint" class="form-label">
-                                Azure OpenAI GPT Endpoint
-                            </label>
-                            <input type="text" class="form-control" id="azure_openai_gpt_endpoint"
-                                name="azure_openai_gpt_endpoint" value="{{ settings.azure_openai_gpt_endpoint or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_gpt_authentication_type" class="form-label">
-                                Authentication Type
-                            </label>
-                            <select class="form-select" id="azure_openai_gpt_authentication_type"
-                                name="azure_openai_gpt_authentication_type">
-                                <option value="key" {% if settings.azure_openai_gpt_authentication_type=='key'
-                                    %}selected{% endif %}>
-                                    Key
-                                </option>
-                                <option value="managed_identity" {% if
-                                    settings.azure_openai_gpt_authentication_type=='managed_identity' %}selected{% endif
-                                    %}>
-                                    Managed Identity
-                                </option>
-                            </select>
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_gpt_subscription_id" class="form-label">Subscription ID</label>
-                            <input type="text" class="form-control" id="azure_openai_gpt_subscription_id"
-                                name="azure_openai_gpt_subscription_id"
-                                value="{{ settings.azure_openai_gpt_subscription_id or '' }}">
-                        </div>
-                        <div class="mb-3">
-                            <label for="azure_openai_gpt_resource_group" class="form-label">Resource Group</label>
-                            <input type="text" class="form-control" id="azure_openai_gpt_resource_group"
-                                name="azure_openai_gpt_resource_group"
-                                value="{{ settings.azure_openai_gpt_resource_group or '' }}">
-                        </div>
-                        <div class="mb-3" id="gpt_key_container" {% if settings.azure_openai_gpt_authentication_type
-                            !='key' %}style="display: none;" {% endif %}>
-                            <label for="azure_openai_gpt_key" class="form-label">Azure OpenAI GPT Key</label>
-                            <div class="input-group">
-                                <input type="password" class="form-control" id="azure_openai_gpt_key"
-                                    name="azure_openai_gpt_key" value="{{ settings.azure_openai_gpt_key or '' }}">
-                                <button type="button" class="btn btn-outline-secondary"
-                                    id="toggle_gpt_key">Show</button>
-                            </div>
-                        </div>
-                        <div class="mb-3">
-                            <label for="gpt_model" class="form-label">Azure OpenAI GPT Model Selection</label>
-                            <br><small>Each selected model will be available in the Chat UI as an option for the User. You can select multiple models.</small>
-                            <br><small>Save Pending Changes to settings before clicking Fetch Models</small>
-                            <div id="gpt_models_list" class="mt-2 mb-3">
-                                
-                            </div>
-                            
-                            <small>Save pending changes to settings before clicking Fetch Embedding Models</small><br>
-
-                            <input type="hidden" name="gpt_model_json" id="gpt_model_json" />
+                    <div class="form-check form-switch mb-3 d-flex align-items-center">
+                        <input type="checkbox" class="form-check-input me-2" id="enable_multi_model_endpoints" name="enable_multi_model_endpoints" {% if settings.enable_multi_model_endpoints %}checked{% endif %}>
+                        <label class="form-check-label" for="enable_multi_model_endpoints">Enable multi-endpoint model management</label>
+                    </div>
 
-                            
-                            <input type="hidden" id="gpt_model" value="{{ settings.gpt_model.selected[0].deploymentName if settings.gpt_model.selected else '' }}" />
+                    <div id="multi-endpoint-warning" class="alert alert-warning {% if not settings.multi_endpoint_migration_notice.enabled %}d-none{% endif %}">
+                        <i class="bi bi-exclamation-triangle me-2"></i>
+                        <span>{{ settings.multi_endpoint_migration_notice.message }}</span>
+                    </div>
 
-                            <button type="button" class="btn btn-secondary" id="fetch_gpt_models_btn">
-                                Fetch GPT Models
-                            </button>
-                        </div>
-                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
-                            data-bs-target="#advancedGptFields" aria-expanded="false" aria-controls="advancedGptFields">
-                            Show Advanced
-                        </a>
-                        <div class="collapse" id="advancedGptFields">
-                            <div class="card card-body mt-2">
-                                <div class="mb-3">
-                                    <label for="azure_openai_gpt_api_version" class="form-label">
-                                        Azure OpenAI GPT API Version
-                                    </label>
-                                    <input type="text" class="form-control" id="azure_openai_gpt_api_version"
-                                        name="azure_openai_gpt_api_version"
-                                        value="{{ settings.azure_openai_gpt_api_version or '' }}">
-                                </div>
-                            </div>
+                    <div id="default-model-selection-wrapper" class="mt-3">
+                        <label for="default-model-selection" class="form-label">Default model for fallbacks</label>
+                        <select class="form-select" id="default-model-selection" aria-label="Default model for fallback selection"></select>
+                        <div class="form-text">
+                            Used for tasks such as conversation summarization, fallback, and other operations when an agent is selected.
                         </div>
                     </div>
-                </div>
 
-                <div id="apim_gpt_settings" class="card p-3 mb-3" {% if not settings.enable_gpt_apim
-                    %}style="display: none;" {% endif %}>
-                    <div class="mb-3">
-                        <label for="azure_apim_gpt_endpoint" class="form-label">Azure APIM Endpoint</label>
-                        <input type="text" class="form-control" id="azure_apim_gpt_endpoint"
-                            name="azure_apim_gpt_endpoint" value="{{ settings.azure_apim_gpt_endpoint or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_gpt_api_version" class="form-label">Azure APIM API Version</label>
-                        <input type="text" class="form-control" id="azure_apim_gpt_api_version"
-                            name="azure_apim_gpt_api_version" value="{{ settings.azure_apim_gpt_api_version or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_gpt_deployment" class="form-label">Azure APIM Deployment</label>
-                        <br><small class="text-muted">Each model defined here will be available in the Chat UI as an option for the User. You can include multiple models seperated by a comma (example: gpt-4o, o-1, o-3).</small>
-                        <br><small class="text-muted">NOTE: The APIM GPT Test is against the first model in the list.</small>
-                        <input type="text" class="form-control" id="azure_apim_gpt_deployment"
-                            name="azure_apim_gpt_deployment" value="{{ settings.azure_apim_gpt_deployment or '' }}">
-                    </div>
-                    <div class="mb-3">
-                        <label for="azure_apim_gpt_subscription_key" class="form-label">Azure APIM Subscription
-                            Key</label>
-                        <div class="input-group">
-                            <input type="password" class="form-control" id="azure_apim_gpt_subscription_key"
-                                name="azure_apim_gpt_subscription_key"
-                                value="{{ settings.azure_apim_gpt_subscription_key or '' }}">
-                            <button type="button" class="btn btn-outline-secondary"
-                                id="toggle_azure_apim_gpt_subscription_key">Show</button>
+                    <input type="hidden" name="model_endpoints_json" id="model_endpoints_json" />
+                    <input type="hidden" name="default_model_selection_json" id="default_model_selection_json" />
+                    
+                    <div id="model-endpoints-wrapper" class="{% if not settings.enable_multi_model_endpoints %}d-none{% endif %}">
+                        <div class="d-flex justify-content-between align-items-center mb-2">
+                            <h6 class="mb-0">Configured Endpoints</h6>
+                            <button type="button" class="btn btn-sm btn-outline-primary" id="add-model-endpoint-btn">
+                                <i class="bi bi-plus-circle me-1"></i>Add Endpoint
+                            </button>
+                        </div>
+                        <div class="table-responsive">
+                            <table class="table table-sm table-bordered">
+                                <thead>
+                                    <tr>
+                                        <th>Name</th>
+                                        <th>Provider</th>
+                                        <th>Selected Models</th>
+                                        <th>Status</th>
+                                        <th>Actions</th>
+                                    </tr>
+                                </thead>
+                                <tbody id="model-endpoints-tbody">
+                                    <!-- Populated by JavaScript -->
+                                </tbody>
+                            </table>
                         </div>
                     </div>
-                </div>
-
-                <button type="button" class="btn btn-secondary mt-3" id="test_gpt_button">
-                    Test GPT Connection
-                </button>
-                <div id="test_gpt_result" class="mt-2"></div>
+                    {% if not settings.enable_multi_model_endpoints %}
+                        <button type="button" class="btn btn-outline-secondary" data-bs-toggle="modal" data-bs-target="#legacyModelSettingsModal">
+                            <i class="bi bi-sliders me-1"></i>Open Legacy Model Configuration
+                        </button>
+                    {% endif %}
                 </div>
 
                 <!-- Processing Thoughts Section -->
@@ -1919,6 +1724,167 @@ <h5 class="card-title">
                 </button>
                 <div id="test_image_result" class="mt-2"></div>
                 </div>
+
+                {% include '_multiendpoint_modal.html' %}
+
+                <!-- Legacy AI Models Modal -->
+                <div class="modal fade" id="legacyModelSettingsModal" tabindex="-1" aria-labelledby="legacyModelSettingsModalLabel" aria-hidden="true">
+                    <div class="modal-dialog modal-xl modal-dialog-scrollable">
+                        <div class="modal-content">
+                            <div class="modal-header">
+                                <h5 class="modal-title" id="legacyModelSettingsModalLabel">Legacy AI Model Configuration</h5>
+                                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+                            </div>
+                            <div class="modal-body">
+                                <!-- GPT Configuration Section -->
+                                <div class="card p-3 mb-4" id="gpt-configuration">
+                                    <h5 class="card-title">
+                                        <i class="bi bi-chat-text me-2"></i>GPT Configuration
+                                    </h5>
+                                    <p class="text-muted small">
+                                        Configure your GPT model settings. These are used for generating AI text responses.
+                                    </p>
+
+                                <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
+                                    <input type="checkbox" class="form-check-input me-2" id="enable_gpt_apim" name="enable_gpt_apim" {%
+                                        if settings.enable_gpt_apim %}checked{% endif %}>
+                                    <label class="form-check-label" for="enable_gpt_apim">Use APIM instead of direct to Azure OpenAI
+                                        endpoint</label>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Route GPT model requests through Azure API Management instead of directly to Azure OpenAI service for additional governance and monitoring."></i>
+                                    <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="APIM provides an additional layer for security, monitoring, and rate limiting. When using APIM, you'll need to manually specify your model names and will not be able to fetch models automatically."></i>
+                                </div>
+
+                                <div id="non_apim_gpt_settings" {% if settings.enable_gpt_apim %}style="display: none;" {% endif %}>
+                                    <div class="card p-3 mb-3">
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_endpoint" class="form-label">
+                                                Azure OpenAI GPT Endpoint
+                                            </label>
+                                            <input type="text" class="form-control" id="azure_openai_gpt_endpoint"
+                                                name="azure_openai_gpt_endpoint" value="{{ settings.azure_openai_gpt_endpoint or '' }}">
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_authentication_type" class="form-label">
+                                                Authentication Type
+                                            </label>
+                                            <select class="form-select" id="azure_openai_gpt_authentication_type"
+                                                name="azure_openai_gpt_authentication_type">
+                                                <option value="key" {% if settings.azure_openai_gpt_authentication_type=='key'
+                                                    %}selected{% endif %}>
+                                                    Key
+                                                </option>
+                                                <option value="managed_identity" {% if
+                                                    settings.azure_openai_gpt_authentication_type=='managed_identity' %}selected{% endif
+                                                    %}>
+                                                    Managed Identity
+                                                </option>
+                                            </select>
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_subscription_id" class="form-label">Subscription ID</label>
+                                            <input type="text" class="form-control" id="azure_openai_gpt_subscription_id"
+                                                name="azure_openai_gpt_subscription_id"
+                                                value="{{ settings.azure_openai_gpt_subscription_id or '' }}">
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="azure_openai_gpt_resource_group" class="form-label">Resource Group</label>
+                                            <input type="text" class="form-control" id="azure_openai_gpt_resource_group"
+                                                name="azure_openai_gpt_resource_group"
+                                                value="{{ settings.azure_openai_gpt_resource_group or '' }}">
+                                        </div>
+                                        <div class="mb-3" id="gpt_key_container" {% if settings.azure_openai_gpt_authentication_type
+                                            !='key' %}style="display: none;" {% endif %}>
+                                            <label for="azure_openai_gpt_key" class="form-label">Azure OpenAI GPT Key</label>
+                                            <div class="input-group">
+                                                <input type="password" class="form-control" id="azure_openai_gpt_key"
+                                                    name="azure_openai_gpt_key" value="{{ settings.azure_openai_gpt_key or '' }}">
+                                                <button type="button" class="btn btn-outline-secondary"
+                                                    id="toggle_gpt_key">Show</button>
+                                            </div>
+                                        </div>
+                                        <div class="mb-3">
+                                            <label for="gpt_model" class="form-label">Azure OpenAI GPT Model Selection</label>
+                                            <br><small>Each selected model will be available in the Chat UI as an option for the User. You can select multiple models.</small>
+                                            <br><small>Save Pending Changes to settings before clicking Fetch Models</small>
+                                            <div id="gpt_models_list" class="mt-2 mb-3">
+                                                
+                                            </div>
+                                            
+                                            <small>Save pending changes to settings before clicking Fetch Embedding Models</small><br>
+
+                                            <input type="hidden" name="gpt_model_json" id="gpt_model_json" />
+
+                                            
+                                            <input type="hidden" id="gpt_model" value="{{ settings.gpt_model.selected[0].deploymentName if settings.gpt_model.selected else '' }}" />
+
+                                            <button type="button" class="btn btn-secondary" id="fetch_gpt_models_btn">
+                                                Fetch GPT Models
+                                            </button>
+                                        </div>
+                                        <a href="#" class="fw-bold text-decoration-none mb-2" data-bs-toggle="collapse"
+                                            data-bs-target="#advancedGptFields" aria-expanded="false" aria-controls="advancedGptFields">
+                                            Show Advanced
+                                        </a>
+                                        <div class="collapse" id="advancedGptFields">
+                                            <div class="card card-body mt-2">
+                                                <div class="mb-3">
+                                                    <label for="azure_openai_gpt_api_version" class="form-label">
+                                                        Azure OpenAI GPT API Version
+                                                    </label>
+                                                    <input type="text" class="form-control" id="azure_openai_gpt_api_version"
+                                                        name="azure_openai_gpt_api_version"
+                                                        value="{{ settings.azure_openai_gpt_api_version or '' }}">
+                                                </div>
+                                            </div>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <div id="apim_gpt_settings" class="card p-3 mb-3" {% if not settings.enable_gpt_apim
+                                    %}style="display: none;" {% endif %}>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_endpoint" class="form-label">Azure APIM Endpoint</label>
+                                        <input type="text" class="form-control" id="azure_apim_gpt_endpoint"
+                                            name="azure_apim_gpt_endpoint" value="{{ settings.azure_apim_gpt_endpoint or '' }}">
+                                    </div>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_api_version" class="form-label">Azure APIM API Version</label>
+                                        <input type="text" class="form-control" id="azure_apim_gpt_api_version"
+                                            name="azure_apim_gpt_api_version" value="{{ settings.azure_apim_gpt_api_version or '' }}">
+                                    </div>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_deployment" class="form-label">Azure APIM Deployment</label>
+                                        <br><small class="text-muted">Each model defined here will be available in the Chat UI as an option for the User. You can include multiple models seperated by a comma (example: gpt-4o, o-1, o-3).</small>
+                                        <br><small class="text-muted">NOTE: The APIM GPT Test is against the first model in the list.</small>
+                                        <input type="text" class="form-control" id="azure_apim_gpt_deployment"
+                                            name="azure_apim_gpt_deployment" value="{{ settings.azure_apim_gpt_deployment or '' }}">
+                                    </div>
+                                    <div class="mb-3">
+                                        <label for="azure_apim_gpt_subscription_key" class="form-label">Azure APIM Subscription
+                                            Key</label>
+                                        <div class="input-group">
+                                            <input type="password" class="form-control" id="azure_apim_gpt_subscription_key"
+                                                name="azure_apim_gpt_subscription_key"
+                                                value="{{ settings.azure_apim_gpt_subscription_key or '' }}">
+                                            <button type="button" class="btn btn-outline-secondary"
+                                                id="toggle_azure_apim_gpt_subscription_key">Show</button>
+                                        </div>
+                                    </div>
+                                </div>
+
+                                <button type="button" class="btn btn-secondary mt-3" id="test_gpt_button">
+                                    Test GPT Connection
+                                </button>
+                                <div id="test_gpt_result" class="mt-2"></div>
+                                </div>
+
+                            </div>
+                            <div class="modal-footer">
+                                <button type="button" class="btn btn-secondary" data-bs-dismiss="modal">Close</button>
+                            </div>
+                        </div>
+                    </div>
+                </div>
             </div>
 
             <!-- Control Center Configuration Tab -->
@@ -3350,7 +3316,7 @@ <h6 class="mb-2"><i class="bi bi-bell me-2"></i>User Data Notice</h6>
                             </div>
                             <div class="col-md-6">
                                 <label for="web_search_foundry_agent_id" class="form-label">Foundry Agent ID</label>
-                                <input type="text" class="form-control" id="web_search_foundry_agent_id" name="web_search_foundry_agent_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.agent_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="GUID from Azure AI Foundry">
+                                <input type="text" class="form-control" id="web_search_foundry_agent_id" name="web_search_foundry_agent_id" value="{{ settings.web_search_agent.other_settings.azure_ai_foundry.agent_id if settings.web_search_agent.other_settings and settings.web_search_agent.other_settings.azure_ai_foundry else '' }}" placeholder="ID from Azure AI Foundry. Typically starts with asst_">
                             </div>
                             <div class="col-md-4">
                                 <label for="web_search_foundry_auth_type" class="form-label">Authentication Type</label>
@@ -3668,6 +3634,110 @@ <h5><i class="bi bi-file-earmark-text me-2"></i>Document Intelligence</h5>
                     </div>
                 </div>
 
+                <div class="card p-3 mb-3" id="chunk-size-section">
+                    <div class="d-flex align-items-center justify-content-between mb-2">
+                        <h5 class="mb-0"><i class="bi bi-collection me-2"></i>Chunk Sizes</h5>
+                        <span class="badge bg-primary-subtle text-primary-emphasis">Cap: {{ chunk_size_cap }}</span>
+                    </div>
+                    <p class="text-muted mb-2 small">Custom chunk sizes apply to new uploads only. Existing documents keep their current chunks.</p>
+                    <div class="alert alert-warning small mb-3">
+                        <strong>Heads up:</strong> Overrides are capped at {{ chunk_size_cap }} (2x embedding context window, fallback 16,384).
+                    </div>
+                    <div class="form-check form-switch mb-3">
+                        <input
+                            type="checkbox"
+                            class="form-check-input"
+                            id="enable_chunk_size_override"
+                            name="enable_chunk_size_override"
+                            {% if settings.enable_chunk_size_override %}checked{% endif %}
+                        >
+                        <label class="form-check-label ms-2" for="enable_chunk_size_override">
+                            Enable custom chunk sizes by file type
+                        </label>
+                    </div>
+
+                    <div id="chunk-size-fields" class="{% if not settings.enable_chunk_size_override %}d-none{% endif %}">
+                        <div id="chunk-size-cap-warning" class="alert alert-warning d-none" role="alert">
+                            <span id="chunk-size-cap-warning-text">Chunk sizes above the cap will be reduced automatically.</span>
+                        </div>
+                        <input type="hidden" id="chunk_size_cap" value="{{ chunk_size_cap }}" />
+                        {% set chunk_settings = chunk_size_settings or {} %}
+                        {% set chunk_defaults = chunk_size_defaults or {} %}
+                        <div class="row g-3">
+                            <div class="col-md-6">
+                                <label for="chunk_size_txt" class="form-label">TXT (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TXT" id="chunk_size_txt" name="chunk_size_txt" value="{{ chunk_settings.get('txt', {}).get('value', chunk_defaults.get('txt', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_log" class="form-label">LOG (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="LOG" id="chunk_size_log" name="chunk_size_log" value="{{ chunk_settings.get('log', {}).get('value', chunk_defaults.get('log', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_doc" class="form-label">DOC (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOC" id="chunk_size_doc" name="chunk_size_doc" value="{{ chunk_settings.get('doc', {}).get('value', chunk_defaults.get('doc', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_docm" class="form-label">DOCM (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCM" id="chunk_size_docm" name="chunk_size_docm" value="{{ chunk_settings.get('docm', {}).get('value', chunk_defaults.get('docm', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-4">
+                                <label for="chunk_size_docx" class="form-label">DOCX (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="DOCX" id="chunk_size_docx" name="chunk_size_docx" value="{{ chunk_settings.get('docx', {}).get('value', chunk_defaults.get('docx', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_html" class="form-label">HTML (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="HTML" id="chunk_size_html" name="chunk_size_html" value="{{ chunk_settings.get('html', {}).get('value', chunk_defaults.get('html', {}).get('value')) }}">
+                                <div class="form-text">Minimum enforced at 50% of target on merge.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_md" class="form-label">Markdown (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="MD" id="chunk_size_md" name="chunk_size_md" value="{{ chunk_settings.get('md', {}).get('value', chunk_defaults.get('md', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_xml" class="form-label">XML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="XML" id="chunk_size_xml" name="chunk_size_xml" value="{{ chunk_settings.get('xml', {}).get('value', chunk_defaults.get('xml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_yaml" class="form-label">YAML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YAML" id="chunk_size_yaml" name="chunk_size_yaml" value="{{ chunk_settings.get('yaml', {}).get('value', chunk_defaults.get('yaml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_yml" class="form-label">YML (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="YML" id="chunk_size_yml" name="chunk_size_yml" value="{{ chunk_settings.get('yml', {}).get('value', chunk_defaults.get('yml', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_json" class="form-label">JSON (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="JSON" id="chunk_size_json" name="chunk_size_json" value="{{ chunk_settings.get('json', {}).get('value', chunk_defaults.get('json', {}).get('value')) }}">
+                            </div>
+                            <!--
+                            <div class="col-md-6">
+                                <label for="chunk_size_csv" class="form-label">CSV (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="CSV" id="chunk_size_csv" name="chunk_size_csv" value="{{ chunk_settings.get('csv', {}).get('value', chunk_defaults.get('csv', {}).get('value')) }}">
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_excel" class="form-label">Excel (characters)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="EXCEL" id="chunk_size_excel" name="chunk_size_excel" value="{{ chunk_settings.get('excel', {}).get('value', chunk_defaults.get('excel', {}).get('value')) }}">
+                            </div>
+                            -->
+                            <div class="col-md-6">
+                                <label for="chunk_size_transcript" class="form-label">Transcripts (words)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="TRANSCRIPT" id="chunk_size_transcript" name="chunk_size_transcript" value="{{ chunk_settings.get('transcript', {}).get('value', chunk_defaults.get('transcript', {}).get('value')) }}">
+                                <div class="form-text">Applies to new audio transcripts.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_pdf" class="form-label">PDF (pages)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PDF" id="chunk_size_pdf" name="chunk_size_pdf" value="{{ chunk_settings.get('pdf', {}).get('value', chunk_defaults.get('pdf', {}).get('value')) }}">
+                                <div class="form-text">Pages per chunk after extraction.</div>
+                            </div>
+                            <div class="col-md-6">
+                                <label for="chunk_size_pptx" class="form-label">PPT/PPTX (slides)</label>
+                                <input type="number" min="1" class="form-control chunk-size-input" data-label="PPT/PPTX" id="chunk_size_pptx" name="chunk_size_pptx" value="{{ chunk_settings.get('pptx', {}).get('value', chunk_defaults.get('pptx', {}).get('value')) }}">
+                                <div class="form-text">Slides per chunk after extraction.</div>
+                            </div>
+                        </div>
+                    </div>
+                </div>
+
                 <!-- AI Video Intelligence Card -->
                 <div class="card p-4 mb-4 border-info shadow-sm" id="video-intelligence-section">
                     <div class="d-flex align-items-center justify-content-between mb-3">
@@ -3989,65 +4059,8 @@ <h5 class="mb-3">
                     </p>
                 </div>
             </div>
-            
-
         </div>
-        <div class="tab-pane fade" id="security" role="tabpanel" aria-labelledby="security-tab">
-                 <p class="text-muted">
-                    Configure Security Settings.
-                </p>
-                <div class="card p-3 mb-3" id="keyvault-section">
-                    <div class="d-flex justify-content-between align-items-center mb-2">
-                        <h5>
-                            <i class="bi bi-safe me-2"></i>Key Vault
-                        </h5>
-                        <button type="button" class="btn btn-outline-info btn-sm" data-bs-toggle="modal" data-bs-target="#keyVaultInfoModal">
-                            <i class="bi bi-info-circle me-1"></i>Configuration Guide
-                        </button>
-                    </div>
-                    
-                    <p class="text-muted">
-                        Configure Key Vault settings.
-                    </p>
-                    <div class="form-group form-check form-switch mb-3 d-flex align-items-center">
-                        <input
-                            type="checkbox"
-                            class="form-check-input me-2"
-                            id="enable_key_vault_secret_storage"
-                            name="enable_key_vault_secret_storage"
-                            {% if settings.enable_key_vault_secret_storage %}checked{% endif %}
-                        >
-                        <label class="form-check-label" for="enable_key_vault_secret_storage">
-                            Enable Key Vault for Agent and Action Secrets
-                        </label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="Store agent and action sensitive information like API keys and secrets securely in Azure Key Vault."></i>
-                    </div>
-                    <div id="key-vault-warning" class="alert alert-warning mt-2">
-                        <strong>⚠️ Warning:</strong> Once you enable Key Vault, you should <u>NOT</u> disable it. Disabling Key Vault after enabling <u>WILL</u> cause loss of access to secrets and break application functionality.
-                    </div>
-                    <div class="mb-3">
-                        <label for="key_vault_name" class="form-label">Key Vault Name</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="The name of the key vault resource. Endpoint is determined by your AZURE_ENVIRONMENT app service configuration."></i>
-                        <input type="text" class="form-control" id="key_vault_name" name="key_vault_name" value="{{ settings.key_vault_name or '' }}" {% if settings.enable_key_vault_secret_storage %}required{% endif %}>
-                    </div>
-                    <div class="mb-3">
-                        <label for="key_vault_identity" class="form-label">Key Vault Managed Identity Client ID</label>
-                        <i class="bi bi-info-circle ms-2" data-bs-toggle="tooltip" title="The Client ID of the User Assigned Managed Identity. Leave blank for system-assigned identity of the app service."></i>
-                        <input type="text" class="form-control" id="key_vault_identity" name="key_vault_identity" value="{{ settings.key_vault_identity or '' }}">
-                    </div>
-                    <button
-                        type="button"
-                        class="btn btn-secondary mt-3"
-                        style="width: auto;"
-                        id="test_key_vault_button"
-                    >
-                        Test Key Vault Connection
-                    </button>
-                    <div id="test_key_vault_result" class="mt-2">
-                    </div>
-                </div>
-            </div>
-        </div> <!-- End of Admin tab content -->
+        <!-- End of Admin tab content -->
     </form>
     
     <!-- Floating Save Button -->
@@ -4404,6 +4417,11 @@ <h5 class="modal-title" id="userAgreementPreviewModalLabel">
     window.imageSelected = JSON.parse('{{ settings.image_gen_model.selected|tojson()|safe }}' || '[]');
     window.imageAll      = JSON.parse('{{ settings.image_gen_model.all|tojson()|safe }}' || '[]');
 
+    window.enableMultiModelEndpoints = {{ 'true' if settings.enable_multi_model_endpoints else 'false' }};
+    window.modelEndpoints = JSON.parse('{{ settings.model_endpoints|tojson()|safe }}' || '[]');
+    window.defaultModelSelection = JSON.parse('{{ settings.default_model_selection|tojson()|safe }}' || '{}');
+    window.multiEndpointMigrationNotice = JSON.parse('{{ settings.multi_endpoint_migration_notice|tojson()|safe }}' || '{}');
+
     // *** NEW: Classification Data ***
     try {
         let categoriesStr = '{{ settings.document_classification_categories|tojson(indent=None)|safe }}';
@@ -4442,12 +4460,12 @@ <h5 class="modal-title" id="userAgreementPreviewModalLabel">
 
 </script>
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_settings.js') }}"></script>
+<script type="module" src="{{ url_for('static', filename='js/admin/admin_model_endpoints.js') }}"></script>
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_sidebar_nav.js') }}"></script>
 <script type="module" src="{{ url_for('static', filename='js/plugin_modal_stepper.js') }}"></script>
 {% if settings.enable_semantic_kernel %}
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_plugins.js') }}"></script>
 <script type="module" src="{{ url_for('static', filename='js/admin/admin_agents.js') }}"></script>
-<script type="module" src="{{ url_for('static', filename='js/admin/admin_agent_templates.js') }}"></script>
 {% endif %}
 
 <!-- Script to update the walkthrough steps based on form changes -->
diff --git a/application/single_app/templates/approvals.html b/application/single_app/templates/approvals.html
index a3388f23..cb5b0d95 100644
--- a/application/single_app/templates/approvals.html
+++ b/application/single_app/templates/approvals.html
@@ -99,6 +99,75 @@ <h2>
                     </div>
                 </div>
             </div>
+
+            {% if has_agent_template_admin_access %}
+            <div class="card mt-4" id="agent-template-approvals">
+                <div class="card-body" id="agent-templates-admin-panel">
+                    <div class="d-flex flex-wrap justify-content-between align-items-start gap-3 mb-3">
+                        <div>
+                            <h4 class="mb-1">
+                                <i class="bi bi-layers me-2"></i>Agent Template Approvals
+                            </h4>
+                            <p class="text-muted small mb-0">Review community template submissions from the shared approvals page.</p>
+                        </div>
+                        <div class="btn-group btn-group-sm" role="group" id="agent-template-status-filters" aria-label="Agent template status filters">
+                            <button type="button" class="btn btn-outline-secondary active" data-status="pending">Pending</button>
+                            <button type="button" class="btn btn-outline-secondary" data-status="approved">Approved</button>
+                            <button type="button" class="btn btn-outline-secondary" data-status="rejected">Rejected</button>
+                            <button type="button" class="btn btn-outline-secondary" data-status="all">All</button>
+                        </div>
+                    </div>
+                    <div class="row g-3 align-items-end mb-3">
+                        <div class="col-lg-6">
+                            <label for="agent-template-search" class="form-label mb-1">Search templates</label>
+                            <div class="input-group">
+                                <span class="input-group-text"><i class="bi bi-search"></i></span>
+                                <input type="search" class="form-control" id="agent-template-search" placeholder="Search by template name or submitter" />
+                            </div>
+                        </div>
+                        <div class="col-lg-6">
+                            <div class="form-text">Matches template titles, display names, and submitter names or emails.</div>
+                        </div>
+                    </div>
+                    <div class="alert alert-info d-none" id="agent-templates-disabled-alert">
+                        <div class="d-flex gap-2 align-items-start">
+                            <i class="bi bi-info-circle"></i>
+                            <div>
+                                <strong>Template gallery is disabled.</strong>
+                                <div>Enable it from Admin Settings to accept new submissions.</div>
+                            </div>
+                        </div>
+                    </div>
+                    <div class="table-responsive">
+                        <table class="table align-middle" id="agent-templates-table">
+                            <thead>
+                                <tr>
+                                    <th>Template</th>
+                                    <th>Status</th>
+                                    <th>Submitted By</th>
+                                    <th>Updated</th>
+                                    <th class="text-end">Actions</th>
+                                </tr>
+                            </thead>
+                            <tbody id="agent-template-table-body">
+                                <tr>
+                                    <td colspan="5" class="text-center text-muted py-4">
+                                        <div class="spinner-border spinner-border-sm me-2" role="status"><span class="visually-hidden">Loading...</span></div>
+                                        Loading templates...
+                                    </td>
+                                </tr>
+                            </tbody>
+                        </table>
+                    </div>
+                    <div class="d-flex flex-column flex-md-row justify-content-between align-items-md-center gap-2 mt-2">
+                        <div class="text-muted small" id="agent-template-pagination-summary"></div>
+                        <nav id="agent-template-pagination-nav" aria-label="Template pagination">
+                            <ul class="pagination pagination-sm mb-0" id="agent-template-pagination"></ul>
+                        </nav>
+                    </div>
+                </div>
+            </div>
+            {% endif %}
         </div>
     </div>
 </div>
@@ -164,6 +233,71 @@ <h6>Request Details</h6>
         </div>
     </div>
 </div>
+{% if has_agent_template_admin_access %}
+<div class="modal fade" id="agentTemplateReviewModal" tabindex="-1" aria-labelledby="agentTemplateReviewModalLabel" aria-hidden="true">
+    <div class="modal-dialog modal-lg modal-dialog-scrollable">
+        <div class="modal-content">
+            <div class="modal-header">
+                <div class="me-3">
+                    <h5 class="modal-title mb-0" id="agentTemplateReviewModalLabel">Agent Template</h5>
+                    <small class="text-muted d-block" id="agent-template-review-subtitle"></small>
+                </div>
+                <span class="badge bg-secondary" id="agent-template-review-status">Pending</span>
+                <button type="button" class="btn-close" data-bs-dismiss="modal" aria-label="Close"></button>
+            </div>
+            <div class="modal-body">
+                <div id="agent-template-review-error" class="alert alert-danger d-none"></div>
+                <div class="mb-3">
+                    <label class="fw-semibold text-muted small">Helper Text</label>
+                    <p class="mb-1" id="agent-template-review-helper">-</p>
+                    <div class="small text-muted" id="agent-template-review-meta"></div>
+                </div>
+                <div class="mb-3 d-flex flex-wrap gap-2" id="agent-template-review-tags"></div>
+                <div class="mb-3">
+                    <label class="fw-semibold text-muted small">Description</label>
+                    <p id="agent-template-review-description" class="mb-0"></p>
+                </div>
+                <div class="mb-3">
+                    <label class="fw-semibold text-muted small">Instructions</label>
+                    <pre class="bg-dark text-white rounded p-3" id="agent-template-review-instructions"></pre>
+                </div>
+                <div class="mb-3 d-none" id="agent-template-review-settings-wrapper">
+                    <label class="fw-semibold text-muted small">Additional Settings</label>
+                    <pre class="bg-light border rounded p-3" id="agent-template-review-settings"></pre>
+                </div>
+                <div class="mb-3 d-none" id="agent-template-review-actions-wrapper">
+                    <label class="fw-semibold text-muted small">Recommended Actions</label>
+                    <div id="agent-template-review-actions" class="d-flex flex-wrap gap-2"></div>
+                </div>
+                <div class="mb-3">
+                    <label for="agent-template-review-notes" class="form-label">Reviewer notes (optional)</label>
+                    <textarea class="form-control" id="agent-template-review-notes" rows="2" placeholder="Add guidance for the submitter or other admins..."></textarea>
+                </div>
+                <div class="mb-3">
+                    <label for="agent-template-reject-reason" class="form-label">Rejection reason</label>
+                    <textarea class="form-control" id="agent-template-reject-reason" rows="2" placeholder="Required when rejecting a template." aria-describedby="agent-template-reject-help"></textarea>
+                    <div class="form-text" id="agent-template-reject-help">Write clear, descriptive feedback so any admin can explain the rejection to the submitter.</div>
+                </div>
+            </div>
+            <div class="modal-footer">
+                <button type="button" class="btn btn-outline-danger me-auto" id="agent-template-delete-btn">
+                    <i class="bi bi-trash"></i>
+                    Delete
+                </button>
+                <button type="button" class="btn btn-outline-secondary" data-bs-dismiss="modal">Close</button>
+                <button type="button" class="btn btn-outline-danger" id="agent-template-reject-btn">
+                    <i class="bi bi-x-circle"></i>
+                    Reject
+                </button>
+                <button type="button" class="btn btn-success" id="agent-template-approve-btn">
+                    <i class="bi bi-check-circle"></i>
+                    Approve
+                </button>
+            </div>
+        </div>
+    </div>
+</div>
+{% endif %}
 {% endblock %}
 
 {% block scripts %}
@@ -666,4 +800,7 @@ <h6>Request Details</h6>
     }
 });
 </script>
+{% if has_agent_template_admin_access %}
+<script type="module" src="{{ url_for('static', filename='js/admin/admin_agent_templates.js') }}"></script>
+{% endif %}
 {% endblock %}
diff --git a/application/single_app/templates/base.html b/application/single_app/templates/base.html
index fa8d060f..9525526c 100644
--- a/application/single_app/templates/base.html
+++ b/application/single_app/templates/base.html
@@ -63,7 +63,7 @@
     }
     /* Sidebar padding for main content when sidebar is enabled */
     .sidebar-padding {
-      padding-left: 260px;
+      padding-left: var(--sidebar-width, 260px);
       padding-top: 0 !important;
     }
 
@@ -347,6 +347,7 @@
   <!-- Navigation and Sidebar JavaScript -->
   <script src="{{ url_for('static', filename='js/navigation.js') }}"></script>
   <script src="{{ url_for('static', filename='js/sidebar.js') }}"></script>
+  <script src="{{ url_for('static', filename='js/sidebar-resize.js') }}"></script>
   <!-- Profile Image JavaScript -->
   <script src="{{ url_for('static', filename='js/profile-image.js') }}"></script>
   <!-- Notifications JavaScript (for badge polling on all pages) -->
@@ -372,8 +373,8 @@ <h5 class="modal-title" id="userAgreementUploadModalLabel">
           <p class="text-muted small mb-3">
             Please read and accept the following agreement before uploading files:
           </p>
-          <div id="userAgreementUploadContent" class="border rounded p-3 mb-3" 
-               style="max-height: 300px; overflow-y: auto; background-color: var(--bs-light);">
+          <div id="userAgreementUploadContent" class="border rounded p-3 mb-3 bg-light"
+               style="max-height: 300px; overflow-y: auto;">
             <!-- Rendered Markdown content will be inserted here -->
           </div>
           <div id="userAgreementUploadDailyCheck" class="text-muted small" style="display: none;">
diff --git a/application/single_app/templates/chats.html b/application/single_app/templates/chats.html
index 704ff9fb..60db7f8e 100644
--- a/application/single_app/templates/chats.html
+++ b/application/single_app/templates/chats.html
@@ -289,6 +289,20 @@ <h5 id="current-conversation-title" class="mb-0 flex-grow-1">
                 <!-- Chat messages will be dynamically loaded here -->
             </div>
 
+            <!--
+            {% if multi_endpoint_notice.enabled %}
+            <div id="multi-endpoint-notice" class="alert alert-warning d-none mx-3 mb-0" data-message="{{ multi_endpoint_notice.message }}">
+                <div class="d-flex justify-content-between align-items-center">
+                    <div class="me-3">
+                        <i class="bi bi-exclamation-triangle me-2"></i>
+                        <span id="multi-endpoint-notice-text">{{ multi_endpoint_notice.message }}</span>
+                    </div>
+                    <button type="button" class="btn btn-sm btn-outline-dark" id="dismiss-multi-endpoint-notice">Dismiss</button>
+                </div>
+            </div>
+            {% endif %}
+            -->
+
             <div class="p-3 border-top flex-shrink-0">
                 
                       <div class="chat-toolbar mb-2">
@@ -445,19 +459,33 @@ <h5 id="current-conversation-title" class="mb-0 flex-grow-1">
                                 </option>
                                 {% endfor %}
                             {% else %}
-                                {# normal direct-Azure OpenAI flow: show whatever you fetched into settings.gpt_model.selected #}
-                                {% for model in settings.gpt_model.selected %}
-                                <option
-                                    value="{{ model.deploymentName }}"
-                                    {% if loop.first %}selected{% endif %}
-                                >
-                                    {{ model.modelName }}
-                                </option>
-                                {% endfor %}
+                                {% if settings.enable_gpt_apim %}
+                                    {# when using APIM, azure_apim_gpt_deployment may be "dep1" or "dep1,dep2,…" #}
+                                    {% set raw = settings.azure_apim_gpt_deployment or "" %}
+                                    {% set apim_list = raw.split(',') %}
+                                    {% for dep in apim_list %}
+                                    {% set d = dep.strip() %}
+                                    <option value="{{ d }}" {% if loop.first %}selected{% endif %}>
+                                        {{ d }}
+                                    </option>
+                                    {% endfor %}
+                                {% else %}
+                                    {# normal direct-Azure OpenAI flow: show whatever you fetched into settings.gpt_model.selected #}
+                                    {% for model in settings.gpt_model.selected %}
+                                    <option
+                                        value="{{ model.deploymentName }}"
+                                        {% if loop.first %}selected{% endif %}
+                                    >
+                                        {{ model.modelName }}
+                                    </option>
+                                    {% endfor %}
+                                {% endif %}
                             {% endif %}
                             </select>
                         </div>
 
+                        </div>
+
                         <div class="chat-toolbar-toggles">
 
                         <!-- Reasoning effort toggle button -->
@@ -488,7 +516,6 @@ <h5 id="current-conversation-title" class="mb-0 flex-grow-1">
                         {% endif %}
 
                         </div>
-                        </div>
                     </div>
                 </div>
 
@@ -1093,8 +1120,8 @@ <h5 class="modal-title" id="scopeLockModalLabel">
     window.activeGroupId = "{{ active_group_id }}";
     window.activeGroupName = "{{ active_group_name }}";
     window.activePublicWorkspaceId = "{{ active_public_workspace_id }}";
-    window.userGroups = {{ user_groups|tojson|safe }};
-    window.userVisiblePublicWorkspaces = {{ user_visible_public_workspaces|tojson|safe }};
+    window.userGroups = JSON.parse('{{ user_groups|tojson|safe }}');
+    window.userVisiblePublicWorkspaces = JSON.parse('{{ user_visible_public_workspaces|tojson|safe }}');
     window.enableEnhancedCitations = "{{ enable_enhanced_citations }}";
     window.enable_document_classification = "{{ enable_document_classification }}";
     window.classification_categories = JSON.parse('{{ settings.document_classification_categories|tojson(indent=None)|safe }}' || '[]');
@@ -1110,13 +1137,16 @@ <h5 class="modal-title" id="scopeLockModalLabel">
 
     // App settings for feature detection
     window.appSettings = {
-        enable_text_to_speech: {{ 'true' if app_settings.enable_text_to_speech else 'false' }},
-        enable_speech_to_text_input: {{ 'true' if app_settings.enable_speech_to_text_input else 'false' }},
-        enable_web_search_user_notice: {{ 'true' if settings.enable_web_search_user_notice else 'false' }},
-        enforce_workspace_scope_lock: {{ 'true' if settings.enforce_workspace_scope_lock else 'false' }},
-        enable_thoughts: {{ 'true' if settings.enable_thoughts else 'false' }}
+        enable_text_to_speech: JSON.parse('{{ 'true' if app_settings.enable_text_to_speech else 'false' }}'),
+        enable_speech_to_text_input: JSON.parse('{{ 'true' if app_settings.enable_speech_to_text_input else 'false' }}'),
+        enable_web_search_user_notice: JSON.parse('{{ 'true' if settings.enable_web_search_user_notice else 'false' }}'),
+        enforce_workspace_scope_lock: JSON.parse('{{ 'true' if settings.enforce_workspace_scope_lock else 'false' }}'),
+        enable_multi_model_endpoints: JSON.parse('{{ 'true' if enable_multi_model_endpoints else 'false' }}'),
+        enable_thoughts: JSON.parse('{{ 'true' if settings.enable_thoughts else 'false' }}')
     };
 
+    window.multiEndpointNotice = JSON.parse('{{ multi_endpoint_notice|tojson()|safe }}');
+
     // Layout related globals (can stay here or move entirely into chat-layout.js if preferred)
     let splitInstance = null;
     let currentLayout = 'split'; // Default layout
diff --git a/application/single_app/templates/control_center.html b/application/single_app/templates/control_center.html
index d3d5adb2..bff6f2e9 100644
--- a/application/single_app/templates/control_center.html
+++ b/application/single_app/templates/control_center.html
@@ -760,6 +760,57 @@ <h6 class="card-title mb-0">
                                             </h6>
                                         </div>
                                         <div class="card-body">
+                                            <div class="row g-2 align-items-end mb-3">
+                                                <div class="col-xl-2 col-lg-3 col-md-4">
+                                                    <label for="tokenUserFilter" class="form-label small mb-1">User</label>
+                                                    <select class="form-select form-select-sm" id="tokenUserFilter">
+                                                        <option value="all">All users</option>
+                                                    </select>
+                                                </div>
+                                                <div class="col-xl-2 col-lg-3 col-md-4">
+                                                    <label for="tokenWorkspaceTypeFilter" class="form-label small mb-1">Workspace</label>
+                                                    <select class="form-select form-select-sm" id="tokenWorkspaceTypeFilter">
+                                                        <option value="all">All workspaces</option>
+                                                    </select>
+                                                </div>
+                                                <div class="col-xl-2 col-lg-3 col-md-4 d-none" id="tokenGroupFilterContainer">
+                                                    <label for="tokenGroupFilter" class="form-label small mb-1">Group</label>
+                                                    <select class="form-select form-select-sm" id="tokenGroupFilter">
+                                                        <option value="all">All groups</option>
+                                                    </select>
+                                                </div>
+                                                <div class="col-xl-2 col-lg-3 col-md-4 d-none" id="tokenPublicWorkspaceFilterContainer">
+                                                    <label for="tokenPublicWorkspaceFilter" class="form-label small mb-1">Public Workspace</label>
+                                                    <select class="form-select form-select-sm" id="tokenPublicWorkspaceFilter">
+                                                        <option value="all">All public workspaces</option>
+                                                    </select>
+                                                </div>
+                                                <div class="col-xl-2 col-lg-3 col-md-4">
+                                                    <label for="tokenModelFilter" class="form-label small mb-1">Model</label>
+                                                    <select class="form-select form-select-sm" id="tokenModelFilter">
+                                                        <option value="all">All models</option>
+                                                    </select>
+                                                </div>
+                                                <div class="col-xl-2 col-lg-3 col-md-4">
+                                                    <label for="tokenTypeFilter" class="form-label small mb-1">Token Type</label>
+                                                    <select class="form-select form-select-sm" id="tokenTypeFilter">
+                                                        <option value="all">All token types</option>
+                                                    </select>
+                                                </div>
+                                                <div class="col-xl-2 col-lg-3 col-md-4">
+                                                    <div class="d-flex gap-2">
+                                                        <button type="button" class="btn btn-primary btn-sm w-100" id="tokenApplyFiltersBtn">
+                                                            <i class="bi bi-funnel me-1"></i>Apply
+                                                        </button>
+                                                        <button type="button" class="btn btn-outline-secondary btn-sm" id="tokenResetFiltersBtn" aria-label="Reset token filters">
+                                                            <i class="bi bi-arrow-counterclockwise"></i>
+                                                        </button>
+                                                    </div>
+                                                </div>
+                                            </div>
+                                            <div class="small text-muted mb-3">
+                                                Token filters apply to the token chart and token export data only.
+                                            </div>
                                             <div class="chart-container" style="height: 300px; position: relative;">
                                                 <canvas id="tokensChart"></canvas>
                                             </div>
diff --git a/application/single_app/templates/group_workspaces.html b/application/single_app/templates/group_workspaces.html
index 658f6cde..882251a1 100644
--- a/application/single_app/templates/group_workspaces.html
+++ b/application/single_app/templates/group_workspaces.html
@@ -292,37 +292,55 @@ <h2>Group Workspace</h2>
         Group Prompts
       </button>
     </li>
-    {% if settings.enable_semantic_kernel and settings.allow_group_agents %}
-    <li class="nav-item" role="presentation">
-      <button
-        class="nav-link"
-        id="group-agents-tab-btn"
-        data-bs-toggle="tab"
-        data-bs-target="#group-agents-tab"
-        type="button"
-        role="tab"
-        aria-controls="group-agents-tab"
-        aria-selected="false"
-      >
-        Group Agents
-      </button>
-    </li>
+    {% if settings.per_user_semantic_kernel and settings.enable_semantic_kernel %}
+      {% if settings.allow_group_agents %}
+        <li class="nav-item" role="presentation">
+          <button
+            class="nav-link"
+            id="group-agents-tab-btn"
+            data-bs-toggle="tab"
+            data-bs-target="#group-agents-tab"
+            type="button"
+            role="tab"
+            aria-controls="group-agents-tab"
+            aria-selected="false"
+          >
+            Group Agents
+          </button>
+        </li>
+    
+        {% if settings.enable_semantic_kernel and settings.allow_group_plugins %}
+          <li class="nav-item" role="presentation">
+            <button
+              class="nav-link"
+              id="group-plugins-tab-btn"
+              data-bs-toggle="tab"
+              data-bs-target="#group-plugins-tab"
+              type="button"
+              role="tab"
+              aria-controls="group-plugins-tab"
+              aria-selected="false"
+            >
+              Group Actions
+            </button>
+          </li>
+      {% endif %}
     {% endif %}
-    {% if settings.enable_semantic_kernel and settings.allow_group_plugins %}
-    <li class="nav-item" role="presentation">
-      <button
-        class="nav-link"
-        id="group-plugins-tab-btn"
-        data-bs-toggle="tab"
-        data-bs-target="#group-plugins-tab"
-        type="button"
-        role="tab"
-        aria-controls="group-plugins-tab"
-        aria-selected="false"
-      >
-        Group Actions
-      </button>
-    </li>
+    {% if settings.allow_group_custom_endpoints %}
+      <li class="nav-item" role="presentation">
+        <button
+          class="nav-link"
+          id="group-endpoints-tab-btn"
+          data-bs-toggle="tab"
+          data-bs-target="#group-endpoints-tab"
+          type="button"
+          role="tab"
+          aria-controls="group-endpoints-tab"
+          aria-selected="false"
+        >
+          Group Endpoints
+        </button>
+      </li>
     {% endif %}
   </ul>
 
@@ -742,7 +760,6 @@ <h2>Group Workspace</h2>
     </div>
     <!-- End GROUP PROMPTS TAB -->
 
-    {% if settings.enable_semantic_kernel and settings.allow_group_agents %}
     <!-- ============= GROUP AGENTS TAB ============= -->
     <div
       class="tab-pane fade"
@@ -864,11 +881,130 @@ <h2>Group Workspace</h2>
     <!-- End GROUP ACTIONS TAB -->
     {% endif %}
 
+    {% if settings.enable_semantic_kernel and settings.allow_group_custom_endpoints and settings.enable_multi_model_endpoints %}
+    <!-- ============= GROUP ENDPOINTS TAB ============= -->
+    <div
+      class="tab-pane fade"
+      id="group-endpoints-tab"
+      role="tabpanel"
+      aria-labelledby="group-endpoints-tab-btn"
+    >
+      <!-- Group Model Endpoints -->
+      <div class="card p-3 my-3" id="group-multi-endpoint-configuration">
+        <h6 class="mb-2"><i class="bi bi-hdd-network me-2"></i>Group Model Endpoints</h6>
+        <p class="text-muted small mb-2">Manage model endpoints for this group. Global endpoints are managed by admins.</p>
+        <div class="form-check form-switch mb-3 d-flex align-items-center">
+          <input type="checkbox" class="form-check-input me-2" id="enable_multi_model_endpoints" name="enable_multi_model_endpoints" {% if settings.enable_multi_model_endpoints %}checked{% endif %} disabled />
+          <label class="form-check-label" for="enable_multi_model_endpoints">Multi-endpoint management is controlled by your admin</label>
+        </div>
+        <div id="model-endpoints-wrapper" class="{% if not settings.enable_multi_model_endpoints %}d-none{% endif %}">
+          <div class="d-flex justify-content-between align-items-center mb-2">
+            <h6 class="mb-0">Group Endpoints</h6>
+            <button type="button" class="btn btn-sm btn-outline-primary" id="add-model-endpoint-btn">
+              <i class="bi bi-plus-circle me-1"></i>Add Endpoint
+            </button>
+          </div>
+          <div class="table-responsive">
+            <table class="table table-sm table-bordered">
+              <thead>
+                <tr>
+                  <th>Name</th>
+                  <th>Provider</th>
+                  <th>Selected Models</th>
+                  <th>Status</th>
+                  <th>Actions</th>
+                </tr>
+              </thead>
+              <tbody id="model-endpoints-tbody">
+                <!-- Populated by JS -->
+              </tbody>
+            </table>
+          </div>
+        </div>
+        <input type="hidden" id="model_endpoints_json" />
+      </div>
+    </div>
+    <!-- End GROUP ENDPOINTS TAB -->
+    {% endif %}
+
+    {% if app_settings.enable_retention_policy_group %}
+    <!-- ============= GROUP SETTINGS TAB ============= -->
+    <div
+      class="tab-pane fade"
+      id="group-settings-tab"
+      role="tabpanel"
+      aria-labelledby="group-settings-tab-btn"
+    >
+      <div class="card p-4 my-3">
+        <h5 class="mb-3"><i class="bi bi-hourglass-split me-2"></i>Retention Policy Settings</h5>
+        <p class="text-muted">Configure how long to keep conversations and documents in this group workspace. Items older than the specified period will be automatically deleted.</p>
+        
+        <div class="alert alert-info">
+          <i class="bi bi-info-circle me-2"></i>
+          <strong>Default:</strong> You can use the organization default or set a custom retention period. Choose "No automatic deletion" to keep items indefinitely.
+        </div>
+        
+        <div class="row g-3">
+          <div class="col-md-6">
+            <label for="group-conversation-retention-days" class="form-label">Conversation Retention</label>
+            <select class="form-select" id="group-conversation-retention-days" name="conversation_retention_days">
+              <option value="default">Using organization default</option>
+              <option value="none">No automatic deletion</option>
+              <option value="7">7 days (1 week)</option>
+              <option value="14">14 days (2 weeks)</option>
+              <option value="30">30 days (1 month)</option>
+              <option value="60">60 days (2 months)</option>
+              <option value="90">90 days (3 months)</option>
+              <option value="180">180 days (6 months)</option>
+              <option value="365">365 days (1 year)</option>
+              <option value="730">730 days (2 years)</option>
+              <option value="1095">1095 days (3 years)</option>
+              <option value="3650">3650 days (10 years)</option>
+            </select>
+            <small class="form-text text-muted">Conversations older than this will be automatically deleted.</small>
+          </div>
+          
+          <div class="col-md-6">
+            <label for="group-document-retention-days" class="form-label">Document Retention</label>
+            <select class="form-select" id="group-document-retention-days" name="document_retention_days">
+              <option value="default">Using organization default</option>
+              <option value="none">No automatic deletion</option>
+              <option value="7">7 days (1 week)</option>
+              <option value="14">14 days (2 weeks)</option>
+              <option value="30">30 days (1 month)</option>
+              <option value="60">60 days (2 months)</option>
+              <option value="90">90 days (3 months)</option>
+              <option value="180">180 days (6 months)</option>
+              <option value="365">365 days (1 year)</option>
+              <option value="730">730 days (2 years)</option>
+              <option value="1095">1095 days (3 years)</option>
+              <option value="3650">3650 days (10 years)</option>
+            </select>
+            <small class="form-text text-muted">Documents older than this will be automatically deleted.</small>
+          </div>
+        </div>
+        
+        <div class="mt-3">
+          <button type="button" class="btn btn-primary" onclick="saveGroupRetentionSettings()">
+            <i class="bi bi-save me-1"></i>Save Retention Settings
+          </button>
+          <span id="group-retention-save-status" class="ms-3"></span>
+        </div>
+        
+        <div class="alert alert-warning mt-3 mb-0">
+          <i class="bi bi-exclamation-triangle me-2"></i>
+          <strong>Important:</strong> Deleted conversations will be archived if archiving is enabled. All deletions are logged in activity history.
+        </div>
+      </div>
+    </div>
+    <!-- End GROUP SETTINGS TAB -->
+    {% endif %}
   </div>
   <!-- End Tab Content -->
 </div>
 <!-- End Container -->
 
+{% include '_multiendpoint_modal.html' %}
 <!-- Item View Modal (shared by agents & actions grid/list view buttons) -->
 <div class="modal fade" id="item-view-modal" tabindex="-1" aria-labelledby="item-view-modal-title" aria-hidden="true">
   <div class="modal-dialog modal-lg modal-dialog-scrollable">
@@ -1300,7 +1436,9 @@ <h5 class="modal-title" id="groupTagSelectionModalLabel">Select Tags</h5>
   </div>
 </div>
 
-{% endblock %} {% block scripts %}
+{% endblock %} 
+
+{% block scripts %}
 <!-- SimpleMDE CSS/JS (Keep As Is) -->
 <!-- <script src="https://cdn.jsdelivr.net/npm/simplemde/dist/simplemde.min.js"></script>
  LOCAL VERSION BELOW -->
@@ -1310,6 +1448,14 @@ <h5 class="modal-title" id="groupTagSelectionModalLabel">Select Tags</h5>
 <script src="/static/js/workspace/group-documents-sharing.js"></script>
 <script src="/static/js/workspace_sidebar_nav.js"></script>
 
