Merge branch 'dev' into branch10

WriteWorkspaceFileTool: when write_file rejects with "Storage limit exceeded",
append a recovery hint pointing at list_workspace_files + delete_workspace_file.
The agent reads this on the next turn and can offer to clean up before falling
back to "ask the user to upgrade", so the user doesn't have to leave the chat.

Upload route TOCTOU rollback: route the over-quota cleanup through
WorkspaceManager.delete_file instead of soft_delete_workspace_file. The latter
only flips isDeleted on the DB row and renames the path — the storage backend
blob would survive, leaking storage on every concurrent-upload race. delete_file
removes the blob first, then soft-deletes the DB record.

.claude/skills/pr-polish/SKILL.md

@@ -0,0 +1,245 @@
+---
+name: pr-polish
+description: Alternate /pr-review and /pr-address on a PR until the PR is truly mergeable — no new review findings, zero unresolved inline threads, zero unaddressed top-level reviews or issue comments, all CI checks green, and two consecutive quiet polls after CI settles. Use when the user wants a PR polished to merge-ready without setting a fixed number of rounds.
+user-invocable: true
+argument-hint: "[PR number or URL] — if omitted, finds PR for current branch."
+metadata:
+  author: autogpt-team
+  version: "1.0.0"
+---
+
+# PR Polish
+
+**Goal.** Drive a PR to merge-ready by alternating `/pr-review` and `/pr-address` until **all** of the following hold:
+
+1. The most recent `/pr-review` produces **zero new findings** (no new inline comments, no new top-level reviews with a non-empty body).
+2. Every inline review thread reachable via GraphQL reports `isResolved: true`.
+3. Every non-bot, non-author top-level review has been acknowledged (replied-to) OR resolved via a thread it spawned.
+4. Every non-bot, non-author issue comment has been acknowledged (replied-to).
+5. Every CI check is `conclusion: "success"` or `"skipped"` / `"neutral"` — none `"failure"` or still pending.
+6. **Two consecutive post-CI polls** (≥60s apart) stay clean — no new threads, no new non-empty reviews, no new issue comments. Bots (coderabbitai, sentry, autogpt-reviewer) frequently post late after CI settles; a single green snapshot is not sufficient.
+
+**Do not stop at a fixed number of rounds.** If round N introduces new comments, round N+1 is required. Cap at `_MAX_ROUNDS = 10` as a safety valve, but expect 2–5 in practice.
+
+## TodoWrite
+
+Before starting, write two todos so the user can see the loop progression:
+
+- `Round {current}: /pr-review + /pr-address on PR #{N}` — current iteration.
+- `Final polish polling: 2 consecutive clean polls, CI green, 0 unresolved` — runs after the last non-empty review round.
+
+Update the `current` round counter at the start of each iteration; mark `completed` only when the round's address step finishes (all new threads addressed + resolved).
+
+## Find the PR
+
+```bash
+ARG_PR="${ARG:-}"
+# Normalize URL → numeric ID if the skill arg is a pull-request URL.
+if [[ "$ARG_PR" =~ ^https?://github\.com/[^/]+/[^/]+/pull/([0-9]+) ]]; then
+  ARG_PR="${BASH_REMATCH[1]}"
+fi
+PR="${ARG_PR:-$(gh pr list --head "$(git branch --show-current)" --repo Significant-Gravitas/AutoGPT --json number --jq '.[0].number')}"
+if [ -z "$PR" ] || [ "$PR" = "null" ]; then
+  echo "No PR found for current branch. Provide a PR number or URL as the skill arg."
+  exit 1
+fi
+echo "Polishing PR #$PR"
+```
+
+## The outer loop
+
+```text
+round = 0
+while round < _MAX_ROUNDS:
+    round += 1
+    baseline = snapshot_state(PR)   # see "Snapshotting state" below
+    invoke_skill("pr-review", PR)   # posts findings as inline comments / top-level review
+    findings = diff_state(PR, baseline)
+    if findings.total == 0:
+        break  # no new findings → go to polish polling
+    invoke_skill("pr-address", PR)  # resolves every unresolved thread + CI failure
+# Post-loop: polish polling (see below).
+polish_polling(PR)
+```
+
+### Snapshotting state
+
+Before each `/pr-review`, capture a baseline so the diff after the review reflects **only** what the review just added (not pre-existing threads):
+
+```bash
+# Inline threads — total count + latest databaseId per thread
+gh api graphql -f query="
+{
+  repository(owner: \"Significant-Gravitas\", name: \"AutoGPT\") {
+    pullRequest(number: ${PR}) {
+      reviewThreads(first: 100) {
+        totalCount
+        nodes {
+          id
+          isResolved
+          comments(last: 1) { nodes { databaseId } }
+        }
+      }
+    }
+  }
+}" > /tmp/baseline_threads.json
+
+# Top-level reviews — count + latest id per non-empty review
+gh api "repos/Significant-Gravitas/AutoGPT/pulls/${PR}/reviews" --paginate \
+  --jq '[.[] | select((.body // "") != "") | {id, user: .user.login, state, submitted_at}]' \
+  > /tmp/baseline_reviews.json
+
+# Issue comments — count + latest id per non-bot, non-author comment.
+# Bots are filtered by User.type == "Bot" (GitHub sets this for app/bot
+# accounts like coderabbitai, github-actions, sentry-io). The author is
+# filtered by comparing login to the PR author — export it so jq can see it.
+AUTHOR=$(gh api "repos/Significant-Gravitas/AutoGPT/pulls/${PR}" --jq '.user.login')
+gh api "repos/Significant-Gravitas/AutoGPT/issues/${PR}/comments" --paginate \
+  --jq --arg author "$AUTHOR" \
+      '[.[] | select(.user.type != "Bot" and .user.login != $author)
+            | {id, user: .user.login, created_at}]' \
+  > /tmp/baseline_issue_comments.json
+```
+
+### Diffing after a review
+
+After `/pr-review` runs, any of these counting as "new findings" means another address round is needed:
+
+- New inline thread `id` not in the baseline.
+- An existing thread whose latest comment `databaseId` is higher than the baseline's (new reply on an old thread).
+- A new top-level review `id` with a non-empty body.
+- A new issue comment `id` from a non-bot, non-author user.
+
+If any of the four buckets is non-empty → not done; invoke `/pr-address` and loop.
+
+## Polish polling
+
+Once `/pr-review` produces zero new findings, do **not** exit yet. Bots (coderabbitai, sentry, autogpt-reviewer) commonly post late reviews after CI settles — 30–90 seconds after the final push. Poll at 60-second intervals:
+
+```text
+NON_SUCCESS_TERMINAL = {"failure", "cancelled", "timed_out", "action_required", "startup_failure"}
+clean_polls = 0
+required_clean = 2
+while clean_polls < required_clean:
+    # 1. CI gate — any terminal non-success conclusion (not just "failure")
+    # must trigger /pr-address. "success", "skipped", "neutral" are clean;
+    # anything else (including cancelled, timed_out, action_required) is a
+    # blocker that won't self-resolve.
+    ci = fetch_check_runs(PR)
+    if any ci.conclusion in NON_SUCCESS_TERMINAL:
+        invoke_skill("pr-address", PR)  # address failures + any new comments
+        baseline = snapshot_state(PR)   # reset — push during address invalidates old baseline
+        clean_polls = 0
+        continue
+    if any ci.conclusion is None (still in_progress):
+        sleep 60; continue  # wait without counting this as clean
+
+    # 2. Comment / thread gate
+    threads = fetch_unresolved_threads(PR)
+    new_issue_comments = diff_against_baseline(issue_comments)
+    new_reviews = diff_against_baseline(reviews)
+    if threads or new_issue_comments or new_reviews:
+        invoke_skill("pr-address", PR)
+        baseline = snapshot_state(PR)   # reset — the address loop just dealt with these,
+                                        # otherwise they stay "new" relative to the old baseline forever
+        clean_polls = 0
+        continue
+
+    # 3. Mergeability gate
+    mergeable = gh api repos/.../pulls/${PR} --jq '.mergeable'
+    if mergeable == false (CONFLICTING):
+        resolve_conflicts(PR)  # see pr-address skill
+        clean_polls = 0
+        continue
+    if mergeable is null (UNKNOWN):
+        sleep 60; continue
+
+    clean_polls += 1
+    sleep 60
+```
+
+Only after `clean_polls == 2` do you report `ORCHESTRATOR:DONE`.
+
+### Why 2 clean polls, not 1
+
+A single green snapshot can be misleading — the final CI check often completes ~30s before a bot posts its delayed review. One quiet cycle does not prove the PR is stable; two consecutive cycles with no new threads, reviews, or issue comments arriving gives high confidence nothing else is incoming.
+
+### Why checking every source each poll
+
+`/pr-address` polling inside a single round already re-checks its own comments, but `/pr-polish` sits a level above and must also catch:
+
+- New top-level reviews (autogpt-reviewer sometimes posts structured feedback only after several CI green cycles).
+- Issue comments from human reviewers (not caught by inline thread polling).
+- Sentry bug predictions that land on new line numbers post-push.
+- Merge conflicts introduced by a race between your push and a merge to `dev`.
+
+## Invocation pattern
+
+Delegate to existing skills with the `Skill` tool; do not re-implement the review or address logic inline. This keeps the polish loop focused on orchestration and lets the child skills evolve independently.
+
+```python
+Skill(skill="pr-review",  args=pr_url)
+Skill(skill="pr-address", args=pr_url)
+```
+
+After each child invocation, re-query GitHub state directly — never trust a summary for the stop condition. The orchestrator's `ORCHESTRATOR:DONE` is verified against actual GraphQL / REST responses per the rules in `pr-address`'s "Verify actual count before outputting ORCHESTRATOR:DONE" section.
+
+### **Auto-continue: do NOT end your response between child skills**
+
+`/pr-polish` is a single orchestration task — one invocation drives the PR all the way to merge-ready. When a child `Skill()` call returns control to you:
+
+- Do NOT summarize and stop.
+- Do NOT wait for user confirmation to continue.
+- Immediately, in the same response, perform the next loop step: state diff → decide next action → next `Skill()` call or polling sleep.
+
+The child skill returning is a **loop iteration boundary**, not a conversation turn boundary. You are expected to keep going until one of the exit conditions in the opening section is met (2 consecutive clean polls, `_MAX_ROUNDS` hit, or an unrecoverable error).
+
+If the user needs to approve a risky action mid-loop (e.g., a force-push or a destructive git operation), pause there — but not at the routine "round N finished, round N+1 needed" boundary. Those are silent transitions.
+
+## GitHub rate limits
+
+This skill issues many GraphQL calls (one review-thread query per outer iteration plus per-poll queries inside polish polling). Expect the GraphQL budget to be tight on large PRs. When `gh api rate_limit --jq .resources.graphql.remaining` drops below ~200, back off:
+
+- Fall back to REST for reads (flat `/pulls/{N}/comments`, `/pulls/{N}/reviews`, `/issues/{N}/comments`) per the `pr-address` skill's GraphQL-fallback section.
+- Queue thread resolutions (GraphQL-only) until the budget resets; keep making progress on fixes + REST replies meanwhile.
+- `sleep 5` between any batch of ≥20 writes to avoid secondary rate limits.
+
+## Safety valves
+
+- `_MAX_ROUNDS = 10` — if review+address rounds exceed this, stop and escalate to the user with a summary of what's still unresolved. A PR that cannot converge in 10 rounds has systemic issues that need human judgment.
+- After each commit, run `poetry run format` / `pnpm format && pnpm lint && pnpm types` per the target codebase's conventions. A failing format check is CI `failure` that will never self-resolve.
+- Every `/pr-review` round checks for **duplicate** concerns first (via `pr-review`'s own "Fetch existing review comments" step) so the loop does not re-post the same finding that a prior round already resolved.
+
+## Reporting
+
+When the skill finishes (either via two clean polls or hitting `_MAX_ROUNDS`), produce a compact summary:
+
+```
+PR #{N} polish complete ({rounds_completed} rounds):
+- {X} inline threads opened and resolved
+- {Y} CI failures fixed
+- {Z} new commits pushed
+Final state: CI green, {total} threads all resolved, mergeable.
+```
+
+If exiting via `_MAX_ROUNDS`, flag explicitly:
+
+```
+PR #{N} polish stopped at {_MAX_ROUNDS} rounds — NOT merge-ready:
+- {N} threads still unresolved: {titles}
+- CI status: {summary}
+Needs human review.
+```
+
+## When to use this skill
+
+Use when the user says any of:
+- "polish this PR"
+- "keep reviewing and addressing until it's mergeable"
+- "loop /pr-review + /pr-address until done"
+- "make sure the PR is actually merge-ready"
+
+Do **not** use when:
+- User wants just one review pass (→ `/pr-review`).
+- User wants to address already-posted comments without further self-review (→ `/pr-address`).
+- A fixed round count is explicitly requested (e.g., "do 3 rounds") — honour the count instead of converging.

.claude/skills/pr-test/SKILL.md

@@ -186,7 +186,7 @@ Multiple worktrees share the same host — Docker infra (postgres, redis, clamav
 
 ### Lock file contract
 
-Path (**always** the root worktree so all siblings see it): `/Users/majdyz/Code/AutoGPT/.ign.testing.lock`
+Path (**always** the root worktree so all siblings see it): `$REPO_ROOT/.ign.testing.lock`
 
 Body (one `key=value` per line):
 ```
@@ -202,7 +202,7 @@ intent=<one-line description + rough duration>
 ### Claim
 
 ```bash
-LOCK=/Users/majdyz/Code/AutoGPT/.ign.testing.lock
+LOCK=$REPO_ROOT/.ign.testing.lock
 NOW=$(date -u +%Y-%m-%dT%H:%MZ)
 STALE_AFTER_MIN=5
 
@@ -252,7 +252,7 @@ echo "$HEARTBEAT_PID" > /tmp/pr-test-heartbeat.pid
 kill "$HEARTBEAT_PID" 2>/dev/null
 rm -f "$LOCK" /tmp/pr-test-heartbeat.pid
 echo "$(date -u +%Y-%m-%dT%H:%MZ) [pr-${PR_NUMBER}] released lock" \
-    >> /Users/majdyz/Code/AutoGPT/.ign.testing.log
+    >> $REPO_ROOT/.ign.testing.log
 ```
 
 Use a `trap` so release runs even on `exit 1`:
@@ -260,12 +260,38 @@ Use a `trap` so release runs even on `exit 1`:
 trap 'kill "$HEARTBEAT_PID" 2>/dev/null; rm -f "$LOCK"' EXIT INT TERM
 ```
 
+### **Release the lock AS SOON AS the test run is done**
+
+The lock guards **test execution**, not **app lifecycle**. Once Step 5 (record results) and Step 6 (post PR comment) are complete, release the lock IMMEDIATELY — even if:
+
+- The native `poetry run app` / `pnpm dev` processes are still running so the user can keep poking at the app manually.
+- You're leaving docker containers up.
+- You're tailing logs for a minute or two.
+
+Keeping the lock held past the test run is the single most common way `/pr-test` stalls other agents. **The app staying up is orthogonal to the lock; don't conflate them.** Sibling worktrees running their own `/pr-test` will kill the stray processes and free the ports themselves (Step 3c/3e-native handle that) — they just need the lock file gone.
+
+Concretely, the sequence at the end of every `/pr-test` run (success or failure) is:
+
+```bash
+# 1. Write the final report + post PR comment — done above in Step 5/6.
+# 2. Release the lock right now, even if the app is still up.
+kill "$HEARTBEAT_PID" 2>/dev/null
+rm -f "$LOCK" /tmp/pr-test-heartbeat.pid
+echo "$(date -u +%Y-%m-%dT%H:%MZ) [pr-${PR_NUMBER}] released lock (app may still be running)" \
+    >> $REPO_ROOT/.ign.testing.log
+# 3. Optionally leave the app running and note it so the user knows:
+echo "Native stack still running on :3000 / :8006 for manual poking. Kill with:"
+echo "  pkill -9 -f 'poetry run app'; pkill -9 -f 'next-server|next dev'"
+```
+
+If a sibling agent's `/pr-test` needs to take over, it'll do the kill+rebuild dance from Step 3c/3e-native on its own — your only job is to not hold the lock file past the end of your test.
+
 ### Shared status log
 
-`/Users/majdyz/Code/AutoGPT/.ign.testing.log` is an append-only channel any agent can read/write. Use it for "I'm waiting", "I'm done, resources free", or post-run notes:
+`$REPO_ROOT/.ign.testing.log` is an append-only channel any agent can read/write. Use it for "I'm waiting", "I'm done, resources free", or post-run notes:
 ```bash
 echo "$(date -u +%Y-%m-%dT%H:%MZ) [pr-${PR_NUMBER}] <message>" \
-    >> /Users/majdyz/Code/AutoGPT/.ign.testing.log
+    >> $REPO_ROOT/.ign.testing.log
 ```
 
 ## Step 3: Environment setup
@@ -755,6 +781,19 @@ Upload screenshots to the PR using the GitHub Git API (no local git operations
 
 **CRITICAL — NEVER post a bare directory link like `https://github.com/.../tree/...`.** Every screenshot MUST appear as `![name](raw_url)` inline in the PR comment so reviewers can see them without clicking any links. After posting, the verification step below greps the comment for `![` tags and exits 1 if none are found — the test run is considered incomplete until this passes.
 
+**CRITICAL — NEVER paste absolute local paths into the PR comment.** Strings like `/Users/…`, `/home/…`, `C:\…` are useless to every reviewer except you. Before posting, grep the final body for `/Users/`, `/home/`, `/tmp/`, `/private/`, `C:\`, `~/` and either drop those lines entirely or rewrite them as repo-relative paths (`autogpt_platform/backend/…`). The PR comment is an artifact reviewers on GitHub read — it must be self-contained on github.com. Keep local paths in `$RESULTS_DIR/test-report.md` for yourself; only copy the *content* they reference (excerpts, test names, log lines) into the PR comment, not the path.
+
+**Pre-post sanity check** (paste after building the comment body, before `gh api ... comments`):
+
+```bash
+# Reject any local-looking absolute path or home-dir shortcut in the body
+if grep -nE '(^|[^A-Za-z])(/Users/|/home/|/tmp/|/private/|C:\\|~/)[A-Za-z0-9]' "$COMMENT_FILE" ; then
+  echo "ABORT: local filesystem paths detected in PR comment body."
+  echo "Remove or rewrite as repo-relative (autogpt_platform/...) before posting."
+  exit 1
+fi
+```
+
 ```bash
 # Upload screenshots via GitHub Git API (creates blobs, tree, commit, and ref remotely)
 REPO="Significant-Gravitas/AutoGPT"

.github/workflows/platform-backend-ci.yml

@@ -119,10 +119,12 @@ jobs:
     runs-on: ubuntu-latest
 
     services:
-      redis:
-        image: redis:latest
-        ports:
-          - 6379:6379
+      # Redis is provisioned as a real 3-shard cluster below via docker
+      # run (see the "Start Redis Cluster" step). GHA services can't
+      # override the image CMD or stand up multi-container clusters, so
+      # that setup is inlined — it mirrors the topology of the local dev
+      # compose stack (autogpt_platform/docker-compose.platform.yml) and
+      # prod helm chart.
       rabbitmq:
         image: rabbitmq:4.1.4
         ports:
@@ -166,6 +168,68 @@ jobs:
         with:
           python-version: ${{ matrix.python-version }}
 
+      - name: Start Redis Cluster (3 shards)
+        run: |
+          # 3-master Redis Cluster matching the local compose stack
+          # (autogpt_platform/docker-compose.platform.yml) and prod. Each
+          # shard runs in its own container on a dedicated bridge network,
+          # announces its compose-style hostname for intra-network clients,
+          # and publishes 1700N on the GHA host so tests can reach every
+          # shard via localhost. The backend's ``_address_remap`` rewrites
+          # every CLUSTER SLOTS reply to localhost:<announced-port>, which
+          # picks the right published port per shard.
+          #
+          # Not reusing docker-compose.platform.yml directly because compose
+          # validates the full file even when only some services are ``up``,
+          # and that file references services (db/kong/...) defined in a
+          # sibling compose file — pulling both in would needlessly couple
+          # CI to the full local-dev stack.
+          docker network create redis-cluster-ci
+          for i in 0 1 2; do
+            port=$((17000 + i))
+            bus=$((27000 + i))
+            docker run -d --name redis-$i --network redis-cluster-ci \
+              --network-alias redis-$i \
+              -p $port:$port \
+              redis:7 \
+              redis-server --port $port \
+                --cluster-enabled yes \
+                --cluster-config-file nodes.conf \
+                --cluster-node-timeout 5000 \
+                --cluster-require-full-coverage no \
+                --cluster-announce-hostname redis-$i \
+                --cluster-announce-port $port \
+                --cluster-announce-bus-port $bus \
+                --cluster-preferred-endpoint-type hostname
+          done
+          # Wait for each shard to accept commands.
+          for i in 0 1 2; do
+            port=$((17000 + i))
+            for _ in $(seq 1 30); do
+              docker exec redis-$i redis-cli -p $port ping 2>/dev/null | grep -q PONG && break
+              sleep 1
+            done
+          done
+          # Form the cluster from an init container on the same network so
+          # --cluster-preferred-endpoint-type hostname resolves redis-0/1/2.
+          docker run --rm --network redis-cluster-ci redis:7 \
+            redis-cli --cluster create \
+              redis-0:17000 redis-1:17001 redis-2:17002 \
+              --cluster-replicas 0 --cluster-yes
+          # Confirm convergence.
+          for _ in $(seq 1 30); do
+            state=$(docker exec redis-0 redis-cli -p 17000 cluster info | awk -F: '/^cluster_state:/ {print $2}' | tr -d '[:cntrl:]')
+            if [ "$state" = "ok" ]; then
+              echo "Redis Cluster ready (3 shards, state=ok)"
+              docker exec redis-0 redis-cli -p 17000 cluster nodes
+              exit 0
+            fi
+            sleep 1
+          done
+          echo "Redis Cluster failed to reach ok state" >&2
+          docker exec redis-0 redis-cli -p 17000 cluster info >&2 || true
+          exit 1
+
       - name: Setup Supabase
         uses: supabase/setup-cli@v1
         with:
@@ -286,8 +350,13 @@ jobs:
           SUPABASE_SERVICE_ROLE_KEY: ${{ steps.supabase.outputs.SERVICE_ROLE_KEY }}
           JWT_VERIFY_KEY: ${{ steps.supabase.outputs.JWT_SECRET }}
           REDIS_HOST: "localhost"
-          REDIS_PORT: "6379"
+          REDIS_PORT: "17000"
           ENCRYPTION_KEY: "dvziYgz0KSK8FENhju0ZYi8-fRTfAdlz6YLhdB_jhNw=" # DO NOT USE IN PRODUCTION!!
+          # Opt-in: lets backend/data/e2e_redis_restart_test.py spin up its
+          # own isolated 3-shard cluster (ports 27110–27112) and exercise
+          # ``docker restart <shard>`` mid-stream. Off locally so a
+          # contributor's ``poetry run test`` doesn't pay the ~15s cost.
+          E2E_RESTART_ISOLATED: "1"
 
       - name: Upload coverage reports to Codecov
         if: ${{ !cancelled() }}

.gitignore

@@ -196,3 +196,7 @@ test.db
 plans/
 .claude/worktrees/
 test-results/
+
+# Playwright MCP / local browser-testing artifacts
+.playwright-mcp/
+copilot-session-switch-qa/

.secrets.baseline

@@ -267,7 +267,7 @@
         "filename": "autogpt_platform/backend/backend/blocks/replicate/replicate_block.py",
         "hashed_secret": "8bbdd6f26368f58ea4011d13d7f763cb662e66f0",
         "is_verified": false,
-        "line_number": 55
+        "line_number": 67
       }
     ],
     "autogpt_platform/backend/backend/blocks/slant3d/webhook.py": [
@@ -467,5 +467,5 @@
       }
     ]
   },
-  "generated_at": "2026-04-09T14:20:23Z"
+  "generated_at": "2026-04-24T16:42:44Z"
 }

autogpt_platform/autogpt_libs/autogpt_libs/rate_limit/config.py

@@ -1,33 +0,0 @@
-from typing import Optional
-
-from pydantic import Field
-from pydantic_settings import BaseSettings, SettingsConfigDict
-
-
-class RateLimitSettings(BaseSettings):
-    redis_host: str = Field(
-        default="redis://localhost:6379",
-        description="Redis host",
-        validation_alias="REDIS_HOST",
-    )
-
-    redis_port: str = Field(
-        default="6379", description="Redis port", validation_alias="REDIS_PORT"
-    )
-
-    redis_password: Optional[str] = Field(
-        default=None,
-        description="Redis password",
-        validation_alias="REDIS_PASSWORD",
-    )
-
-    requests_per_minute: int = Field(
-        default=60,
-        description="Maximum number of requests allowed per minute per API key",
-        validation_alias="RATE_LIMIT_REQUESTS_PER_MINUTE",
-    )
-
-    model_config = SettingsConfigDict(case_sensitive=True, extra="ignore")
-
-
-RATE_LIMIT_SETTINGS = RateLimitSettings()

autogpt_platform/autogpt_libs/autogpt_libs/rate_limit/limiter.py

@@ -1,51 +0,0 @@
-import time
-from typing import Tuple
-
-from redis import Redis
-
-from .config import RATE_LIMIT_SETTINGS
-
-
-class RateLimiter:
-    def __init__(
-        self,
-        redis_host: str = RATE_LIMIT_SETTINGS.redis_host,
-        redis_port: str = RATE_LIMIT_SETTINGS.redis_port,
-        redis_password: str | None = RATE_LIMIT_SETTINGS.redis_password,
-        requests_per_minute: int = RATE_LIMIT_SETTINGS.requests_per_minute,
-    ):
-        self.redis = Redis(
-            host=redis_host,
-            port=int(redis_port),
-            password=redis_password,
-            decode_responses=True,
-        )
-        self.window = 60
-        self.max_requests = requests_per_minute
-
-    async def check_rate_limit(self, api_key_id: str) -> Tuple[bool, int, int]:
-        """
-        Check if request is within rate limits.
-
-        Args:
-            api_key_id: The API key identifier to check
-
-        Returns:
-            Tuple of (is_allowed, remaining_requests, reset_time)
-        """
-        now = time.time()
-        window_start = now - self.window
-        key = f"ratelimit:{api_key_id}:1min"
-
-        pipe = self.redis.pipeline()
-        pipe.zremrangebyscore(key, 0, window_start)
-        pipe.zadd(key, {str(now): now})
-        pipe.zcount(key, window_start, now)
-        pipe.expire(key, self.window)
-
-        _, _, request_count, _ = pipe.execute()
-
-        remaining = max(0, self.max_requests - request_count)
-        reset_time = int(now + self.window)
-
-        return request_count <= self.max_requests, remaining, reset_time

autogpt_platform/autogpt_libs/autogpt_libs/rate_limit/middleware.py

@@ -1,32 +0,0 @@
-from fastapi import HTTPException, Request
-from starlette.middleware.base import RequestResponseEndpoint
-
-from .limiter import RateLimiter
-
-
-async def rate_limit_middleware(request: Request, call_next: RequestResponseEndpoint):
-    """FastAPI middleware for rate limiting API requests."""
-    limiter = RateLimiter()
-
-    if not request.url.path.startswith("/api"):
-        return await call_next(request)
-
-    api_key = request.headers.get("Authorization")
-    if not api_key:
-        return await call_next(request)
-
-    api_key = api_key.replace("Bearer ", "")
-
-    is_allowed, remaining, reset_time = await limiter.check_rate_limit(api_key)
-
-    if not is_allowed:
-        raise HTTPException(
-            status_code=429, detail="Rate limit exceeded. Please try again later."
-        )
-
-    response = await call_next(request)
-    response.headers["X-RateLimit-Limit"] = str(limiter.max_requests)
-    response.headers["X-RateLimit-Remaining"] = str(remaining)
-    response.headers["X-RateLimit-Reset"] = str(reset_time)
-
-    return response

autogpt_platform/autogpt_libs/autogpt_libs/supabase_integration_credentials_store/types.py

@@ -59,6 +59,8 @@ class OAuthState(BaseModel):
     code_verifier: Optional[str] = None
     scopes: list[str]
     """Unix timestamp (seconds) indicating when this OAuth state expires"""
+    credential_id: Optional[str] = None
+    """If set, this OAuth flow upgrades an existing credential's scopes."""
 
 
 class UserMetadata(BaseModel):

autogpt_platform/autogpt_libs/autogpt_libs/utils/synchronize.py

@@ -1,13 +1,16 @@
 import asyncio
 from contextlib import asynccontextmanager
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Union
 
 from expiringdict import ExpiringDict
 
 if TYPE_CHECKING:
     from redis.asyncio import Redis as AsyncRedis
+    from redis.asyncio.cluster import RedisCluster as AsyncRedisCluster
     from redis.asyncio.lock import Lock as AsyncRedisLock
 
+    AsyncRedisLike = Union[AsyncRedis, AsyncRedisCluster]
+
 
 class AsyncRedisKeyedMutex:
     """
@@ -17,7 +20,7 @@ class AsyncRedisKeyedMutex:
     in case the key is not unlocked for a specified duration, to prevent memory leaks.
     """
 
-    def __init__(self, redis: "AsyncRedis", timeout: int | None = 60):
+    def __init__(self, redis: "AsyncRedisLike", timeout: int | None = 60):
         self.redis = redis
         self.timeout = timeout
         self.locks: dict[Any, "AsyncRedisLock"] = ExpiringDict(

autogpt_platform/backend/.env.default

@@ -37,6 +37,23 @@ JWT_VERIFY_KEY=your-super-secret-jwt-token-with-at-least-32-characters-long
 ENCRYPTION_KEY=dvziYgz0KSK8FENhju0ZYi8-fRTfAdlz6YLhdB_jhNw=
 UNSUBSCRIBE_SECRET_KEY=HlP8ivStJjmbf6NKi78m_3FnOogut0t5ckzjsIqeaio=
 
+# Web Push (VAPID) — generate with: poetry run python -c "
+#   from py_vapid import Vapid; import base64
+#   from cryptography.hazmat.primitives.serialization import Encoding, PublicFormat
+#   v = Vapid(); v.generate_keys()
+#   raw_priv = v.private_key.private_numbers().private_value.to_bytes(32, 'big')
+#   print('VAPID_PRIVATE_KEY=' + base64.urlsafe_b64encode(raw_priv).rstrip(b'=').decode())
+#   raw_pub = v.public_key.public_bytes(Encoding.X962, PublicFormat.UncompressedPoint)
+#   print('VAPID_PUBLIC_KEY=' + base64.urlsafe_b64encode(raw_pub).rstrip(b'=').decode())
+# "
+# Dev-only keypair below — DO NOT use in staging/production. Regenerate
+# your own with the snippet above before any non-local deployment.
+VAPID_PRIVATE_KEY=17hBPdSdn6TR_yAgQxA0TjTcvRj3Lf6znHnASZ4rOKc
+VAPID_PUBLIC_KEY=BBg49iVTWthVbRYphwmZNvZyiSJDqtSO4nmLxDzLKe3Oo9jbtu0Usa14xX4HQQNLUeiEfzD42zWSlrvY1PR12bs
+# Per RFC 8292 push services use this in 410 Gone reports; set to a real
+# mailbox in production. Defaults to a placeholder for local dev.
+VAPID_CLAIM_EMAIL=mailto:dev@example.com
+
 ## ===== IMPORTANT OPTIONAL CONFIGURATION ===== ##
 # Platform URLs (set these for webhooks and OAuth to work)
 PLATFORM_BASE_URL=http://localhost:8000
@@ -182,6 +199,10 @@ GOOGLE_MAPS_API_KEY=
 # Platform Bot Linking
 PLATFORM_LINK_BASE_URL=http://localhost:3000/link
 
+# CoPilot chat-platform bridge (Discord/Telegram/Slack)
+# Uses FRONTEND_BASE_URL (above) for link confirmation pages.
+AUTOPILOT_BOT_DISCORD_TOKEN=
+
 # Communication Services
 DISCORD_BOT_TOKEN=
 MEDIUM_API_KEY=

autogpt_platform/backend/backend/api/conn_manager.py

@@ -1,14 +1,44 @@
 import asyncio
-from typing import Dict, Set
+import json
+import logging
+import time
+from typing import Awaitable, Callable, Dict, Optional, Set
 
-from fastapi import WebSocket
+from fastapi import WebSocket, WebSocketDisconnect
+from redis.asyncio import Redis as AsyncRedis
+from redis.asyncio.client import PubSub as AsyncPubSub
+from redis.exceptions import MovedError, RedisError, ResponseError
+from starlette.websockets import WebSocketState
 
-from backend.api.model import NotificationPayload, WSMessage, WSMethod
+from backend.api.model import WSMessage, WSMethod
+from backend.data import redis_client as redis
+from backend.data.event_bus import _assert_no_wildcard
 from backend.data.execution import (
     ExecutionEventType,
-    GraphExecutionEvent,
-    NodeExecutionEvent,
+    exec_channel,
+    get_graph_execution_meta,
+    graph_all_channel,
 )
+from backend.data.notification_bus import NotificationEvent
+from backend.util.settings import Settings
+
+logger = logging.getLogger(__name__)
+_settings = Settings()
+
+
+def _is_ws_close_race(exc: BaseException, websocket: WebSocket) -> bool:
+    """A SPUBLISH→WS send racing with WS close — benign, drop quietly."""
+    if isinstance(exc, WebSocketDisconnect):
+        return True
+    if (
+        getattr(websocket, "application_state", None) == WebSocketState.DISCONNECTED
+        or getattr(websocket, "client_state", None) == WebSocketState.DISCONNECTED
+    ):
+        return True
+    if isinstance(exc, RuntimeError) and "close message has been sent" in str(exc):
+        return True
+    return False
+
 
 _EVENT_TYPE_TO_METHOD_MAP: dict[ExecutionEventType, WSMethod] = {
     ExecutionEventType.GRAPH_EXEC_UPDATE: WSMethod.GRAPH_EXECUTION_EVENT,
@@ -16,128 +46,379 @@ _EVENT_TYPE_TO_METHOD_MAP: dict[ExecutionEventType, WSMethod] = {
 }
 
 
+def event_bus_channel(channel_key: str) -> str:
+    """Prefix a channel key with the execution event bus name."""
+    return f"{_settings.config.execution_event_bus_name}/{channel_key}"
+
+
+def _notification_bus_channel(user_id: str) -> str:
+    """Return the full sharded channel name for a user's notifications."""
+    return f"{_settings.config.notification_event_bus_name}/{user_id}"
+
+
+MessageHandler = Callable[[Optional[bytes | str]], Awaitable[None]]
+
+
+def _is_moved_error(exc: BaseException) -> bool:
+    """A MOVED redirect — slot migration mid-stream; pump should reconnect."""
+    if isinstance(exc, MovedError):
+        return True
+    if isinstance(exc, ResponseError) and str(exc).startswith("MOVED "):
+        return True
+    return False
+
+
+# Reconnect tunables for shard-failover during pubsub.listen().
+_PUMP_RECONNECT_DEADLINE_S = 60.0
+_PUMP_RECONNECT_BACKOFF_INITIAL_S = 0.5
+_PUMP_RECONNECT_BACKOFF_MAX_S = 8.0
+
+
+class _Subscription:
+    """One SSUBSCRIBE lifecycle bound to a WebSocket, pinned to the owning shard."""
+
+    def __init__(self, full_channel: str) -> None:
+        _assert_no_wildcard(full_channel)
+        self.full_channel = full_channel
+        self._client: AsyncRedis | None = None
+        self._pubsub: AsyncPubSub | None = None
+        self._task: asyncio.Task | None = None
+
+    async def start(self, on_message: MessageHandler) -> None:
+        await self._open_pubsub()
+        self._task = asyncio.create_task(self._pump(on_message))
+
+    async def _open_pubsub(self) -> None:
+        """(Re)establish the sharded pubsub connection + SSUBSCRIBE."""
+        self._client = await redis.connect_sharded_pubsub_async(self.full_channel)
+        self._pubsub = self._client.pubsub()
+        await self._pubsub.execute_command("SSUBSCRIBE", self.full_channel)
+        # redis-py 6.x async PubSub.listen() exits when ``channels`` is
+        # empty; raw SSUBSCRIBE doesn't populate it, so do it ourselves.
+        self._pubsub.channels[self.full_channel] = None  # type: ignore[index]
+
+    async def _close_pubsub_quietly(self) -> None:
+        """Best-effort teardown before reconnect — never raises."""
+        if self._pubsub is not None:
+            try:
+                await self._pubsub.aclose()
+            except Exception:
+                pass
+            self._pubsub = None
+        if self._client is not None:
+            try:
+                await self._client.aclose()
+            except Exception:
+                pass
+            self._client = None
+
+    async def _pump(self, on_message: MessageHandler) -> None:
+        if self._pubsub is None:
+            return
+        backoff = _PUMP_RECONNECT_BACKOFF_INITIAL_S
+        deadline = time.monotonic() + _PUMP_RECONNECT_DEADLINE_S
+        while True:
+            pubsub = self._pubsub
+            if pubsub is None:
+                return
+            needs_reconnect = False
+            try:
+                async for message in pubsub.listen():
+                    msg_type = message.get("type")
+                    # Server-pushed sunsubscribe: slot ownership changed and
+                    # Redis revoked our SSUBSCRIBE without dropping the TCP.
+                    # Treat as a reconnect trigger so we re-resolve the shard.
+                    if msg_type == "sunsubscribe":
+                        needs_reconnect = True
+                        break
+                    if msg_type not in ("smessage", "message", "pmessage"):
+                        continue
+                    # Successful read resets the reconnect budget.
+                    backoff = _PUMP_RECONNECT_BACKOFF_INITIAL_S
+                    deadline = time.monotonic() + _PUMP_RECONNECT_DEADLINE_S
+                    try:
+                        await on_message(message.get("data"))
+                    except Exception:
+                        logger.exception(
+                            "Websocket message-handler failed for channel %s",
+                            self.full_channel,
+                        )
+                if not needs_reconnect:
+                    # listen() exited cleanly (channels emptied) — pump is done.
+                    return
+            except asyncio.CancelledError:
+                raise
+            except (ConnectionError, RedisError) as exc:
+                if isinstance(exc, ResponseError) and not _is_moved_error(exc):
+                    logger.exception(
+                        "Pubsub pump crashed on non-retryable ResponseError for %s",
+                        self.full_channel,
+                    )
+                    return
+                if time.monotonic() > deadline:
+                    logger.exception(
+                        "Pubsub pump giving up after reconnect deadline for %s",
+                        self.full_channel,
+                    )
+                    return
+                logger.warning(
+                    "Pubsub pump reconnecting for %s after %s: %s",
+                    self.full_channel,
+                    type(exc).__name__,
+                    exc,
+                )
+            except Exception:
+                logger.exception("Pubsub pump crashed for %s", self.full_channel)
+                return
+
+            # Either a retryable error was raised, or the server pushed a
+            # sunsubscribe — close the stale pubsub and reopen against the
+            # (possibly migrated) shard.
+            await self._close_pubsub_quietly()
+            await asyncio.sleep(backoff)
+            backoff = min(backoff * 2, _PUMP_RECONNECT_BACKOFF_MAX_S)
+            try:
+                await self._open_pubsub()
+            except (ConnectionError, RedisError) as reopen_exc:
+                logger.warning(
+                    "Pubsub pump reopen failed for %s: %s",
+                    self.full_channel,
+                    reopen_exc,
+                )
+                # Loop again — deadline check will eventually exit.
+                continue
+
+    async def stop(self) -> None:
+        if self._task is not None:
+            self._task.cancel()
+            try:
+                await self._task
+            except (asyncio.CancelledError, Exception):
+                pass
+            self._task = None
+        if self._pubsub is not None:
+            try:
+                await self._pubsub.execute_command("SUNSUBSCRIBE", self.full_channel)
+            except Exception:
+                logger.warning(
+                    "SUNSUBSCRIBE failed for %s", self.full_channel, exc_info=True
+                )
+            try:
+                await self._pubsub.aclose()
+            except Exception:
+                pass
+            self._pubsub = None
+        if self._client is not None:
+            try:
+                await self._client.aclose()
+            except Exception:
+                pass
+            self._client = None
+
+
 class ConnectionManager:
     def __init__(self):
         self.active_connections: Set[WebSocket] = set()
+        # channel_key → sockets subscribed (public channel keys, not raw Redis channels)
         self.subscriptions: Dict[str, Set[WebSocket]] = {}
-        self.user_connections: Dict[str, Set[WebSocket]] = {}
+        # websocket → {channel_key: _Subscription}
+        self._ws_subs: Dict[WebSocket, Dict[str, _Subscription]] = {}
+        # websocket → notification subscription
+        self._ws_notifications: Dict[WebSocket, _Subscription] = {}
 
     async def connect_socket(self, websocket: WebSocket, *, user_id: str):
         await websocket.accept()
         self.active_connections.add(websocket)
-        if user_id not in self.user_connections:
-            self.user_connections[user_id] = set()
-        self.user_connections[user_id].add(websocket)
+        self._ws_subs.setdefault(websocket, {})
+        await self._start_notification_subscription(websocket, user_id=user_id)
 
-    def disconnect_socket(self, websocket: WebSocket, *, user_id: str):
+    async def disconnect_socket(self, websocket: WebSocket, *, user_id: str):
         self.active_connections.discard(websocket)
-        for subscribers in self.subscriptions.values():
+        # Stop SSUBSCRIBE pumps before dropping bookkeeping to avoid leaks.
+        subs = self._ws_subs.pop(websocket, {})
+        for sub in subs.values():
+            await sub.stop()
+        notif_sub = self._ws_notifications.pop(websocket, None)
+        if notif_sub is not None:
+            await notif_sub.stop()
+        for channel_key, subscribers in list(self.subscriptions.items()):
             subscribers.discard(websocket)
-        user_conns = self.user_connections.get(user_id)
-        if user_conns is not None:
-            user_conns.discard(websocket)
-            if not user_conns:
-                self.user_connections.pop(user_id, None)
+            if not subscribers:
+                self.subscriptions.pop(channel_key, None)
 
     async def subscribe_graph_exec(
         self, *, user_id: str, graph_exec_id: str, websocket: WebSocket
     ) -> str:
-        return await self._subscribe(
-            _graph_exec_channel_key(user_id, graph_exec_id=graph_exec_id), websocket
+        # Hash-tagged channel needs graph_id; resolve once per subscribe.
+        meta = await get_graph_execution_meta(user_id, graph_exec_id)
+        if meta is None:
+            raise ValueError(
+                f"graph_exec #{graph_exec_id} not found for user #{user_id}"
+            )
+        channel_key = graph_exec_channel_key(user_id, graph_exec_id=graph_exec_id)
+        full_channel = event_bus_channel(
+            exec_channel(user_id, meta.graph_id, graph_exec_id)
         )
+        await self._open_subscription(websocket, channel_key, full_channel)
+        return channel_key
 
     async def subscribe_graph_execs(
         self, *, user_id: str, graph_id: str, websocket: WebSocket
     ) -> str:
-        return await self._subscribe(
-            _graph_execs_channel_key(user_id, graph_id=graph_id), websocket
-        )
+        channel_key = _graph_execs_channel_key(user_id, graph_id=graph_id)
+        full_channel = event_bus_channel(graph_all_channel(user_id, graph_id))
+        await self._open_subscription(websocket, channel_key, full_channel)
+        return channel_key
 
     async def unsubscribe_graph_exec(
         self, *, user_id: str, graph_exec_id: str, websocket: WebSocket
     ) -> str | None:
-        return await self._unsubscribe(
-            _graph_exec_channel_key(user_id, graph_exec_id=graph_exec_id), websocket
-        )
+        channel_key = graph_exec_channel_key(user_id, graph_exec_id=graph_exec_id)
+        return await self._close_subscription(websocket, channel_key)
 
     async def unsubscribe_graph_execs(
         self, *, user_id: str, graph_id: str, websocket: WebSocket
     ) -> str | None:
-        return await self._unsubscribe(
-            _graph_execs_channel_key(user_id, graph_id=graph_id), websocket
-        )
+        channel_key = _graph_execs_channel_key(user_id, graph_id=graph_id)
+        return await self._close_subscription(websocket, channel_key)
 
-    async def send_execution_update(
-        self, exec_event: GraphExecutionEvent | NodeExecutionEvent
-    ) -> int:
-        graph_exec_id = (
-            exec_event.id
-            if isinstance(exec_event, GraphExecutionEvent)
-            else exec_event.graph_exec_id
-        )
+    async def _open_subscription(
+        self, websocket: WebSocket, channel_key: str, full_channel: str
+    ) -> None:
+        self.subscriptions.setdefault(channel_key, set()).add(websocket)
+        per_ws = self._ws_subs.setdefault(websocket, {})
+        if channel_key in per_ws:
+            return
+        sub = _Subscription(full_channel)
 
-        n_sent = 0
+        async def on_message(data: Optional[bytes | str]) -> None:
+            await self._forward_exec_event(websocket, channel_key, data)
 
-        channels: set[str] = {
-            # Send update to listeners for this graph execution
-            _graph_exec_channel_key(exec_event.user_id, graph_exec_id=graph_exec_id)
-        }
-        if isinstance(exec_event, GraphExecutionEvent):
-            # Send update to listeners for all executions of this graph
-            channels.add(
-                _graph_execs_channel_key(
-                    exec_event.user_id, graph_id=exec_event.graph_id
-                )
-            )
+        await sub.start(on_message)
+        per_ws[channel_key] = sub
 
-        for channel in channels.intersection(self.subscriptions.keys()):
-            message = WSMessage(
-                method=_EVENT_TYPE_TO_METHOD_MAP[exec_event.event_type],
-                channel=channel,
-                data=exec_event.model_dump(),
-            ).model_dump_json()
-            for connection in self.subscriptions[channel]:
-                await connection.send_text(message)
-                n_sent += 1
-
-        return n_sent
-
-    async def send_notification(
-        self, *, user_id: str, payload: NotificationPayload
-    ) -> int:
-        """Send a notification to all websocket connections belonging to a user."""
-        message = WSMessage(
-            method=WSMethod.NOTIFICATION,
-            data=payload.model_dump(),
-        ).model_dump_json()
-
-        connections = tuple(self.user_connections.get(user_id, set()))
-        if not connections:
-            return 0
-
-        await asyncio.gather(
-            *(connection.send_text(message) for connection in connections),
-            return_exceptions=True,
-        )
-
-        return len(connections)
-
-    async def _subscribe(self, channel_key: str, websocket: WebSocket) -> str:
-        if channel_key not in self.subscriptions:
-            self.subscriptions[channel_key] = set()
-        self.subscriptions[channel_key].add(websocket)
+    async def _close_subscription(
+        self, websocket: WebSocket, channel_key: str
+    ) -> str | None:
+        subscribers = self.subscriptions.get(channel_key)
+        if subscribers is None:
+            return None
+        subscribers.discard(websocket)
+        if not subscribers:
+            self.subscriptions.pop(channel_key, None)
+        per_ws = self._ws_subs.get(websocket)
+        if per_ws and channel_key in per_ws:
+            sub = per_ws.pop(channel_key)
+            await sub.stop()
         return channel_key
 
-    async def _unsubscribe(self, channel_key: str, websocket: WebSocket) -> str | None:
-        if channel_key in self.subscriptions:
-            self.subscriptions[channel_key].discard(websocket)
-            if not self.subscriptions[channel_key]:
-                del self.subscriptions[channel_key]
-            return channel_key
-        return None
+    async def _forward_exec_event(
+        self,
+        websocket: WebSocket,
+        channel_key: str,
+        raw_payload: Optional[bytes | str],
+    ) -> None:
+        if raw_payload is None:
+            return
+        # Unwrap the `_EventPayloadWrapper` envelope, then re-wrap as a WS message.
+        try:
+            wrapper = (
+                raw_payload.decode()
+                if isinstance(raw_payload, (bytes, bytearray))
+                else raw_payload
+            )
+        except Exception:
+            logger.warning(
+                "Failed to decode pubsub payload on %s", channel_key, exc_info=True
+            )
+            return
+
+        try:
+            parsed = json.loads(wrapper)
+            event_data = parsed.get("payload")
+            if not isinstance(event_data, dict):
+                return
+            event_type = event_data.get("event_type")
+            method = _EVENT_TYPE_TO_METHOD_MAP.get(ExecutionEventType(event_type))
+            if method is None:
+                return
+            message = WSMessage(
+                method=method,
+                channel=channel_key,
+                data=event_data,
+            ).model_dump_json()
+            await websocket.send_text(message)
+        except Exception as e:
+            if _is_ws_close_race(e, websocket):
+                logger.debug("Dropped exec event on closed WS for %s", channel_key)