+<script>
+    window.enableMultiModelEndpoints = {{ 'true' if settings.enable_multi_model_endpoints else 'false' }};
+    window.modelEndpointScope = 'group';
+    window.workspaceModelEndpoints = JSON.parse('{{ group_model_endpoints|default([])|tojson|safe }}' || '[]');
+    window.globalModelEndpoints = JSON.parse('{{ global_model_endpoints|default([])|tojson|safe }}' || '[]');
+</script>
+<script type="module" src="{{ url_for('static', filename='js/workspace/workspace_model_endpoints.js') }}"></script>
+
 <!-- Pass backend flags to JS -->
 <script>
   window.classification_categories = JSON.parse('{{ settings.document_classification_categories|tojson(indent=None)|safe }}' || '[]');
@@ -4934,3 +5080,5 @@ <h5 class="alert-heading">
 {% endif %}
 {% endblock %}
 
+
+
diff --git a/application/single_app/templates/workspace.html b/application/single_app/templates/workspace.html
index 798cff37..2ef8aceb 100644
--- a/application/single_app/templates/workspace.html
+++ b/application/single_app/templates/workspace.html
@@ -7,8 +7,8 @@
    <link rel="stylesheet" href="/static/css/simplemde.min.css" />
 
   <style>
-    /* Force fixed layout so columns don't expand when content changes */
-    #documents-table, #prompts-table, #agents-table { /* Apply to all tables */
+    /* Keep fixed layout for document and prompt tables only. */
+    #documents-table, #prompts-table {
       table-layout: fixed;
       width: 100%;
     }
@@ -93,24 +93,25 @@
     /* --- Agents Table Styles --- */
     #agents-table th:nth-child(1), /* Display Name */
     #agents-table td:nth-child(1) {
-        width: 25%; /* Agent name column */
+      width: 28%;
         overflow: hidden;
         white-space: nowrap;
         text-overflow: ellipsis;
-        min-width: 120px;
+      min-width: 140px;
     }
     #agents-table th:nth-child(2), /* Description */
     #agents-table td:nth-child(2) {
-        width: 55%; /* Description column - largest */
+      width: 47%;
         overflow: hidden;
         white-space: nowrap;
         text-overflow: ellipsis;
-        min-width: 200px;
+      max-width: 0;
     }
     #agents-table th:nth-child(3), /* Actions */
     #agents-table td:nth-child(3) {
-        width: 20%; /* Actions column */
-        min-width: 120px;
+      width: 25%;
+      min-width: 160px;
+      white-space: nowrap;
     }
 
     /* Style for the classification badge */
@@ -333,34 +334,55 @@ <h2>Personal Workspace</h2>
         </button>
       </li>
       {% if settings.per_user_semantic_kernel and settings.enable_semantic_kernel %}
-      <li class="nav-item" role="presentation">
-        <button
-          class="nav-link"
-          id="agents-tab-btn"
-          data-bs-toggle="tab"
-          data-bs-target="#agents-tab"
-          type="button"
-          role="tab"
-          aria-controls="agents-tab"
-          aria-selected="false"
-        >
-          Your Agents
-        </button>
-      </li>
-      <li class="nav-item" role="presentation">
-        <button
-          class="nav-link"
-          id="plugins-tab-btn"
-          data-bs-toggle="tab"
-          data-bs-target="#plugins-tab"
-          type="button"
-          role="tab"
-          aria-controls="plugins-tab"
-          aria-selected="false"
-        >
-          Your Actions
-        </button>
-      </li>
+        {% if settings.allow_user_agents %}
+          <li class="nav-item" role="presentation">
+            <button
+              class="nav-link"
+              id="agents-tab-btn"
+              data-bs-toggle="tab"
+              data-bs-target="#agents-tab"
+              type="button"
+              role="tab"
+              aria-controls="agents-tab"
+              aria-selected="false"
+            >
+              Your Agents
+            </button>
+          </li>
+      
+          {% if settings.allow_user_plugins %}
+            <li class="nav-item" role="presentation">
+              <button
+                class="nav-link"
+                id="plugins-tab-btn"
+                data-bs-toggle="tab"
+                data-bs-target="#plugins-tab"
+                type="button"
+                role="tab"
+                aria-controls="plugins-tab"
+                aria-selected="false"
+              >
+                Your Actions
+              </button>
+            </li>
+          {% endif %}
+        {% endif %}
+      {% endif %}
+      {% if settings.allow_user_custom_endpoints %}
+        <li class="nav-item" role="presentation">
+          <button
+            class="nav-link"
+            id="endpoints-tab-btn"
+            data-bs-toggle="tab"
+            data-bs-target="#endpoints-tab"
+            type="button"
+            role="tab"
+            aria-controls="endpoints-tab"
+            aria-selected="false"
+          >
+            Your Endpoints
+          </button>
+        </li>
       {% endif %}
     </ul>
 
@@ -669,7 +691,6 @@ <h2>Personal Workspace</h2>
         </div> <!-- End Card -->
       </div>
       <!-- End PROMPTS TAB -->
-      {% if settings.per_user_semantic_kernel and settings.enable_semantic_kernel %}
       <!-- ============= AGENTS TAB ============= -->
       <div
         class="tab-pane fade"
@@ -724,7 +745,7 @@ <h2>Personal Workspace</h2>
         {% endif %}
       </div>
       <!-- End AGENTS TAB -->
-      {% endif %}
+      
 
       {% if settings.per_user_semantic_kernel and settings.enable_semantic_kernel %}
       <!-- ============= ACTIONS TAB ============= -->
@@ -764,18 +785,68 @@ <h2>Personal Workspace</h2>
               <div id="plugins-grid-view" class="row g-3 d-none"></div>
             </div>
           </template>
-          </div>
         {% else %}
           <div class="alert alert-warning text-center my-4">
             Custom User Actions are currently disabled. Please ask your admin to enable actions for your workspace.
           </div>
         {% endif %}
+      </div>
+      <!-- End ACTIONS TAB -->
+
+      {% if settings.allow_user_custom_endpoints and settings.enable_multi_model_endpoints %}
+      <!-- ============= ENDPOINTS TAB ============= -->
+      <div
+        class="tab-pane fade"
+        id="endpoints-tab"
+        role="tabpanel"
+        aria-labelledby="endpoints-tab-btn"
+      >
+        <div class="tab-pane-inner">
+          <!-- Workspace Model Endpoints -->
+          <div class="card p-3 my-3" id="workspace-multi-endpoint-configuration">
+            <h6 class="mb-2"><i class="bi bi-hdd-network me-2"></i>Workspace Model Endpoints</h6>
+            <p class="text-muted small mb-2">Manage personal model endpoints used by your workspace agents. Global endpoints are managed by admins.</p>
+            <div class="form-check form-switch mb-3 d-flex align-items-center">
+              <input type="checkbox" class="form-check-input me-2" id="enable_multi_model_endpoints" name="enable_multi_model_endpoints" {% if settings.enable_multi_model_endpoints %}checked{% endif %} disabled />
+              <label class="form-check-label" for="enable_multi_model_endpoints">Multi-endpoint management is controlled by your admin</label>
+            </div>
+            <div id="model-endpoints-wrapper" class="{% if not settings.enable_multi_model_endpoints %}d-none{% endif %}">
+              <div class="d-flex justify-content-between align-items-center mb-2">
+                <h6 class="mb-0">Your Endpoints</h6>
+                <button type="button" class="btn btn-sm btn-outline-primary" id="add-model-endpoint-btn">
+                  <i class="bi bi-plus-circle me-1"></i>Add Endpoint
+                </button>
+              </div>
+              <div class="table-responsive">
+                <table class="table table-sm table-bordered">
+                  <thead>
+                    <tr>
+                      <th>Name</th>
+                      <th>Provider</th>
+                      <th>Selected Models</th>
+                      <th>Status</th>
+                      <th>Actions</th>
+                    </tr>
+                  </thead>
+                  <tbody id="model-endpoints-tbody">
+                    <!-- Populated by JS -->
+                  </tbody>
+                </table>
+              </div>
+            </div>
+            <input type="hidden" id="model_endpoints_json" />
+          </div>
+        </div>
+      </div>
+      <!-- End ENDPOINTS TAB -->
+      {% endif %}
       {% endif %}
     </div>
     <!-- End Tab Content -->
   </div>
   <!--</div>-->
 
+  {% include '_multiendpoint_modal.html' %}
   <!-- Shared Item View Modal (read-only details for agents/actions) -->
   <div class="modal fade" id="item-view-modal" tabindex="-1" aria-labelledby="item-view-modal-label" aria-hidden="true">
     <div class="modal-dialog modal-lg modal-dialog-scrollable">
@@ -1293,6 +1364,13 @@ <h5 class="modal-title" id="approveSharedModalLabel">Approve Shared Document</h5
     <script type="module" src="/static/js/workspace/workspace_agents.js"></script>
     <script type="module" src="/static/js/workspace/workspace_plugins.js"></script>
   {% endif %}
+  <script>
+    window.enableMultiModelEndpoints = {{ 'true' if settings.enable_multi_model_endpoints else 'false' }};
+    window.modelEndpointScope = 'user';
+    window.workspaceModelEndpoints = JSON.parse('{{ personal_model_endpoints|default([])|tojson|safe }}' || '[]');
+    window.globalModelEndpoints = JSON.parse('{{ global_model_endpoints|default([])|tojson|safe }}' || '[]');
+  </script>
+  <script type="module" src="{{ url_for('static', filename='js/workspace/workspace_model_endpoints.js') }}"></script>
   <!-- <script src="https://cdn.jsdelivr.net/npm/simplemde/dist/simplemde.min.js"></script>
    LOCAL VERSION BELOW -->
    <script src="/static/js/simplemde/simplemde.min.js"></script>
diff --git a/application/single_app/utils_cache.py b/application/single_app/utils_cache.py
index 679d8334..2d474cd1 100644
--- a/application/single_app/utils_cache.py
+++ b/application/single_app/utils_cache.py
@@ -439,7 +439,7 @@ def get_cached_search_results(
             logger.debug(f"Cache expired for key: {cache_key}")
             try:
                 cosmos_search_cache_container.delete_item(item=cache_key, partition_key=partition_key)
-            except:
+            except Exception as ex:
                 pass  # Already deleted by TTL or doesn't exist
             
     except CosmosResourceNotFoundError:
@@ -807,7 +807,7 @@ def get_cache_stats() -> Dict[str, Any]:
                 enable_cross_partition_query=True
             ))
             expired_count = result_expired[0] if result_expired else 0
-        except:
+        except Exception as ex:
             expired_count = 0  # Ignore errors in counting expired
         
         return {
diff --git a/docs/explanation/features/ADMIN_ACTIVITY_LOGGING.md b/docs/explanation/features/ADMIN_ACTIVITY_LOGGING.md
new file mode 100644
index 00000000..75db02dd
--- /dev/null
+++ b/docs/explanation/features/ADMIN_ACTIVITY_LOGGING.md
@@ -0,0 +1,41 @@
+# Admin Activity Logging (v0.236.017)
+
+## Overview and Purpose
+This feature adds a general-purpose activity log entry for admin actions so operational changes show up in the activity timeline.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.017**
+
+## Dependencies
+- Activity logs Cosmos container
+- Application Insights for telemetry
+
+## Technical Specifications
+### Architecture Overview
+- A helper function constructs a standardized activity record and writes it to the activity logs container.
+- Records include admin identity fields and a description for display in the UI timeline.
+
+### Configuration Options
+- None
+
+### File Structure
+- Logging helper: application/single_app/functions_activity_logging.py
+- Functional test: functional_tests/test_admin_action_activity_log.py
+
+## Usage Instructions
+### How to Log
+Call `log_general_admin_action()` with the admin user ID, admin email, and action string.
+Optionally pass a human-readable description and additional context.
+
+### Example
+- Action: "settings_updated"
+- Description: "Admin updated AI model settings"
+
+## Testing and Validation
+- Functional test: functional_tests/test_admin_action_activity_log.py
+
+## Known Limitations
+- Caller is responsible for invoking the helper when admin actions occur.
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.017**.
diff --git a/docs/explanation/features/CONTROL_CENTER_TOKEN_FILTERS.md b/docs/explanation/features/CONTROL_CENTER_TOKEN_FILTERS.md
new file mode 100644
index 00000000..85d3e803
--- /dev/null
+++ b/docs/explanation/features/CONTROL_CENTER_TOKEN_FILTERS.md
@@ -0,0 +1,54 @@
+# Control Center Token Filters
+
+Implemented in version: **0.239.164**
+
+## Overview and Purpose
+
+The Control Center dashboard now supports token-specific filtering so admins and control center users can explore token usage by the dimensions already captured in `token_usage` activity logs. This improves token analysis without requiring a separate analytics store.
+
+## Dependencies
+
+- `application/single_app/route_backend_control_center.py`
+- `application/single_app/templates/control_center.html`
+- `application/single_app/static/js/control-center.js`
+- `application/single_app/functions_activity_logging.py`
+- Cosmos `activity_logs` container token usage documents
+
+## Technical Specifications
+
+### Architecture Overview
+
+The token chart continues to use `token_usage` entries from the activity log container. The backend now parses optional token filters, applies them only to the token query path, and reuses the same filter payload for chart data, CSV export, and chat-export flows.
+
+### Supported Filters
+
+- User
+- Workspace type
+- Group
+- Public workspace
+- Model deployment name
+- Token type
+
+### File Structure
+
+- `route_backend_control_center.py`: token filter parsing, query helpers, token filter options endpoint, filtered export support
+- `control_center.html`: token filter controls added above the token chart
+- `control-center.js`: token filter state, filter option loading, request forwarding, and reset/apply behavior
+
+## Usage Instructions
+
+1. Open the Control Center dashboard.
+2. In the Token Usage card, choose one or more token filters.
+3. Click Apply to refresh the token chart with the selected scope.
+4. Use Reset to return to the unfiltered token view.
+5. Export activity trends to keep token CSV output aligned with the selected token filters.
+
+## Testing and Validation
+
+- Functional regression: `functional_tests/test_control_center_token_filters.py`
+- UI regression: `ui_tests/test_control_center_token_filters.py`
+
+## Known Limitations
+
+- Endpoint-level token filtering is not included in this version because endpoint metadata is not yet persisted in `token_usage` activity log records.
+- Token filters apply to the token chart and token export data only; the other dashboard charts remain global for the selected time range.
\ No newline at end of file
diff --git a/docs/explanation/features/DUAL_FOUNDRY_AGENT_SUPPORT.md b/docs/explanation/features/DUAL_FOUNDRY_AGENT_SUPPORT.md
new file mode 100644
index 00000000..c5a1b7b2
--- /dev/null
+++ b/docs/explanation/features/DUAL_FOUNDRY_AGENT_SUPPORT.md
@@ -0,0 +1,115 @@
+# Dual Foundry Agent Support
+
+Version implemented: 0.239.154
+Dependencies: Azure AI Foundry project endpoints, agent modal stepper, scoped agent CRUD routes, Semantic Kernel loader, Foundry runtime helpers
+
+Fixed/Implemented in version: **0.239.154**
+
+## Overview
+
+SimpleChat now supports both Foundry experiences at the same time instead of forcing a migration path.
+
+- `aifoundry` remains the persisted classic Foundry agent type and is displayed in the UI as `Foundry (classic)`.
+- `new_foundry` is a new persisted agent type for the application-based Foundry experience.
+- The agent modal, schema validation, backend payload sanitizer, loader, and chat runtime now recognize both modes side by side.
+
+This change is intentionally additive. Existing classic Foundry agents continue to work without migration.
+
+## Technical Specifications
+
+### Architecture overview
+
+The implementation separates the two Foundry paths instead of trying to coerce them into one shared runtime contract.
+
+- Classic Foundry continues to use the existing SDK-backed agent invocation flow.
+- New Foundry uses a separate runtime path that calls the application Responses endpoint directly.
+- The loader instantiates different agent wrappers based on `agent_type`.
+- The modal stepper renders separate configuration fields for classic and new Foundry while preserving the local agent flow.
+
+### Backend and runtime changes
+
+Files modified:
+- `application/single_app/functions_agent_payload.py`
+- `application/single_app/static/json/schemas/agent.schema.json`
+- `application/single_app/foundry_agent_runtime.py`
+- `application/single_app/semantic_kernel_loader.py`
+- `application/single_app/route_backend_chats.py`
+- `application/single_app/route_backend_models.py`
+- `application/single_app/route_backend_agents.py`
+- `application/single_app/functions_settings.py`
+- `application/single_app/functions_global_agents.py`
+
+Key behaviors:
+- `sanitize_agent_payload()` now accepts `local`, `aifoundry`, and `new_foundry`.
+- Classic Foundry still uses `other_settings.azure_ai_foundry`.
+- New Foundry uses `other_settings.new_foundry` with application-centric fields such as `application_id`, `application_name`, `application_version`, and `responses_api_version`.
+- `route_backend_chats.py` dispatches both Foundry types through Foundry-style invocation instead of falling back to local handling.
+- `foundry_agent_runtime.py` adds a dedicated new Foundry runtime that calls `/applications/{application}/protocols/openai/responses`.
+
+### Frontend changes
+
+Files modified:
+- `application/single_app/templates/_agent_modal.html`
+- `application/single_app/templates/_multiendpoint_modal.html`
+- `application/single_app/static/js/agent_modal_stepper.js`
+- `application/single_app/static/js/agents_common.js`
+- `application/single_app/static/js/admin/admin_model_endpoints.js`
+- `application/single_app/static/js/workspace/workspace_model_endpoints.js`
+- `application/single_app/static/js/workspace/view-utils.js`
+
+Key behaviors:
+- The agent modal now exposes `Local`, `Foundry (classic)`, and `New Foundry`.
+- Classic Foundry keeps the endpoint fetch-and-select flow for existing Foundry agents.
+- New Foundry exposes application reference fields and Responses API version fields.
+- New Foundry now supports fetching project agents/applications to populate the application identifier fields.
+- Endpoint management now includes a `new_foundry` provider option.
+
+## Usage Instructions
+
+### How to configure classic Foundry
+
+1. Open the agent modal.
+2. Select `Foundry (classic)`.
+3. Choose a configured Foundry endpoint.
+4. Fetch and select a classic Foundry agent.
+5. Save the agent.
+
+### How to configure new Foundry
+
+1. Open the agent modal.
+2. Select `New Foundry`.
+3. Choose or enter the Foundry project endpoint and project name.
+4. Enter the application identifier from the new Foundry portal.
+5. Enter the Responses API version.
+6. Save the agent.
+
+### Scope support
+
+Both classic and new Foundry agent types are supported in all three scopes:
+- Personal agents
+- Group agents
+- Global agents
+
+## Testing and Validation
+
+Functional coverage:
+- `functional_tests/test_dual_foundry_agent_support.py`
+
+UI coverage:
+- `ui_tests/test_agent_modal_dual_foundry_modes.py`
+
+Validation focus:
+- Classic Foundry payloads remain valid.
+- New Foundry payloads validate through the schema and sanitizer.
+- Runtime and loader files contain explicit support for `new_foundry`.
+- The modal exposes both Foundry modes and type-specific fields.
+
+## Known Limitations
+
+- Phase 1 does not add activity protocol polling yet.
+- Phase 1 expects existing new Foundry portal applications to already exist.
+- The dedicated web search Foundry configuration remains on the classic Foundry path.
+
+## Related Config Version Update
+
+The application version in `application/single_app/config.py` was incremented to `0.239.154` as part of this feature.
diff --git a/docs/explanation/features/LOGGED_CORE_SEMANTIC_KERNEL_PLUGINS.md b/docs/explanation/features/LOGGED_CORE_SEMANTIC_KERNEL_PLUGINS.md
new file mode 100644
index 00000000..5549cd7b
--- /dev/null
+++ b/docs/explanation/features/LOGGED_CORE_SEMANTIC_KERNEL_PLUGINS.md
@@ -0,0 +1,71 @@
+# Logged Core Semantic Kernel Plugins
+
+Version implemented: 0.239.153
+Implemented in version: **0.239.153**
+
+## Overview and Purpose
+
+This feature moves SimpleChat's built-in Semantic Kernel core plugins onto local subclasses that emit plugin invocation logs through the existing plugin invocation logger. The change covers the Time, Wait, Math, and Text plugins and ensures that core-plugin invocations can now surface as thought records, not just custom plugin calls.
+
+## Dependencies
+
+- `semantic_kernel_plugins.plugin_invocation_logger`
+- `semantic_kernel_plugins.plugin_invocation_thoughts`
+- `semantic_kernel_loader.py`
+- `route_backend_chats.py`
+- Semantic Kernel upstream core plugins from the `semantic-kernel` repository
+
+## Technical Specifications
+
+### Architecture Overview
+
+SimpleChat now owns thin subclasses for the upstream Semantic Kernel `TimePlugin`, `WaitPlugin`, `MathPlugin`, and `TextPlugin`. Each subclass lives in `application/single_app/semantic_kernel_plugins/` and calls the shared `auto_wrap_plugin_functions()` helper during initialization so inherited kernel functions receive the same invocation logging behavior as custom SimpleChat plugins.
+
+### Configuration and Loader Flow
+
+`semantic_kernel_loader.py` now imports the local SimpleChat versions of the Time and Wait plugins and continues to use the local Math and Text plugin modules. This means all existing loader paths that call `load_time_plugin()`, `load_wait_plugin()`, `load_math_plugin()`, and `load_text_plugin()` now register the logged subclasses automatically.
+
+### Thought Integration
+
+Thought formatting and callback registration were extracted into `semantic_kernel_plugins/plugin_invocation_thoughts.py`. The chat route reuses that helper in non-streaming agent execution, streaming agent execution, and the kernel-only Semantic Kernel fallback path so logged core-plugin invocations can generate `agent_tool_call` thoughts consistently. The formatter now emits user-readable summaries for wait and math operations, a parameter-aware fallback summary for other plugin calls, and an explicit `Invoking Plugin.Function` thought at the start of tool execution.
+
+### File Structure
+
+- `application/single_app/semantic_kernel_plugins/time_plugin.py`
+- `application/single_app/semantic_kernel_plugins/wait_plugin.py`
+- `application/single_app/semantic_kernel_plugins/math_plugin.py`
+- `application/single_app/semantic_kernel_plugins/text_plugin.py`
+- `application/single_app/semantic_kernel_plugins/plugin_invocation_logger.py`
+- `application/single_app/semantic_kernel_plugins/plugin_invocation_thoughts.py`
+- `application/single_app/semantic_kernel_plugins/logged_plugin_loader.py`
+- `application/single_app/semantic_kernel_loader.py`
+- `application/single_app/route_backend_chats.py`
+
+## Usage Instructions
+
+No additional configuration is required beyond the existing plugin enablement flags. When the Time, Wait, Math, or Text plugins are enabled in settings, the loader now registers the logged SimpleChat subclasses automatically.
+
+For runtime behavior:
+
+- Plugin invocations are recorded through the shared plugin invocation logger.
+- Agent and kernel-only chat paths can register thought callbacks using `register_plugin_invocation_thought_callback()`.
+- Thought content now includes human-readable operation summaries when possible, such as wait duration and math expressions/results, plus generic parameter summaries for other plugins.
+- Streaming chat now polls pending thoughts while a response is still in flight so long-running tool calls can replace the active status badge before any content tokens are returned.
+- Existing citation extraction still reads from the same invocation logger history.
+
+## Testing and Validation
+
+Functional coverage was added in `functional_tests/test_logged_core_plugins.py`.
+
+The test validates:
+
+- Inherited upstream methods are logged after auto-wrapping.
+- SimpleChat-specific Math extensions remain available and logged.
+- Async logging still works for the Wait plugin.
+- Invocation callbacks can be transformed into thought records for both success and failure cases.
+- Human-readable thought formatting includes meaningful wait, math, and generic plugin execution summaries.
+
+## Known Limitations
+
+- The standard upstream `HttpPlugin` fallback is not part of this first pass because SimpleChat already prefers `SmartHttpPlugin`.
+- Prompt-based core plugins such as conversation summarization were intentionally left out to keep the change focused on native function plugins.
\ No newline at end of file
diff --git a/docs/explanation/features/MODEL_ENDPOINT_API_KEY_MANUAL_MODELS.md b/docs/explanation/features/MODEL_ENDPOINT_API_KEY_MANUAL_MODELS.md
new file mode 100644
index 00000000..70992095
--- /dev/null
+++ b/docs/explanation/features/MODEL_ENDPOINT_API_KEY_MANUAL_MODELS.md
@@ -0,0 +1,50 @@
+# Model Endpoint API Key Manual Models (v0.236.019)
+
+## Overview and Purpose
+Adds manual model entry for API key-authenticated endpoints, with per-model connection tests and guidance to prefer identity-based discovery.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.019**
+
+## Dependencies
+- Admin model endpoint modal
+- Backend model test endpoint
+- Azure OpenAI / Foundry inference clients
+
+## Technical Specifications
+### Architecture Overview
+- API key endpoints skip discovery and allow manual model entries.
+- Each model row supports per-model connection testing.
+- Service principal auth includes management cloud and custom authority inputs.
+
+### API Endpoints
+- `/api/models/test-model` — tests a specific model deployment using the endpoint settings.
+
+### Configuration Options
+- `auth.management_cloud` — Public, Government, or Custom authority.
+- `auth.custom_authority` — custom authority URL for service principal auth.
+
+### File Structure
+- Modal UI: application/single_app/templates/admin_settings.html
+- Modal logic: application/single_app/static/js/admin/admin_model_endpoints.js
+- Backend test endpoint: application/single_app/route_backend_models.py
+
+## Usage Instructions
+### API Key Flow
+1. Choose Authentication Type: API Key.
+2. Use Add Model to enter deployment name, display name, and description.
+3. Use the per-model Test Connection button to verify access.
+
+### Service Principal Flow
+1. Choose Authentication Type: Service Principal.
+2. Select Management Cloud (Public/Government/Custom).
+3. For Custom, enter the authority URL.
+
+## Testing and Validation
+- Functional test: functional_tests/test_model_endpoints_api_key_manual_models.py
+
+## Known Limitations
+- API key auth supports inference only; discovery requires identity-based auth.
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.019**.
diff --git a/docs/explanation/features/MSGRAPH_PLUGIN_OPERATIONS.md b/docs/explanation/features/MSGRAPH_PLUGIN_OPERATIONS.md
new file mode 100644
index 00000000..271f0078
--- /dev/null
+++ b/docs/explanation/features/MSGRAPH_PLUGIN_OPERATIONS.md
@@ -0,0 +1,64 @@
+# Microsoft Graph Plugin Operations
+
+Implemented in version: **0.239.171**
+
+## Overview and Purpose
+
+The Microsoft Graph plugin now provides a stronger foundation for Graph-backed agent operations and adds practical read-focused capabilities for profile, calendar, mail, directory, and OneDrive access. The goal is to make the plugin more useful for day-to-day assistant workflows while handling consent and Graph list responses more safely.
+
+## Dependencies
+
+- `application/single_app/semantic_kernel_plugins/msgraph_plugin.py`
+- `application/single_app/functions_authentication.py`
+- `application/single_app/semantic_kernel_plugins/base_plugin.py`
+- `application/single_app/semantic_kernel_plugins/plugin_invocation_logger.py`
+- Microsoft Graph delegated permissions for the enabled operations
+
+## Technical Specifications
+
+### Architecture Overview
+
+The plugin now routes Graph calls through a shared request helper that:
+
+- acquires access tokens through the plugin-aware authentication helper
+- supports scoped overrides from the plugin manifest
+- builds common OData parameters consistently
+- handles pagination for Graph list responses
+- returns structured error payloads for consent, throttling, and HTTP failures
+
+### Operations Added or Enhanced
+
+- `get_my_profile`
+- `get_my_events`
+- `get_my_messages`
+- `search_users`
+- `get_user_by_email`
+- `list_drive_items`
+- `get_my_security_alerts`
+
+### File Structure
+
+- `msgraph_plugin.py`: Graph request helper, token handling, OData support, and operation methods
+- `functions_authentication.py`: delegated token acquisition and consent flow support
+
+## Usage Instructions
+
+1. Register the plugin with a Graph endpoint manifest.
+2. Ensure delegated Microsoft Graph permissions are granted for the desired operations.
+3. Use read operations first to confirm token scope coverage.
+4. If consent is required, surface the returned consent URL to the user and retry after consent is granted.
+
+## Testing and Validation
+
+- Functional regression: `functional_tests/test_msgraph_plugin_operations.py`
+
+## Performance Considerations
+
+- Graph list results are capped per request to avoid oversized agent payloads.
+- Pagination is followed only up to a bounded number of pages.
+- OData field selection should be used to reduce response size whenever possible.
+
+## Known Limitations
+
+- The plugin currently focuses on read-heavy operations and does not yet add write operations such as sending mail or creating events.
+- Security alert access still requires elevated delegated permissions and may not be appropriate for all tenants.
\ No newline at end of file
diff --git a/docs/explanation/features/NEW_FOUNDRY_REST_STREAMING.md b/docs/explanation/features/NEW_FOUNDRY_REST_STREAMING.md
new file mode 100644
index 00000000..24fee1eb
--- /dev/null
+++ b/docs/explanation/features/NEW_FOUNDRY_REST_STREAMING.md
@@ -0,0 +1,69 @@
+# NEW_FOUNDRY_REST_STREAMING.md
+
+# New Foundry REST Streaming
+
+## Overview
+
+Version implemented: **0.239.175**
+
+This change adds REST-based streaming support for New Foundry application agents while preserving the existing Semantic Kernel-based path for classic Azure AI Foundry agents.
+
+The goal is to let the app connect to classic and new Foundry simultaneously without taking a runtime dependency on Microsoft Agent Framework or forcing the whole app onto a newer `azure-ai-projects` version that conflicts with Semantic Kernel.
+
+## Dependencies
+
+- Semantic Kernel for classic Foundry agent execution
+- Azure Identity credentials for both classic and new Foundry authentication
+- Direct REST calls to the New Foundry Responses and project agent-list endpoints
+- Existing chat SSE pipeline in the app
+
+## Technical Specification
+
+### Architecture
+
+- Classic Foundry remains on the existing Semantic Kernel + `azure-ai-projects` 1.x path.
+- New Foundry uses app-local REST transport in `application/single_app/foundry_agent_runtime.py`.
+- New Foundry discovery uses the project `/agents` REST endpoint instead of SDK-only discovery.
+- The streaming route in `application/single_app/route_backend_chats.py` now forwards agent deltas as they are produced instead of buffering all chunks first.
+
+### Files Updated
+
+- `application/single_app/foundry_agent_runtime.py`
+- `application/single_app/route_backend_chats.py`
+- `application/single_app/route_backend_models.py`
+- `functional_tests/test_new_foundry_fetch_support.py`
+- `functional_tests/test_new_foundry_streaming_runtime.py`
+
+### Runtime Behavior
+
+- New Foundry application requests use the Responses protocol endpoint with `stream=true` for live streaming.
+- SSE events are parsed server-side and token deltas are forwarded through the app's `/api/chat/stream` endpoint.
+- Final model metadata and citations are still attached to the persisted assistant message when the stream completes.
+
+## Usage
+
+### Configuration
+
+Configure classic and new Foundry endpoints side by side through the existing model endpoint configuration.
+
+- Use provider `aifoundry` for classic Foundry agents.
+- Use provider `new_foundry` for New Foundry applications.
+
+### User Workflow
+
+1. Select a classic or new Foundry-backed agent.
+2. Send a chat message through the normal chat UI.
+3. If the selected agent is New Foundry, the app streams token deltas through `/api/chat/stream`.
+4. On completion, the final assistant message includes the full content, model metadata, and any citations captured from the runtime.
+
+## Testing And Validation
+
+- Functional coverage verifies New Foundry fetch support remains available.
+- Functional coverage verifies the runtime exposes a REST streaming executor and that the stream route consumes agent chunks incrementally.
+- Existing classic Foundry and general stream-route behavior remain on their previous code paths.
+
+## Known Limitations
+
+- Classic Foundry still depends on the existing Semantic Kernel integration and its current Azure SDK boundary.
+- `chat_api` still exists for compatibility scenarios outside the initial New Foundry stream path migration.
+- Real-time citation SSE events are not expanded in this phase; citations are still finalized when the response completes.
\ No newline at end of file
diff --git a/docs/explanation/features/WORKSPACE_MULTI_ENDPOINTS.md b/docs/explanation/features/WORKSPACE_MULTI_ENDPOINTS.md
new file mode 100644
index 00000000..06d816df
--- /dev/null
+++ b/docs/explanation/features/WORKSPACE_MULTI_ENDPOINTS.md
@@ -0,0 +1,65 @@
+# WORKSPACE MULTI ENDPOINTS (Version 0.236.045)
+
+## Overview
+Workspace multi-endpoint management extends the admin multi-endpoint system to personal and group workspaces. Users can configure workspace endpoints that live alongside global endpoints, and agent model selection is driven by these combined lists.
+
+**Implemented in version: 0.236.045**
+
+## Dependencies
+- Global model endpoints configured in admin settings
+- Workspace endpoint storage in user settings and group documents
+- Agent modal updates for multi-endpoint and Foundry agent discovery
+
+## Technical Specifications
+### Architecture Overview
+- Global endpoints remain in application settings.
+- Personal endpoints are stored in user settings under `personal_model_endpoints`.
+- Group endpoints are stored on group documents under `model_endpoints`.
+- Agent modal requests a combined, sanitized endpoint list for model selection.
+- Foundry agent lookup uses endpoint IDs to resolve authentication and list agents.
+
+### API Endpoints
+- `GET /api/user/model-endpoints` / `POST /api/user/model-endpoints`
+- `GET /api/group/model-endpoints` / `POST /api/group/model-endpoints`
+- `GET /api/user/agent/settings`
+- `GET /api/group/agent/settings`
+- `POST /api/models/foundry/agents`
+- `POST /api/user/models/fetch` / `POST /api/user/models/test-model`
+- `POST /api/group/models/fetch` / `POST /api/group/models/test-model`
+
+### Configuration
+- Global toggle: `enable_multi_model_endpoints` in [application/single_app/config.py](application/single_app/config.py)
+- Workspace endpoints stored per user and per group
+
+### File Structure
+- Frontend templates: [application/single_app/templates/workspace.html](application/single_app/templates/workspace.html), [application/single_app/templates/group_workspaces.html](application/single_app/templates/group_workspaces.html), [application/single_app/templates/_agent_modal.html](application/single_app/templates/_agent_modal.html)
+- Frontend logic: [application/single_app/static/js/workspace/workspace_model_endpoints.js](application/single_app/static/js/workspace/workspace_model_endpoints.js), [application/single_app/static/js/agent_modal_stepper.js](application/single_app/static/js/agent_modal_stepper.js)
+- Backend: [application/single_app/route_backend_models.py](application/single_app/route_backend_models.py), [application/single_app/route_backend_agents.py](application/single_app/route_backend_agents.py), [application/single_app/semantic_kernel_loader.py](application/single_app/semantic_kernel_loader.py)
+
+## Usage Instructions
+### Enable/Configure
+1. Admin enables multi-endpoint model management in admin settings.
+2. Users open Personal Workspace or Group Workspace and add endpoints under the new Workspace/Group Model Endpoints card.
+3. In the agent modal, select a model from the combined endpoint list.
+
+### Foundry Agent Import
+1. Select an Azure AI Foundry endpoint in the Foundry section of the agent modal.
+2. Click **Fetch Agents** to list available agents.
+3. Select an agent to import its identity, then save.
+
+### User Workflows
+- Personal agents can select models from global + personal endpoints.
+- Group agents can select models from global + group endpoints.
+- Foundry agents auto-populate identities from the selected Foundry endpoint.
+
+## Testing and Validation
+- Functional test: [functional_tests/test_workspace_multi_endpoints.py](functional_tests/test_workspace_multi_endpoints.py)
+- Manual validation:
+  - Add workspace endpoints and ensure they appear in agent model dropdowns.
+  - Verify Foundry agent list import using configured endpoints.
+
+## Performance Considerations
+- Model discovery uses on-demand API calls to Azure/Foundry endpoints.
+
+## Known Limitations
+- Workspace endpoints require configured credentials; only stored secrets are used for runtime resolution.
diff --git a/docs/explanation/features/v0.229.001/COMPREHENSIVE_UI_PERFORMANCE_ENHANCEMENTS.md b/docs/explanation/features/v0.229.001/COMPREHENSIVE_UI_PERFORMANCE_ENHANCEMENTS.md
index 79f5002c..ce04b507 100644
--- a/docs/explanation/features/v0.229.001/COMPREHENSIVE_UI_PERFORMANCE_ENHANCEMENTS.md
+++ b/docs/explanation/features/v0.229.001/COMPREHENSIVE_UI_PERFORMANCE_ENHANCEMENTS.md
@@ -910,7 +910,7 @@ class CitationGenerator:
                 from datetime import datetime
                 date_obj = datetime.fromisoformat(creation_date.replace('Z', '+00:00'))
                 citation_parts.append(f"({date_obj.year})")
-            except:
+            except Exception as ex:
                 pass
         