+                return
+            logger.exception("Failed to forward exec event on %s", channel_key)
+
+    async def _start_notification_subscription(
+        self, websocket: WebSocket, *, user_id: str
+    ) -> None:
+        full_channel = _notification_bus_channel(user_id)
+        sub = _Subscription(full_channel)
+
+        async def on_message(data: Optional[bytes | str]) -> None:
+            await self._forward_notification(websocket, user_id, data)
+
+        try:
+            await sub.start(on_message)
+        except Exception:
+            logger.exception(
+                "Failed to open notification SSUBSCRIBE for user=%s", user_id
+            )
+            return
+        self._ws_notifications[websocket] = sub
+
+    async def _forward_notification(
+        self,
+        websocket: WebSocket,
+        user_id: str,
+        raw_payload: Optional[bytes | str],
+    ) -> None:
+        if raw_payload is None:
+            return
+        try:
+            wrapper_json = (
+                raw_payload.decode()
+                if isinstance(raw_payload, (bytes, bytearray))
+                else raw_payload
+            )
+            parsed = json.loads(wrapper_json)
+            inner = parsed.get("payload") if isinstance(parsed, dict) else None
+            if not isinstance(inner, dict):
+                return
+            event = NotificationEvent.model_validate(inner)
+        except Exception:
+            logger.warning(
+                "Failed to parse notification payload for user=%s",
+                user_id,
+                exc_info=True,
+            )
+            return
+        # Defense in depth against cross-user payloads.
+        if event.user_id != user_id:
+            return
+        message = WSMessage(
+            method=WSMethod.NOTIFICATION,
+            data=event.payload.model_dump(),
+        ).model_dump_json()
+        try:
+            await websocket.send_text(message)
+        except Exception as e:
+            if _is_ws_close_race(e, websocket):
+                logger.debug("Dropped notification on closed WS for user=%s", user_id)
+                return
+            logger.warning(
+                "Failed to deliver notification to WS for user=%s",
+                user_id,
+                exc_info=True,
+            )
 
 
-def _graph_exec_channel_key(user_id: str, *, graph_exec_id: str) -> str:
+def graph_exec_channel_key(user_id: str, *, graph_exec_id: str) -> str:
     return f"{user_id}|graph_exec#{graph_exec_id}"
 
 

autogpt_platform/backend/backend/api/conn_manager_integration_test.py

@@ -0,0 +1,386 @@
+"""ConnectionManager integration over the live 3-shard Redis cluster:
+SSUBSCRIBE → SPUBLISH → WebSocket forwarding with no Redis mocks. Skips
+when the cluster is unreachable."""
+
+import asyncio
+import json
+from datetime import datetime, timezone
+from unittest.mock import AsyncMock
+from uuid import uuid4
+
+import pytest
+from fastapi import WebSocket
+
+import backend.data.redis_client as redis_client
+from backend.api.conn_manager import (
+    ConnectionManager,
+    _graph_execs_channel_key,
+    event_bus_channel,
+    graph_exec_channel_key,
+)
+from backend.api.model import WSMethod
+from backend.data.execution import (
+    ExecutionStatus,
+    GraphExecutionEvent,
+    GraphExecutionMeta,
+    NodeExecutionEvent,
+    exec_channel,
+    graph_all_channel,
+)
+
+
+def _has_live_cluster() -> bool:
+    try:
+        c = redis_client.connect()
+    except Exception:  # noqa: BLE001 — any connect failure → skip
+        return False
+    try:
+        c.close()
+    except Exception:
+        pass
+    return True
+
+
+pytestmark = pytest.mark.skipif(
+    not _has_live_cluster(),
+    reason="local redis cluster not reachable; skip conn_manager integration",
+)
+
+
+def _meta(user_id: str, graph_id: str, graph_exec_id: str) -> GraphExecutionMeta:
+    """Build a minimal GraphExecutionMeta for ``subscribe_graph_exec`` to use."""
+    return GraphExecutionMeta(
+        id=graph_exec_id,
+        user_id=user_id,
+        graph_id=graph_id,
+        graph_version=1,
+        inputs=None,
+        credential_inputs=None,
+        nodes_input_masks=None,
+        preset_id=None,
+        status=ExecutionStatus.RUNNING,
+        started_at=datetime.now(tz=timezone.utc),
+        ended_at=None,
+        stats=GraphExecutionMeta.Stats(),
+    )
+
+
+def _node_event_payload(
+    *, user_id: str, graph_id: str, graph_exec_id: str, marker: str
+) -> bytes:
+    """Wire-format a NodeExecutionEvent the way RedisExecutionEventBus would."""
+    inner = NodeExecutionEvent(
+        user_id=user_id,
+        graph_id=graph_id,
+        graph_version=1,
+        graph_exec_id=graph_exec_id,
+        node_exec_id=f"node-exec-{marker}",
+        node_id="node-1",
+        block_id="block-1",
+        status=ExecutionStatus.COMPLETED,
+        input_data={"in": marker},
+        output_data={"out": [marker]},
+        add_time=datetime.now(tz=timezone.utc),
+        queue_time=None,
+        start_time=datetime.now(tz=timezone.utc),
+        end_time=datetime.now(tz=timezone.utc),
+    ).model_dump(mode="json")
+    return json.dumps({"payload": inner}).encode()
+
+
+def _graph_event_payload(
+    *, user_id: str, graph_id: str, graph_exec_id: str, marker: str
+) -> bytes:
+    inner = GraphExecutionEvent(
+        id=graph_exec_id,
+        user_id=user_id,
+        graph_id=graph_id,
+        graph_version=1,
+        preset_id=None,
+        status=ExecutionStatus.COMPLETED,
+        started_at=datetime.now(tz=timezone.utc),
+        ended_at=datetime.now(tz=timezone.utc),
+        stats=GraphExecutionEvent.Stats(
+            cost=0,
+            duration=1.0,
+            node_exec_time=0.5,
+            node_exec_count=1,
+        ),
+        inputs={"x": marker},
+        credential_inputs=None,
+        nodes_input_masks=None,
+        outputs={"y": [marker]},
+    ).model_dump(mode="json")
+    return json.dumps({"payload": inner}).encode()
+
+
+async def _wait_until(predicate, timeout: float = 5.0, interval: float = 0.05) -> bool:
+    """Poll ``predicate()`` until truthy or timeout — used to wait for pubsub."""
+    deadline = asyncio.get_event_loop().time() + timeout
+    while asyncio.get_event_loop().time() < deadline:
+        if predicate():
+            return True
+        await asyncio.sleep(interval)
+    return False
+
+
+@pytest.mark.asyncio
+async def test_two_clients_get_independent_ssubscribes_on_right_shards(
+    monkeypatch,
+) -> None:
+    """Two WS clients on different graph_exec_ids each receive ONLY their
+    own publish, even when the channels land on different shards."""
+    user_id = "user-conn-int-1"
+    graph_a = f"graph-a-{uuid4().hex[:8]}"
+    graph_b = f"graph-b-{uuid4().hex[:8]}"
+    exec_a = f"exec-a-{uuid4().hex[:8]}"
+    exec_b = f"exec-b-{uuid4().hex[:8]}"
+
+    # Stub Prisma lookup so tests don't need a DB.
+    async def _fake_meta(_uid, gex_id):
+        return _meta(user_id, graph_a if gex_id == exec_a else graph_b, gex_id)
+
+    monkeypatch.setattr("backend.api.conn_manager.get_graph_execution_meta", _fake_meta)
+
+    cm = ConnectionManager()
+    ws_a: AsyncMock = AsyncMock(spec=WebSocket)
+    ws_b: AsyncMock = AsyncMock(spec=WebSocket)
+    sent_a: list[str] = []
+    sent_b: list[str] = []
+    ws_a.send_text = AsyncMock(side_effect=lambda m: sent_a.append(m))
+    ws_b.send_text = AsyncMock(side_effect=lambda m: sent_b.append(m))
+
+    redis_client.get_redis.cache_clear()
+    cluster = redis_client.get_redis()
+
+    try:
+        await cm.subscribe_graph_exec(
+            user_id=user_id, graph_exec_id=exec_a, websocket=ws_a
+        )
+        await cm.subscribe_graph_exec(
+            user_id=user_id, graph_exec_id=exec_b, websocket=ws_b
+        )
+        # Let SSUBSCRIBE settle on each shard.
+        await asyncio.sleep(0.2)
+
+        # Publish to each per-exec channel.
+        chan_a = event_bus_channel(exec_channel(user_id, graph_a, exec_a))
+        chan_b = event_bus_channel(exec_channel(user_id, graph_b, exec_b))
+        cluster.spublish(
+            chan_a,
+            _node_event_payload(
+                user_id=user_id,
+                graph_id=graph_a,
+                graph_exec_id=exec_a,
+                marker="A",
+            ).decode(),
+        )
+        cluster.spublish(
+            chan_b,
+            _node_event_payload(
+                user_id=user_id,
+                graph_id=graph_b,
+                graph_exec_id=exec_b,
+                marker="B",
+            ).decode(),
+        )
+
+        delivered = await _wait_until(lambda: sent_a and sent_b, timeout=5.0)
+        assert delivered, f"timeout: sent_a={sent_a!r} sent_b={sent_b!r}"
+
+        msg_a = json.loads(sent_a[0])
+        msg_b = json.loads(sent_b[0])
+        assert msg_a["channel"] == graph_exec_channel_key(user_id, graph_exec_id=exec_a)
+        assert msg_b["channel"] == graph_exec_channel_key(user_id, graph_exec_id=exec_b)
+        assert msg_a["data"]["graph_exec_id"] == exec_a
+        assert msg_b["data"]["graph_exec_id"] == exec_b
+        # No cross-talk: each socket got exactly one message.
+        assert len(sent_a) == 1 and len(sent_b) == 1
+    finally:
+        await cm.disconnect_socket(ws_a, user_id=user_id)
+        await cm.disconnect_socket(ws_b, user_id=user_id)
+        redis_client.disconnect()
+
+
+@pytest.mark.asyncio
+async def test_aggregate_channel_receives_per_exec_publishes(monkeypatch) -> None:
+    """A subscriber on the ``graph_execs`` aggregate channel must receive the
+    GraphExecutionEvent published to the ``/all`` channel — even though
+    per-exec events go to a different channel."""
+    user_id = "user-conn-int-2"
+    graph_id = f"graph-{uuid4().hex[:8]}"
+    exec_id = f"exec-{uuid4().hex[:8]}"
+
+    async def _fake_meta(_uid, gex_id):
+        return _meta(user_id, graph_id, gex_id)
+
+    monkeypatch.setattr("backend.api.conn_manager.get_graph_execution_meta", _fake_meta)
+
+    cm = ConnectionManager()
+    ws_agg: AsyncMock = AsyncMock(spec=WebSocket)
+    ws_per: AsyncMock = AsyncMock(spec=WebSocket)
+    sent_agg: list[str] = []
+    sent_per: list[str] = []
+    ws_agg.send_text = AsyncMock(side_effect=lambda m: sent_agg.append(m))
+    ws_per.send_text = AsyncMock(side_effect=lambda m: sent_per.append(m))
+
+    redis_client.get_redis.cache_clear()
+    cluster = redis_client.get_redis()
+
+    try:
+        await cm.subscribe_graph_execs(
+            user_id=user_id, graph_id=graph_id, websocket=ws_agg
+        )
+        await cm.subscribe_graph_exec(
+            user_id=user_id, graph_exec_id=exec_id, websocket=ws_per
+        )
+        await asyncio.sleep(0.2)
+
+        # The eventbus publishes the same event to both channels — replicate.
+        chan_per = event_bus_channel(exec_channel(user_id, graph_id, exec_id))
+        chan_all = event_bus_channel(graph_all_channel(user_id, graph_id))
+        payload = _graph_event_payload(
+            user_id=user_id,
+            graph_id=graph_id,
+            graph_exec_id=exec_id,
+            marker="agg",
+        ).decode()
+        cluster.spublish(chan_per, payload)
+        cluster.spublish(chan_all, payload)
+
+        delivered = await _wait_until(lambda: sent_agg and sent_per, timeout=5.0)
+        assert delivered, f"sent_agg={sent_agg!r} sent_per={sent_per!r}"
+        agg_msg = json.loads(sent_agg[0])
+        per_msg = json.loads(sent_per[0])
+        # Aggregate subscriber's channel key is the per-graph executions key.
+        assert agg_msg["channel"] == _graph_execs_channel_key(
+            user_id, graph_id=graph_id
+        )
+        assert per_msg["channel"] == graph_exec_channel_key(
+            user_id, graph_exec_id=exec_id
+        )
+        assert agg_msg["method"] == WSMethod.GRAPH_EXECUTION_EVENT.value
+    finally:
+        await cm.disconnect_socket(ws_agg, user_id=user_id)
+        await cm.disconnect_socket(ws_per, user_id=user_id)
+        redis_client.disconnect()
+
+
+@pytest.mark.asyncio
+async def test_disconnect_unsubscribes_and_drops_future_publishes(monkeypatch) -> None:
+    """After ``disconnect_socket`` runs, a subsequent SPUBLISH must NOT reach
+    the dead websocket — exercises the SUNSUBSCRIBE + bookkeeping cleanup."""
+    user_id = "user-conn-int-3"
+    graph_id = f"graph-{uuid4().hex[:8]}"
+    exec_id = f"exec-{uuid4().hex[:8]}"
+
+    async def _fake_meta(_uid, gex_id):
+        return _meta(user_id, graph_id, gex_id)
+
+    monkeypatch.setattr("backend.api.conn_manager.get_graph_execution_meta", _fake_meta)
+
+    cm = ConnectionManager()
+    ws: AsyncMock = AsyncMock(spec=WebSocket)
+    sent: list[str] = []
+    ws.send_text = AsyncMock(side_effect=lambda m: sent.append(m))
+
+    redis_client.get_redis.cache_clear()
+    cluster = redis_client.get_redis()
+    chan = event_bus_channel(exec_channel(user_id, graph_id, exec_id))
+    payload = _node_event_payload(
+        user_id=user_id, graph_id=graph_id, graph_exec_id=exec_id, marker="live"
+    ).decode()
+
+    try:
+        await cm.subscribe_graph_exec(
+            user_id=user_id, graph_exec_id=exec_id, websocket=ws
+        )
+        await asyncio.sleep(0.15)
+
+        # First publish — must reach the socket.
+        cluster.spublish(chan, payload)
+        delivered = await _wait_until(lambda: bool(sent), timeout=5.0)
+        assert delivered
+        assert len(sent) == 1
+
+        # Disconnect → SUNSUBSCRIBE + bookkeeping cleared.
+        await cm.disconnect_socket(ws, user_id=user_id)
+        # Pump cancellation may drain in-flight messages; wait for it.
+        await asyncio.sleep(0.2)
+
+        # Channel bookkeeping must be gone.
+        assert (
+            graph_exec_channel_key(user_id, graph_exec_id=exec_id)
+            not in cm.subscriptions
+        )
+        assert ws not in cm._ws_subs
+
+        # Second publish — must NOT reach the (already-disconnected) socket.
+        cluster.spublish(
+            chan,
+            _node_event_payload(
+                user_id=user_id,
+                graph_id=graph_id,
+                graph_exec_id=exec_id,
+                marker="post-disconnect",
+            ).decode(),
+        )
+        await asyncio.sleep(0.5)
+        # Still only the one pre-disconnect message.
+        assert len(sent) == 1
+    finally:
+        redis_client.disconnect()
+
+
+@pytest.mark.asyncio
+async def test_slow_consumer_receives_all_events_without_loss(monkeypatch) -> None:
+    """Burst-publish many SPUBLISHes; assert every one reaches the subscriber
+    in order — guards against drops/reorderings in the pubsub pump."""
+    user_id = "user-conn-int-4"
+    graph_id = f"graph-{uuid4().hex[:8]}"
+    exec_id = f"exec-{uuid4().hex[:8]}"
+    n_events = 100
+
+    async def _fake_meta(_uid, gex_id):
+        return _meta(user_id, graph_id, gex_id)
+
+    monkeypatch.setattr("backend.api.conn_manager.get_graph_execution_meta", _fake_meta)
+
+    cm = ConnectionManager()
+    ws: AsyncMock = AsyncMock(spec=WebSocket)
+    sent: list[str] = []
+    ws.send_text = AsyncMock(side_effect=lambda m: sent.append(m))
+
+    redis_client.get_redis.cache_clear()
+    cluster = redis_client.get_redis()
+    chan = event_bus_channel(exec_channel(user_id, graph_id, exec_id))
+
+    try:
+        await cm.subscribe_graph_exec(
+            user_id=user_id, graph_exec_id=exec_id, websocket=ws
+        )
+        await asyncio.sleep(0.2)
+
+        # Burst-publish n_events without yielding to the pump.
+        for i in range(n_events):
+            cluster.spublish(
+                chan,
+                _node_event_payload(
+                    user_id=user_id,
+                    graph_id=graph_id,
+                    graph_exec_id=exec_id,
+                    marker=f"m{i}",
+                ).decode(),
+            )
+
+        delivered = await _wait_until(
+            lambda: len(sent) >= n_events, timeout=15.0, interval=0.1
+        )
+        assert delivered, f"only delivered {len(sent)}/{n_events}"
+
+        # Validate ordering — Redis pub/sub is FIFO per channel.
+        markers = [json.loads(m)["data"]["input_data"]["in"] for m in sent[:n_events]]
+        assert markers == [f"m{i}" for i in range(n_events)]
+    finally:
+        await cm.disconnect_socket(ws, user_id=user_id)
+        redis_client.disconnect()

autogpt_platform/backend/backend/api/features/admin/rate_limit_admin_routes_test.py

@@ -57,7 +57,7 @@ def _patch_rate_limit_deps(
     mocker.patch(
         f"{_MOCK_MODULE}.get_global_rate_limits",
         new_callable=AsyncMock,
-        return_value=(2_500_000, 12_500_000, SubscriptionTier.FREE),
+        return_value=(2_500_000, 12_500_000, SubscriptionTier.BASIC),
     )
     mocker.patch(
         f"{_MOCK_MODULE}.get_usage_status",
@@ -89,7 +89,7 @@ def test_get_rate_limit(
     assert data["weekly_cost_limit_microdollars"] == 12_500_000
     assert data["daily_cost_used_microdollars"] == 500_000
     assert data["weekly_cost_used_microdollars"] == 3_000_000
-    assert data["tier"] == "FREE"
+    assert data["tier"] == "BASIC"
 
     configured_snapshot.assert_match(
         json.dumps(data, indent=2, sort_keys=True) + "\n",
@@ -163,7 +163,7 @@ def test_reset_user_usage_daily_only(
     assert data["daily_cost_used_microdollars"] == 0
     # Weekly is untouched
     assert data["weekly_cost_used_microdollars"] == 3_000_000
-    assert data["tier"] == "FREE"
+    assert data["tier"] == "BASIC"
 
     mock_reset.assert_awaited_once_with(target_user_id, reset_weekly=False)
 
@@ -194,7 +194,7 @@ def test_reset_user_usage_daily_and_weekly(
     data = response.json()
     assert data["daily_cost_used_microdollars"] == 0
     assert data["weekly_cost_used_microdollars"] == 0
-    assert data["tier"] == "FREE"
+    assert data["tier"] == "BASIC"
 
     mock_reset.assert_awaited_once_with(target_user_id, reset_weekly=True)
 
@@ -231,7 +231,7 @@ def test_get_rate_limit_email_lookup_failure(
     mocker.patch(
         f"{_MOCK_MODULE}.get_global_rate_limits",
         new_callable=AsyncMock,
-        return_value=(2_500_000, 12_500_000, SubscriptionTier.FREE),
+        return_value=(2_500_000, 12_500_000, SubscriptionTier.BASIC),
     )
     mocker.patch(
         f"{_MOCK_MODULE}.get_usage_status",
@@ -324,7 +324,7 @@ def test_set_user_tier(
     mocker.patch(
         f"{_MOCK_MODULE}.get_user_tier",
         new_callable=AsyncMock,
-        return_value=SubscriptionTier.FREE,
+        return_value=SubscriptionTier.BASIC,
     )
     mock_set = mocker.patch(
         f"{_MOCK_MODULE}.set_user_tier",
@@ -347,7 +347,7 @@ def test_set_user_tier_downgrade(
     mocker: pytest_mock.MockerFixture,
     target_user_id: str,
 ) -> None:
-    """Test downgrading a user's tier from PRO to FREE."""
+    """Test downgrading a user's tier from PRO to BASIC."""
     mocker.patch(
         f"{_MOCK_MODULE}.get_user_email_by_id",
         new_callable=AsyncMock,
@@ -365,14 +365,14 @@ def test_set_user_tier_downgrade(
 
     response = client.post(
         "/admin/rate_limit/tier",
-        json={"user_id": target_user_id, "tier": "FREE"},
+        json={"user_id": target_user_id, "tier": "BASIC"},
     )
 
     assert response.status_code == 200
     data = response.json()
     assert data["user_id"] == target_user_id
-    assert data["tier"] == "FREE"
-    mock_set.assert_awaited_once_with(target_user_id, SubscriptionTier.FREE)
+    assert data["tier"] == "BASIC"
+    mock_set.assert_awaited_once_with(target_user_id, SubscriptionTier.BASIC)
 
 
 def test_set_user_tier_invalid_tier(
@@ -456,7 +456,7 @@ def test_set_user_tier_db_failure(
     mocker.patch(
         f"{_MOCK_MODULE}.get_user_tier",
         new_callable=AsyncMock,
-        return_value=SubscriptionTier.FREE,
+        return_value=SubscriptionTier.BASIC,
     )
     mocker.patch(
         f"{_MOCK_MODULE}.set_user_tier",

autogpt_platform/backend/backend/api/features/chat/routes.py

@@ -8,7 +8,7 @@ from uuid import uuid4
 
 from autogpt_libs import auth
 from fastapi import APIRouter, HTTPException, Query, Response, Security
-from fastapi.responses import JSONResponse, StreamingResponse
+from fastapi.responses import StreamingResponse
 from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 from backend.copilot import service as chat_service
@@ -47,7 +47,14 @@ from backend.copilot.rate_limit import (
     release_reset_lock,
     reset_daily_usage,
 )
-from backend.copilot.response_model import StreamError, StreamFinish, StreamHeartbeat
+from backend.copilot.response_model import (
+    StreamError,
+    StreamFinish,
+    StreamFinishStep,
+    StreamHeartbeat,
+    StreamStart,
+    StreamStartStep,
+)
 from backend.copilot.service import strip_injected_context_for_display
 from backend.copilot.tools.e2b_sandbox import kill_sandbox
 from backend.copilot.tools.models import (
@@ -75,6 +82,7 @@ from backend.copilot.tools.models import (
     NoResultsResponse,
     SetupRequirementsResponse,
     SuggestedGoalResponse,
+    TodoWriteResponse,
     UnderstandingUpdatedResponse,
 )
 from backend.copilot.tracking import track_user_message
@@ -153,6 +161,14 @@ class StreamChatRequest(BaseModel):
     )
 
 
+class QueuePendingMessageRequest(BaseModel):
+    """Request model for queueing a follow-up while a turn is running."""
+
+    message: str = Field(max_length=64_000)
+    context: dict[str, str] | None = None
+    file_ids: list[str] | None = Field(default=None, max_length=20)
+
+
 class PeekPendingMessagesResponse(BaseModel):
     """Response for the pending-message peek (GET) endpoint.
 
@@ -208,6 +224,11 @@ class ActiveStreamInfo(BaseModel):
 
     turn_id: str
     last_message_id: str  # Redis Stream message ID for resumption
+    # ISO-8601 timestamp (UTC) marking when the backend registered the turn
+    # as running. Lets the frontend seed its elapsed-time counter so restored
+    # turns show honest "time since turn started" instead of the misleading
+    # "time since this mount resumed the SSE".
+    started_at: str | None = None
 
 
 class SessionDetailResponse(BaseModel):
@@ -299,8 +320,11 @@ async def list_sessions(
             redis = await get_redis_async()
             pipe = redis.pipeline(transaction=False)
             for session in sessions:
+                # Use the canonical helper so the hash-tag braces match every
+                # other writer; building the key inline drops the braces and
+                # silently misses every running session on cluster mode.
                 pipe.hget(
-                    f"{config.session_meta_prefix}{session.session_id}",
+                    stream_registry.get_session_meta_key(session.session_id),
                     "status",
                 )
             statuses = await pipe.execute()
@@ -528,6 +552,7 @@ async def get_session(
             active_stream_info = ActiveStreamInfo(
                 turn_id=active_session.turn_id,
                 last_message_id=last_message_id,
+                started_at=active_session.created_at.isoformat(),
             )
 
     # Skip session metadata on "load more" — frontend only needs messages
@@ -815,17 +840,45 @@ async def cancel_session_task(
     return CancelSessionResponse(cancelled=True)
 
 
+def _ui_message_stream_headers() -> dict[str, str]:
+    return {
+        "Cache-Control": "no-cache",
+        "Connection": "keep-alive",
+        "X-Accel-Buffering": "no",
+        "x-vercel-ai-ui-message-stream": "v1",
+    }
+
+
+def _empty_ui_message_stream_response() -> StreamingResponse:
+    # Stable placeholder messageId for the empty queued-mid-turn stream.
+    # Real turns generate per-message UUIDs via the executor; this stream
+    # has no message to attach to, but the AI SDK parser still requires a
+    # non-empty ``messageId`` field on ``StreamStart``.
+    message_id = uuid4().hex
+
+    async def event_generator() -> AsyncGenerator[str, None]:
+        # Vercel AI SDK's UI-message-stream parser expects symmetric
+        # start/finish framing at both stream and step level — every
+        # non-empty turn emits the pair.  Without an opener, today's parser
+        # tolerates the closer (no active parts to flush) but a future SDK
+        # tightening would silently break the queue-mid-turn UX.  Emit the
+        # full empty pair so the contract stays correct.
+        yield StreamStart(messageId=message_id).to_sse()
+        yield StreamStartStep().to_sse()
+        yield StreamFinishStep().to_sse()
+        yield StreamFinish().to_sse()
+        yield "data: [DONE]\n\n"
+
+    return StreamingResponse(
+        event_generator(),
+        media_type="text/event-stream",
+        headers=_ui_message_stream_headers(),
+    )
+
+
 @router.post(
     "/sessions/{session_id}/stream",
     responses={
-        202: {
-            "model": QueuePendingMessageResponse,
-            "description": (
-                "Session has a turn in flight — message queued into the pending "
-                "buffer and will be picked up between tool-call rounds by the "
-                "executor currently processing the turn."
-            ),
-        },
         404: {"description": "Session not found or access denied"},
         429: {"description": "Cost rate-limit or call-frequency cap exceeded"},
     },
@@ -835,19 +888,18 @@ async def stream_chat_post(
     request: StreamChatRequest,
     user_id: str = Security(auth.get_user_id),
 ):
-    """Start a new turn OR queue a follow-up — decided server-side.
+    """Start a new turn and return an AI SDK UI message stream.
 
-    - **Session idle**: starts a turn.  Returns an SSE stream (``text/event-stream``)
-      with Vercel AI SDK chunks (text fragments, tool-call UI, tool results).
-      The generation runs in a background task that survives client disconnects;
-      reconnect via ``GET /sessions/{session_id}/stream`` to resume.
+    Returns an SSE stream (``text/event-stream``) with Vercel AI SDK chunks
+    (text fragments, tool-call UI, tool results). The generation runs in a
+    background task that survives client disconnects; reconnect via
+    ``GET /sessions/{session_id}/stream`` to resume.
 
-    - **Session has a turn in flight**: pushes the message into the per-session
-      pending buffer and returns ``202 application/json`` with
-      ``QueuePendingMessageResponse``.  The executor running the current turn
-      drains the buffer between tool-call rounds (baseline) or at the start of
-      the next turn (SDK).  Clients should detect the 202 and surface the
-      message as a queued-chip in the UI.
+    Follow-up messages typed while a turn is already running should use
+    ``POST /sessions/{session_id}/messages/pending``. If an older client still
+    posts that follow-up here, we queue it defensively but still return a valid
+    empty UI-message stream so AI SDK transports never receive a JSON body from
+    the stream endpoint.
 
     Args:
         session_id: The chat session identifier.
@@ -871,26 +923,29 @@ async def stream_chat_post(
         extra={"json_fields": log_meta},
     )
     session = await _validate_and_get_session(session_id, user_id)
-    builder_permissions = resolve_session_permissions(session)
 
-    # Self-defensive queue-fallback: if a turn is already running, don't race
-    # it on the cluster lock — drop the message into the pending buffer and
-    # return 202 so the caller can render a chip.  Both UI chips and autopilot
-    # block follow-ups route through this path; keeping the decision on the
-    # server means every caller gets uniform behaviour.
     if (
         request.is_user_message
         and request.message
         and await is_turn_in_flight(session_id)
     ):
-        response = await queue_pending_for_http(
-            session_id=session_id,
-            user_id=user_id,
-            message=request.message,
-            context=request.context,
-            file_ids=request.file_ids,
-        )
-        return JSONResponse(status_code=202, content=response.model_dump())
+        try:
+            await queue_pending_for_http(
+                session_id=session_id,
+                user_id=user_id,
+                message=request.message,
+                context=request.context,
+                file_ids=request.file_ids,
+            )
+            return _empty_ui_message_stream_response()
+        except HTTPException as exc:
+            if exc.status_code != 409:
+                raise
+
+    # Permission resolution is only needed below for the actual turn — keep
+    # it after the queue-fall-through so a queued mid-turn request returns
+    # without paying the work.
+    builder_permissions = resolve_session_permissions(session)
 
     logger.info(
         f"[TIMING] session validated in {(time.perf_counter() - stream_start_time) * 1000:.1f}ms",
@@ -1129,12 +1184,37 @@ async def stream_chat_post(
     return StreamingResponse(
         event_generator(),
         media_type="text/event-stream",
-        headers={
-            "Cache-Control": "no-cache",
-            "Connection": "keep-alive",
-            "X-Accel-Buffering": "no",  # Disable nginx buffering
-            "x-vercel-ai-ui-message-stream": "v1",  # AI SDK protocol header
-        },
+        headers=_ui_message_stream_headers(),
+    )
+
+
+@router.post(
+    "/sessions/{session_id}/messages/pending",
+    response_model=QueuePendingMessageResponse,
+    responses={
+        404: {"description": "Session not found or access denied"},
+        409: {"description": "Session has no active turn to receive pending messages"},
+        429: {"description": "Call-frequency cap exceeded"},
+    },
+)
+async def queue_pending_message(
+    session_id: str,
+    request: QueuePendingMessageRequest,
+    user_id: str = Security(auth.get_user_id),
+):
+    """Queue a follow-up message while the session has an active turn."""
+    await _validate_and_get_session(session_id, user_id)
+    if not await is_turn_in_flight(session_id):
+        raise HTTPException(
+            status_code=409,
+            detail="Session has no active turn. Start a new turn with POST /stream.",
+        )
+    return await queue_pending_for_http(
+        session_id=session_id,
+        user_id=user_id,
+        message=request.message,
+        context=request.context,
+        file_ids=request.file_ids,
     )
 
 
@@ -1168,6 +1248,7 @@ async def get_pending_messages(
 )
 async def resume_session_stream(
     session_id: str,
+    last_chunk_id: str | None = Query(default=None, include_in_schema=False),
     user_id: str = Security(auth.get_user_id),
 ):
     """
@@ -1177,27 +1258,26 @@ async def resume_session_stream(
     Checks for an active (in-progress) task on the session and either replays
     the full SSE stream or returns 204 No Content if nothing is running.
 
-    Args:
-        session_id: The chat session identifier.
-        user_id: Optional authenticated user ID.
-
-    Returns:
-        StreamingResponse (SSE) when an active stream exists,
-        or 204 No Content when there is nothing to resume.
+    Always replays the active turn from ``0-0``. The AI SDK UI-message parser
+    keeps text/reasoning part state inside a single parser instance; resuming
+    from a Redis cursor can skip the ``*-start`` events required by later
+    ``*-delta`` chunks.
     """
     import asyncio
 
-    active_session, last_message_id = await stream_registry.get_active_session(
+    active_session, _latest_backend_id = await stream_registry.get_active_session(
         session_id, user_id
     )
 
     if not active_session:
         return Response(status_code=204)
 
-    # Always replay from the beginning ("0-0") on resume.
-    # We can't use last_message_id because it's the latest ID in the backend