         citation_parts.append(f"Retrieved from {url}")
diff --git a/docs/explanation/fixes/AGENT_DROPDOWN_SCOPE_BY_CONVERSATION_METADATA_FIX.md b/docs/explanation/fixes/AGENT_DROPDOWN_SCOPE_BY_CONVERSATION_METADATA_FIX.md
new file mode 100644
index 00000000..10753fec
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_DROPDOWN_SCOPE_BY_CONVERSATION_METADATA_FIX.md
@@ -0,0 +1,34 @@
+# Agent Dropdown Scope by Conversation Metadata Fix (0.236.063)
+
+## Issue Description
+Personal agents were hidden in chat even when the current conversation was personal. Filtering relied on global group state rather than the active conversation scope, so group context suppressed personal agents.
+
+## Root Cause Analysis
+The agent dropdown used `activeGroupId` to decide scope. The chat page always renders an active group ID, so personal conversations were mistakenly treated as group scope. The UI already stores the conversation scope in `data-chat-type`, but the dropdown ignored it.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.063**
+
+## Technical Details
+- **Files modified**:
+  - application/single_app/static/js/chat/chat-agents.js
+  - application/single_app/static/js/chat/chat-retry.js
+  - application/single_app/config.py
+- **Change summary**:
+  - Scope is derived from the active conversation's `data-chat-type`.
+  - New conversations with no metadata show all agents.
+  - Group scope shows group + global agents only; other scopes show personal + global.
+
+## Testing Approach
+- Added functional test: functional_tests/test_agent_dropdown_scope_by_conversation_metadata.py
+- Test validates the metadata-based scope logic is present in both chat dropdown scripts.
+
+## Impact Analysis
+- Personal agents are visible in personal conversations.
+- Group agents are shown only in group conversations.
+- New conversations default to showing all agents.
+
+## Validation
+- Start a new chat: personal + group + global agents appear.
+- Open a group chat: only group + global agents appear.
+- Open a personal chat: only personal + global agents appear.
diff --git a/docs/explanation/fixes/AGENT_GPT_INIT_MULTIENDPOINT_GATING_FIX.md b/docs/explanation/fixes/AGENT_GPT_INIT_MULTIENDPOINT_GATING_FIX.md
new file mode 100644
index 00000000..99f454d3
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_GPT_INIT_MULTIENDPOINT_GATING_FIX.md
@@ -0,0 +1,31 @@
+# Agent GPT Init Multi-Endpoint Gating Fix (Version 0.236.052)
+
+## Overview
+Ensures multi-endpoint GPT resolution is skipped for agent-based requests and avoids APIM initialization failures when no model deployment is provided.
+
+## Issue Description
+Agent chat requests include `agent_info` but no `model_id` or `model_deployment`. With APIM enabled and multiple deployments configured, GPT initialization failed before agent invocation, blocking the request.
+
+## Root Cause Analysis
+`resolve_multi_endpoint_gpt_config` runs early in chat initialization, and APIM requires `model_deployment` when multiple deployments are configured. Agent requests do not send these fields, causing premature failures.
+
+## Fix Summary
+- Skip multi-endpoint GPT resolution when `agent_info` is present.
+- Default to the first APIM deployment for agent requests without `model_deployment`.
+
+## Files Modified
+- application/single_app/route_backend_chats.py
+- application/single_app/config.py
+- functional_tests/test_agent_gpt_init_skips_multiendpoint.py
+
+## Testing
+- Added functional test: `test_agent_gpt_init_skips_multiendpoint.py`.
+
+## Validation
+- Verified GPT init gating logs and APIM defaulting behavior for agent requests.
+
+## Version
+Fixed/Implemented in version: **0.236.052**
+
+## Config Version Reference
+`config.py` updated to `VERSION = "0.236.052"`.
diff --git a/docs/explanation/fixes/AGENT_MODAL_MODEL_ENDPOINT_FILTERING_FIX.md b/docs/explanation/fixes/AGENT_MODAL_MODEL_ENDPOINT_FILTERING_FIX.md
new file mode 100644
index 00000000..8e57cff3
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_MODAL_MODEL_ENDPOINT_FILTERING_FIX.md
@@ -0,0 +1,30 @@
+# Agent Modal Model Endpoint Filtering Fix (Version 0.236.056)
+
+## Issue Description
+Local agent modals did not show non-Azure OpenAI endpoints when selecting a model. This made Azure AI Foundry models unavailable in the modal even when multi-endpoint settings returned them.
+
+## Root Cause Analysis
+The agent modal dropdown filtered model endpoints by provider, allowing only Azure OpenAI providers for local agents. Foundry endpoints were excluded even when provided by the settings API.
+
+## Fix Summary
+- Allow local agents to include non-AOAI providers in the modal dropdown.
+- Normalize model identifiers and display labels so entries without explicit IDs still render.
+
+## Technical Details
+- Files modified:
+  - application/single_app/static/js/agents_common.js
+  - application/single_app/config.py
+- Updated provider filtering logic to only restrict when the agent type is explicitly `aifoundry`.
+- Added model ID and display name normalization to improve dropdown resilience.
+
+## Testing
+- Functional test: functional_tests/test_agent_modal_model_endpoint_filtering.py
+
+## Impact Analysis
+- Local agent modals now list Foundry endpoints wherever the modal is used (admin, user, group).
+- Existing AOAI behavior is unchanged.
+
+## Fixed/Implemented in version: **0.236.056**
+
+## Config Version Update
+- Updated VERSION in application/single_app/config.py to 0.236.056.
diff --git a/docs/explanation/fixes/AGENT_MODAL_MULTIENDPOINT_FOUNDARY_NOTICE_FIX.md b/docs/explanation/fixes/AGENT_MODAL_MULTIENDPOINT_FOUNDARY_NOTICE_FIX.md
new file mode 100644
index 00000000..ec9a7c8c
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_MODAL_MULTIENDPOINT_FOUNDARY_NOTICE_FIX.md
@@ -0,0 +1,33 @@
+# Agent Modal Multi-Endpoint & Foundry Notice Fix (Version 0.236.054)
+
+## Overview
+Hides custom connection controls in the agent modal when multi-endpoint model management is enabled and adds an advanced settings notice for Azure AI Foundry agents.
+
+## Issue Description
+When multi-endpoint model management is enabled, custom connection fields should not be available in the agent modal. Additionally, Azure AI Foundry agents need a clear notice that advanced settings are managed by Foundry.
+
+## Root Cause Analysis
+The agent modal always rendered custom connection controls and lacked a Foundry-specific advanced settings notice.
+
+## Fix Summary
+- Hide custom connection toggle and fields via Jinja when multi-endpoint model management is enabled.
+- Add an advanced settings notice for Foundry agents and toggle visibility in the modal stepper.
+
+## Files Modified
+- application/single_app/templates/_agent_modal.html
+- application/single_app/static/js/agent_modal_stepper.js
+- application/single_app/config.py
+- functional_tests/test_agent_modal_multiendpoint_foundry_advanced_notice.py
+
+## Testing
+- Added functional test: `test_agent_modal_multiendpoint_foundry_advanced_notice.py`.
+
+## Validation
+- Verified the custom connection fields are gated by the multi-endpoint setting.
+- Verified the Foundry advanced notice is toggled when selecting Foundry agent type.
+
+## Version
+Fixed/Implemented in version: **0.236.054**
+
+## Config Version Reference
+`config.py` updated to `VERSION = "0.236.054"`.
diff --git a/docs/explanation/fixes/AGENT_PAYLOAD_FIELD_LENGTHS_FIX.md b/docs/explanation/fixes/AGENT_PAYLOAD_FIELD_LENGTHS_FIX.md
new file mode 100644
index 00000000..e7f38582
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_PAYLOAD_FIELD_LENGTHS_FIX.md
@@ -0,0 +1,27 @@
+# Agent Payload Field Lengths Fix (Version 0.237.009)
+
+## Header Information
+- **Fix Title:** Agent payload field length validation
+- **Issue Description:** Agent payload validation did not enforce length limits, allowing oversized values into storage.
+- **Root Cause Analysis:** Length checks existed but were never invoked in `sanitize_agent_payload`, and no limits covered Azure-specific fields.
+- **Fixed/Implemented in version:** **0.237.009**
+- **Config Version Updated:** `config.py` VERSION set to **0.237.009**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/functions_agent_payload.py
+  - application/single_app/config.py
+- **Code Changes Summary:**
+  - Added max length recommendations for Azure OpenAI and APIM fields.
+  - Validated field lengths in `sanitize_agent_payload` and for Foundry settings.
+  - Bumped application version in config.py.
+- **Testing Approach:**
+  - Added a functional test to confirm validation wiring and limits are present.
+
+## Validation
+- **Test Results:** functional_tests/test_agent_payload_field_lengths.py
+- **Before/After Comparison:**
+  - Before: Oversized agent fields could pass validation.
+  - After: Oversized fields raise `AgentPayloadError` with a clear message.
+- **User Experience Improvements:**
+  - Prevents invalid payloads and provides consistent validation feedback.
diff --git a/docs/explanation/fixes/AGENT_SELECTION_MODEL_ROUTING_FIX.md b/docs/explanation/fixes/AGENT_SELECTION_MODEL_ROUTING_FIX.md
new file mode 100644
index 00000000..ed645b7d
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_SELECTION_MODEL_ROUTING_FIX.md
@@ -0,0 +1,56 @@
+# AGENT_SELECTION_MODEL_ROUTING_FIX.md
+
+## Agent Selection Model Routing Fix (v0.239.173)
+
+Fixed/Implemented in version: **0.239.173**
+
+### Issue Description
+
+Per-user Semantic Kernel requests could fall back into model-only mode even when the selected
+personal agent still existed. In that state, chats skipped agent invocation entirely and used the
+standard GPT routing path instead.
+
+### Root Cause Analysis
+
+The per-user agent loader fetched personal agents correctly, merged any group agents, and then
+reset `agents_cfg` back to an empty list before global-agent merge and agent selection. When
+`merge_global_semantic_kernel_with_workspace` was enabled, that left only global agents in the
+candidate set. Personal agents like `graph` were therefore invisible during selection even though
+they were present in Cosmos.
+
+### Technical Details
+
+Files modified:
+- `application/single_app/route_backend_agents.py`
+- `application/single_app/semantic_kernel_loader.py`
+- `application/single_app/route_backend_chats.py`
+- `application/single_app/config.py`
+- `functional_tests/test_agent_selection_recovery.py`
+
+Code changes summary:
+- Added server-side validation so `/api/user/settings/selected_agent` only saves agents that are
+  actually selectable for the current user and scope.
+- Removed the candidate-list reset so personal agents remain available during merge and selection.
+- Normalized per-user chat selection handling so dict-based `selected_agent` settings resolve to
+  agent names correctly in the chat route.
+- Bumped the application version and added regression coverage.
+
+Testing approach:
+- Added `functional_tests/test_agent_selection_recovery.py` to verify personal agents remain in
+  the loader candidate set and invalid selections are rejected when saved.
+
+Impact analysis:
+- Prevents valid personal agents from being dropped during per-user merge logic.
+- Keeps agent-routed chats on the agent’s configured model instead of dropping into the standard
+  model-only fallback path.
+
+### Validation
+
+Before:
+- Personal agents were loaded, but then removed from `agents_cfg` before selection.
+- Requests then used the normal GPT model path rather than the selected agent model.
+
+After:
+- Personal agents remain in the per-user candidate set during global merge.
+- Invalid agent selections are rejected when saved.
+- Agent-enabled chats remain on the intended agent invocation path.
\ No newline at end of file
diff --git a/docs/explanation/fixes/AGENT_TEMPLATE_APPROVALS_AND_NOTIFICATIONS_FIX.md b/docs/explanation/fixes/AGENT_TEMPLATE_APPROVALS_AND_NOTIFICATIONS_FIX.md
new file mode 100644
index 00000000..933c5f14
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_TEMPLATE_APPROVALS_AND_NOTIFICATIONS_FIX.md
@@ -0,0 +1,47 @@
+# Agent Template Approvals And Notifications Fix (Version 0.239.163)
+
+## Header Information
+- **Fix Title:** Shared approvals page for agent template review and approval notification cleanup
+- **Issue Description:** Agent template approvals were managed only inside Admin Settings, and approval notifications did not consistently notify submitters or clear stale admin pending notices.
+- **Root Cause Analysis:** The agent template review queue lived in a separate admin page, while notification cleanup logic did not handle assignment-scope notification partitions used for reviewer work queues.
+- **Fixed/Implemented in version:** **0.239.163**
+- **Config Version Updated:** `config.py` VERSION set to **0.239.163**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/functions_notifications.py
+  - application/single_app/functions_approvals.py
+  - application/single_app/functions_agent_templates.py
+  - application/single_app/route_backend_agent_templates.py
+  - application/single_app/route_frontend_control_center.py
+  - application/single_app/templates/approvals.html
+  - application/single_app/templates/admin_settings.html
+  - application/single_app/config.py
+  - functional_tests/test_approval_notification_routing_fix.py
+  - ui_tests/test_approvals_agent_template_admin_section.py
+- **Code Changes Summary:**
+  - Added notification types for requester pending states and agent template review outcomes.
+  - Added shared notification partition resolution and metadata-based cleanup helpers so assignment-scope reviewer notifications can be removed reliably.
+  - Notified approval request submitters when requests enter pending status and kept result notifications for approved and denied outcomes.
+  - Added agent template notifications for pending review, approved, declined, and deleted outcomes.
+  - Updated rejection notifications to include the reviewer-provided reason directly in the notification message.
+  - Added read-time notification message enrichment so older generic rejection notifications also display their stored rejection reasons.
+  - Added activity log entries for agent template submissions, approvals, rejections, and deletions.
+  - Replaced the native browser delete confirmation with a reusable Bootstrap confirmation modal for template deletion flows.
+  - Moved the admin template review queue and existing review modal onto `/approvals` while leaving configuration toggles in Admin Settings.
+  - Bumped application version in `config.py`.
+- **Testing Approach:**
+  - Added a functional test covering approval and agent template notification routing plus stale reviewer notification cleanup.
+  - Added a UI test covering the admin-only agent template approvals section on `/approvals`.
+
+## Validation
+- **Test Results:**
+  - functional_tests/test_approval_notification_routing_fix.py
+  - ui_tests/test_approvals_agent_template_admin_section.py
+- **Before/After Comparison:**
+  - Before: Admins reviewed templates from Admin Settings, submitters were not notified when requests entered pending state, and reviewer pending notifications could linger after a decision.
+  - After: Admins review templates from `/approvals`, submitters receive pending and result notifications, and reviewer pending notifications are cleared when an approval is resolved.
+- **User Experience Improvements:**
+  - Centralized approval workflows for admins.
+  - Clearer notification lifecycle for both request submitters and reviewers.
+  - Reduced stale notification noise after approval decisions.
\ No newline at end of file
diff --git a/docs/explanation/fixes/AGENT_TEMPLATE_MAX_LENGTHS_FIX.md b/docs/explanation/fixes/AGENT_TEMPLATE_MAX_LENGTHS_FIX.md
new file mode 100644
index 00000000..71e1f0de
--- /dev/null
+++ b/docs/explanation/fixes/AGENT_TEMPLATE_MAX_LENGTHS_FIX.md
@@ -0,0 +1,27 @@
+# Agent Template Max Lengths Fix (Version 0.237.010)
+
+## Header Information
+- **Fix Title:** Agent template max length validation
+- **Issue Description:** Agent template updates did not enforce length limits, allowing oversized fields into storage.
+- **Root Cause Analysis:** Length checks were missing from the update path in `update_agent_template`.
+- **Fixed/Implemented in version:** **0.237.010**
+- **Config Version Updated:** `config.py` VERSION set to **0.237.010**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/functions_agent_templates.py
+  - application/single_app/config.py
+- **Code Changes Summary:**
+  - Added max length constants for template fields and list items.
+  - Validated lengths during template updates.
+  - Bumped application version in config.py.
+- **Testing Approach:**
+  - Added a functional test to validate length validation wiring.
+
+## Validation
+- **Test Results:** functional_tests/test_agent_template_length_validation.py
+- **Before/After Comparison:**
+  - Before: Oversized template fields could be saved.
+  - After: Oversized fields raise a validation error before persistence.
+- **User Experience Improvements:**
+  - Consistent template validation and clearer error feedback.
diff --git a/docs/explanation/fixes/AI_MODELS_TAB_EMBEDDING_IMAGE_LOCATION_FIX.md b/docs/explanation/fixes/AI_MODELS_TAB_EMBEDDING_IMAGE_LOCATION_FIX.md
new file mode 100644
index 00000000..92a698d2
--- /dev/null
+++ b/docs/explanation/fixes/AI_MODELS_TAB_EMBEDDING_IMAGE_LOCATION_FIX.md
@@ -0,0 +1,34 @@
+# AI Models Tab Embedding/Image Location Fix (v0.236.014)
+
+## Issue Description
+Embeddings and image generation configuration were placed inside the legacy AI model modal, which made them harder to find and inconsistent with the expected AI Models tab layout.
+
+## Root Cause Analysis
+The embeddings and image generation cards were moved into the legacy modal during a refactor that consolidated legacy GPT settings into a modal, unintentionally relocating non-legacy sections.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.014**
+
+## Technical Details
+### Files Modified
+- application/single_app/templates/admin_settings.html
+- application/single_app/config.py
+
+### Code Changes Summary
+- Moved the embeddings and image generation cards back to the AI Models tab.
+- Kept GPT configuration in the legacy modal.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to assert that the embeddings and image generation sections are outside the legacy modal markup.
+
+### Impact Analysis
+- Restores expected layout for administrators.
+- Prevents settings from being hidden in the legacy modal.
+- Maintains legacy GPT configuration flow without impacting multi-endpoint UI.
+
+## Validation
+- Functional test: functional_tests/test_ai_models_tab_embedding_image_location.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.014**.
diff --git a/docs/explanation/fixes/AOAI_MODEL_DISCOVERY_EMPTY_LIST_FIX.md b/docs/explanation/fixes/AOAI_MODEL_DISCOVERY_EMPTY_LIST_FIX.md
new file mode 100644
index 00000000..afe070c5
--- /dev/null
+++ b/docs/explanation/fixes/AOAI_MODEL_DISCOVERY_EMPTY_LIST_FIX.md
@@ -0,0 +1,36 @@
+# AOAI Model Discovery Empty List Fix (v0.236.015)
+
+## Issue Description
+Azure OpenAI endpoint discovery in the multi-endpoint modal returned a successful connection but always displayed zero models.
+
+## Root Cause Analysis
+The `/api/models/fetch` endpoint only handled Azure AI Foundry and returned an empty list for Azure OpenAI providers. The modal payload also lacked resource group support required to query deployments via ARM.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.015**
+
+## Technical Details
+### Files Modified
+- application/single_app/templates/admin_settings.html
+- application/single_app/static/js/admin/admin_model_endpoints.js
+- application/single_app/route_backend_models.py
+- application/single_app/config.py
+
+### Code Changes Summary
+- Added Resource Group input to the model endpoint modal for AOAI discovery.
+- Required subscription + resource group for AOAI payloads.
+- Implemented AOAI deployment listing via ARM in `/api/models/fetch` and `/api/models/test-connection`.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to validate AOAI discovery wiring and resource group handling.
+
+### Impact Analysis
+- AOAI model fetch now returns deployments for the selected endpoint.
+- Prevents misleading “success with zero models” results.
+
+## Validation
+- Functional test: functional_tests/test_model_endpoints_aoai_fetch_fix.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.015**.
diff --git a/docs/explanation/fixes/CHAT_MODEL_DESCRIPTION_TOOLTIP_FIX.md b/docs/explanation/fixes/CHAT_MODEL_DESCRIPTION_TOOLTIP_FIX.md
new file mode 100644
index 00000000..0e8d9443
--- /dev/null
+++ b/docs/explanation/fixes/CHAT_MODEL_DESCRIPTION_TOOLTIP_FIX.md
@@ -0,0 +1,31 @@
+# Chat Model Description Tooltip Fix (v0.236.023)
+
+## Issue Description
+Chat model options did not expose model descriptions on hover, making it harder for users to choose between similar models.
+
+## Root Cause Analysis
+The model select options did not include a tooltip title derived from the model description.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.023**
+
+## Technical Details
+### Files Modified
+- application/single_app/templates/chats.html
+- application/single_app/config.py
+
+### Code Changes Summary
+- Added a title attribute on multi-endpoint model options using the model description (or display name as fallback).
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to verify the tooltip title is present in the chat template.
+
+### Impact Analysis
+- Improves model selection clarity with descriptive hover text.
+
+## Validation
+- Functional test: functional_tests/test_chat_model_description_tooltip.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.023**.
diff --git a/docs/explanation/fixes/CHAT_STREAM_HEARTBEAT_REATTACH_FIX.md b/docs/explanation/fixes/CHAT_STREAM_HEARTBEAT_REATTACH_FIX.md
new file mode 100644
index 00000000..0b10f8bd
--- /dev/null
+++ b/docs/explanation/fixes/CHAT_STREAM_HEARTBEAT_REATTACH_FIX.md
@@ -0,0 +1,68 @@
+# Chat Stream Heartbeat Reattach Fix
+
+Fixed/Implemented in version: **0.239.183**
+
+## Issue Description
+
+Long-running chat streams could still go quiet long enough to hit Azure App Service idle timeouts, and navigating away from a conversation meant the browser lost the live stream even though the backend worker kept running.
+
+The original reconnect support also depended on in-process memory, so reconnecting from a different App Service or gunicorn worker could miss the active stream entirely.
+
+## Root Cause Analysis
+
+The streaming route sent useful SSE data only when a model token or explicit thought event was available. There was no transport-level heartbeat during long blocking phases such as tool execution or tabular analysis.
+
+The background worker also outlived the original HTTP consumer, but the live response stream was only attached to that first request. Reopening the conversation later loaded persisted messages only and had no way to replay or rejoin the in-flight response.
+
+The first reconnect registry stored replay state only in module globals, which made it best-effort inside a single worker process but not durable across multi-worker deployments.
+
+## Technical Details
+
+### Files Modified
+
+- `application/single_app/route_backend_chats.py`
+- `application/single_app/app_settings_cache.py`
+- `application/single_app/static/js/chat/chat-streaming.js`
+- `application/single_app/static/js/chat/chat-conversations.js`
+- `application/single_app/static/js/chat/chat-messages.js`
+- `application/single_app/config.py`
+- `functional_tests/test_chat_stream_background_execution.py`
+- `functional_tests/test_chat_stream_heartbeat_reattach.py`
+- `functional_tests/test_chat_stream_compatibility_sse_syntax.py`
+- `functional_tests/test_chat_stream_debug_logging.py`
+- `functional_tests/test_streaming_only_chat_path.py`
+- `functional_tests/test_streaming_thought_finalization.py`
+
+### Code Changes Summary
+
+- Added SSE heartbeat comments so active stream connections continue emitting bytes during long idle gaps.
+- Added a per-user, per-conversation active stream registry that stores in-flight SSE history for reconnecting consumers.
+- Added Redis-backed session metadata and event replay through `app_settings_cache.py`, with same-process in-memory fallback when Redis is disabled.
+- Added stream status and reattach endpoints so the frontend can reconnect to an active conversation stream.
+- Updated the chat client to remove the hardcoded five-minute timeout, wait for saved message reload, and then attempt reattachment for pending conversations.
+- Kept backend processing detached from the browser request so navigation away does not cancel server-side completion.
+- Bumped the application version to `0.239.183`.
+
+### Testing Approach
+
+- Added `functional_tests/test_chat_stream_heartbeat_reattach.py` to verify heartbeat emission, cache-backed session replay hooks, and frontend reattach hooks.
+- Updated existing streaming regression tests to reflect the new version and stream-session routing.
+
+## Validation
+
+### Before
+
+- Long blocking phases could leave the SSE connection silent for too long.
+- A user returning to the conversation only saw persisted messages after the stream fully completed.
+- The frontend had a separate five-minute timeout path that could interrupt the visible stream.
+
+### After
+
+- Active stream responses emit keep-alive comment frames while waiting for the next real SSE payload.
+- Reopening a conversation can reconnect to the still-running stream and replay its in-flight events.
+- Redis-enabled deployments can reattach across App Service or gunicorn workers because session metadata and event history are no longer limited to a single process.
+- The backend worker continues independently, and the frontend no longer imposes a hard five-minute timeout on the stream.
+
+### Impact Analysis
+
+This change improves resilience for long-running chat operations without changing the persisted message model. Completed replies still become the source of truth in Cosmos DB, while in-flight replies gain a durable reconnect path when Redis is enabled and still retain same-process fallback behavior when it is not.
\ No newline at end of file
diff --git a/docs/explanation/fixes/CHAT_TAGGING_ENDPOINT_VISIBILITY_AND_DARK_MODE_FIX.md b/docs/explanation/fixes/CHAT_TAGGING_ENDPOINT_VISIBILITY_AND_DARK_MODE_FIX.md
new file mode 100644
index 00000000..c37d533b
--- /dev/null
+++ b/docs/explanation/fixes/CHAT_TAGGING_ENDPOINT_VISIBILITY_AND_DARK_MODE_FIX.md
@@ -0,0 +1,71 @@
+# Chat Tagging Endpoint Visibility And Dark Mode Fix
+
+Fixed/Implemented in version: **0.239.167**
+
+## Issue Description
+
+Three related UI regressions needed correction:
+
+- Unsupported `new_foundry` model endpoints were still visible in user-facing multi-endpoint flows.
+- Personal conversations displayed visible tags, while group conversation labels were inconsistent between the active header and sidebar, and some group-agent conversations failed to surface a group tag.
+- The upload user agreement content became unreadable in dark mode because its light background styling bypassed the shared dark-mode override.
+
+## Root Cause Analysis
+
+- Frontend endpoint sanitization removed secrets but did not filter unsupported providers before rendering workspace, group, and chat endpoint views.
+- Endpoint saves merged only the visible payload, so hiding unsupported providers on read alone would have risked deleting previously stored hidden endpoints.
+- The streaming chat path saved conversation metadata without the selected agent details, which prevented group-agent conversations from consistently preserving primary group context.
+- The sidebar conversation renderer emitted visible `personal` badges and hard-coded `group` text instead of using the group name.
+- The active conversation header and details formatter shortened group labels when the full group name should have been shown in the primary chat view.
+- The upload agreement modal used an inline `background-color: var(--bs-light)` style, which bypassed the existing `[data-bs-theme="dark"] .bg-light` override.
+
+## Technical Details
+
+### Files Modified
+
+- `application/single_app/functions_settings.py`
+- `application/single_app/templates/_multiendpoint_modal.html`
+- `application/single_app/static/js/chat/chat-conversations.js`
+- `application/single_app/static/js/chat/chat-conversation-details.js`
+- `application/single_app/route_backend_chats.py`
+- `application/single_app/templates/base.html`
+- `application/single_app/config.py`
+- `functional_tests/test_chat_tagging_and_endpoint_provider_visibility.py`
+- `ui_tests/test_model_endpoint_request_uses_endpoint_id.py`
+- `ui_tests/test_upload_agreement_dark_mode.py`
+
+### Code Changes Summary
+
+- Added shared provider visibility filtering so only `aoai` and `aifoundry` are exposed in frontend endpoint payloads.
+- Preserved stored hidden endpoints during merge/save flows so unsupported `new_foundry` entries remain in data even though they are no longer shown in the UI.
+- Removed the New Foundry option from the multi-endpoint provider selector and added APIM provider guidance under the field.
+- Updated conversation tag rendering so personal conversations show no visible badge, the active conversation header shows the full group name, and the sidebar shows a short group tag using the first 8 characters of the group name.
+- Updated the conversation details formatter to show the full group name.
+- Fixed the streaming chat path to pass selected agent metadata into conversation metadata collection so group-agent conversations retain group context.
+- Swapped the upload agreement content container to the shared `bg-light` class so the existing dark-mode override applies.
+
+### Testing Approach
+
+- Functional regression: `functional_tests/test_chat_tagging_and_endpoint_provider_visibility.py`
+- UI regression: `ui_tests/test_model_endpoint_request_uses_endpoint_id.py`
+- UI regression: `ui_tests/test_upload_agreement_dark_mode.py`
+
+## Validation
+
+### Before
+
+- Users could still see unsupported New Foundry endpoint options in user-facing multi-endpoint workflows.
+- Personal conversations displayed visible `personal` badges in the sidebar.
+- Group conversations showed inconsistent labels between the active header and the sidebar.
+- Group-agent conversations could lose their group tag when saved through the streaming path.
+- The upload agreement content could render as light text on a light surface in dark mode.
+
+### After
+
+- Only Azure OpenAI and Foundry (classic) are exposed in the visible multi-endpoint provider UI.
+- Existing hidden unsupported endpoints are preserved in storage.
+- Personal conversations no longer render a visible tag.
+- The active conversation header and details view show the full group name.
+- Sidebar group conversations render a short badge using the first 8 characters of the group name.
+- Streaming group-agent conversations retain group metadata for tag display and related filtering.
+- The upload agreement content uses the shared dark-mode-safe light surface styling.
\ No newline at end of file
diff --git a/docs/explanation/fixes/CHAT_TOOLBAR_LAYOUT_FIX.md b/docs/explanation/fixes/CHAT_TOOLBAR_LAYOUT_FIX.md
new file mode 100644
index 00000000..fe8e384b
--- /dev/null
+++ b/docs/explanation/fixes/CHAT_TOOLBAR_LAYOUT_FIX.md
@@ -0,0 +1,45 @@
+# Chat Toolbar Layout Fix
+
+Fixed/Implemented in version: **0.239.170**
+
+## Issue Description
+
+The chat toolbar could either leave an empty band above the chat input or let prompt and agent/model selectors crowd each other when the chat pane became narrower.
+
+## Root Cause Analysis
+
+- The selector and toggle controls are separate sibling groups, but the actions cluster can wrap internally as the available pane width shrinks.
+- Without a medium-width breakpoint, that internal wrapping either created a blank band above the controls or forced the prompt and agent/model selectors to compete for the same row.
+- The layout needed different behavior for wide, medium, and mobile widths instead of a single desktop rule.
+
+## Technical Details
+
+### Files Modified
+
+- `application/single_app/static/css/chats.css`
+- `application/single_app/config.py`
+- `functional_tests/test_chat_toolbar_layout.py`
+
+### Code Changes Summary
+
+- Kept the selector and toggle controls as separate sibling groups.
+- Updated the wide-layout toolbar flex rules so the controls stay on one row and align to the bottom edge.
+- Added a medium-width breakpoint that promotes the actions and controls clusters to separate full-width rows before selector overlap can occur.
+- Kept the mobile breakpoint wrapped behavior so the toolbar can still stack on narrow screens.
+- Added a regression test to verify the sibling structure plus the wide and medium responsive layout hooks remain in place.
+
+### Testing Approach
+
+- Functional regression: `functional_tests/test_chat_toolbar_layout.py`
+
+## Validation
+
+### Before
+
+- The selector dropdowns and the voice toggle could drop awkwardly or crowd each other, depending on the pane width.
+
+### After
+
+- The selector dropdowns and the voice toggle remain as separate sibling groups.
+- On wide layouts they stay aligned on a single row.
+- On medium widths they switch to clean full-width rows before prompt and agent/model controls can overlap.
\ No newline at end of file
diff --git a/docs/explanation/fixes/CHAT_TYPE_NORMALIZATION_FIX.md b/docs/explanation/fixes/CHAT_TYPE_NORMALIZATION_FIX.md
new file mode 100644
index 00000000..035c7841
--- /dev/null
+++ b/docs/explanation/fixes/CHAT_TYPE_NORMALIZATION_FIX.md
@@ -0,0 +1,46 @@
+# Chat Type Normalization Fix (0.236.065)
+
+## Fix Title
+Chat Type Normalization for New and Personal Conversations
+
+## Issue Description
+New conversations and legacy personal conversations could lack a consistent `chat_type`, which made scope-aware UI logic inconsistent across agent dropdowns, badges, and metadata views.
+
+## Root Cause Analysis
+Chat type values were optional in conversation items. Missing or legacy values were not normalized, causing ambiguous scope handling and inconsistent UI state.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.065**
+
+## Technical Details
+### Files Modified
+- application/single_app/static/js/chat/chat-conversations.js
+- application/single_app/static/js/chat/chat-agents.js
+- application/single_app/static/js/chat/chat-retry.js
+- application/single_app/static/js/chat/chat-conversation-details.js
+- application/single_app/route_backend_conversations.py
+- application/single_app/route_backend_chats.py
+- application/single_app/functions_conversation_metadata.py
+- application/single_app/config.py
+- functional_tests/test_chat_type_normalization.py
+
+### Code Changes Summary
+- Normalize missing or legacy personal chat types to `personal_single_user`.
+- Mark new conversations with `chat_type = "new"` on creation.
+- Persist normalization server-side for legacy conversations.
+- Update chat detail rendering and badges to handle `personal_single_user` and `new`.
+
+## Testing Approach
+- Added a functional test to assert chat type normalization across UI and backend sources.
+
+## Validation
+### Test Results
+- Functional test: functional_tests/test_chat_type_normalization.py
+
+### User Experience Improvements
+- Consistent agent scope determination for new and personal chats.
+- Stable chat type metadata in conversation lists and details.
+
+## Related Updates
+- Config version updated to 0.236.065.
+- Functional test added for chat type normalization coverage.
diff --git a/docs/explanation/fixes/CONTROL_CENTER_DATE_LABELS_FIX.md b/docs/explanation/fixes/CONTROL_CENTER_DATE_LABELS_FIX.md
new file mode 100644
index 00000000..a7d1bf34
--- /dev/null
+++ b/docs/explanation/fixes/CONTROL_CENTER_DATE_LABELS_FIX.md
@@ -0,0 +1,27 @@
+# Control Center Date Labels Fix (Version 0.235.074)
+
+## Header Information
+- **Fix Title:** Control Center Date Labels Fix
+- **Issue Description:** Control Center charts displayed dates one day behind due to UTC parsing of date keys.
+- **Root Cause Analysis:** The frontend parsed YYYY-MM-DD strings with `new Date(...)`, which treats the value as UTC and shifts the day in local timezones.
+- **Fixed/Implemented in version:** **0.235.074**
+- **Config Version Updated:** `config.py` VERSION set to **0.235.074**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/static/js/control-center.js
+  - application/single_app/config.py
+- **Code Changes Summary:**
+  - Added a local date parsing helper for YYYY-MM-DD keys.
+  - Updated chart label and tooltip rendering to use local date parsing.
+  - Bumped application version in config.py.
+- **Testing Approach:**
+  - Added a functional test to validate the date parsing helper is present in the chart logic.
+
+## Validation
+- **Test Results:** functional_tests/test_control_center_date_labels_fix.py
+- **Before/After Comparison:**
+  - Before: Date labels in charts appeared one day behind in local timezones.
+  - After: Date labels match the correct local date (e.g., Jan 21 for today).
+- **User Experience Improvements:**
+  - Accurate daily labels across all activity charts.
diff --git a/docs/explanation/fixes/CUSTOM_ENDPOINT_FLAGS_WORKSPACE_MERGE_FIX.md b/docs/explanation/fixes/CUSTOM_ENDPOINT_FLAGS_WORKSPACE_MERGE_FIX.md
new file mode 100644
index 00000000..7639e607
--- /dev/null
+++ b/docs/explanation/fixes/CUSTOM_ENDPOINT_FLAGS_WORKSPACE_MERGE_FIX.md
@@ -0,0 +1,51 @@
+# Custom Endpoint Flags & Workspace Merge Fix (Version 0.236.058)
+
+## Header Information
+- Fix Title: Custom endpoint flag migration and workspace merge enforcement
+- Issue Description: Custom endpoint toggles only applied to agents, endpoints loaded despite being disabled, and workspace merges could include global + personal + group agents simultaneously.
+- Root Cause Analysis: Legacy settings names were still in use, backend routes did not consistently enforce the custom endpoint flags, and agent selection merged multiple scopes at once.
+- Version Implemented: 0.236.058
+- Fixed/Implemented in version: **0.236.058**
+- Config version updated in: application/single_app/config.py
+
+## Technical Details
+### Files Modified
+- application/single_app/functions_settings.py
+- application/single_app/route_backend_agents.py
+- application/single_app/route_backend_models.py
+- application/single_app/route_frontend_admin_settings.py
+- application/single_app/semantic_kernel_loader.py
+- application/single_app/static/js/agent_modal_stepper.js
+- application/single_app/static/js/workspace/group_agents.js
+- application/single_app/static/js/chat/chat-agents.js
+- application/single_app/static/js/chat/chat-retry.js
+- application/single_app/static/js/admin/admin_settings.js
+- application/single_app/templates/admin_settings.html
+- application/single_app/templates/workspace.html
+- application/single_app/templates/group_workspaces.html
+
+### Code Changes Summary
+- Added new custom endpoint flags (allow_user_custom_endpoints, allow_group_custom_endpoints) with migration from legacy names.
+- Enforced custom endpoint flags across user/group model endpoint routes and agent payload handling.
+- Scoped agent and model merges to global + workspace (personal or group) only.
+- Updated frontend toggles and visibility to respect the new settings.
+
+### Testing Approach
+- Added functional test to validate migration and legacy flag sync.
+
+### Impact Analysis
+- Prevents disabled endpoint settings from leaking into workspace UI and backend payloads.
+- Ensures group workspaces and personal workspaces only merge global agents with their own scope.
+- Maintains backward compatibility by migrating legacy settings.
+
+## Validation
+- Test Results: Functional test added for settings migration.
+- Before/After Comparison:
+  - Before: Endpoint settings could appear even when disabled; merges could include global + personal + group simultaneously.
+  - After: Endpoint visibility and persistence are gated by flags; merges are limited to one workspace scope.
+- User Experience Improvements:
+  - Clearer, consistent enforcement of custom endpoint permissions.
+  - Reduced confusion around which agents/models are available per workspace.
+
+## Related Tests
+- functional_tests/test_custom_endpoint_settings_migration.py
diff --git a/docs/explanation/fixes/DEFAULT_MODEL_DROPDOWN_FOUNDRY_MODELS_FIX.md b/docs/explanation/fixes/DEFAULT_MODEL_DROPDOWN_FOUNDRY_MODELS_FIX.md
new file mode 100644
index 00000000..4a82ea31
--- /dev/null
+++ b/docs/explanation/fixes/DEFAULT_MODEL_DROPDOWN_FOUNDRY_MODELS_FIX.md
@@ -0,0 +1,33 @@
+# Default Model Dropdown Foundry Models Fix (Version 0.236.057)
+
+## Issue Description
+The admin multi-endpoint default model dropdown did not list Azure AI Foundry models when model IDs or enabled flags were missing in stored endpoint data. This caused the dropdown to only show Azure OpenAI entries.
+
+## Root Cause Analysis
+Endpoint data could be missing model IDs and enabled flags, and those values were not normalized at the data layer. Missing identifiers made Foundry models appear unavailable in the dropdown.
+
+## Fix Summary
+- Normalize model endpoints on the backend so IDs and enabled flags are consistently present.
+- Use stable fallback identifiers derived from deployment names when IDs are missing.
+
+## Technical Details
+- Files modified:
+  - application/single_app/functions_settings.py
+  - application/single_app/route_frontend_admin_settings.py
+  - application/single_app/route_backend_models.py
+  - application/single_app/route_backend_chats.py
+  - application/single_app/config.py
+- Added backend normalization so endpoints/models always include stable IDs and enabled flags.
+- Updated multi-endpoint resolution to match by deployment/model names when IDs are missing.
+
+## Testing
+- Functional test: functional_tests/test_model_endpoint_normalization_backend.py
+
+## Impact Analysis
+- Admins can now see Foundry deployments in the default model dropdown even when IDs were previously missing.
+- Existing endpoint data remains compatible and is normalized in-memory before rendering.
+
+## Fixed/Implemented in version: **0.236.057**
+
+## Config Version Update
+- Updated VERSION in application/single_app/config.py to 0.236.057.
diff --git a/docs/explanation/fixes/DEFAULT_MODEL_SELECTION_FALLBACK_FIX.md b/docs/explanation/fixes/DEFAULT_MODEL_SELECTION_FALLBACK_FIX.md
new file mode 100644
index 00000000..20b25e70
--- /dev/null
+++ b/docs/explanation/fixes/DEFAULT_MODEL_SELECTION_FALLBACK_FIX.md
@@ -0,0 +1,38 @@
+# Default Model Selection Fallback Fix (Version 0.236.053)
+
+## Overview
+Adds an admin-configurable default model selection for multi-endpoint configurations and uses it as a fallback when agent requests omit model information.
+
+## Issue Description
+Agent-based requests can omit `model_id` and `model_endpoint_id`, which caused GPT initialization to fail when multiple deployments were configured. Without a default model, summarization and fallback logic could not resolve a usable GPT client.
+
+## Root Cause Analysis
+Multi-endpoint GPT resolution requires `model_id` and `model_endpoint_id`. Agent requests do not always send those fields, and there was no default model configured to bridge the gap.
+
+## Fix Summary
+- Added a default model selection to admin settings for multi-endpoint mode.
+- Persisted default model selection in settings and validated it against configured endpoints/models.
+- Added fallback GPT initialization using the default selection for agent requests without model info.
+- Supports both Azure OpenAI and Azure AI Foundry providers.
+
+## Files Modified
+- application/single_app/functions_settings.py
+- application/single_app/templates/admin_settings.html
+- application/single_app/static/js/admin/admin_model_endpoints.js
+- application/single_app/route_frontend_admin_settings.py
+- application/single_app/route_backend_chats.py
+- application/single_app/config.py
+- functional_tests/test_default_model_selection_fallback.py
+
+## Testing
+- Added functional test: `test_default_model_selection_fallback.py`.
+
+## Validation
+- Verified admin UI renders the default model selector and stores the selection.
+- Verified chat GPT initialization can resolve default model when agent requests omit model info.
+
+## Version
+Fixed/Implemented in version: **0.236.053**
+
+## Config Version Reference
+`config.py` updated to `VERSION = "0.236.053"`.
diff --git a/docs/explanation/fixes/DOCUMENT_UPLOAD_TRACEBACK_SHADOW_FIX.md b/docs/explanation/fixes/DOCUMENT_UPLOAD_TRACEBACK_SHADOW_FIX.md
new file mode 100644
index 00000000..e7d41388
--- /dev/null
+++ b/docs/explanation/fixes/DOCUMENT_UPLOAD_TRACEBACK_SHADOW_FIX.md
@@ -0,0 +1,53 @@
+# Document Upload Traceback Shadow Fix
+
+Fixed/Implemented in version: **0.239.165**
+
+## Issue Description
+
+Uploading PDF and DOCX documents could fail during processing with this message:
+
+`Processing failed: cannot access local variable 'traceback' where it is not associated with a value`
+
+The failure happened while the document ingestion flow was handling an earlier exception, so the user saw the traceback-scoping error instead of the original upload problem.
+
+## Root Cause Analysis
+
+- `process_di_document(...)` used `traceback.format_exc()` in one exception path.
+- The same function also had a later branch with `import traceback` inside the function body.
+- In Python, that function-local import makes `traceback` a local variable for the entire function scope.
+- When an earlier exception path tried to call `traceback.format_exc()` before the local import executed, Python raised an unbound local error.
+
+## Technical Details
+
+### Files Modified
+
+- `application/single_app/functions_documents.py`
+- `application/single_app/config.py`
+- `functional_tests/test_document_upload_traceback_shadow_fix.py`
+
+### Code Changes Summary
+
+- Added a module-level `import traceback` in `functions_documents.py`.
+- Removed function-local `import traceback` statements so exception handlers all use the same module-scoped import.
+- Bumped the application version to `0.239.165`.
+- Added a regression test that inspects the AST for `process_di_document(...)` and verifies the fix remains in place.
+
+### Testing Approach
+
+- Added `functional_tests/test_document_upload_traceback_shadow_fix.py` to verify:
+- `functions_documents.py` imports `traceback` at module scope.
+- `process_di_document(...)` does not locally import `traceback`.
+- `process_di_document(...)` still uses `traceback.format_exc()` for diagnostics.
+
+## Validation
+
+### Before
+
+- PDF and DOCX uploads could fail with an unbound local error while handling a processing exception.
+- The error masked the original processing failure and made upload debugging harder.
+
+### After
+
+- The upload pipeline uses a consistent module-scoped `traceback` import.
+- PDF and DOCX processing no longer trips the unbound local error caused by traceback shadowing.
+- Any real underlying processing error now surfaces through the intended exception handling path.
\ No newline at end of file
diff --git a/docs/explanation/fixes/ENDPOINTS_TAB_ORDER_VISIBILITY_FIX.md b/docs/explanation/fixes/ENDPOINTS_TAB_ORDER_VISIBILITY_FIX.md
new file mode 100644
index 00000000..893df6f9
--- /dev/null
+++ b/docs/explanation/fixes/ENDPOINTS_TAB_ORDER_VISIBILITY_FIX.md
@@ -0,0 +1,36 @@
+# Endpoints Tab Order & Visibility Fix (v0.236.046)
+
+## Issue Description
+Endpoints tabs appeared before Actions and were still visible even when admin settings disallowed custom endpoints.
+
+## Root Cause Analysis
+The tab ordering placed endpoints ahead of actions, and the endpoints UI was only gated by general agent settings instead of the custom endpoint permission flags.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.046**
+
+## Technical Details
+### Files Modified
+- application/single_app/templates/workspace.html
+- application/single_app/templates/group_workspaces.html
+- application/single_app/config.py
+- functional_tests/test_endpoints_tab_order_visibility.py
+
+### Code Changes Summary
+- Reordered tabs to follow Documents → Prompts → Agents → Actions → Endpoints.
+- Gated endpoints tabs and panes behind admin custom endpoint settings.
+- Added a functional test to verify tab ordering and gating.
+- Incremented the application version.
+
+### Testing Approach
+- Functional test validates the tab order and permission gating in both templates.
+
+## Impact Analysis
+- Endpoints UI is fully hidden unless admins allow custom endpoints.
+- Tab order matches the requested workflow order.
+
+## Validation
+- Functional test: functional_tests/test_endpoints_tab_order_visibility.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.046**.
diff --git a/docs/explanation/fixes/FOUNDARY_DEPLOYMENT_DISABLED_FILTER_FIX.md b/docs/explanation/fixes/FOUNDARY_DEPLOYMENT_DISABLED_FILTER_FIX.md
new file mode 100644
index 00000000..265b4fe6
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDARY_DEPLOYMENT_DISABLED_FILTER_FIX.md
@@ -0,0 +1,34 @@
+# Foundry Deployment Disabled Filter Fix (v0.236.025)
+
+## Issue Description
+Model discovery included deployments that were disabled, causing unavailable models to appear in the UI.
+
+## Root Cause Analysis
+The deployment list responses were not filtered by provisioning state.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.025**
+
+## Technical Details
+### Files Modified
+- application/single_app/route_backend_models.py
+- application/single_app/static/js/admin/admin_model_endpoints.js
+- application/single_app/config.py
+
+### Code Changes Summary
+- Added deployment provisioning state filtering (exclude non-succeeded deployments).
+- Switched Foundry management discovery to deployments list.
+- Updated Foundry validation to require resource group.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test for deployment state filtering.
+
+### Impact Analysis
+- Prevents disabled deployments from appearing in model selection.
+
+## Validation
+- Functional test: functional_tests/test_foundry_deployment_disabled_filter.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.025**.
diff --git a/docs/explanation/fixes/FOUNDRY_AGENT_ENDPOINT_RESOLUTION_FIX.md b/docs/explanation/fixes/FOUNDRY_AGENT_ENDPOINT_RESOLUTION_FIX.md
new file mode 100644
index 00000000..d7503255
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_AGENT_ENDPOINT_RESOLUTION_FIX.md
@@ -0,0 +1,31 @@
+# Foundry Agent Endpoint Resolution Fix (Version 0.236.051)
+
+## Overview
+Ensures Azure AI Foundry agents resolve project-scoped endpoints reliably by enriching agent configuration with the Foundry project name and endpoint ID during kernel load.
+
+## Issue Description
+Foundry agent chat invocation failed for agents configured with a Foundry endpoint that required a project name. The runtime endpoint resolution did not receive the project name, so `/api/projects/<project>` was not appended, resulting in invalid requests.
+
+## Root Cause Analysis
+`resolve_agent_config` enriched Foundry settings with the endpoint URL and API version, but did not propagate `project_name` or `endpoint_id` from the selected Foundry endpoint configuration. Agents created earlier could also lack `model_endpoint_id`, leaving only `other_settings.azure_ai_foundry.endpoint_id` for resolution.
+
+## Fix Summary
+- Enrich Foundry settings with `project_name` and `endpoint_id` from the selected endpoint configuration.
+- Add endpoint ID fallback to resolve Foundry endpoint config when `model_endpoint_id` is missing.
+
+## Files Modified
+- application/single_app/semantic_kernel_loader.py
+- application/single_app/config.py
+- functional_tests/test_foundry_agent_endpoint_resolution.py
+
+## Testing
+- Added functional test: `test_foundry_agent_endpoint_resolution.py`.
+
+## Validation
+- Verified Foundry settings enrichment includes `project_name` and endpoint ID fallback logic.
+
+## Version
+Fixed/Implemented in version: **0.236.051**
+
+## Config Version Reference
+`config.py` updated to `VERSION = "0.236.051"`.
diff --git a/docs/explanation/fixes/FOUNDRY_AGENT_ENDPOINT_VALIDATION_FIX.md b/docs/explanation/fixes/FOUNDRY_AGENT_ENDPOINT_VALIDATION_FIX.md
new file mode 100644
index 00000000..fa3fdf88
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_AGENT_ENDPOINT_VALIDATION_FIX.md
@@ -0,0 +1,36 @@
+# Foundry Agent Endpoint Validation Fix (Version 0.236.060)
+
+## Header Information
+- Fix Title: Prevent Foundry agent invocation without configured endpoint
+- Issue Description: Foundry agents could be invoked without an endpoint resolved, resulting in runtime failures during agent execution.
+- Root Cause Analysis: Foundry agents were registered even when endpoint configuration was missing, leaving runtime resolution to fail.
+- Version Implemented: 0.236.060
+- Fixed/Implemented in version: **0.236.060**
+- Config version updated in: application/single_app/config.py
+
+## Technical Details
+### Files Modified
+- application/single_app/semantic_kernel_loader.py
+- application/single_app/config.py
+
+### Code Changes Summary
+- Added a helper to resolve Foundry endpoints using agent settings, global settings, and environment fallback.
+- Prevented Foundry agent registration when no endpoint is available, falling back to kernel-only mode.
+
+### Testing Approach
+- Added functional test covering Foundry endpoint resolution priority and fallback.
+
+### Impact Analysis
+- Avoids runtime errors when Foundry agent endpoint configuration is missing.
+- Improves clarity by keeping kernel-only mode when configuration is incomplete.
+
+## Validation
+- Test Results: Functional test added for endpoint resolution logic.
+- Before/After Comparison:
+  - Before: Foundry agent invocation failed at runtime with missing endpoint.
+  - After: Foundry agent registration is skipped and kernel-only mode is used when endpoint is missing.
+- User Experience Improvements:
+  - Clearer fallback behavior and fewer runtime errors for misconfigured Foundry agents.
+
+## Related Tests
+- functional_tests/test_foundry_endpoint_resolution.py
diff --git a/docs/explanation/fixes/FOUNDRY_AGENT_LIST_ASYNC_PAGING_FIX.md b/docs/explanation/fixes/FOUNDRY_AGENT_LIST_ASYNC_PAGING_FIX.md
new file mode 100644
index 00000000..dbb35de9
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_AGENT_LIST_ASYNC_PAGING_FIX.md
@@ -0,0 +1,33 @@
+# Foundry Agent List Async Paging Fix (v0.236.047)
+
+## Issue Description
+Fetching Azure AI Foundry agents failed with "object AsyncItemPaged can't be used in 'await' expression".
+
+## Root Cause Analysis
+The async list operation returns an `AsyncItemPaged` sequence, but the code awaited it directly instead of iterating over the async iterator.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.047**
+
+## Technical Details
+### Files Modified
+- application/single_app/foundry_agent_runtime.py
+- application/single_app/config.py
+- functional_tests/test_foundry_agent_list_async_paging.py
+
+### Code Changes Summary
+- Stopped awaiting the list call and added async iteration for paged results.
+- Kept support for list/dict responses.
+- Incremented the application version.
+
+### Testing Approach
+- Functional test checks for async iteration and non-awaited list calls.
+
+## Impact Analysis
+- Foundry agent discovery now works reliably across paged responses.
+
+## Validation
+- Functional test: functional_tests/test_foundry_agent_list_async_paging.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.047**.
diff --git a/docs/explanation/fixes/FOUNDRY_AGENT_LIST_PROJECT_ENDPOINT_FIX.md b/docs/explanation/fixes/FOUNDRY_AGENT_LIST_PROJECT_ENDPOINT_FIX.md
new file mode 100644
index 00000000..b3743b43
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_AGENT_LIST_PROJECT_ENDPOINT_FIX.md
@@ -0,0 +1,34 @@
+# Foundry Agent List Project Endpoint Fix (v0.236.048)
+
+## Issue Description
+Listing Azure AI Foundry agents returned a 404 Resource not found error for endpoints configured without the project path.
+
+## Root Cause Analysis
+Agent listing used the base endpoint and omitted the required `/api/projects/{project_name}` segment when a project name was configured.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.048**
+
+## Technical Details
+### Files Modified
+- application/single_app/foundry_agent_runtime.py
+- application/single_app/route_backend_models.py
+- application/single_app/config.py
+- functional_tests/test_foundry_agent_list_project_endpoint.py
+
+### Code Changes Summary
+- Added project name to Foundry settings.
+- Appended `/api/projects/{project_name}` when missing.
+- Incremented the application version.
+
+### Testing Approach
+- Functional test checks for project name wiring and endpoint normalization.
+
+## Impact Analysis
+- Foundry agent listing works for project-scoped endpoints.
+
+## Validation
+- Functional test: functional_tests/test_foundry_agent_list_project_endpoint.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.048**.
diff --git a/docs/explanation/fixes/FOUNDRY_CHAT_INFERENCE_SCOPE_FIX.md b/docs/explanation/fixes/FOUNDRY_CHAT_INFERENCE_SCOPE_FIX.md
new file mode 100644
index 00000000..e253a6d2
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_CHAT_INFERENCE_SCOPE_FIX.md
@@ -0,0 +1,35 @@
+# Foundry Chat Inference Scope Fix (v0.236.030)
+
+## Header Information
+- **Fix Title:** Foundry chat inference uses cloud-aware scopes
+- **Issue Description:** Multi-endpoint Foundry inference in chat returned 401 Unauthorized due to incorrect token audience.
+- **Root Cause Analysis:** Chat route always used the Cognitive Services scope and did not apply the Foundry scope per cloud.
+- **Version Implemented:** 0.236.030
+
+## Fixed/Implemented in version: **0.236.030**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/route_backend_chats.py
+  - functional_tests/test_foundry_chat_scope_resolution.py
+  - application/single_app/config.py
+- **Code Changes Summary:**
+  - Added Foundry scope resolution for multi-endpoint chat inference.
+  - Applied service principal cloud tags and endpoint-based scope inference for managed identity.
+  - Added a functional test validating scope resolution.
+  - Incremented the application version to 0.236.030.
+- **Testing Approach:**
+  - Functional test checks for cloud-aware scope logic in chat routes.
+- **Impact Analysis:**
+  - Foundry chat inference now requests tokens with the correct audience per cloud.
+
+## Validation
+- **Test Results:** Functional test added (see functional_tests/test_foundry_chat_scope_resolution.py).
+- **Before/After Comparison:**
+  - **Before:** Foundry chat inference always used Cognitive Services scope.
+  - **After:** Foundry chat inference derives scope based on cloud and endpoint.
+- **User Experience Improvements:**
+  - Foundry model inference works in multi-endpoint chat without unauthorized errors.
+
+## References
+- Config version updated in application/single_app/config.py to 0.236.030.
diff --git a/docs/explanation/fixes/FOUNDRY_INFERENCE_SCOPE_FIX.md b/docs/explanation/fixes/FOUNDRY_INFERENCE_SCOPE_FIX.md
new file mode 100644
index 00000000..47e4d16c
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_INFERENCE_SCOPE_FIX.md
@@ -0,0 +1,34 @@
+# Foundry Inference Scope Fix (v0.236.027)
+
+## Header Information
+- **Fix Title:** Foundry inference token scope uses AI Foundry audience
+- **Issue Description:** Testing Foundry models returned 401 Unauthorized due to an incorrect token audience.
+- **Root Cause Analysis:** The inference token used the Cognitive Services scope instead of the AI Foundry scope for Foundry project endpoints.
+- **Version Implemented:** 0.236.027
+
+## Fixed/Implemented in version: **0.236.027**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/route_backend_models.py
+  - application/single_app/config.py
+  - functional_tests/test_foundry_inference_scope_fix.py
+- **Code Changes Summary:**
+  - Updated inference client to use the AI Foundry token scope for Foundry endpoints.
+  - Added a functional test to assert provider-aware scope selection.
+  - Incremented the application version to 0.236.027.
+- **Testing Approach:**
+  - Functional test validates the Foundry-specific scope is present in the inference path.
+- **Impact Analysis:**
+  - Foundry model tests authenticate successfully when using managed identity or service principal.
+
+## Validation
+- **Test Results:** Functional test added (see functional_tests/test_foundry_inference_scope_fix.py).
+- **Before/After Comparison:**
+  - **Before:** Foundry model test used Cognitive Services token scope.
+  - **After:** Foundry model test uses AI Foundry token scope.
+- **User Experience Improvements:**
+  - Admins can test Foundry model connections without unauthorized errors.
+
+## References
+- Config version updated in application/single_app/config.py to 0.236.027.
diff --git a/docs/explanation/fixes/FOUNDRY_MANAGEMENT_FIELDS_CLEANUP_FIX.md b/docs/explanation/fixes/FOUNDRY_MANAGEMENT_FIELDS_CLEANUP_FIX.md
new file mode 100644
index 00000000..d2c52547
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_MANAGEMENT_FIELDS_CLEANUP_FIX.md
@@ -0,0 +1,37 @@
+# Foundry Management Fields Cleanup Fix (v0.236.029)
+
+## Header Information
+- **Fix Title:** Remove management fields from Foundry endpoint configuration
+- **Issue Description:** Foundry endpoint configuration still referenced subscription/resource group/location fields after moving to project-scoped discovery.
+- **Root Cause Analysis:** The modal payload and debug logging retained AOAI management metadata for Foundry endpoints.
+- **Version Implemented:** 0.236.029
+
+## Fixed/Implemented in version: **0.236.029**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/static/js/admin/admin_model_endpoints.js
+  - application/single_app/route_backend_models.py
+  - functional_tests/test_foundry_management_fields_cleanup.py
+  - application/single_app/config.py
+- **Code Changes Summary:**
+  - Removed location field usage from the endpoint modal script.
+  - Ensured management metadata is only included for Azure OpenAI payloads.
+  - Cleaned backend debug logging to remove location references.
+  - Added a functional test for Foundry management field cleanup.
+  - Incremented the application version to 0.236.029.
+- **Testing Approach:**
+  - Functional test validates the modal payload uses management fields only for AOAI.
+- **Impact Analysis:**
+  - Foundry endpoint configuration is now project-only without AOAI management metadata.
+
+## Validation
+- **Test Results:** Functional test added (see functional_tests/test_foundry_management_fields_cleanup.py).
+- **Before/After Comparison:**
+  - **Before:** Foundry payload carried AOAI management fields and location debug logs.
+  - **After:** Foundry payload excludes management fields and location is removed.
+- **User Experience Improvements:**
+  - Admins no longer see or save unnecessary management fields for Foundry endpoints.
+
+## References
+- Config version updated in application/single_app/config.py to 0.236.029.
diff --git a/docs/explanation/fixes/FOUNDRY_MODEL_LIST_ENDPOINT_FALLBACK_FIX.md b/docs/explanation/fixes/FOUNDRY_MODEL_LIST_ENDPOINT_FALLBACK_FIX.md
new file mode 100644
index 00000000..c19d99a2
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_MODEL_LIST_ENDPOINT_FALLBACK_FIX.md
@@ -0,0 +1,32 @@
+# Foundry Model List Endpoint Fallback Fix (v0.236.024)
+
+## Issue Description
+Model discovery for Azure AI Foundry returned a 400 error against `/openai/v1/models` for certain Foundry endpoints.
+
+## Root Cause Analysis
+Some Foundry endpoints expect the Azure OpenAI data-plane path `/openai/models` rather than `/openai/v1/models`.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.024**
+
+## Technical Details
+### Files Modified
+- application/single_app/route_backend_models.py
+- application/single_app/config.py
+
+### Code Changes Summary
+- Attempt `/openai/models` first, fall back to `/openai/v1/models`.
+- Added debug output for the attempted URLs.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to validate the fallback order.
+
+### Impact Analysis
+- Reduces 400 errors when listing models from Foundry endpoints.
+
+## Validation
+- Functional test: functional_tests/test_foundry_model_list_fallback.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.024**.
diff --git a/docs/explanation/fixes/FOUNDRY_PROJECT_DEPLOYMENTS_FETCH_FIX.md b/docs/explanation/fixes/FOUNDRY_PROJECT_DEPLOYMENTS_FETCH_FIX.md
new file mode 100644
index 00000000..8e5d9f68
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_PROJECT_DEPLOYMENTS_FETCH_FIX.md
@@ -0,0 +1,37 @@
+# Foundry Project Deployments Fetch Fix (v0.236.026)
+
+## Header Information
+- **Fix Title:** Foundry project deployments fetch uses project-scoped API
+- **Issue Description:** Foundry model discovery was pulling from account-level or data-plane lists, which did not align with project-scoped deployments shown in Foundry projects.
+- **Root Cause Analysis:** The discovery logic relied on generic model list fallbacks and management-plane deployments, instead of the project deployments list endpoint.
+- **Version Implemented:** 0.236.026
+
+## Fixed/Implemented in version: **0.236.026**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/route_backend_models.py
+  - application/single_app/static/js/admin/admin_model_endpoints.js
+  - functional_tests/test_foundry_model_list_fallback.py
+  - application/single_app/config.py
+- **Code Changes Summary:**
+  - Switched Foundry discovery to the project deployments list endpoint using the project API scope.
+  - Removed subscription/resource group requirement for Foundry project discovery in the admin modal validation.
+  - Updated the functional test to validate project deployments discovery.
+  - Incremented the application version to 0.236.026.
+- **Testing Approach:**
+  - Updated functional test validates project deployments discovery helper and scope usage.
+- **Impact Analysis:**
+  - Foundry model discovery now reflects project-scoped deployments.
+  - Admin configuration flow no longer blocks on subscription/resource group for Foundry discovery.
+
+## Validation
+- **Test Results:** Functional test updated (see functional_tests/test_foundry_model_list_fallback.py).
+- **Before/After Comparison:**
+  - **Before:** Foundry model discovery used account-level or data-plane model listings.
+  - **After:** Foundry model discovery uses the project deployments list endpoint.
+- **User Experience Improvements:**
+  - Admins see the same project deployments as the Foundry project UI.
+
+## References
+- Config version updated in application/single_app/config.py to 0.236.026.
diff --git a/docs/explanation/fixes/FOUNDRY_SCOPE_BY_CLOUD_FIX.md b/docs/explanation/fixes/FOUNDRY_SCOPE_BY_CLOUD_FIX.md
new file mode 100644
index 00000000..b9cd9147
--- /dev/null
+++ b/docs/explanation/fixes/FOUNDRY_SCOPE_BY_CLOUD_FIX.md
@@ -0,0 +1,38 @@
+# Foundry Scope by Cloud Fix (v0.236.028)
+
+## Header Information
+- **Fix Title:** Foundry scope derived from cloud configuration
+- **Issue Description:** Foundry tokens used a hardcoded audience and did not support government or custom cloud scopes.
+- **Root Cause Analysis:** Scope selection was fixed to the public cloud audience and lacked a custom scope override.
+- **Version Implemented:** 0.236.028
+
+## Fixed/Implemented in version: **0.236.028**
+
+## Technical Details
+- **Files Modified:**
+  - application/single_app/route_backend_models.py
+  - application/single_app/static/js/admin/admin_model_endpoints.js
+  - application/single_app/templates/admin_settings.html
+  - functional_tests/test_foundry_inference_scope_fix.py
+  - application/single_app/config.py
+- **Code Changes Summary:**
+  - Added Foundry scope resolver that maps to public/government audiences and supports a custom scope value.
+  - Added a Foundry scope input for custom cloud service principal configurations.
+  - Hid Azure OpenAI subscription/resource group fields for Foundry endpoints.
+  - Updated the functional test to validate cloud-specific scope handling.
+  - Incremented the application version to 0.236.028.
+- **Testing Approach:**
+  - Functional test validates presence of cloud-specific and custom scope logic.
+- **Impact Analysis:**
+  - Foundry model discovery and inference now use the correct audience for public, government, and custom clouds.
+
+## Validation
+- **Test Results:** Functional test updated (see functional_tests/test_foundry_inference_scope_fix.py).
+- **Before/After Comparison:**
+  - **Before:** Foundry scope was hardcoded to public cloud.
+  - **After:** Foundry scope is derived from cloud configuration with custom override support.
+- **User Experience Improvements:**
+  - Admins can configure Foundry endpoints across supported clouds without manual code changes.
+
+## References
+- Config version updated in application/single_app/config.py to 0.236.028.
diff --git a/docs/explanation/fixes/GROUP_AGENT_SELECTION_ACTIVE_GROUP_FIX.md b/docs/explanation/fixes/GROUP_AGENT_SELECTION_ACTIVE_GROUP_FIX.md
new file mode 100644
index 00000000..d27ab507
--- /dev/null
+++ b/docs/explanation/fixes/GROUP_AGENT_SELECTION_ACTIVE_GROUP_FIX.md
@@ -0,0 +1,38 @@
+# Group Agent Selection Active Group Fix (Version 0.236.059)
+
+## Header Information
+- Fix Title: Enforce active group when resolving requested agents
+- Issue Description: Group agent requests were resolving to the fallback researcher agent because the loader matched only personal/global agents after request overrides.
+- Root Cause Analysis: Request agent overrides were stored as names only, which caused group scope to be lost; selection logic also ignored group scope when matching candidates.
+- Version Implemented: 0.236.059
+- Fixed/Implemented in version: **0.236.059**
+- Config version updated in: application/single_app/config.py
+
+## Technical Details
+### Files Modified
+- application/single_app/route_backend_chats.py
+- application/single_app/semantic_kernel_loader.py
+- application/single_app/config.py
+
+### Code Changes Summary
+- Persisted full request agent metadata in request context for scope-aware selection.
+- Enforced group_id presence and active-group matching before loading group agents.
+- Added scope-aware agent matching to prevent fallback to personal/global agents with the same name.
+
+### Testing Approach
+- Added functional test to validate scope-aware agent matching.
+
+### Impact Analysis
+- Group agent selection respects the active group and rejects mismatched group requests.
+- Prevents falling back to researcher when the requested group agent is missing or out of scope.
+
+## Validation
+- Test Results: Functional test added for scope-aware selection.
+- Before/After Comparison:
+  - Before: Group agent request often fell back to global/personal researcher.
+  - After: Group agent selection only succeeds when group_id matches the active group; otherwise kernel loads core plugins only.
+- User Experience Improvements:
+  - Correct agent selection for group workspaces with explicit scope enforcement.
+
+## Related Tests
+- functional_tests/test_group_agent_selection_scope.py
diff --git a/docs/explanation/fixes/MODEL_ENDPOINT_MIGRATION_AUTH_FIX.md b/docs/explanation/fixes/MODEL_ENDPOINT_MIGRATION_AUTH_FIX.md
new file mode 100644
index 00000000..7a83c87f
--- /dev/null
+++ b/docs/explanation/fixes/MODEL_ENDPOINT_MIGRATION_AUTH_FIX.md
@@ -0,0 +1,34 @@
+# Model Endpoint Migration Auth Fix (v0.236.016)
+
+## Issue Description
+Automatic migration to multi-endpoint settings did not preserve legacy authentication type, API key, subscription ID, or resource group, resulting in incomplete endpoint configurations.
+
+## Root Cause Analysis
+The migration logic only populated `auth.type` with the legacy `azure_openai_gpt_authentication_type` value, which uses `key` instead of the new `api_key` type. It also omitted management metadata needed for AOAI discovery.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.016**
+
+## Technical Details
+### Files Modified
+- application/single_app/route_frontend_admin_settings.py
+- application/single_app/config.py
+
+### Code Changes Summary
+- Mapped legacy `key` auth type to `api_key` during migration.
+- Carried forward `azure_openai_gpt_key` for API key auth.
+- Added `subscription_id` and `resource_group` to migrated endpoint management fields.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to verify migration wiring preserves auth and management fields.
+
+### Impact Analysis
+- Ensures migrated multi-endpoint configurations are complete and usable.
+- Prevents broken model discovery after migration.
+
+## Validation
+- Functional test: functional_tests/test_multi_endpoint_migration_auth_preserved.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.016**.
diff --git a/docs/explanation/fixes/MODEL_ENDPOINT_SAVE_BUTTON_FIX.md b/docs/explanation/fixes/MODEL_ENDPOINT_SAVE_BUTTON_FIX.md
new file mode 100644
index 00000000..e7c16c65
--- /dev/null
+++ b/docs/explanation/fixes/MODEL_ENDPOINT_SAVE_BUTTON_FIX.md
@@ -0,0 +1,32 @@
+# Model Endpoint Save Button Fix (v0.236.021)
+
+## Issue Description
+Clicking the Save Endpoint button in the model endpoint modal did not trigger any visible action.
+
+## Root Cause Analysis
+The click handler did not guard against errors, and failures in the save flow were not surfaced to the user.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.021**
+
+## Technical Details
+### Files Modified
+- application/single_app/static/js/admin/admin_model_endpoints.js
+- application/single_app/config.py
+
+### Code Changes Summary
+- Wrapped `saveEndpoint()` in a try/catch with toast error handling.
+- Ensured Save button prevents default behavior and always invokes the handler.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to confirm Save button wiring and error handling exists.
+
+### Impact Analysis
+- Save Endpoint now reliably triggers and surfaces errors.
+
+## Validation
+- Functional test: functional_tests/test_model_endpoints_save_button.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.021**.
diff --git a/docs/explanation/fixes/MODEL_ENDPOINT_SAVE_TOAST_REMINDER_FIX.md b/docs/explanation/fixes/MODEL_ENDPOINT_SAVE_TOAST_REMINDER_FIX.md
new file mode 100644
index 00000000..0201f8f8
--- /dev/null
+++ b/docs/explanation/fixes/MODEL_ENDPOINT_SAVE_TOAST_REMINDER_FIX.md
@@ -0,0 +1,31 @@
+# Model Endpoint Save Toast Reminder Fix (v0.236.022)
+
+## Issue Description
+The endpoint modal displayed a success toast after saving a model endpoint, which led admins to assume settings were persisted without clicking the main Save Settings button.
+
+## Root Cause Analysis
+The toast message did not clarify that modal changes are staged and require saving the admin settings form.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.022**
+
+## Technical Details
+### Files Modified
+- application/single_app/static/js/admin/admin_model_endpoints.js
+- application/single_app/config.py
+
+### Code Changes Summary
+- Updated the success toast to remind users to save settings to persist changes.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to confirm the updated toast message.
+
+### Impact Analysis
+- Reduces accidental data loss when navigating away without saving.
+
+## Validation
+- Functional test: functional_tests/test_model_endpoints_save_toast_message.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.022**.
diff --git a/docs/explanation/fixes/MODEL_ENDPOINT_TEST_BUTTON_FIX.md b/docs/explanation/fixes/MODEL_ENDPOINT_TEST_BUTTON_FIX.md
new file mode 100644
index 00000000..9f9b34dc
--- /dev/null
+++ b/docs/explanation/fixes/MODEL_ENDPOINT_TEST_BUTTON_FIX.md
@@ -0,0 +1,31 @@
+# Model Endpoint Test Button Fix (v0.236.020)
+
+## Issue Description
+The per-model Test Connection button did not trigger a test because the payload builder referenced `authType` before it was defined, which caused a runtime error.
+
+## Root Cause Analysis
+`buildEndpointPayload()` used `authType` in validation checks before declaring it, resulting in a `ReferenceError` and preventing any request from being sent.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.020**
+
+## Technical Details
+### Files Modified
+- application/single_app/static/js/admin/admin_model_endpoints.js
+- application/single_app/config.py
+
+### Code Changes Summary
+- Defined `authType` before provider-specific validation checks in `buildEndpointPayload()`.
+- Incremented the application version.
+
+### Testing Approach
+- Added a functional test to verify `authType` is declared before validation checks.
+
+### Impact Analysis
+- Per-model Test Connection now triggers correctly.
+
+## Validation
+- Functional test: functional_tests/test_model_endpoint_payload_auth_type_order.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.020**.
diff --git a/docs/explanation/fixes/MSGRAPH_INCREMENTAL_CONSENT_FLOW_FIX.md b/docs/explanation/fixes/MSGRAPH_INCREMENTAL_CONSENT_FLOW_FIX.md
new file mode 100644
index 00000000..5a859125
--- /dev/null
+++ b/docs/explanation/fixes/MSGRAPH_INCREMENTAL_CONSENT_FLOW_FIX.md
@@ -0,0 +1,57 @@
+# MSGRAPH_INCREMENTAL_CONSENT_FLOW_FIX.md
+
+## Microsoft Graph Incremental Consent Flow Fix (v0.239.175)
+
+Fixed/Implemented in version: **0.239.175**
+
+### Issue Description
+
+Microsoft Graph plugin calls could incorrectly tell users to grant permissions again even when the
+authentication app registration already had the delegated permissions granted. The plugin auth flow
+also lost the plugin-requested scopes during the `/getAToken` callback and redeemed only the base
+login scope set.
+
+### Root Cause Analysis
+
+The shared plugin token helper treated any silent-token miss as a consent problem and always built
+an interactive URL with `prompt=consent`. At the same time, the OAuth callback always redeemed
+`SCOPE` from `config.py` instead of the scopes originally requested by the plugin operation.
+
+### Technical Details
+
+Files modified:
+- `application/single_app/functions_authentication.py`
+- `application/single_app/route_frontend_authentication.py`
+- `application/single_app/config.py`
+- `functional_tests/test_msgraph_auth_consent_flow.py`
+
+Code changes summary:
+- Added session-backed tracking for plugin-requested OAuth scopes.
+- Stopped forcing `prompt=consent` for generic interactive reauthentication.
+- Preserved explicit consent prompting only when Microsoft Entra returns a consent-specific error.
+- Updated the `/getAToken` callback to redeem the stored plugin scopes instead of always using the
+  base login scope list.
+
+Testing approach:
+- Added `functional_tests/test_msgraph_auth_consent_flow.py` to verify:
+  - silent token misses return interactive auth without forced consent,
+  - explicit consent errors still force `prompt=consent`,
+  - the OAuth callback redeems the originally requested plugin scopes.
+
+Impact analysis:
+- Users should no longer be told to re-consent for already granted delegated Graph permissions.
+- Incremental Graph plugin scopes now survive the OAuth round-trip correctly.
+- The authentication app registration remains the expected delegated-auth client for Graph plugin
+  operations, while managed identity continues to be unrelated to `/me` Graph calls.
+
+### Validation
+
+Before:
+- Silent token misses were surfaced as consent requests.
+- Interactive URLs always forced `prompt=consent`.
+- The callback redeemed only the base login scopes and could miss plugin-specific Graph scopes.
+
+After:
+- Generic interactive sign-in requests no longer force a consent prompt.
+- Consent is only forced when Microsoft Entra explicitly reports missing consent.
+- The callback redeems the exact plugin-requested scopes and clears the temporary scope state.
\ No newline at end of file
diff --git a/docs/explanation/fixes/MSGRAPH_TIMEZONE_LOOKUP_FIX.md b/docs/explanation/fixes/MSGRAPH_TIMEZONE_LOOKUP_FIX.md
new file mode 100644
index 00000000..76882a30
--- /dev/null
+++ b/docs/explanation/fixes/MSGRAPH_TIMEZONE_LOOKUP_FIX.md
@@ -0,0 +1,47 @@
+# MSGRAPH_TIMEZONE_LOOKUP_FIX.md
+
+## Microsoft Graph Timezone Lookup Fix (v0.239.174)
+
+Fixed/Implemented in version: **0.239.174**
+
+### Issue Description
+
+Timezone-sensitive responses could be wrong because the core Semantic Kernel time plugin does not
+know the signed-in user's mailbox timezone and often defaults to UTC-oriented behavior.
+
+### Root Cause Analysis
+
+The application exposed Microsoft Graph calendar and mail operations but did not expose mailbox
+timezone settings. That left the agent without a user-specific timezone source when it needed to
+answer questions such as current local time, date boundaries, or time-relative interpretations.
+
+### Technical Details
+
+Files modified:
+- `application/single_app/semantic_kernel_plugins/msgraph_plugin.py`
+- `application/single_app/config.py`
+- `functional_tests/test_msgraph_plugin_operations.py`
+
+Code changes summary:
+- Added `get_my_timezone` to the Microsoft Graph plugin.
+- Wired the new operation to `GET /v1.0/me/mailboxSettings` with the `MailboxSettings.Read` scope.
+- Updated plugin metadata so agents can discover the timezone operation.
+- Extended functional coverage for the new timezone lookup.
+
+Testing approach:
+- Updated `functional_tests/test_msgraph_plugin_operations.py` to verify metadata exposure,
+  required scope usage, request path, and shaped timezone result payload.
+
+Impact analysis:
+- Agents now have an explicit per-user timezone source from Microsoft Graph.
+- Timezone-sensitive responses can prefer the user's mailbox timezone instead of assuming UTC.
+
+### Validation
+
+Before:
+- The agent had no dedicated Microsoft Graph timezone lookup.
+- TimePlugin-based answers could drift to UTC assumptions.
+
+After:
+- The agent can call `msgraph.get_my_timezone` to retrieve the mailbox timezone and formatting.
+- Time-sensitive answers can use mailbox timezone context before relying on generic time helpers.
\ No newline at end of file
diff --git a/docs/explanation/fixes/MULTIGPT_KEY_VAULT_SECRET_STORAGE_FIX.md b/docs/explanation/fixes/MULTIGPT_KEY_VAULT_SECRET_STORAGE_FIX.md
new file mode 100644
index 00000000..aac2c742
--- /dev/null
+++ b/docs/explanation/fixes/MULTIGPT_KEY_VAULT_SECRET_STORAGE_FIX.md
@@ -0,0 +1,118 @@
+# MULTIGPT KEY VAULT SECRET STORAGE FIX
+
+Fixed in version: **0.239.156**
+
+## Overview
+
+This fix adds Azure Key Vault support for MultiGPT model endpoint secrets across global, personal, and group endpoint configurations.
+
+When `enable_key_vault_secret_storage` is enabled, endpoint secrets entered for MultiGPT connections are now stored in Key Vault instead of remaining in persisted endpoint payloads. Backend fetch, test, Foundry listing, and runtime execution paths now resolve the stored secret server-side so the UI does not need to receive plaintext secrets after the initial save.
+
+Version `0.239.156` also fixes a follow-up regression in Foundry model discovery where sync fetch routes could import an async credential helper and fail with `'coroutine' object has no attribute 'token'` when requesting model lists.
+
+## Issue Description
+
+MultiGPT endpoint configuration supported secret-bearing auth fields such as:
+
+- `auth.api_key`
+- `auth.client_secret`
+
+Those fields were not integrated with the existing Key Vault helper flow that already supported agents and plugins.
+
+As a result:
+
+- endpoint secrets could remain outside the existing Key Vault lifecycle
+- admin and workspace editors depended on secrets being present in the browser to fetch models or test models
+- reopening a saved endpoint without the plaintext secret could break fetch and test operations
+- runtime consumers could fail if a saved endpoint only held a Key Vault reference and the execution path did not resolve it
+
+## Root Cause Analysis
+
+The original implementation had three separate gaps:
+
+1. MultiGPT endpoint auth fields did not have endpoint-specific Key Vault save/get/delete helpers.
+2. Fetch and test routes expected secrets in request payloads from the UI instead of merging with persisted endpoint configuration and resolving stored secrets on the server.
+3. Runtime endpoint consumers, especially Semantic Kernel multi-endpoint resolution and Foundry endpoint enrichment, used saved endpoint auth directly without a consistent Key Vault resolution step.
+
+The follow-up regression was caused by a fourth issue:
+
+4. Sync Foundry model-discovery code reused an async credential helper from the Foundry runtime layer, so synchronous token retrieval returned a coroutine instead of a token object.
+
+## Technical Details
+
+### Files Modified
+
+- `application/single_app/functions_keyvault.py`
+- `application/single_app/functions_settings.py`
+- `application/single_app/route_backend_models.py`
+- `application/single_app/route_frontend_admin_settings.py`
+- `application/single_app/semantic_kernel_loader.py`
+- `application/single_app/foundry_agent_runtime.py`
+- `application/single_app/static/js/admin/admin_model_endpoints.js`
+- `application/single_app/static/js/workspace/workspace_model_endpoints.js`
+- `application/single_app/config.py`
+- `functional_tests/test_foundry_model_fetch_sync_credentials.py`
+- `functional_tests/test_model_endpoints_key_vault_secret_storage.py`
+- `functional_tests/test_workspace_multi_endpoints.py`
+- `functional_tests/test_model_endpoint_normalization_backend.py`
+- `functional_tests/test_model_endpoints_api_key_manual_models.py`
+
+### Code Changes Summary
+
+- Added a dedicated `model-endpoint` Key Vault source and endpoint-specific helper functions for save, get, delete, and cleanup of obsolete references.
+- Added shared endpoint merge helpers so empty secret fields from the UI preserve stored secrets during edits.
+- Updated endpoint normalization to strip UI-only secret-presence flags before persistence.
+- Updated global, personal, and group endpoint save flows to store endpoint secrets in Key Vault when enabled.
+- Updated fetch/test request handling so saved endpoint auth is resolved server-side by endpoint ID and scope.
+- Updated Foundry agent listing and Semantic Kernel runtime endpoint selection to resolve Key Vault-backed endpoint auth before execution.
+- Split Foundry credential construction so runtime invocation keeps async credentials while sync model discovery and project SDK flows use sync Azure credentials.
+- Updated admin and workspace endpoint editors to use placeholder behavior for stored secrets and to include endpoint IDs in fetch/test requests.
+
+### Secret Handling Behavior
+
+- New or edited endpoint secrets are saved to Key Vault when Key Vault is enabled.
+- Existing saved endpoint secrets are not backfilled automatically.
+- Saved endpoint edits preserve stored secrets unless the auth type changes or a new secret is provided.
+- Obsolete endpoint Key Vault references are deleted when endpoint auth configuration changes or when an endpoint is removed.
+
+## Testing Approach
+
+### Functional Tests
+
+- `functional_tests/test_model_endpoints_key_vault_secret_storage.py`
+- `functional_tests/test_foundry_model_fetch_sync_credentials.py`
+- `functional_tests/test_workspace_multi_endpoints.py`
+- `functional_tests/test_model_endpoint_normalization_backend.py`
+- `functional_tests/test_model_endpoints_api_key_manual_models.py`
+
+### Validation Covered
+
+- Key Vault save, placeholder fetch, value fetch, and cleanup for endpoint auth secrets
+- sync Foundry credential builders returning token objects instead of coroutine values
+- frontend sanitization of endpoint secrets and secret-presence flags
+- backend normalization of endpoint payloads without persisting UI-only flags
+- admin and workspace request wiring for endpoint-ID-based stored-secret resolution
+
+## Impact Analysis
+
+### Before
+
+- MultiGPT endpoint secrets were not handled by the existing Key Vault helper pattern.
+- Saved endpoint tests could fail after reopening the editor because the browser no longer had the secret value.
+- Runtime endpoint consumers did not consistently resolve Key Vault-backed endpoint auth.
+
+### After
+
+- MultiGPT endpoint secrets follow the same secure storage pattern as other Key Vault-backed secret types.
+- Endpoint fetch/test flows work with stored secrets without rehydrating plaintext values into the UI.
+- Foundry model discovery works again for sync fetch routes because sync token acquisition no longer uses async credentials.
+- Runtime consumers resolve endpoint secrets server-side before model access.
+
+## Validation Results
+
+Validated with targeted functional test runs for:
+
+- endpoint Key Vault lifecycle
+- workspace endpoint sanitization
+- endpoint normalization
+- API key manual model entry and per-model test wiring
\ No newline at end of file
diff --git a/docs/explanation/fixes/NEW_CONVERSATION_AGENT_MODEL_REFRESH_FIX.md b/docs/explanation/fixes/NEW_CONVERSATION_AGENT_MODEL_REFRESH_FIX.md
new file mode 100644
index 00000000..d34c54b1
--- /dev/null
+++ b/docs/explanation/fixes/NEW_CONVERSATION_AGENT_MODEL_REFRESH_FIX.md
@@ -0,0 +1,42 @@
+# New Conversation Agent/Model Refresh Fix (0.236.066)
+
+## Fix Title
+Refresh agent and model lists on new conversation creation
+
+## Issue Description
+When starting a new conversation, the agent list did not refresh and depended on the previously selected conversation scope. The model list also did not re-apply user preferences after a new conversation was created.
+
+## Root Cause Analysis
+- New conversations are added without invoking the full selection flow, so the agent dropdown remained stale.
+- Group agents were fetched only when `window.activeGroupId` was set; active group settings in user settings (`activeGroupOid`) were not used.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.066**
+
+## Technical Details
+### Files Modified
+- application/single_app/static/js/agents_common.js
+- application/single_app/static/js/chat/chat-agents.js
+- application/single_app/static/js/chat/chat-retry.js
+- application/single_app/static/js/chat/chat-conversations.js
+- application/single_app/config.py
+- functional_tests/test_new_conversation_agent_model_refresh.py
+
+### Code Changes Summary
+- Group agent fetching now accepts an explicit active group id.
+- New conversation agent dropdown uses `activeGroupOid` from user settings.
+- Model selection is refreshed on new conversation creation and on conversation switches.
+
+## Testing Approach
+- Added a functional test to verify active group fallback and refresh hooks.
+
+## Validation
+### Test Results
+- Functional test: functional_tests/test_new_conversation_agent_model_refresh.py
+
+### User Experience Improvements
+- New conversations consistently show personal + active group agents.
+- Model selection is re-applied to reflect user preferences.
+
+## Related Updates
+- Config version updated to 0.236.066.
diff --git a/docs/explanation/fixes/NEW_FOUNDRY_API_VERSION_HANDLING_FIX.md b/docs/explanation/fixes/NEW_FOUNDRY_API_VERSION_HANDLING_FIX.md
new file mode 100644
index 00000000..31892a19
--- /dev/null
+++ b/docs/explanation/fixes/NEW_FOUNDRY_API_VERSION_HANDLING_FIX.md
@@ -0,0 +1,36 @@
+# NEW_FOUNDRY_API_VERSION_HANDLING_FIX.md
+
+# New Foundry API Version Handling Fix
+
+Fixed in version: **0.239.180**
+
+## Issue
+
+The New Foundry endpoint modal had already stopped defaulting the OpenAI API version to `2024-05-01-preview`, but existing New Foundry agents could still be loaded with that endpoint-level fallback value. This happened both in the edit modal and at runtime, even when the agent document in Cosmos already stored the correct `responses_api_version`.
+
+## Root Cause
+
+- The runtime loader merged endpoint connection settings over the saved New Foundry agent settings and treated the endpoint API version as authoritative.
+- The agent modal re-applied endpoint defaults after loading the saved agent, which overwrote the stored `responses_api_version` in the form.
+- New Foundry agents need endpoint metadata for discovery, but an explicitly saved agent `responses_api_version` must take precedence during edit and invocation.
+
+## Files Modified
+
+- `application/single_app/semantic_kernel_loader.py`
+- `application/single_app/static/js/agent_modal_stepper.js`
+- `application/single_app/static/js/admin/admin_model_endpoints.js`
+- `application/single_app/templates/_multiendpoint_modal.html`
+- `ui_tests/test_model_endpoint_request_uses_endpoint_id.py`
+- `functional_tests/test_new_foundry_endpoint_api_version_handling.py`
+- `application/single_app/config.py`
+
+## Validation
+
+- Functional coverage verifies New Foundry endpoints no longer receive the generic AOAI API-version default.
+- Functional coverage verifies the fetch response can populate the Responses API version back into the agent modal when available.
+- Functional coverage verifies existing New Foundry agents preserve their saved `responses_api_version` when the endpoint configuration contains a different fallback value.
+- UI coverage now expects the endpoint modal to clear the OpenAI API version field when `new_foundry` is selected for a new endpoint.
+
+## Impact
+
+New New Foundry endpoint configurations no longer silently inherit `2024-05-01-preview`, and existing New Foundry agents now keep their saved Responses/OpenAI API version during both modal editing and runtime invocation. Endpoint configuration remains the default source for incomplete agents, but it no longer clobbers an agent-specific version that was already persisted correctly.
\ No newline at end of file
diff --git a/docs/explanation/fixes/NEW_FOUNDRY_UI_VISIBILITY_FIX.md b/docs/explanation/fixes/NEW_FOUNDRY_UI_VISIBILITY_FIX.md
new file mode 100644
index 00000000..2056127f
--- /dev/null
+++ b/docs/explanation/fixes/NEW_FOUNDRY_UI_VISIBILITY_FIX.md
@@ -0,0 +1,39 @@
+# NEW_FOUNDRY_UI_VISIBILITY_FIX.md
+
+# New Foundry UI Visibility Fix
+
+Fixed in version: **0.239.177**
+
+## Issue
+
+New Foundry had already been wired into backend fetch and streaming paths, but the browser UI no longer exposed it in the agent modal or the model endpoint modal. Frontend endpoint sanitization also filtered `new_foundry` out of the visible provider list, which prevented saved New Foundry endpoints from appearing in user-facing workflows.
+
+## Root Cause
+
+- The New Foundry agent type radio in `_agent_modal.html` was wrapped in a disabled `{% if false %}` block.
+- `_multiendpoint_modal.html` only exposed `aoai` and classic Foundry in the provider selector.
+- `is_frontend_visible_model_endpoint_provider()` in `functions_settings.py` still treated `new_foundry` as unsupported for frontend use.
+
+## Files Modified
+
+- `application/single_app/templates/_agent_modal.html`
+- `application/single_app/templates/_multiendpoint_modal.html`
+- `application/single_app/functions_settings.py`
+- `functional_tests/test_chat_tagging_and_endpoint_provider_visibility.py`
+- `functional_tests/test_new_foundry_fetch_support.py`
+- `functional_tests/test_new_foundry_ui_visibility.py`
+- `ui_tests/test_agent_modal_dual_foundry_modes.py`
+- `ui_tests/test_model_endpoint_request_uses_endpoint_id.py`
+- `application/single_app/config.py`
+
+## Validation
+
+- Functional coverage now verifies the New Foundry agent type is present in the agent modal template.
+- Functional coverage now verifies the endpoint modal exposes `new_foundry` and frontend endpoint sanitization allows it.
+- Existing UI tests were updated to expect New Foundry to be visible in both agent and endpoint modal workflows.
+
+## Impact
+
+Users can configure New Foundry endpoints again and select the New Foundry agent type in the browser, which restores the UI path needed to test the REST-based streaming backend.
+
+The agent modal now also displays fetched published versions in the application selector and inherits the Responses API version from the selected endpoint configuration instead of asking the user to type version metadata manually.
\ No newline at end of file
diff --git a/docs/explanation/fixes/NEW_FOUNDRY_VERSION_METADATA_FIX.md b/docs/explanation/fixes/NEW_FOUNDRY_VERSION_METADATA_FIX.md
new file mode 100644
index 00000000..a7a4b150
--- /dev/null
+++ b/docs/explanation/fixes/NEW_FOUNDRY_VERSION_METADATA_FIX.md
@@ -0,0 +1,35 @@
+# NEW_FOUNDRY_VERSION_METADATA_FIX.md
+
+# New Foundry Version Metadata Fix
+
+Fixed in version: **0.239.177**
+
+## Issue
+
+New Foundry application fetches were succeeding, but the returned list was not always surfacing the published version number in the agent selector. That forced the user to infer version metadata manually. The agent modal also exposed a manual version field even though the live Responses invocation path uses the application name and endpoint-level OpenAI API version instead.
+
+## Root Cause
+
+- The REST normalization logic did not read nested version shapes such as `versions.latest.version`.
+- The agent modal treated application version as a user-entered value instead of fetched metadata.
+- The agent modal still used a hardcoded default for the Responses API version instead of inheriting it from the selected endpoint configuration.
+
+## Files Modified
+
+- `application/single_app/foundry_agent_runtime.py`
+- `application/single_app/static/js/agent_modal_stepper.js`
+- `application/single_app/templates/_agent_modal.html`
+- `application/single_app/templates/_multiendpoint_modal.html`
+- `functional_tests/test_new_foundry_fetch_support.py`
+- `functional_tests/test_new_foundry_version_metadata.py`
+- `application/single_app/config.py`
+
+## Validation
+
+- Functional coverage verifies nested New Foundry version metadata is read from the fetched payload.
+- Functional coverage verifies the version field is no longer presented as a manual entry field in the agent modal.
+- Functional coverage verifies the current app version and selector-version formatting are present.
+
+## Impact
+
+Users can fetch New Foundry applications and see the published version in the selector while continuing to configure the runtime by application name. The Responses API version is now inherited from endpoint configuration rather than hardcoded in the agent modal.
\ No newline at end of file
diff --git a/docs/explanation/fixes/PERSONAL_AGENT_DROPDOWN_SCOPE_FIX.md b/docs/explanation/fixes/PERSONAL_AGENT_DROPDOWN_SCOPE_FIX.md
new file mode 100644
index 00000000..51bfd578
--- /dev/null
+++ b/docs/explanation/fixes/PERSONAL_AGENT_DROPDOWN_SCOPE_FIX.md
@@ -0,0 +1,32 @@
+# Personal Agent Dropdown Scope Fix (0.236.062)
+
+## Issue Description
+Personal agents were hidden in the chat dropdown whenever an active group ID existed in global page state, even when the user was chatting in the personal tab.
+
+## Root Cause Analysis
+The dropdown treated any non-empty `activeGroupId` as a group context. Because the chat page always renders `active_group_id`, personal agents were filtered out even in user chat.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.062**
+
+## Technical Details
+- **Files modified**:
+  - application/single_app/static/js/chat/chat-agents.js
+  - application/single_app/static/js/chat/chat-retry.js
+  - application/single_app/config.py
+- **Change summary**:
+  - Determine group scope using `window.activeChatTabType === 'group'` before using `activeGroupId`.
+  - Personal agents now show in the user chat tab; group agents only show in group chat.
+
+## Testing Approach
+- Added functional test: functional_tests/test_personal_agent_dropdown_scope_fix.py
+- Test verifies the group chat scope guard is present in chat dropdown scripts.
+
+## Impact Analysis
+- Restores personal agent visibility in personal chat.
+- Preserves group agent visibility in group chat.
+- No changes to backend agent data.
+
+## Validation
+- Open personal chat and confirm personal + global agents appear.
+- Switch to group chat tab and confirm group + global agents appear.
diff --git a/docs/explanation/fixes/PERSONAL_AGENT_DROPDOWN_VISIBILITY_FIX.md b/docs/explanation/fixes/PERSONAL_AGENT_DROPDOWN_VISIBILITY_FIX.md
new file mode 100644
index 00000000..a4522949
--- /dev/null
+++ b/docs/explanation/fixes/PERSONAL_AGENT_DROPDOWN_VISIBILITY_FIX.md
@@ -0,0 +1,32 @@
+# Personal Agent Dropdown Visibility Fix (0.236.061)
+
+## Issue Description
+Personal agents were missing from the chat agent dropdown when no active group was actually selected. The UI treated string values like "None" as a valid active group ID, so the dropdown only showed group and global agents.
+
+## Root Cause Analysis
+The chat dropdown logic relied on `window.activeGroupId` and treated any non-empty string as a real group ID. When templates rendered `None` as a string, the code mistakenly filtered out personal agents.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.061**
+
+## Technical Details
+- **Files modified**:
+  - application/single_app/static/js/chat/chat-agents.js
+  - application/single_app/static/js/chat/chat-retry.js
+  - application/single_app/config.py
+- **Change summary**:
+  - Normalize `activeGroupId` by treating "none", "null", and "undefined" as empty.
+  - Ensures personal agents are included when no real group is active.
+
+## Testing Approach
+- Added functional test: functional_tests/test_personal_agent_dropdown_in_chats_fix.py
+- Test validates the normalization guard exists in both chat dropdown scripts.
+
+## Impact Analysis
+- Personal agents now appear in the chat dropdown when no active group is selected.
+- Group/global behavior remains unchanged when a real active group ID is present.
+
+## Validation
+- Open chat page with no active group.
+- Confirm personal + global agents appear in the dropdown.
+- Switch to a valid active group and confirm group + global agents appear.
diff --git a/docs/explanation/fixes/PERSONAL_AGENT_USER_ID_SAVE_FIX.md b/docs/explanation/fixes/PERSONAL_AGENT_USER_ID_SAVE_FIX.md
new file mode 100644
index 00000000..32612f32
--- /dev/null
+++ b/docs/explanation/fixes/PERSONAL_AGENT_USER_ID_SAVE_FIX.md
@@ -0,0 +1,32 @@
+# Personal Agent User ID Save Fix (v0.236.050)
+
+## Issue Description
+Personal agents were saved without the `user_id` property, causing them to be missing from user-scoped queries.
+
+## Root Cause Analysis
+The save flow populated `user_id` on a sanitized copy, but persisted the unsanitized payload without `user_id`.
+
+## Version Implemented
+Fixed/Implemented in version: **0.236.050**
+
+## Technical Details
+### Files Modified
+- application/single_app/functions_personal_agents.py
+- application/single_app/config.py
+- functional_tests/test_personal_agent_user_id_saved.py
+
+### Code Changes Summary
+- Assigned `user_id` and metadata to the payload persisted to Cosmos.
+- Incremented the application version.
+
+### Testing Approach
+- Functional test validates `user_id` assignment in the save flow.
+
+## Impact Analysis
+- Personal agents now show up in user-scoped lists and queries.
+
+## Validation
+- Functional test: functional_tests/test_personal_agent_user_id_saved.py
+
+## Reference to Config Version Update
+- Version updated in application/single_app/config.py to **0.236.050**.
diff --git a/docs/explanation/fixes/STREAMING_THOUGHT_PROGRESSION_FIX.md b/docs/explanation/fixes/STREAMING_THOUGHT_PROGRESSION_FIX.md
new file mode 100644
index 00000000..c78ca3bb
--- /dev/null
+++ b/docs/explanation/fixes/STREAMING_THOUGHT_PROGRESSION_FIX.md
@@ -0,0 +1,48 @@
+# Streaming Thought Progression Fix
+
+Fixed/Implemented in version: **0.239.185**
+
+## Overview
+
+This fix restores live thought progression in the chat streaming placeholder without reintroducing the previous-message bleed-through regression.
+
+## Issue Description
+
+After the earlier stale-thought isolation work, the active streaming placeholder could stop advancing through new thought updates. Users would often see one early thought remain visible until the assistant began streaming content, even though later thought events had been recorded for the same reply.
+
+## Root Cause
+
+- The live placeholder relied on message correlation state that was not fully reset per placeholder session.
+- Pending-thought polling still grouped by the most recent message in the conversation window instead of allowing the caller to request thoughts for a specific assistant message.
+- The browser had no dedicated per-placeholder state for deduping and ordering thought updates while still blocking stale events from older messages.
+
+## Files Modified
+
+- `application/single_app/static/js/chat/chat-thoughts.js`
+- `application/single_app/static/js/chat/chat-streaming.js`
+- `application/single_app/functions_thoughts.py`
+- `application/single_app/route_backend_thoughts.py`
+- `functional_tests/test_streaming_thought_finalization.py`
+- `functional_tests/test_pending_thought_message_scoping.py`
+- `ui_tests/test_streaming_thought_progression.py`
+- `application/single_app/config.py`
+
+## Code Changes Summary
+
+- Added explicit per-placeholder reset and dedupe state for live streaming thoughts.
+- Preserved the active assistant message guard so stale thoughts from a prior reply are still ignored.
+- Added an optional `message_id` query parameter to the pending-thought API and backend helper.
+- Returned `message_id` in sanitized thought payloads so callers can verify correlation.
+- Restored live SSE emission for agent/plugin invocation thoughts instead of replaying those updates only after the stream completed.
+- Added regression coverage for browser placeholder updates and message-scoped pending thought queries.
+
+## Testing Approach
+
+- Functional test coverage validates the message-scoped pending-thought backend contract and the updated live-thought frontend hooks.
+- UI test coverage validates that the placeholder advances to the newest thought, does not retain the previous message's thought, and ignores new thought updates once response content starts streaming.
+
+## Impact Analysis
+
+- Streaming replies now keep the latest current-message thought visible until the assistant starts sending response text.
+- Reconnect and fallback callers can request pending thoughts for one assistant message instead of reading whichever message updated most recently.
+- The stale-thought isolation behavior remains in place for consecutive replies.
\ No newline at end of file
diff --git a/docs/explanation/fixes/STREAMING_THOUGHT_STALE_STATUS_FIX.md b/docs/explanation/fixes/STREAMING_THOUGHT_STALE_STATUS_FIX.md
new file mode 100644
index 00000000..7a758ce2
--- /dev/null
+++ b/docs/explanation/fixes/STREAMING_THOUGHT_STALE_STATUS_FIX.md
@@ -0,0 +1,43 @@
+# Streaming Thought Stale Status Fix
+
+## Fix Title
+Streaming thought placeholders now stay scoped to the active assistant response instead of briefly showing the previous response's final thought.
+
+## Issue Description
+In back-to-back streaming chats, the next assistant placeholder could briefly display the final status from the prior response, such as a trailing model completion thought. Users would see the wrong thought badge while the new Semantic Kernel execution was just starting.
+
+## Root Cause Analysis
+- The streaming UI started conversation-level pending-thought polling even though the streaming response already delivered live thought events over SSE.
+- That polling endpoint returns the latest recent thoughts for the conversation, so during the startup gap before the new response wrote its first thought, the client could receive the previous message's final thought.
+- The streaming thought renderer updated a temporary assistant placeholder using a broad temp-message lookup instead of an explicitly tracked active streaming target.
+
+## Version Implemented
+Fixed in version: **0.239.181**
+
+## Files Modified
+| File | Change |
+|------|--------|
+| `application/single_app/static/js/chat/chat-streaming.js` | Removed streaming-mode reliance on pending-thought polling and bound live thought updates to the active temporary assistant placeholder |
+| `application/single_app/static/js/chat/chat-thoughts.js` | Added per-stream thought session tracking and exact placeholder targeting for streaming thought renders |
+| `application/single_app/route_backend_chats.py` | Added `message_id` to streaming thought SSE payloads so live thought events carry stable assistant-message identity |
+| `functional_tests/test_streaming_thought_finalization.py` | Added regression coverage for message-scoped streaming thought updates |
+| `application/single_app/config.py` | Version bump to 0.239.181 |
+
+## Code Changes Summary
+- Started an explicit streaming-thought session when a temporary assistant placeholder is created.
+- Cleared that session on completion, error, or interrupted stream paths.
+- Routed SSE thought events to the current placeholder by exact temporary message ID instead of searching for any `temp_ai_` node.
+- Tracked backend `message_id` values for live thought events and ignored mismatched thought payloads.
+- Stopped starting the conversation-level pending-thought polling flow for streaming chat responses.
+
+## Testing Approach
+- Extended `functional_tests/test_streaming_thought_finalization.py` with assertions covering message-scoped thought rendering and SSE `message_id` payloads.
+
+## Impact Analysis
+- Streaming placeholders should no longer inherit the previous response's terminal thought during quick consecutive prompts.
+- The streaming path now relies on its native SSE thought feed instead of mixing conversation-level polling into the same UI state.
+- The existing content-start guards remain in place, so live thoughts still cannot replace real streamed answer content once content begins.
+
+## Validation
+- Before: a new streaming response could begin with the prior response's final thought badge.
+- After: a new streaming response stays on its neutral placeholder until its own live thoughts arrive, and those thoughts only render on the active placeholder.
\ No newline at end of file
diff --git a/docs/explanation/release_notes.md b/docs/explanation/release_notes.md
index 09224196..51d965ee 100644
--- a/docs/explanation/release_notes.md
+++ b/docs/explanation/release_notes.md
@@ -2,6 +2,36 @@
 