-    # stream, not the latest the frontend received — the gap causes lost
-    # messages. The frontend deduplicates replayed content.
+    if last_chunk_id:
+        logger.info(
+            "Ignoring deprecated last_chunk_id on stream resume",
+            extra={"session_id": session_id, "last_chunk_id": last_chunk_id},
+        )
+
     subscriber_queue = await stream_registry.subscribe_to_session(
         session_id=session_id,
         user_id=user_id,
@@ -1258,12 +1338,7 @@ async def resume_session_stream(
     return StreamingResponse(
         event_generator(),
         media_type="text/event-stream",
-        headers={
-            "Cache-Control": "no-cache",
-            "Connection": "keep-alive",
-            "X-Accel-Buffering": "no",
-            "x-vercel-ai-ui-message-stream": "v1",
-        },
+        headers=_ui_message_stream_headers(),
     )
 
 
@@ -1419,6 +1494,7 @@ ToolResponseUnion = (
     | MemorySearchResponse
     | MemoryForgetCandidatesResponse
     | MemoryForgetConfirmResponse
+    | TodoWriteResponse
 )
 
 

autogpt_platform/backend/backend/api/features/chat/routes_test.py

@@ -157,6 +157,11 @@ def _mock_stream_internals(mocker: pytest_mock.MockerFixture):
         "backend.api.features.chat.routes._validate_and_get_session",
         return_value=None,
     )
+    mocker.patch(
+        "backend.api.features.chat.routes.is_turn_in_flight",
+        new_callable=AsyncMock,
+        return_value=False,
+    )
     mock_save = mocker.patch(
         "backend.api.features.chat.routes.append_and_save_message",
         return_value=MagicMock(),  # non-None = message was saved (not a duplicate)
@@ -380,7 +385,7 @@ def _mock_usage(
     weekly_used: int = 2000,
     daily_limit: int = 10000,
     weekly_limit: int = 50000,
-    tier: "SubscriptionTier" = SubscriptionTier.FREE,
+    tier: "SubscriptionTier" = SubscriptionTier.BASIC,
 ) -> AsyncMock:
     """Mock get_usage_status and get_global_rate_limits for usage endpoint tests.
 
@@ -440,7 +445,7 @@ def test_usage_returns_daily_and_weekly(
         daily_cost_limit=10000,
         weekly_cost_limit=50000,
         rate_limit_reset_cost=chat_routes.config.rate_limit_reset_cost,
-        tier=SubscriptionTier.FREE,
+        tier=SubscriptionTier.BASIC,
     )
 
 
@@ -461,7 +466,7 @@ def test_usage_uses_config_limits(
         daily_cost_limit=99999,
         weekly_cost_limit=77777,
         rate_limit_reset_cost=500,
-        tier=SubscriptionTier.FREE,
+        tier=SubscriptionTier.BASIC,
     )
 
 
@@ -637,7 +642,7 @@ class TestStreamChatRequestModeValidation:
         assert req.mode is None
 
 
-# ─── POST /stream queue-fallback (when a turn is already in flight) ──
+# ─── Pending message queue (when a turn is already in flight) ─────────
 
 
 def _mock_stream_queue_internals(
@@ -646,11 +651,9 @@ def _mock_stream_queue_internals(
     session_exists: bool = True,
     turn_in_flight: bool = True,
     call_count: int = 1,
+    push_length: int | None = 1,
 ):
-    """Mock dependencies for the POST /stream queue-fallback path.
-
-    When ``turn_in_flight`` is True the handler takes the 202 queue branch.
-    """
+    """Mock dependencies for the pending-message queue path."""
     if session_exists:
         mock_session = mocker.MagicMock()
         mock_session.id = "sess-1"
@@ -692,12 +695,10 @@ def _mock_stream_queue_internals(
         return_value=call_count,
     )
     mocker.patch(
-        "backend.copilot.pending_message_helpers.push_pending_message",
+        "backend.copilot.pending_message_helpers.push_pending_message_if_session_running",
         new_callable=AsyncMock,
-        return_value=1,
+        return_value=push_length,
     )
-    # queue_user_message re-runs is_turn_in_flight via the helper module —
-    # stub that path out too so we don't need a fake stream_registry.
     mocker.patch(
         "backend.copilot.pending_message_helpers.get_active_session_meta",
         new_callable=AsyncMock,
@@ -705,37 +706,65 @@ def _mock_stream_queue_internals(
     )
 
 
-def test_stream_queue_returns_202_when_turn_in_flight(
+def test_queue_pending_message_returns_200_when_turn_in_flight(
     mocker: pytest_mock.MockerFixture,
 ) -> None:
-    """Happy path: POST /stream to a session with a live turn → 202 queue."""
+    """Happy path: POST /messages/pending to a live turn queues the message."""
     _mock_stream_queue_internals(mocker)
 
     response = client.post(
-        "/sessions/sess-1/stream",
-        json={"message": "follow-up", "is_user_message": True},
+        "/sessions/sess-1/messages/pending",
+        json={"message": "follow-up"},
     )
 
-    assert response.status_code == 202
+    assert response.status_code == 200
     data = response.json()
     assert data["buffer_length"] == 1
     assert "turn_in_flight" in data
 
 
-def test_stream_queue_session_not_found_returns_404(
+def test_queue_pending_message_session_not_found_returns_404(
     mocker: pytest_mock.MockerFixture,
 ) -> None:
     """If the session doesn't exist or belong to the user, returns 404."""
     _mock_stream_queue_internals(mocker, session_exists=False)
 
     response = client.post(
-        "/sessions/bad-sess/stream",
-        json={"message": "hi", "is_user_message": True},
+        "/sessions/bad-sess/messages/pending",
+        json={"message": "hi"},
     )
     assert response.status_code == 404
 
 
-def test_stream_queue_call_frequency_limit_returns_429(
+def test_queue_pending_message_without_active_turn_returns_409(
+    mocker: pytest_mock.MockerFixture,
+) -> None:
+    """A pending-message push needs an active turn to consume it."""
+    _mock_stream_queue_internals(mocker, turn_in_flight=False)
+
+    response = client.post(
+        "/sessions/sess-1/messages/pending",
+        json={"message": "hi"},
+    )
+
+    assert response.status_code == 409
+
+
+def test_queue_pending_message_race_after_active_check_returns_409(
+    mocker: pytest_mock.MockerFixture,
+) -> None:
+    """If the active turn ends before the atomic push, the message is not queued."""
+    _mock_stream_queue_internals(mocker, push_length=None)
+
+    response = client.post(
+        "/sessions/sess-1/messages/pending",
+        json={"message": "hi"},
+    )
+
+    assert response.status_code == 409
+
+
+def test_queue_pending_message_call_frequency_limit_returns_429(
     mocker: pytest_mock.MockerFixture,
 ) -> None:
     """Per-user call-frequency cap rejects rapid-fire queued pushes."""
@@ -744,14 +773,14 @@ def test_stream_queue_call_frequency_limit_returns_429(
     _mock_stream_queue_internals(mocker, call_count=PENDING_CALL_LIMIT + 1)
 
     response = client.post(
-        "/sessions/sess-1/stream",
-        json={"message": "hi", "is_user_message": True},
+        "/sessions/sess-1/messages/pending",
+        json={"message": "hi"},
     )
     assert response.status_code == 429
     assert "Too many queued message requests this minute" in response.json()["detail"]
 
 
-def test_stream_queue_converts_context_dict_to_pending_context(
+def test_queue_pending_message_converts_context_dict_to_pending_context(
     mocker: pytest_mock.MockerFixture,
 ) -> None:
     """StreamChatRequest.context is a raw dict; must be coerced to the
@@ -768,15 +797,14 @@ def test_stream_queue_converts_context_dict_to_pending_context(
     )
 
     response = client.post(
-        "/sessions/sess-1/stream",
+        "/sessions/sess-1/messages/pending",
         json={
             "message": "hi",
-            "is_user_message": True,
             "context": {"url": "https://example.test", "content": "body"},
         },
     )
 
-    assert response.status_code == 202
+    assert response.status_code == 200
     queue_spy.assert_awaited_once()
     kwargs = queue_spy.await_args.kwargs
     from backend.copilot.pending_messages import PendingMessageContext
@@ -786,7 +814,7 @@ def test_stream_queue_converts_context_dict_to_pending_context(
     assert kwargs["context"].content == "body"
 
 
-def test_stream_queue_passes_none_context_when_omitted(
+def test_queue_pending_message_passes_none_context_when_omitted(
     mocker: pytest_mock.MockerFixture,
 ) -> None:
     """When request.context is omitted, the queue call receives context=None."""
@@ -802,15 +830,31 @@ def test_stream_queue_passes_none_context_when_omitted(
     )
 
     response = client.post(
-        "/sessions/sess-1/stream",
-        json={"message": "hi", "is_user_message": True},
+        "/sessions/sess-1/messages/pending",
+        json={"message": "hi"},
     )
 
-    assert response.status_code == 202
+    assert response.status_code == 200
     queue_spy.assert_awaited_once()
     assert queue_spy.await_args.kwargs["context"] is None
 
 
+def test_stream_chat_queues_legacy_inflight_post_but_returns_sse(
+    mocker: pytest_mock.MockerFixture,
+) -> None:
+    """POST /stream must not return JSON to an AI SDK transport."""
+    _mock_stream_queue_internals(mocker)
+
+    response = client.post(
+        "/sessions/sess-1/stream",
+        json={"message": "follow-up", "is_user_message": True},
+    )
+
+    assert response.status_code == 200
+    assert response.headers["content-type"].startswith("text/event-stream")
+    assert '"type":"finish"' in response.text
+
+
 # ─── get_pending_messages (GET /sessions/{session_id}/messages/pending) ─────
 
 
@@ -996,7 +1040,7 @@ def test_stream_chat_accepts_exactly_max_length_message(
     mocker.patch(
         "backend.api.features.chat.routes.get_global_rate_limits",
         new_callable=AsyncMock,
-        return_value=(0, 0, SubscriptionTier.FREE),
+        return_value=(0, 0, SubscriptionTier.BASIC),
     )
 
     response = client.post(
@@ -1267,7 +1311,7 @@ def _mock_reset_internals(
     enable_credit: bool = True,
     daily_limit: int = 10_000,
     weekly_limit: int = 50_000,
-    tier: "SubscriptionTier" = SubscriptionTier.FREE,
+    tier: "SubscriptionTier" = SubscriptionTier.BASIC,
     daily_used: int = 10_001,
     weekly_used: int = 1_000,
     reset_count: int | None = 0,
@@ -1366,7 +1410,7 @@ def test_reset_usage_returns_400_when_no_daily_limit(
     mocker.patch(
         "backend.api.features.chat.routes.get_global_rate_limits",
         new_callable=AsyncMock,
-        return_value=(0, 50_000, SubscriptionTier.FREE),
+        return_value=(0, 50_000, SubscriptionTier.BASIC),
     )
     mocker.patch(
         "backend.api.features.chat.routes.get_daily_reset_count",
@@ -1389,7 +1433,7 @@ def test_reset_usage_returns_503_when_redis_unavailable(
     mocker.patch(
         "backend.api.features.chat.routes.get_global_rate_limits",
         new_callable=AsyncMock,
-        return_value=(10_000, 50_000, SubscriptionTier.FREE),
+        return_value=(10_000, 50_000, SubscriptionTier.BASIC),
     )
     mocker.patch(
         "backend.api.features.chat.routes.get_daily_reset_count",
@@ -1412,7 +1456,7 @@ def test_reset_usage_returns_429_when_max_resets_reached(
     mocker.patch(
         "backend.api.features.chat.routes.get_global_rate_limits",
         new_callable=AsyncMock,
-        return_value=(10_000, 50_000, SubscriptionTier.FREE),
+        return_value=(10_000, 50_000, SubscriptionTier.BASIC),
     )
     mocker.patch(
         "backend.api.features.chat.routes.get_daily_reset_count",
@@ -1436,7 +1480,7 @@ def test_reset_usage_returns_429_when_lock_not_acquired(
     mocker.patch(
         "backend.api.features.chat.routes.get_global_rate_limits",
         new_callable=AsyncMock,
-        return_value=(10_000, 50_000, SubscriptionTier.FREE),
+        return_value=(10_000, 50_000, SubscriptionTier.BASIC),
     )
     mocker.patch(
         "backend.api.features.chat.routes.get_daily_reset_count",
@@ -1581,9 +1625,14 @@ def test_resume_session_stream_no_subscriber_queue(
     mock_registry.subscribe_to_session = AsyncMock(return_value=None)
     mocker.patch("backend.api.features.chat.routes.stream_registry", mock_registry)
 
-    response = client.get("/sessions/sess-1/stream")
+    response = client.get("/sessions/sess-1/stream?last_chunk_id=9999-9")
 
     assert response.status_code == 204
+    mock_registry.subscribe_to_session.assert_awaited_once_with(
+        session_id="sess-1",
+        user_id=TEST_USER_ID,
+        last_message_id="0-0",
+    )
 
 
 # ─── DELETE /sessions/{id}/stream — disconnect listeners ──────────────

autogpt_platform/backend/backend/api/features/integrations/models.py

@@ -7,6 +7,7 @@ allowing frontend code generators like Orval to create corresponding TypeScript
 
 from pydantic import BaseModel, Field
 
+from backend.data.model import CredentialsType
 from backend.integrations.providers import ProviderName
 from backend.sdk.registry import AutoRegistry
 
@@ -47,6 +48,57 @@ class ProviderNamesResponse(BaseModel):
     )
 
 
+class ProviderMetadata(BaseModel):
+    """Display metadata for a provider, shown in the settings integrations UI."""
+
+    name: str = Field(description="Provider slug (e.g. ``github``)")
+    description: str | None = Field(
+        default=None,
+        description=(
+            "One-line human-readable summary of what the provider does. "
+            "Declared via ``ProviderBuilder.with_description(...)`` in the "
+            "provider's ``_config.py``. ``None`` if not set."
+        ),
+    )
+    supported_auth_types: list[CredentialsType] = Field(
+        default_factory=list,
+        description=(
+            "Credential types this provider accepts. Drives which connection "
+            "tabs the settings UI renders for the provider. Empty list means "
+            "no auth types declared."
+        ),
+    )
+
+
+def get_supported_auth_types(name: str) -> list[CredentialsType]:
+    """Return the provider's supported credential types from :class:`AutoRegistry`.
+
+    Populated by :meth:`ProviderBuilder.with_supported_auth_types` (or by
+    ``with_oauth`` / ``with_api_key`` / ``with_user_password`` when the provider
+    uses the full builder chain). Returns an empty list for providers with no
+    auth types declared.
+    """
+    provider = AutoRegistry.get_provider(name)
+    if provider is None:
+        return []
+    return sorted(provider.supported_auth_types)
+
+
+def get_provider_description(name: str) -> str | None:
+    """Return the provider's description from :class:`AutoRegistry`.
+
+    Descriptions are declared via ``ProviderBuilder.with_description(...)`` in
+    the provider's ``_config.py`` (SDK path) or in
+    ``blocks/_static_provider_configs.py`` (for providers that don't yet have
+    their own directory). Returns ``None`` for providers with no registered
+    description.
+    """
+    provider = AutoRegistry.get_provider(name)
+    if provider is None:
+        return None
+    return provider.description
+
+
 class ProviderConstants(BaseModel):
     """
     Model that exposes all provider names as a constant in the OpenAPI schema.

autogpt_platform/backend/backend/api/features/integrations/router.py

@@ -14,7 +14,7 @@ from fastapi import (
     Security,
     status,
 )
-from pydantic import BaseModel, Field, SecretStr, model_validator
+from pydantic import BaseModel, Field, model_validator
 from starlette.status import HTTP_500_INTERNAL_SERVER_ERROR, HTTP_502_BAD_GATEWAY
 
 from backend.api.features.library.db import set_preset_webhook, update_preset
@@ -29,15 +29,14 @@ from backend.data.integrations import (
     wait_for_webhook_event,
 )
 from backend.data.model import (
+    APIKeyCredentials,
     Credentials,
     CredentialsType,
     HostScopedCredentials,
     OAuth2Credentials,
-    UserIntegrations,
     is_sdk_default,
 )
 from backend.data.onboarding import OnboardingStep, complete_onboarding_step
-from backend.data.user import get_user_integrations
 from backend.executor.utils import add_graph_execution
 from backend.integrations.ayrshare import AyrshareClient, SocialPlatform
 from backend.integrations.credentials_store import (
@@ -48,7 +47,14 @@ from backend.integrations.creds_manager import (
     IntegrationCredentialsManager,
     create_mcp_oauth_handler,
 )
-from backend.integrations.managed_credentials import ensure_managed_credentials
+from backend.integrations.managed_credentials import (
+    ensure_managed_credential,
+    ensure_managed_credentials,
+)
+from backend.integrations.managed_providers.ayrshare import AyrshareManagedProvider
+from backend.integrations.managed_providers.ayrshare import (
+    settings_available as ayrshare_settings_available,
+)
 from backend.integrations.oauth import CREDENTIALS_BY_PROVIDER, HANDLERS_BY_NAME
 from backend.integrations.providers import ProviderName
 from backend.integrations.webhooks import get_webhook_manager
@@ -60,7 +66,14 @@ from backend.util.exceptions import (
 )
 from backend.util.settings import Settings
 
-from .models import ProviderConstants, ProviderNamesResponse, get_all_provider_names
+from .models import (
+    ProviderConstants,
+    ProviderMetadata,
+    ProviderNamesResponse,
+    get_all_provider_names,
+    get_provider_description,
+    get_supported_auth_types,
+)
 
 if TYPE_CHECKING:
     from backend.integrations.oauth import BaseOAuthHandler
@@ -87,14 +100,23 @@ async def login(
     scopes: Annotated[
         str, Query(title="Comma-separated list of authorization scopes")
     ] = "",
+    credential_id: Annotated[
+        str | None,
+        Query(title="ID of existing credential to upgrade scopes for"),
+    ] = None,
 ) -> LoginResponse:
     handler = _get_provider_oauth_handler(request, provider)
 
     requested_scopes = scopes.split(",") if scopes else []
 
+    if credential_id:
+        requested_scopes = await _prepare_scope_upgrade(
+            user_id, provider, credential_id, requested_scopes
+        )
+
     # Generate and store a secure random state token along with the scopes
     state_token, code_challenge = await creds_manager.store.store_state_token(
-        user_id, provider, requested_scopes
+        user_id, provider, requested_scopes, credential_id=credential_id
     )
     login_url = handler.get_login_url(
         requested_scopes, state_token, code_challenge=code_challenge
@@ -216,7 +238,9 @@ async def callback(
         )
 
     # TODO: Allow specifying `title` to set on `credentials`
-    await creds_manager.create(user_id, credentials)
+    credentials = await _merge_or_create_credential(
+        user_id, provider, credentials, valid_state.credential_id
+    )
 
     logger.debug(
         f"Successfully processed OAuth callback for user {user_id} "
@@ -226,13 +250,38 @@ async def callback(
     return to_meta_response(credentials)
 
 
+# Bound the first-time sweep so a slow upstream (e.g. Ayrshare) can't hang
+# the credential-list endpoint.  On timeout we still kick off a fire-and-
+# forget sweep so provisioning eventually completes; the user just won't
+# see the managed cred until the next refresh.
+_MANAGED_PROVISION_TIMEOUT_S = 10.0
+
+
+async def _ensure_managed_credentials_bounded(user_id: str) -> None:
+    try:
+        await asyncio.wait_for(
+            ensure_managed_credentials(user_id, creds_manager.store),
+            timeout=_MANAGED_PROVISION_TIMEOUT_S,
+        )
+    except asyncio.TimeoutError:
+        logger.warning(
+            "Managed credential sweep exceeded %.1fs for user=%s; "
+            "continuing without it — provisioning will complete in background",
+            _MANAGED_PROVISION_TIMEOUT_S,
+            user_id,
+        )
+        asyncio.create_task(ensure_managed_credentials(user_id, creds_manager.store))
+
+
 @router.get("/credentials", summary="List Credentials")
 async def list_credentials(
     user_id: Annotated[str, Security(get_user_id)],
 ) -> list[CredentialsMetaResponse]:
-    # Fire-and-forget: provision missing managed credentials in the background.
-    # The credential appears on the next page load; listing is never blocked.
-    asyncio.create_task(ensure_managed_credentials(user_id, creds_manager.store))
+    # Block on provisioning so managed credentials appear on the first load
+    # instead of after a refresh, but with a timeout so a slow upstream
+    # can't hang the endpoint.  `_provisioned_users` short-circuits on
+    # repeat calls.
+    await _ensure_managed_credentials_bounded(user_id)
     credentials = await creds_manager.store.get_all_creds(user_id)
 
     return [
@@ -247,7 +296,7 @@ async def list_credentials_by_provider(
     ],
     user_id: Annotated[str, Security(get_user_id)],
 ) -> list[CredentialsMetaResponse]:
-    asyncio.create_task(ensure_managed_credentials(user_id, creds_manager.store))
+    await _ensure_managed_credentials_bounded(user_id)
     credentials = await creds_manager.store.get_creds_by_provider(user_id, provider)
 
     return [
@@ -281,6 +330,115 @@ async def get_credential(
     return to_meta_response(credential)
 
 
+class PickerTokenResponse(BaseModel):
+    """Short-lived OAuth access token shipped to the browser for rendering a
+    provider-hosted picker UI (e.g. Google Drive Picker). Deliberately narrow:
+    only the fields the client needs to initialize the picker widget. Issued
+    from the user's own stored credential so ownership and scope gating are
+    enforced by the credential lookup."""
+
+    access_token: str = Field(
+        description="OAuth access token suitable for the picker SDK call."
+    )
+    access_token_expires_at: int | None = Field(
+        default=None,
+        description="Unix timestamp at which the access token expires, if known.",
+    )
+
+
+# Allowlist of (provider, scopes) tuples that may mint picker tokens. Only
+# Drive-picker-capable scopes qualify so a caller can't use this endpoint to
+# extract a GitHub / other-provider OAuth token for unrelated purposes. If a
+# future provider integrates a hosted picker that needs a raw access token,
+# add its specific picker-relevant scopes here.
+_PICKER_TOKEN_ALLOWED_SCOPES: dict[ProviderName, frozenset[str]] = {
+    ProviderName.GOOGLE: frozenset(
+        [
+            "https://www.googleapis.com/auth/drive.file",
+            "https://www.googleapis.com/auth/drive.readonly",
+            "https://www.googleapis.com/auth/drive",
+        ]
+    ),
+}
+
+
+@router.post(
+    "/{provider}/credentials/{cred_id}/picker-token",
+    summary="Issue a short-lived access token for a provider-hosted picker",
+    operation_id="postV1GetPickerToken",
+)
+async def get_picker_token(
+    provider: Annotated[
+        ProviderName, Path(title="The provider that owns the credentials")
+    ],
+    cred_id: Annotated[
+        str, Path(title="The ID of the OAuth2 credentials to mint a token from")
+    ],
+    user_id: Annotated[str, Security(get_user_id)],
+) -> PickerTokenResponse:
+    """Return the raw access token for an OAuth2 credential so the frontend
+    can initialize a provider-hosted picker (e.g. Google Drive Picker).
+
+    `GET /{provider}/credentials/{cred_id}` deliberately strips secrets (see
+    `CredentialsMetaResponse` + `TestGetCredentialReturnsMetaOnly` in
+    `router_test.py`). That hardening broke the Drive picker, which needs the
+    raw access token to call `google.picker.Builder.setOAuthToken(...)`. This
+    endpoint carves a narrow, explicit hole: the caller must own the
+    credential, it must be OAuth2, and the endpoint returns only the access
+    token + its expiry — nothing else about the credential. SDK-default
+    credentials are excluded for the same reason as `get_credential`.
+    """
+    if is_sdk_default(cred_id):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Credentials not found"
+        )
+
+    credential = await creds_manager.get(user_id, cred_id)
+    if not credential:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Credentials not found"
+        )
+    if not provider_matches(credential.provider, provider):
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND, detail="Credentials not found"
+        )
+    if not isinstance(credential, OAuth2Credentials):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Picker tokens are only available for OAuth2 credentials",
+        )
+    if not credential.access_token:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Credential has no access token; reconnect the account",
+        )
+
+    # Gate on provider+scope: only credentials that actually grant access to
+    # a provider-hosted picker flow may mint a token through this endpoint.
+    # Prevents using this path to extract bearer tokens for unrelated OAuth
+    # integrations (e.g. GitHub) that happen to be stored under the same user.
+    allowed_scopes = _PICKER_TOKEN_ALLOWED_SCOPES.get(provider)
+    if not allowed_scopes:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=(f"Picker tokens are not available for provider '{provider.value}'"),
+        )
+    cred_scopes = set(credential.scopes or [])
+    if cred_scopes.isdisjoint(allowed_scopes):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail=(
+                "Credential does not grant any scope eligible for the picker. "
+                "Reconnect with the appropriate scope."
+            ),
+        )
+
+    return PickerTokenResponse(
+        access_token=credential.access_token.get_secret_value(),
+        access_token_expires_at=credential.access_token_expires_at,
+    )
+
+
 @router.post("/{provider}/credentials", status_code=201, summary="Create Credentials")
 async def create_credentials(
     user_id: Annotated[str, Security(get_user_id)],
@@ -574,6 +732,186 @@ async def _execute_webhook_preset_trigger(
         # Continue processing - webhook should be resilient to individual failures
 
 
+# -------------------- INCREMENTAL AUTH HELPERS -------------------- #
+
+
+async def _prepare_scope_upgrade(
+    user_id: str,
+    provider: ProviderName,
+    credential_id: str,
+    requested_scopes: list[str],
+) -> list[str]:
+    """Validate an existing credential for scope upgrade and compute scopes.
+
+    For providers without native incremental auth (e.g. GitHub), returns the
+    union of existing + requested scopes.  For providers that handle merging
+    server-side (e.g. Google with ``include_granted_scopes``), returns the
+    requested scopes unchanged.
+
+    Raises HTTPException on validation failure.
+    """
+    # Platform-owned system credentials must never be upgraded — scope
+    # changes here would leak across every user that shares them.
+    if is_system_credential(credential_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="System credentials cannot be upgraded",
+        )
+
+    existing = await creds_manager.store.get_creds_by_id(user_id, credential_id)
+    if not existing:
+        raise HTTPException(
+            status_code=status.HTTP_404_NOT_FOUND,
+            detail="Credential to upgrade not found",
+        )
+    if not isinstance(existing, OAuth2Credentials):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Only OAuth2 credentials can be upgraded",
+        )
+    if not provider_matches(existing.provider, provider.value):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Credential provider does not match the requested provider",
+        )
+    if existing.is_managed:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Managed credentials cannot be upgraded",
+        )
+
+    # Google handles scope merging via include_granted_scopes; others need
+    # the union of existing + new scopes in the login URL.
+    if provider != ProviderName.GOOGLE:
+        requested_scopes = list(set(requested_scopes) | set(existing.scopes))
+
+    return requested_scopes
+
+
+async def _merge_or_create_credential(
+    user_id: str,
+    provider: ProviderName,
+    credentials: OAuth2Credentials,
+    credential_id: str | None,
+) -> OAuth2Credentials:
+    """Either upgrade an existing credential or create a new one.
+
+    When *credential_id* is set (explicit upgrade), merges scopes and updates
+    the existing credential.  Otherwise, checks for an implicit merge (same
+    provider + username) before falling back to creating a new credential.
+    """
+    if credential_id:
+        return await _upgrade_existing_credential(user_id, credential_id, credentials)
+
+    # Implicit merge: check for existing credential with same provider+username.
+    # Skip managed/system credentials and require a non-None username on both
+    # sides so we never accidentally merge unrelated credentials.
+    if credentials.username is None:
+        await creds_manager.create(user_id, credentials)
+        return credentials
+
+    existing_creds = await creds_manager.store.get_creds_by_provider(user_id, provider)
+    matching = next(
+        (
+            c
+            for c in existing_creds
+            if isinstance(c, OAuth2Credentials)
+            and not c.is_managed
+            and not is_system_credential(c.id)
+            and c.username is not None
+            and c.username == credentials.username
+        ),
+        None,
+    )
+    if matching:
+        # Only merge into the existing credential when the new token
+        # already covers every scope we're about to advertise on it.
+        # Without this guard we'd overwrite ``matching.access_token`` with
+        # a narrower token while storing a wider ``scopes`` list — the
+        # record would claim authorizations the token does not grant, and
+        # blocks using the lost scopes would fail with opaque 401/403s
+        # until the user hits re-auth.  On a narrowing login, keep the
+        # two credentials separate instead.
+        if set(credentials.scopes).issuperset(set(matching.scopes)):
+            return await _upgrade_existing_credential(user_id, matching.id, credentials)
+
+    await creds_manager.create(user_id, credentials)
+    return credentials
+
+
+async def _upgrade_existing_credential(
+    user_id: str,
+    existing_cred_id: str,
+    new_credentials: OAuth2Credentials,
+) -> OAuth2Credentials:
+    """Merge scopes from *new_credentials* into an existing credential."""
+    # Defense-in-depth: re-check system and provider invariants right before
+    # the write.  The login-time check in `_prepare_scope_upgrade` can go stale
+    # by the time the callback runs, and the implicit-merge path bypasses
+    # login-time validation entirely, so every write-path must enforce these
+    # on its own.
+    if is_system_credential(existing_cred_id):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="System credentials cannot be upgraded",
+        )
+    existing = await creds_manager.store.get_creds_by_id(user_id, existing_cred_id)
+    if not existing or not isinstance(existing, OAuth2Credentials):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Credential to upgrade not found",
+        )
+    if existing.is_managed:
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Managed credentials cannot be upgraded",
+        )
+    if not provider_matches(existing.provider, new_credentials.provider):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Credential provider does not match the requested provider",
+        )
+
+    if (
+        existing.username
+        and new_credentials.username
+        and existing.username != new_credentials.username
+    ):
+        raise HTTPException(
+            status_code=status.HTTP_400_BAD_REQUEST,
+            detail="Username mismatch: authenticated as a different user",
+        )
+
+    # Operate on a copy so the caller's ``new_credentials`` object is not
+    # mutated out from under them.  Every caller today immediately discards
+    # or replaces its reference, but the implicit-merge path in
+    # ``_merge_or_create_credential`` reads ``credentials.scopes`` before
+    # calling into us — a future reader after the call would otherwise
+    # silently see the overwritten values.
+    merged = new_credentials.model_copy(deep=True)
+    merged.id = existing.id
+    merged.title = existing.title
+    merged.scopes = list(set(existing.scopes) | set(new_credentials.scopes))
+    merged.metadata = {
+        **(existing.metadata or {}),
+        **(new_credentials.metadata or {}),
+    }
+    # Preserve the existing refresh_token and username if the incremental
+    # response doesn't carry them.  Providers like Google only return a
+    # refresh_token on first authorization — dropping it here would orphan
+    # the credential on the next access-token expiry, forcing the user to
+    # re-auth from scratch. Username is similarly sticky: if we've already
+    # resolved it for this credential, keep it rather than silently
+    # blanking it on an incremental upgrade.
+    if not merged.refresh_token and existing.refresh_token:
+        merged.refresh_token = existing.refresh_token
+        merged.refresh_token_expires_at = existing.refresh_token_expires_at
+    if not merged.username and existing.username:
+        merged.username = existing.username
+    await creds_manager.update(user_id, merged)
+    return merged
+
+
 # --------------------------- UTILITIES ---------------------------- #
 
 
@@ -784,12 +1122,21 @@ def _get_provider_oauth_handler(
 async def get_ayrshare_sso_url(
     user_id: Annotated[str, Security(get_user_id)],
 ) -> AyrshareSSOResponse:
-    """
-    Generate an SSO URL for Ayrshare social media integration.
+    """Generate a JWT SSO URL so the user can link their social accounts.
 
-    Returns:
-        dict: Contains the SSO URL for Ayrshare integration
+    The per-user Ayrshare profile key is provisioned and persisted as a
+    standard ``is_managed=True`` credential by
+    :class:`~backend.integrations.managed_providers.ayrshare.AyrshareManagedProvider`.
+    This endpoint only signs a short-lived JWT pointing at the Ayrshare-
+    hosted social-linking page; all profile lifecycle logic lives with the
+    managed provider.
     """
+    if not ayrshare_settings_available():
+        raise HTTPException(
+            status_code=HTTP_500_INTERNAL_SERVER_ERROR,
+            detail="Ayrshare integration is not configured",
+        )
+
     try:
         client = AyrshareClient()
     except MissingConfigError:
@@ -798,66 +1145,63 @@ async def get_ayrshare_sso_url(
             detail="Ayrshare integration is not configured",
         )
 
-    # Ayrshare profile key is stored in the credentials store
-    # It is generated when creating a new profile, if there is no profile key,
-    # we create a new profile and store the profile key in the credentials store
-
-    user_integrations: UserIntegrations = await get_user_integrations(user_id)
-    profile_key = user_integrations.managed_credentials.ayrshare_profile_key
-
-    if not profile_key:
-        logger.debug(f"Creating new Ayrshare profile for user {user_id}")
-        try:
-            profile = await client.create_profile(
-                title=f"User {user_id}", messaging_active=True
-            )
-            profile_key = profile.profileKey
-            await creds_manager.store.set_ayrshare_profile_key(user_id, profile_key)
-        except Exception as e:
-            logger.error(f"Error creating Ayrshare profile for user {user_id}: {e}")
-            raise HTTPException(
-                status_code=HTTP_502_BAD_GATEWAY,
-                detail="Failed to create Ayrshare profile",
-            )
-    else:
-        logger.debug(f"Using existing Ayrshare profile for user {user_id}")
-
-    profile_key_str = (
-        profile_key.get_secret_value()
-        if isinstance(profile_key, SecretStr)
-        else str(profile_key)
+    # On-demand provisioning: AyrshareManagedProvider opts out of the
+    # credentials sweep (profile quota is per-user subscription-bound).  This
+    # endpoint is the only trigger that provisions a profile — one Ayrshare
+    # profile per user who actually opens the connect flow, not one per
+    # every authenticated user.
+    provisioned = await ensure_managed_credential(
+        user_id, creds_manager.store, AyrshareManagedProvider()
     )
+    if not provisioned:
+        raise HTTPException(
+            status_code=HTTP_502_BAD_GATEWAY,
+            detail="Failed to provision Ayrshare profile",
+        )
+
+    ayrshare_creds = [
+        c
+        for c in await creds_manager.store.get_creds_by_provider(user_id, "ayrshare")
+        if c.is_managed and isinstance(c, APIKeyCredentials)
+    ]
+    if not ayrshare_creds:
+        logger.error(
+            "Ayrshare credential provisioning did not produce a credential "
+            "for user %s",
+            user_id,
+        )
+        raise HTTPException(
+            status_code=HTTP_502_BAD_GATEWAY,
+            detail="Failed to provision Ayrshare profile",
+        )
+    profile_key_str = ayrshare_creds[0].api_key.get_secret_value()
 
     private_key = settings.secrets.ayrshare_jwt_key
-    # Ayrshare JWT expiry is 2880 minutes (48 hours)
+    # Ayrshare JWT max lifetime is 2880 minutes (48 h).
     max_expiry_minutes = 2880
     try:
-        logger.debug(f"Generating Ayrshare JWT for user {user_id}")
         jwt_response = await client.generate_jwt(
             private_key=private_key,
             profile_key=profile_key_str,
+            # `allowed_social` is the set of networks the Ayrshare-hosted
+            # social-linking page will *offer* the user to connect.  Blocks
+            # exist for more platforms than are listed here; the list is
+            # deliberately narrower so the rollout can verify each network
+            # end-to-end before widening the user-visible surface.  Keep
+            # in sync with tested platforms — extend as each is verified
+            # against the block + Ayrshare's network-specific quirks.
             allowed_social=[
-                # NOTE: We are enabling platforms one at a time
-                # to speed up the development process
-                # SocialPlatform.FACEBOOK,
                 SocialPlatform.TWITTER,
                 SocialPlatform.LINKEDIN,
                 SocialPlatform.INSTAGRAM,
                 SocialPlatform.YOUTUBE,
-                # SocialPlatform.REDDIT,
-                # SocialPlatform.TELEGRAM,
-                # SocialPlatform.GOOGLE_MY_BUSINESS,
-                # SocialPlatform.PINTEREST,
                 SocialPlatform.TIKTOK,
-                # SocialPlatform.BLUESKY,
-                # SocialPlatform.SNAPCHAT,
-                # SocialPlatform.THREADS,
             ],
             expires_in=max_expiry_minutes,
             verify=True,
         )
-    except Exception as e:
-        logger.error(f"Error generating Ayrshare JWT for user {user_id}: {e}")
+    except Exception as exc:
+        logger.error("Error generating Ayrshare JWT for user %s: %s", user_id, exc)
         raise HTTPException(
             status_code=HTTP_502_BAD_GATEWAY, detail="Failed to generate JWT"
         )
@@ -867,20 +1211,37 @@ async def get_ayrshare_sso_url(
 
 
 # === PROVIDER DISCOVERY ENDPOINTS ===
-@router.get("/providers", response_model=List[str])
-async def list_providers() -> List[str]:
+@router.get("/providers", response_model=List[ProviderMetadata])
+async def list_providers() -> List[ProviderMetadata]:
     """
-    Get a list of all available provider names.
+    Get metadata for every available provider.
 
-    Returns both statically defined providers (from ProviderName enum)
-    and dynamically registered providers (from SDK decorators).
+    Returns both statically defined providers (from ``ProviderName`` enum) and
+    dynamically registered providers (from SDK decorators). Each entry includes
+    a ``description`` declared via ``ProviderBuilder.with_description(...)`` in
+    the provider's ``_config.py``.
 
     Note: The complete list of provider names is also available as a constant
     in the generated TypeScript client via PROVIDER_NAMES.
     """
-    # Get all providers at runtime
+    # Ensure all block modules (and therefore every provider's _config.py) are
+    # imported before we read from AutoRegistry. Cached on first call.
+    try:
+        from backend.blocks import load_all_blocks
+
+        load_all_blocks()
+    except Exception as e:
+        logger.warning(f"Failed to load blocks for provider metadata: {e}")
+
     all_providers = get_all_provider_names()
-    return all_providers
+    return [
+        ProviderMetadata(
+            name=name,
+            description=get_provider_description(name),
+            supported_auth_types=get_supported_auth_types(name),
+        )
+        for name in all_providers
+    ]
 
 
 @router.get("/providers/system", response_model=List[str])

autogpt_platform/backend/backend/api/features/integrations/router_test.py

@@ -393,7 +393,7 @@ class TestEnsureManagedCredentials:
             _PROVIDERS.update(saved)
             _provisioned_users.pop("user-1", None)
 
-        provider.provision.assert_awaited_once_with("user-1")
+        provider.provision.assert_awaited_once_with("user-1", store)
         store.add_managed_credential.assert_awaited_once_with("user-1", cred)
 
     @pytest.mark.asyncio
@@ -568,3 +568,181 @@ class TestCleanupManagedCredentials:
             _PROVIDERS.update(saved)
 
         # No exception raised — cleanup failure is swallowed.
+
+
+class TestGetPickerToken:
+    """POST /{provider}/credentials/{cred_id}/picker-token must:
+    1. Return the access token for OAuth2 creds the caller owns.
+    2. 404 for non-owned, non-existent, or wrong-provider creds.
+    3. 400 for non-OAuth2 creds (API key, host-scoped, user/password).
+    4. 404 for SDK default creds (same hardening as get_credential).
+    5. Preserve the `TestGetCredentialReturnsMetaOnly` contract — the
+       existing meta-only endpoint must still strip secrets even after
+       this picker-token endpoint exists."""
+
+    def test_oauth2_owner_gets_access_token(self):
+        # Use a Google cred with a drive.file scope — only picker-eligible
+        # (provider, scope) pairs can mint a token. GitHub-style creds are
+        # explicitly rejected; see `test_non_picker_provider_rejected_as_400`.
+        cred = _make_oauth2_cred(
+            cred_id="cred-gdrive",
+            provider="google",
+        )
+        cred.scopes = ["https://www.googleapis.com/auth/drive.file"]
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/google/credentials/cred-gdrive/picker-token")
+
+        assert resp.status_code == 200
+        data = resp.json()
+        # The whole point of this endpoint: the access token IS returned here.
+        assert data["access_token"] == "ghp_secret_token"
+        # Only the two declared fields come back — nothing else leaks.
+        assert set(data.keys()) <= {"access_token", "access_token_expires_at"}
+
+    def test_non_picker_provider_rejected_as_400(self):
+        """Provider allowlist: even with a valid OAuth2 credential, a
+        non-picker provider (GitHub, etc.) cannot mint a picker token.
+        Stops this endpoint from being used as a generic bearer-token
+        extraction path for any stored OAuth cred under the same user."""
+        cred = _make_oauth2_cred(provider="github")
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/github/credentials/cred-456/picker-token")
+
+        assert resp.status_code == 400
+        assert "not available for provider" in resp.json()["detail"]
+        assert "ghp_secret_token" not in str(resp.json())
+
+    def test_google_oauth_without_drive_scope_rejected(self):
+        """Scope allowlist: a Google OAuth2 cred that only carries non-picker
+        scopes (e.g. gmail.readonly, calendar) cannot mint a picker token.
+        Forces the frontend to reconnect with a Drive scope before the
+        picker is available."""
+        cred = _make_oauth2_cred(provider="google")
+        cred.scopes = [
+            "https://www.googleapis.com/auth/gmail.readonly",
+            "https://www.googleapis.com/auth/calendar",
+        ]
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/google/credentials/cred-456/picker-token")
+
+        assert resp.status_code == 400
+        assert "picker" in resp.json()["detail"].lower()
+
+    def test_api_key_credential_rejected_as_400(self):
+        cred = _make_api_key_cred()
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/openai/credentials/cred-123/picker-token")
+
+        assert resp.status_code == 400
+        # API keys must not silently fall through to a 200 response of some
+        # other shape — the client should see a clear shape rejection.
+        body = str(resp.json())
+        assert "sk-secret-key-value" not in body
+
+    def test_user_password_credential_rejected_as_400(self):
+        cred = _make_user_password_cred()
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/openai/credentials/cred-789/picker-token")
+
+        assert resp.status_code == 400
+        body = str(resp.json())
+        assert "s3cret-pass" not in body
+        assert "admin" not in body
+
+    def test_host_scoped_credential_rejected_as_400(self):
+        cred = _make_host_scoped_cred()
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/openai/credentials/cred-host/picker-token")
+
+        assert resp.status_code == 400
+        assert "top-secret" not in str(resp.json())
+
+    def test_missing_credential_returns_404(self):
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=None)
+            resp = client.post("/github/credentials/nonexistent/picker-token")
+
+        assert resp.status_code == 404
+        assert resp.json()["detail"] == "Credentials not found"
+
+    def test_wrong_provider_returns_404(self):
+        """Symmetric with get_credential: provider mismatch is a generic
+        404, not a 400, so we don't leak existence of a credential the
+        caller doesn't own on that provider."""
+        cred = _make_oauth2_cred(provider="github")
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/google/credentials/cred-456/picker-token")
+
+        assert resp.status_code == 404
+        assert resp.json()["detail"] == "Credentials not found"
+
+    def test_sdk_default_returns_404(self):
+        """SDK defaults are invisible to the user-facing API — picker-token
+        must not mint a token for them either."""
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock()
+            resp = client.post("/openai/credentials/openai-default/picker-token")
+
+        assert resp.status_code == 404
+        mock_mgr.get.assert_not_called()
+
+    def test_oauth2_without_access_token_returns_400(self):
+        """A stored OAuth2 cred whose access_token is missing can't satisfy
+        a picker init. Surface a clear reconnect instruction rather than
+        returning an empty string."""
+        cred = _make_oauth2_cred()
+        # Simulate a cred that lost its access token
+        object.__setattr__(cred, "access_token", None)
+
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.post("/github/credentials/cred-456/picker-token")
+
+        assert resp.status_code == 400
+        assert "reconnect" in resp.json()["detail"].lower()
+
+    def test_meta_only_endpoint_still_strips_access_token(self):
+        """Regression guard for the coexistence contract: the new
+        picker-token endpoint must NOT accidentally leak the token through
+        the meta-only GET endpoint. TestGetCredentialReturnsMetaOnly
+        covers this more broadly; this is a fast sanity check co-located
+        with the new endpoint's tests."""
+        cred = _make_oauth2_cred()
+        with patch(
+            "backend.api.features.integrations.router.creds_manager"
+        ) as mock_mgr:
+            mock_mgr.get = AsyncMock(return_value=cred)
+            resp = client.get("/github/credentials/cred-456")
+
+        assert resp.status_code == 200
+        body = resp.json()
+        assert "access_token" not in body
+        assert "refresh_token" not in body
+        assert "ghp_secret_token" not in str(body)

autogpt_platform/backend/backend/api/features/library/db.py

@@ -1804,7 +1804,7 @@ async def create_preset_from_graph_execution(
             raise NotFoundError(
                 f"Graph #{graph_execution.graph_id} not found or accessible"
             )
-        elif len(graph.aggregate_credentials_inputs()) > 0:
+        elif len(graph.regular_credentials_inputs) > 0:
             raise ValueError(
                 f"Graph execution #{graph_exec_id} can't be turned into a preset "
                 "because it was run before this feature existed "

autogpt_platform/backend/backend/api/features/push/model.py

@@ -0,0 +1,20 @@
+import pydantic
+
+
+class PushSubscriptionKeys(pydantic.BaseModel):
+    p256dh: str = pydantic.Field(min_length=1, max_length=512)
+    auth: str = pydantic.Field(min_length=1, max_length=512)
+
+
+class PushSubscribeRequest(pydantic.BaseModel):
+    endpoint: str = pydantic.Field(min_length=1, max_length=2048)
+    keys: PushSubscriptionKeys
+    user_agent: str | None = pydantic.Field(default=None, max_length=512)
+
+
+class PushUnsubscribeRequest(pydantic.BaseModel):
+    endpoint: str = pydantic.Field(min_length=1, max_length=2048)
+
+
+class VapidPublicKeyResponse(pydantic.BaseModel):
+    public_key: str

autogpt_platform/backend/backend/api/features/push/routes.py

@@ -0,0 +1,64 @@
+from typing import Annotated
+
+from autogpt_libs.auth import get_user_id, requires_user
+from fastapi import APIRouter, HTTPException, Security
+from starlette.status import HTTP_204_NO_CONTENT, HTTP_400_BAD_REQUEST
+
+from backend.api.features.push.model import (
+    PushSubscribeRequest,
+    PushUnsubscribeRequest,
+    VapidPublicKeyResponse,
+)
+from backend.data.push_subscription import (
+    delete_push_subscription,
+    upsert_push_subscription,
+    validate_push_endpoint,
+)
+from backend.util.settings import Settings
+
+router = APIRouter()
+_settings = Settings()
+
+
+@router.get(
+    "/vapid-key",
+    summary="Get VAPID public key for push subscription",
+)
+async def get_vapid_public_key() -> VapidPublicKeyResponse:
+    return VapidPublicKeyResponse(public_key=_settings.secrets.vapid_public_key)
+
+
+@router.post(
+    "/subscribe",
+    summary="Register a push subscription for the current user",
+    status_code=HTTP_204_NO_CONTENT,
+    dependencies=[Security(requires_user)],
+)
+async def subscribe_push(
+    user_id: Annotated[str, Security(get_user_id)],
+    body: PushSubscribeRequest,
+) -> None:
+    try:
+        await validate_push_endpoint(body.endpoint)
+        await upsert_push_subscription(
+            user_id=user_id,
+            endpoint=body.endpoint,
+            p256dh=body.keys.p256dh,
+            auth=body.keys.auth,
+            user_agent=body.user_agent,
+        )
+    except ValueError as e:
+        raise HTTPException(status_code=HTTP_400_BAD_REQUEST, detail=str(e))
+
+
+@router.post(
+    "/unsubscribe",
+    summary="Remove a push subscription",
+    status_code=HTTP_204_NO_CONTENT,
+    dependencies=[Security(requires_user)],
+)
+async def unsubscribe_push(
+    user_id: Annotated[str, Security(get_user_id)],
+    body: PushUnsubscribeRequest,
+) -> None:
+    await delete_push_subscription(user_id, body.endpoint)

autogpt_platform/backend/backend/api/features/push/routes_test.py

@@ -0,0 +1,240 @@
+"""Tests for push notification routes."""
+
+from unittest.mock import AsyncMock, MagicMock
+
+import fastapi
+import fastapi.testclient
+import pytest
+
+from backend.api.features.push.routes import router
+
+app = fastapi.FastAPI()
+app.include_router(router)
+client = fastapi.testclient.TestClient(app)
+
+
+@pytest.fixture(autouse=True)
+def setup_app_auth(mock_jwt_user):
+    from autogpt_libs.auth.jwt_utils import get_jwt_payload
+
+    app.dependency_overrides[get_jwt_payload] = mock_jwt_user["get_jwt_payload"]
+    yield
+    app.dependency_overrides.clear()
+
+
+def test_get_vapid_public_key(mocker):
+    mock_settings = MagicMock()
+    mock_settings.secrets.vapid_public_key = "test-vapid-public-key-base64url"
+    mocker.patch(
+        "backend.api.features.push.routes._settings",
+        mock_settings,
+    )
+
+    response = client.get("/vapid-key")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["public_key"] == "test-vapid-public-key-base64url"
+
+
+def test_get_vapid_public_key_empty(mocker):
+    mock_settings = MagicMock()
+    mock_settings.secrets.vapid_public_key = ""
+    mocker.patch(
+        "backend.api.features.push.routes._settings",
+        mock_settings,
+    )
+
+    response = client.get("/vapid-key")
+
+    assert response.status_code == 200
+    data = response.json()
+    assert data["public_key"] == ""
+
+
+def test_subscribe_push(mocker, test_user_id):
+    mock_upsert = mocker.patch(
+        "backend.api.features.push.routes.upsert_push_subscription",
+        new_callable=AsyncMock,
+    )
+
+    response = client.post(
+        "/subscribe",
+        json={
+            "endpoint": "https://fcm.googleapis.com/fcm/send/abc123",
+            "keys": {
+                "p256dh": "test-p256dh-key",
+                "auth": "test-auth-key",
+            },
+            "user_agent": "Mozilla/5.0 Test",
+        },
+    )
+
+    assert response.status_code == 204
+    mock_upsert.assert_awaited_once_with(
+        user_id=test_user_id,
+        endpoint="https://fcm.googleapis.com/fcm/send/abc123",
+        p256dh="test-p256dh-key",
+        auth="test-auth-key",
+        user_agent="Mozilla/5.0 Test",
+    )
+
+
+def test_subscribe_push_without_user_agent(mocker, test_user_id):
+    mock_upsert = mocker.patch(
+        "backend.api.features.push.routes.upsert_push_subscription",
+        new_callable=AsyncMock,
+    )
+
+    response = client.post(
+        "/subscribe",
+        json={
+            "endpoint": "https://fcm.googleapis.com/fcm/send/abc123",
+            "keys": {
+                "p256dh": "test-p256dh-key",
+                "auth": "test-auth-key",
+            },
+        },
+    )
+
+    assert response.status_code == 204
+    mock_upsert.assert_awaited_once_with(
+        user_id=test_user_id,
+        endpoint="https://fcm.googleapis.com/fcm/send/abc123",
+        p256dh="test-p256dh-key",
+        auth="test-auth-key",
+        user_agent=None,
+    )
+
+
+def test_subscribe_push_missing_keys():
+    response = client.post(
+        "/subscribe",
+        json={
+            "endpoint": "https://fcm.googleapis.com/fcm/send/abc123",
+        },
+    )
+
+    assert response.status_code == 422
+
+
+def test_subscribe_push_missing_endpoint():
+    response = client.post(
+        "/subscribe",
+        json={
+            "keys": {
+                "p256dh": "test-p256dh-key",
+                "auth": "test-auth-key",
+            },
+        },
+    )
+
+    assert response.status_code == 422
+
+
+def test_subscribe_push_rejects_empty_crypto_keys():
+    response = client.post(
+        "/subscribe",
+        json={
+            "endpoint": "https://fcm.googleapis.com/fcm/send/abc123",
+            "keys": {"p256dh": "", "auth": ""},
+        },
+    )
+
+    assert response.status_code == 422
+
+
+def test_subscribe_push_rejects_oversized_endpoint():
+    response = client.post(
+        "/subscribe",
+        json={
+            "endpoint": "https://fcm.googleapis.com/fcm/send/" + "x" * 3000,
+            "keys": {"p256dh": "k", "auth": "a"},
+        },
+    )
+
+    assert response.status_code == 422
+
+
+def test_unsubscribe_push(mocker, test_user_id):
+    mock_delete = mocker.patch(
+        "backend.api.features.push.routes.delete_push_subscription",
+        new_callable=AsyncMock,
+    )
+
+    response = client.post(
+        "/unsubscribe",
+        json={
+            "endpoint": "https://fcm.googleapis.com/fcm/send/abc123",
+        },
+    )
+
+    assert response.status_code == 204
+    mock_delete.assert_awaited_once_with(
+        test_user_id,
+        "https://fcm.googleapis.com/fcm/send/abc123",
+    )
+
+
+def test_unsubscribe_push_missing_endpoint():
+    response = client.post(
+        "/unsubscribe",
+        json={},
+    )
+
+    assert response.status_code == 422
+
+
+@pytest.mark.parametrize(
+    "untrusted_endpoint",
+    [
+        "https://localhost/evil",
+        "https://127.0.0.1/evil",
+        "https://169.254.169.254/latest/meta-data/",
+        "https://internal-service.local/api",
+        "https://attacker.example.com/push",
+        "http://fcm.googleapis.com/fcm/send/abc",
+        "file:///etc/passwd",
+    ],
+)
+def test_subscribe_push_rejects_untrusted_endpoints(mocker, untrusted_endpoint):
+    mock_upsert = mocker.patch(
+        "backend.api.features.push.routes.upsert_push_subscription",
+        new_callable=AsyncMock,
+    )
+
+    response = client.post(
+        "/subscribe",
+        json={
+            "endpoint": untrusted_endpoint,
+            "keys": {
+                "p256dh": "test-p256dh-key",
+                "auth": "test-auth-key",
+            },
+        },
+    )
+
+    assert response.status_code == 400
+    mock_upsert.assert_not_awaited()
+
+
+def test_subscribe_push_surfaces_cap_as_400(mocker):
+    mocker.patch(
+        "backend.api.features.push.routes.upsert_push_subscription",
+        new_callable=AsyncMock,
+        side_effect=ValueError("Subscription limit of 20 per user reached"),
+    )
+
+    response = client.post(
+        "/subscribe",
+        json={
+            "endpoint": "https://fcm.googleapis.com/fcm/send/abc123",
+            "keys": {
+                "p256dh": "test-p256dh-key",
+                "auth": "test-auth-key",
+            },
+        },
+    )
+
+    assert response.status_code == 400
+    assert "Subscription limit" in response.json()["detail"]

autogpt_platform/backend/backend/api/features/store/db.py

@@ -490,6 +490,9 @@ async def get_store_creators(
     # Build where clause with sanitized inputs
     where = {}
 
+    # Only return creators with approved agents
+    where["num_agents"] = {"gt": 0}
+
     if featured:
         where["is_featured"] = featured
 

autogpt_platform/backend/backend/api/features/store/db_test.py

@@ -1,4 +1,5 @@
 from datetime import datetime
+from unittest.mock import AsyncMock
 
 import prisma.enums
 import prisma.errors
@@ -50,8 +51,8 @@ async def test_get_store_agents(mocker):
 
     # Mock prisma calls
     mock_store_agent = mocker.patch("prisma.models.StoreAgent.prisma")
-    mock_store_agent.return_value.find_many = mocker.AsyncMock(return_value=mock_agents)
-    mock_store_agent.return_value.count = mocker.AsyncMock(return_value=1)
+    mock_store_agent.return_value.find_many = AsyncMock(return_value=mock_agents)
+    mock_store_agent.return_value.count = AsyncMock(return_value=1)
 
     # Call function
     result = await db.get_store_agents()
@@ -94,7 +95,7 @@ async def test_get_store_agent_details(mocker):
 
     # Mock StoreAgent prisma call
     mock_store_agent = mocker.patch("prisma.models.StoreAgent.prisma")
-    mock_store_agent.return_value.find_first = mocker.AsyncMock(return_value=mock_agent)
+    mock_store_agent.return_value.find_first = AsyncMock(return_value=mock_agent)
 
     # Call function
     result = await db.get_store_agent_details("creator", "test-agent")
@@ -133,7 +134,7 @@ async def test_get_store_creator(mocker):
 
     # Mock prisma call
     mock_creator = mocker.patch("prisma.models.Creator.prisma")
-    mock_creator.return_value.find_unique = mocker.AsyncMock()
+    mock_creator.return_value.find_unique = AsyncMock()
     # Configure the mock to return values that will pass validation
     mock_creator.return_value.find_unique.return_value = mock_creator_data
 
@@ -189,7 +190,7 @@ async def test_create_store_submission(mocker):
         notifyOnAgentApproved=True,
         notifyOnAgentRejected=True,
         timezone="Europe/Delft",
-        subscriptionTier=prisma.enums.SubscriptionTier.FREE,  # type: ignore[reportCallIssue,reportAttributeAccessIssue]
+        subscriptionTier=prisma.enums.SubscriptionTier.BASIC,  # type: ignore[reportCallIssue,reportAttributeAccessIssue]
     )
     mock_agent = prisma.models.AgentGraph(
         id="agent-id",
@@ -236,23 +237,23 @@ async def test_create_store_submission(mocker):
 
     # Mock prisma calls
     mock_agent_graph = mocker.patch("prisma.models.AgentGraph.prisma")
-    mock_agent_graph.return_value.find_first = mocker.AsyncMock(return_value=mock_agent)
+    mock_agent_graph.return_value.find_first = AsyncMock(return_value=mock_agent)
 
     # Mock transaction context manager
     mock_tx = mocker.MagicMock()
     mocker.patch(
         "backend.api.features.store.db.transaction",
-        return_value=mocker.AsyncMock(
-            __aenter__=mocker.AsyncMock(return_value=mock_tx),
-            __aexit__=mocker.AsyncMock(return_value=False),
+        return_value=AsyncMock(
+            __aenter__=AsyncMock(return_value=mock_tx),
+            __aexit__=AsyncMock(return_value=False),
         ),
     )
 
     mock_sl = mocker.patch("prisma.models.StoreListing.prisma")
-    mock_sl.return_value.find_unique = mocker.AsyncMock(return_value=None)
+    mock_sl.return_value.find_unique = AsyncMock(return_value=None)
 
     mock_slv = mocker.patch("prisma.models.StoreListingVersion.prisma")
-    mock_slv.return_value.create = mocker.AsyncMock(return_value=mock_version)
+    mock_slv.return_value.create = AsyncMock(return_value=mock_version)
 
     # Call function
     result = await db.create_store_submission(
@@ -292,10 +293,8 @@ async def test_update_profile(mocker):
 
     # Mock prisma calls
     mock_profile_db = mocker.patch("prisma.models.Profile.prisma")
-    mock_profile_db.return_value.find_first = mocker.AsyncMock(
-        return_value=mock_profile
-    )
-    mock_profile_db.return_value.update = mocker.AsyncMock(return_value=mock_profile)
+    mock_profile_db.return_value.find_first = AsyncMock(return_value=mock_profile)
+    mock_profile_db.return_value.update = AsyncMock(return_value=mock_profile)
 
     # Test data
     profile = Profile(
@@ -336,9 +335,7 @@ async def test_get_user_profile(mocker):
 
     # Mock prisma calls
     mock_profile_db = mocker.patch("prisma.models.Profile.prisma")
-    mock_profile_db.return_value.find_first = mocker.AsyncMock(
-        return_value=mock_profile
-    )
+    mock_profile_db.return_value.find_first = AsyncMock(return_value=mock_profile)
 
     # Call function
     result = await db.get_user_profile("user-id")
@@ -396,3 +393,38 @@ async def test_get_store_agents_search_category_array_injection():
     # Verify the query executed without error
     # Category should be parameterized, preventing SQL injection
     assert isinstance(result.agents, list)
+
+
+@pytest.mark.asyncio(loop_scope="session")
+async def test_get_store_creators_only_returns_approved(mocker):
+    mock_creators = [
+        prisma.models.Creator(
+            name="Creator One",
+            username="creator1",
+            description="desc",
+            links=["link1"],
+            avatar_url="avatar.jpg",
+            num_agents=1,
+            agent_rating=4.5,
+            agent_runs=10,
+            top_categories=["test"],
+            is_featured=False,
+        )
+    ]
+
+    mock_creator = mocker.patch("prisma.models.Creator.prisma")
+    mock_creator.return_value.find_many = AsyncMock(return_value=mock_creators)
+    mock_creator.return_value.count = AsyncMock(return_value=1)
+
+    result = await db.get_store_creators()
+
+    assert len(result.creators) == 1
+    assert result.creators[0].username == "creator1"
+
+    mock_creator.return_value.find_many.assert_called_once()
+    mock_creator.return_value.count.assert_called_once()
+
+    _, find_kwargs = mock_creator.return_value.find_many.call_args
+    _, count_kwargs = mock_creator.return_value.count.call_args
+    assert find_kwargs["where"]["num_agents"] == {"gt": 0}
+    assert count_kwargs["where"]["num_agents"] == {"gt": 0}