 # Feature Release
 
+### **(v0.239.158)**
+
+#### Bug Fixes
+
+*   **Workspace Agent View Consistency**
+    *   Fixed personal and group workspace agent lists so table-view actions now use the same button order, making agent management behavior more predictable across both workspaces.
+    *   Fixed group workspace agent grid cards so editable group agents once again show Edit and Delete actions when the current user has permission to manage them.
+    *   Fixed personal workspace agent table layout so action buttons stay inside the table instead of overflowing past the Actions column.
+    *   (Ref: `workspace.html`, `workspace_agents.js`, `group_agents.js`, `view-utils.js`, `test_workspace_agent_views_consistency.py`)
+
+### **(v0.239.156)**
+
+#### Bug Fixes
+
+*   **MultiGPT Endpoint Key Vault Secret Storage and Foundry Fetch Reliability**
+    *   MultiGPT endpoint secrets such as API keys and service principal client secrets now move into Azure Key Vault when Key Vault secret storage is enabled, instead of remaining in saved endpoint payloads.
+    *   Endpoint fetch, test, Foundry listing, and runtime execution now resolve stored secrets server-side by endpoint ID, so reopening an endpoint no longer depends on the browser still holding plaintext credentials.
+    *   Fixed a follow-up regression in Foundry model discovery where sync fetch routes could fail with `'coroutine' object has no attribute 'token'` because async credentials were being reused in a synchronous token acquisition path.
+    *   (Ref: `functions_keyvault.py`, `functions_settings.py`, `route_backend_models.py`, `route_frontend_admin_settings.py`, `semantic_kernel_loader.py`, `foundry_agent_runtime.py`, `admin_model_endpoints.js`, `workspace_model_endpoints.js`, `test_model_endpoints_key_vault_secret_storage.py`, `test_foundry_model_fetch_sync_credentials.py`)
+
+### **(v0.239.153)**
+
+#### Bug Fixes
+
+*   **Live Tool Invocation Thoughts During Streaming**
+    *   Updated plugin thought handling so the chat can surface an immediate `Invoking Plugin.Function` thought as soon as a tool starts, instead of waiting until the tool completes.
+    *   Streaming chat now polls pending thoughts while the response is still in flight, allowing the active status badge to switch from model-sending text to the currently executing plugin call during long-running tools such as `WaitPlugin.wait`.
+    *   Completed plugin thoughts still include the richer human-readable summaries for wait, math, and generic plugin executions, and broader plugin coverage remains enabled through auto-wrapping for manifest-loaded plugins.
+    *   (Ref: `plugin_invocation_logger.py`, `plugin_invocation_thoughts.py`, `chat-thoughts.js`, `chat-streaming.js`, `logged_plugin_loader.py`, `test_logged_core_plugins.py`)
+
 ### **(v0.240.001)**
 
 #### Bug Fixes
diff --git a/functional_tests/test_admin_action_activity_log.py b/functional_tests/test_admin_action_activity_log.py
new file mode 100644
index 00000000..5530f4c1
--- /dev/null
+++ b/functional_tests/test_admin_action_activity_log.py
@@ -0,0 +1,34 @@
+# test_admin_action_activity_log.py
+#!/usr/bin/env python3
+"""
+Functional test for general admin action logging.
+Version: 0.236.017
+Implemented in: 0.236.017
+
+This test ensures a helper exists for logging general admin actions with
+admin identity fields and a description for activity log display.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_admin_action_activity_log_helper():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    log_path = os.path.join(repo_root, 'application', 'single_app', 'functions_activity_logging.py')
+    content = read_file_text(log_path)
+
+    assert 'def log_general_admin_action' in content, "Missing admin action logging helper."
+    assert "activity_type': 'admin_action'" in content, "Expected admin_action activity type."
+    assert "'admin':" in content, "Expected admin identity metadata in activity record."
+    assert "'description':" in content, "Expected description for activity display."
+
+    print("✅ Admin action activity logging helper verified.")
+
+
+if __name__ == "__main__":
+    test_admin_action_activity_log_helper()
diff --git a/functional_tests/test_agent_dropdown_scope_by_conversation_metadata.py b/functional_tests/test_agent_dropdown_scope_by_conversation_metadata.py
new file mode 100644
index 00000000..7ad3e187
--- /dev/null
+++ b/functional_tests/test_agent_dropdown_scope_by_conversation_metadata.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""
+Functional test for agent dropdown scope by conversation metadata.
+Version: 0.236.063
+Implemented in: 0.236.063
+
+This test ensures the chat agent dropdown derives scope from the active
+conversation's data-chat-type and shows all agents for new conversations.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _read_file(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _assert_metadata_scope_guard(js_text, file_label):
+    required_snippets = [
+        "data-chat-type",
+        "conversationScope",
+        "orderedAgents",
+    ]
+    missing = [snippet for snippet in required_snippets if snippet not in js_text]
+    if missing:
+        raise AssertionError(
+            f"Missing conversation metadata scope guard in {file_label}: {', '.join(missing)}"
+        )
+
+
+def test_agent_dropdown_scope_guard():
+    """Verify dropdown scope logic uses conversation metadata."""
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    chat_agents_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-agents.js",
+    )
+    chat_retry_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-retry.js",
+    )
+
+    chat_agents_js = _read_file(chat_agents_path)
+    chat_retry_js = _read_file(chat_retry_path)
+
+    _assert_metadata_scope_guard(chat_agents_js, "chat-agents.js")
+    _assert_metadata_scope_guard(chat_retry_js, "chat-retry.js")
+
+    print("✅ Agent dropdown scope uses conversation metadata")
+    return True
+
+
+if __name__ == "__main__":
+    success = test_agent_dropdown_scope_guard()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_agent_gpt_init_skips_multiendpoint.py b/functional_tests/test_agent_gpt_init_skips_multiendpoint.py
new file mode 100644
index 00000000..57acc652
--- /dev/null
+++ b/functional_tests/test_agent_gpt_init_skips_multiendpoint.py
@@ -0,0 +1,58 @@
+# test_agent_gpt_init_skips_multiendpoint.py
+#!/usr/bin/env python3
+"""
+Functional test for agent GPT init gating.
+Version: 0.236.052
+Implemented in: 0.236.052
+
+This test ensures agent requests skip multi-endpoint GPT resolution and
+default APIM deployment selection when model_deployment is not provided.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_agent_gpt_init_gating():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    chat_path = os.path.join(repo_root, "application", "single_app", "route_backend_chats.py")
+
+    chat_content = read_file_text(chat_path)
+
+    assert "Skipping multi-endpoint resolution because agent_info is provided" in chat_content, (
+        "Expected agent requests to skip multi-endpoint GPT resolution."
+    )
+    assert "Agent request without model_deployment; defaulting to first APIM deployment" in chat_content, (
+        "Expected APIM defaulting behavior for agent requests without model_deployment."
+    )
+
+    print("✅ Agent GPT init gating verified.")
+
+
+def run_tests():
+    tests = [test_agent_gpt_init_gating]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_agent_modal_model_endpoint_filtering.py b/functional_tests/test_agent_modal_model_endpoint_filtering.py
new file mode 100644
index 00000000..1083e77e
--- /dev/null
+++ b/functional_tests/test_agent_modal_model_endpoint_filtering.py
@@ -0,0 +1,64 @@
+# test_agent_modal_model_endpoint_filtering.py
+"""
+Functional test for agent modal model endpoint filtering.
+Version: 0.236.056
+Implemented in: 0.236.056
+
+This test ensures the agent modal dropdown includes non-AOAI providers for local
+agents and normalizes model IDs/display names when building the model list.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def test_agent_modal_model_endpoint_filtering():
+    """Validate agent modal dropdown logic for model endpoints."""
+    print("🔍 Validating agent modal model endpoint filtering...")
+
+    try:
+        repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+        js_path = os.path.join(
+            repo_root,
+            "application",
+            "single_app",
+            "static",
+            "js",
+            "agents_common.js",
+        )
+
+        if not os.path.exists(js_path):
+            raise FileNotFoundError(f"agents_common.js not found at {js_path}")
+
+        with open(js_path, "r", encoding="utf-8") as handle:
+            content = handle.read()
+
+        required_snippets = [
+            "agentType === 'aifoundry' && provider !== 'aifoundry'",
+            "const modelId = model.id",
+            "const displayName = model.displayName",
+            "display_name: displayName",
+        ]
+
+        missing = [snippet for snippet in required_snippets if snippet not in content]
+        if missing:
+            raise AssertionError(
+                f"Missing expected filtering/normalization snippets: {', '.join(missing)}"
+            )
+
+        print("✅ Agent modal model endpoint filtering logic present.")
+        return True
+
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+
+        traceback.print_exc()
+        return False
+
+
+if __name__ == "__main__":
+    success = test_agent_modal_model_endpoint_filtering()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_agent_modal_multiendpoint_foundry_advanced_notice.py b/functional_tests/test_agent_modal_multiendpoint_foundry_advanced_notice.py
new file mode 100644
index 00000000..e6a30cc1
--- /dev/null
+++ b/functional_tests/test_agent_modal_multiendpoint_foundry_advanced_notice.py
@@ -0,0 +1,65 @@
+# test_agent_modal_multiendpoint_foundry_advanced_notice.py
+#!/usr/bin/env python3
+"""
+Functional test for agent modal multi-endpoint and Foundry advanced notice.
+Version: 0.236.054
+Implemented in: 0.236.054
+
+This test ensures the agent modal hides custom connection fields when
+multi-endpoint model management is enabled and shows an advanced
+settings notice for Azure AI Foundry agents.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_agent_modal_multiendpoint_and_foundry_notice():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    modal_path = os.path.join(repo_root, "application", "single_app", "templates", "_agent_modal.html")
+    stepper_path = os.path.join(repo_root, "application", "single_app", "static", "js", "agent_modal_stepper.js")
+
+    modal_content = read_file_text(modal_path)
+    stepper_content = read_file_text(stepper_path)
+
+    assert "agent-custom-connection-toggle" in modal_content, "Expected custom connection toggle markup."
+    assert "settings.enable_multi_model_endpoints" in modal_content, (
+        "Expected Jinja gating for custom connection fields when multi-endpoint is enabled."
+    )
+    assert "agent-advanced-foundry-note" in modal_content, (
+        "Expected Foundry advanced settings notice in the modal."
+    )
+    assert "agent-advanced-foundry-note" in stepper_content, (
+        "Expected JS toggling for Foundry advanced settings notice."
+    )
+
+    print("✅ Agent modal multi-endpoint and Foundry advanced notice verified.")
+
+
+def run_tests():
+    tests = [test_agent_modal_multiendpoint_and_foundry_notice]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_agent_schema_full_validation.py b/functional_tests/test_agent_schema_full_validation.py
new file mode 100644
index 00000000..df1466a3
--- /dev/null
+++ b/functional_tests/test_agent_schema_full_validation.py
@@ -0,0 +1,101 @@
+# test_agent_schema_full_validation.py
+#!/usr/bin/env python3
+"""
+Functional test for full agent schema validation.
+Version: 0.236.049
+Implemented in: 0.236.049
+
+This test ensures that validate_agent uses the full Draft 7 schema
+so internal definitions resolve correctly for Foundry settings.
+"""
+
+import copy
+import os
+import sys
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'application', 'single_app'))
+
+from json_schema_validation import validate_agent
+
+
+def build_valid_foundry_agent():
+    """Build a valid Azure AI Foundry agent payload."""
+    return {
+        "id": "123e4567-e89b-12d3-a456-426614174000",
+        "user_id": "test-user-123",
+        "last_updated": "2025-01-30T00:00:00Z",
+        "name": "foundry_agent_1",
+        "display_name": "Foundry Agent",
+        "description": "Valid Foundry agent payload for schema validation.",
+        "azure_openai_gpt_endpoint": "https://example.openai.azure.com",
+        "azure_openai_gpt_deployment": "gpt-4o",
+        "azure_openai_gpt_api_version": "2024-10-01-preview",
+        "agent_type": "aifoundry",
+        "instructions": "You are a helpful test agent.",
+        "actions_to_load": [],
+        "other_settings": {
+            "azure_ai_foundry": {
+                "agent_id": "agent-123"
+            }
+        },
+        "max_completion_tokens": 2048,
+        "is_global": False,
+        "is_group": False
+    }
+
+
+def test_valid_agent_schema():
+    """Ensure valid Foundry agent passes schema validation."""
+    print("\n🔍 Testing valid Foundry agent schema validation...")
+    try:
+        agent = build_valid_foundry_agent()
+        result = validate_agent(agent)
+        if result is None:
+            print("✅ Valid Foundry agent passed schema validation.")
+            return True
+
+        print(f"❌ Validation failed unexpectedly: {result}")
+        return False
+    except Exception as exc:
+        print(f"❌ Unexpected exception during validation: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+def test_invalid_agent_missing_foundry_agent_id():
+    """Ensure missing Foundry agent_id triggers validation error."""
+    print("\n🔍 Testing Foundry agent schema validation with missing agent_id...")
+    try:
+        agent = build_valid_foundry_agent()
+        agent_missing_id = copy.deepcopy(agent)
+        agent_missing_id["other_settings"]["azure_ai_foundry"].pop("agent_id", None)
+
+        result = validate_agent(agent_missing_id)
+        if result:
+            print("✅ Missing agent_id correctly failed schema validation.")
+            return True
+
+        print("❌ Validation unexpectedly succeeded for missing agent_id.")
+        return False
+    except Exception as exc:
+        print(f"❌ Unexpected exception during validation: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+if __name__ == "__main__":
+    tests = [
+        test_valid_agent_schema,
+        test_invalid_agent_missing_foundry_agent_id
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        results.append(test())
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_agent_schema_ref_resolution.py b/functional_tests/test_agent_schema_ref_resolution.py
new file mode 100644
index 00000000..e176050e
--- /dev/null
+++ b/functional_tests/test_agent_schema_ref_resolution.py
@@ -0,0 +1,53 @@
+# test_agent_schema_ref_resolution.py
+#!/usr/bin/env python3
+"""
+Functional test for agent schema reference resolution.
+Version: 0.236.049
+Implemented in: 0.236.049
+
+This test ensures agent schema validation uses the root schema so $ref
+entries like OtherSettings resolve correctly.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_agent_schema_ref_resolution():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    validation_path = os.path.join(repo_root, "application", "single_app", "json_schema_validation.py")
+    content = read_file_text(validation_path)
+
+    assert "Draft7Validator(schema" in content, "Expected agent schema validation to use the root schema."
+    assert "RefResolver.from_schema(schema)" in content, "Expected schema ref resolver wiring."
+
+    print("✅ Agent schema ref resolution wiring verified.")
+
+
+def run_tests():
+    tests = [test_agent_schema_ref_resolution]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_agent_selection_recovery.py b/functional_tests/test_agent_selection_recovery.py
new file mode 100644
index 00000000..56d7e529
--- /dev/null
+++ b/functional_tests/test_agent_selection_recovery.py
@@ -0,0 +1,77 @@
+# test_agent_selection_recovery.py
+#!/usr/bin/env python3
+"""
+Functional test for per-user agent loading and selection safeguards.
+Version: 0.239.173
+Implemented in: 0.239.173
+
+This test ensures per-user agent loading preserves personal agents during
+global merge and invalid persisted agent selections are rejected when saved.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_agent_selection_recovery_wiring():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    loader_path = os.path.join(
+        repo_root, "application", "single_app", "semantic_kernel_loader.py"
+    )
+    agents_route_path = os.path.join(
+        repo_root, "application", "single_app", "route_backend_agents.py"
+    )
+    chats_route_path = os.path.join(
+        repo_root, "application", "single_app", "route_backend_chats.py"
+    )
+
+    loader_text = read_file_text(loader_path)
+    agents_route_text = read_file_text(agents_route_path)
+    chats_route_text = read_file_text(chats_route_path)
+
+    assert "agents_cfg = get_personal_agents(user_id)" in loader_text, (
+        "Expected semantic kernel loader to initialize candidate agents from personal agents."
+    )
+    assert "agents_cfg = []" not in loader_text.split("agents_cfg = get_personal_agents(user_id)", 1)[1][:2500], (
+        "Unexpected reset of agents_cfg after personal agents are loaded."
+    )
+    assert "Selected agent is not available for this user or scope." in agents_route_text, (
+        "Expected selected-agent endpoint to reject invalid selections."
+    )
+    assert "def _find_matching_user_selected_agent" in agents_route_text, (
+        "Expected user selected-agent matching helper in route_backend_agents.py."
+    )
+    assert "if isinstance(selected_agent_info, dict):" in chats_route_text, (
+        "Expected chat route to normalize dict-based selected_agent settings."
+    )
+
+    print("✅ Agent loading and selection wiring verified.")
+
+
+def run_tests():
+    tests = [test_agent_selection_recovery_wiring]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
\ No newline at end of file
diff --git a/functional_tests/test_ai_models_tab_embedding_image_location.py b/functional_tests/test_ai_models_tab_embedding_image_location.py
new file mode 100644
index 00000000..21f60c9e
--- /dev/null
+++ b/functional_tests/test_ai_models_tab_embedding_image_location.py
@@ -0,0 +1,46 @@
+# test_ai_models_tab_embedding_image_location.py
+#!/usr/bin/env python3
+"""
+Functional test for AI Models tab placement of embeddings and image generation sections.
+Version: 0.236.014
+Implemented in: 0.236.014
+
+This test ensures embeddings and image generation settings remain on the AI Models tab
+and are not nested inside the legacy model modal.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_ai_models_tab_embedding_image_location():
+    """Verify embeddings and image generation sections are outside legacy modal markup."""
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    template_path = os.path.join(repo_root, 'application', 'single_app', 'templates', 'admin_settings.html')
+
+    content = read_file_text(template_path)
+
+    embeddings_marker = 'id="embeddings-configuration"'
+    image_marker = 'id="image-generation-configuration"'
+    legacy_modal_marker = 'id="legacyModelSettingsModal"'
+
+    assert embeddings_marker in content, "Embeddings configuration section is missing."
+    assert image_marker in content, "Image generation configuration section is missing."
+    assert legacy_modal_marker in content, "Legacy model modal is missing."
+
+    embeddings_index = content.index(embeddings_marker)
+    image_index = content.index(image_marker)
+    legacy_modal_index = content.index(legacy_modal_marker)
+
+    assert embeddings_index < legacy_modal_index, "Embeddings section should be outside legacy modal."
+    assert image_index < legacy_modal_index, "Image generation section should be outside legacy modal."
+
+    print("✅ Embeddings and image generation sections are on the AI Models tab.")
+
+
+if __name__ == "__main__":
+    test_ai_models_tab_embedding_image_location()
diff --git a/functional_tests/test_approval_notification_routing_fix.py b/functional_tests/test_approval_notification_routing_fix.py
new file mode 100644
index 00000000..f198ceda
--- /dev/null
+++ b/functional_tests/test_approval_notification_routing_fix.py
@@ -0,0 +1,539 @@
+#!/usr/bin/env python3
+# test_approval_notification_routing_fix.py
+"""
+Functional test for approval notification routing, cleanup, and template activity logging.
+Version: 0.239.162
+Implemented in: 0.239.159
+
+This test ensures that approval requests notify submitters and reviewers,
+that reviewer pending notifications are cleared when a decision is made,
+and that agent template review outcomes notify the original submitter.
+"""
+
+import copy
+import os
+import sys
+
+from azure.cosmos import exceptions
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', 'application', 'single_app'))
+
+
+class FakeNotificationContainer:
+    """In-memory Cosmos-like container for notification tests."""
+
+    def __init__(self):
+        self.items = {}
+
+    def create_item(self, item):
+        self.items[item['id']] = copy.deepcopy(item)
+        return copy.deepcopy(item)
+
+    def upsert_item(self, item):
+        self.items[item['id']] = copy.deepcopy(item)
+        return copy.deepcopy(item)
+
+    def delete_item(self, item=None, partition_key=None):
+        item_id = item if item is not None else partition_key
+        if item_id not in self.items:
+            raise exceptions.CosmosResourceNotFoundError(message='Notification not found')
+        del self.items[item_id]
+
+    def query_items(self, query=None, parameters=None, partition_key=None, enable_cross_partition_query=False):
+        results = [copy.deepcopy(item) for item in self.items.values()]
+        parameter_map = {param['name']: param['value'] for param in (parameters or [])}
+
+        if "c.scope = 'assignment'" in (query or ''):
+            results = [item for item in results if item.get('scope') == 'assignment']
+
+        if '@notification_id' in parameter_map:
+            results = [item for item in results if item.get('id') == parameter_map['@notification_id']]
+
+        if '@user_id' in parameter_map:
+            results = [item for item in results if item.get('user_id') == parameter_map['@user_id']]
+
+        if '@group_id' in parameter_map:
+            results = [item for item in results if item.get('group_id') == parameter_map['@group_id']]
+
+        notification_types = [
+            value
+            for name, value in parameter_map.items()
+            if name.startswith('@notification_type')
+        ]
+        if notification_types:
+            results = [
+                item for item in results
+                if item.get('notification_type') in notification_types
+            ]
+
+        for metadata_key in ('approval_id', 'template_id'):
+            parameter_name = f'@metadata_{metadata_key}'
+            if parameter_name in parameter_map:
+                results = [
+                    item for item in results
+                    if item.get('metadata', {}).get(metadata_key) == parameter_map[parameter_name]
+                ]
+
+        return results
+
+
+class FakeApprovalsContainer:
+    """In-memory Cosmos-like container for approval documents."""
+
+    def __init__(self):
+        self.items = {}
+
+    def create_item(self, body=None, **kwargs):
+        item = body or kwargs.get('item')
+        self.items[item['id']] = copy.deepcopy(item)
+        return copy.deepcopy(item)
+
+    def upsert_item(self, item):
+        self.items[item['id']] = copy.deepcopy(item)
+        return copy.deepcopy(item)
+
+    def read_item(self, item=None, partition_key=None):
+        if item not in self.items:
+            raise exceptions.CosmosResourceNotFoundError(message='Approval not found')
+        stored = self.items[item]
+        if partition_key != stored.get('group_id'):
+            raise exceptions.CosmosResourceNotFoundError(message='Approval partition mismatch')
+        return copy.deepcopy(stored)
+
+
+class FakeTemplateContainer:
+    """In-memory Cosmos-like container for agent template documents."""
+
+    def __init__(self):
+        self.items = {}
+
+    def upsert_item(self, item):
+        self.items[item['id']] = copy.deepcopy(item)
+        return copy.deepcopy(item)
+
+    def read_item(self, item=None, partition_key=None):
+        if item not in self.items:
+            raise exceptions.CosmosResourceNotFoundError(message='Template not found')
+        stored = self.items[item]
+        if partition_key != stored.get('id'):
+            raise exceptions.CosmosResourceNotFoundError(message='Template partition mismatch')
+        return copy.deepcopy(stored)
+
+    def delete_item(self, item=None, partition_key=None):
+        if item not in self.items:
+            raise exceptions.CosmosResourceNotFoundError(message='Template not found')
+        del self.items[item]
+
+
+class FakeActivityLogsContainer:
+    """In-memory Cosmos-like container for activity log tests."""
+
+    def __init__(self):
+        self.items = {}
+
+    def create_item(self, body=None, **kwargs):
+        item = body or kwargs.get('item')
+        self.items[item['id']] = copy.deepcopy(item)
+        return copy.deepcopy(item)
+
+
+def _notification_types(container, metadata_key, metadata_value):
+    return sorted([
+        item.get('notification_type')
+        for item in container.items.values()
+        if item.get('metadata', {}).get(metadata_key) == metadata_value
+    ])
+
+
+def _notifications(container, metadata_key, metadata_value):
+    return [
+        copy.deepcopy(item)
+        for item in container.items.values()
+        if item.get('metadata', {}).get(metadata_key) == metadata_value
+    ]
+
+
+def _activity_logs(container, activity_type):
+    return [
+        copy.deepcopy(item)
+        for item in container.items.values()
+        if item.get('activity_type') == activity_type
+    ]
+
+
+def test_standard_approval_notifications_and_cleanup():
+    """Verify submitter/admin notifications and cleanup for standard approvals."""
+    print('🔍 Testing standard approval notification lifecycle...')
+
+    import functions_approvals
+    import functions_notifications
+
+    notification_container = FakeNotificationContainer()
+    approval_container = FakeApprovalsContainer()
+    group_doc = {
+        'id': 'group-1',
+        'name': 'Operations Group',
+        'owner': {
+            'id': 'group-owner-1',
+            'email': 'owner@example.com',
+            'displayName': 'Group Owner'
+        }
+    }
+
+    originals = {
+        'notification_container': functions_notifications.cosmos_notifications_container,
+        'approval_container': functions_approvals.cosmos_approvals_container,
+        'find_group_by_id': functions_approvals.find_group_by_id,
+        'approvals_log_event': functions_approvals.log_event,
+    }
+
+    functions_notifications.cosmos_notifications_container = notification_container
+    functions_approvals.cosmos_approvals_container = approval_container
+    functions_approvals.find_group_by_id = lambda group_id: copy.deepcopy(group_doc) if group_id == group_doc['id'] else None
+    functions_approvals.log_event = lambda *args, **kwargs: None
+
+    try:
+        approved_request = functions_approvals.create_approval_request(
+            request_type=functions_approvals.TYPE_DELETE_GROUP,
+            group_id='group-1',
+            requester_id='requester-1',
+            requester_email='requester@example.com',
+            requester_name='Requester One',
+            reason='Please remove this unused group.',
+            metadata={'entity_type': 'group'}
+        )
+
+        pending_types = _notification_types(notification_container, 'approval_id', approved_request['id'])
+        if pending_types.count('approval_request_pending') != 1 or pending_types.count('approval_request_pending_submitter') != 1:
+            print(f'❌ Unexpected pending notification set: {pending_types}')
+            return False
+
+        functions_approvals.approve_request(
+            approval_id=approved_request['id'],
+            group_id='group-1',
+            approver_id='admin-1',
+            approver_email='admin@example.com',
+            approver_name='Admin Reviewer',
+            comment='Looks good.'
+        )
+
+        approved_types = _notification_types(notification_container, 'approval_id', approved_request['id'])
+        if 'approval_request_pending' in approved_types:
+            print(f'❌ Pending admin notification was not cleared after approval: {approved_types}')
+            return False
+        if 'approval_request_approved' not in approved_types:
+            print(f'❌ Approved notification missing after approval: {approved_types}')
+            return False
+
+        denied_request = functions_approvals.create_approval_request(
+            request_type=functions_approvals.TYPE_DELETE_DOCUMENTS,
+            group_id='group-1',
+            requester_id='requester-2',
+            requester_email='requester2@example.com',
+            requester_name='Requester Two',
+            reason='Clear legacy documents.',
+            metadata={'entity_type': 'group'}
+        )
+
+        functions_approvals.deny_request(
+            approval_id=denied_request['id'],
+            group_id='group-1',
+            denier_id='admin-2',
+            denier_email='admin2@example.com',
+            denier_name='Admin Denier',
+            comment='Need more details.',
+            auto_denied=False
+        )
+
+        denied_types = _notification_types(notification_container, 'approval_id', denied_request['id'])
+        if 'approval_request_pending' in denied_types:
+            print(f'❌ Pending admin notification was not cleared after denial: {denied_types}')
+            return False
+        if 'approval_request_denied' not in denied_types:
+            print(f'❌ Denied notification missing after denial: {denied_types}')
+            return False
+
+        denied_notifications = _notifications(notification_container, 'approval_id', denied_request['id'])
+        denied_message = next(
+            (
+                item.get('message', '')
+                for item in denied_notifications
+                if item.get('notification_type') == 'approval_request_denied'
+            ),
+            ''
+        )
+        if 'Need more details.' not in denied_message:
+            print(f'❌ Denied approval notification did not include reason: {denied_message}')
+            return False
+
+        print('✅ Standard approvals notify submitters and clear reviewer pending notifications')
+        return True
+    finally:
+        functions_notifications.cosmos_notifications_container = originals['notification_container']
+        functions_approvals.cosmos_approvals_container = originals['approval_container']
+        functions_approvals.find_group_by_id = originals['find_group_by_id']
+        functions_approvals.log_event = originals['approvals_log_event']
+
+
+def test_agent_template_review_notifications_and_cleanup():
+    """Verify template review notifications for approve, reject, and delete paths."""
+    print('🔍 Testing agent template approval notification lifecycle...')
+
+    import functions_agent_templates
+    import functions_activity_logging
+    import functions_notifications
+
+    notification_container = FakeNotificationContainer()
+    template_container = FakeTemplateContainer()
+    activity_container = FakeActivityLogsContainer()
+
+    originals = {
+        'notification_container': functions_notifications.cosmos_notifications_container,
+        'template_container': functions_agent_templates.cosmos_agent_templates_container,
+        'template_log_event': functions_agent_templates.log_event,
+        'activity_container': functions_activity_logging.cosmos_activity_logs_container,
+        'activity_log_event': functions_activity_logging.log_event,
+    }
+
+    functions_notifications.cosmos_notifications_container = notification_container
+    functions_agent_templates.cosmos_agent_templates_container = template_container
+    functions_agent_templates.log_event = lambda *args, **kwargs: None
+    functions_activity_logging.cosmos_activity_logs_container = activity_container
+    functions_activity_logging.log_event = lambda *args, **kwargs: None
+
+    submitter = {
+        'userId': 'template-user-1',
+        'email': 'template-user@example.com',
+        'displayName': 'Template Submitter'
+    }
+    admin = {
+        'userId': 'template-admin-1',
+        'email': 'template-admin@example.com',
+        'displayName': 'Template Admin'
+    }
+
+    try:
+        approved_template = functions_agent_templates.create_agent_template(
+            payload={
+                'title': 'Agent One',
+                'display_name': 'Agent One',
+                'description': 'Test agent for approval.',
+                'instructions': 'Always be helpful.',
+                'source_scope': 'personal'
+            },
+            user_info=submitter,
+            auto_approve=False
+        )
+
+        initial_types = _notification_types(notification_container, 'template_id', approved_template['id'])
+        if initial_types.count('agent_template_pending_admin') != 1 or initial_types.count('agent_template_pending_submitter') != 1:
+            print(f'❌ Unexpected pending template notifications: {initial_types}')
+            return False
+        if not _activity_logs(activity_container, 'agent_template_submission'):
+            print('❌ Template submission activity log missing')
+            return False
+
+        functions_agent_templates.approve_agent_template(approved_template['id'], admin, notes='Approved for gallery.')
+        approved_types = _notification_types(notification_container, 'template_id', approved_template['id'])
+        if 'agent_template_pending_admin' in approved_types:
+            print(f'❌ Pending admin template notification not cleared after approval: {approved_types}')
+            return False
+        if 'agent_template_approved' not in approved_types:
+            print(f'❌ Approved template notification missing: {approved_types}')
+            return False
+        approval_logs = _activity_logs(activity_container, 'agent_template_approval')
+        if not approval_logs:
+            print('❌ Template approval activity log missing')
+            return False
+
+        rejected_template = functions_agent_templates.create_agent_template(
+            payload={
+                'title': 'Agent Two',
+                'display_name': 'Agent Two',
+                'description': 'Test agent for rejection.',
+                'instructions': 'Never leak secrets.',
+                'source_scope': 'personal'
+            },
+            user_info=submitter,
+            auto_approve=False
+        )
+
+        functions_agent_templates.reject_agent_template(
+            rejected_template['id'],
+            admin,
+            reason='Needs clearer instructions.',
+            notes='Please simplify the prompt.'
+        )
+        rejected_types = _notification_types(notification_container, 'template_id', rejected_template['id'])
+        if 'agent_template_pending_admin' in rejected_types:
+            print(f'❌ Pending admin template notification not cleared after rejection: {rejected_types}')
+            return False
+        if 'agent_template_rejected' not in rejected_types:
+            print(f'❌ Rejected template notification missing: {rejected_types}')
+            return False
+
+        rejected_notifications = _notifications(notification_container, 'template_id', rejected_template['id'])
+        rejected_message = next(
+            (
+                item.get('message', '')
+                for item in rejected_notifications
+                if item.get('notification_type') == 'agent_template_rejected'
+            ),
+            ''
+        )
+        if 'Needs clearer instructions.' not in rejected_message:
+            print(f'❌ Rejected template notification did not include reason: {rejected_message}')
+            return False
+        rejection_logs = _activity_logs(activity_container, 'agent_template_rejection')
+        if not rejection_logs:
+            print('❌ Template rejection activity log missing')
+            return False
+        if rejection_logs[-1].get('review_reason') != 'Needs clearer instructions.':
+            print(f"❌ Template rejection activity log missing review reason: {rejection_logs[-1]}")
+            return False
+
+        deleted_template = functions_agent_templates.create_agent_template(
+            payload={
+                'title': 'Agent Three',
+                'display_name': 'Agent Three',
+                'description': 'Test agent for deletion.',
+                'instructions': 'Be concise.',
+                'source_scope': 'personal'
+            },
+            user_info=submitter,
+            auto_approve=False
+        )
+
+        deleted = functions_agent_templates.delete_agent_template(deleted_template['id'], actor_info=admin)
+        if not deleted:
+            print('❌ Expected template deletion to succeed')
+            return False
+
+        deleted_types = _notification_types(notification_container, 'template_id', deleted_template['id'])
+        if 'agent_template_pending_admin' in deleted_types:
+            print(f'❌ Pending admin template notification not cleared after deletion: {deleted_types}')
+            return False
+        if 'agent_template_deleted' not in deleted_types:
+            print(f'❌ Deleted template notification missing: {deleted_types}')
+            return False
+        if not _activity_logs(activity_container, 'agent_template_deletion'):
+            print('❌ Template deletion activity log missing')
+            return False
+
+        print('✅ Agent template review notifications route to submitters and clear stale admin pending notices')
+        return True
+    finally:
+        functions_notifications.cosmos_notifications_container = originals['notification_container']
+        functions_agent_templates.cosmos_agent_templates_container = originals['template_container']
+        functions_agent_templates.log_event = originals['template_log_event']
+        functions_activity_logging.cosmos_activity_logs_container = originals['activity_container']
+        functions_activity_logging.log_event = originals['activity_log_event']
+
+
+def test_notification_display_backfills_rejection_reasons_from_metadata():
+    """Verify notification reads append reasons for older generic rejection messages."""
+    print('🔍 Testing notification display fallback for rejection reasons...')
+
+    import functions_notifications
+    import functions_group
+    import functions_public_workspaces
+
+    notification_container = FakeNotificationContainer()
+    notification_container.create_item({
+        'id': 'approval-denied-legacy',
+        'user_id': 'legacy-user',
+        'group_id': None,
+        'public_workspace_id': None,
+        'scope': 'personal',
+        'notification_type': 'approval_request_denied',
+        'title': 'Request Denied',
+        'message': 'Your request was denied by break glass.',
+        'created_at': '2026-03-25T15:00:00+00:00',
+        'ttl': 100,
+        'read_by': [],
+        'dismissed_by': [],
+        'link_url': '/approvals',
+        'link_context': {'approval_id': 'approval-legacy'},
+        'metadata': {
+            'approval_id': 'approval-legacy',
+            'comment': 'Testing the rejection reason in notifications'
+        },
+        'assignment': None
+    })
+    notification_container.create_item({
+        'id': 'template-rejected-legacy',
+        'user_id': 'legacy-user',
+        'group_id': None,
+        'public_workspace_id': None,
+        'scope': 'personal',
+        'notification_type': 'agent_template_rejected',
+        'title': 'Template Declined: pa-gle',
+        'message': "Your template 'pa-gle' was declined by break glass.",
+        'created_at': '2026-03-25T15:01:00+00:00',
+        'ttl': 100,
+        'read_by': [],
+        'dismissed_by': [],
+        'link_url': '/workspace',
+        'link_context': {'template_id': 'template-legacy'},
+        'metadata': {
+            'template_id': 'template-legacy',
+            'rejection_reason': 'Testing the rejection reason in notifications'
+        },
+        'assignment': None
+    })
+
+    originals = {
+        'notification_container': functions_notifications.cosmos_notifications_container,
+        'get_user_groups': functions_group.get_user_groups,
+        'get_user_public_workspaces': functions_public_workspaces.get_user_public_workspaces,
+    }
+
+    functions_notifications.cosmos_notifications_container = notification_container
+    functions_group.get_user_groups = lambda user_id: []
+    functions_public_workspaces.get_user_public_workspaces = lambda user_id: []
+
+    try:
+        result = functions_notifications.get_user_notifications(
+            user_id='legacy-user',
+            page=1,
+            per_page=20,
+            include_read=True,
+            include_dismissed=False,
+            user_roles=[]
+        )
+        notifications = {item['id']: item for item in result['notifications']}
+
+        approval_message = notifications['approval-denied-legacy']['message']
+        if 'Testing the rejection reason in notifications' not in approval_message:
+            print(f'❌ Approval denial display message missing reason fallback: {approval_message}')
+            return False
+
+        template_message = notifications['template-rejected-legacy']['message']
+        if 'Testing the rejection reason in notifications' not in template_message:
+            print(f'❌ Template rejection display message missing reason fallback: {template_message}')
+            return False
+
+        print('✅ Notification display backfills rejection reasons from metadata')
+        return True
+    finally:
+        functions_notifications.cosmos_notifications_container = originals['notification_container']
+        functions_group.get_user_groups = originals['get_user_groups']
+        functions_public_workspaces.get_user_public_workspaces = originals['get_user_public_workspaces']
+
+
+if __name__ == '__main__':
+    tests = [
+        test_standard_approval_notifications_and_cleanup,
+        test_agent_template_review_notifications_and_cleanup,
+        test_notification_display_backfills_rejection_reasons_from_metadata,
+    ]
+
+    results = []
+    for test in tests:
+        print(f'\n🧪 Running {test.__name__}...')
+        results.append(test())
+
+    success = all(results)
+    print(f'\n📊 Results: {sum(results)}/{len(results)} tests passed')
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_azure_di_diagnostics.py b/functional_tests/test_azure_di_diagnostics.py
index d736f880..58b04cea 100644
--- a/functional_tests/test_azure_di_diagnostics.py
+++ b/functional_tests/test_azure_di_diagnostics.py
@@ -176,7 +176,7 @@ def test_azure_di_api_call():
             try:
                 os.unlink(test_pdf_path)
                 print(f"✅ Cleaned up test file: {test_pdf_path}")
-            except:
+            except Exception as ex:
                 pass
         