autogpt_platform/backend/backend/api/features/subscription_routes_test.py

@@ -60,25 +60,47 @@ def _stub_pending_subscription_change(mocker: pytest_mock.MockFixture) -> None:
     )
 
 
+_DEFAULT_TIER_PRICES: dict[SubscriptionTier, str | None] = {
+    SubscriptionTier.BASIC: None,  # Legacy: stripe-price-id-basic unset by default.
+    SubscriptionTier.PRO: "price_pro",
+    SubscriptionTier.MAX: "price_max",
+    SubscriptionTier.BUSINESS: None,  # Reserved: Business card hidden by default.
+}
+
+
 @pytest.fixture(autouse=True)
 def _stub_subscription_status_lookups(mocker: pytest_mock.MockFixture) -> None:
-    """Stub Stripe price + proration lookups used by get_subscription_status.
+    """Stub Stripe price + proration + tier-multiplier lookups used by
+    get_subscription_status.
 
     The POST /credits/subscription handler now returns the full subscription
-    status payload from every branch (same-tier, FREE downgrade, paid→paid
+    status payload from every branch (same-tier, BASIC downgrade, paid→paid
     modify, checkout creation), so every POST test implicitly hits these
     helpers.  Individual tests can override via their own mocker.patch call.
     """
+
+    async def default_price_id(tier: SubscriptionTier) -> str | None:
+        return _DEFAULT_TIER_PRICES.get(tier)
+
     mocker.patch(
         "backend.api.features.v1.get_subscription_price_id",
-        new_callable=AsyncMock,
-        return_value=None,
+        side_effect=default_price_id,
     )
     mocker.patch(
         "backend.api.features.v1.get_proration_credit_cents",
         new_callable=AsyncMock,
         return_value=0,
     )
+    # Default tier-multiplier resolver to the backend defaults so the endpoint
+    # never reaches LaunchDarkly during tests.  Individual tests override for
+    # LD-override scenarios.
+    from backend.copilot.rate_limit import _DEFAULT_TIER_MULTIPLIERS
+
+    mocker.patch(
+        "backend.api.features.v1.get_tier_multipliers",
+        new_callable=AsyncMock,
+        return_value=dict(_DEFAULT_TIER_MULTIPLIERS),
+    )
 
 
 @pytest.mark.parametrize(
@@ -122,15 +144,28 @@ def test_get_subscription_status_pro(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
-    """GET /credits/subscription returns PRO tier with Stripe price for a PRO user."""
+    """GET /credits/subscription returns PRO tier with Stripe prices for all priced tiers."""
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.PRO
 
+    prices = {
+        SubscriptionTier.BASIC: "price_basic",
+        SubscriptionTier.PRO: "price_pro",
+        SubscriptionTier.MAX: "price_max",
+        SubscriptionTier.BUSINESS: "price_business",
+    }
+    amounts = {
+        "price_basic": 0,
+        "price_pro": 1999,
+        "price_max": 4999,
+        "price_business": 14999,
+    }
+
     async def mock_price_id(tier: SubscriptionTier) -> str | None:
-        return "price_pro" if tier == SubscriptionTier.PRO else None
+        return prices.get(tier)
 
     async def mock_stripe_price_amount(price_id: str) -> int:
-        return 1999 if price_id == "price_pro" else 0
+        return amounts.get(price_id, 0)
 
     mocker.patch(
         "backend.api.features.v1.get_user_by_id",
@@ -158,16 +193,64 @@ def test_get_subscription_status_pro(
     assert data["tier"] == "PRO"
     assert data["monthly_cost"] == 1999
     assert data["tier_costs"]["PRO"] == 1999
-    assert data["tier_costs"]["BUSINESS"] == 0
-    assert data["tier_costs"]["FREE"] == 0
+    assert data["tier_costs"]["MAX"] == 4999
+    assert data["tier_costs"]["BUSINESS"] == 14999
+    assert data["tier_costs"]["BASIC"] == 0
+    assert "ENTERPRISE" not in data["tier_costs"]
     assert data["proration_credit_cents"] == 500
+    # tier_multipliers mirrors the same set of tiers that land in tier_costs,
+    # so the frontend never renders a multiplier badge for a hidden row.
+    assert set(data["tier_multipliers"].keys()) == set(data["tier_costs"].keys())
+    assert data["tier_multipliers"]["BASIC"] == 1.0
+    assert data["tier_multipliers"]["PRO"] == 5.0
+    assert data["tier_multipliers"]["MAX"] == 20.0
+    assert data["tier_multipliers"]["BUSINESS"] == 60.0
 
 
-def test_get_subscription_status_defaults_to_free(
+def test_get_subscription_status_tier_multipliers_ld_override(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
-    """GET /credits/subscription when subscription_tier is None defaults to FREE."""
+    """A LaunchDarkly-overridden tier multiplier flows through the response."""
+    mock_user = Mock()
+    mock_user.subscription_tier = SubscriptionTier.BASIC
+
+    mocker.patch(
+        "backend.api.features.v1.get_user_by_id",
+        new_callable=AsyncMock,
+        return_value=mock_user,
+    )
+
+    # LD says PRO is 7.5× (instead of the 5× default); other tiers unchanged.
+    mocker.patch(
+        "backend.api.features.v1.get_tier_multipliers",
+        new_callable=AsyncMock,
+        return_value={
+            SubscriptionTier.BASIC: 1.0,
+            SubscriptionTier.PRO: 7.5,
+            SubscriptionTier.MAX: 20.0,
+            SubscriptionTier.BUSINESS: 60.0,
+            SubscriptionTier.ENTERPRISE: 60.0,
+        },
+    )
+
+    response = client.get("/credits/subscription")
+    assert response.status_code == 200
+    data = response.json()
+    # Only tiers that made it into tier_costs get a multiplier (default stub
+    # exposes PRO + MAX via _DEFAULT_TIER_PRICES).
+    assert data["tier_multipliers"]["PRO"] == 7.5
+    assert data["tier_multipliers"]["MAX"] == 20.0
+    # BUSINESS has no price configured → hidden from both maps.
+    assert "BUSINESS" not in data["tier_multipliers"]
+
+
+def test_get_subscription_status_defaults_to_no_tier(
+    client: fastapi.testclient.TestClient,
+    mocker: pytest_mock.MockFixture,
+) -> None:
+    """When user has no subscription_tier, defaults to NO_TIER (the explicit
+    no-active-subscription state)."""
     mock_user = Mock()
     mock_user.subscription_tier = None
 
@@ -191,14 +274,9 @@ def test_get_subscription_status_defaults_to_free(
 
     assert response.status_code == 200
     data = response.json()
-    assert data["tier"] == SubscriptionTier.FREE.value
+    assert data["tier"] == SubscriptionTier.NO_TIER.value
     assert data["monthly_cost"] == 0
-    assert data["tier_costs"] == {
-        "FREE": 0,
-        "PRO": 0,
-        "BUSINESS": 0,
-        "ENTERPRISE": 0,
-    }
+    assert data["tier_costs"] == {}
     assert data["proration_credit_cents"] == 0
 
 
@@ -249,11 +327,11 @@ def test_get_subscription_status_stripe_error_falls_back_to_zero(
     assert data["tier_costs"]["PRO"] == 0
 
 
-def test_update_subscription_tier_free_no_payment(
+def test_update_subscription_tier_no_tier_no_payment(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
-    """POST /credits/subscription to FREE tier when payment disabled skips Stripe."""
+    """POST /credits/subscription to NO_TIER (cancel) when payment disabled skips Stripe."""
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.PRO
 
@@ -274,7 +352,7 @@ def test_update_subscription_tier_free_no_payment(
         new_callable=AsyncMock,
     )
 
-    response = client.post("/credits/subscription", json={"tier": "FREE"})
+    response = client.post("/credits/subscription", json={"tier": "NO_TIER"})
 
     assert response.status_code == 200
     assert response.json()["url"] == ""
@@ -286,7 +364,7 @@ def test_update_subscription_tier_paid_beta_user(
 ) -> None:
     """POST /credits/subscription for paid tier when payment disabled returns 422."""
     mock_user = Mock()
-    mock_user.subscription_tier = SubscriptionTier.FREE
+    mock_user.subscription_tier = SubscriptionTier.BASIC
 
     async def mock_feature_disabled(*args, **kwargs):
         return False
@@ -313,7 +391,7 @@ def test_update_subscription_tier_paid_requires_urls(
 ) -> None:
     """POST /credits/subscription for paid tier without success/cancel URLs returns 422."""
     mock_user = Mock()
-    mock_user.subscription_tier = SubscriptionTier.FREE
+    mock_user.subscription_tier = SubscriptionTier.BASIC
 
     async def mock_feature_enabled(*args, **kwargs):
         return True
@@ -327,19 +405,116 @@ def test_update_subscription_tier_paid_requires_urls(
         "backend.api.features.v1.is_feature_enabled",
         side_effect=mock_feature_enabled,
     )
+    mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        new_callable=AsyncMock,
+        return_value=False,
+    )
 
     response = client.post("/credits/subscription", json={"tier": "PRO"})
 
     assert response.status_code == 422
 
 
+def test_update_subscription_tier_currency_mismatch_returns_422(
+    client: fastapi.testclient.TestClient,
+    mocker: pytest_mock.MockFixture,
+) -> None:
+    """Stripe rejects a SubscriptionSchedule whose phases mix currencies (e.g.
+    GBP-checkout sub trying to schedule a USD-only target Price). The handler
+    must convert that into a specific 422 instead of the generic 502 so the
+    caller can tell the difference between a currency-config bug and a Stripe
+    outage."""
+    mock_user = Mock()
+    mock_user.subscription_tier = SubscriptionTier.MAX
+
+    async def mock_feature_enabled(*args, **kwargs):
+        return True
+
+    mocker.patch(
+        "backend.api.features.v1.get_user_by_id",
+        new_callable=AsyncMock,
+        return_value=mock_user,
+    )
+    mocker.patch(
+        "backend.api.features.v1.is_feature_enabled",
+        side_effect=mock_feature_enabled,
+    )
+    mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        side_effect=stripe.InvalidRequestError(
+            "The price specified only supports `usd`. This doesn't match the"
+            " expected currency: `gbp`.",
+            param="phases",
+        ),
+    )
+
+    response = client.post(
+        "/credits/subscription",
+        json={
+            "tier": "PRO",
+            "success_url": f"{TEST_FRONTEND_ORIGIN}/success",
+            "cancel_url": f"{TEST_FRONTEND_ORIGIN}/cancel",
+        },
+    )
+
+    assert response.status_code == 422
+    detail = response.json()["detail"]
+    assert "billing currency" in detail.lower()
+    assert "contact support" in detail.lower()
+
+
+def test_update_subscription_tier_non_currency_invalid_request_returns_502(
+    client: fastapi.testclient.TestClient,
+    mocker: pytest_mock.MockFixture,
+) -> None:
+    """Locks the contract that *only* currency-mismatch InvalidRequestErrors
+    translate to 422 — every other Stripe InvalidRequestError must still
+    surface as the generic 502 so that widening the conditional later is
+    caught by the suite."""
+    mock_user = Mock()
+    mock_user.subscription_tier = SubscriptionTier.MAX
+
+    async def mock_feature_enabled(*args, **kwargs):
+        return True
+
+    mocker.patch(
+        "backend.api.features.v1.get_user_by_id",
+        new_callable=AsyncMock,
+        return_value=mock_user,
+    )
+    mocker.patch(
+        "backend.api.features.v1.is_feature_enabled",
+        side_effect=mock_feature_enabled,
+    )
+    mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        side_effect=stripe.InvalidRequestError(
+            "No such price: 'price_does_not_exist'",
+            param="items[0][price]",
+        ),
+    )
+
+    response = client.post(
+        "/credits/subscription",
+        json={
+            "tier": "PRO",
+            "success_url": f"{TEST_FRONTEND_ORIGIN}/success",
+            "cancel_url": f"{TEST_FRONTEND_ORIGIN}/cancel",
+        },
+    )
+
+    assert response.status_code == 502
+    assert "billing currency" not in response.json()["detail"].lower()
+
+
 def test_update_subscription_tier_creates_checkout(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
     """POST /credits/subscription creates Stripe Checkout Session for paid upgrade."""
     mock_user = Mock()
-    mock_user.subscription_tier = SubscriptionTier.FREE
+    mock_user.subscription_tier = SubscriptionTier.BASIC
 
     async def mock_feature_enabled(*args, **kwargs):
         return True
@@ -353,6 +528,11 @@ def test_update_subscription_tier_creates_checkout(
         "backend.api.features.v1.is_feature_enabled",
         side_effect=mock_feature_enabled,
     )
+    mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        new_callable=AsyncMock,
+        return_value=False,
+    )
     mocker.patch(
         "backend.api.features.v1.create_subscription_checkout",
         new_callable=AsyncMock,
@@ -378,7 +558,7 @@ def test_update_subscription_tier_rejects_open_redirect(
 ) -> None:
     """POST /credits/subscription rejects success/cancel URLs outside the frontend origin."""
     mock_user = Mock()
-    mock_user.subscription_tier = SubscriptionTier.FREE
+    mock_user.subscription_tier = SubscriptionTier.BASIC
 
     async def mock_feature_enabled(*args, **kwargs):
         return True
@@ -392,6 +572,11 @@ def test_update_subscription_tier_rejects_open_redirect(
         "backend.api.features.v1.is_feature_enabled",
         side_effect=mock_feature_enabled,
     )
+    mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        new_callable=AsyncMock,
+        return_value=False,
+    )
     checkout_mock = mocker.patch(
         "backend.api.features.v1.create_subscription_checkout",
         new_callable=AsyncMock,
@@ -572,14 +757,14 @@ def test_update_subscription_tier_same_tier_stripe_error_returns_502(
     assert "contact support" in response.json()["detail"].lower()
 
 
-def test_update_subscription_tier_free_with_payment_schedules_cancel_and_does_not_update_db(
+def test_update_subscription_tier_no_tier_with_payment_schedules_cancel_and_does_not_update_db(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
-    """Downgrading to FREE schedules Stripe cancellation at period end.
+    """Cancelling to NO_TIER schedules Stripe cancellation at period end.
 
     The DB tier must NOT be updated immediately — the customer.subscription.deleted
-    webhook fires at period end and downgrades to FREE then.
+    webhook fires at period end and downgrades to NO_TIER then.
     """
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.PRO
@@ -605,18 +790,18 @@ def test_update_subscription_tier_free_with_payment_schedules_cancel_and_does_no
         side_effect=mock_feature_enabled,
     )
 
-    response = client.post("/credits/subscription", json={"tier": "FREE"})
+    response = client.post("/credits/subscription", json={"tier": "NO_TIER"})
 
     assert response.status_code == 200
     mock_cancel.assert_awaited_once()
     mock_set_tier.assert_not_awaited()
 
 
-def test_update_subscription_tier_free_cancel_failure_returns_502(
+def test_update_subscription_tier_no_tier_cancel_failure_returns_502(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
-    """Downgrading to FREE returns 502 with a generic error (no Stripe detail leakage)."""
+    """Cancelling to NO_TIER returns 502 with a generic error (no Stripe detail leakage)."""
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.PRO
 
@@ -639,7 +824,7 @@ def test_update_subscription_tier_free_cancel_failure_returns_502(
         side_effect=mock_feature_enabled,
     )
 
-    response = client.post("/credits/subscription", json={"tier": "FREE"})
+    response = client.post("/credits/subscription", json={"tier": "NO_TIER"})
 
     assert response.status_code == 502
     detail = response.json()["detail"]
@@ -756,6 +941,16 @@ def test_update_subscription_tier_paid_to_paid_modifies_subscription(
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.PRO
 
+    async def price_id_with_business(tier: SubscriptionTier) -> str | None:
+        return {
+            **_DEFAULT_TIER_PRICES,
+            SubscriptionTier.BUSINESS: "price_business",
+        }.get(tier)
+
+    mocker.patch(
+        "backend.api.features.v1.get_subscription_price_id",
+        side_effect=price_id_with_business,
+    )
     mocker.patch(
         "backend.api.features.v1.get_user_by_id",
         new_callable=AsyncMock,
@@ -791,15 +986,59 @@ def test_update_subscription_tier_paid_to_paid_modifies_subscription(
     checkout_mock.assert_not_awaited()
 
 
-def test_update_subscription_tier_admin_granted_paid_to_paid_updates_db_directly(
+def test_update_subscription_tier_max_checkout(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
-    """Admin-granted paid tier users are NOT sent to Stripe checkout for paid→paid changes.
+    """POST /credits/subscription from PRO→MAX modifies the existing subscription."""
+    mock_user = Mock()
+    mock_user.subscription_tier = SubscriptionTier.PRO
 
-    When modify_stripe_subscription_for_tier returns False (no Stripe subscription
-    found — admin-granted tier), the endpoint must update the DB tier directly and
-    return 200 with url="", rather than falling through to Checkout Session creation.
+    mocker.patch(
+        "backend.api.features.v1.get_user_by_id",
+        new_callable=AsyncMock,
+        return_value=mock_user,
+    )
+    mocker.patch(
+        "backend.api.features.v1.is_feature_enabled",
+        new_callable=AsyncMock,
+        return_value=True,
+    )
+    modify_mock = mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        new_callable=AsyncMock,
+        return_value=True,
+    )
+    checkout_mock = mocker.patch(
+        "backend.api.features.v1.create_subscription_checkout",
+        new_callable=AsyncMock,
+    )
+
+    response = client.post(
+        "/credits/subscription",
+        json={
+            "tier": "MAX",
+            "success_url": f"{TEST_FRONTEND_ORIGIN}/success",
+            "cancel_url": f"{TEST_FRONTEND_ORIGIN}/cancel",
+        },
+    )
+
+    assert response.status_code == 200
+    assert response.json()["url"] == ""
+    modify_mock.assert_awaited_once_with(TEST_USER_ID, SubscriptionTier.MAX)
+    checkout_mock.assert_not_awaited()
+
+
+def test_update_subscription_tier_no_active_sub_falls_through_to_checkout(
+    client: fastapi.testclient.TestClient,
+    mocker: pytest_mock.MockFixture,
+) -> None:
+    """Any tier change from a user with no active Stripe sub goes through Checkout.
+
+    Admin-granted users (no Stripe sub yet) and never-paid users follow the
+    exact same path: modify returns False → Checkout to set up payment. The
+    endpoint has no admin-specific branch — admin tier grants happen out-of-band
+    via the admin portal, not this user-facing route.
     """
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.PRO
@@ -814,7 +1053,6 @@ def test_update_subscription_tier_admin_granted_paid_to_paid_updates_db_directly
         new_callable=AsyncMock,
         return_value=True,
     )
-    # Return False = no Stripe subscription (admin-granted tier)
     modify_mock = mocker.patch(
         "backend.api.features.v1.modify_stripe_subscription_for_tier",
         new_callable=AsyncMock,
@@ -827,23 +1065,146 @@ def test_update_subscription_tier_admin_granted_paid_to_paid_updates_db_directly
     checkout_mock = mocker.patch(
         "backend.api.features.v1.create_subscription_checkout",
         new_callable=AsyncMock,
+        return_value="https://checkout.stripe.com/pay/cs_test_no_sub",
     )
 
     response = client.post(
         "/credits/subscription",
         json={
-            "tier": "BUSINESS",
+            "tier": "MAX",
             "success_url": f"{TEST_FRONTEND_ORIGIN}/success",
             "cancel_url": f"{TEST_FRONTEND_ORIGIN}/cancel",
         },
     )
 
     assert response.status_code == 200
-    assert response.json()["url"] == ""
-    modify_mock.assert_awaited_once_with(TEST_USER_ID, SubscriptionTier.BUSINESS)
-    # DB tier updated directly — no Stripe Checkout Session created
-    set_tier_mock.assert_awaited_once_with(TEST_USER_ID, SubscriptionTier.BUSINESS)
+    assert response.json()["url"] == "https://checkout.stripe.com/pay/cs_test_no_sub"
+    modify_mock.assert_awaited_once_with(TEST_USER_ID, SubscriptionTier.MAX)
+    # No DB-flip — payment must be collected via Checkout regardless of direction.
+    set_tier_mock.assert_not_awaited()
+    checkout_mock.assert_awaited_once()
+
+
+def test_update_subscription_tier_priced_basic_no_sub_falls_through_to_checkout(
+    client: fastapi.testclient.TestClient,
+    mocker: pytest_mock.MockFixture,
+) -> None:
+    """Once stripe-price-id-basic is configured, a BASIC user without an active sub
+    must hit Stripe Checkout rather than being silently set_subscription_tier'd."""
+    mock_user = Mock()
+    mock_user.subscription_tier = SubscriptionTier.BASIC
+
+    async def mock_price_id(tier: SubscriptionTier) -> str | None:
+        return {
+            SubscriptionTier.BASIC: "price_basic",
+            SubscriptionTier.PRO: "price_pro",
+            SubscriptionTier.MAX: "price_max",
+            SubscriptionTier.BUSINESS: "price_business",
+        }.get(tier)
+
+    mocker.patch(
+        "backend.api.features.v1.get_user_by_id",
+        new_callable=AsyncMock,
+        return_value=mock_user,
+    )
+    mocker.patch(
+        "backend.api.features.v1.get_subscription_price_id",
+        side_effect=mock_price_id,
+    )
+    mocker.patch(
+        "backend.api.features.v1.is_feature_enabled",
+        new_callable=AsyncMock,
+        return_value=True,
+    )
+    modify_mock = mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        new_callable=AsyncMock,
+        return_value=False,
+    )
+    set_tier_mock = mocker.patch(
+        "backend.api.features.v1.set_subscription_tier",
+        new_callable=AsyncMock,
+    )
+    checkout_mock = mocker.patch(
+        "backend.api.features.v1.create_subscription_checkout",
+        new_callable=AsyncMock,
+        return_value="https://checkout.stripe.com/pay/cs_test_priced_basic",
+    )
+
+    response = client.post(
+        "/credits/subscription",
+        json={
+            "tier": "PRO",
+            "success_url": f"{TEST_FRONTEND_ORIGIN}/success",
+            "cancel_url": f"{TEST_FRONTEND_ORIGIN}/cancel",
+        },
+    )
+
+    assert response.status_code == 200
+    assert (
+        response.json()["url"] == "https://checkout.stripe.com/pay/cs_test_priced_basic"
+    )
+    # Priced-BASIC user without an active sub: must NOT silently flip DB tier —
+    # they need to set up payment via Checkout.
+    set_tier_mock.assert_not_awaited()
+    checkout_mock.assert_awaited_once()
+    # modify is still called first; returning False just means "no active sub".
+    modify_mock.assert_awaited_once_with(TEST_USER_ID, SubscriptionTier.PRO)
+
+
+def test_update_subscription_tier_target_without_ld_price_returns_422(
+    client: fastapi.testclient.TestClient,
+    mocker: pytest_mock.MockFixture,
+) -> None:
+    """Paid target with no LD-configured Stripe price must fail fast with 422.
+
+    Matches the UI hiding: if `stripe-price-id-pro` resolves to None we can't
+    start a Checkout Session anyway, and we don't want to surface an opaque
+    Stripe error mid-flow. The handler rejects the request before touching
+    Stripe at all.
+    """
+    mock_user = Mock()
+    mock_user.subscription_tier = SubscriptionTier.BASIC
+
+    async def mock_price_id(tier: SubscriptionTier) -> str | None:
+        return None  # Neither BASIC nor PRO have an LD price.
+
+    mocker.patch(
+        "backend.api.features.v1.get_user_by_id",
+        new_callable=AsyncMock,
+        return_value=mock_user,
+    )
+    mocker.patch(
+        "backend.api.features.v1.get_subscription_price_id",
+        side_effect=mock_price_id,
+    )
+    mocker.patch(
+        "backend.api.features.v1.is_feature_enabled",
+        new_callable=AsyncMock,
+        return_value=True,
+    )
+    checkout_mock = mocker.patch(
+        "backend.api.features.v1.create_subscription_checkout",
+        new_callable=AsyncMock,
+    )
+    modify_mock = mocker.patch(
+        "backend.api.features.v1.modify_stripe_subscription_for_tier",
+        new_callable=AsyncMock,
+    )
+
+    response = client.post(
+        "/credits/subscription",
+        json={
+            "tier": "PRO",
+            "success_url": f"{TEST_FRONTEND_ORIGIN}/success",
+            "cancel_url": f"{TEST_FRONTEND_ORIGIN}/cancel",
+        },
+    )
+
+    assert response.status_code == 422
+    assert "not available" in response.json()["detail"].lower()
     checkout_mock.assert_not_awaited()
+    modify_mock.assert_not_awaited()
 
 
 def test_update_subscription_tier_paid_to_paid_stripe_error_returns_502(
@@ -854,6 +1215,16 @@ def test_update_subscription_tier_paid_to_paid_stripe_error_returns_502(
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.PRO
 
+    async def price_id_with_business(tier: SubscriptionTier) -> str | None:
+        return {
+            **_DEFAULT_TIER_PRICES,
+            SubscriptionTier.BUSINESS: "price_business",
+        }.get(tier)
+
+    mocker.patch(
+        "backend.api.features.v1.get_subscription_price_id",
+        side_effect=price_id_with_business,
+    )
     mocker.patch(
         "backend.api.features.v1.get_user_by_id",
         new_callable=AsyncMock,
@@ -882,14 +1253,14 @@ def test_update_subscription_tier_paid_to_paid_stripe_error_returns_502(
     assert response.status_code == 502
 
 
-def test_update_subscription_tier_free_no_stripe_subscription(
+def test_update_subscription_tier_no_tier_no_stripe_subscription(
     client: fastapi.testclient.TestClient,
     mocker: pytest_mock.MockFixture,
 ) -> None:
-    """Downgrading to FREE when no Stripe subscription exists updates DB tier directly.
+    """Cancelling to NO_TIER when no Stripe subscription exists updates DB tier directly.
 
     Admin-granted paid tiers have no associated Stripe subscription.  When such a
-    user requests a self-service downgrade, cancel_stripe_subscription returns False
+    user requests a self-service cancel, cancel_stripe_subscription returns False
     (nothing to cancel), so the endpoint must immediately call set_subscription_tier
     rather than waiting for a webhook that will never arrive.
     """
@@ -917,13 +1288,13 @@ def test_update_subscription_tier_free_no_stripe_subscription(
         new_callable=AsyncMock,
     )
 
-    response = client.post("/credits/subscription", json={"tier": "FREE"})
+    response = client.post("/credits/subscription", json={"tier": "NO_TIER"})
 
     assert response.status_code == 200
     assert response.json()["url"] == ""
     cancel_mock.assert_awaited_once_with(TEST_USER_ID)
     # DB tier must be updated immediately — no webhook will fire for a missing sub
-    set_tier_mock.assert_awaited_once_with(TEST_USER_ID, SubscriptionTier.FREE)
+    set_tier_mock.assert_awaited_once_with(TEST_USER_ID, SubscriptionTier.NO_TIER)
 
 
 def test_get_subscription_status_includes_pending_tier(
@@ -1014,6 +1385,16 @@ def test_update_subscription_tier_downgrade_paid_to_paid_schedules(
     mock_user = Mock()
     mock_user.subscription_tier = SubscriptionTier.BUSINESS
 
+    async def price_id_with_business(tier: SubscriptionTier) -> str | None:
+        return {
+            **_DEFAULT_TIER_PRICES,
+            SubscriptionTier.BUSINESS: "price_business",
+        }.get(tier)
+
+    mocker.patch(
+        "backend.api.features.v1.get_subscription_price_id",
+        side_effect=price_id_with_business,
+    )
     mocker.patch(
         "backend.api.features.v1.get_user_by_id",
         new_callable=AsyncMock,

autogpt_platform/backend/backend/api/features/v1.py

@@ -44,6 +44,7 @@ from backend.api.model import (
     UploadFileResponse,
 )
 from backend.blocks import get_block, get_blocks
+from backend.copilot.rate_limit import get_tier_multipliers
 from backend.data import execution as execution_db
 from backend.data import graph as graph_db
 from backend.data.auth import api_key as api_key_db
@@ -56,12 +57,14 @@ from backend.data.credit import (
     UserCredit,
     cancel_stripe_subscription,
     create_subscription_checkout,
+    get_active_subscription_period_end,
     get_auto_top_up,
     get_pending_subscription_change,
     get_proration_credit_cents,
     get_subscription_price_id,
     get_user_credit_model,
     handle_subscription_payment_failure,
+    handle_subscription_payment_success,
     modify_stripe_subscription_for_tier,
     release_pending_subscription_schedule,
     set_auto_top_up,
@@ -699,23 +702,48 @@ async def get_user_auto_top_up(
 
 
 class SubscriptionTierRequest(BaseModel):
-    tier: Literal["FREE", "PRO", "BUSINESS"]
+    tier: Literal["NO_TIER", "BASIC", "PRO", "MAX", "BUSINESS"]
     success_url: str = ""
     cancel_url: str = ""
 
 
 class SubscriptionStatusResponse(BaseModel):
-    tier: Literal["FREE", "PRO", "BUSINESS", "ENTERPRISE"]
+    tier: Literal["NO_TIER", "BASIC", "PRO", "MAX", "BUSINESS", "ENTERPRISE"]
     monthly_cost: int  # amount in cents (Stripe convention)
     tier_costs: dict[str, int]  # tier name -> amount in cents
+    tier_multipliers: dict[str, float] = Field(
+        default_factory=dict,
+        description=(
+            "Tier → rate-limit multiplier. Covers the same tiers listed in"
+            " ``tier_costs`` so the frontend can render rate-limit badges"
+            " relative to the lowest visible tier without knowing backend"
+            " defaults."
+        ),
+    )
     proration_credit_cents: int  # unused portion of current sub to convert on upgrade
-    pending_tier: Optional[Literal["FREE", "PRO", "BUSINESS"]] = None
+    has_active_stripe_subscription: bool = Field(
+        default=False,
+        description=(
+            "True when the user has an active/trialing Stripe subscription. The"
+            " frontend uses this to branch upgrade UX: modify-in-place + saved-card"
+            " auto-charge when True, redirect to Stripe Checkout when False."
+        ),
+    )
+    current_period_end: Optional[int] = Field(
+        default=None,
+        description=(
+            "Unix timestamp of the active subscription's current_period_end. Used"
+            " to show the date Stripe will issue the next invoice (with prorated"
+            " upgrade charges, if any). None when no active sub."
+        ),
+    )
+    pending_tier: Optional[Literal["NO_TIER", "BASIC", "PRO", "MAX", "BUSINESS"]] = None
     pending_tier_effective_at: Optional[datetime] = None
     url: str = Field(
         default="",
         description=(
             "Populated only when POST /credits/subscription starts a Stripe Checkout"
-            " Session (FREE → paid upgrade). Empty string in all other branches —"
+            " Session (BASIC → paid upgrade). Empty string in all other branches —"
             " the client redirects to this URL when non-empty."
         ),
     )
@@ -794,27 +822,48 @@ async def get_subscription_status(
     user_id: Annotated[str, Security(get_user_id)],
 ) -> SubscriptionStatusResponse:
     user = await get_user_by_id(user_id)
-    tier = user.subscription_tier or SubscriptionTier.FREE
+    tier = user.subscription_tier or SubscriptionTier.NO_TIER
 
-    paid_tiers = [SubscriptionTier.PRO, SubscriptionTier.BUSINESS]
+    # Tiers that *can* have a Stripe price configured (and therefore appear
+    # in the tier picker if the LD flag exposes a price-id). NO_TIER is not
+    # priceable — it's the implicit "no active subscription" state.
+    priceable_tiers = [
+        SubscriptionTier.BASIC,
+        SubscriptionTier.PRO,
+        SubscriptionTier.MAX,
+        SubscriptionTier.BUSINESS,
+    ]
     price_ids = await asyncio.gather(
-        *[get_subscription_price_id(t) for t in paid_tiers]
+        *[get_subscription_price_id(t) for t in priceable_tiers]
     )
 
-    tier_costs: dict[str, int] = {
-        SubscriptionTier.FREE.value: 0,
-        SubscriptionTier.ENTERPRISE.value: 0,
-    }
-
     async def _cost(pid: str | None) -> int:
         return (await _get_stripe_price_amount(pid) or 0) if pid else 0
 