     except Exception as e:
diff --git a/functional_tests/test_backend_agents_swagger_integration.py b/functional_tests/test_backend_agents_swagger_integration.py
index 5bb4ed3e..d8f518d8 100644
--- a/functional_tests/test_backend_agents_swagger_integration.py
+++ b/functional_tests/test_backend_agents_swagger_integration.py
@@ -129,7 +129,7 @@ def test_backend_agents_swagger_integration():
                         security_count += 1
                         print(f"  ✅ Security configured for authentication")
                         break
-                except:
+                except Exception as ex:
                     pass
         
         if security_count > 0:
diff --git a/functional_tests/test_backend_chats_swagger_integration.py b/functional_tests/test_backend_chats_swagger_integration.py
index 9d18721e..60d22550 100644
--- a/functional_tests/test_backend_chats_swagger_integration.py
+++ b/functional_tests/test_backend_chats_swagger_integration.py
@@ -103,7 +103,7 @@ def test_backend_chats_swagger_integration():
                         security_count += 1
                         print(f"  ✅ Security configured for authentication")
                         break
-                except:
+                except Exception as ex:
                     pass
         
         if security_count > 0:
diff --git a/functional_tests/test_chat_model_description_tooltip.py b/functional_tests/test_chat_model_description_tooltip.py
new file mode 100644
index 00000000..b510302f
--- /dev/null
+++ b/functional_tests/test_chat_model_description_tooltip.py
@@ -0,0 +1,31 @@
+# test_chat_model_description_tooltip.py
+#!/usr/bin/env python3
+"""
+Functional test for chat model description tooltip.
+Version: 0.236.023
+Implemented in: 0.236.023
+
+This test ensures multi-endpoint model options include a title attribute
+that can display the model description on hover.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_chat_model_description_tooltip():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    template_path = os.path.join(repo_root, 'application', 'single_app', 'templates', 'chats.html')
+    content = read_file_text(template_path)
+
+    assert 'title="{{ model.description or model.display_name }}"' in content, "Model tooltip title missing in chat model select."
+
+    print("✅ Chat model description tooltip verified.")
+
+
+if __name__ == "__main__":
+    test_chat_model_description_tooltip()
diff --git a/functional_tests/test_chat_stream_background_execution.py b/functional_tests/test_chat_stream_background_execution.py
index 9ec9c8f6..c6263b05 100644
--- a/functional_tests/test_chat_stream_background_execution.py
+++ b/functional_tests/test_chat_stream_background_execution.py
@@ -2,12 +2,13 @@
 # test_chat_stream_background_execution.py
 """
 Functional test for chat stream background execution.
-Version: 0.239.143
+Version: 0.239.185
 Implemented in: 0.239.129
 
 This test ensures that the streaming chat route runs its SSE generator through
 background execution so chat completion can continue after the browser leaves
-the page, while still streaming live events to an attached consumer.
+the page, while still streaming live events to an attached consumer and any
+later reattached consumer.
 """
 
 import sys
@@ -26,7 +27,7 @@ def assert_contains(file_path: Path, expected: str) -> None:
         raise AssertionError(f"Expected to find {expected!r} in {file_path}")
 
 
-def test_chat_stream_background_execution() -> bool:
+def test_chat_stream_background_execution() -> None:
     print("Testing chat stream background execution...")
 
     assert_contains(ROUTE_FILE, "class BackgroundStreamBridge:")
@@ -34,21 +35,24 @@ def test_chat_stream_background_execution() -> bool:
     assert_contains(ROUTE_FILE, "executor = current_app.extensions.get('executor')")
     assert_contains(ROUTE_FILE, "executor.submit(stream_worker)")
     assert_contains(ROUTE_FILE, "worker_thread = threading.Thread(target=stream_worker, daemon=True)")
-    assert_contains(ROUTE_FILE, "for event in event_generator_factory():")
+    assert_contains(ROUTE_FILE, "def publish_background_event(event_text):")
+    assert_contains(ROUTE_FILE, "event_iterator = event_generator_factory(")
+    assert_contains(ROUTE_FILE, "for event in event_iterator:")
     assert_contains(ROUTE_FILE, "stream_bridge.detach_consumer()")
-    assert_contains(ROUTE_FILE, "return build_background_stream_response(generate_compatibility_response)")
-    assert_contains(ROUTE_FILE, "return build_background_stream_response(generate)")
+    assert_contains(ROUTE_FILE, "CHAT_STREAM_REGISTRY = ActiveConversationStreamRegistry()")
+    assert_contains(ROUTE_FILE, "return build_background_stream_response(generate_compatibility_response, stream_session=stream_session)")
+    assert_contains(ROUTE_FILE, "return build_background_stream_response(generate, stream_session=stream_session)")
 
-    assert_contains(CONFIG_FILE, 'VERSION = "0.239.143"')
+    assert_contains(CONFIG_FILE, 'VERSION = "0.239.185"')
     assert_contains(FIX_DOC_FILE, "Fixed/Implemented in version: **0.239.129**")
 
     print("Chat stream background execution checks passed!")
-    return True
 
 
 if __name__ == "__main__":
     try:
-        success = test_chat_stream_background_execution()
+        test_chat_stream_background_execution()
+        success = True
     except Exception as exc:
         print(f"Test failed: {exc}")
         import traceback
diff --git a/functional_tests/test_chat_stream_compatibility_sse_syntax.py b/functional_tests/test_chat_stream_compatibility_sse_syntax.py
index c49bd45d..6474c132 100644
--- a/functional_tests/test_chat_stream_compatibility_sse_syntax.py
+++ b/functional_tests/test_chat_stream_compatibility_sse_syntax.py
@@ -2,7 +2,7 @@
 # test_chat_stream_compatibility_sse_syntax.py
 """
 Functional test for chat stream compatibility SSE syntax.
-Version: 0.239.143
+Version: 0.239.185
 Implemented in: 0.239.134
 
 This test ensures that the streaming chat route compiles successfully and that
@@ -26,7 +26,7 @@ def assert_contains(file_path: Path, expected: str) -> None:
         raise AssertionError(f"Expected to find {expected!r} in {file_path}")
 
 
-def test_chat_stream_compatibility_sse_syntax() -> bool:
+def test_chat_stream_compatibility_sse_syntax() -> None:
     print("Testing chat stream compatibility SSE syntax...")
 
     source = ROUTE_FILE.read_text(encoding="utf-8")
@@ -36,16 +36,16 @@ def test_chat_stream_compatibility_sse_syntax() -> bool:
     assert_contains(ROUTE_FILE, "image_request_event = {")
     assert_contains(ROUTE_FILE, "image_ready_event = {")
     assert_contains(ROUTE_FILE, 'yield f"data: {json.dumps(image_prompt_event)}\\n\\n"')
-    assert_contains(CONFIG_FILE, 'VERSION = "0.239.143"')
+    assert_contains(CONFIG_FILE, 'VERSION = "0.239.185"')
     assert_contains(FIX_DOC_FILE, "Fixed/Implemented in version: **0.239.134**")
 
     print("Chat stream compatibility SSE syntax checks passed!")
-    return True
 
 
 if __name__ == "__main__":
     try:
-        success = test_chat_stream_compatibility_sse_syntax()
+        test_chat_stream_compatibility_sse_syntax()
+        success = True
     except Exception as exc:
         print(f"Test failed: {exc}")
         import traceback
diff --git a/functional_tests/test_chat_stream_debug_logging.py b/functional_tests/test_chat_stream_debug_logging.py
index 396bb774..c28fced0 100644
--- a/functional_tests/test_chat_stream_debug_logging.py
+++ b/functional_tests/test_chat_stream_debug_logging.py
@@ -2,7 +2,7 @@
 # test_chat_stream_debug_logging.py
 """
 Functional test for chat stream debug logging.
-Version: 0.239.143
+Version: 0.239.185
 Implemented in: 0.239.142
 
 This test ensures that the streaming chat route retains unconditional
@@ -25,7 +25,7 @@ def assert_contains(file_path: Path, expected: str) -> None:
         raise AssertionError(f"Expected to find {expected!r} in {file_path}")
 
 
-def test_chat_stream_debug_logging() -> bool:
+def test_chat_stream_debug_logging() -> None:
     print("Testing chat stream debug logging markers...")
 
     assert_contains(ROUTE_FILE, '[Streaming] Incoming /api/chat/stream request | ')
@@ -34,18 +34,17 @@ def test_chat_stream_debug_logging() -> bool:
     assert_contains(ROUTE_FILE, '[Streaming] Cleared plugin invocations for user_id=')
     assert_contains(ROUTE_FILE, '[Streaming] Selected response path | ')
     assert_contains(ROUTE_FILE, '[Streaming][Plugin Callback] Registering callback for key=')
-    assert_contains(ROUTE_FILE, '[Streaming][Plugin Callback] Received invocation ')
     assert_contains(ROUTE_FILE, '[Streaming][Plugin Callback] Deregistered callback after successful stream for key=')
     assert_contains(ROUTE_FILE, '[Streaming] Finalizing stream response | ')
-    assert_contains(CONFIG_FILE, 'VERSION = "0.239.143"')
+    assert_contains(CONFIG_FILE, 'VERSION = "0.239.185"')
 
     print("Chat stream debug logging checks passed!")
-    return True
 
 
 if __name__ == "__main__":
     try:
-        success = test_chat_stream_debug_logging()
+        test_chat_stream_debug_logging()
+        success = True
     except Exception as exc:
         print(f"Test failed: {exc}")
         import traceback
diff --git a/functional_tests/test_chat_stream_heartbeat_reattach.py b/functional_tests/test_chat_stream_heartbeat_reattach.py
new file mode 100644
index 00000000..417f0239
--- /dev/null
+++ b/functional_tests/test_chat_stream_heartbeat_reattach.py
@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+# test_chat_stream_heartbeat_reattach.py
+"""
+Functional test for chat stream heartbeat and reattach support.
+Version: 0.239.185
+Implemented in: 0.239.183
+
+This test ensures long-running chat streams emit keep-alive heartbeat frames,
+register replayable in-flight sessions for reconnecting consumers through the
+shared app cache, and that the chat UI attempts to reattach when a user
+reopens an active conversation.
+"""
+
+import sys
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+ROUTE_FILE = ROOT / "application" / "single_app" / "route_backend_chats.py"
+APP_CACHE_FILE = ROOT / "application" / "single_app" / "app_settings_cache.py"
+STREAMING_FILE = ROOT / "application" / "single_app" / "static" / "js" / "chat" / "chat-streaming.js"
+CONVERSATIONS_FILE = ROOT / "application" / "single_app" / "static" / "js" / "chat" / "chat-conversations.js"
+CONFIG_FILE = ROOT / "application" / "single_app" / "config.py"
+FIX_DOC_FILE = ROOT / "docs" / "explanation" / "fixes" / "CHAT_STREAM_HEARTBEAT_REATTACH_FIX.md"
+
+
+def assert_contains(file_path: Path, expected: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if expected not in content:
+        raise AssertionError(f"Expected to find {expected!r} in {file_path}")
+
+
+def assert_not_contains(file_path: Path, forbidden: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if forbidden in content:
+        raise AssertionError(f"Did not expect to find {forbidden!r} in {file_path}")
+
+
+def test_chat_stream_heartbeat_and_reattach() -> None:
+    print("Testing chat stream heartbeat and reattach support...")
+
+    assert_contains(ROUTE_FILE, "yield ': keep-alive\\n\\n'")
+    assert_contains(ROUTE_FILE, "class ActiveConversationStreamSession:")
+    assert_contains(ROUTE_FILE, "CHAT_STREAM_REGISTRY = ActiveConversationStreamRegistry()")
+    assert_contains(ROUTE_FILE, "@app.route('/api/chat/stream/status/<conversation_id>', methods=['GET'])")
+    assert_contains(ROUTE_FILE, "@app.route('/api/chat/stream/reattach/<conversation_id>', methods=['GET'])")
+    assert_contains(ROUTE_FILE, "stream_with_context(stream_session.iter_events())")
+    assert_contains(ROUTE_FILE, "import app_settings_cache")
+    assert_contains(ROUTE_FILE, "app_settings_cache.initialize_stream_session_cache(")
+    assert_contains(ROUTE_FILE, "app_settings_cache.append_stream_session_event(")
+    assert_contains(ROUTE_FILE, "app_settings_cache.get_stream_session_events(")
+
+    assert_contains(APP_CACHE_FILE, "APP_STREAM_SESSION_METADATA = {}")
+    assert_contains(APP_CACHE_FILE, "APP_STREAM_SESSION_EVENTS = {}")
+    assert_contains(APP_CACHE_FILE, "def initialize_stream_session_cache_redis(cache_key, metadata, ttl_seconds=None):")
+    assert_contains(APP_CACHE_FILE, "def append_stream_session_event_redis(cache_key, event_text, ttl_seconds=None):")
+    assert_contains(APP_CACHE_FILE, "def get_stream_session_events_mem(cache_key, start_index=0):")
+
+    assert_contains(STREAMING_FILE, "export async function reattachStreamingConversation(conversationId)")
+    assert_contains(STREAMING_FILE, "fetch(`/api/chat/stream/status/${conversationId}`")
+    assert_contains(STREAMING_FILE, "fetch(`/api/chat/stream/reattach/${conversationId}`")
+    assert_not_contains(STREAMING_FILE, "5 * 60 * 1000")
+
+    assert_contains(CONVERSATIONS_FILE, "await loadMessages(conversationId);")
+    assert_contains(CONVERSATIONS_FILE, "await streamingModule.reattachStreamingConversation(conversationId);")
+
+    assert_contains(CONFIG_FILE, 'VERSION = "0.239.185"')
+    assert_contains(FIX_DOC_FILE, "Fixed/Implemented in version: **0.239.183**")
+    assert_contains(FIX_DOC_FILE, "Redis-backed session metadata and event replay")
+
+    print("Chat stream heartbeat and reattach checks passed!")
+
+
+if __name__ == "__main__":
+    try:
+        test_chat_stream_heartbeat_and_reattach()
+        success = True
+    except Exception as exc:
+        print(f"Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        success = False
+
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_chat_tagging_and_endpoint_provider_visibility.py b/functional_tests/test_chat_tagging_and_endpoint_provider_visibility.py
new file mode 100644
index 00000000..25b2b4e4
--- /dev/null
+++ b/functional_tests/test_chat_tagging_and_endpoint_provider_visibility.py
@@ -0,0 +1,105 @@
+# test_chat_tagging_and_endpoint_provider_visibility.py
+#!/usr/bin/env python3
+"""
+Functional test for chat tagging and endpoint provider visibility.
+Version: 0.239.177
+Implemented in: 0.239.177
+
+This test ensures supported New Foundry endpoints are exposed to user-facing
+endpoint payloads, streaming group-agent conversations preserve group
+metadata, personal conversations no longer render visible tags, the active
+conversation header shows the full group name, and the sidebar shows the first
+8 characters of the group name.
+"""
+
+import os
+import sys
+
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _read_text(relative_path):
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    with open(os.path.join(repo_root, relative_path), "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def test_endpoint_provider_visibility_guard() -> None:
+    """Verify supported endpoint providers are exposed to frontend flows."""
+    print("🔍 Testing endpoint provider visibility guard...")
+
+    try:
+        settings_text = _read_text("application/single_app/functions_settings.py")
+
+        required_snippets = [
+            "def is_frontend_visible_model_endpoint_provider(provider):",
+            'return normalized_provider in {"aoai", "aifoundry", "new_foundry"}',
+            'if not is_frontend_visible_model_endpoint_provider(endpoint.get("provider")):',
+            'if is_frontend_visible_model_endpoint_provider(endpoint.get("provider")):',
+        ]
+
+        missing = [snippet for snippet in required_snippets if snippet not in settings_text]
+        if missing:
+            raise AssertionError(f"Missing endpoint visibility snippets: {', '.join(missing)}")
+
+        print("✅ Frontend endpoint provider filtering is wired")
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        raise
+
+
+def test_group_agent_tagging_and_personal_badge_removal() -> None:
+    """Verify group-agent metadata survives streaming and UI tags render correctly."""
+    print("🔍 Testing group-agent tagging and personal badge removal...")
+
+    try:
+        chat_conversations_text = _read_text("application/single_app/static/js/chat/chat-conversations.js")
+        chat_details_text = _read_text("application/single_app/static/js/chat/chat-conversation-details.js")
+        chat_sidebar_text = _read_text("application/single_app/static/js/chat/chat-sidebar-conversations.js")
+        chat_backend_text = _read_text("application/single_app/route_backend_chats.py")
+
+        required_snippets = [
+            'selected_agent=agent_name_used if use_agent_streaming else None',
+            'selected_agent_details=selected_agent_metadata if use_agent_streaming else None',
+            'return normalizedName.slice(0, 8);',
+            "groupBadge.textContent = (groupName || 'group').trim() || 'group';",
+            "badge.textContent = getShortGroupLabel(groupName);",
+            'return `<span class="badge bg-info" title="${escapeHtml(groupName)}">${escapeHtml(groupName)}</span>`;',
+            "return '<span class=\"text-muted\">personal</span>';",
+        ]
+        missing = [
+            snippet
+            for snippet in required_snippets
+            if snippet not in f"{chat_conversations_text}\n{chat_details_text}\n{chat_sidebar_text}\n{chat_backend_text}"
+        ]
+        if missing:
+            raise AssertionError(f"Missing tagging snippets: {', '.join(missing)}")
+
+        if 'badge.textContent = \'personal\'' in chat_sidebar_text:
+            raise AssertionError("Personal conversations still render a visible personal badge in the sidebar")
+
+        print("✅ Group-agent metadata and conversation tag rendering are wired correctly")
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        raise
+
+
+if __name__ == "__main__":
+    tests = [
+        test_endpoint_provider_visibility_guard,
+        test_group_agent_tagging_and_personal_badge_removal,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        results.append(test())
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(tests)} tests passed")
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_chat_toolbar_layout.py b/functional_tests/test_chat_toolbar_layout.py
new file mode 100644
index 00000000..f377f1d3
--- /dev/null
+++ b/functional_tests/test_chat_toolbar_layout.py
@@ -0,0 +1,76 @@
+# test_chat_toolbar_layout.py
+#!/usr/bin/env python3
+"""
+Functional test for chat toolbar layout separation.
+Version: 0.239.170
+Implemented in: 0.239.170
+
+This test ensures the chat selectors and toggle buttons remain separate sibling
+groups, stay aligned on wide layouts, and switch to clean full-width toolbar
+rows before overlap occurs on narrower layouts.
+"""
+
+import os
+import re
+import sys
+
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _read_text(relative_path):
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    with open(os.path.join(repo_root, relative_path), "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def test_chat_toolbar_groups_are_responsive_without_overlap():
+    """Verify the toolbar layout has both desktop and medium-width guardrails."""
+    print("🔍 Testing chat toolbar group alignment...")
+
+    try:
+        template_text = _read_text("application/single_app/templates/chats.html")
+        css_text = _read_text("application/single_app/static/css/chats.css")
+
+        structure_pattern = re.compile(
+            r'<div class="chat-toolbar-controls">.*?<div class="chat-toolbar-selectors">.*?</div>\s*<div class="chat-toolbar-toggles">',
+            re.DOTALL,
+        )
+
+        if not structure_pattern.search(template_text):
+            print("❌ Chat toolbar selectors and toggles are not separate sibling groups")
+            return False
+
+        required_css_snippets = [
+            ".chat-toolbar {",
+            "flex-wrap: nowrap;",
+            "align-items: flex-end;",
+            ".chat-toolbar-controls {",
+            "flex-wrap: nowrap;",
+            "align-items: flex-end;",
+            ".chat-toolbar-toggles {",
+            ".chat-toolbar-selectors {",
+            "@media (max-width: 1200px) {",
+            "flex: 1 1 100%;",
+            "justify-content: flex-start;",
+            "@media (max-width: 768px) {",
+        ]
+
+        missing_css = [snippet for snippet in required_css_snippets if snippet not in css_text]
+        if missing_css:
+            print(f"❌ Missing toolbar layout CSS snippets: {', '.join(missing_css)}")
+            return False
+
+        print("✅ Chat toolbar selectors and toggles remain aligned without medium-width overlap")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+        traceback.print_exc()
+        return False
+
+
+if __name__ == "__main__":
+    success = test_chat_toolbar_groups_are_responsive_without_overlap()
+    print(f"\n📊 Results: {1 if success else 0}/1 tests passed")
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_chat_type_normalization.py b/functional_tests/test_chat_type_normalization.py
new file mode 100644
index 00000000..dec83b6e
--- /dev/null
+++ b/functional_tests/test_chat_type_normalization.py
@@ -0,0 +1,88 @@
+#!/usr/bin/env python3
+"""
+Functional test for chat type normalization.
+Version: 0.236.065
+Implemented in: 0.236.065
+
+This test ensures new conversations are marked with chat_type "new" and
+personal conversations normalize to "personal_single_user" across the UI
+and backend metadata paths.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _read_file(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _assert_contains(text, snippet, file_label):
+    if snippet not in text:
+        raise AssertionError(f"Missing '{snippet}' in {file_label}")
+
+
+def test_chat_type_normalization():
+    """Verify chat_type normalization is wired across UI and backend."""
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+
+    js_conversations_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-conversations.js",
+    )
+    js_details_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-conversation-details.js",
+    )
+    backend_conversations_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "route_backend_conversations.py",
+    )
+    backend_chats_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "route_backend_chats.py",
+    )
+    metadata_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "functions_conversation_metadata.py",
+    )
+
+    js_conversations = _read_file(js_conversations_path)
+    js_details = _read_file(js_details_path)
+    backend_conversations = _read_file(backend_conversations_path)
+    backend_chats = _read_file(backend_chats_path)
+    metadata = _read_file(metadata_path)
+
+    _assert_contains(js_conversations, 'chat_type: "new"', "chat-conversations.js")
+    _assert_contains(js_conversations, 'personal_single_user', "chat-conversations.js")
+    _assert_contains(js_details, 'personal_single_user', "chat-conversation-details.js")
+    _assert_contains(backend_conversations, "personal_single_user", "route_backend_conversations.py")
+    _assert_contains(backend_chats, "personal_single_user", "route_backend_chats.py")
+    _assert_contains(metadata, "personal_single_user", "functions_conversation_metadata.py")
+
+    print("✅ Chat type normalization verified")
+    return True
+
+
+if __name__ == "__main__":
+    success = test_chat_type_normalization()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_control_center_token_filters.py b/functional_tests/test_control_center_token_filters.py
new file mode 100644
index 00000000..fd01fd92
--- /dev/null
+++ b/functional_tests/test_control_center_token_filters.py
@@ -0,0 +1,133 @@
+# test_control_center_token_filters.py
+"""
+Functional test for Control Center token filters.
+Version: 0.239.164
+Implemented in: 0.239.164
+
+This test ensures that the Control Center token filters are wired through the
+backend APIs, dashboard template, and client-side request handling.
+"""
+
+from pathlib import Path
+import sys
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+
+if str(APP_DIR) not in sys.path:
+    sys.path.insert(0, str(APP_DIR))
+
+
+def read_text(relative_path: str) -> str:
+    """Read a repository file as UTF-8 text."""
+    return (ROOT / relative_path).read_text(encoding="utf-8")
+
+
+def test_backend_token_filter_routes_and_helpers_present() -> bool:
+    """Validate the control center backend exposes token filter support."""
+    print("Testing control center token filter backend wiring...")
+    backend_content = read_text("application/single_app/route_backend_control_center.py")
+
+    required_snippets = [
+        "/api/admin/control-center/token-filters",
+        "def extract_token_filters(source):",
+        "def append_token_usage_filters(query_conditions, parameters, token_filters):",
+        "def build_token_usage_query_context(start_date, end_date, token_filters=None):",
+        "token_filters = extract_token_filters(request.args)",
+        "token_filters = extract_token_filters(data)",
+        "c.usage.model = @token_model",
+        "c.workspace_context.group_id = @token_group_id",
+        "c.workspace_context.public_workspace_id = @token_public_workspace_id"
+    ]
+
+    for snippet in required_snippets:
+        if snippet not in backend_content:
+            print(f"Missing backend snippet: {snippet}")
+            return False
+
+    print("Backend token filter support found.")
+    return True
+
+
+def test_control_center_template_contains_token_filter_controls() -> bool:
+    """Validate the dashboard template includes token filter controls."""
+    print("Testing control center token filter template controls...")
+    template_content = read_text("application/single_app/templates/control_center.html")
+
+    required_ids = [
+        'id="tokenUserFilter"',
+        'id="tokenWorkspaceTypeFilter"',
+        'id="tokenGroupFilter"',
+        'id="tokenPublicWorkspaceFilter"',
+        'id="tokenModelFilter"',
+        'id="tokenTypeFilter"',
+        'id="tokenApplyFiltersBtn"',
+        'id="tokenResetFiltersBtn"'
+    ]
+
+    for element_id in required_ids:
+        if element_id not in template_content:
+            print(f"Missing template element: {element_id}")
+            return False
+
+    print("Template token filter controls found.")
+    return True
+
+
+def test_control_center_javascript_wires_token_filter_requests() -> bool:
+    """Validate the client script loads and forwards token filters."""
+    print("Testing control center token filter JavaScript wiring...")
+    js_content = read_text("application/single_app/static/js/control-center.js")
+
+    required_snippets = [
+        "this.tokenFilters = this.getDefaultTokenFilters();",
+        "loadTokenFilterOptions()",
+        "getTokenFilterRequestPayload()",
+        "applyTokenFilters()",
+        "resetTokenFilters()",
+        "syncTokenFiltersFromControls()",
+        "params.append(key, value);",
+        "exportData.token_filters = tokenFilters;",
+        "chatData.token_filters = tokenFilters;",
+        "'/api/admin/control-center/token-filters'"
+    ]
+
+    for snippet in required_snippets:
+        if snippet not in js_content:
+            print(f"Missing JavaScript snippet: {snippet}")
+            return False
+
+    print("JavaScript token filter wiring found.")
+    return True
+
+
+def test_config_version_bumped_for_token_filters() -> bool:
+    """Validate the repository version bump for the feature."""
+    print("Testing config version bump...")
+    config_content = read_text("application/single_app/config.py")
+
+    if 'VERSION = "0.239.164"' not in config_content:
+        print("Config version was not bumped to 0.239.164")
+        return False
+
+    print("Config version bump found.")
+    return True
+
+
+if __name__ == "__main__":
+    checks = [
+        test_backend_token_filter_routes_and_helpers_present,
+        test_control_center_template_contains_token_filter_controls,
+        test_control_center_javascript_wires_token_filter_requests,
+        test_config_version_bumped_for_token_filters,
+    ]
+
+    results = []
+    for check in checks:
+        print(f"\nRunning {check.__name__}...")
+        results.append(check())
+
+    success = all(results)
+    print(f"\nResults: {sum(results)}/{len(results)} checks passed")
+    raise SystemExit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_conversation_metrics.py b/functional_tests/test_conversation_metrics.py
index ad53b9a2..ecce9161 100644
--- a/functional_tests/test_conversation_metrics.py
+++ b/functional_tests/test_conversation_metrics.py
@@ -61,7 +61,7 @@ def test_conversation_metrics_structure():
     try:
         date_obj = datetime.fromisoformat(last_updated.replace('Z', '+00:00'))
         last_day_conversation = date_obj.strftime('%m/%d/%Y')
-    except:
+    except Exception as ex:
         last_day_conversation = 'Invalid date'
     
     print(f"   - Most Recent Conversation: {last_day_conversation}")
@@ -126,7 +126,7 @@ def test_date_formatting():
             try:
                 date_obj = datetime.fromisoformat(test_date.replace('Z', '+00:00'))
                 result = date_obj.strftime('%m/%d/%Y')
-            except:
+            except Exception as ex:
                 result = 'Invalid date'
         
         print(f"   Result: {result}")
diff --git a/functional_tests/test_custom_endpoint_settings_migration.py b/functional_tests/test_custom_endpoint_settings_migration.py
new file mode 100644
index 00000000..1c8fde52
--- /dev/null
+++ b/functional_tests/test_custom_endpoint_settings_migration.py
@@ -0,0 +1,87 @@
+# test_custom_endpoint_settings_migration.py
+"""
+Functional test for custom endpoint settings migration.
+Version: 0.236.058
+Implemented in: 0.236.058
+
+This test ensures legacy custom endpoint settings are migrated to the new
+workspace-scoped flags and kept in sync.
+"""
+
+import os
+import sys
+
+repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+sys.path.append(repo_root)
+
+from application.single_app.functions_settings import apply_custom_endpoint_setting_migration
+
+
+def test_custom_endpoint_settings_migration_from_legacy():
+    """Ensure legacy custom endpoint flags migrate to new settings."""
+    print("🔍 Validating custom endpoint settings migration...")
+
+    settings = {
+        "allow_user_custom_agent_endpoints": True,
+        "allow_group_custom_agent_endpoints": False
+    }
+
+    updated = apply_custom_endpoint_setting_migration(settings)
+
+    assert updated is True
+    assert settings["allow_user_custom_endpoints"] is True
+    assert settings["allow_group_custom_endpoints"] is False
+    assert settings["allow_user_custom_agent_endpoints"] is True
+    assert settings["allow_group_custom_agent_endpoints"] is False
+
+    print("✅ Custom endpoint settings migration passed.")
+
+
+def test_custom_endpoint_settings_migration_syncs_legacy():
+    """Ensure legacy flags stay in sync with new settings."""
+    print("🔍 Validating legacy flag sync for custom endpoints...")
+
+    settings = {
+        "allow_user_custom_endpoints": False,
+        "allow_group_custom_endpoints": True,
+        "allow_user_custom_agent_endpoints": True,
+        "allow_group_custom_agent_endpoints": False
+    }
+
+    updated = apply_custom_endpoint_setting_migration(settings)
+
+    assert updated is True
+    assert settings["allow_user_custom_agent_endpoints"] is False
+    assert settings["allow_group_custom_agent_endpoints"] is True
+
+    print("✅ Legacy flag sync passed.")
+
+
+def run_tests():
+    tests = [
+        test_custom_endpoint_settings_migration_from_legacy,
+        test_custom_endpoint_settings_migration_syncs_legacy
+    ]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    success = run_tests()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_default_model_selection_fallback.py b/functional_tests/test_default_model_selection_fallback.py
new file mode 100644
index 00000000..c6558632
--- /dev/null
+++ b/functional_tests/test_default_model_selection_fallback.py
@@ -0,0 +1,74 @@
+# test_default_model_selection_fallback.py
+#!/usr/bin/env python3
+"""
+Functional test for default model selection fallback.
+Version: 0.236.053
+Implemented in: 0.236.053
+
+This test ensures default model selection is surfaced in admin settings
+and used for fallback GPT initialization when agent requests omit model info.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_default_model_selection_wiring():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    admin_template_path = os.path.join(
+        repo_root, "application", "single_app", "templates", "admin_settings.html"
+    )
+    admin_route_path = os.path.join(
+        repo_root, "application", "single_app", "route_frontend_admin_settings.py"
+    )
+    chat_path = os.path.join(
+        repo_root, "application", "single_app", "route_backend_chats.py"
+    )
+
+    admin_template = read_file_text(admin_template_path)
+    admin_route = read_file_text(admin_route_path)
+    chat_route = read_file_text(chat_path)
+
+    assert "default_model_selection_json" in admin_template, (
+        "Expected default model selection input in admin settings template."
+    )
+    assert "default-model-selection" in admin_template, (
+        "Expected default model selection dropdown in admin settings template."
+    )
+    assert "default_model_selection" in admin_route, (
+        "Expected default model selection to be handled in admin settings save." 
+    )
+    assert "resolve_default_model_gpt_config" in chat_route, (
+        "Expected default model fallback logic in chat route."
+    )
+
+    print("✅ Default model selection wiring verified.")
+
+
+def run_tests():
+    tests = [test_default_model_selection_wiring]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_document_metadata_update_activity_logging.py b/functional_tests/test_document_metadata_update_activity_logging.py
index 16af038a..f29768f5 100644
--- a/functional_tests/test_document_metadata_update_activity_logging.py
+++ b/functional_tests/test_document_metadata_update_activity_logging.py
@@ -220,7 +220,7 @@ def test_metadata_update_logging():
                 partition_key=test_user_id
             )
             print("✓ Test document deleted")
-        except:
+        except Exception as ex:
             print("⚠️  Test document already deleted or not found")
         
         # Delete all activity logs for test user
@@ -230,7 +230,7 @@ def test_metadata_update_logging():
                     item=log['id'],
                     partition_key=log['user_id']
                 )
-            except:
+            except Exception as ex:
                 pass
         print("✓ Activity logs cleaned up")
         
diff --git a/functional_tests/test_document_metrics_database_queries.py b/functional_tests/test_document_metrics_database_queries.py
index c661a751..b5fba265 100644
--- a/functional_tests/test_document_metrics_database_queries.py
+++ b/functional_tests/test_document_metrics_database_queries.py
@@ -85,10 +85,10 @@ def test_document_metrics_queries():
                 # Try different date formats
                 try:
                     dt = datetime.fromisoformat(last_updated.replace('Z', '+00:00'))
-                except:
+                except Exception as ex:
                     try:
                         dt = datetime.strptime(last_updated, '%Y-%m-%d')
-                    except:
+                    except Exception as ex:
                         dt = datetime.strptime(last_updated, '%Y-%m-%dT%H:%M:%S')
             else:
                 dt = last_updated
diff --git a/functional_tests/test_document_metrics_implementation_verification.py b/functional_tests/test_document_metrics_implementation_verification.py
index e8583041..a7c2a303 100644
--- a/functional_tests/test_document_metrics_implementation_verification.py
+++ b/functional_tests/test_document_metrics_implementation_verification.py
@@ -147,10 +147,10 @@ def validate_date_format():
                 # Try different date formats
                 try:
                     dt = datetime.fromisoformat(test_date.replace('Z', '+00:00'))
-                except:
+                except Exception as ex:
                     try:
                         dt = datetime.strptime(test_date, '%Y-%m-%d')
-                    except:
+                    except Exception as ex:
                         dt = datetime.strptime(test_date, '%Y-%m-%dT%H:%M:%S')
             
             formatted = dt.strftime('%m/%d/%Y')
diff --git a/functional_tests/test_document_upload_fix.py b/functional_tests/test_document_upload_fix.py
index e97f2be1..e38d13f7 100644
--- a/functional_tests/test_document_upload_fix.py
+++ b/functional_tests/test_document_upload_fix.py
@@ -122,7 +122,7 @@ def test_azure_di_api_parameters():
             # Clean up temp file
             try:
                 os.unlink(temp_file_path)
-            except:
+            except Exception as ex:
                 pass
                 