     costs = await asyncio.gather(*[_cost(pid) for pid in price_ids])
-    for t, cost in zip(paid_tiers, costs):
-        tier_costs[t.value] = cost
+
+    tier_costs: dict[str, int] = {}
+    for t, pid, cost in zip(priceable_tiers, price_ids, costs):
+        if pid:
+            tier_costs[t.value] = cost
+
+    # Expose the effective rate-limit multipliers alongside prices so the
+    # frontend can render "Nx rate limits" relative to the lowest visible
+    # tier without hard-coding backend defaults.  Only emit entries for tiers
+    # that land in ``tier_costs`` — rows hidden at the price layer must stay
+    # hidden in the multiplier layer too.
+    multipliers = await get_tier_multipliers()
+    tier_multipliers: dict[str, float] = {
+        t.value: multipliers.get(t, 1.0)
+        for t in priceable_tiers
+        if t.value in tier_costs
+    }
 
     current_monthly_cost = tier_costs.get(tier.value, 0)
-    proration_credit = await get_proration_credit_cents(user_id, current_monthly_cost)
+    proration_credit, current_period_end = await asyncio.gather(
+        get_proration_credit_cents(user_id, current_monthly_cost),
+        get_active_subscription_period_end(user_id),
+    )
 
     try:
         pending = await get_pending_subscription_change(user_id)
@@ -834,17 +883,21 @@ async def get_subscription_status(
         tier=tier.value,
         monthly_cost=current_monthly_cost,
         tier_costs=tier_costs,
+        tier_multipliers=tier_multipliers,
         proration_credit_cents=proration_credit,
+        has_active_stripe_subscription=current_period_end is not None,
+        current_period_end=current_period_end,
     )
     if pending is not None:
         pending_tier_enum, pending_effective_at = pending
-        if pending_tier_enum == SubscriptionTier.FREE:
-            response.pending_tier = "FREE"
-        elif pending_tier_enum == SubscriptionTier.PRO:
-            response.pending_tier = "PRO"
-        elif pending_tier_enum == SubscriptionTier.BUSINESS:
-            response.pending_tier = "BUSINESS"
-        if response.pending_tier is not None:
+        if pending_tier_enum in (
+            SubscriptionTier.NO_TIER,
+            SubscriptionTier.BASIC,
+            SubscriptionTier.PRO,
+            SubscriptionTier.MAX,
+            SubscriptionTier.BUSINESS,
+        ):
+            response.pending_tier = pending_tier_enum.value
             response.pending_tier_effective_at = pending_effective_at
     return response
 
@@ -860,23 +913,25 @@ async def update_subscription_tier(
     request: SubscriptionTierRequest,
     user_id: Annotated[str, Security(get_user_id)],
 ) -> SubscriptionStatusResponse:
-    # Pydantic validates tier is one of FREE/PRO/BUSINESS via Literal type.
+    # Pydantic validates tier is one of BASIC/PRO/MAX/BUSINESS via Literal type.
     tier = SubscriptionTier(request.tier)
 
     # ENTERPRISE tier is admin-managed — block self-service changes from ENTERPRISE users.
     user = await get_user_by_id(user_id)
-    if (user.subscription_tier or SubscriptionTier.FREE) == SubscriptionTier.ENTERPRISE:
+    if (
+        user.subscription_tier or SubscriptionTier.NO_TIER
+    ) == SubscriptionTier.ENTERPRISE:
         raise HTTPException(
             status_code=403,
             detail="ENTERPRISE subscription changes must be managed by an administrator",
         )
 
     # Same-tier request = "stay on my current tier" = cancel any pending
-    # scheduled change (paid→paid downgrade or paid→FREE cancel). This is the
+    # scheduled change (paid→paid downgrade or paid→BASIC cancel). This is the
     # collapsed behaviour that replaces the old /credits/subscription/cancel-pending
     # route. Safe when no pending change exists: release_pending_subscription_schedule
     # returns False and we simply return the current status.
-    if (user.subscription_tier or SubscriptionTier.FREE) == tier:
+    if (user.subscription_tier or SubscriptionTier.NO_TIER) == tier:
         try:
             await release_pending_subscription_schedule(user_id)
         except stripe.StripeError as e:
@@ -898,22 +953,18 @@ async def update_subscription_tier(
         Flag.ENABLE_PLATFORM_PAYMENT, user_id, default=False
     )
 
-    # Downgrade to FREE: schedule Stripe cancellation at period end so the user
-    # keeps their tier for the time they already paid for. The DB tier is NOT
-    # updated here when a subscription exists — the customer.subscription.deleted
-    # webhook fires at period end and downgrades to FREE then.
-    # Exception: if the user has no active Stripe subscription (e.g. admin-granted
-    # tier), cancel_stripe_subscription returns False and we update the DB tier
-    # immediately since no webhook will ever fire.
-    # When payment is disabled entirely, update the DB tier directly.
-    if tier == SubscriptionTier.FREE:
+    target_price_id = await get_subscription_price_id(tier)
+
+    # Cancel: target NO_TIER. Schedule Stripe cancellation at period end;
+    # cancel_at_period_end=True lets the webhook flip the DB tier. No active
+    # sub (admin-granted or never-paid) or payment disabled → DB flip.
+    # NO_TIER is never priceable, so this branch always fires for cancel
+    # requests regardless of LD config.
+    if tier == SubscriptionTier.NO_TIER:
         if payment_enabled:
             try:
                 had_subscription = await cancel_stripe_subscription(user_id)
             except stripe.StripeError as e:
-                # Log full Stripe error server-side but return a generic message
-                # to the client — raw Stripe errors can leak customer/sub IDs and
-                # infrastructure config details.
                 logger.exception(
                     "Stripe error cancelling subscription for user %s: %s",
                     user_id,
@@ -927,54 +978,73 @@ async def update_subscription_tier(
                     ),
                 )
             if not had_subscription:
-                # No active Stripe subscription found — the user was on an
-                # admin-granted tier. Update DB immediately since the
-                # subscription.deleted webhook will never fire.
                 await set_subscription_tier(user_id, tier)
             return await get_subscription_status(user_id)
         await set_subscription_tier(user_id, tier)
         return await get_subscription_status(user_id)
 
-    # Paid tier changes require payment to be enabled — block self-service upgrades
-    # when the flag is off.  Admins use the /api/admin/ routes to set tiers directly.
     if not payment_enabled:
         raise HTTPException(
             status_code=422,
-            detail=f"Subscription not available for tier {tier}",
+            detail=f"Subscription not available for tier {tier.value}",
         )
 
-    # Paid→paid tier change: if the user already has a Stripe subscription,
-    # modify it in-place with proration instead of creating a new Checkout
-    # Session. This preserves remaining paid time and avoids double-charging.
-    # The customer.subscription.updated webhook fires and updates the DB tier.
-    current_tier = user.subscription_tier or SubscriptionTier.FREE
-    if current_tier in (SubscriptionTier.PRO, SubscriptionTier.BUSINESS):
-        try:
-            modified = await modify_stripe_subscription_for_tier(user_id, tier)
-            if modified:
-                return await get_subscription_status(user_id)
-            # modify_stripe_subscription_for_tier returns False when no active
-            # Stripe subscription exists — i.e. the user has an admin-granted
-            # paid tier with no Stripe record.  In that case, update the DB
-            # tier directly (same as the FREE-downgrade path for admin-granted
-            # users) rather than sending them through a new Checkout Session.
-            await set_subscription_tier(user_id, tier)
+    # Target has no LD price — not provisionable (matches the GET hiding).
+    if target_price_id is None:
+        raise HTTPException(
+            status_code=422,
+            detail=f"Subscription not available for tier {tier.value}",
+        )
+
+    # Modify in place if there's a sub; else fall through to Checkout below.
+    try:
+        modified = await modify_stripe_subscription_for_tier(user_id, tier)
+        if modified:
             return await get_subscription_status(user_id)
-        except ValueError as e:
-            raise HTTPException(status_code=422, detail=str(e))
-        except stripe.StripeError as e:
-            logger.exception(
-                "Stripe error modifying subscription for user %s: %s", user_id, e
+    except ValueError as e:
+        raise HTTPException(status_code=422, detail=str(e))
+    except stripe.InvalidRequestError as e:
+        # Stripe rejects schedule modify when phases mix currencies, e.g. the
+        # active sub was checked out in GBP but the target tier's Price is
+        # USD-only. 502 reads as outage; surface a 422 with a specific message
+        # so the user/admin can see what to fix in Stripe.
+        msg = str(e)
+        if "currency" in msg.lower():
+            logger.warning(
+                "Currency mismatch on tier change for user %s: %s", user_id, msg
             )
             raise HTTPException(
-                status_code=502,
+                status_code=422,
                 detail=(
-                    "Unable to update your subscription right now. "
-                    "Please try again or contact support."
+                    "Tier change unavailable for your current billing currency."
+                    " Please contact support — the target tier needs to be"
+                    " configured for your currency in Stripe before this"
+                    " change can go through."
                 ),
             )
+        logger.exception(
+            "Stripe error modifying subscription for user %s: %s", user_id, e
+        )
+        raise HTTPException(
+            status_code=502,
+            detail=(
+                "Unable to update your subscription right now. "
+                "Please try again or contact support."
+            ),
+        )
+    except stripe.StripeError as e:
+        logger.exception(
+            "Stripe error modifying subscription for user %s: %s", user_id, e
+        )
+        raise HTTPException(
+            status_code=502,
+            detail=(
+                "Unable to update your subscription right now. "
+                "Please try again or contact support."
+            ),
+        )
 
-    # Paid upgrade from FREE → create Stripe Checkout Session.
+    # No active Stripe subscription → create Stripe Checkout Session.
     if not request.success_url or not request.cancel_url:
         raise HTTPException(
             status_code=422,
@@ -1108,6 +1178,9 @@ async def stripe_webhook(request: Request):
     ):
         await sync_subscription_schedule_from_stripe(data_object)
 
+    if event_type == "invoice.payment_succeeded":
+        await handle_subscription_payment_success(data_object)
+
     if event_type == "invoice.payment_failed":
         await handle_subscription_payment_failure(data_object)
 

autogpt_platform/backend/backend/api/features/workspace/routes.py

@@ -2,6 +2,7 @@
 Workspace API routes for managing user file storage.
 """
 
+import asyncio
 import logging
 import os
 import re
@@ -14,6 +15,8 @@ from fastapi import Query, UploadFile
 from fastapi.responses import Response
 from pydantic import BaseModel, Field
 
+from backend.api.features.store.exceptions import VirusDetectedError, VirusScanError
+from backend.copilot.rate_limit import get_workspace_storage_limit_bytes
 from backend.data.workspace import (
     WorkspaceFile,
     count_workspace_files,
@@ -21,11 +24,9 @@ from backend.data.workspace import (
     get_workspace,
     get_workspace_file,
     get_workspace_total_size,
-    soft_delete_workspace_file,
 )
 from backend.util.settings import Config
-from backend.util.virus_scanner import scan_content_safe
-from backend.util.workspace import WorkspaceManager
+from backend.util.workspace import WorkspaceManager, format_bytes
 from backend.util.workspace_storage import get_workspace_storage
 
 
@@ -249,66 +250,47 @@ async def upload_file(
     # Get or create workspace
     workspace = await get_or_create_workspace(user_id)
 
-    # Pre-write storage cap check (soft check — final enforcement is post-write)
-    storage_limit_bytes = config.max_workspace_storage_mb * 1024 * 1024
-    current_usage = await get_workspace_total_size(workspace.id)
-    if storage_limit_bytes and current_usage + len(content) > storage_limit_bytes:
-        used_percent = (current_usage / storage_limit_bytes) * 100
-        raise fastapi.HTTPException(
-            status_code=413,
-            detail={
-                "message": "Storage limit exceeded",
-                "used_bytes": current_usage,
-                "limit_bytes": storage_limit_bytes,
-                "used_percent": round(used_percent, 1),
-            },
-        )
-
-    # Warn at 80% usage
-    if (
-        storage_limit_bytes
-        and (usage_ratio := (current_usage + len(content)) / storage_limit_bytes) >= 0.8
-    ):
-        logger.warning(
-            f"User {user_id} workspace storage at {usage_ratio * 100:.1f}% "
-            f"({current_usage + len(content)} / {storage_limit_bytes} bytes)"
-        )
-
-    # Virus scan
-    await scan_content_safe(content, filename=filename)
-
-    # Write file via WorkspaceManager
+    # Write file via WorkspaceManager (handles virus scan, per-file size,
+    # and per-user tier-based storage quota internally).
     manager = WorkspaceManager(user_id, workspace.id, session_id)
     try:
         workspace_file = await manager.write_file(
             content, filename, overwrite=overwrite, metadata={"origin": "user-upload"}
         )
+    except VirusDetectedError as e:
+        raise fastapi.HTTPException(status_code=400, detail=str(e)) from e
+    except VirusScanError as e:
+        raise fastapi.HTTPException(status_code=500, detail=str(e)) from e
     except ValueError as e:
-        # write_file raises ValueError for both path-conflict and size-limit
-        # cases; map each to its correct HTTP status.
+        # write_file raises ValueError for path-conflict, size-limit, and
+        # storage-quota cases; map each to its correct HTTP status.
         message = str(e)
-        if message.startswith("File too large"):
+        if message.startswith(("File too large", "Storage limit exceeded")):
             raise fastapi.HTTPException(status_code=413, detail=message) from e
         raise fastapi.HTTPException(status_code=409, detail=message) from e
 
     # Post-write storage check — eliminates TOCTOU race on the quota.
     # If a concurrent upload pushed us over the limit, undo this write.
+    storage_limit_bytes = await get_workspace_storage_limit_bytes(user_id)
     new_total = await get_workspace_total_size(workspace.id)
     if storage_limit_bytes and new_total > storage_limit_bytes:
         try:
-            await soft_delete_workspace_file(workspace_file.id, workspace.id)
+            # Route through WorkspaceManager so the storage backend blob is
+            # removed too — soft_delete_workspace_file alone leaks the blob.
+            await manager.delete_file(workspace_file.id)
         except Exception as e:
             logger.warning(
-                f"Failed to soft-delete over-quota file {workspace_file.id} "
+                f"Failed to delete over-quota file {workspace_file.id} "
                 f"in workspace {workspace.id}: {e}"
             )
         raise fastapi.HTTPException(
             status_code=413,
-            detail={
-                "message": "Storage limit exceeded (concurrent upload)",
-                "used_bytes": new_total,
-                "limit_bytes": storage_limit_bytes,
-            },
+            detail=(
+                f"Storage limit exceeded. "
+                f"You've used {format_bytes(new_total)} of your "
+                f"{format_bytes(storage_limit_bytes)} quota. "
+                f"Delete some files or upgrade your plan for more storage."
+            ),
         )
 
     return UploadFileResponse(
@@ -331,12 +313,13 @@ async def get_storage_usage(
     """
     Get storage usage information for the user's workspace.
     """
-    config = Config()
     workspace = await get_or_create_workspace(user_id)
 
-    used_bytes = await get_workspace_total_size(workspace.id)
-    file_count = await count_workspace_files(workspace.id)
-    limit_bytes = config.max_workspace_storage_mb * 1024 * 1024
+    used_bytes, file_count, limit_bytes = await asyncio.gather(
+        get_workspace_total_size(workspace.id),
+        count_workspace_files(workspace.id),
+        get_workspace_storage_limit_bytes(user_id),
+    )
 
     return StorageUsageResponse(
         used_bytes=used_bytes,

autogpt_platform/backend/backend/api/features/workspace/routes_test.py

@@ -151,15 +151,16 @@ def test_list_files_null_metadata_coerced_to_empty_dict(
 # -- upload_file metadata tests --
 
 
+@patch("backend.api.features.workspace.routes.get_workspace_storage_limit_bytes")
 @patch("backend.api.features.workspace.routes.get_or_create_workspace")
 @patch("backend.api.features.workspace.routes.get_workspace_total_size")
-@patch("backend.api.features.workspace.routes.scan_content_safe")
 @patch("backend.api.features.workspace.routes.WorkspaceManager")
 def test_upload_passes_user_upload_origin_metadata(
-    mock_manager_cls, mock_scan, mock_total_size, mock_get_workspace
+    mock_manager_cls, mock_total_size, mock_get_workspace, mock_storage_limit
 ):
     mock_get_workspace.return_value = _make_workspace()
     mock_total_size.return_value = 100
+    mock_storage_limit.return_value = 250 * 1024 * 1024
     written = _make_file(id="new-file", name="doc.pdf")
     mock_instance = AsyncMock()
     mock_instance.write_file.return_value = written
@@ -178,10 +179,9 @@ def test_upload_passes_user_upload_origin_metadata(
 
 @patch("backend.api.features.workspace.routes.get_or_create_workspace")
 @patch("backend.api.features.workspace.routes.get_workspace_total_size")
-@patch("backend.api.features.workspace.routes.scan_content_safe")
 @patch("backend.api.features.workspace.routes.WorkspaceManager")
 def test_upload_returns_409_on_file_conflict(
-    mock_manager_cls, mock_scan, mock_total_size, mock_get_workspace
+    mock_manager_cls, mock_total_size, mock_get_workspace
 ):
     mock_get_workspace.return_value = _make_workspace()
     mock_total_size.return_value = 100
@@ -234,8 +234,8 @@ def test_upload_happy_path(mocker):
         return_value=0,
     )
     mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
-        return_value=None,
+        "backend.api.features.workspace.routes.get_workspace_storage_limit_bytes",
+        return_value=250 * 1024 * 1024,
     )
     mock_manager = mocker.MagicMock()
     mock_manager.write_file = mocker.AsyncMock(return_value=_MOCK_FILE)
@@ -256,20 +256,24 @@ def test_upload_exceeds_max_file_size(mocker):
     """Files larger than max_file_size_mb should be rejected with 413."""
     cfg = mocker.patch("backend.api.features.workspace.routes.Config")
     cfg.return_value.max_file_size_mb = 0  # 0 MB → any content is too big
-    cfg.return_value.max_workspace_storage_mb = 500
 
     response = _upload(content=b"x" * 1024)
     assert response.status_code == 413
 
 
 def test_upload_storage_quota_exceeded(mocker):
+    """WorkspaceManager.write_file raises ValueError when quota exceeded → 413."""
     mocker.patch(
         "backend.api.features.workspace.routes.get_or_create_workspace",
         return_value=_make_workspace(),
     )
+    mock_manager = mocker.MagicMock()
+    mock_manager.write_file = mocker.AsyncMock(
+        side_effect=ValueError("Storage limit exceeded: 500 MB used of 250 MB (200.0%)")
+    )
     mocker.patch(
-        "backend.api.features.workspace.routes.get_workspace_total_size",
-        return_value=500 * 1024 * 1024,
+        "backend.api.features.workspace.routes.WorkspaceManager",
+        return_value=mock_manager,
     )
 
     response = _upload()
@@ -278,33 +282,33 @@ def test_upload_storage_quota_exceeded(mocker):
 
 
 def test_upload_post_write_quota_race(mocker):
-    """Concurrent upload tipping over limit after write should soft-delete + 413."""
+    """Concurrent upload tipping over limit after write should delete + 413."""
     mocker.patch(
         "backend.api.features.workspace.routes.get_or_create_workspace",
         return_value=_make_workspace(),
     )
+    # Post-write total exceeds the tier-based limit (250 MB for FREE).
     mocker.patch(
         "backend.api.features.workspace.routes.get_workspace_total_size",
-        side_effect=[0, 600 * 1024 * 1024],
+        return_value=600 * 1024 * 1024,
     )
     mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
-        return_value=None,
+        "backend.api.features.workspace.routes.get_workspace_storage_limit_bytes",
+        return_value=250 * 1024 * 1024,
     )
     mock_manager = mocker.MagicMock()
     mock_manager.write_file = mocker.AsyncMock(return_value=_MOCK_FILE)
+    mock_manager.delete_file = mocker.AsyncMock(return_value=True)
     mocker.patch(
         "backend.api.features.workspace.routes.WorkspaceManager",
         return_value=mock_manager,
     )
-    mock_delete = mocker.patch(
-        "backend.api.features.workspace.routes.soft_delete_workspace_file",
-        return_value=None,
-    )
 
     response = _upload()
     assert response.status_code == 413
-    mock_delete.assert_called_once_with("file-aaa-bbb", "ws-001")
+    # Rollback must go through manager.delete_file so the storage blob is removed,
+    # not just soft_delete_workspace_file (which would orphan the blob).
+    mock_manager.delete_file.assert_awaited_once_with("file-aaa-bbb")
 
 
 def test_upload_any_extension(mocker):
@@ -318,8 +322,8 @@ def test_upload_any_extension(mocker):
         return_value=0,
     )
     mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
-        return_value=None,
+        "backend.api.features.workspace.routes.get_workspace_storage_limit_bytes",
+        return_value=250 * 1024 * 1024,
     )
     mock_manager = mocker.MagicMock()
     mock_manager.write_file = mocker.AsyncMock(return_value=_MOCK_FILE)
@@ -333,23 +337,17 @@ def test_upload_any_extension(mocker):
 
 
 def test_upload_blocked_by_virus_scan(mocker):
-    """Files flagged by ClamAV should be rejected and never written to storage."""
+    """Files flagged by ClamAV should be rejected via WorkspaceManager."""
     from backend.api.features.store.exceptions import VirusDetectedError
 
     mocker.patch(
         "backend.api.features.workspace.routes.get_or_create_workspace",
         return_value=_make_workspace(),
     )
-    mocker.patch(
-        "backend.api.features.workspace.routes.get_workspace_total_size",
-        return_value=0,
-    )
-    mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
+    mock_manager = mocker.MagicMock()
+    mock_manager.write_file = mocker.AsyncMock(
         side_effect=VirusDetectedError("Eicar-Test-Signature"),
     )
-    mock_manager = mocker.MagicMock()
-    mock_manager.write_file = mocker.AsyncMock(return_value=_MOCK_FILE)
     mocker.patch(
         "backend.api.features.workspace.routes.WorkspaceManager",
         return_value=mock_manager,
@@ -357,7 +355,6 @@ def test_upload_blocked_by_virus_scan(mocker):
 
     response = _upload(filename="evil.exe", content=b"X5O!P%@AP...")
     assert response.status_code == 400
-    mock_manager.write_file.assert_not_called()
 
 
 def test_upload_file_without_extension(mocker):
@@ -371,8 +368,8 @@ def test_upload_file_without_extension(mocker):
         return_value=0,
     )
     mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
-        return_value=None,
+        "backend.api.features.workspace.routes.get_workspace_storage_limit_bytes",
+        return_value=250 * 1024 * 1024,
     )
     mock_manager = mocker.MagicMock()
     mock_manager.write_file = mocker.AsyncMock(return_value=_MOCK_FILE)
@@ -402,8 +399,8 @@ def test_upload_strips_path_components(mocker):
         return_value=0,
     )
     mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
-        return_value=None,
+        "backend.api.features.workspace.routes.get_workspace_storage_limit_bytes",
+        return_value=250 * 1024 * 1024,
     )
     mock_manager = mocker.MagicMock()
     mock_manager.write_file = mocker.AsyncMock(return_value=_MOCK_FILE)
@@ -488,14 +485,6 @@ def test_upload_write_file_too_large_returns_413(mocker):
         "backend.api.features.workspace.routes.get_or_create_workspace",
         return_value=_make_workspace(),
     )
-    mocker.patch(
-        "backend.api.features.workspace.routes.get_workspace_total_size",
-        return_value=0,
-    )
-    mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
-        return_value=None,
-    )
     mock_manager = mocker.MagicMock()
     mock_manager.write_file = mocker.AsyncMock(
         side_effect=ValueError("File too large: 900 bytes exceeds 1MB limit")
@@ -516,14 +505,6 @@ def test_upload_write_file_conflict_returns_409(mocker):
         "backend.api.features.workspace.routes.get_or_create_workspace",
         return_value=_make_workspace(),
     )
-    mocker.patch(
-        "backend.api.features.workspace.routes.get_workspace_total_size",
-        return_value=0,
-    )
-    mocker.patch(
-        "backend.api.features.workspace.routes.scan_content_safe",
-        return_value=None,
-    )
     mock_manager = mocker.MagicMock()
     mock_manager.write_file = mocker.AsyncMock(
         side_effect=ValueError("File already exists at path: /sessions/x/a.txt")
@@ -602,6 +583,54 @@ def test_list_files_offset_is_echoed_back(mock_manager_cls, mock_get_workspace):
     )
 
 
+def test_upload_virus_scan_infrastructure_error_returns_500(mocker):
+    """VirusScanError (ClamAV outage) should return 500, not 409."""
+    from backend.api.features.store.exceptions import VirusScanError
+
+    mocker.patch(
+        "backend.api.features.workspace.routes.get_or_create_workspace",
+        return_value=_make_workspace(),
+    )
+    mock_manager = mocker.MagicMock()
+    mock_manager.write_file = mocker.AsyncMock(
+        side_effect=VirusScanError("ClamAV connection refused"),
+    )
+    mocker.patch(
+        "backend.api.features.workspace.routes.WorkspaceManager",
+        return_value=mock_manager,
+    )
+
+    response = _upload()
+    assert response.status_code == 500
+
+
+def test_get_storage_usage_returns_tier_based_limit(mocker):
+    """get_storage_usage should return the user's tier-based limit, not a static config."""
+    mocker.patch(
+        "backend.api.features.workspace.routes.get_or_create_workspace",
+        return_value=_make_workspace(),
+    )
+    mocker.patch(
+        "backend.api.features.workspace.routes.get_workspace_total_size",
+        return_value=100 * 1024 * 1024,  # 100 MB used
+    )
+    mocker.patch(
+        "backend.api.features.workspace.routes.count_workspace_files",
+        return_value=5,
+    )
+    mocker.patch(
+        "backend.api.features.workspace.routes.get_workspace_storage_limit_bytes",
+        return_value=1024 * 1024 * 1024,  # 1 GB (PRO tier)
+    )
+
+    response = client.get("/storage/usage")
+    assert response.status_code == 200
+    data = response.json()
+    assert data["limit_bytes"] == 1024 * 1024 * 1024
+    assert data["used_bytes"] == 100 * 1024 * 1024
+    assert data["file_count"] == 5
+
+
 # -- _sanitize_filename_for_header tests --
 
 

autogpt_platform/backend/backend/api/rest_api.py

@@ -34,6 +34,7 @@ import backend.api.features.oauth
 import backend.api.features.otto.routes
 import backend.api.features.platform_linking.routes
 import backend.api.features.postmark.postmark
+import backend.api.features.push.routes as push_routes
 import backend.api.features.store.model
 import backend.api.features.store.routes
 import backend.api.features.v1
@@ -41,6 +42,7 @@ import backend.api.features.workspace.routes as workspace_routes
 import backend.data.block
 import backend.data.db
 import backend.data.graph
+import backend.data.redis_client
 import backend.data.user
 import backend.integrations.webhooks.utils
 import backend.util.service
@@ -95,6 +97,8 @@ async def lifespan_context(app: fastapi.FastAPI):
     verify_auth_settings()
 
     await backend.data.db.connect()
+    # Eager connect to fail-fast if Redis is unreachable.
+    await backend.data.redis_client.get_redis_async()
 
     # Configure thread pool for FastAPI sync operation performance
     # CRITICAL: FastAPI automatically runs ALL sync functions in this thread pool:
@@ -146,7 +150,18 @@ async def lifespan_context(app: fastapi.FastAPI):
     except Exception as e:
         logger.warning(f"Error shutting down workspace storage: {e}")
 
-    await backend.data.db.disconnect()
+    # Each cleanup is wrapped so one failure doesn't block the rest. The
+    # Redis close in particular silences asyncio's "Unclosed ClusterNode"
+    # GC warning at interpreter shutdown.
+    try:
+        await backend.data.redis_client.disconnect_async()
+    except Exception:
+        logger.warning("redis_client.disconnect_async failed", exc_info=True)
+
+    try:
+        await backend.data.db.disconnect()
+    except Exception:
+        logger.warning("db.disconnect failed", exc_info=True)
 
 
 def custom_generate_unique_id(route: APIRoute):
@@ -379,6 +394,11 @@ app.include_router(
     tags=["oauth"],
     prefix="/api/oauth",
 )
+app.include_router(
+    push_routes.router,
+    tags=["push"],
+    prefix="/api/push",
+)
 app.include_router(
     backend.api.features.platform_linking.routes.router,
     tags=["platform-linking"],

autogpt_platform/backend/backend/api/ws_api.py

@@ -1,4 +1,3 @@
-import asyncio
 import logging
 from contextlib import asynccontextmanager
 from typing import Protocol
@@ -17,14 +16,12 @@ from backend.api.model import (
     WSSubscribeGraphExecutionsRequest,
 )
 from backend.api.utils.cors import build_cors_params
-from backend.data.execution import AsyncRedisExecutionEventBus
-from backend.data.notification_bus import AsyncRedisNotificationEventBus
+from backend.data import db, redis_client
 from backend.data.user import DEFAULT_USER_ID
 from backend.monitoring.instrumentation import (
     instrument_fastapi,
     update_websocket_connections,
 )
-from backend.util.retry import continuous_retry
 from backend.util.service import AppProcess
 from backend.util.settings import AppEnvironment, Config, Settings
 
@@ -34,10 +31,24 @@ settings = Settings()
 
 @asynccontextmanager
 async def lifespan(app: FastAPI):
-    manager = get_connection_manager()
-    fut = asyncio.create_task(event_broadcaster(manager))
-    fut.add_done_callback(lambda _: logger.info("Event broadcaster stopped"))
-    yield
+    # Prisma is needed to resolve graph_id from graph_exec_id on subscribe.
+    await db.connect()
+    # Eager connect to fail-fast if Redis is unreachable.
+    await redis_client.get_redis_async()
+    try:
+        yield
+    finally:
+        # Each cleanup is wrapped so one failure doesn't block the rest. The
+        # Redis close silences asyncio's "Unclosed ClusterNode" GC warning at
+        # interpreter shutdown.
+        try:
+            await redis_client.disconnect_async()
+        except Exception:
+            logger.warning("redis_client.disconnect_async failed", exc_info=True)
+        try:
+            await db.disconnect()
+        except Exception:
+            logger.warning("db.disconnect failed", exc_info=True)
 
 
 docs_url = "/docs" if settings.config.app_env == AppEnvironment.LOCAL else None