     except ImportError as e:
diff --git a/functional_tests/test_document_upload_traceback_shadow_fix.py b/functional_tests/test_document_upload_traceback_shadow_fix.py
new file mode 100644
index 00000000..6283a441
--- /dev/null
+++ b/functional_tests/test_document_upload_traceback_shadow_fix.py
@@ -0,0 +1,121 @@
+# test_document_upload_traceback_shadow_fix.py
+"""
+Functional test for document upload traceback shadowing fix.
+Version: 0.239.165
+Implemented in: 0.239.165
+
+This test ensures PDF and DOCX upload processing no longer shadows the traceback
+module inside process_di_document, which previously caused upload failures when
+exception handling tried to call traceback.format_exc().
+"""
+
+import ast
+import os
+import sys
+
+
+FUNCTIONS_DOCUMENTS_PATH = os.path.join(
+    os.path.dirname(os.path.abspath(__file__)),
+    "..",
+    "application",
+    "single_app",
+    "functions_documents.py",
+)
+
+
+def _load_module_ast():
+    with open(FUNCTIONS_DOCUMENTS_PATH, "r", encoding="utf-8") as source_file:
+        return ast.parse(source_file.read(), filename=FUNCTIONS_DOCUMENTS_PATH)
+
+
+def test_traceback_import_is_module_scoped():
+    """Verify traceback is imported at module scope for functions_documents."""
+    print("🔍 Checking module-level traceback import...")
+
+    try:
+        module_ast = _load_module_ast()
+        has_module_import = any(
+            isinstance(node, ast.Import)
+            and any(alias.name == "traceback" for alias in node.names)
+            for node in module_ast.body
+        )
+
+        if not has_module_import:
+            print("❌ Module-level 'import traceback' not found")
+            return False
+
+        print("✅ Module-level 'import traceback' found")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        traceback_module = __import__("traceback")
+        traceback_module.print_exc()
+        return False
+
+
+def test_process_di_document_has_no_local_traceback_import():
+    """Verify process_di_document no longer defines traceback as a local name."""
+    print("🔍 Checking process_di_document for local traceback imports...")
+
+    try:
+        module_ast = _load_module_ast()
+        process_di_document_node = next(
+            (
+                node
+                for node in module_ast.body
+                if isinstance(node, ast.FunctionDef) and node.name == "process_di_document"
+            ),
+            None,
+        )
+
+        if process_di_document_node is None:
+            print("❌ process_di_document function not found")
+            return False
+
+        local_traceback_imports = [
+            node
+            for node in ast.walk(process_di_document_node)
+            if isinstance(node, ast.Import)
+            and any(alias.name == "traceback" for alias in node.names)
+        ]
+
+        if local_traceback_imports:
+            print("❌ Found function-local 'import traceback' in process_di_document")
+            return False
+
+        uses_traceback_format_exc = any(
+            isinstance(node, ast.Call)
+            and isinstance(node.func, ast.Attribute)
+            and isinstance(node.func.value, ast.Name)
+            and node.func.value.id == "traceback"
+            and node.func.attr == "format_exc"
+            for node in ast.walk(process_di_document_node)
+        )
+
+        if not uses_traceback_format_exc:
+            print("❌ process_di_document no longer calls traceback.format_exc(); expected regression guard missing")
+            return False
+
+        print("✅ process_di_document uses traceback.format_exc() without local shadowing")
+        return True
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        traceback_module = __import__("traceback")
+        traceback_module.print_exc()
+        return False
+
+
+if __name__ == "__main__":
+    tests = [
+        test_traceback_import_is_module_scoped,
+        test_process_di_document_has_no_local_traceback_import,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        results.append(test())
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_dual_foundry_agent_support.py b/functional_tests/test_dual_foundry_agent_support.py
new file mode 100644
index 00000000..331fef30
--- /dev/null
+++ b/functional_tests/test_dual_foundry_agent_support.py
@@ -0,0 +1,197 @@
+# test_dual_foundry_agent_support.py
+#!/usr/bin/env python3
+"""
+Functional test for dual Foundry agent support.
+Version: 0.239.154
+Implemented in: 0.239.154
+
+This test ensures that classic Foundry and new Foundry agent payloads both
+validate through the backend sanitizer, preserve separate settings, and that
+runtime/modal code paths include explicit support for the new_foundry type.
+"""
+
+import os
+import sys
+
+REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+APP_ROOT = os.path.join(REPO_ROOT, "application", "single_app")
+
+sys.path.append(APP_ROOT)
+
+from functions_agent_payload import AgentPayloadError, sanitize_agent_payload
+from json_schema_validation import validate_agent
+
+
+def read_file_text(*relative_parts):
+    file_path = os.path.join(REPO_ROOT, *relative_parts)
+    with open(file_path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def test_classic_foundry_payload_still_validates():
+    """Classic Foundry payloads should remain valid and isolated."""
+    print("🔍 Testing classic Foundry payload validation...")
+
+    payload = {
+        "id": "123e4567-e89b-12d3-a456-426614174000",
+        "name": "classic_foundry_agent",
+        "display_name": "Classic Foundry Agent",
+        "description": "Classic Foundry path",
+        "instructions": "Managed in Foundry",
+        "agent_type": "aifoundry",
+        "actions_to_load": ["pluginA"],
+        "enable_agent_gpt_apim": True,
+        "azure_openai_gpt_endpoint": "https://example.services.ai.azure.com",
+        "azure_openai_gpt_deployment": "sc-aifoundry",
+        "azure_openai_gpt_api_version": "v1",
+        "other_settings": {
+            "azure_ai_foundry": {
+                "agent_id": "asst_123",
+                "endpoint_id": "classic-endpoint"
+            }
+        },
+        "max_completion_tokens": 4096,
+    }
+
+    cleaned = sanitize_agent_payload(payload)
+    validation_error = validate_agent(cleaned)
+
+    assert cleaned["agent_type"] == "aifoundry"
+    assert cleaned["actions_to_load"] == []
+    assert cleaned["enable_agent_gpt_apim"] is False
+    assert cleaned["other_settings"]["azure_ai_foundry"]["agent_id"] == "asst_123"
+    assert "new_foundry" not in cleaned["other_settings"]
+    assert validation_error is None, validation_error
+    print("✅ Classic Foundry payload validation passed.")
+
+
+def test_new_foundry_payload_validates_and_stays_separate():
+    """New Foundry payloads should sanitize and validate independently."""
+    print("🔍 Testing new Foundry payload validation...")
+
+    payload = {
+        "id": "123e4567-e89b-12d3-a456-426614174001",
+        "name": "new_foundry_agent",
+        "display_name": "New Foundry Agent",
+        "description": "New Foundry path",
+        "instructions": "Managed in Foundry",
+        "agent_type": "new_foundry",
+        "actions_to_load": ["pluginA", "pluginB"],
+        "enable_agent_gpt_apim": True,
+        "azure_openai_gpt_endpoint": "https://nadoyle-foundry.services.ai.azure.com",
+        "azure_openai_gpt_deployment": "sc-aifoundry",
+        "azure_openai_gpt_api_version": "2025-11-15-preview",
+        "other_settings": {
+            "new_foundry": {
+                "application_id": "new-foundry-agent-not-openai:3",
+                "application_name": "new-foundry-agent-not-openai",
+                "application_version": "3",
+                "endpoint_id": "new-foundry-endpoint",
+                "responses_api_version": "2025-11-15-preview",
+                "activity_api_version": "2025-11-15-preview",
+                "notes": "phase-1 validation"
+            }
+        },
+        "max_completion_tokens": 4096,
+    }
+
+    cleaned = sanitize_agent_payload(payload)
+    validation_error = validate_agent(cleaned)
+
+    assert cleaned["agent_type"] == "new_foundry"
+    assert cleaned["actions_to_load"] == []
+    assert cleaned["enable_agent_gpt_apim"] is False
+    assert cleaned["other_settings"]["new_foundry"]["application_id"] == "new-foundry-agent-not-openai:3"
+    assert cleaned["other_settings"]["new_foundry"]["responses_api_version"] == "2025-11-15-preview"
+    assert "azure_ai_foundry" not in cleaned["other_settings"]
+    assert validation_error is None, validation_error
+    print("✅ New Foundry payload validation passed.")
+
+
+def test_new_foundry_requires_application_reference():
+    """New Foundry payloads should fail without an application reference."""
+    print("🔍 Testing new Foundry application reference requirement...")
+
+    payload = {
+        "id": "123e4567-e89b-12d3-a456-426614174002",
+        "name": "missing_new_foundry_app",
+        "display_name": "Missing New Foundry App",
+        "description": "Invalid new Foundry payload",
+        "instructions": "Managed in Foundry",
+        "agent_type": "new_foundry",
+        "actions_to_load": [],
+        "azure_openai_gpt_endpoint": "https://nadoyle-foundry.services.ai.azure.com",
+        "azure_openai_gpt_deployment": "sc-aifoundry",
+        "azure_openai_gpt_api_version": "2025-11-15-preview",
+        "other_settings": {
+            "new_foundry": {
+                "responses_api_version": "2025-11-15-preview"
+            }
+        },
+        "max_completion_tokens": 4096,
+    }
+
+    try:
+        sanitize_agent_payload(payload)
+    except AgentPayloadError as exc:
+        assert "application" in str(exc).lower()
+        print("✅ Missing New Foundry application reference correctly rejected.")
+        return
+
+    raise AssertionError("Expected AgentPayloadError for missing New Foundry application reference")
+
+
+def test_dual_foundry_runtime_and_modal_hooks_exist():
+    """Runtime, loader, and modal files should include explicit dual Foundry support hooks."""
+    print("🔍 Verifying runtime and modal support hooks...")
+
+    runtime_content = read_file_text("application", "single_app", "foundry_agent_runtime.py")
+    loader_content = read_file_text("application", "single_app", "semantic_kernel_loader.py")
+    modal_js_content = read_file_text("application", "single_app", "static", "js", "agent_modal_stepper.js")
+    modal_html_content = read_file_text("application", "single_app", "templates", "_agent_modal.html")
+
+    required_snippets = [
+        (runtime_content, "class AzureAIFoundryNewChatCompletionAgent"),
+        (runtime_content, "execute_new_foundry_agent"),
+        (loader_content, 'if agent_type in {"aifoundry", "new_foundry"}:'),
+        (loader_content, '("aoai", "aifoundry", "new_foundry")'),
+        (modal_js_content, "selectedAgentType === 'new_foundry'"),
+        (modal_js_content, "getAgentTypeLabel"),
+        (modal_html_content, 'value="new_foundry"'),
+        (modal_html_content, "agent-new-foundry-application-id"),
+    ]
+
+    missing = [snippet for content, snippet in required_snippets if snippet not in content]
+    if missing:
+        raise AssertionError(f"Missing expected dual Foundry support hooks: {', '.join(missing)}")
+
+    print("✅ Runtime, loader, and modal hooks verified.")
+
+
+def run_tests():
+    tests = [
+        test_classic_foundry_payload_still_validates,
+        test_new_foundry_payload_validates_and_stays_separate,
+        test_new_foundry_requires_application_reference,
+        test_dual_foundry_runtime_and_modal_hooks_exist,
+    ]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_endpoints_tab_order_visibility.py b/functional_tests/test_endpoints_tab_order_visibility.py
new file mode 100644
index 00000000..7fdc0fdd
--- /dev/null
+++ b/functional_tests/test_endpoints_tab_order_visibility.py
@@ -0,0 +1,95 @@
+# test_endpoints_tab_order_visibility.py
+#!/usr/bin/env python3
+"""
+Functional test for workspace/group endpoints tab order and visibility.
+Version: 0.236.046
+Implemented in: 0.236.046
+
+This test ensures endpoints tabs appear after actions and are gated by admin
+custom endpoint settings.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_workspace_endpoints_tab_order_visibility():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    template_path = os.path.join(repo_root, "application", "single_app", "templates", "workspace.html")
+    content = read_file_text(template_path)
+
+    agents_idx = content.find('id="agents-tab-btn"')
+    actions_idx = content.find('id="plugins-tab-btn"')
+    endpoints_idx = content.find('id="endpoints-tab-btn"')
+
+    assert agents_idx != -1, "Agents tab button missing in workspace template."
+    assert actions_idx != -1, "Actions tab button missing in workspace template."
+    assert endpoints_idx != -1, "Endpoints tab button missing in workspace template."
+    assert agents_idx < actions_idx < endpoints_idx, "Workspace tab order should be Agents -> Actions -> Endpoints."
+
+    actions_pane_idx = content.find('id="plugins-tab"')
+    endpoints_pane_idx = content.find('id="endpoints-tab"')
+    assert actions_pane_idx != -1, "Actions tab pane missing in workspace template."
+    assert endpoints_pane_idx != -1, "Endpoints tab pane missing in workspace template."
+    assert actions_pane_idx < endpoints_pane_idx, "Endpoints tab pane should appear after actions pane."
+
+    assert "settings.allow_user_custom_agent_endpoints" in content, "Workspace endpoints should be gated by custom endpoint settings."
+
+    print("✅ Workspace endpoints tab order and visibility verified.")
+
+
+def test_group_endpoints_tab_order_visibility():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    template_path = os.path.join(repo_root, "application", "single_app", "templates", "group_workspaces.html")
+    content = read_file_text(template_path)
+
+    agents_idx = content.find('id="group-agents-tab-btn"')
+    actions_idx = content.find('id="group-plugins-tab-btn"')
+    endpoints_idx = content.find('id="group-endpoints-tab-btn"')
+
+    assert agents_idx != -1, "Group agents tab button missing in group workspace template."
+    assert actions_idx != -1, "Group actions tab button missing in group workspace template."
+    assert endpoints_idx != -1, "Group endpoints tab button missing in group workspace template."
+    assert agents_idx < actions_idx < endpoints_idx, "Group tab order should be Agents -> Actions -> Endpoints."
+
+    actions_pane_idx = content.find('id="group-plugins-tab"')
+    endpoints_pane_idx = content.find('id="group-endpoints-tab"')
+    assert actions_pane_idx != -1, "Group actions tab pane missing in group workspace template."
+    assert endpoints_pane_idx != -1, "Group endpoints tab pane missing in group workspace template."
+    assert actions_pane_idx < endpoints_pane_idx, "Group endpoints tab pane should appear after actions pane."
+
+    assert "settings.allow_group_custom_agent_endpoints" in content, "Group endpoints should be gated by custom endpoint settings."
+
+    print("✅ Group endpoints tab order and visibility verified.")
+
+
+def run_tests():
+    tests = [
+        test_workspace_endpoints_tab_order_visibility,
+        test_group_endpoints_tab_order_visibility
+    ]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_foundry_agent_endpoint_resolution.py b/functional_tests/test_foundry_agent_endpoint_resolution.py
new file mode 100644
index 00000000..6dd613c6
--- /dev/null
+++ b/functional_tests/test_foundry_agent_endpoint_resolution.py
@@ -0,0 +1,58 @@
+# test_foundry_agent_endpoint_resolution.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry agent endpoint resolution enrichment.
+Version: 0.236.051
+Implemented in: 0.236.051
+
+This test ensures Foundry agent endpoint configuration is enriched with
+project_name and supports endpoint_id fallback when model_endpoint_id is missing.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_foundry_agent_endpoint_resolution_enrichment():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    loader_path = os.path.join(repo_root, "application", "single_app", "semantic_kernel_loader.py")
+
+    loader_content = read_file_text(loader_path)
+
+    assert "foundry_settings[\"project_name\"]" in loader_content, (
+        "Expected Foundry settings to include project_name enrichment."
+    )
+    assert "foundry_settings.get(\"endpoint_id\")" in loader_content, (
+        "Expected endpoint_id fallback to be available in Foundry resolution."
+    )
+
+    print("✅ Foundry agent endpoint resolution enrichment verified.")
+
+
+def run_tests():
+    tests = [test_foundry_agent_endpoint_resolution_enrichment]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_foundry_agent_list_async_paging.py b/functional_tests/test_foundry_agent_list_async_paging.py
new file mode 100644
index 00000000..649a240d
--- /dev/null
+++ b/functional_tests/test_foundry_agent_list_async_paging.py
@@ -0,0 +1,53 @@
+# test_foundry_agent_list_async_paging.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry agent list async paging handling.
+Version: 0.236.047
+Implemented in: 0.236.047
+
+This test ensures Foundry agent listing avoids awaiting AsyncItemPaged
+and iterates async results safely.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_foundry_agent_list_async_paging():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    runtime_path = os.path.join(repo_root, "application", "single_app", "foundry_agent_runtime.py")
+    content = read_file_text(runtime_path)
+
+    assert "async for item in result" in content, "Expected async iteration over agent list results."
+    assert "return agents_client.list_agents()" in content, "list_agents should not be awaited."
+
+    print("✅ Foundry agent list async paging handling verified.")
+
+
+def run_tests():
+    tests = [test_foundry_agent_list_async_paging]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_foundry_agent_list_project_endpoint.py b/functional_tests/test_foundry_agent_list_project_endpoint.py
new file mode 100644
index 00000000..c49e9fb3
--- /dev/null
+++ b/functional_tests/test_foundry_agent_list_project_endpoint.py
@@ -0,0 +1,56 @@
+# test_foundry_agent_list_project_endpoint.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry agent list project endpoint resolution.
+Version: 0.236.048
+Implemented in: 0.236.048
+
+This test ensures project names are used to append /api/projects/<name>
+when listing Foundry agents.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_foundry_agent_list_project_endpoint_resolution():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    runtime_path = os.path.join(repo_root, "application", "single_app", "foundry_agent_runtime.py")
+    models_path = os.path.join(repo_root, "application", "single_app", "route_backend_models.py")
+
+    runtime_content = read_file_text(runtime_path)
+    models_content = read_file_text(models_path)
+
+    assert "project_name" in models_content, "Expected Foundry settings to include project_name."
+    assert "/api/projects/" in runtime_content, "Expected endpoint normalization to include /api/projects/."
+
+    print("✅ Foundry agent list project endpoint resolution verified.")
+
+
+def run_tests():
+    tests = [test_foundry_agent_list_project_endpoint_resolution]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_foundry_chat_scope_resolution.py b/functional_tests/test_foundry_chat_scope_resolution.py
new file mode 100644
index 00000000..a40c9199
--- /dev/null
+++ b/functional_tests/test_foundry_chat_scope_resolution.py
@@ -0,0 +1,34 @@
+# test_foundry_chat_scope_resolution.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry chat scope resolution.
+Version: 0.236.030
+Implemented in: 0.236.030
+
+This test ensures multi-endpoint chat inference uses cloud-aware Foundry scopes.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_foundry_chat_scope_resolution():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    backend_path = os.path.join(repo_root, 'application', 'single_app', 'route_backend_chats.py')
+    content = read_file_text(backend_path)
+
+    assert "def resolve_foundry_scope_for_auth" in content, "Missing Foundry scope resolver for chat routes."
+    assert "https://ai.azure.com/.default" in content, "Expected public Foundry scope constant."
+    assert "https://ai.azure.us/.default" in content, "Expected government Foundry scope constant."
+    assert "foundry_scope" in content, "Expected custom Foundry scope override field."
+    assert "Multi-endpoint SP scope" in content, "Expected Foundry scope debug logging for service principal."
+
+    print("✅ Foundry chat scope resolution verified.")
+
+
+if __name__ == "__main__":
+    test_foundry_chat_scope_resolution()
diff --git a/functional_tests/test_foundry_deployment_disabled_filter.py b/functional_tests/test_foundry_deployment_disabled_filter.py
new file mode 100644
index 00000000..188b2965
--- /dev/null
+++ b/functional_tests/test_foundry_deployment_disabled_filter.py
@@ -0,0 +1,31 @@
+# test_foundry_deployment_disabled_filter.py
+#!/usr/bin/env python3
+"""
+Functional test for filtering disabled deployments in model discovery.
+Version: 0.236.025
+Implemented in: 0.236.025
+
+This test ensures deployment provisioning state filtering exists for AOAI/Foundry model lists.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_foundry_deployment_disabled_filter():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    backend_path = os.path.join(repo_root, 'application', 'single_app', 'route_backend_models.py')
+    content = read_file_text(backend_path)
+
+    assert 'def is_deployment_enabled' in content, "Missing deployment state filter helper."
+    assert 'provisioningState' in content or 'provisioning_state' in content, "Expected provisioning state extraction."
+
+    print("✅ Disabled deployments filtered from model lists.")
+
+
+if __name__ == "__main__":
+    test_foundry_deployment_disabled_filter()
diff --git a/functional_tests/test_foundry_endpoint_resolution.py b/functional_tests/test_foundry_endpoint_resolution.py
new file mode 100644
index 00000000..e17e5194
--- /dev/null
+++ b/functional_tests/test_foundry_endpoint_resolution.py
@@ -0,0 +1,73 @@
+# test_foundry_endpoint_resolution.py
+"""
+Functional test for Foundry endpoint resolution.
+Version: 0.236.060
+Implemented in: 0.236.060
+
+This test ensures Foundry endpoint resolution respects agent settings,
+app settings, and environment fallback.
+"""
+
+import os
+import sys
+
+repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+sys.path.append(repo_root)
+
+from application.single_app.semantic_kernel_loader import resolve_foundry_endpoint_from_settings
+
+
+def test_foundry_endpoint_resolution_priority():
+    """Agent settings should override global settings and env."""
+    print("🔍 Validating Foundry endpoint resolution priority...")
+
+    settings = {"azure_ai_foundry_endpoint": "https://global.example"}
+    foundry_settings = {"endpoint": "https://agent.example"}
+
+    resolved = resolve_foundry_endpoint_from_settings(foundry_settings, settings)
+    assert resolved == "https://agent.example"
+
+    print("✅ Foundry endpoint resolution priority passed.")
+
+
+def test_foundry_endpoint_resolution_fallbacks():
+    """Global settings should be used when agent endpoint is missing."""
+    print("🔍 Validating Foundry endpoint resolution fallback...")
+
+    settings = {"azure_ai_foundry_endpoint": "https://global.example"}
+    foundry_settings = {}
+
+    resolved = resolve_foundry_endpoint_from_settings(foundry_settings, settings)
+    assert resolved == "https://global.example"
+
+    print("✅ Foundry endpoint resolution fallback passed.")
+
+
+def run_tests():
+    tests = [
+        test_foundry_endpoint_resolution_priority,
+        test_foundry_endpoint_resolution_fallbacks,
+    ]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    success = run_tests()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_foundry_inference_scope_fix.py b/functional_tests/test_foundry_inference_scope_fix.py
new file mode 100644
index 00000000..644271bb
--- /dev/null
+++ b/functional_tests/test_foundry_inference_scope_fix.py
@@ -0,0 +1,33 @@
+# test_foundry_inference_scope_fix.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry scope selection by cloud.
+Version: 0.236.028
+Implemented in: 0.236.028
+
+This test ensures Foundry model inference uses cloud-specific scopes and supports custom scope overrides.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_foundry_inference_scope_fix():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    backend_path = os.path.join(repo_root, 'application', 'single_app', 'route_backend_models.py')
+    content = read_file_text(backend_path)
+
+    assert "def resolve_foundry_scope" in content, "Missing Foundry scope resolver."
+    assert "https://ai.azure.com/.default" in content, "Expected public Foundry scope constant."
+    assert "https://ai.azure.us/.default" in content, "Expected government Foundry scope constant."
+    assert "foundry_scope" in content, "Expected custom Foundry scope override field."
+
+    print("✅ Foundry scope selection verified.")
+
+
+if __name__ == "__main__":
+    test_foundry_inference_scope_fix()
diff --git a/functional_tests/test_foundry_management_fields_cleanup.py b/functional_tests/test_foundry_management_fields_cleanup.py
new file mode 100644
index 00000000..d8d460af
--- /dev/null
+++ b/functional_tests/test_foundry_management_fields_cleanup.py
@@ -0,0 +1,31 @@
+# test_foundry_management_fields_cleanup.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry management field cleanup.
+Version: 0.236.029
+Implemented in: 0.236.029
+
+This test ensures Foundry endpoints no longer use subscription/resource/location fields in the modal payload.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_foundry_management_fields_cleanup():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    js_path = os.path.join(repo_root, 'application', 'single_app', 'static', 'js', 'admin', 'admin_model_endpoints.js')
+    content = read_file_text(js_path)
+
+    assert "const management = provider === \"aoai\"" in content, "Expected management fields only for AOAI."
+    assert "endpointLocation" not in content, "Foundry/AOAI location field should be removed from the modal script."
+
+    print("✅ Foundry management field cleanup verified.")
+
+
+if __name__ == "__main__":
+    test_foundry_management_fields_cleanup()
diff --git a/functional_tests/test_foundry_model_fetch_sync_credentials.py b/functional_tests/test_foundry_model_fetch_sync_credentials.py
new file mode 100644
index 00000000..230ca172
--- /dev/null
+++ b/functional_tests/test_foundry_model_fetch_sync_credentials.py
@@ -0,0 +1,168 @@
+# test_foundry_model_fetch_sync_credentials.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry model fetch sync credential handling.
+Version: 0.239.156
+Implemented in: 0.239.156
+
+This test ensures sync Foundry model discovery helpers use synchronous Azure
+credentials so token retrieval returns a token object instead of a coroutine.
+"""
+
+import importlib
+import inspect
+import os
+import sys
+import types
+
+
+REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+SINGLE_APP_ROOT = os.path.join(REPO_ROOT, "application", "single_app")
+sys.path.insert(0, SINGLE_APP_ROOT)
+sys.path.insert(0, REPO_ROOT)
+
+
+def restore_modules(original_modules):
+    for module_name, original_module in original_modules.items():
+        if original_module is None:
+            sys.modules.pop(module_name, None)
+        else:
+            sys.modules[module_name] = original_module
+
+
+def load_foundry_agent_runtime_module():
+    functions_appinsights_stub = types.ModuleType("functions_appinsights")
+    functions_appinsights_stub.log_event = lambda *args, **kwargs: None
+
+    functions_debug_stub = types.ModuleType("functions_debug")
+    functions_debug_stub.debug_print = lambda *args, **kwargs: None
+
+    functions_keyvault_stub = types.ModuleType("functions_keyvault")
+    functions_keyvault_stub.retrieve_secret_from_key_vault_by_full_name = lambda value: value
+    functions_keyvault_stub.validate_secret_name_dynamic = lambda value: False
+
+    requests_stub = types.ModuleType("requests")
+
+    class Response:
+        pass
+
+    requests_stub.Response = Response
+    requests_stub.get = lambda *args, **kwargs: None
+    requests_stub.post = lambda *args, **kwargs: None
+
+    azure_stub = types.ModuleType("azure")
+    azure_identity_stub = types.ModuleType("azure.identity")
+    azure_identity_aio_stub = types.ModuleType("azure.identity.aio")
+
+    class SyncToken:
+        def __init__(self, value):
+            self.token = value
+
+    class SyncDefaultAzureCredential:
+        def __init__(self, *args, **kwargs):
+            self.args = args
+            self.kwargs = kwargs
+
+        def get_token(self, scope):
+            return SyncToken(f"sync:{scope}")
+
+        def close(self):
+            return None
+
+    class SyncClientSecretCredential(SyncDefaultAzureCredential):
+        pass
+
+    class AsyncDefaultAzureCredential:
+        def __init__(self, *args, **kwargs):
+            self.args = args
+            self.kwargs = kwargs
+
+        async def get_token(self, scope):
+            return SyncToken(f"async:{scope}")
+
+        async def close(self):
+            return None
+
+    class AsyncClientSecretCredential(AsyncDefaultAzureCredential):
+        pass
+
+    class AzureAuthorityHosts:
+        AZURE_PUBLIC_CLOUD = "public"
+        AZURE_GOVERNMENT = "government"
+
+    azure_identity_stub.AzureAuthorityHosts = AzureAuthorityHosts
+    azure_identity_stub.ClientSecretCredential = SyncClientSecretCredential
+    azure_identity_stub.DefaultAzureCredential = SyncDefaultAzureCredential
+    azure_identity_aio_stub.ClientSecretCredential = AsyncClientSecretCredential
+    azure_identity_aio_stub.DefaultAzureCredential = AsyncDefaultAzureCredential
+
+    semantic_kernel_stub = types.ModuleType("semantic_kernel")
+    semantic_kernel_agents_stub = types.ModuleType("semantic_kernel.agents")
+    semantic_kernel_contents_stub = types.ModuleType("semantic_kernel.contents")
+    semantic_kernel_chat_stub = types.ModuleType("semantic_kernel.contents.chat_message_content")
+
+    class AzureAIAgent:
+        @staticmethod
+        def create_client(*args, **kwargs):
+            raise AssertionError("create_client should not be used in this regression test")
+
+    class ChatMessageContent:
+        pass
+
+    semantic_kernel_agents_stub.AzureAIAgent = AzureAIAgent
+    semantic_kernel_chat_stub.ChatMessageContent = ChatMessageContent
+
+    original_modules = {}
+    module_stubs = {
+        "functions_appinsights": functions_appinsights_stub,
+        "functions_debug": functions_debug_stub,
+        "functions_keyvault": functions_keyvault_stub,
+        "requests": requests_stub,
+        "azure": azure_stub,
+        "azure.identity": azure_identity_stub,
+        "azure.identity.aio": azure_identity_aio_stub,
+        "semantic_kernel": semantic_kernel_stub,
+        "semantic_kernel.agents": semantic_kernel_agents_stub,
+        "semantic_kernel.contents": semantic_kernel_contents_stub,
+        "semantic_kernel.contents.chat_message_content": semantic_kernel_chat_stub,
+    }
+
+    for module_name, module_stub in module_stubs.items():
+        original_modules[module_name] = sys.modules.get(module_name)
+        sys.modules[module_name] = module_stub
+
+    original_modules["foundry_agent_runtime"] = sys.modules.get("foundry_agent_runtime")
+    sys.modules.pop("foundry_agent_runtime", None)
+    module = importlib.import_module("foundry_agent_runtime")
+    return module, original_modules
+
+
+def test_build_project_credential_returns_sync_token_provider():
+    """Ensure sync discovery helper uses sync Azure credentials."""
+    print("🔍 Testing Foundry sync discovery credential builder...")
+    module, original_modules = load_foundry_agent_runtime_module()
+
+    try:
+        credential = module.build_project_credential({"type": "managed_identity"})
+        token = credential.get_token("https://ai.azure.com/.default")
+
+        assert not inspect.iscoroutine(token)
+        assert token.token == "sync:https://ai.azure.com/.default"
+    finally:
+        restore_modules(original_modules)
+
+    print("✅ Foundry sync discovery credential builder passed.")
+
+
+if __name__ == "__main__":
+    success = True
+    try:
+        test_build_project_credential_returns_sync_token_provider()
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+
+        traceback.print_exc()
+        success = False
+
+    raise SystemExit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_foundry_model_list_fallback.py b/functional_tests/test_foundry_model_list_fallback.py
new file mode 100644
index 00000000..30159a2a
--- /dev/null
+++ b/functional_tests/test_foundry_model_list_fallback.py
@@ -0,0 +1,32 @@
+# test_foundry_model_list_fallback.py
+#!/usr/bin/env python3
+"""
+Functional test for Foundry project deployments discovery.
+Version: 0.236.026
+Implemented in: 0.236.026
+
+This test ensures Foundry model discovery uses the project deployments list endpoint.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_foundry_model_list_fallback():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    backend_path = os.path.join(repo_root, 'application', 'single_app', 'route_backend_models.py')
+    content = read_file_text(backend_path)
+
+    assert "fetch_foundry_project_deployments" in content, "Expected project deployments discovery helper."
+    assert "/deployments" in content, "Expected Foundry project deployments list endpoint."
+    assert "https://ai.azure.com/.default" in content, "Expected Foundry project scope for discovery token."
+
+    print("✅ Foundry project deployments discovery verified.")
+
+
+if __name__ == "__main__":
+    test_foundry_model_list_fallback()
diff --git a/functional_tests/test_group_agent_conversation_metadata_fix.py b/functional_tests/test_group_agent_conversation_metadata_fix.py
index aa45f493..f651c3fd 100644
--- a/functional_tests/test_group_agent_conversation_metadata_fix.py
+++ b/functional_tests/test_group_agent_conversation_metadata_fix.py
@@ -2,8 +2,8 @@
 # test_group_agent_conversation_metadata_fix.py
 """
 Functional test for group agent conversation metadata fix.
-Version: 0.233.161
-Implemented in: 0.233.161
+Version: 0.239.166
+Implemented in: 0.239.166
 
 This test ensures that conversations using group agents receive the correct
 primary context and chat type metadata even when no documents are retrieved.
@@ -11,9 +11,15 @@
 
 import sys
 import os
+from pathlib import Path
 from unittest.mock import patch
 
-sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+
+if str(APP_DIR) not in sys.path:
+    sys.path.insert(0, str(APP_DIR))
 
 
 def test_group_agent_primary_context():
diff --git a/functional_tests/test_group_agent_selection_scope.py b/functional_tests/test_group_agent_selection_scope.py
new file mode 100644
index 00000000..a2f37070
--- /dev/null
+++ b/functional_tests/test_group_agent_selection_scope.py
@@ -0,0 +1,95 @@
+# test_group_agent_selection_scope.py
+"""
+Functional test for scope-aware agent selection.
+Version: 0.236.059
+Implemented in: 0.236.059
+
+This test ensures scope-aware agent matching respects group IDs and global/personal scopes.
+"""
+
+import os
+import sys
+
+repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+sys.path.append(repo_root)
+
+from application.single_app.semantic_kernel_loader import find_agent_by_scope
+
+
+def test_group_agent_selection_requires_group_id_match():
+    """Ensure group agent selection only matches when group_id aligns."""
+    print("🔍 Validating group agent scope matching...")
+
+    agents_cfg = [
+        {"id": "g1", "name": "group-web-search", "is_group": True, "group_id": "group-a"},
+        {"id": "p1", "name": "group-web-search", "is_group": False, "is_global": False}
+    ]
+
+    selected_agent = {
+        "id": "g1",
+        "name": "group-web-search",
+        "is_group": True,
+        "group_id": "group-b"
+    }
+
+    resolved = find_agent_by_scope(agents_cfg, selected_agent)
+    assert resolved is None
+
+    selected_agent["group_id"] = "group-a"
+    resolved = find_agent_by_scope(agents_cfg, selected_agent)
+    assert resolved is not None
+    assert resolved.get("id") == "g1"
+
+    print("✅ Group agent scope matching passed.")
+
+
+def test_global_vs_personal_agent_selection():
+    """Ensure global and personal agents with same name are disambiguated by scope."""
+    print("🔍 Validating global vs personal agent selection...")
+
+    agents_cfg = [
+        {"id": "g1", "name": "researcher", "is_global": True, "is_group": False},
+        {"id": "p1", "name": "researcher", "is_global": False, "is_group": False}
+    ]
+
+    selected_global = {"name": "researcher", "is_global": True, "is_group": False}
+    resolved_global = find_agent_by_scope(agents_cfg, selected_global)
+    assert resolved_global is not None
+    assert resolved_global.get("id") == "g1"
+
+    selected_personal = {"name": "researcher", "is_global": False, "is_group": False}
+    resolved_personal = find_agent_by_scope(agents_cfg, selected_personal)
+    assert resolved_personal is not None
+    assert resolved_personal.get("id") == "p1"
+
+    print("✅ Global vs personal selection passed.")
+
+
+def run_tests():
+    tests = [
+        test_group_agent_selection_requires_group_id_match,
+        test_global_vs_personal_agent_selection
+    ]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    success = run_tests()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_group_member_deleted_activity_logging.py b/functional_tests/test_group_member_deleted_activity_logging.py
index a503d25e..37530c8f 100644
--- a/functional_tests/test_group_member_deleted_activity_logging.py
+++ b/functional_tests/test_group_member_deleted_activity_logging.py
@@ -232,7 +232,7 @@ def test_group_member_deleted_logging():
                     item=log['id'],
                     partition_key=log['user_id']
                 )
-            except:
+            except Exception as ex:
                 pass
         print("✓ Activity logs cleaned up")
         
diff --git a/functional_tests/test_image_generation_model_compatibility.py b/functional_tests/test_image_generation_model_compatibility.py
index 07aa0bea..98bbee32 100644
--- a/functional_tests/test_image_generation_model_compatibility.py
+++ b/functional_tests/test_image_generation_model_compatibility.py
@@ -145,7 +145,7 @@ def test_image_response_validation():
                     else:
                         generated_image_url = image_data['url']
                         is_valid = generated_image_url and generated_image_url != 'null'
-            except:
+            except Exception as ex:
                 is_valid = False
             
             if is_valid == expected:
diff --git a/functional_tests/test_logged_core_plugins.py b/functional_tests/test_logged_core_plugins.py
new file mode 100644
index 00000000..955f294d
--- /dev/null
+++ b/functional_tests/test_logged_core_plugins.py
@@ -0,0 +1,177 @@
+# test_logged_core_plugins.py
+"""
+Functional test for logged core Semantic Kernel plugins.
+Version: 0.239.153
+Implemented in: 0.239.153
+
+This test ensures that the SimpleChat subclasses for Semantic Kernel core plugins
+emit plugin invocation logs for inherited and custom methods and that invocation
+callbacks can be converted into thought records for both success and failure cases.
+"""
+
+import asyncio
+import sys
+import types
+
+
+def create_invocation(plugin_name, function_name, parameters, result=None, success=True, error_message=None, duration_ms=1234):
+    """Create a lightweight invocation object for formatter tests."""
+    return types.SimpleNamespace(
+        plugin_name=plugin_name,
+        function_name=function_name,
+        parameters=parameters,
+        result=result,
+        success=success,
+        error_message=error_message,
+        duration_ms=duration_ms,
+    )
+
+
+def install_test_stubs():
+    """Install lightweight stubs for application services used by the logger."""
+    functions_appinsights = types.ModuleType('functions_appinsights')
+    functions_appinsights.log_event = lambda *args, **kwargs: None
+    functions_appinsights.get_appinsights_logger = lambda: None
+    sys.modules['functions_appinsights'] = functions_appinsights
+
+    functions_authentication = types.ModuleType('functions_authentication')
+    functions_authentication.get_current_user_id = lambda: None
+    sys.modules['functions_authentication'] = functions_authentication
+
+    functions_debug = types.ModuleType('functions_debug')
+    functions_debug.debug_print = lambda *args, **kwargs: None
+    sys.modules['functions_debug'] = functions_debug
+
+
+class FakeThoughtTracker:
+    """Capture thought writes in memory for assertions."""
+
+    def __init__(self):
+        self.events = []
+
+    def add_thought(self, step_type, content, detail=None):
+        self.events.append({
+            'step_type': step_type,
+            'content': content,
+            'detail': detail,
+        })
+
+
+def test_logged_core_plugins():
+    """Validate logged core plugin subclasses and thought callback mapping."""
+    repo_root = r'c:\Repos\simplechatmsft\application\single_app'
+    semantic_kernel_repo_root = r'c:\Repos\semantic-kernel\python'
+    if repo_root not in sys.path:
+        sys.path.insert(0, repo_root)
+    if semantic_kernel_repo_root not in sys.path:
+        sys.path.insert(0, semantic_kernel_repo_root)
+
+    install_test_stubs()
+
+    from semantic_kernel_plugins.math_plugin import MathPlugin
+    from semantic_kernel_plugins.plugin_invocation_logger import get_plugin_logger
+    from semantic_kernel_plugins.plugin_invocation_thoughts import (
+        format_plugin_invocation_start_thought,
+        format_plugin_invocation_thought,
+        register_plugin_invocation_thought_callback,
+    )
+    from semantic_kernel_plugins.text_plugin import TextPlugin
+    from semantic_kernel_plugins.time_plugin import TimePlugin
+    from semantic_kernel_plugins.wait_plugin import WaitPlugin
+
+    plugin_logger = get_plugin_logger()
+    plugin_logger.clear_history()
+    plugin_logger.deregister_callbacks('None:None')
+
+    thought_tracker = FakeThoughtTracker()
+    callback_key = register_plugin_invocation_thought_callback(
+        plugin_logger,
+        thought_tracker,
+        None,
+        None,
+        actor_label='Kernel'
+    )
+
+    math_plugin = MathPlugin()
+    text_plugin = TextPlugin()
+    time_plugin = TimePlugin()
+    wait_plugin = WaitPlugin()
+
+    print('Testing logged core plugin invocations...')
+    assert math_plugin.add('2', '3') == 5.0
+    assert math_plugin.multiply(4, 5) == 20.0
+    assert text_plugin.trim('  hello  ') == 'hello'
+    assert isinstance(time_plugin.date(), str)
+    asyncio.run(wait_plugin.wait('0'))
+
+    try:
+        math_plugin.divide('1', '0')
+    except ValueError:
+        print('Captured expected divide-by-zero failure')
+    else:
+        raise AssertionError('Expected divide-by-zero failure was not raised')
+
+    plugin_logger.deregister_callbacks(callback_key)
+
+    recent_invocations = plugin_logger.get_recent_invocations(10)
+    recent_names = [f"{inv.plugin_name}.{inv.function_name}" for inv in recent_invocations]
+    print(f'Recent invocations: {recent_names}')
+
+    assert 'MathPlugin.Add' in recent_names
+    assert 'MathPlugin.Multiply' in recent_names
+    assert 'TextPlugin.trim' in recent_names
+    assert 'TimePlugin.date' in recent_names
+    assert 'WaitPlugin.wait' in recent_names
+    assert 'MathPlugin.Divide' in recent_names
+
+    divide_failure = next(inv for inv in recent_invocations if inv.plugin_name == 'MathPlugin' and inv.function_name == 'Divide')
+    assert divide_failure.success is False
+    assert divide_failure.error_message is not None
+    assert 'divide by zero' in divide_failure.error_message.lower()
+
+    thought_contents = [event['content'] for event in thought_tracker.events]
+    print(f'Thought events: {thought_contents}')
+
+    assert any('Invoking MathPlugin.Add' in content for content in thought_contents)
+    assert any('Invoking WaitPlugin.wait' in content for content in thought_contents)
+    assert any('Kernel performed math: 2 + 3 = 5.0' in content for content in thought_contents)
+    assert any('Kernel invoked wait for 0 seconds' in content for content in thought_contents)
+    assert any('Kernel performed math: 1 / 0' in content for content in thought_contents)
+    assert any(
+        event['detail'] and 'error=' in event['detail']
+        for event in thought_tracker.events
+        if 'Kernel performed math: 1 / 0' in event['content']
+    )
+
+    generic_thought = format_plugin_invocation_thought(
+        create_invocation(
+            'OpenApiPlugin',
+            'topNews',
+            {'query': 'latest space weather', 'limit': 5},
+            result='ok',
+            duration_ms=88,
+        ),
+        actor_label='Agent'
+    )
+    print(f"Generic thought payload: {generic_thought}")
+    assert 'Agent executed OpenApiPlugin.topNews' in generic_thought['content']
+    assert 'query=latest space weather' in generic_thought['content'] or 'query=latest space weat...' in generic_thought['content']
+
+    start_thought = format_plugin_invocation_start_thought(
+        create_invocation(
+            'WaitPlugin',
+            'wait',
+            {'input': 30},
+        )
+    )
+    print(f"Start thought payload: {start_thought}")
+    assert start_thought['content'] == 'Invoking WaitPlugin.wait'
+    assert 'input=30' in start_thought['detail']
+
+    print('All logged core plugin checks passed')
+    return True
+
+
+if __name__ == '__main__':
+    success = test_logged_core_plugins()
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_metadata_detection_utility.py b/functional_tests/test_metadata_detection_utility.py
index 35bb1fb8..fcaa824a 100644
--- a/functional_tests/test_metadata_detection_utility.py
+++ b/functional_tests/test_metadata_detection_utility.py
@@ -7,7 +7,7 @@ def test_metadata_detection(metadata_value):
     try:
         metadata_obj = json.loads(metadata or '{}')
         has_metadata = len(metadata_obj) > 0
-    except:
+    except Exception as ex:
         has_metadata = len(metadata) > 0 and metadata != '{}'
     
     return has_metadata
diff --git a/functional_tests/test_model_endpoint_normalization_backend.py b/functional_tests/test_model_endpoint_normalization_backend.py
new file mode 100644
index 00000000..acc64aa3
--- /dev/null
+++ b/functional_tests/test_model_endpoint_normalization_backend.py
@@ -0,0 +1,116 @@
+# test_model_endpoint_normalization_backend.py
+"""
+Functional test for backend model endpoint normalization.
+Version: 0.239.155
+Implemented in: 0.239.155
+
+This test ensures model endpoints are normalized with stable IDs and enabled
+flags so frontend consumers receive consistent identifiers.
+"""
+
+import os
+import sys
+import importlib
+import json
+import types
+
+repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+single_app_root = os.path.join(repo_root, "application", "single_app")
+sys.path.append(repo_root)
+sys.path.append(single_app_root)
+
+
+def _restore_modules(original_modules):
+    for module_name, original_module in original_modules.items():
+        if original_module is None:
+            sys.modules.pop(module_name, None)
+        else:
+            sys.modules[module_name] = original_module
+
+
+def _load_functions_settings_module():
+    config_stub = types.ModuleType("config")
+    config_stub.json = json
+
+    appinsights_stub = types.ModuleType("functions_appinsights")
+    appinsights_stub.log_event = lambda *args, **kwargs: None
+
+    cache_stub = types.ModuleType("app_settings_cache")
+    cache_stub.get_settings_cache = lambda: None
+    cache_stub.update_settings_cache = lambda settings: None
+
+    original_modules = {}
+    for module_name, module_stub in {
+        "config": config_stub,
+        "functions_appinsights": appinsights_stub,
+        "app_settings_cache": cache_stub,
+    }.items():
+        original_modules[module_name] = sys.modules.get(module_name)
+        sys.modules[module_name] = module_stub
+
+    original_modules["application.single_app.functions_settings"] = sys.modules.get("application.single_app.functions_settings")
+    sys.modules.pop("application.single_app.functions_settings", None)
+    module = importlib.import_module("application.single_app.functions_settings")
+    return module, original_modules
+
+
+def test_model_endpoint_normalization_backend():
+    """Ensure IDs and enabled flags are normalized on backend."""
+    print("🔍 Validating backend model endpoint normalization...")
+    functions_settings, original_modules = _load_functions_settings_module()
+
+    endpoints = [
+        {
+            "name": "Foundry Endpoint",
+            "has_api_key": True,
+            "has_client_secret": True,
+            "connection": {"endpoint": "https://foundry.example"},
+            "models": [
+                {
+                    "deploymentName": "gpt-4o"
+                }
+            ]
+        }
+    ]
+
+    try:
+        normalized, changed = functions_settings.normalize_model_endpoints(endpoints)
+
+        assert changed is True
+        assert normalized[0]["id"] == "Foundry Endpoint"
+        assert normalized[0]["enabled"] is True
+        assert "has_api_key" not in normalized[0]
+        assert "has_client_secret" not in normalized[0]
+        assert normalized[0]["models"][0]["id"] == "gpt-4o"
+        assert normalized[0]["models"][0]["enabled"] is True
+    finally:
+        _restore_modules(original_modules)
+
+    print("✅ Backend model endpoint normalization passed.")
+
+
+def run_tests():
+    tests = [test_model_endpoint_normalization_backend]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    success = run_tests()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_model_endpoint_payload_auth_type_order.py b/functional_tests/test_model_endpoint_payload_auth_type_order.py
new file mode 100644
index 00000000..3378ba9f
--- /dev/null
+++ b/functional_tests/test_model_endpoint_payload_auth_type_order.py
@@ -0,0 +1,39 @@
+# test_model_endpoint_payload_auth_type_order.py
+#!/usr/bin/env python3
+"""
+Functional test for model endpoint payload auth type ordering.
+Version: 0.236.020
+Implemented in: 0.236.020
+
+This test ensures authType is defined before validation checks in buildEndpointPayload,
+so per-model test and fetch actions do not throw a reference error.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_model_endpoint_payload_auth_type_order():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    js_path = os.path.join(repo_root, 'application', 'single_app', 'static', 'js', 'admin', 'admin_model_endpoints.js')
+
+    content = read_file_text(js_path)
+    auth_type_index = content.find("const authType = endpointAuthTypeSelect")
+    foundry_check_index = content.find("provider === \"aifoundry\" && authType")
+    aoai_check_index = content.find("provider === \"aoai\" && authType")
+
+    assert auth_type_index != -1, "Expected authType assignment in buildEndpointPayload."
+    assert foundry_check_index != -1, "Expected Foundry validation using authType."
+    assert aoai_check_index != -1, "Expected AOAI validation using authType."
+    assert auth_type_index < foundry_check_index, "authType must be defined before Foundry validation."
+    assert auth_type_index < aoai_check_index, "authType must be defined before AOAI validation."
+
+    print("✅ buildEndpointPayload defines authType before validation checks.")
+
+
+if __name__ == "__main__":
+    test_model_endpoint_payload_auth_type_order()
diff --git a/functional_tests/test_model_endpoints_aoai_fetch_fix.py b/functional_tests/test_model_endpoints_aoai_fetch_fix.py
new file mode 100644
index 00000000..1d6199be
--- /dev/null
+++ b/functional_tests/test_model_endpoints_aoai_fetch_fix.py
@@ -0,0 +1,40 @@
+# test_model_endpoints_aoai_fetch_fix.py
+#!/usr/bin/env python3
+"""
+Functional test for Azure OpenAI model discovery in multi-endpoint modal.
+Version: 0.236.015
+Implemented in: 0.236.015
+
+This test ensures AOAI model discovery wiring includes resource group input in the modal,
+payload support in admin JS, and backend handling for AOAI in the models fetch route.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_model_endpoints_aoai_fetch_fix():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+
+    template_path = os.path.join(repo_root, 'application', 'single_app', 'templates', 'admin_settings.html')
+    admin_js_path = os.path.join(repo_root, 'application', 'single_app', 'static', 'js', 'admin', 'admin_model_endpoints.js')
+    models_route_path = os.path.join(repo_root, 'application', 'single_app', 'route_backend_models.py')
+
+    template_content = read_file_text(template_path)
+    admin_js_content = read_file_text(admin_js_path)
+    route_content = read_file_text(models_route_path)
+
+    assert 'id="model-endpoint-resource-group"' in template_content, "Resource group input missing from endpoint modal."
+    assert 'resource_group' in admin_js_content, "Admin endpoint payload missing resource_group handling."
+    assert 'provider == "aoai"' in route_content, "AOAI handling missing in model fetch route."
+    assert 'resource_group' in route_content, "Backend AOAI discovery missing resource group requirement."
+
+    print("✅ AOAI model discovery wiring validated.")
+
+
+if __name__ == "__main__":
+    test_model_endpoints_aoai_fetch_fix()
diff --git a/functional_tests/test_model_endpoints_api_key_manual_models.py b/functional_tests/test_model_endpoints_api_key_manual_models.py
new file mode 100644
index 00000000..ec210504
--- /dev/null
+++ b/functional_tests/test_model_endpoints_api_key_manual_models.py
@@ -0,0 +1,48 @@
+# test_model_endpoints_api_key_manual_models.py
+#!/usr/bin/env python3
+"""
+Functional test for API key manual model entry in endpoint modal.
+Version: 0.239.155
+Implemented in: 0.239.155
+
+This test ensures the API key flow exposes manual model entry UI,
+per-model test buttons, and management cloud fields for service principal.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_model_endpoints_api_key_manual_models():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+
+    template_path = os.path.join(repo_root, 'application', 'single_app', 'templates', '_multiendpoint_modal.html')
+    js_path = os.path.join(repo_root, 'application', 'single_app', 'static', 'js', 'admin', 'admin_model_endpoints.js')
+    backend_path = os.path.join(repo_root, 'application', 'single_app', 'route_backend_models.py')
+
+    template_content = read_file_text(template_path)
+    js_content = read_file_text(js_path)
+    backend_content = read_file_text(backend_path)
+
+    assert 'id="model-endpoint-api-key-note"' in template_content, "Missing API key inference-only note."
+    assert 'id="model-endpoint-add-model-btn"' in template_content, "Missing Add Model button for API key flow."
+    assert 'id="model-endpoint-management-cloud"' in template_content, "Missing management cloud selector."
+    assert 'id="model-endpoint-custom-authority"' in template_content, "Missing custom authority input."
+
+    assert 'addManualModel' in js_content, "Missing manual model add handler."
+    assert 'test-model' in js_content, "Missing per-model test action wiring."
+    assert 'management_cloud' in js_content, "Missing management cloud payload wiring."
+    assert 'const endpointId = endpointIdInput?.value.trim() || "";' in js_content, "Missing endpoint ID request wiring."
+
+    assert '/api/models/test-model' in backend_content, "Missing backend test-model endpoint."
+    assert 'resolve_request_endpoint_payload' in backend_content, "Missing stored-secret request resolution helper."
+
+    print("✅ API key manual model entry and per-model test wiring verified.")
+
+
+if __name__ == "__main__":
+    test_model_endpoints_api_key_manual_models()
diff --git a/functional_tests/test_model_endpoints_key_vault_secret_storage.py b/functional_tests/test_model_endpoints_key_vault_secret_storage.py
new file mode 100644
index 00000000..de14e629
--- /dev/null
+++ b/functional_tests/test_model_endpoints_key_vault_secret_storage.py
@@ -0,0 +1,237 @@
+#!/usr/bin/env python3
+# test_model_endpoints_key_vault_secret_storage.py
+"""
+Functional test for MultiGPT endpoint Key Vault secret storage.
+Version: 0.239.155
+Implemented in: 0.239.155
+
+This test ensures MultiGPT endpoint secrets are stored in Key Vault,
+returned to the UI as placeholders, resolved for backend use, and cleaned up
+when endpoint auth settings change.
+"""
+
+import importlib
+import os
+import sys
+import types
+
+
+REPO_ROOT = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+SINGLE_APP_ROOT = os.path.join(REPO_ROOT, "application", "single_app")
+sys.path.insert(0, SINGLE_APP_ROOT)
+sys.path.insert(0, REPO_ROOT)
+
+
+class FakeRetrievedSecret:
+    def __init__(self, value):
+        self.value = value
+
+
+class FakeSecretClient:
+    stored_secrets = {}
+    deleted_secrets = []
+
+    def __init__(self, vault_url, credential):
+        self.vault_url = vault_url
+        self.credential = credential
+
+    @classmethod
+    def reset(cls):
+        cls.stored_secrets = {}
+        cls.deleted_secrets = []
+
+    def set_secret(self, name, value):
+        FakeSecretClient.stored_secrets[name] = value
+
+    def get_secret(self, name):
+        return FakeRetrievedSecret(FakeSecretClient.stored_secrets[name])
+
+    def begin_delete_secret(self, name):
+        FakeSecretClient.deleted_secrets.append(name)
+        FakeSecretClient.stored_secrets.pop(name, None)
+
+
+def restore_modules(original_modules):
+    for module_name, original_module in original_modules.items():
+        if original_module is None:
+            sys.modules.pop(module_name, None)
+        else:
+            sys.modules[module_name] = original_module
+
+
+def load_functions_keyvault_module():
+    config_stub = types.ModuleType("config")
+    config_stub.KEY_VAULT_DOMAIN = ".vault.azure.net"
+
+    appinsights_stub = types.ModuleType("functions_appinsights")
+    appinsights_stub.log_event = lambda *args, **kwargs: None
+
+    auth_stub = types.ModuleType("functions_authentication")
+    settings_stub = types.ModuleType("functions_settings")
+
+    app_settings_cache_stub = types.ModuleType("app_settings_cache")
+    app_settings_cache_stub.get_settings_cache = lambda: {
+        "enable_key_vault_secret_storage": True,
+        "key_vault_name": "unit-test-vault",
+        "key_vault_identity": None,
+    }
+
+    azure_stub = types.ModuleType("azure")
+    identity_stub = types.ModuleType("azure.identity")
+    keyvault_stub = types.ModuleType("azure.keyvault")
+    secrets_stub = types.ModuleType("azure.keyvault.secrets")
+
+    class FakeDefaultAzureCredential:
+        def __init__(self, *args, **kwargs):
+            self.args = args
+            self.kwargs = kwargs
+
+    identity_stub.DefaultAzureCredential = FakeDefaultAzureCredential
+    secrets_stub.SecretClient = FakeSecretClient
+    azure_stub.identity = identity_stub
+    azure_stub.keyvault = keyvault_stub
+    keyvault_stub.secrets = secrets_stub
+
+    original_modules = {}
+    module_stubs = {
+        "config": config_stub,
+        "functions_appinsights": appinsights_stub,
+        "functions_authentication": auth_stub,
+        "functions_settings": settings_stub,
+        "app_settings_cache": app_settings_cache_stub,
+        "azure": azure_stub,
+        "azure.identity": identity_stub,
+        "azure.keyvault": keyvault_stub,
+        "azure.keyvault.secrets": secrets_stub,
+    }
+
+    for module_name, module_stub in module_stubs.items():
+        original_modules[module_name] = sys.modules.get(module_name)
+        sys.modules[module_name] = module_stub
+
+    original_modules["functions_keyvault"] = sys.modules.get("functions_keyvault")
+    sys.modules.pop("functions_keyvault", None)
+
+    module = importlib.import_module("functions_keyvault")
+    return module, original_modules
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file_handle:
+        return file_handle.read()
+
+
+def test_model_endpoint_key_vault_helper_lifecycle():
+    """Ensure endpoint auth secrets are stored, resolved, and cleaned up correctly."""
+    print("🔍 Testing model endpoint Key Vault helper lifecycle...")
+    FakeSecretClient.reset()
+    module, original_modules = load_functions_keyvault_module()
+
+    try:
+        endpoint = {
+            "id": "endpoint-123",
+            "name": "Primary Endpoint",
+            "auth": {
+                "type": "api_key",
+                "api_key": "super-secret-key",
+            },
+        }
+
+        saved_endpoint = module.keyvault_model_endpoint_save_helper(endpoint, "endpoint-123", scope="user")
+        secret_reference = saved_endpoint["auth"]["api_key"]
+
+        assert secret_reference == "endpoint-123--model-endpoint--user--model-endpoint-api-key"
+        assert FakeSecretClient.stored_secrets[secret_reference] == "super-secret-key"
+
+        placeholder_endpoint = module.keyvault_model_endpoint_get_helper(
+            saved_endpoint,
+            "endpoint-123",
+            scope="user",
+            return_type=module.SecretReturnType.TRIGGER,
+        )
+        assert placeholder_endpoint["auth"]["api_key"] == module.ui_trigger_word
+
+        resolved_endpoint = module.keyvault_model_endpoint_get_helper(
+            saved_endpoint,
+            "endpoint-123",
+            scope="user",
+            return_type=module.SecretReturnType.VALUE,
+        )
+        assert resolved_endpoint["auth"]["api_key"] == "super-secret-key"
+
+        updated_endpoint = module.keyvault_model_endpoint_save_helper(
+            {
+                "id": "endpoint-123",
+                "name": "Primary Endpoint",
+                "auth": {
+                    "type": "managed_identity",
+                    "api_key": "",
+                },
+            },
+            "endpoint-123",
+            scope="user",
+            existing_endpoint=saved_endpoint,
+        )
+        assert updated_endpoint["auth"].get("api_key") is None
+
+        module.keyvault_model_endpoint_cleanup_helper(
+            saved_endpoint,
+            updated_endpoint,
+            "endpoint-123",
+            scope="user",
+        )
+        assert secret_reference not in FakeSecretClient.stored_secrets
+        assert secret_reference in FakeSecretClient.deleted_secrets
+
+        print("✅ Model endpoint Key Vault helper lifecycle passed.")
+    finally:
+        restore_modules(original_modules)
+
+
+def test_model_endpoint_frontend_contract_files():
+    """Ensure the frontend/backend contract includes endpoint IDs and stored-secret placeholders."""
+    print("🔍 Verifying model endpoint UI/backend stored-secret contract...")
+    admin_js_path = os.path.join(SINGLE_APP_ROOT, "static", "js", "admin", "admin_model_endpoints.js")
+    workspace_js_path = os.path.join(SINGLE_APP_ROOT, "static", "js", "workspace", "workspace_model_endpoints.js")
+    backend_path = os.path.join(SINGLE_APP_ROOT, "route_backend_models.py")
+
+    admin_js = read_file_text(admin_js_path)
+    workspace_js = read_file_text(workspace_js_path)
+    backend_content = read_file_text(backend_path)
+
+    assert 'const endpointId = endpointIdInput?.value.trim() || "";' in admin_js
+    assert 'const endpointId = endpointIdInput?.value.trim() || "";' in workspace_js
+    assert 'clientSecretInput.placeholder = "Stored"' in admin_js
+    assert 'apiKeyInput.placeholder = "Stored"' in admin_js
+    assert 'resolve_request_endpoint_payload' in backend_content
+    assert 'keyvault_model_endpoint_get_helper' in backend_content
+
+    print("✅ Model endpoint UI/backend stored-secret contract passed.")
+
+
+def run_tests():
+    tests = [
+        test_model_endpoint_key_vault_helper_lifecycle,
+        test_model_endpoint_frontend_contract_files,
+    ]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    sys.exit(0 if run_tests() else 1)
\ No newline at end of file
diff --git a/functional_tests/test_model_endpoints_save_button.py b/functional_tests/test_model_endpoints_save_button.py
new file mode 100644
index 00000000..71e8c79a
--- /dev/null
+++ b/functional_tests/test_model_endpoints_save_button.py
@@ -0,0 +1,32 @@
+# test_model_endpoints_save_button.py
+#!/usr/bin/env python3
+"""
+Functional test for model endpoint Save button wiring.
+Version: 0.236.021
+Implemented in: 0.236.021
+
+This test ensures the Save Endpoint button triggers save logic and surfaces errors.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_model_endpoints_save_button():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    js_path = os.path.join(repo_root, 'application', 'single_app', 'static', 'js', 'admin', 'admin_model_endpoints.js')
+    content = read_file_text(js_path)
+
+    assert 'saveEndpoint()' in content, "Save endpoint handler missing."
+    assert 'event.preventDefault()' in content, "Save button should prevent default." 
+    assert 'Failed to save endpoint' in content, "Expected error handling for save endpoint." 
+
+    print("✅ Save Endpoint button handler verified.")
+
+
+if __name__ == "__main__":
+    test_model_endpoints_save_button()
diff --git a/functional_tests/test_model_endpoints_save_toast_message.py b/functional_tests/test_model_endpoints_save_toast_message.py
new file mode 100644
index 00000000..3e91b348
--- /dev/null
+++ b/functional_tests/test_model_endpoints_save_toast_message.py
@@ -0,0 +1,30 @@
+# test_model_endpoints_save_toast_message.py
+#!/usr/bin/env python3
+"""
+Functional test for model endpoint save toast messaging.
+Version: 0.236.022
+Implemented in: 0.236.022
+
+This test ensures the save toast reminds admins to save settings to persist changes.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_model_endpoints_save_toast_message():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    js_path = os.path.join(repo_root, 'application', 'single_app', 'static', 'js', 'admin', 'admin_model_endpoints.js')
+    content = read_file_text(js_path)
+
+    assert "Please save your settings" in content, "Expected save toast reminder in endpoint save flow."
+
+    print("✅ Save toast reminder verified.")
+
+
+if __name__ == "__main__":
+    test_model_endpoints_save_toast_message()
diff --git a/functional_tests/test_msgraph_auth_consent_flow.py b/functional_tests/test_msgraph_auth_consent_flow.py
new file mode 100644
index 00000000..85e7d9f1
--- /dev/null
+++ b/functional_tests/test_msgraph_auth_consent_flow.py
@@ -0,0 +1,229 @@
+# test_msgraph_auth_consent_flow.py
+"""
+Functional test for Microsoft Graph incremental auth flow.
+Version: 0.239.175
+Implemented in: 0.239.175
+
+This test ensures plugin-requested Microsoft Graph scopes survive the OAuth
+callback and that interactive reauthentication does not force consent unless
+Microsoft Entra explicitly reports missing consent.
+"""
+
+from pathlib import Path
+import sys
+
+from flask import Flask, session
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+
+if str(APP_DIR) not in sys.path:
+    sys.path.insert(0, str(APP_DIR))
+
+
+import functions_authentication as auth_module  # noqa: E402
+import functions_settings  # noqa: E402
+import route_frontend_authentication as route_module  # noqa: E402
+
+
+class FakeTokenCache:
+    """Minimal MSAL token cache stub for callback tests."""
+
+    has_state_changed = False
+
+
+class FakeMsalApp:
+    """Simple MSAL stub that records interactive and callback requests."""
+
+    def __init__(self, silent_result=None, auth_code_result=None):
+        self.silent_result = silent_result
+        self.auth_code_result = auth_code_result or {
+            "id_token_claims": {
+                "name": "Test User",
+                "oid": "oid",
+                "sub": "sub",
+            },
+            "access_token": "fake-token",
+        }
+        self.authorization_requests = []
+        self.auth_code_requests = []
+        self.token_cache = FakeTokenCache()
+
+    def get_accounts(self, username=None):
+        return [{"home_account_id": "oid.tid", "username": username}]
+
+    def acquire_token_silent_with_error(self, scopes, account=None):
+        self.last_silent_request = {
+            "scopes": list(scopes),
+            "account": account,
+        }
+        return self.silent_result
+
+    def get_authorization_request_url(self, scopes, **kwargs):
+        self.authorization_requests.append(
+            {
+                "scopes": list(scopes),
+                **kwargs,
+            }
+        )
+        prompt_value = kwargs.get("prompt", "none")
+        return f"https://login.example.test/authorize?prompt={prompt_value}&scopes={','.join(scopes)}"
+
+    def acquire_token_by_authorization_code(self, code=None, scopes=None, redirect_uri=None):
+        self.auth_code_requests.append(
+            {
+                "code": code,
+                "scopes": list(scopes or []),
+                "redirect_uri": redirect_uri,
+            }
+        )
+        return self.auth_code_result
+
+
+def test_plugin_auth_uses_interactive_sign_in_without_forced_consent() -> bool:
+    """Verify a silent token miss stores scopes and does not force prompt=consent."""
+    print("Testing Microsoft Graph interactive auth without forced consent...")
+
+    app = Flask(__name__)
+    app.secret_key = "test-secret"
+    fake_msal_app = FakeMsalApp(silent_result=None)
+    original_builder = auth_module._build_msal_app
+
+    try:
+        auth_module._build_msal_app = lambda cache=None, authority_override=None: fake_msal_app
+
+        with app.test_request_context("/", base_url="https://example.test"):
+            session["user"] = {
+                "oid": "oid",
+                "tid": "tid",
+                "preferred_username": "user@example.com",
+            }
+
+            result = auth_module.get_valid_access_token_for_plugins(["MailboxSettings.Read"])
+
+            if result.get("error") != "interactive_auth_required":
+                print(f"Expected interactive_auth_required, got: {result}")
+                return False
+            if auth_module.get_requested_oauth_scopes() != ["MailboxSettings.Read"]:
+                print(f"Expected stored requested scopes, got: {auth_module.get_requested_oauth_scopes()}")
+                return False
+            if not fake_msal_app.authorization_requests:
+                print("Expected an interactive auth URL request to be generated")
+                return False
+            if fake_msal_app.authorization_requests[0].get("prompt") is not None:
+                print(f"Expected no forced prompt for silent token miss, got: {fake_msal_app.authorization_requests[0]}")
+                return False
+
+        print("Microsoft Graph interactive auth avoids forced consent when reauth is enough")
+        return True
+    finally:
+        auth_module._build_msal_app = original_builder
+
+
+def test_plugin_auth_only_forces_consent_when_entra_requires_it() -> bool:
+    """Verify explicit consent errors still request prompt=consent."""
+    print("Testing Microsoft Graph explicit consent handling...")
+
+    app = Flask(__name__)
+    app.secret_key = "test-secret"
+    fake_msal_app = FakeMsalApp(
+        silent_result={
+            "error": "invalid_grant",
+            "error_description": "AADSTS65001: consent_required",
+        }
+    )
+    original_builder = auth_module._build_msal_app
+
+    try:
+        auth_module._build_msal_app = lambda cache=None, authority_override=None: fake_msal_app
+
+        with app.test_request_context("/", base_url="https://example.test"):
+            session["user"] = {
+                "oid": "oid",
+                "tid": "tid",
+                "preferred_username": "user@example.com",
+            }
+
+            result = auth_module.get_valid_access_token_for_plugins(["Calendars.Read"])
+
+            if result.get("error") != "consent_required":
+                print(f"Expected consent_required, got: {result}")
+                return False
+            if fake_msal_app.authorization_requests[0].get("prompt") != "consent":
+                print(f"Expected prompt=consent for explicit consent errors, got: {fake_msal_app.authorization_requests[0]}")
+                return False
+
+        print("Microsoft Graph consent flow still forces consent when Entra requires it")
+        return True
+    finally:
+        auth_module._build_msal_app = original_builder
+
+
+def test_oauth_callback_redeems_requested_plugin_scopes() -> bool:
+    """Verify the OAuth callback uses the stored plugin scopes instead of base login scopes."""
+    print("Testing OAuth callback scope redemption for plugin auth...")
+
+    app = Flask(__name__)
+    app.secret_key = "test-secret"
+
+    @app.route("/")
+    def index():
+        return "ok"
+
+    route_module.register_route_frontend_authentication(app)
+
+    fake_msal_app = FakeMsalApp()
+    original_builder = route_module._build_msal_app
+    original_load_cache = route_module._load_cache
+    original_save_cache = route_module._save_cache
+    original_get_settings = functions_settings.get_settings
+
+    try:
+        route_module._build_msal_app = lambda cache=None: fake_msal_app
+        route_module._load_cache = lambda: None
+        route_module._save_cache = lambda cache: None
+        functions_settings.get_settings = lambda: {"enable_front_door": False}
+
+        with app.test_request_context("/getAToken?code=fake-code", base_url="https://example.test"):
+            session[auth_module.REQUESTED_SCOPES_SESSION_KEY] = ["MailboxSettings.Read"]
+
+            response = app.view_functions["authorized"]()
+
+            if response.status_code != 302:
+                print(f"Expected callback redirect, got status {response.status_code}")
+                return False
+            if not fake_msal_app.auth_code_requests:
+                print("Expected acquire_token_by_authorization_code to be called")
+                return False
+            if fake_msal_app.auth_code_requests[0].get("scopes") != ["MailboxSettings.Read"]:
+                print(f"Expected callback to redeem requested plugin scopes, got: {fake_msal_app.auth_code_requests[0]}")
+                return False
+            if auth_module.REQUESTED_SCOPES_SESSION_KEY in session:
+                print(f"Expected requested scope state to be cleared, got: {dict(session)}")
+                return False
+
+        print("OAuth callback redeems the requested plugin scopes and clears session state")
+        return True
+    finally:
+        route_module._build_msal_app = original_builder
+        route_module._load_cache = original_load_cache
+        route_module._save_cache = original_save_cache
+        functions_settings.get_settings = original_get_settings
+
+
+if __name__ == "__main__":
+    tests = [
+        test_plugin_auth_uses_interactive_sign_in_without_forced_consent,
+        test_plugin_auth_only_forces_consent_when_entra_requires_it,
+        test_oauth_callback_redeems_requested_plugin_scopes,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        results.append(test())
+
+    success = all(results)
+    print(f"\nResults: {sum(results)}/{len(tests)} tests passed")
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_msgraph_plugin_operations.py b/functional_tests/test_msgraph_plugin_operations.py
new file mode 100644
index 00000000..a8b32e47
--- /dev/null
+++ b/functional_tests/test_msgraph_plugin_operations.py
@@ -0,0 +1,234 @@
+# test_msgraph_plugin_operations.py
+#!/usr/bin/env python3
+"""
+Functional test for Microsoft Graph plugin operations.
+Version: 0.239.174
+Implemented in: 0.239.174
+
+This test ensures the Microsoft Graph plugin exposes the new high-value read
+operations, routes requests through the shared Graph helper, and handles
+pagination and token consent failures safely.
+"""
+
+from pathlib import Path
+import sys
+
+
+ROOT = Path(__file__).resolve().parents[1]
+APP_DIR = ROOT / "application" / "single_app"
+
+if str(APP_DIR) not in sys.path:
+    sys.path.insert(0, str(APP_DIR))
+
+
+from semantic_kernel_plugins.msgraph_plugin import MSGraphPlugin  # noqa: E402
+import semantic_kernel_plugins.msgraph_plugin as msgraph_module  # noqa: E402
+
+
+class FakeResponse:
+    def __init__(self, status_code, payload, headers=None, text=""):
+        self.status_code = status_code
+        self._payload = payload
+        self.headers = headers or {}
+        self.text = text
+
+    def json(self):
+        return self._payload
+
+
+def test_msgraph_plugin_exposes_expected_operations() -> bool:
+    """Verify the plugin metadata and registration expose the new operations."""
+    print("Testing Microsoft Graph plugin metadata and function registration...")
+
+    plugin = MSGraphPlugin({"name": "msgraph_plugin"})
+    expected_functions = {
+        "get_my_profile",
+        "get_my_timezone",
+        "get_my_events",
+        "get_my_messages",
+        "search_users",
+        "get_user_by_email",
+        "list_drive_items",
+        "get_my_security_alerts",
+    }
+
+    registered_functions = set(plugin.get_functions())
+    if expected_functions != registered_functions:
+        print(f"Unexpected function registration. Got: {sorted(registered_functions)}")
+        return False
+
+    method_names = {method["name"] for method in plugin.metadata.get("methods", [])}
+    missing_methods = expected_functions - method_names
+    if missing_methods:
+        print(f"Metadata missing methods: {sorted(missing_methods)}")
+        return False
+
+    print("Microsoft Graph plugin metadata includes the expected operations")
+    return True
+
+
+def test_msgraph_plugin_paginates_and_truncates_list_results() -> bool:
+    """Verify the shared Graph helper paginates list results up to the requested max."""
+    print("Testing Microsoft Graph helper pagination behavior...")
+
+    plugin = MSGraphPlugin({"name": "msgraph_plugin"})
+    original_token_helper = msgraph_module.get_valid_access_token_for_plugins
+    original_request = msgraph_module.requests.request
+
+    responses = [
+        FakeResponse(200, {"value": [{"id": "1"}, {"id": "2"}], "@odata.nextLink": "https://graph.microsoft.com/v1.0/me/messages?page=2"}),
+        FakeResponse(200, {"value": [{"id": "3"}, {"id": "4"}]})
+    ]
+    request_log = []
+
+    def fake_token_helper(scopes=None):
+        return {"access_token": "fake-token", "scopes": scopes}
+
+    def fake_request(method, url, headers=None, params=None, json=None, timeout=None):
+        request_log.append({
+            "method": method,
+            "url": url,
+            "headers": headers,
+            "params": params,
+            "timeout": timeout,
+        })
+        return responses.pop(0)
+
+    try:
+        msgraph_module.get_valid_access_token_for_plugins = fake_token_helper
+        msgraph_module.requests.request = fake_request
+
+        result = plugin.get_my_messages(top=3)
+
+        if result.get("count") != 3:
+            print(f"Expected 3 messages after pagination, got: {result}")
+            return False
+        if len(result.get("value", [])) != 3:
+            print(f"Expected truncated message list of length 3, got: {result.get('value', [])}")
+            return False
+        if not result.get("truncated"):
+            print(f"Expected truncated=True when additional page data remains, got: {result}")
+            return False
+        if len(request_log) != 2:
+            print(f"Expected 2 Graph requests, got {len(request_log)}")
+            return False
+
+        print("Microsoft Graph helper paginates and truncates list results safely")
+        return True
+    finally:
+        msgraph_module.get_valid_access_token_for_plugins = original_token_helper
+        msgraph_module.requests.request = original_request
+
+
+def test_msgraph_plugin_reads_mailbox_timezone() -> bool:
+    """Verify the plugin can read mailbox timezone settings for the signed-in user."""
+    print("Testing Microsoft Graph mailbox timezone lookup...")
+
+    plugin = MSGraphPlugin({"name": "msgraph_plugin"})
+    original_token_helper = msgraph_module.get_valid_access_token_for_plugins
+    original_request = msgraph_module.requests.request
+
+    request_log = []
+
+    def fake_token_helper(scopes=None):
+        request_log.append({"scopes": scopes})
+        return {"access_token": "fake-token", "scopes": scopes}
+
+    def fake_request(method, url, headers=None, params=None, json=None, timeout=None):
+        request_log.append({
+            "method": method,
+            "url": url,
+            "headers": headers,
+            "params": params,
+            "timeout": timeout,
+        })
+        return FakeResponse(
+            200,
+            {
+                "timeZone": "Pacific Standard Time",
+                "dateFormat": "M/d/yyyy",
+                "timeFormat": "h:mm tt",
+                "language": {"locale": "en-US", "displayName": "English (United States)"},
+                "workingHours": {"timeZone": {"name": "Pacific Standard Time"}},
+            },
+        )
+
+    try:
+        msgraph_module.get_valid_access_token_for_plugins = fake_token_helper
+        msgraph_module.requests.request = fake_request
+
+        result = plugin.get_my_timezone()
+        if result.get("time_zone") != "Pacific Standard Time":
+            print(f"Expected Pacific Standard Time, got: {result}")
+            return False
+        if result.get("time_format") != "h:mm tt":
+            print(f"Expected mailbox time format in result, got: {result}")
+            return False
+        if request_log[0].get("scopes") != ["MailboxSettings.Read"]:
+            print(f"Expected MailboxSettings.Read scope, got: {request_log[0]}")
+            return False
+        if not str(request_log[1].get("url", "")).endswith("/v1.0/me/mailboxSettings"):
+            print(f"Expected mailboxSettings request URL, got: {request_log[1]}")
+            return False
+
+        print("Microsoft Graph plugin reads mailbox timezone settings safely")
+        return True
+    finally:
+        msgraph_module.get_valid_access_token_for_plugins = original_token_helper
+        msgraph_module.requests.request = original_request
+
+
+def test_msgraph_plugin_surfaces_token_consent_errors() -> bool:
+    """Verify token acquisition failures are returned as structured plugin errors."""
+    print("Testing Microsoft Graph token consent error handling...")
+
+    plugin = MSGraphPlugin({"name": "msgraph_plugin"})
+    original_token_helper = msgraph_module.get_valid_access_token_for_plugins
+    original_request = msgraph_module.requests.request
+
+    def fake_token_helper(scopes=None):
+        return {
+            "error": "consent_required",
+            "message": "Consent is required.",
+            "consent_url": "https://example.test/consent",
+            "scopes": scopes,
+        }
+
+    def fail_if_called(*args, **kwargs):
+        raise AssertionError("requests.request should not be called when token acquisition fails")
+
+    try:
+        msgraph_module.get_valid_access_token_for_plugins = fake_token_helper
+        msgraph_module.requests.request = fail_if_called
+
+        result = plugin.search_users("Ada")
+        if result.get("error") != "consent_required":
+            print(f"Expected consent_required result, got: {result}")
+            return False
+        if result.get("operation") != "search_users":
+            print(f"Expected operation name in token error result, got: {result}")
+            return False
+
+        print("Microsoft Graph plugin surfaces consent requirements safely")
+        return True
+    finally:
+        msgraph_module.get_valid_access_token_for_plugins = original_token_helper
+        msgraph_module.requests.request = original_request
+
+
+if __name__ == "__main__":
+    tests = [
+        test_msgraph_plugin_exposes_expected_operations,
+        test_msgraph_plugin_paginates_and_truncates_list_results,
+        test_msgraph_plugin_reads_mailbox_timezone,
+        test_msgraph_plugin_surfaces_token_consent_errors,
+    ]
+
+    results = []
+    for test in tests:
+        print(f"\nRunning {test.__name__}...")
+        results.append(test())
+
+    success = all(results)
+    print(f"\nResults: {sum(results)}/{len(tests)} tests passed")
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_multi_endpoint_migration_auth_preserved.py b/functional_tests/test_multi_endpoint_migration_auth_preserved.py
new file mode 100644
index 00000000..dc2ea591
--- /dev/null
+++ b/functional_tests/test_multi_endpoint_migration_auth_preserved.py
@@ -0,0 +1,35 @@
+# test_multi_endpoint_migration_auth_preserved.py
+#!/usr/bin/env python3
+"""
+Functional test for multi-endpoint migration auth preservation.
+Version: 0.236.016
+Implemented in: 0.236.016
+
+This test ensures the migration preserves authentication type, API key,
+subscription ID, and resource group for Azure OpenAI endpoints.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file:
+        return file.read()
+
+
+def test_multi_endpoint_migration_auth_preserved():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), '..'))
+    route_path = os.path.join(repo_root, 'application', 'single_app', 'route_frontend_admin_settings.py')
+    content = read_file_text(route_path)
+
+    assert "legacy_auth_type" in content, "Expected legacy auth type mapping for migration."
+    assert "migrated_auth_type" in content, "Expected migrated auth type mapping for migration."
+    assert "azure_openai_gpt_key" in content, "Expected GPT API key migration."
+    assert "azure_openai_gpt_subscription_id" in content, "Expected subscription ID migration."
+    assert "azure_openai_gpt_resource_group" in content, "Expected resource group migration."
+
+    print("✅ Migration preserves auth type, API key, and subscription data.")
+
+
+if __name__ == "__main__":
+    test_multi_endpoint_migration_auth_preserved()
diff --git a/functional_tests/test_new_conversation_agent_model_refresh.py b/functional_tests/test_new_conversation_agent_model_refresh.py
new file mode 100644
index 00000000..7ff49706
--- /dev/null
+++ b/functional_tests/test_new_conversation_agent_model_refresh.py
@@ -0,0 +1,74 @@
+#!/usr/bin/env python3
+"""
+Functional test for new conversation agent/model refresh.
+Version: 0.236.066
+Implemented in: 0.236.066
+
+This test ensures new conversations refresh both agent and model lists and
+use activeGroupOid from user settings when loading group agents.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _read_file(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _assert_contains(text, snippet, file_label):
+    if snippet not in text:
+        raise AssertionError(f"Missing '{snippet}' in {file_label}")
+
+
+def test_new_conversation_agent_model_refresh():
+    """Verify refresh logic and activeGroupOid usage exist in UI code."""
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+
+    chat_agents_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-agents.js",
+    )
+    chat_retry_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-retry.js",
+    )
+    chat_conversations_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-conversations.js",
+    )
+
+    chat_agents_js = _read_file(chat_agents_path)
+    chat_retry_js = _read_file(chat_retry_path)
+    chat_conversations_js = _read_file(chat_conversations_path)
+
+    _assert_contains(chat_agents_js, "activeGroupOid", "chat-agents.js")
+    _assert_contains(chat_agents_js, "fetchGroupAgentsForActiveGroup(activeGroupId)", "chat-agents.js")
+    _assert_contains(chat_retry_js, "activeGroupOid", "chat-retry.js")
+    _assert_contains(chat_conversations_js, "refreshModelSelection", "chat-conversations.js")
+
+    print("✅ New conversation agent/model refresh logic verified")
+    return True
+
+
+if __name__ == "__main__":
+    success = test_new_conversation_agent_model_refresh()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_new_foundry_endpoint_api_version_handling.py b/functional_tests/test_new_foundry_endpoint_api_version_handling.py
new file mode 100644
index 00000000..8a87e5f3
--- /dev/null
+++ b/functional_tests/test_new_foundry_endpoint_api_version_handling.py
@@ -0,0 +1,62 @@
+# test_new_foundry_endpoint_api_version_handling.py
+#!/usr/bin/env python3
+"""
+Functional test for New Foundry endpoint API version handling.
+Version: 0.239.180
+Implemented in: 0.239.180
+
+This test ensures that New Foundry endpoints do not silently inherit the
+generic Azure OpenAI API-version default and that existing agents preserve
+their stored Responses API version instead of being overwritten by endpoint
+fallback values.
+"""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def assert_contains(file_path: Path, expected: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if expected not in content:
+        raise AssertionError(f"Expected to find {expected!r} in {file_path}")
+
+
+def test_new_foundry_endpoint_api_version_handling() -> None:
+    print("Testing New Foundry endpoint API version handling...")
+
+    endpoint_js = ROOT / "application" / "single_app" / "static" / "js" / "admin" / "admin_model_endpoints.js"
+    agent_modal_js = ROOT / "application" / "single_app" / "static" / "js" / "agent_modal_stepper.js"
+    loader_py = ROOT / "application" / "single_app" / "semantic_kernel_loader.py"
+    endpoint_modal = ROOT / "application" / "single_app" / "templates" / "_multiendpoint_modal.html"
+    config_file = ROOT / "application" / "single_app" / "config.py"
+
+    assert_contains(endpoint_js, 'const DEFAULT_AOAI_OPENAI_API_VERSION = "2024-05-01-preview";')
+    assert_contains(endpoint_js, 'return provider === "new_foundry" ? "" : DEFAULT_AOAI_OPENAI_API_VERSION;')
+    assert_contains(endpoint_js, 'if (provider === "new_foundry") {')
+    assert_contains(endpoint_js, 'endpointOpenAiApiVersionInput.value = "";')
+    assert_contains(agent_modal_js, "const fetchedResponsesApiVersion = payload.responses_api_version || '';")
+    assert_contains(agent_modal_js, 'const preserveCurrentSelection = this.shouldPreserveCurrentFoundrySelection(endpointId);')
+    assert_contains(agent_modal_js, "const storedResponsesApiVersion = currentFoundrySettings.responses_api_version || '';")
+    assert_contains(loader_py, 'stored_responses_api_version = (')
+    assert_contains(loader_py, 'or agent.get("azure_openai_gpt_api_version")')
+    assert_contains(agent_modal_js, "if (responsesApiVersionInput && selected.responses_api_version) {")
+    assert_contains(endpoint_modal, 'No default is applied for New Foundry')
+    assert_contains(config_file, 'VERSION = "0.239.180"')
+
+    print("✅ New Foundry endpoint API version handling verified.")
+
+
+if __name__ == "__main__":
+    success = True
+    try:
+        test_new_foundry_endpoint_api_version_handling()
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+
+        traceback.print_exc()
+        success = False
+
+    raise SystemExit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_new_foundry_fetch_support.py b/functional_tests/test_new_foundry_fetch_support.py
new file mode 100644
index 00000000..d978a67d
--- /dev/null
+++ b/functional_tests/test_new_foundry_fetch_support.py
@@ -0,0 +1,70 @@
+# test_new_foundry_fetch_support.py
+#!/usr/bin/env python3
+"""
+Functional test for new Foundry fetch support.
+Version: 0.239.180
+Implemented in: 0.239.180
+
+This test ensures that the backend exposes a new_foundry fetch path and that
+the agent modal can fetch and apply New Foundry application metadata.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_new_foundry_fetch_support_present():
+    """Validate New Foundry fetch plumbing across backend and modal files."""
+    print("🔍 Testing New Foundry fetch support...")
+
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    models_path = os.path.join(repo_root, "application", "single_app", "route_backend_models.py")
+    modal_js_path = os.path.join(repo_root, "application", "single_app", "static", "js", "agent_modal_stepper.js")
+    modal_html_path = os.path.join(repo_root, "application", "single_app", "templates", "_agent_modal.html")
+
+    models_content = read_file_text(models_path)
+    modal_js_content = read_file_text(modal_js_path)
+    modal_html_content = read_file_text(modal_html_path)
+
+    required_snippets = [
+        "list_new_foundry_agents_from_endpoint",
+        'if provider == "new_foundry":',
+        'agents = list_new_foundry_agents_from_endpoint(foundry_settings, get_settings())',
+        'id="agent-type-new-foundry" value="new_foundry"',
+        "foundryFetchBtnLabel.textContent = isNewFoundry ? 'Fetch Applications' : 'Fetch Agents';",
+        "const versionSuffix = agent.application_version ? ` (v${agent.application_version})` : '';",
+        '"responses_api_version": responses_api_version,',
+        "const fetchedResponsesApiVersion = payload.responses_api_version || '';",
+        "return normalizedProvider === this.getCurrentFoundryProvider();",
+        "applicationIdInput.value = selected.application_id || selected.id || '';",
+        'id="agent-foundry-fetch-btn-label"',
+        'id="agent-foundry-select-label"',
+    ]
+
+    combined = "\n".join([models_content, modal_js_content, modal_html_content])
+    missing = [snippet for snippet in required_snippets if snippet not in combined]
+    if missing:
+        raise AssertionError(f"Missing expected New Foundry fetch snippets: {', '.join(missing)}")
+
+    print("✅ New Foundry fetch support verified.")
+
+
+if __name__ == "__main__":
+    success = True
+    try:
+        test_new_foundry_fetch_support_present()
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+
+        traceback.print_exc()
+        success = False
+
+    raise SystemExit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_new_foundry_streaming_runtime.py b/functional_tests/test_new_foundry_streaming_runtime.py
new file mode 100644
index 00000000..0436a378
--- /dev/null
+++ b/functional_tests/test_new_foundry_streaming_runtime.py
@@ -0,0 +1,68 @@
+# test_new_foundry_streaming_runtime.py
+#!/usr/bin/env python3
+"""
+Functional test for new Foundry REST streaming runtime.
+Version: 0.239.177
+Implemented in: 0.239.177
+
+This test ensures that new Foundry application discovery stays REST-based,
+that the runtime exposes a streaming executor, and that the chat stream route
+emits agent deltas as they arrive instead of buffering them first.
+"""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def assert_contains(file_path: Path, expected: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if expected not in content:
+        raise AssertionError(f"Expected to find {expected!r} in {file_path}")
+
+
+def assert_not_contains(file_path: Path, forbidden: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if forbidden in content:
+        raise AssertionError(f"Did not expect to find {forbidden!r} in {file_path}")
+
+
+def test_new_foundry_streaming_runtime() -> None:
+    print("Testing new Foundry REST streaming runtime...")
+
+    runtime_path = ROOT / "application" / "single_app" / "foundry_agent_runtime.py"
+    chats_path = ROOT / "application" / "single_app" / "route_backend_chats.py"
+    models_path = ROOT / "application" / "single_app" / "route_backend_models.py"
+    config_path = ROOT / "application" / "single_app" / "config.py"
+
+    assert_contains(runtime_path, "async def execute_new_foundry_agent_stream(")
+    assert_contains(runtime_path, '"stream": stream')
+    assert_contains(runtime_path, "stream=True,")
+    assert_contains(runtime_path, "def _iter_sse_events(response: requests.Response):")
+    assert_contains(runtime_path, "yield FoundryAgentStreamMessage(content=delta_text)")
+    assert_not_contains(runtime_path, "from azure.ai.projects import AIProjectClient")
+
+    assert_contains(models_path, 'agents = list_new_foundry_agents_from_endpoint(foundry_settings, get_settings())')
+
+    assert_contains(chats_path, "agent_stream = selected_agent.invoke_stream(messages=agent_message_history)")
+    assert_contains(chats_path, "response = loop.run_until_complete(agent_stream.__anext__())")
+    assert_not_contains(chats_path, "chunks, stream_usage = loop.run_until_complete(stream_agent_async())")
+
+    assert_contains(config_path, 'VERSION = "0.239.177"')
+
+    print("✅ New Foundry REST streaming runtime verified.")
+
+
+if __name__ == "__main__":
+    try:
+        test_new_foundry_streaming_runtime()
+        success = True
+    except Exception as exc:
+        print(f"Test failed: {exc}")
+        import traceback
+
+        traceback.print_exc()
+        success = False
+
+    raise SystemExit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_new_foundry_ui_visibility.py b/functional_tests/test_new_foundry_ui_visibility.py
new file mode 100644
index 00000000..80da0b83
--- /dev/null
+++ b/functional_tests/test_new_foundry_ui_visibility.py
@@ -0,0 +1,60 @@
+# test_new_foundry_ui_visibility.py
+#!/usr/bin/env python3
+"""
+Functional test for New Foundry UI visibility.
+Version: 0.239.180
+Implemented in: 0.239.180
+
+This test ensures that New Foundry is exposed again in the agent modal,
+the endpoint modal, and frontend endpoint sanitization so the browser UI can
+configure and select New Foundry resources.
+"""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def assert_contains(file_path: Path, expected: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if expected not in content:
+        raise AssertionError(f"Expected to find {expected!r} in {file_path}")
+
+
+def assert_not_contains(file_path: Path, forbidden: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if forbidden in content:
+        raise AssertionError(f"Did not expect to find {forbidden!r} in {file_path}")
+
+
+def test_new_foundry_ui_visibility() -> None:
+    print("Testing New Foundry UI visibility...")
+
+    agent_modal = ROOT / "application" / "single_app" / "templates" / "_agent_modal.html"
+    endpoint_modal = ROOT / "application" / "single_app" / "templates" / "_multiendpoint_modal.html"
+    settings_file = ROOT / "application" / "single_app" / "functions_settings.py"
+    config_file = ROOT / "application" / "single_app" / "config.py"
+
+    assert_contains(agent_modal, 'id="agent-type-new-foundry"')
+    assert_not_contains(agent_modal, '{% if false %}')
+
+    assert_contains(endpoint_modal, '<option value="new_foundry">New Foundry</option>')
+    assert_contains(settings_file, 'return normalized_provider in {"aoai", "aifoundry", "new_foundry"}')
+    assert_contains(config_file, 'VERSION = "0.239.180"')
+
+    print("✅ New Foundry UI visibility verified.")
+
+
+if __name__ == "__main__":
+    success = True
+    try:
+        test_new_foundry_ui_visibility()
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+
+        traceback.print_exc()
+        success = False
+
+    raise SystemExit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_new_foundry_version_metadata.py b/functional_tests/test_new_foundry_version_metadata.py
new file mode 100644
index 00000000..ab89a67e
--- /dev/null
+++ b/functional_tests/test_new_foundry_version_metadata.py
@@ -0,0 +1,61 @@
+# test_new_foundry_version_metadata.py
+#!/usr/bin/env python3
+"""
+Functional test for New Foundry version metadata handling.
+Version: 0.239.180
+Implemented in: 0.239.180
+
+This test ensures that published New Foundry application versions are read from
+the fetched payload, shown in the selector label, and no longer require manual
+entry in the agent modal.
+"""
+
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def assert_contains(file_path: Path, expected: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if expected not in content:
+        raise AssertionError(f"Expected to find {expected!r} in {file_path}")
+
+
+def assert_not_contains(file_path: Path, forbidden: str) -> None:
+    content = file_path.read_text(encoding="utf-8")
+    if forbidden in content:
+        raise AssertionError(f"Did not expect to find {forbidden!r} in {file_path}")
+
+
+def test_new_foundry_version_metadata() -> None:
+    print("Testing New Foundry version metadata handling...")
+
+    runtime_path = ROOT / "application" / "single_app" / "foundry_agent_runtime.py"
+    modal_js_path = ROOT / "application" / "single_app" / "static" / "js" / "agent_modal_stepper.js"
+    modal_html_path = ROOT / "application" / "single_app" / "templates" / "_agent_modal.html"
+    config_path = ROOT / "application" / "single_app" / "config.py"
+
+    assert_contains(runtime_path, '_extract_nested_version_value(item.get("versions"))')
+    assert_contains(runtime_path, '_extract_nested_version_value(properties.get("versions"))')
+    assert_contains(modal_js_path, 'const versionSuffix = agent.application_version ? ` (v${agent.application_version})` : \'\';')
+    assert_contains(modal_html_path, 'id="agent-new-foundry-application-version"')
+    assert_contains(modal_html_path, 'type="hidden" id="agent-new-foundry-application-version"')
+    assert_not_contains(modal_html_path, '<label for="agent-new-foundry-application-version" class="form-label">Version</label>')
+    assert_contains(config_path, 'VERSION = "0.239.180"')
+
+    print("✅ New Foundry version metadata handling verified.")
+
+
+if __name__ == "__main__":
+    success = True
+    try:
+        test_new_foundry_version_metadata()
+    except Exception as exc:
+        print(f"❌ Test failed: {exc}")
+        import traceback
+
+        traceback.print_exc()
+        success = False
+
+    raise SystemExit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_pending_thought_message_scoping.py b/functional_tests/test_pending_thought_message_scoping.py
new file mode 100644
index 00000000..8865a185
--- /dev/null
+++ b/functional_tests/test_pending_thought_message_scoping.py
@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+# test_pending_thought_message_scoping.py
+"""
+Functional test for pending thought message scoping.
+Version: 0.239.185
+Implemented in: 0.239.185
+
+This test ensures the pending-thought polling path can be scoped to the active
+assistant message so reconnect and fallback flows do not read thoughts from a
+different in-flight reply.
+"""
+
+import os
+import sys
+
+
+ROOT_DIR = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+THOUGHTS_FILE = os.path.join(
+    ROOT_DIR,
+    'application', 'single_app', 'functions_thoughts.py'
+)
+ROUTE_FILE = os.path.join(
+    ROOT_DIR,
+    'application', 'single_app', 'route_backend_thoughts.py'
+)
+CLIENT_FILE = os.path.join(
+    ROOT_DIR,
+    'application', 'single_app', 'static', 'js', 'chat', 'chat-thoughts.js'
+)
+
+
+def read_file_content(file_path):
+    with open(file_path, 'r', encoding='utf-8') as file_handle:
+        return file_handle.read()
+
+
+def test_pending_thoughts_support_optional_message_id_scope():
+    """Verify the backend query path supports an explicit message scope."""
+    print('🔍 Testing pending thought backend message scoping...')
+
+    thoughts_content = read_file_content(THOUGHTS_FILE)
+
+    checks = {
+        'optional message_id parameter': 'def get_pending_thoughts(conversation_id, user_id, message_id=None):' in thoughts_content,
+        'query supports message filter': 'AND c.message_id = @msg_id ' in thoughts_content,
+        'message filter parameter append': 'params.append({"name": "@msg_id", "value": message_id})' in thoughts_content,
+        'message scoped branch': 'if message_id:' in thoughts_content,
+        'legacy fallback branch preserved': 'latest_message_id = results[0].get(\'message_id\')' in thoughts_content,
+    }
+
+    all_passed = True
+    for name, passed in checks.items():
+        status = 'PASS' if passed else 'FAIL'
+        print(f'  [{status}] {name}')
+        if not passed:
+            all_passed = False
+
+    assert all_passed
+
+
+def test_pending_thought_route_forwards_query_message_id():
+    """Verify the route reads message_id from the query string and returns it."""
+    print('\n🔍 Testing pending thought route query forwarding...')
+
+    route_content = read_file_content(ROUTE_FILE)
+
+    checks = {
+        'route reads query string message_id': "message_id = request.args.get('message_id')" in route_content,
+        'route forwards scoped query': 'get_pending_thoughts(conversation_id, user_id, message_id=message_id)' in route_content,
+        'sanitized response includes message_id': "'message_id': t.get('message_id')" in route_content,
+    }
+
+    all_passed = True
+    for name, passed in checks.items():
+        status = 'PASS' if passed else 'FAIL'
+        print(f'  [{status}] {name}')
+        if not passed:
+            all_passed = False
+
+    assert all_passed
+
+
+def test_pending_thought_client_builds_scoped_request_urls():
+    """Verify the browser helper can request pending thoughts for one message."""
+    print('\n🔍 Testing pending thought client URL construction...')
+
+    client_content = read_file_content(CLIENT_FILE)
+
+    checks = {
+        'pending url helper exists': 'function buildPendingThoughtsUrl(conversationId, messageId = null)' in client_content,
+        'query param name is message_id': "queryParams.set('message_id', messageId);" in client_content,
+        'startThoughtPolling accepts message id': 'export function startThoughtPolling(conversationId, messageId = null)' in client_content,
+        'startStreamingThoughtPolling accepts message id': 'export function startStreamingThoughtPolling(conversationId, messageId = null)' in client_content,
+    }
+
+    all_passed = True
+    for name, passed in checks.items():
+        status = 'PASS' if passed else 'FAIL'
+        print(f'  [{status}] {name}')
+        if not passed:
+            all_passed = False
+
+    assert all_passed
+
+
+if __name__ == '__main__':
+    tests = [
+        test_pending_thoughts_support_optional_message_id_scope,
+        test_pending_thought_route_forwards_query_message_id,
+        test_pending_thought_client_builds_scoped_request_urls,
+    ]
+
+    success = True
+    passed = 0
+    total = len(tests)
+
+    for test in tests:
+        print(f'\n🧪 Running {test.__name__}...')
+        try:
+            test()
+            passed += 1
+        except Exception:
+            success = False
+            import traceback
+
+            traceback.print_exc()
+
+    print(f'\n📊 Results: {passed}/{total} tests passed')
+    sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_personal_agent_dropdown_in_chats_fix.py b/functional_tests/test_personal_agent_dropdown_in_chats_fix.py
new file mode 100644
index 00000000..df5175a0
--- /dev/null
+++ b/functional_tests/test_personal_agent_dropdown_in_chats_fix.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""
+Functional test for personal agent dropdown visibility in chats.
+Version: 0.236.061
+Implemented in: 0.236.061
+
+This test ensures that chat agent dropdown logic treats invalid active group IDs
+("None", "null", "undefined") as empty so personal agents are included.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _read_file(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _assert_normalization_guard(js_text, file_label):
+    required_snippets = [
+        "rawGroupId",
+        "activeGroupId",
+        "['none', 'null', 'undefined']",
+    ]
+    missing = [snippet for snippet in required_snippets if snippet not in js_text]
+    if missing:
+        raise AssertionError(
+            f"Missing normalization guard in {file_label}: {', '.join(missing)}"
+        )
+
+
+def test_personal_agent_dropdown_guard():
+    """Verify chat dropdown guards against bogus active group ids."""
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    chat_agents_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-agents.js",
+    )
+    chat_retry_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-retry.js",
+    )
+
+    chat_agents_js = _read_file(chat_agents_path)
+    chat_retry_js = _read_file(chat_retry_path)
+
+    _assert_normalization_guard(chat_agents_js, "chat-agents.js")
+    _assert_normalization_guard(chat_retry_js, "chat-retry.js")
+
+    print("✅ Personal agent dropdown guard is present in chat JS files")
+    return True
+
+
+if __name__ == "__main__":
+    success = test_personal_agent_dropdown_guard()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_personal_agent_dropdown_scope_fix.py b/functional_tests/test_personal_agent_dropdown_scope_fix.py
new file mode 100644
index 00000000..dc0ec81d
--- /dev/null
+++ b/functional_tests/test_personal_agent_dropdown_scope_fix.py
@@ -0,0 +1,69 @@
+#!/usr/bin/env python3
+"""
+Functional test for personal agent dropdown scope in chats.
+Version: 0.236.062
+Implemented in: 0.236.062
+
+This test ensures the chat agent dropdown only treats group agents as active
+when the group chat tab is explicitly selected.
+"""
+
+import os
+import sys
+
+sys.path.append(os.path.dirname(os.path.abspath(__file__)))
+
+
+def _read_file(path):
+    with open(path, "r", encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _assert_group_chat_guard(js_text, file_label):
+    required_snippets = [
+        "activeChatTabType",
+        "isGroupChat",
+        "activeGroupId",
+    ]
+    missing = [snippet for snippet in required_snippets if snippet not in js_text]
+    if missing:
+        raise AssertionError(
+            f"Missing group chat scope guard in {file_label}: {', '.join(missing)}"
+        )
+
+
+def test_personal_agent_dropdown_scope_guard():
+    """Verify agent dropdown uses explicit group chat tab selection."""
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    chat_agents_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-agents.js",
+    )
+    chat_retry_path = os.path.join(
+        repo_root,
+        "application",
+        "single_app",
+        "static",
+        "js",
+        "chat",
+        "chat-retry.js",
+    )
+
+    chat_agents_js = _read_file(chat_agents_path)
+    chat_retry_js = _read_file(chat_retry_path)
+
+    _assert_group_chat_guard(chat_agents_js, "chat-agents.js")
+    _assert_group_chat_guard(chat_retry_js, "chat-retry.js")
+
+    print("✅ Agent dropdown scope guard present for group chat only")
+    return True
+
+
+if __name__ == "__main__":
+    success = test_personal_agent_dropdown_scope_guard()
+    sys.exit(0 if success else 1)
diff --git a/functional_tests/test_personal_agent_user_id_saved.py b/functional_tests/test_personal_agent_user_id_saved.py
new file mode 100644
index 00000000..2a76d36b
--- /dev/null
+++ b/functional_tests/test_personal_agent_user_id_saved.py
@@ -0,0 +1,52 @@
+# test_personal_agent_user_id_saved.py
+#!/usr/bin/env python3
+"""
+Functional test for personal agent user_id persistence.
+Version: 0.236.050
+Implemented in: 0.236.050
+
+This test ensures personal agent saves assign user_id to the persisted payload.
+"""
+
+import os
+
+
+def read_file_text(file_path):
+    with open(file_path, "r", encoding="utf-8") as file:
+        return file.read()
+
+
+def test_personal_agent_user_id_saved():
+    repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+    file_path = os.path.join(repo_root, "application", "single_app", "functions_personal_agents.py")
+    content = read_file_text(file_path)
+
+    assert "agent_data['user_id'] = user_id" in content, "Expected user_id to be set on persisted agent payload."
+    assert "agent_data['last_updated']" in content, "Expected last_updated to be set on persisted agent payload."
+
+    print("✅ Personal agent save user_id persistence verified.")
+
+
+def run_tests():
+    tests = [test_personal_agent_user_id_saved]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    raise SystemExit(0 if run_tests() else 1)
diff --git a/functional_tests/test_profile_dashboard.py b/functional_tests/test_profile_dashboard.py
index 1fa05f5d..f85d8baa 100644
--- a/functional_tests/test_profile_dashboard.py
+++ b/functional_tests/test_profile_dashboard.py
@@ -40,7 +40,7 @@ def test_profile_endpoints():
                     item=test_user_id, 
                     partition_key=test_user_id
                 )
-            except:
+            except Exception as ex:
                 # Create test user settings
                 user_doc = {
                     'id': test_user_id,
@@ -316,7 +316,7 @@ def test_profile_endpoints():
                         item=activity['id'],
                         partition_key=activity['user_id']
                     )
-                except:
+                except Exception as ex:
                     pass
             
             # Optionally delete test user (uncomment if needed)
@@ -325,7 +325,7 @@ def test_profile_endpoints():
             #         item=test_user_id,
             #         partition_key=test_user_id
             #     )
-            # except:
+            # except Exception as ex:
             #     pass
             
             print("   ✅ Test data cleaned up successfully")
diff --git a/functional_tests/test_streaming_only_chat_path.py b/functional_tests/test_streaming_only_chat_path.py
index 540e08a6..053fe747 100644
--- a/functional_tests/test_streaming_only_chat_path.py
+++ b/functional_tests/test_streaming_only_chat_path.py
@@ -2,7 +2,7 @@
 #!/usr/bin/env python3
 """
 Functional test for streaming-only chat path migration.
-Version: 0.239.137
+Version: 0.239.185
 Implemented in: 0.239.137
 
 This test ensures that first-party chat clients use the streaming chat path,
@@ -30,7 +30,7 @@ def assert_not_contains(file_path: Path, forbidden: str) -> None:
         raise AssertionError(f"Did not expect to find {forbidden!r} in {file_path}")
 
 
-def test_streaming_only_chat_path() -> bool:
+def test_streaming_only_chat_path() -> None:
     print("Testing streaming-only chat path migration...")
 
     chat_messages = ROOT / "application" / "single_app" / "static" / "js" / "chat" / "chat-messages.js"
@@ -62,17 +62,17 @@ def test_streaming_only_chat_path() -> bool:
 
     assert_not_contains(chats_template, "streaming-toggle-btn")
     assert_not_contains(chats_template, "streaming-badge")
-    assert_contains(route_backend_chats, "return build_background_stream_response(generate_compatibility_response)")
-    assert_contains(route_backend_chats, "return build_background_stream_response(generate)")
-    assert_contains(config_file, 'VERSION = "0.239.137"')
+    assert_contains(route_backend_chats, "return build_background_stream_response(generate_compatibility_response, stream_session=stream_session)")
+    assert_contains(route_backend_chats, "return build_background_stream_response(generate, stream_session=stream_session)")
+    assert_contains(config_file, 'VERSION = "0.239.185"')
 
     print("Streaming-only chat path checks passed!")
-    return True
 
 
 if __name__ == "__main__":
     try:
-        success = test_streaming_only_chat_path()
+        test_streaming_only_chat_path()
+        success = True
     except Exception as exc:
         print(f"Test failed: {exc}")
         import traceback
diff --git a/functional_tests/test_streaming_thought_finalization.py b/functional_tests/test_streaming_thought_finalization.py
index 27acfa73..d6f7a359 100644
--- a/functional_tests/test_streaming_thought_finalization.py
+++ b/functional_tests/test_streaming_thought_finalization.py
@@ -1,12 +1,13 @@
 #!/usr/bin/env python3
 # test_streaming_thought_finalization.py
 """
-Functional test for streaming thought finalization fix.
-Version: 0.239.116
-Implemented in: 0.239.116
+Functional test for streaming thought rendering and finalization fixes.
+Version: 0.239.185
+Implemented in: 0.239.185
 
 This test ensures the streaming client buffers split SSE events and prevents
-late thought updates from replacing already-streamed assistant content.
+late or stale thought updates from replacing already-streamed assistant content
+or leaking across consecutive streaming responses.
 """
 
 import os
@@ -22,6 +23,14 @@
     ROOT_DIR,
     'application', 'single_app', 'static', 'js', 'chat', 'chat-thoughts.js'
 )
+PLUGIN_THOUGHTS_FILE = os.path.join(
+    ROOT_DIR,
+    'application', 'single_app', 'semantic_kernel_plugins', 'plugin_invocation_thoughts.py'
+)
+ROUTE_BACKEND_CHATS_FILE = os.path.join(
+    ROOT_DIR,
+    'application', 'single_app', 'route_backend_chats.py'
+)
 
 
 def read_file_content(file_path):
@@ -53,11 +62,11 @@ def test_streaming_parser_buffers_split_sse_events():
             if not passed:
                 all_passed = False
 
-        return all_passed
+        assert all_passed
 
     except Exception as exc:
         print(f'  [FAIL] Exception: {exc}')
-        return False
+        raise
 
 
 def test_late_thoughts_do_not_replace_streamed_content():
@@ -69,7 +78,8 @@ def test_late_thoughts_do_not_replace_streamed_content():
         thoughts_content = read_file_content(THOUGHTS_FILE)
 
         checks = {
-            'content-start tracking': "messageElement.dataset.streamingHasContent = 'true';" in streaming_content,
+            'content-start helper import': 'markStreamingThoughtContentStarted' in streaming_content,
+            'content-start helper call': 'markStreamingThoughtContentStarted(messageId);' in streaming_content,
             'thought guard before render': "if (!hasStreamedContent && !streamCompleted) {" in streaming_content,
             'thought module data guard': "if (messageElement.dataset.streamingHasContent === 'true') {" in thoughts_content,
             'thought module early return': 'return;' in thoughts_content,
@@ -82,27 +92,100 @@ def test_late_thoughts_do_not_replace_streamed_content():
             if not passed:
                 all_passed = False
 
-        return all_passed
+        assert all_passed
 
     except Exception as exc:
         print(f'  [FAIL] Exception: {exc}')
-        return False
+        raise
+
+
+def test_streaming_thoughts_are_scoped_to_the_active_message():
+    """Verify streaming thoughts target the current placeholder and include message identity."""
+    print('\n🔍 Testing streaming thought message scoping...')
+
+    try:
+        streaming_content = read_file_content(STREAMING_FILE)
+        thoughts_content = read_file_content(THOUGHTS_FILE)
+        backend_content = read_file_content(ROUTE_BACKEND_CHATS_FILE)
+
+        checks = {
+            'streaming session starts with placeholder id': 'beginStreamingThoughtSession(tempAiMessageId);' in streaming_content,
+            'sse thought handler receives placeholder id': 'handleStreamingThought(data, tempAiMessageId);' in streaming_content,
+            'streaming path no longer starts pending-thought polling': 'startStreamingThoughtPolling(thoughtConversationId);' not in streaming_content,
+            'thought renderer uses message helper': 'function getStreamingMessageElement(messageId)' in thoughts_content,
+            'session reset helper': 'function resetStreamingPlaceholderState(messageElement)' in thoughts_content,
+            'thought renderer tracks active backend message id': 'activeStreamingServerMessageId' in thoughts_content,
+            'thought renderer ignores mismatched message ids': 'activeStreamingServerMessageId !== thoughtData.message_id' in thoughts_content,
+            'thought renderer tracks dedupe signature': 'streamingThoughtSignature' in thoughts_content,
+            'backend thought sse includes message id': "'message_id': assistant_message_id" in backend_content,
+        }
+
+        all_passed = True
+        for name, passed in checks.items():
+            status = 'PASS' if passed else 'FAIL'
+            print(f'  [{status}] {name}')
+            if not passed:
+                all_passed = False
+
+        assert all_passed
+
+    except Exception as exc:
+        print(f'  [FAIL] Exception: {exc}')
+        raise
+
+
+def test_plugin_invocation_thoughts_stream_live_during_agent_execution():
+    """Verify plugin invocation callbacks can publish live SSE thought events."""
+    print('\n🔍 Testing live plugin invocation thought emission...')
+
+    try:
+        route_content = read_file_content(ROUTE_BACKEND_CHATS_FILE)
+        plugin_thoughts_content = read_file_content(PLUGIN_THOUGHTS_FILE)
+
+        checks = {
+            'callback helper supports live callback': 'live_thought_callback=None' in plugin_thoughts_content,
+            'callback publishes live payload': "live_payload['step_index'] = thought_tracker.current_index - 1" in plugin_thoughts_content,
+            'stream route defines background publisher': 'def publish_background_event(event_text):' in route_content,
+            'stream route defines live plugin publisher': 'def publish_live_plugin_thought(thought_payload):' in route_content,
+            'agent callback registers live publisher': 'live_thought_callback=publish_live_plugin_thought' in route_content,
+            'completion replay removed': 'thought_tracker.current_index += 1' not in route_content,
+        }
+
+        all_passed = True
+        for name, passed in checks.items():
+            status = 'PASS' if passed else 'FAIL'
+            print(f'  [{status}] {name}')
+            if not passed:
+                all_passed = False
+
+        assert all_passed
+
+    except Exception as exc:
+        print(f'  [FAIL] Exception: {exc}')
+        raise
 
 
 if __name__ == '__main__':
     tests = [
         test_streaming_parser_buffers_split_sse_events,
         test_late_thoughts_do_not_replace_streamed_content,
+        test_streaming_thoughts_are_scoped_to_the_active_message,
+        test_plugin_invocation_thoughts_stream_live_during_agent_execution,
     ]
 
-    results = []
+    success = True
+    passed = 0
+    total = len(tests)
     for test in tests:
         print(f'\n🧪 Running {test.__name__}...')
-        results.append(test())
-
-    passed = sum(1 for result in results if result)
-    total = len(results)
-    success = passed == total
+        try:
+            test()
+            passed += 1
+        except Exception:
+            success = False
+            import traceback
+
+            traceback.print_exc()
 
     print(f'\n📊 Results: {passed}/{total} tests passed')
     sys.exit(0 if success else 1)
\ No newline at end of file
diff --git a/functional_tests/test_workspace_multi_endpoints.py b/functional_tests/test_workspace_multi_endpoints.py
new file mode 100644
index 00000000..df5a7f0a
--- /dev/null
+++ b/functional_tests/test_workspace_multi_endpoints.py
@@ -0,0 +1,155 @@
+# test_workspace_multi_endpoints.py
+"""
+Functional test for workspace multi-endpoint routing.
+Version: 0.239.155
+Implemented in: 0.239.155
+
+This test ensures that workspace multi-endpoint payloads are sanitized and that
+agent payloads accept multi-endpoint selection fields.
+"""
+
+import sys
+import os
+import importlib
+import json
+import types
+
+repo_root = os.path.abspath(os.path.join(os.path.dirname(__file__), ".."))
+single_app_root = os.path.join(repo_root, "application", "single_app")
+sys.path.append(repo_root)
+sys.path.append(single_app_root)
+
+from application.single_app.functions_agent_payload import sanitize_agent_payload
+
+
+def _restore_modules(original_modules):
+    for module_name, original_module in original_modules.items():
+        if original_module is None:
+            sys.modules.pop(module_name, None)
+        else:
+            sys.modules[module_name] = original_module
+
+
+def _load_functions_settings_module():
+    config_stub = types.ModuleType("config")
+    config_stub.json = json
+
+    appinsights_stub = types.ModuleType("functions_appinsights")
+    appinsights_stub.log_event = lambda *args, **kwargs: None
+
+    cache_stub = types.ModuleType("app_settings_cache")
+    cache_stub.get_settings_cache = lambda: None
+    cache_stub.update_settings_cache = lambda settings: None
+
+    original_modules = {}
+    for module_name, module_stub in {
+        "config": config_stub,
+        "functions_appinsights": appinsights_stub,
+        "app_settings_cache": cache_stub,
+    }.items():
+        original_modules[module_name] = sys.modules.get(module_name)
+        sys.modules[module_name] = module_stub
+
+    original_modules["application.single_app.functions_settings"] = sys.modules.get("application.single_app.functions_settings")
+    sys.modules.pop("application.single_app.functions_settings", None)
+    module = importlib.import_module("application.single_app.functions_settings")
+    return module, original_modules
+
+
+def test_model_endpoint_sanitization():
+    """Ensure secrets are stripped and flags are preserved."""
+    functions_settings, original_modules = _load_functions_settings_module()
+    endpoints = [
+        {
+            "id": "endpoint-1",
+            "name": "Personal Endpoint",
+            "provider": "aoai",
+            "auth": {
+                "type": "api_key",
+                "api_key": "super-secret"
+            },
+            "connection": {
+                "endpoint": "https://example.openai.azure.com",
+                "openai_api_version": "2024-05-01-preview"
+            },
+            "models": [
+                {"id": "model-1", "deploymentName": "gpt-4o", "enabled": True}
+            ]
+        }
+    ]
+    try:
+        sanitized = functions_settings.sanitize_model_endpoints_for_frontend(endpoints)
+        assert sanitized[0]["auth"].get("api_key") is None
+        assert sanitized[0]["has_api_key"] is True
+
+        service_principal_endpoints = [
+            {
+                "id": "endpoint-2",
+                "name": "Foundry Endpoint",
+                "provider": "aifoundry",
+                "auth": {
+                    "type": "service_principal",
+                    "client_secret": "client-secret-value"
+                },
+                "connection": {
+                    "endpoint": "https://foundry.example.azure.com",
+                    "openai_api_version": "2024-05-01-preview"
+                },
+                "models": []
+            }
+        ]
+        sanitized_sp = functions_settings.sanitize_model_endpoints_for_frontend(service_principal_endpoints)
+        assert sanitized_sp[0]["auth"].get("client_secret") is None
+        assert sanitized_sp[0]["has_client_secret"] is True
+    finally:
+        _restore_modules(original_modules)
+
+
+def test_agent_payload_multi_endpoint_fields():
+    """Ensure agent payload accepts multi-endpoint selection fields."""
+    agent_payload = {
+        "id": "123e4567-e89b-12d3-a456-426614174000",
+        "name": "workspace_agent",
+        "display_name": "Workspace Agent",
+        "description": "Test agent",
+        "instructions": "Be helpful",
+        "actions_to_load": [],
+        "other_settings": {},
+        "max_completion_tokens": 256,
+        "agent_type": "local",
+        "is_global": False,
+        "is_group": False,
+        "model_endpoint_id": "endpoint-1",
+        "model_id": "model-1",
+        "model_provider": "aoai",
+        "azure_openai_gpt_deployment": "gpt-4o"
+    }
+    sanitized = sanitize_agent_payload(agent_payload)
+    assert sanitized.get("model_endpoint_id") == "endpoint-1"
+    assert sanitized.get("model_id") == "model-1"
+    assert sanitized.get("model_provider") == "aoai"
+
+
+def run_tests():
+    tests = [test_model_endpoint_sanitization, test_agent_payload_multi_endpoint_fields]
+    results = []
+
+    for test in tests:
+        print(f"\n🧪 Running {test.__name__}...")
+        try:
+            test()
+            print("✅ Test passed")
+            results.append(True)
+        except Exception as exc:
+            print(f"❌ Test failed: {exc}")
+            import traceback
+            traceback.print_exc()
+            results.append(False)
+
+    success = all(results)
+    print(f"\n📊 Results: {sum(results)}/{len(results)} tests passed")
+    return success
+
+
+if __name__ == "__main__":
+    sys.exit(0 if run_tests() else 1)
diff --git a/msgraph_test_output.txt b/msgraph_test_output.txt
new file mode 100644
index 00000000..24e1c1a5
--- /dev/null
+++ b/msgraph_test_output.txt
@@ -0,0 +1,66 @@
+C:\Repos\simplechatmsft\.venv\Lib\site-packages\requests\__init__.py:113: RequestsDependencyWarning: urllib3 (2.6.3) or chardet (7.3.0)/charset_normalizer (3.4.6) doesn't match a supported version!
+  warnings.warn(
+[Plugin Function Logger] Function completed successfully
+Plugin function executed successfully
+[Plugin Invocation] MSGraphPlugin.get_my_messages
+[Plugin Function Logger] Function completed successfully
+Plugin function executed successfully
+[Plugin Invocation] MSGraphPlugin.get_my_timezone
+[Plugin Function Logger] Function completed successfully
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'get_my_profile', 'plugin_name': 'MSGraphPlugin'}
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'get_my_timezone', 'plugin_name': 'MSGraphPlugin'}
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'get_my_events', 'plugin_name': 'MSGraphPlugin'}
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'get_my_messages', 'plugin_name': 'MSGraphPlugin'}
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'search_users', 'plugin_name': 'MSGraphPlugin'}
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'get_user_by_email', 'plugin_name': 'MSGraphPlugin'}
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'list_drive_items', 'plugin_name': 'MSGraphPlugin'}
+[Log] [Plugin Function Logger] Decorating function for plugin -- {'function_name': 'get_my_security_alerts', 'plugin_name': 'MSGraphPlugin'}
+
+Running test_msgraph_plugin_exposes_expected_operations...
+Testing Microsoft Graph plugin metadata and function registration...
+Microsoft Graph plugin metadata includes the expected operations
+
+Running test_msgraph_plugin_paginates_and_truncates_list_results...
+Testing Microsoft Graph helper pagination behavior...
+[Log] [Plugin Function Logger] Function call started -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_messages'}
+[Log] [Plugin Function Logger] Function parameters -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_messages', 'parameters': {'top': 3}, 'param_string': 'top=3'}
+Warning: Failed to get settings from cache, read from Cosmos DB instead. Called from C:\Repos\simplechatmsft\application\single_app\functions_debug.py:46 in debug_print().
+[DEBUG] [INFO]: [MSGraphPlugin] get_my_messages requesting https://graph.microsoft.com/v1.0/me/mailFolders/inbox/messages params={'$top': 3, '$select': 'id,subject,from,receivedDateTime,isRead,importance,webLink', '$orderby': 'receivedDateTime desc'}
+Warning: Failed to get settings from cache, read from Cosmos DB instead. Called from C:\Repos\simplechatmsft\application\single_app\functions_debug.py:46 in debug_print().
+[DEBUG] [INFO]: [MSGraphPlugin] get_my_messages requesting https://graph.microsoft.com/v1.0/me/messages?page=2 params=None
+[Log] [Plugin Function Logger] Function completed successfully -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_messages', 'result_preview': "{'operation': 'get_my_messages', 'count': 3, 'value': [{'id': '1'}, {'id': '2'}, {'id': '3'}], 'next_link': None, 'truncated': True}", 'duration_ms': 190.74654579162598, 'full_function_name': 'MSGraphPlugin.get_my_messages'}
+Warning: Failed to get settings from cache, read from Cosmos DB instead. Called from C:\Repos\simplechatmsft\application\single_app\functions_debug.py:46 in debug_print().
+[DEBUG] [INFO]: [Plugin SUCCESS] MSGraphPlugin.get_my_messages (190.7ms)
+[Log] Plugin function executed successfully -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_messages', 'duration_ms': 190.74654579162598, 'success': True, 'user_id': None, 'timestamp': '2026-03-26T03:02:20.809761', 'parameter_count': 1, 'parameters': {'top': '3'}, 'result_preview': "{'operation': 'get_my_messages', 'count': 3, 'value': [{'id': '1'}, {'id': '2'}, {'id': '3'}], 'next_link': None, 'truncated': True}", 'result_type': 'dict'}
+[Log] [Plugin Invocation] MSGraphPlugin.get_my_messages -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_messages', 'duration_ms': 190.74654579162598, 'success': True, 'user_id': None, 'timestamp': '2026-03-26T03:02:20.809761', 'parameter_count': 1, 'result_type': 'dict', 'error_message': None, 'parameters': {'top': '3'}, 'result_preview': "{'operation': 'get_my_messages', 'count': 3, 'value': [{'id': '1'}, {'id': '2'}, {'id': '3'}], 'next_link': None, 'truncated': True}"}
+Microsoft Graph helper paginates and truncates list results safely
+
+Running test_msgraph_plugin_reads_mailbox_timezone...
+Testing Microsoft Graph mailbox timezone lookup...
+[Log] [Plugin Function Logger] Function call started -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_timezone'}
+[Log] [Plugin Function Logger] Function parameters -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_timezone', 'parameters': {}, 'param_string': 'no parameters'}
+Warning: Failed to get settings from cache, read from Cosmos DB instead. Called from C:\Repos\simplechatmsft\application\single_app\functions_debug.py:46 in debug_print().
+[DEBUG] [INFO]: [MSGraphPlugin] get_my_timezone requesting https://graph.microsoft.com/v1.0/me/mailboxSettings params={}
+[Log] [Plugin Function Logger] Function completed successfully -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_timezone', 'result_preview': "{'operation': 'get_my_timezone', 'time_zone': 'Pacific Standard Time', 'date_format': 'M/d/yyyy', 'time_format': 'h:mm tt', 'language': {'locale': 'en-US', 'displayName': 'English (United States)'}, '...", 'duration_ms': 95.86191177368164, 'full_function_name': 'MSGraphPlugin.get_my_timezone'}
+Warning: Failed to get settings from cache, read from Cosmos DB instead. Called from C:\Repos\simplechatmsft\application\single_app\functions_debug.py:46 in debug_print().
+[DEBUG] [INFO]: [Plugin SUCCESS] MSGraphPlugin.get_my_timezone (95.9ms)
+[Log] Plugin function executed successfully -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_timezone', 'duration_ms': 95.86191177368164, 'success': True, 'user_id': None, 'timestamp': '2026-03-26T03:02:21.010018', 'result_preview': "{'operation': 'get_my_timezone', 'time_zone': 'Pacific Standard Time', 'date_format': 'M/d/yyyy', 'time_format': 'h:mm tt', 'language': {'locale': 'en-US', 'displayName': 'English (United States)'}, '...", 'result_type': 'dict'}
+[Log] [Plugin Invocation] MSGraphPlugin.get_my_timezone -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'get_my_timezone', 'duration_ms': 95.86191177368164, 'success': True, 'user_id': None, 'timestamp': '2026-03-26T03:02:21.010018', 'parameter_count': 0, 'result_type': 'dict', 'error_message': None, 'result_preview': '{\'operation\': \'get_my_timezone\', \'time_zone\': \'Pacific Standard Time\', \'date_format\': \'M/d/yyyy\', \'time_format\': \'h:mm tt\', \'language\': {\'locale\': \'en-US\', \'displayName\': \'English (United States)\'}, \'working_hours_time_zone\': {\'name\': \'Pacific Standard Time\'}, \'message\': "Use the user\'s mailbox time_zone instead of assuming UTC when answering user-facing date and time questions."}'}
+Microsoft Graph plugin reads mailbox timezone settings safely
+
+Running test_msgraph_plugin_surfaces_token_consent_errors...
+Testing Microsoft Graph token consent error handling...
+[Log] [Plugin Function Logger] Function call started -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'search_users'}
+[Log] [Plugin Function Logger] Function parameters -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'search_users', 'parameters': {'arg_0': 'Ada'}, 'param_string': 'arg_0=Ada'}
+Warning: Failed to get settings from cache, read from Cosmos DB instead. Called from C:\Repos\simplechatmsft\application\single_app\functions_debug.py:46 in debug_print().
+[DEBUG] [INFO]: [MSGraphPlugin] search_users token acquisition failed: {'error': 'consent_required', 'message': 'Consent is required.', 'consent_url': 'https://example.test/consent', 'scopes': ['User.ReadBasic.All'], 'operation': 'search_users'}
+[Log] [Plugin Function Logger] Function completed successfully -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'search_users', 'result_preview': "{'error': 'consent_required', 'message': 'Consent is required.', 'consent_url': 'https://example.test/consent', 'scopes': ['User.ReadBasic.All'], 'operation': 'search_users'}", 'duration_ms': 95.50833702087402, 'full_function_name': 'MSGraphPlugin.search_users'}
+Plugin function executed successfully
+[Plugin Invocation] MSGraphPlugin.search_users
+Warning: Failed to get settings from cache, read from Cosmos DB instead. Called from C:\Repos\simplechatmsft\application\single_app\functions_debug.py:46 in debug_print().
+[DEBUG] [INFO]: [Plugin SUCCESS] MSGraphPlugin.search_users (95.5ms)
+[Log] Plugin function executed successfully -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'search_users', 'duration_ms': 95.50833702087402, 'success': True, 'user_id': None, 'timestamp': '2026-03-26T03:02:21.202137', 'parameter_count': 1, 'parameters': {'arg_0': 'Ada'}, 'result_preview': "{'error': 'consent_required', 'message': 'Consent is required.', 'consent_url': 'https://example.test/consent', 'scopes': ['User.ReadBasic.All'], 'operation': 'search_users'}", 'result_type': 'dict'}
+[Log] [Plugin Invocation] MSGraphPlugin.search_users -- {'plugin_name': 'MSGraphPlugin', 'function_name': 'search_users', 'duration_ms': 95.50833702087402, 'success': True, 'user_id': None, 'timestamp': '2026-03-26T03:02:21.202137', 'parameter_count': 1, 'result_type': 'dict', 'error_message': None, 'parameters': {'arg_0': 'Ada'}, 'result_preview': "{'error': 'consent_required', 'message': 'Consent is required.', 'consent_url': 'https://example.test/consent', 'scopes': ['User.ReadBasic.All'], 'operation': 'search_users'}"}
+Microsoft Graph plugin surfaces consent requirements safely
+
+Results: 4/4 tests passed
diff --git a/scripts/Register-ResourceProviders.ps1 b/scripts/Register-ResourceProviders.ps1
new file mode 100644
index 00000000..0664c4f3
--- /dev/null
+++ b/scripts/Register-ResourceProviders.ps1
@@ -0,0 +1,186 @@
+<#
+.SYNOPSIS
+Registers Azure resource providers required to deploy Simple Chat.
+
+.DESCRIPTION
+Scans a predefined list of provider namespaces derived from the deployer Bicep templates
+and registers any that are not already registered. Optionally waits for registration
+completion and supports retries with exponential backoff.
+
+.PARAMETER SubscriptionId
+Optional subscription ID to target. If provided, the script will set the active subscription.
+
+.PARAMETER Providers
+Optional list of provider namespaces to register. Defaults to the providers required by Simple Chat.
+
+.PARAMETER Wait
+If specified, waits for each provider to reach the "Registered" state.
+
+.PARAMETER MaxWaitMinutes
+Maximum time to wait for a provider registration to complete.
+
+.PARAMETER MaxRetries
+Maximum number of retries for transient registration failures.
+
+.PARAMETER RetryDelaySeconds
+Initial delay (in seconds) between retries. Uses exponential backoff.
+
+.EXAMPLE
+# Register all required providers in the current subscription
+.\Register-ResourceProviders.ps1 -Wait
+
+.EXAMPLE
+# Register providers in a specific subscription
+.\Register-ResourceProviders.ps1 -SubscriptionId "00000000-0000-0000-0000-000000000000" -Wait
+#>
+
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $false)]
+    [string] $SubscriptionId,
+
+    [Parameter(Mandatory = $false)]
+    [string[]] $Providers = @(
+        'Microsoft.Authorization',
+        'Microsoft.Cache',
+        'Microsoft.CognitiveServices',
+        'Microsoft.ContainerRegistry',
+        'Microsoft.DocumentDB',
+        'Microsoft.Insights',
+        'Microsoft.KeyVault',
+        'Microsoft.ManagedIdentity',
+        'Microsoft.Network',
+        'Microsoft.OperationalInsights',
+        'Microsoft.Resources',
+        'Microsoft.Search',
+        'Microsoft.Storage',
+        'Microsoft.VideoIndexer',
+        'Microsoft.Web'
+    ),
+
+    [Parameter(Mandatory = $false)]
+    [switch] $Wait,
+
+    [Parameter(Mandatory = $false)]
+    [int] $MaxWaitMinutes = 20,
+
+    [Parameter(Mandatory = $false)]
+    [int] $MaxRetries = 3,
+
+    [Parameter(Mandatory = $false)]
+    [int] $RetryDelaySeconds = 5
+)
+
+$ErrorActionPreference = 'Stop'
+
+function Write-Log {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $Message,
+
+        [Parameter(Mandatory = $false)]
+        [ValidateSet('INFO', 'WARN', 'ERROR')]
+        [string] $Level = 'INFO'
+    )
+
+    $timestamp = (Get-Date).ToString('u')
+    Write-Host "[$timestamp][$Level] $Message"
+}
+
+function Ensure-AzCli {
+    if (-not (Get-Command az -ErrorAction SilentlyContinue)) {
+        throw 'Azure CLI (az) is required but was not found in PATH. Install Azure CLI and run "az login".'
+    }
+}
+
+function Get-ProviderState {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $Namespace
+    )
+
+    $state = az provider show --namespace $Namespace --query "registrationState" -o tsv
+    if (-not $state) {
+        return 'NotRegistered'
+    }
+
+    return $state
+}
+
+function Register-ProviderWithRetry {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $Namespace
+    )
+
+    $attempt = 0
+    $delay = $RetryDelaySeconds
+
+    while ($attempt -lt $MaxRetries) {
+        try {
+            $attempt++
+            Write-Log "Registering provider: $Namespace (attempt $attempt/$MaxRetries)"
+            az provider register --namespace $Namespace | Out-Null
+            return
+        }
+        catch {
+            if ($attempt -ge $MaxRetries) {
+                throw
+            }
+
+            Write-Log "Retrying provider registration for $Namespace in $delay seconds..." 'WARN'
+            Start-Sleep -Seconds $delay
+            $delay = [Math]::Min($delay * 2, 60)
+        }
+    }
+}
+
+function Wait-ForProvider {
+    param(
+        [Parameter(Mandatory = $true)]
+        [string] $Namespace
+    )
+
+    $deadline = (Get-Date).AddMinutes($MaxWaitMinutes)
+    while ((Get-Date) -lt $deadline) {
+        $state = Get-ProviderState -Namespace $Namespace
+        if ($state -eq 'Registered') {
+            Write-Log "Provider registered: $Namespace"
+            return
+        }
+
+        Write-Log "Waiting for provider $Namespace to register (current: $state)..." 'INFO'
+        Start-Sleep -Seconds 10
+    }
+
+    throw "Timed out waiting for provider $Namespace to register."
+}
+
+try {
+    Ensure-AzCli
+
+    if ($SubscriptionId) {
+        Write-Log "Setting subscription to $SubscriptionId"
+        az account set --subscription $SubscriptionId | Out-Null
+    }
+
+    foreach ($provider in $Providers) {
+        $state = Get-ProviderState -Namespace $provider
+        if ($state -eq 'Registered') {
+            Write-Log "Already registered: $provider"
+            continue
+        }
+
+        Register-ProviderWithRetry -Namespace $provider
+
+        if ($Wait) {
+            Wait-ForProvider -Namespace $provider
+        }
+    }
+
+    Write-Log 'Provider registration complete.'
+}
+catch {
+    Write-Log $_.Exception.Message 'ERROR'
+    throw
+}
diff --git a/scripts/resolve_multiendpoint_gpt.py b/scripts/resolve_multiendpoint_gpt.py
new file mode 100644
index 00000000..d6f7a6b6
--- /dev/null
+++ b/scripts/resolve_multiendpoint_gpt.py
@@ -0,0 +1,416 @@
+# resolve_multiendpoint_gpt.py
+"""
+Emulate the multi-endpoint GPT resolver and send a test chat completion.
+
+This script pulls settings from Cosmos DB (simplechat/settings), resolves the selected
+model endpoint, then sends a GPT-only chat request with detailed logging.
+"""
+
+import argparse
+import json
+import logging
+import os
+from urllib.parse import urlparse
+
+from azure.cosmos import CosmosClient
+from azure.cosmos.exceptions import CosmosResourceNotFoundError
+from azure.identity import ClientSecretCredential, DefaultAzureCredential, get_bearer_token_provider
+from dotenv import load_dotenv
+from openai import AzureOpenAI, OpenAI
+
+
+def configure_logging(verbose):
+    logging.basicConfig(
+        level=logging.DEBUG if verbose else logging.INFO,
+        format="[%(levelname)s] %(message)s"
+    )
+
+
+def get_env_value(name):
+    value = os.getenv(name, "")
+    return value.strip()
+
+
+def resolve_authority(auth_settings):
+    management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+    if management_cloud == "government":
+        return "https://login.microsoftonline.us"
+    if management_cloud == "custom":
+        custom_authority = auth_settings.get("custom_authority") or ""
+        return custom_authority.strip() or None
+    return None
+
+
+def infer_foundry_scope_from_endpoint(endpoint):
+    if not endpoint:
+        return "https://ai.azure.com/.default"
+    host = urlparse(endpoint).hostname or endpoint
+    host = host.lower()
+    if "azure.us" in host:
+        return "https://ai.azure.us/.default"
+    if "azure.cn" in host:
+        return "https://ai.azure.cn/.default"
+    if "azure.de" in host:
+        return "https://ai.azure.de/.default"
+    return "https://ai.azure.com/.default"
+
+
+def resolve_foundry_scope_for_auth(auth_settings, endpoint=None):
+    auth_type = (auth_settings.get("type") or "managed_identity").lower()
+    if auth_type == "service_principal":
+        management_cloud = (auth_settings.get("management_cloud") or "public").lower()
+        if management_cloud == "government":
+            return "https://ai.azure.us/.default"
+        if management_cloud == "custom":
+            custom_scope = (auth_settings.get("foundry_scope") or "").strip()
+            if not custom_scope:
+                raise ValueError("Foundry scope is required for custom cloud configurations.")
+            return custom_scope
+        return "https://ai.azure.com/.default"
+
+    custom_scope = (auth_settings.get("foundry_scope") or "").strip()
+    if custom_scope:
+        return custom_scope
+    return infer_foundry_scope_from_endpoint(endpoint)
+
+
+def resolve_cognitive_services_scope():
+    azure_env = (get_env_value("AZURE_ENVIRONMENT") or "public").lower()
+    if azure_env == "usgovernment":
+        return "https://cognitiveservices.azure.us/.default"
+    if azure_env == "custom":
+        custom_scope = get_env_value("CUSTOM_COGNITIVE_SERVICES_URL_VALUE")
+        if not custom_scope:
+            raise ValueError("CUSTOM_COGNITIVE_SERVICES_URL_VALUE is required for custom cloud.")
+        return custom_scope
+    return "https://cognitiveservices.azure.com/.default"
+
+
+def normalize_foundry_base_url(endpoint):
+    if not endpoint:
+        raise ValueError("Foundry endpoint is required.")
+    normalized = endpoint.rstrip("/")
+    if "/models" in normalized:
+        return normalized + "/"
+    if "/openai/v1" in normalized:
+        return normalized.replace("/openai/v1", "/models") + "/"
+    if "/openai" in normalized:
+        return normalized.replace("/openai", "/models") + "/"
+    return normalized + "/models/"
+
+
+def get_foundry_api_version_candidates(primary_version, settings):
+    candidates = [primary_version]
+    fallback = (settings.get("azure_openai_gpt_api_version") or "").strip()
+    if fallback:
+        candidates.append(fallback)
+    candidates.extend([
+        "2024-10-01-preview",
+        "2024-07-01-preview",
+        "2024-05-01-preview",
+        "2024-02-01"
+    ])
+    seen = set()
+    unique = []
+    for item in candidates:
+        if not item:
+            continue
+        if item in seen:
+            continue
+        seen.add(item)
+        unique.append(item)
+    return unique
+
+
+def resolve_foundry_inference_api_version(connection, settings):
+    api_version = (connection.get("openai_api_version") or connection.get("api_version") or "").strip()
+    if api_version and api_version != "v1":
+        return api_version
+    fallback = settings.get("azure_openai_gpt_api_version") or "2024-05-01-preview"
+    return fallback
+
+
+def mask_secret(value, visible=4):
+    if not value:
+        return ""
+    if len(value) <= visible:
+        return "*" * len(value)
+    return f"{value[:visible]}***{value[-visible:]}"
+
+
+def log_available_databases(client):
+    try:
+        databases = list(client.list_databases())
+    except Exception as exc:
+        logging.warning("Failed to list databases: %s", exc)
+        return
+    ids = [db.get("id") for db in databases if isinstance(db, dict)]
+    logging.info("Available databases: %s", ", ".join(ids) if ids else "<none>")
+
+
+def log_available_containers(database):
+    try:
+        containers = list(database.list_containers())
+    except Exception as exc:
+        logging.warning("Failed to list containers: %s", exc)
+        return
+    ids = [c.get("id") for c in containers if isinstance(c, dict)]
+    logging.info("Available containers: %s", ", ".join(ids) if ids else "<none>")
+
+
+def fetch_settings_from_cosmos(database_name, container_name, settings_id):
+    cosmos_endpoint = get_env_value("AZURE_COSMOS_ENDPOINT")
+    cosmos_key = get_env_value("AZURE_COSMOS_KEY")
+    if not cosmos_endpoint or not cosmos_key:
+        raise ValueError("AZURE_COSMOS_ENDPOINT and AZURE_COSMOS_KEY must be set in the .env file.")
+
+    logging.info("Connecting to Cosmos DB endpoint: %s", urlparse(cosmos_endpoint).hostname)
+    client = CosmosClient(cosmos_endpoint, credential=cosmos_key)
+    logging.info("Using Cosmos database=%s container=%s settings_id=%s", database_name, container_name, settings_id)
+    database = client.get_database_client(database_name)
+    try:
+        database.read()
+    except CosmosResourceNotFoundError:
+        logging.error("Cosmos database '%s' not found in this account.", database_name)
+        log_available_databases(client)
+        raise ValueError("Cosmos database not found. Check AZURE_COSMOS_ENDPOINT and --database.")
+
+    container = database.get_container_client(container_name)
+    try:
+        container.read()
+    except CosmosResourceNotFoundError:
+        logging.error("Cosmos container '%s' not found in database '%s'.", container_name, database_name)
+        log_available_containers(database)
+        raise ValueError("Cosmos container not found. Check --container.")
+
+    try:
+        settings = container.read_item(item=settings_id, partition_key=settings_id)
+    except CosmosResourceNotFoundError:
+        logging.warning("Settings item not found by id. Attempting query lookup for id=%s", settings_id)
+        query = "SELECT * FROM c WHERE c.id = @id"
+        try:
+            items = list(container.query_items(query=query, parameters=[{"name": "@id", "value": settings_id}], enable_cross_partition_query=True))
+        except CosmosResourceNotFoundError:
+            logging.error("Container query failed. Verify database/container and Cosmos account endpoint.")
+            log_available_containers(database)
+            raise
+        if items:
+            settings = items[0]
+        else:
+            logging.warning("No matching settings id found. Falling back to first item in container.")
+            items = list(container.query_items(query="SELECT TOP 1 * FROM c", enable_cross_partition_query=True))
+            if not items:
+                raise ValueError("No settings documents found in the container.")
+            settings = items[0]
+    logging.info("Settings loaded: enable_multi_model_endpoints=%s", settings.get("enable_multi_model_endpoints"))
+    return settings
+
+
+def build_multi_endpoint_client(auth, provider, endpoint, api_version, settings):
+    auth_type = (auth.get("type") or "managed_identity").lower()
+    if provider == "aifoundry":
+        base_url = normalize_foundry_base_url(endpoint)
+        api_version = resolve_foundry_inference_api_version({"api_version": api_version}, settings)
+        default_query = {"api-version": api_version}
+        if auth_type == "api_key":
+            api_key = auth.get("api_key")
+            if not api_key:
+                raise ValueError("API key is required for the selected endpoint.")
+            logging.info("Using Foundry OpenAI-compatible endpoint: %s", base_url)
+            logging.info("Using Foundry api-version: %s", api_version)
+            return OpenAI(base_url=base_url, api_key=api_key, default_query=default_query)
+
+        authority_override = None
+        if auth_type == "service_principal":
+            authority_override = resolve_authority(auth)
+            credential = ClientSecretCredential(
+                tenant_id=auth.get("tenant_id"),
+                client_id=auth.get("client_id"),
+                client_secret=auth.get("client_secret"),
+                authority=authority_override
+            )
+        else:
+            managed_identity_client_id = auth.get("managed_identity_client_id") or None
+            credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
+
+        scope = resolve_foundry_scope_for_auth(auth, endpoint)
+        logging.info("Using Foundry AAD scope: %s", scope)
+        token = credential.get_token(scope).token
+        logging.info("Using Foundry OpenAI-compatible endpoint: %s", base_url)
+        logging.info("Using Foundry api-version: %s", api_version)
+        return OpenAI(base_url=base_url, api_key=token, default_query=default_query)
+
+    if auth_type == "api_key":
+        api_key = auth.get("api_key")
+        if not api_key:
+            raise ValueError("API key is required for the selected endpoint.")
+        return AzureOpenAI(
+            #api_version=api_version,
+            azure_endpoint=endpoint,
+            api_key=api_key
+        )
+
+    if auth_type == "service_principal":
+        authority_override = resolve_authority(auth)
+        credential = ClientSecretCredential(
+            tenant_id=auth.get("tenant_id"),
+            client_id=auth.get("client_id"),
+            client_secret=auth.get("client_secret"),
+            authority=authority_override
+        )
+        scope = resolve_cognitive_services_scope()
+        logging.info("Using service principal scope: %s", scope)
+        token_provider = get_bearer_token_provider(credential, scope)
+    else:
+        managed_identity_client_id = auth.get("managed_identity_client_id") or None
+        credential = DefaultAzureCredential(managed_identity_client_id=managed_identity_client_id)
+        scope = resolve_cognitive_services_scope()
+        logging.info("Using managed identity scope: %s", scope)
+        token_provider = get_bearer_token_provider(credential, scope)
+
+    return AzureOpenAI(
+        #api_version=api_version,
+        azure_endpoint=endpoint,
+        azure_ad_token_provider=token_provider
+    )
+
+
+def resolve_multi_endpoint_gpt_config(settings, model_id, endpoint_id, provider_override=None):
+    enable_multi_model_endpoints = settings.get("enable_multi_model_endpoints", False)
+    enable_gpt_apim = settings.get("enable_gpt_apim", False)
+
+    if not enable_multi_model_endpoints or enable_gpt_apim or not model_id:
+        raise ValueError("Multi-endpoint resolution is not active or model_id is missing.")
+
+    endpoints = settings.get("model_endpoints", []) or []
+    endpoint_cfg = next((e for e in endpoints if e.get("id") == endpoint_id), None)
+    if not endpoint_cfg or not endpoint_cfg.get("enabled", True):
+        raise ValueError("Selected model endpoint is not available.")
+
+    models = endpoint_cfg.get("models", []) or []
+    model_cfg = next((m for m in models if m.get("id") == model_id), None)
+    if not model_cfg or not model_cfg.get("enabled", True):
+        raise ValueError("Selected model is not available.")
+
+    if provider_override and endpoint_cfg.get("provider") and provider_override != endpoint_cfg.get("provider"):
+        raise ValueError("Selected model provider mismatch.")
+
+    gpt_model = model_cfg.get("deploymentName") or model_cfg.get("deployment") or ""
+    if not gpt_model:
+        raise ValueError("Selected model is missing deployment name.")
+
+    connection = endpoint_cfg.get("connection", {}) or {}
+    auth = endpoint_cfg.get("auth", {}) or {}
+    auth_type = (auth.get("type") or "managed_identity").lower()
+    api_version = connection.get("openai_api_version") or connection.get("api_version")
+    endpoint = connection.get("endpoint")
+    provider = (endpoint_cfg.get("provider") or "aoai").lower()
+    if provider == "aifoundry":
+        api_version = resolve_foundry_inference_api_version(connection, settings)
+        logging.info("Using Foundry inference api_version=%s", api_version)
+
+    logging.info("Resolved endpoint: %s", endpoint_cfg.get("name"))
+    logging.info("Resolved provider: %s", provider)
+    logging.info("Resolved deployment: %s", gpt_model)
+    logging.info("Resolved auth_type: %s", auth_type)
+
+    gpt_client = build_multi_endpoint_client(auth, provider, endpoint, api_version, settings)
+    return gpt_client, gpt_model, provider, endpoint, auth, api_version
+
+
+def run_chat_completion(gpt_client, gpt_model, message, reasoning_effort=None, provider=None, endpoint=None, auth=None, api_version=None, settings=None):
+    logging.info("Sending GPT-only request (model=%s)", gpt_model)
+
+    api_params = {
+        "model": gpt_model.lower(),
+        "messages": [
+            {"role": "system", "content": "You are an AI assistant that helps people find information."},
+            {"role": "user", "content": message}
+        ]
+    }
+    if reasoning_effort and reasoning_effort.lower() != "none":
+        api_params["reasoning_effort"] = reasoning_effort
+        logging.info("Using reasoning_effort=%s", reasoning_effort)
+
+    try:
+        print(f"\nAPI Params: {api_params}\n")
+        response = gpt_client.chat.completions.create(**api_params)
+    except Exception as exc:
+        error_str = str(exc).lower()
+        if provider == "aifoundry" and "api version not supported" in error_str:
+            logging.warning("Foundry API version not supported. Retrying with fallback versions...")
+            api_params.pop("reasoning_effort", None)
+            last_error = exc
+            for candidate in get_foundry_api_version_candidates(api_version, settings or {}):
+                if candidate == api_version:
+                    continue
+                try:
+                    logging.info("Retrying Foundry with api_version=%s", candidate)
+                    retry_client = build_multi_endpoint_client(auth or {}, "aifoundry", endpoint, candidate, settings or {})
+                    response = retry_client.chat.completions.create(**api_params)
+                    break
+                except Exception as retry_exc:
+                    last_error = retry_exc
+                    logging.debug("Foundry retry failed for api_version=%s: %s", candidate, retry_exc)
+            else:
+                raise last_error
+        else:
+            raise
+    choice = response.choices[0]
+    content = choice.message.content if choice.message else ""
+    logging.info("Response received. Finish reason=%s", getattr(choice, "finish_reason", None))
+    logging.debug("Full response: %s", json.dumps(response.model_dump(), indent=2, default=str))
+    return content
+
+
+def parse_args():
+    parser = argparse.ArgumentParser(description="Resolve multi-endpoint GPT config and send a test message.")
+    parser.add_argument("--env-path", required=True, help="Path to the .env file containing Cosmos settings.")
+    parser.add_argument("--endpoint-id", required=True, help="Model endpoint ID from settings.")
+    parser.add_argument("--model-id", required=True, help="Model ID from settings.")
+    parser.add_argument("--database", default="SimpleChat", help="Cosmos database name.")
+    parser.add_argument("--container", default="settings", help="Cosmos settings container name.")
+    parser.add_argument("--settings-id", default="app_settings", help="Settings document id.")
+    parser.add_argument("--provider", default=None, help="Optional provider override (aoai/aifoundry).")
+    parser.add_argument("--message", default="Hello from the multi-endpoint resolver.", help="Test message to send.")
+    parser.add_argument("--reasoning-effort", default=None, help="Optional reasoning_effort value.")
+    parser.add_argument("--verbose", action="store_true", help="Enable verbose logging.")
+    return parser.parse_args()
+
+
+def main():
+    args = parse_args()
+    load_dotenv(args.env_path, override=True)
+    configure_logging(args.verbose)
+
+    logging.info("Loading .env from: %s", args.env_path)
+    settings = fetch_settings_from_cosmos(
+        database_name=args.database,
+        container_name=args.container,
+        settings_id=args.settings_id
+    )
+
+    gpt_client, gpt_model, provider, endpoint, auth, api_version = resolve_multi_endpoint_gpt_config(
+        settings,
+        model_id=args.model_id,
+        endpoint_id=args.endpoint_id,
+        provider_override=args.provider
+    )
+
+    response_text = run_chat_completion(
+        gpt_client,
+        gpt_model,
+        message=args.message,
+        reasoning_effort=args.reasoning_effort,
+        provider=provider,
+        endpoint=endpoint,
+        auth=auth,
+        api_version=api_version,
+        settings=settings
+    )
+
+    logging.info("Response text:\n%s", response_text)
+
+
+if __name__ == "__main__":
+    main()
diff --git a/ui_tests/requirements.txt b/ui_tests/requirements.txt
new file mode 100644
index 00000000..e5d5c89e
--- /dev/null
+++ b/ui_tests/requirements.txt
@@ -0,0 +1,4 @@
+pytest
+playwright
+azure-mgmt-playwright
+azure-identity
\ No newline at end of file
diff --git a/ui_tests/test_agent_modal_dual_foundry_modes.py b/ui_tests/test_agent_modal_dual_foundry_modes.py
new file mode 100644
index 00000000..9d7bd956
--- /dev/null
+++ b/ui_tests/test_agent_modal_dual_foundry_modes.py
@@ -0,0 +1,70 @@
+# test_agent_modal_dual_foundry_modes.py
+"""
+UI test for dual Foundry agent modal modes.
+Version: 0.239.176
+Implemented in: 0.239.176
+
+This test ensures that the agent modal exposes both Foundry modes and that the
+mode-specific form sections toggle correctly in the browser.
+"""
+
+import os
+from pathlib import Path
+
+import pytest
+from playwright.sync_api import expect
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+STORAGE_STATE = os.getenv("SIMPLECHAT_UI_STORAGE_STATE", "")
+
+
+@pytest.mark.ui
+def test_agent_modal_dual_foundry_modes(playwright):
+    """Validate Foundry mode toggling in the agent modal."""
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not STORAGE_STATE or not Path(STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+
+    try:
+        page.goto(f"{BASE_URL}/workspace", wait_until="networkidle")
+        expect(page.locator("#agentModal")).to_be_attached()
+
+        page.evaluate(
+            """
+            () => {
+                const modalEl = document.getElementById('agentModal');
+                if (!modalEl || !window.bootstrap) {
+                    return;
+                }
+                const modal = new bootstrap.Modal(modalEl);
+                modal.show();
+            }
+            """
+        )
+
+        expect(page.get_by_label("Foundry (classic)")).to_be_visible()
+        expect(page.get_by_label("New Foundry")).to_be_visible()
+
+        page.get_by_label("New Foundry").check()
+        expect(page.locator("#agent-foundry-fetch-btn-label")).to_have_text("Fetch Applications")
+        expect(page.locator("#agent-foundry-select-label")).to_have_text("New Foundry Application")
+        expect(page.locator("#agent-new-foundry-only")).to_be_visible()
+        expect(page.locator("#agent-classic-foundry-only")).to_be_hidden()
+
+        page.get_by_label("Foundry (classic)").check()
+        expect(page.locator("#agent-foundry-fetch-btn-label")).to_have_text("Fetch Agents")
+        expect(page.locator("#agent-foundry-select-label")).to_have_text("Foundry Agent")
+        expect(page.locator("#agent-classic-foundry-only")).to_be_visible()
+        expect(page.locator("#agent-new-foundry-only")).to_be_hidden()
+    finally:
+        context.close()
+        browser.close()
diff --git a/ui_tests/test_approvals_agent_template_admin_section.py b/ui_tests/test_approvals_agent_template_admin_section.py
new file mode 100644
index 00000000..2d546684
--- /dev/null
+++ b/ui_tests/test_approvals_agent_template_admin_section.py
@@ -0,0 +1,144 @@
+# test_approvals_agent_template_admin_section.py
+"""
+UI test for approvals page agent template admin section.
+Version: 0.239.163
+Implemented in: 0.239.159
+
+This test ensures that the shared approvals page shows the agent template
+approval queue for admins, keeps that section hidden for non-admin users,
+and uses a Bootstrap confirmation modal for template deletion.
+"""
+
+import json
+import os
+from pathlib import Path
+
+import pytest
+from playwright.sync_api import expect
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+ADMIN_STORAGE_STATE = os.getenv("SIMPLECHAT_UI_ADMIN_STORAGE_STATE", "")
+NON_ADMIN_STORAGE_STATE = os.getenv("SIMPLECHAT_UI_NON_ADMIN_STORAGE_STATE", "")
+
+
+def _require_ui_env():
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not ADMIN_STORAGE_STATE or not Path(ADMIN_STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_ADMIN_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+    if not NON_ADMIN_STORAGE_STATE or not Path(NON_ADMIN_STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_NON_ADMIN_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+
+@pytest.mark.ui
+def test_approvals_agent_template_admin_section(playwright):
+    """Validate admin visibility and Bootstrap delete confirmation behavior on /approvals."""
+    _require_ui_env()
+
+    browser = playwright.chromium.launch()
+    admin_context = browser.new_context(
+        storage_state=ADMIN_STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    user_context = browser.new_context(
+        storage_state=NON_ADMIN_STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+
+    admin_page = admin_context.new_page()
+    user_page = user_context.new_page()
+
+    approvals_payload = {
+        "success": True,
+        "approvals": [],
+        "total_count": 0,
+        "page": 1,
+        "page_size": 20,
+        "total_pages": 0,
+    }
+    templates_payload = {
+        "templates": [
+            {
+                "id": "template-1",
+                "title": "Pending Template",
+                "display_name": "Pending Template",
+                "helper_text": "A pending admin review template",
+                "description": "Pending admin review template",
+                "status": "pending",
+                "created_by_name": "Template Submitter",
+                "created_by_email": "template-user@example.com",
+                "updated_at": "2026-03-24T10:00:00Z",
+            }
+        ]
+    }
+    template_detail_payload = {
+        "template": {
+            "id": "template-1",
+            "title": "Pending Template",
+            "display_name": "Pending Template",
+            "helper_text": "A pending admin review template",
+            "description": "Pending admin review template",
+            "instructions": "Review these instructions.",
+            "status": "pending",
+            "created_by_name": "Template Submitter",
+            "created_by_email": "template-user@example.com",
+            "created_at": "2026-03-24T09:00:00Z",
+            "updated_at": "2026-03-24T10:00:00Z",
+            "tags": ["approval"],
+            "actions_to_load": []
+        }
+    }
+
+    def fulfill_approvals(route):
+        route.fulfill(status=200, content_type="application/json", body=json.dumps(approvals_payload))
+
+    def fulfill_templates(route):
+        route.fulfill(status=200, content_type="application/json", body=json.dumps(templates_payload))
+
+    def fulfill_template_detail(route):
+        route.fulfill(status=200, content_type="application/json", body=json.dumps(template_detail_payload))
+
+    try:
+        dialog_seen = {"value": False}
+
+        def on_dialog(dialog):
+            dialog_seen["value"] = True
+            dialog.dismiss()
+
+        admin_page.on("dialog", on_dialog)
+        admin_page.route("**/api/approvals?*", fulfill_approvals)
+        admin_page.route("**/api/admin/agent-templates?*", fulfill_templates)
+        admin_page.route("**/api/admin/agent-templates/template-1", fulfill_template_detail)
+        admin_page.goto(f"{BASE_URL}/approvals", wait_until="networkidle")
+
+        admin_section = admin_page.locator("#agent-template-approvals")
+        expect(admin_section).to_be_visible()
+        expect(admin_page.locator("#agent-template-table-body")).to_contain_text("Pending Template")
+
+        admin_page.get_by_role("button", name="Delete").first.click()
+        expect(admin_page.locator("#agentTemplateDeleteConfirmModal")).to_be_visible()
+        expect(admin_page.locator("#agent-template-delete-confirm-name")).to_have_text("Pending Template")
+        expect(admin_page.locator("#agentTemplateDeleteConfirmModal")).to_contain_text("This action cannot be undone.")
+        assert dialog_seen["value"] is False
+        admin_page.locator("#agentTemplateDeleteConfirmModal").get_by_role("button", name="Cancel").click()
+        expect(admin_page.locator("#agentTemplateDeleteConfirmModal")).to_be_hidden()
+
+        admin_page.get_by_role("button", name="View").click()
+        expect(admin_page.locator("#agentTemplateReviewModal")).to_be_visible()
+        admin_page.locator("#agent-template-delete-btn").click()
+        expect(admin_page.locator("#agentTemplateDeleteConfirmModal")).to_be_visible()
+        expect(admin_page.locator("#agentTemplateReviewModal")).to_be_hidden()
+        assert dialog_seen["value"] is False
+        admin_page.locator("#agentTemplateDeleteConfirmModal").get_by_role("button", name="Cancel").click()
+        expect(admin_page.locator("#agentTemplateDeleteConfirmModal")).to_be_hidden()
+        expect(admin_page.locator("#agentTemplateReviewModal")).to_be_visible()
+
+        user_page.route("**/api/approvals?*", fulfill_approvals)
+        user_page.goto(f"{BASE_URL}/approvals", wait_until="networkidle")
+
+        expect(user_page.locator("#agent-template-approvals")).to_have_count(0)
+    finally:
+        admin_context.close()
+        user_context.close()
+        browser.close()
\ No newline at end of file
diff --git a/ui_tests/test_control_center_token_filters.py b/ui_tests/test_control_center_token_filters.py
new file mode 100644
index 00000000..8ee75053
--- /dev/null
+++ b/ui_tests/test_control_center_token_filters.py
@@ -0,0 +1,107 @@
+# test_control_center_token_filters.py
+"""
+UI test for control center token filters.
+Version: 0.239.164
+Implemented in: 0.239.164
+
+This test ensures the token filter controls appear on the Control Center
+dashboard and that applying them forwards the selected values to the
+activity-trends request.
+"""
+
+import os
+from pathlib import Path
+from urllib.parse import parse_qs, urlparse
+
+import pytest
+from playwright.sync_api import expect
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+STORAGE_STATE = os.getenv("SIMPLECHAT_UI_STORAGE_STATE", "")
+
+
+@pytest.mark.ui
+def test_control_center_token_filters_forward_query_params(playwright):
+    """Validate token filter controls toggle correctly and update the trends request."""
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not STORAGE_STATE or not Path(STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+    captured_queries = []
+
+    def handle_token_filters(route):
+        route.fulfill(
+            status=200,
+            content_type="application/json",
+            body="""
+            {
+                "success": true,
+                "filters": {
+                    "users": [{"id": "user-1", "label": "Ada Lovelace", "display_name": "Ada Lovelace", "email": "ada@example.com"}],
+                    "groups": [{"id": "group-1", "name": "Research Group"}],
+                    "public_workspaces": [{"id": "workspace-1", "name": "Public Knowledge"}],
+                    "models": [{"value": "gpt-4o", "label": "gpt-4o"}],
+                    "workspace_types": [
+                        {"value": "personal", "label": "Personal"},
+                        {"value": "group", "label": "Group"},
+                        {"value": "public", "label": "Public"}
+                    ],
+                    "token_types": [
+                        {"value": "chat", "label": "Chat"},
+                        {"value": "embedding", "label": "Embedding"}
+                    ]
+                }
+            }
+            """
+        )
+
+    def handle_activity_trends(route):
+        query = parse_qs(urlparse(route.request.url).query)
+        captured_queries.append(query)
+        route.fulfill(
+            status=200,
+            content_type="application/json",
+            body='{"success": true, "activity_data": {"logins": {}, "chats": {}, "documents": {}, "personal_documents": {}, "group_documents": {}, "public_documents": {}, "tokens": {}}, "period": "30 days", "start_date": "2026-03-01T00:00:00", "end_date": "2026-03-30T23:59:59"}'
+        )
+
+    try:
+        page.route("**/api/admin/control-center/token-filters", handle_token_filters)
+        page.route("**/api/admin/control-center/activity-trends*", handle_activity_trends)
+
+        page.goto(f"{BASE_URL}/admin/control-center", wait_until="networkidle")
+
+        expect(page.locator("#tokenUserFilter")).to_be_visible()
+        expect(page.locator("#tokenWorkspaceTypeFilter")).to_be_visible()
+        expect(page.locator("#tokenModelFilter")).to_be_visible()
+        expect(page.locator("#tokenTypeFilter")).to_be_visible()
+
+        page.locator("#tokenWorkspaceTypeFilter").select_option("group")
+        expect(page.locator("#tokenGroupFilterContainer")).to_be_visible()
+        expect(page.locator("#tokenPublicWorkspaceFilterContainer")).to_be_hidden()
+
+        page.locator("#tokenUserFilter").select_option("user-1")
+        page.locator("#tokenGroupFilter").select_option("group-1")
+        page.locator("#tokenModelFilter").select_option("gpt-4o")
+        page.locator("#tokenTypeFilter").select_option("chat")
+
+        with page.expect_response(lambda response: "/api/admin/control-center/activity-trends?" in response.url):
+            page.locator("#tokenApplyFiltersBtn").click()
+
+        assert captured_queries, "Expected at least one activity trends request"
+        applied_query = captured_queries[-1]
+        assert applied_query.get("user_id") == ["user-1"]
+        assert applied_query.get("workspace_type") == ["group"]
+        assert applied_query.get("group_id") == ["group-1"]
+        assert applied_query.get("model") == ["gpt-4o"]
+        assert applied_query.get("token_type") == ["chat"]
+    finally:
+        context.close()
+        browser.close()
\ No newline at end of file
diff --git a/ui_tests/test_model_endpoint_request_uses_endpoint_id.py b/ui_tests/test_model_endpoint_request_uses_endpoint_id.py
new file mode 100644
index 00000000..12f5710a
--- /dev/null
+++ b/ui_tests/test_model_endpoint_request_uses_endpoint_id.py
@@ -0,0 +1,88 @@
+# test_model_endpoint_request_uses_endpoint_id.py
+"""
+UI test for model endpoint request identity wiring.
+Version: 0.239.178
+Implemented in: 0.239.178
+
+This test ensures the admin multi-endpoint modal exposes the supported
+providers, shows the APIM provider guidance, and sends the endpoint ID in the
+test-model request payload so the backend can resolve Key Vault-backed secrets.
+"""
+
+import os
+from pathlib import Path
+
+import pytest
+from playwright.sync_api import expect
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+STORAGE_STATE = os.getenv("SIMPLECHAT_UI_STORAGE_STATE", "")
+
+
+@pytest.mark.ui
+def test_model_endpoint_request_uses_endpoint_id(playwright):
+    """Validate that the endpoint modal includes the endpoint ID in test requests."""
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not STORAGE_STATE or not Path(STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+    captured_request = {}
+
+    def handle_test_request(route):
+        post_data = route.request.post_data_json or {}
+        captured_request.update(post_data)
+        route.fulfill(
+            status=200,
+            content_type="application/json",
+            body='{"success": true}',
+        )
+
+    try:
+        page.goto(f"{BASE_URL}/admin/settings", wait_until="networkidle")
+        expect(page.locator("#add-model-endpoint-btn")).to_be_visible()
+
+        page.route("**/api/models/test-model", handle_test_request)
+
+        page.locator("#add-model-endpoint-btn").click()
+        expect(page.locator("#modelEndpointModal")).to_be_visible()
+
+        provider_options = page.locator("#model-endpoint-provider option").all_text_contents()
+        assert provider_options == ["Azure OpenAI", "Foundry (classic)", "New Foundry"]
+        expect(page.get_by_text("If using classic Foundry, use Foundry (classic). If using the application-based runtime, use New Foundry.")).to_be_visible()
+
+        page.locator("#model-endpoint-provider").select_option("new_foundry")
+        expect(page.locator("#model-endpoint-openai-api-version")).to_have_value("")
+
+        page.evaluate(
+            """
+            () => {
+                const endpointId = document.getElementById('model-endpoint-id');
+                if (endpointId) {
+                    endpointId.value = 'stored-endpoint-123';
+                }
+            }
+            """
+        )
+        page.locator("#model-endpoint-provider").select_option("aoai")
+        page.locator("#model-endpoint-name").fill("Stored Endpoint")
+        page.locator("#model-endpoint-endpoint").fill("https://example.openai.azure.com")
+        page.locator("#model-endpoint-auth-type").select_option("api_key")
+        page.locator("#model-endpoint-api-key").fill("temporary-ui-secret")
+        page.locator("#model-endpoint-add-model-btn").click()
+        page.locator("input[data-deployment-name-for]").first.fill("gpt-4o")
+        page.locator("button[data-action='test-model']").first.click()
+
+        expect(page.locator("#modelEndpointModal")).to_be_visible()
+        assert captured_request.get("id") == "stored-endpoint-123"
+        assert captured_request.get("model", {}).get("deploymentName") == "gpt-4o"
+    finally:
+        context.close()
+        browser.close()
\ No newline at end of file
diff --git a/ui_tests/test_streaming_thought_progression.py b/ui_tests/test_streaming_thought_progression.py
new file mode 100644
index 00000000..264635de
--- /dev/null
+++ b/ui_tests/test_streaming_thought_progression.py
@@ -0,0 +1,127 @@
+# test_streaming_thought_progression.py
+"""
+UI test for streaming thought progression.
+Version: 0.239.185
+Implemented in: 0.239.185
+
+This test ensures the live streaming placeholder keeps advancing to the latest
+thought for the active assistant message and does not inherit stale thought
+state when a new message starts.
+"""
+
+import os
+from pathlib import Path
+
+import pytest
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+STORAGE_STATE = os.getenv("SIMPLECHAT_UI_STORAGE_STATE", "")
+
+
+def _require_ui_env():
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not STORAGE_STATE or not Path(STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+
+@pytest.mark.ui
+def test_streaming_thought_progression_and_session_isolation(playwright):
+    """Validate live thought progression and stale-session isolation in the browser."""
+    _require_ui_env()
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+
+    try:
+        page.goto(f"{BASE_URL}/chats", wait_until="domcontentloaded")
+
+        result = page.evaluate(
+            """
+            async () => {
+                const thoughtsModule = await import('/static/js/chat/chat-thoughts.js');
+                const {
+                    beginStreamingThoughtSession,
+                    clearStreamingThoughtSession,
+                    handleStreamingThought,
+                    markStreamingThoughtContentStarted,
+                } = thoughtsModule;
+
+                function createPlaceholder(messageId, initialText = 'Streaming...') {
+                    const wrapper = document.createElement('div');
+                    wrapper.setAttribute('data-message-id', messageId);
+                    wrapper.innerHTML = `<div class="message-text">${initialText}</div>`;
+                    document.body.appendChild(wrapper);
+                    return wrapper;
+                }
+
+                const oldPlaceholder = createPlaceholder('temp-old');
+                beginStreamingThoughtSession('temp-old');
+                handleStreamingThought({
+                    message_id: 'assistant-old',
+                    step_index: 0,
+                    step_type: 'generation',
+                    content: 'Old thought'
+                }, 'temp-old');
+
+                clearStreamingThoughtSession('temp-old');
+
+                const newPlaceholder = createPlaceholder('temp-new');
+                beginStreamingThoughtSession('temp-new');
+                const beforeThought = newPlaceholder.querySelector('.message-text').textContent;
+
+                handleStreamingThought({
+                    message_id: 'assistant-new',
+                    step_index: 0,
+                    step_type: 'search',
+                    content: 'Searching for current reply'
+                }, 'temp-new');
+                const afterFirstThought = newPlaceholder.querySelector('.message-text').textContent;
+
+                handleStreamingThought({
+                    message_id: 'assistant-new',
+                    step_index: 1,
+                    step_type: 'generation',
+                    content: 'Preparing final answer'
+                }, 'temp-new');
+                const afterSecondThought = newPlaceholder.querySelector('.message-text').textContent;
+
+                markStreamingThoughtContentStarted('temp-new');
+                handleStreamingThought({
+                    message_id: 'assistant-new',
+                    step_index: 2,
+                    step_type: 'generation',
+                    content: 'Late thought should be ignored'
+                }, 'temp-new');
+                const afterContentStarted = newPlaceholder.querySelector('.message-text').textContent;
+
+                return {
+                    beforeThought,
+                    afterFirstThought,
+                    afterSecondThought,
+                    afterContentStarted,
+                    oldPlaceholderText: oldPlaceholder.querySelector('.message-text').textContent,
+                    serverMessageId: newPlaceholder.dataset.streamingServerMessageId || null,
+                    thoughtIndexAfterContent: newPlaceholder.dataset.streamingThoughtIndex || null,
+                };
+            }
+            """
+        )
+
+        assert result['beforeThought'] == 'Streaming...'
+        assert 'Searching for current reply' in result['afterFirstThought']
+        assert 'Old thought' not in result['afterFirstThought']
+        assert 'Preparing final answer' in result['afterSecondThought']
+        assert 'Searching for current reply' not in result['afterSecondThought']
+        assert result['afterContentStarted'] == result['afterSecondThought']
+        assert result['oldPlaceholderText'] != result['afterFirstThought']
+        assert result['serverMessageId'] == 'assistant-new'
+        assert result['thoughtIndexAfterContent'] is None
+    finally:
+        context.close()
+        browser.close()
\ No newline at end of file
diff --git a/ui_tests/test_upload_agreement_dark_mode.py b/ui_tests/test_upload_agreement_dark_mode.py
new file mode 100644
index 00000000..78a01d0f
--- /dev/null
+++ b/ui_tests/test_upload_agreement_dark_mode.py
@@ -0,0 +1,82 @@
+# test_upload_agreement_dark_mode.py
+"""
+UI test for upload agreement dark mode readability.
+Version: 0.239.166
+Implemented in: 0.239.166
+
+This test ensures the upload agreement modal uses the dark-mode-safe light
+surface styling so the agreement text remains readable when the app theme is
+dark.
+"""
+
+import os
+from pathlib import Path
+
+import pytest
+from playwright.sync_api import expect
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+STORAGE_STATE = os.getenv("SIMPLECHAT_UI_STORAGE_STATE", "")
+
+
+@pytest.mark.ui
+def test_upload_agreement_modal_uses_dark_mode_safe_surface(playwright):
+    """Validate the upload agreement content surface remains readable in dark mode."""
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not STORAGE_STATE or not Path(STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+
+    try:
+        page.goto(f"{BASE_URL}/workspace", wait_until="networkidle")
+
+        if page.locator("#userAgreementUploadModal").count() == 0:
+            pytest.skip("User agreement upload modal is not enabled in this environment.")
+
+        page.evaluate(
+            """
+            () => {
+                document.documentElement.setAttribute('data-bs-theme', 'dark');
+                const content = document.getElementById('userAgreementUploadContent');
+                if (content) {
+                    content.textContent = 'Sample agreement content for dark mode verification.';
+                }
+                const modalEl = document.getElementById('userAgreementUploadModal');
+                if (modalEl && window.bootstrap) {
+                    bootstrap.Modal.getOrCreateInstance(modalEl).show();
+                }
+            }
+            """
+        )
+
+        expect(page.locator("#userAgreementUploadModal")).to_be_visible()
+        content_class_name = page.locator("#userAgreementUploadContent").evaluate(
+            "node => node.className"
+        )
+        assert "bg-light" in content_class_name
+
+        colors = page.locator("#userAgreementUploadContent").evaluate(
+            """
+            node => {
+                const styles = getComputedStyle(node);
+                return {
+                    background: styles.backgroundColor,
+                    color: styles.color
+                };
+            }
+            """
+        )
+
+        assert colors["background"] != "rgb(248, 249, 250)"
+        assert colors["background"] != colors["color"]
+    finally:
+        context.close()
+        browser.close()
\ No newline at end of file
diff --git a/ui_tests/test_workspace_agent_views_consistency.py b/ui_tests/test_workspace_agent_views_consistency.py
new file mode 100644
index 00000000..e98330f7
--- /dev/null
+++ b/ui_tests/test_workspace_agent_views_consistency.py
@@ -0,0 +1,125 @@
+# test_workspace_agent_views_consistency.py
+"""
+UI test for workspace agent view consistency.
+Version: 0.239.158
+Implemented in: 0.239.157
+
+This test ensures that the personal workspace agents table uses the same
+action ordering as the group workspace table and that group agent grid cards
+show edit and delete actions when the current user can manage group agents.
+"""
+
+import os
+import json
+from pathlib import Path
+
+import pytest
+from playwright.sync_api import expect
+
+
+BASE_URL = os.getenv("SIMPLECHAT_UI_BASE_URL", "").rstrip("/")
+STORAGE_STATE = os.getenv("SIMPLECHAT_UI_STORAGE_STATE", "")
+
+
+def _require_ui_env():
+    if not BASE_URL:
+        pytest.skip("Set SIMPLECHAT_UI_BASE_URL to run this UI test.")
+    if not STORAGE_STATE or not Path(STORAGE_STATE).exists():
+        pytest.skip("Set SIMPLECHAT_UI_STORAGE_STATE to a valid authenticated Playwright storage state file.")
+
+
+@pytest.mark.ui
+def test_workspace_agent_views_consistency(playwright):
+    """Validate personal table ordering and group grid management actions."""
+    _require_ui_env()
+
+    browser = playwright.chromium.launch()
+    context = browser.new_context(
+        storage_state=STORAGE_STATE,
+        viewport={"width": 1440, "height": 900},
+    )
+    page = context.new_page()
+
+    user_agents_payload = [
+        {
+            "name": "researcher_agent",
+            "display_name": "Researcher",
+            "description": "Personal research agent",
+            "is_global": False,
+        }
+    ]
+    group_agents_payload = {
+        "agents": [
+            {
+                "id": "group-agent-1",
+                "name": "ga_ge",
+                "display_name": "Ga Ge",
+                "description": "A group agent using shared tools",
+                "is_global": False,
+            }
+        ]
+    }
+
+    def handle_user_agents(route):
+        route.fulfill(
+            status=200,
+            content_type="application/json",
+            body=json.dumps(user_agents_payload),
+        )
+
+    def handle_group_agents(route):
+        route.fulfill(
+            status=200,
+            content_type="application/json",
+            body=json.dumps(group_agents_payload),
+        )
+
+    try:
+        page.route("**/api/user/agents", handle_user_agents)
+        page.goto(f"{BASE_URL}/workspace", wait_until="networkidle")
+        page.get_by_role("tab", name="Your Agents").click()
+
+        personal_row = page.locator("#agents-table-body tr").first
+        expect(personal_row).to_be_visible()
+        action_buttons = personal_row.locator("td").nth(2).locator("button")
+        expect(action_buttons).to_have_count(4)
+        button_classes = action_buttons.evaluate_all("elements => elements.map((element) => element.className)")
+        assert "view-agent-btn" in button_classes[0]
+        assert "chat-agent-btn" in button_classes[1]
+        assert "edit-agent-btn" in button_classes[2]
+        assert "delete-agent-btn" in button_classes[3]
+
+        page.route("**/api/group/agents", handle_group_agents)
+        page.goto(f"{BASE_URL}/group_workspaces", wait_until="networkidle")
+        page.get_by_role("tab", name="Group Agents").click()
+        page.evaluate(
+            """
+            () => {
+                window.currentGroupStatus = 'active';
+                window.groupWorkspaceContext = {
+                    activeGroupId: 'test-group-1',
+                    activeGroupName: 'Test Group',
+                    userRole: 'Owner',
+                    requireOwnerForAgentManagement: false
+                };
+                window.dispatchEvent(new CustomEvent('groupWorkspace:context-changed', {
+                    detail: window.groupWorkspaceContext
+                }));
+                if (typeof window.fetchGroupAgents === 'function') {
+                    return window.fetchGroupAgents();
+                }
+                return null;
+            }
+            """
+        )
+
+        page.locator("label[for='groupAgents-view-grid']").click()
+        group_card = page.locator("#group-agents-grid-view .item-card").first
+        expect(group_card).to_be_visible()
+        expect(group_card.locator(".item-card-chat-btn")).to_be_visible()
+        expect(group_card.locator(".item-card-view-btn")).to_be_visible()
+        expect(group_card.locator(".item-card-edit-btn")).to_be_visible()
+        expect(group_card.locator(".item-card-delete-btn")).to_be_visible()
+    finally:
+        context.close()
+        browser.close()
\ No newline at end of file