@@ -61,31 +72,6 @@ def get_connection_manager():
     return _connection_manager
 
 
-@continuous_retry()
-async def event_broadcaster(manager: ConnectionManager):
-    execution_bus = AsyncRedisExecutionEventBus()
-    notification_bus = AsyncRedisNotificationEventBus()
-
-    try:
-
-        async def execution_worker():
-            async for event in execution_bus.listen("*"):
-                await manager.send_execution_update(event)
-
-        async def notification_worker():
-            async for notification in notification_bus.listen("*"):
-                await manager.send_notification(
-                    user_id=notification.user_id,
-                    payload=notification.payload,
-                )
-
-        await asyncio.gather(execution_worker(), notification_worker())
-    finally:
-        # Ensure PubSub connections are closed on any exit to prevent leaks
-        await execution_bus.close()
-        await notification_bus.close()
-
-
 async def authenticate_websocket(websocket: WebSocket) -> str:
     if not settings.config.enable_auth:
         return DEFAULT_USER_ID
@@ -297,6 +283,21 @@ async def websocket_router(
                     ).model_dump_json()
                 )
                 continue
+            except ValueError as e:
+                logger.warning(
+                    "Subscription rejected for user #%s on '%s': %s",
+                    user_id,
+                    message.method.value,
+                    e,
+                )
+                await websocket.send_text(
+                    WSMessage(
+                        method=WSMethod.ERROR,
+                        success=False,
+                        error=str(e),
+                    ).model_dump_json()
+                )
+                continue
             except Exception as e:
                 logger.error(
                     f"Error while handling '{message.method.value}' message "
@@ -321,9 +322,13 @@ async def websocket_router(
                 )
 
     except WebSocketDisconnect:
-        manager.disconnect_socket(websocket, user_id=user_id)
         logger.debug("WebSocket client disconnected")
+    except Exception:
+        logger.exception(f"Unexpected error in websocket_router for user #{user_id}")
     finally:
+        # Always release subscription pumps + Redis connections, regardless of how
+        # the loop exited — otherwise non-WebSocketDisconnect failures leak both.
+        await manager.disconnect_socket(websocket, user_id=user_id)
         update_websocket_connections(user_id, -1)
 
 

autogpt_platform/backend/backend/api/ws_api_test.py

@@ -44,9 +44,12 @@ def test_websocket_server_uses_cors_helper(mocker) -> None:
         "backend.api.ws_api.build_cors_params", return_value=cors_params
     )
 
-    with override_config(
-        settings, "backend_cors_allow_origins", cors_params["allow_origins"]
-    ), override_config(settings, "app_env", AppEnvironment.LOCAL):
+    with (
+        override_config(
+            settings, "backend_cors_allow_origins", cors_params["allow_origins"]
+        ),
+        override_config(settings, "app_env", AppEnvironment.LOCAL),
+    ):
         WebsocketServer().run()
 
     build_cors.assert_called_once_with(
@@ -65,9 +68,12 @@ def test_websocket_server_uses_cors_helper(mocker) -> None:
 def test_websocket_server_blocks_localhost_in_production(mocker) -> None:
     mocker.patch("backend.api.ws_api.uvicorn.run")
 
-    with override_config(
-        settings, "backend_cors_allow_origins", ["http://localhost:3000"]
-    ), override_config(settings, "app_env", AppEnvironment.PRODUCTION):
+    with (
+        override_config(
+            settings, "backend_cors_allow_origins", ["http://localhost:3000"]
+        ),
+        override_config(settings, "app_env", AppEnvironment.PRODUCTION),
+    ):
         with pytest.raises(ValueError):
             WebsocketServer().run()
 
@@ -290,7 +296,232 @@ async def test_handle_unsubscribe_missing_data(
         message=message,
     )
 
-    mock_manager._unsubscribe.assert_not_called()
+    mock_manager.unsubscribe_graph_exec.assert_not_called()
     mock_websocket.send_text.assert_called_once()
     assert '"method":"error"' in mock_websocket.send_text.call_args[0][0]
     assert '"success":false' in mock_websocket.send_text.call_args[0][0]
+
+
+# ---------- Per-graph subscribe branch ----------
+
+
+@pytest.mark.asyncio
+async def test_handle_subscribe_graph_execs_branch(
+    mock_websocket: AsyncMock, mock_manager: AsyncMock
+) -> None:
+    """The SUBSCRIBE_GRAPH_EXECS branch must route to subscribe_graph_execs,
+    not subscribe_graph_exec — regression guard for the aggregate channel."""
+    message = WSMessage(
+        method=WSMethod.SUBSCRIBE_GRAPH_EXECS,
+        data={"graph_id": "graph-abc"},
+    )
+    mock_manager.subscribe_graph_execs.return_value = (
+        "user-1|graph#graph-abc|executions"
+    )
+
+    await handle_subscribe(
+        connection_manager=cast(ConnectionManager, mock_manager),
+        websocket=cast(WebSocket, mock_websocket),
+        user_id="user-1",
+        message=message,
+    )
+
+    mock_manager.subscribe_graph_execs.assert_called_once_with(
+        user_id="user-1",
+        graph_id="graph-abc",
+        websocket=mock_websocket,
+    )
+    mock_manager.subscribe_graph_exec.assert_not_called()
+    mock_websocket.send_text.assert_called_once()
+    assert (
+        '"method":"subscribe_graph_executions"'
+        in mock_websocket.send_text.call_args[0][0]
+    )
+    assert '"success":true' in mock_websocket.send_text.call_args[0][0]
+
+
+@pytest.mark.asyncio
+async def test_handle_subscribe_rejects_unrelated_method(
+    mock_websocket: AsyncMock, mock_manager: AsyncMock
+) -> None:
+    """handle_subscribe must raise for methods that aren't SUBSCRIBE_*."""
+    import pytest as _pytest
+
+    message = WSMessage(
+        method=WSMethod.HEARTBEAT,
+        data={"graph_exec_id": "x"},
+    )
+
+    with _pytest.raises(ValueError):
+        await handle_subscribe(
+            connection_manager=cast(ConnectionManager, mock_manager),
+            websocket=cast(WebSocket, mock_websocket),
+            user_id="user-1",
+            message=message,
+        )
+
+
+# ---------- authenticate_websocket branches ----------
+
+
+@pytest.mark.asyncio
+async def test_authenticate_websocket_missing_token_closes_4001(mocker) -> None:
+    from backend.api.ws_api import authenticate_websocket
+
+    mocker.patch.object(settings.config, "enable_auth", True)
+    ws = AsyncMock(spec=WebSocket)
+    ws.query_params = {}
+
+    user_id = await authenticate_websocket(ws)
+
+    ws.close.assert_awaited_once()
+    assert ws.close.call_args.kwargs["code"] == 4001
+    assert user_id == ""
+
+
+@pytest.mark.asyncio
+async def test_authenticate_websocket_invalid_token_closes_4003(mocker) -> None:
+    from backend.api.ws_api import authenticate_websocket
+
+    mocker.patch.object(settings.config, "enable_auth", True)
+    mocker.patch(
+        "backend.api.ws_api.parse_jwt_token", side_effect=ValueError("bad token")
+    )
+    ws = AsyncMock(spec=WebSocket)
+    ws.query_params = {"token": "abc"}
+
+    user_id = await authenticate_websocket(ws)
+
+    ws.close.assert_awaited_once()
+    assert ws.close.call_args.kwargs["code"] == 4003
+    assert user_id == ""
+
+
+@pytest.mark.asyncio
+async def test_authenticate_websocket_missing_sub_closes_4002(mocker) -> None:
+    from backend.api.ws_api import authenticate_websocket
+
+    mocker.patch.object(settings.config, "enable_auth", True)
+    mocker.patch("backend.api.ws_api.parse_jwt_token", return_value={"not_sub": "x"})
+    ws = AsyncMock(spec=WebSocket)
+    ws.query_params = {"token": "abc"}
+
+    user_id = await authenticate_websocket(ws)
+
+    ws.close.assert_awaited_once()
+    assert ws.close.call_args.kwargs["code"] == 4002
+    assert user_id == ""
+
+
+@pytest.mark.asyncio
+async def test_authenticate_websocket_happy_path_returns_sub(mocker) -> None:
+    from backend.api.ws_api import authenticate_websocket
+
+    mocker.patch.object(settings.config, "enable_auth", True)
+    mocker.patch("backend.api.ws_api.parse_jwt_token", return_value={"sub": "user-X"})
+    ws = AsyncMock(spec=WebSocket)
+    ws.query_params = {"token": "abc"}
+
+    user_id = await authenticate_websocket(ws)
+
+    assert user_id == "user-X"
+
+
+@pytest.mark.asyncio
+async def test_authenticate_websocket_auth_disabled_returns_default(mocker) -> None:
+    from backend.api.ws_api import authenticate_websocket
+
+    mocker.patch.object(settings.config, "enable_auth", False)
+    ws = AsyncMock(spec=WebSocket)
+    ws.query_params = {}
+
+    user_id = await authenticate_websocket(ws)
+
+    assert user_id == DEFAULT_USER_ID
+
+
+# ---------- get_connection_manager singleton ----------
+
+
+def test_get_connection_manager_singleton() -> None:
+    """Repeated calls must return the same ConnectionManager — the WS router
+    depends on a single process-wide subscription table."""
+    import backend.api.ws_api as ws_api
+
+    ws_api._connection_manager = None
+    a = ws_api.get_connection_manager()
+    b = ws_api.get_connection_manager()
+    assert a is b
+    assert isinstance(a, ConnectionManager)
+
+
+# ---------- Lifespan: Prisma connect/disconnect ----------
+
+
+@pytest.mark.asyncio
+async def test_lifespan_connects_and_disconnects_prisma(mocker) -> None:
+    """Lifespan must both connect() and disconnect() db — the subscribe path
+    resolves graph_id via Prisma so a missing connect() is the regression bug."""
+    from fastapi import FastAPI
+
+    from backend.api.ws_api import lifespan
+
+    mock_db = mocker.patch("backend.api.ws_api.db")
+    mock_db.connect = AsyncMock()
+    mock_db.disconnect = AsyncMock()
+
+    dummy_app = FastAPI()
+    async with lifespan(dummy_app):
+        mock_db.connect.assert_awaited_once()
+        mock_db.disconnect.assert_not_called()
+    mock_db.disconnect.assert_awaited_once()
+
+
+@pytest.mark.asyncio
+async def test_lifespan_still_disconnects_on_exception(mocker) -> None:
+    """If the app raises inside the yield, Prisma must still disconnect."""
+    from fastapi import FastAPI
+
+    from backend.api.ws_api import lifespan
+
+    mock_db = mocker.patch("backend.api.ws_api.db")
+    mock_db.connect = AsyncMock()
+    mock_db.disconnect = AsyncMock()
+
+    dummy_app = FastAPI()
+
+    class _Boom(Exception):
+        pass
+
+    with pytest.raises(_Boom):
+        async with lifespan(dummy_app):
+            raise _Boom()
+
+    mock_db.disconnect.assert_awaited_once()
+
+
+# ---------- Health endpoint ----------
+
+
+def test_health_endpoint_returns_ok() -> None:
+    # TestClient triggers lifespan — stub it out so Prisma isn't hit.
+    from contextlib import asynccontextmanager
+
+    from fastapi.testclient import TestClient
+
+    import backend.api.ws_api as ws_api
+
+    @asynccontextmanager
+    async def _noop_lifespan(app):
+        yield
+
+    # Replace the app-level lifespan temporarily.
+    real_router_lifespan = ws_api.app.router.lifespan_context
+    ws_api.app.router.lifespan_context = _noop_lifespan
+    try:
+        with TestClient(ws_api.app) as client:
+            r = client.get("/")
+        assert r.status_code == 200
+        assert r.json() == {"status": "healthy"}
+    finally:
+        ws_api.app.router.lifespan_context = real_router_lifespan

autogpt_platform/backend/backend/app.py

@@ -38,6 +38,7 @@ def main(**kwargs):
 
     from backend.api.rest_api import AgentServer
     from backend.api.ws_api import WebsocketServer
+    from backend.copilot.bot.app import CoPilotChatBridge
     from backend.copilot.executor.manager import CoPilotExecutor
     from backend.data.db_manager import DatabaseManager
     from backend.executor import ExecutionManager, Scheduler
@@ -53,6 +54,7 @@ def main(**kwargs):
         AgentServer(),
         ExecutionManager(),
         CoPilotExecutor(),
+        CoPilotChatBridge(),
         **kwargs,
     )
 

autogpt_platform/backend/backend/blocks/_base.py

@@ -96,27 +96,64 @@ class BlockCategory(Enum):
 
 
 class BlockCostType(str, Enum):
-    RUN = "run"  # cost X credits per run
-    BYTE = "byte"  # cost X credits per byte
-    SECOND = "second"  # cost X credits per second
+    # RUN       : cost_amount credits per run.
+    # BYTE      : cost_amount credits per byte of input data.
+    # SECOND    : cost_amount credits per cost_divisor walltime seconds.
+    # ITEMS     : cost_amount credits per cost_divisor items (from stats).
+    # COST_USD  : cost_amount credits per USD of stats.provider_cost.
+    # TOKENS    : per-(model, provider) rate table lookup; see TOKEN_COST.
+    RUN = "run"
+    BYTE = "byte"
+    SECOND = "second"
+    ITEMS = "items"
+    COST_USD = "cost_usd"
+    TOKENS = "tokens"
+
+    @property
+    def is_dynamic(self) -> bool:
+        """Real charge is computed post-flight from stats.
+
+        Dynamic types (SECOND/ITEMS/COST_USD/TOKENS) return 0 pre-flight and
+        settle against stats via charge_reconciled_usage once the block runs.
+        """
+        return self in _DYNAMIC_COST_TYPES
+
+
+_DYNAMIC_COST_TYPES: frozenset[BlockCostType] = frozenset(
+    {
+        BlockCostType.SECOND,
+        BlockCostType.ITEMS,
+        BlockCostType.COST_USD,
+        BlockCostType.TOKENS,
+    }
+)
 
 
 class BlockCost(BaseModel):
     cost_amount: int
     cost_filter: BlockInput
     cost_type: BlockCostType
+    # cost_divisor: interpret cost_amount as "credits per cost_divisor units".
+    # Only meaningful for SECOND / ITEMS. TOKENS routes through TOKEN_COST
+    # rate tables (per-model input/output/cache pricing) and ignores
+    # cost_divisor entirely. Defaults to 1 so existing RUN/BYTE entries stay
+    # point-wise. Example: cost_amount=1, cost_divisor=10 under SECOND means
+    # "1 credit per 10 seconds of walltime".
+    cost_divisor: int = 1
 
     def __init__(
         self,
         cost_amount: int,
         cost_type: BlockCostType = BlockCostType.RUN,
         cost_filter: Optional[BlockInput] = None,
+        cost_divisor: int = 1,
         **data: Any,
     ) -> None:
         super().__init__(
             cost_amount=cost_amount,
             cost_filter=cost_filter or {},
             cost_type=cost_type,
+            cost_divisor=max(1, cost_divisor),
             **data,
         )
 
@@ -333,6 +370,8 @@ class BlockSchema(BaseModel):
                 "credentials_provider": [config.get("provider", "google")],
                 "credentials_types": [config.get("type", "oauth2")],
                 "credentials_scopes": config.get("scopes"),
+                "is_auto_credential": True,
+                "input_field_name": info["field_name"],
             }
             result[kwarg_name] = CredentialsFieldInfo.model_validate(
                 auto_schema, by_alias=True
@@ -443,19 +482,6 @@ class BlockWebhookConfig(BlockManualWebhookConfig):
 class Block(ABC, Generic[BlockSchemaInputType, BlockSchemaOutputType]):
     _optimized_description: ClassVar[str | None] = None
 
-    def extra_runtime_cost(self, execution_stats: NodeExecutionStats) -> int:
-        """Return extra runtime cost to charge after this block run completes.
-
-        Called by the executor after a block finishes with COMPLETED status.
-        The return value is the number of additional base-cost credits to
-        charge beyond the single credit already collected by charge_usage
-        at the start of execution. Defaults to 0 (no extra charges).
-
-        Override in blocks (e.g. OrchestratorBlock) that make multiple LLM
-        calls within one run and should be billed per call.
-        """
-        return 0
-
     def __init__(
         self,
         id: str = "",
@@ -762,6 +788,61 @@ class Block(ABC, Generic[BlockSchemaInputType, BlockSchemaOutputType]):
                     block_id=self.id,
                 )
 
+        # Ensure auto-credential kwargs are present before we hand off to
+        # run(). A missing auto-credential means the upstream field (e.g.
+        # a Google Drive picker) didn't embed a _credentials_id, or the
+        # executor couldn't resolve it. Without this guard, run() would
+        # crash with a TypeError (missing required kwarg) or an opaque
+        # AttributeError deep inside the provider SDK.
+        #
+        # Only raise when the field is ALSO not populated in input_data.
+        # ``_acquire_auto_credentials`` intentionally skips setting the
+        # kwarg in two legitimate cases — ``_credentials_id`` is ``None``
+        # (chained from upstream) or the field is missing from
+        # ``input_data`` at prep time (connected from upstream block).
+        # In both cases the upstream block is expected to populate the
+        # field value by execute time; raising here would break the
+        # documented ``AgentGoogleDriveFileInputBlock`` chaining pattern.
+        # Dry-run skips because the executor intentionally runs blocks
+        # without resolved creds for schema validation.
+        if not is_dry_run:
+            for (
+                kwarg_name,
+                info,
+            ) in self.input_schema.get_auto_credentials_fields().items():
+                kwargs.setdefault(kwarg_name, None)
+                if kwargs[kwarg_name] is not None:
+                    continue
+                # Upstream-chained pattern: the field was populated by a
+                # prior node (e.g. AgentGoogleDriveFileInputBlock) whose
+                # output carries a resolved ``_credentials_id``.
+                # ``_acquire_auto_credentials`` deliberately doesn't set
+                # the kwarg in that case because the value isn't available
+                # at prep time; the executor fills it in before we reach
+                # ``_execute``. Trust it if the ``_credentials_id`` KEY
+                # is present — its value may be explicitly ``None`` in
+                # the chained case (see sentry thread
+                # PRRT_kwDOJKSTjM58sJfA). Checking truthiness here would
+                # falsely preempt run() for every valid chained graph
+                # that ships ``_credentials_id=None`` in the picker
+                # object. Mirror ``_acquire_auto_credentials``'s own
+                # skip rule, which treats ``cred_id is None`` as a
+                # chained-skip signal.
+                field_name = info["field_name"]
+                field_value = input_data.get(field_name)
+                if isinstance(field_value, dict) and "_credentials_id" in field_value:
+                    continue
+                raise BlockExecutionError(
+                    message=(
+                        f"Missing credentials for '{kwarg_name}'. "
+                        "Select a file via the picker (which carries "
+                        "its credentials), or connect credentials for "
+                        "this block."
+                    ),
+                    block_name=self.name,
+                    block_id=self.id,
+                )
+
         # Use the validated input data
         async for output_name, output_data in self.run(
             self.input_schema(**{k: v for k, v in input_data.items() if v is not None}),

autogpt_platform/backend/backend/blocks/_static_provider_configs.py

@@ -0,0 +1,56 @@
+"""Provider descriptions for services that don't yet have their own ``_config.py``.
+
+Every provider in ``_STATIC_PROVIDER_CONFIGS`` below is declared here because
+its block code currently lives either in a single shared file (e.g. the 8 LLM
+providers in ``blocks/llm.py``) or in a single-file block that has no dedicated
+directory (e.g. ``blocks/reddit.py``).
+
+This file gets loaded by the block auto-loader in ``blocks/__init__.py``
+(``rglob("*.py")`` picks it up) so the ``ProviderBuilder(...).build()`` calls
+run at startup and populate ``AutoRegistry`` before the first API request.
+
+**Migration path:** when a provider graduates into its own directory with a
+proper ``_config.py`` (following the SDK pattern, e.g. ``blocks/linear/_config.py``),
+delete its entry here. The metadata will still be served by
+``GET /integrations/providers`` — it just moves to live next to the provider's
+auth and webhook config.
+"""
+
+from backend.data.model import CredentialsType
+from backend.sdk import ProviderBuilder
+
+_STATIC_PROVIDER_CONFIGS: dict[str, tuple[str, tuple[CredentialsType, ...]]] = {
+    # LLM providers that share blocks/llm.py
+    "aiml_api": ("Unified access to 100+ AI models", ("api_key",)),
+    "anthropic": ("Claude language models", ("api_key",)),
+    "groq": ("Fast LLM inference", ("api_key",)),
+    "llama_api": ("Llama model hosting", ("api_key",)),
+    "ollama": ("Run open-source LLMs locally", ("api_key",)),
+    "open_router": ("One API for every LLM", ("api_key",)),
+    "openai": ("GPT models and embeddings", ("api_key",)),
+    "v0": ("AI-generated UI components", ("api_key",)),
+    # Single-file providers (one provider per standalone blocks/*.py file)
+    "d_id": ("AI avatar and video generation", ("api_key",)),
+    "e2b": ("Sandboxed code execution", ("api_key",)),
+    "google_maps": ("Places, directions, geocoding", ("api_key",)),
+    "http": ("Generic HTTP requests", ("api_key", "host_scoped")),
+    "ideogram": ("Text-to-image generation", ("api_key",)),
+    "medium": ("Publish stories and posts", ("api_key",)),
+    "mem0": ("Long-term memory for agents", ("api_key",)),
+    "openweathermap": ("Weather data and forecasts", ("api_key",)),
+    "pinecone": ("Managed vector database", ("api_key",)),
+    "reddit": ("Subreddits, posts, and comments", ("oauth2",)),
+    "revid": ("AI-generated short-form video", ("api_key",)),
+    "screenshotone": ("Automated website screenshots", ("api_key",)),
+    "smtp": ("Send email via SMTP", ("user_password",)),
+    "unreal_speech": ("Low-cost text-to-speech", ("api_key",)),
+    "webshare_proxy": ("Rotating proxies for scraping", ("api_key",)),
+}
+
+for _name, (_description, _auth_types) in _STATIC_PROVIDER_CONFIGS.items():
+    (
+        ProviderBuilder(_name)
+        .with_description(_description)
+        .with_supported_auth_types(*_auth_types)
+        .build()
+    )

autogpt_platform/backend/backend/blocks/agent.py

@@ -171,7 +171,10 @@ class AgentExecutorBlock(Block):
                 )
                 self.merge_stats(
                     NodeExecutionStats(
-                        extra_cost=event.stats.cost if event.stats else 0,
+                        # Sub-graph already debited each of its own nodes; we
+                        # roll up its total so graph_stats.cost reflects the
+                        # full sub-graph spend.
+                        reconciled_cost_delta=(event.stats.cost if event.stats else 0),
                         extra_steps=event.stats.node_exec_count if event.stats else 0,
                     )
                 )

autogpt_platform/backend/backend/blocks/agent_mail/_config.py

@@ -4,11 +4,17 @@ Shared configuration for all AgentMail blocks.
 
 from agentmail import AsyncAgentMail
 
-from backend.sdk import APIKeyCredentials, ProviderBuilder, SecretStr
+from backend.sdk import APIKeyCredentials, BlockCostType, ProviderBuilder, SecretStr
 
+# AgentMail is in beta with no published paid tier yet, but ~37 blocks
+# without any BLOCK_COSTS entry means they currently execute wallet-free.
+# 1 cr/call is a conservative interim floor so no AgentMail work leaks
+# past billing. Revisit once AgentMail publishes usage-based pricing.
 agent_mail = (
     ProviderBuilder("agent_mail")
+    .with_description("Managed email accounts for agents")
     .with_api_key("AGENTMAIL_API_KEY", "AgentMail API Key")
+    .with_base_cost(1, BlockCostType.RUN)
     .build()
 )
 

autogpt_platform/backend/backend/blocks/airtable/_config.py

@@ -10,6 +10,7 @@ from ._webhook import AirtableWebhookManager
 # Configure the Airtable provider with API key authentication
 airtable = (
     ProviderBuilder("airtable")
+    .with_description("Bases, tables, and records")
     .with_api_key("AIRTABLE_API_KEY", "Airtable Personal Access Token")
     .with_webhook_manager(AirtableWebhookManager)
     .with_base_cost(1, BlockCostType.RUN)

autogpt_platform/backend/backend/blocks/apollo/_config.py

@@ -0,0 +1,15 @@
+"""Provider registration for Apollo.
+
+Registers the provider description shown in the settings integrations UI.
+Apollo doesn't use a full :class:`ProviderBuilder` chain (auth is set up in
+``_auth.py``), so this file only declares metadata.
+"""
+
+from backend.sdk import ProviderBuilder
+
+apollo = (
+    ProviderBuilder("apollo")
+    .with_description("Sales intelligence and prospecting")
+    .with_supported_auth_types("api_key")
+    .build()
+)

autogpt_platform/backend/backend/blocks/autopilot.py

@@ -7,6 +7,7 @@ import logging
 import uuid
 from typing import TYPE_CHECKING, Any
 
+from pydantic import field_validator
 from typing_extensions import TypedDict  # Needed for Python <3.12 compatibility
 
 from backend.blocks._base import (
@@ -17,6 +18,7 @@ from backend.blocks._base import (
     BlockSchemaOutput,
 )
 from backend.copilot.permissions import (
+    DISABLED_LEGACY_TOOL_NAMES,
     CopilotPermissions,
     ToolName,
     all_known_tool_names,
@@ -198,6 +200,13 @@ class AutoPilotBlock(Block):
         # timeouts internally; wrapping with asyncio.timeout corrupts the
         # SDK's internal stream (see service.py CRITICAL comment).
 
+        @field_validator("tools", mode="before")
+        @classmethod
+        def strip_disabled_legacy_tools(cls, tools: Any) -> Any:
+            if not isinstance(tools, list):
+                return tools
+            return [tool for tool in tools if tool not in DISABLED_LEGACY_TOOL_NAMES]
+
     class Output(BlockSchemaOutput):
         """Output schema for the AutoPilot block."""
 

autogpt_platform/backend/backend/blocks/autopilot_permissions_test.py

@@ -62,6 +62,14 @@ class TestBuildAndValidatePermissions:
         with pytest.raises(ValidationError, match="not_a_real_tool"):
             _make_input(tools=["not_a_real_tool"])
 
+    async def test_disabled_legacy_tool_is_accepted_and_removed(self):
+        inp = _make_input(tools=["ask_question", "run_block"])
+        result = await _build_and_validate_permissions(inp)
+
+        assert inp.tools == ["run_block"]
+        assert isinstance(result, CopilotPermissions)
+        assert result.tools == ["run_block"]
+
     async def test_valid_block_name_accepted(self):
         mock_block_cls = MagicMock()
         mock_block_cls.return_value.name = "HTTP Request"

autogpt_platform/backend/backend/blocks/ayrshare/_config.py

@@ -0,0 +1,26 @@
+"""Shared provider config for Ayrshare social-media blocks.
+
+The "credential" exposed to blocks is the **per-user Ayrshare profile key**,
+not the org-level ``AYRSHARE_API_KEY``.  Profile keys are provisioned per
+user by :class:`~backend.integrations.managed_providers.ayrshare.AyrshareManagedProvider`
+and stored in the normal credentials list with ``is_managed=True``, so every
+Ayrshare block fits the standard credential flow:
+
+    credentials: CredentialsMetaInput = ayrshare.credentials_field(...)
+
+``run_block`` / ``resolve_block_credentials`` take care of the rest.
+
+``with_managed_api_key()`` registers ``api_key`` as a supported auth type
+without the env-var-backed default credential that ``with_api_key()`` would
+create — the org-level ``AYRSHARE_API_KEY`` is the admin key and must never
+reach a block as a "profile key".
+"""
+
+from backend.sdk import ProviderBuilder
+
+ayrshare = (
+    ProviderBuilder("ayrshare")
+    .with_description("Post to every social network")
+    .with_managed_api_key()
+    .build()
+)

autogpt_platform/backend/backend/blocks/ayrshare/_cost.py

@@ -0,0 +1,18 @@
+from backend.sdk import BlockCost, BlockCostType
+
+# Ayrshare is a subscription proxy ($149/mo Business). Per-post credit charges
+# prevent a single heavy user from absorbing the fixed cost and align with the
+# upload cost of each post variant.
+# cost_filter matches on input_data.is_video BEFORE run() executes, so the flag
+# has to be correct at input-eval time. Video-only platforms (YouTube, Snapchat)
+# override the base default to True; platforms that accept both (TikTok, etc.)
+# rely on the caller setting is_video explicitly for accurate billing.
+# First match wins in block_usage_cost, so list the video tier first.
+AYRSHARE_POST_COSTS = (
+    BlockCost(
+        cost_amount=5, cost_type=BlockCostType.RUN, cost_filter={"is_video": True}
+    ),
+    BlockCost(
+        cost_amount=2, cost_type=BlockCostType.RUN, cost_filter={"is_video": False}
+    ),
+)

autogpt_platform/backend/backend/blocks/ayrshare/_util.py

@@ -4,22 +4,25 @@ from typing import Optional
 from pydantic import BaseModel, Field
 
 from backend.blocks._base import BlockSchemaInput
-from backend.data.model import SchemaField, UserIntegrations
+from backend.data.model import CredentialsMetaInput, SchemaField
 from backend.integrations.ayrshare import AyrshareClient
-from backend.util.clients import get_database_manager_async_client
 from backend.util.exceptions import MissingConfigError
 
-
-async def get_profile_key(user_id: str):
-    user_integrations: UserIntegrations = (
-        await get_database_manager_async_client().get_user_integrations(user_id)
-    )
-    return user_integrations.managed_credentials.ayrshare_profile_key
+from ._config import ayrshare
 
 
 class BaseAyrshareInput(BlockSchemaInput):
     """Base input model for Ayrshare social media posts with common fields."""
 
+    credentials: CredentialsMetaInput = ayrshare.credentials_field(
+        description=(
+            "Ayrshare profile credential. AutoGPT provisions this managed "
+            "credential automatically — the user does not create it. After "
+            "it's in place, the user links each social account via the "
+            "Ayrshare SSO popup in the Builder."
+        ),
+    )
+
     post: str = SchemaField(
         description="The post text to be published", default="", advanced=False
     )
@@ -29,7 +32,9 @@ class BaseAyrshareInput(BlockSchemaInput):
         advanced=False,
     )
     is_video: bool = SchemaField(
-        description="Whether the media is a video", default=False, advanced=True
+        description="Whether the media is a video. Set to True when uploading a video so billing applies the video tier.",
+        default=False,
+        advanced=True,
     )
     schedule_date: Optional[datetime] = SchemaField(
         description="UTC datetime for scheduling (YYYY-MM-DDThh:mm:ssZ)",

autogpt_platform/backend/backend/blocks/ayrshare/post_to_bluesky.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToBlueskyBlock(Block):
     """Block for posting to Bluesky with Bluesky-specific options."""
 
@@ -57,16 +61,10 @@ class PostToBlueskyBlock(Block):
         self,
         input_data: "PostToBlueskyBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to Bluesky with Bluesky-specific options."""
-
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -106,7 +104,7 @@ class PostToBlueskyBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             bluesky_options=bluesky_options if bluesky_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_facebook.py

@@ -1,21 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import (
-    BaseAyrshareInput,
-    CarouselItem,
-    create_ayrshare_client,
-    get_profile_key,
-)
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, CarouselItem, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToFacebookBlock(Block):
     """Block for posting to Facebook with Facebook-specific options."""
 
@@ -120,15 +119,10 @@ class PostToFacebookBlock(Block):
         self,
         input_data: "PostToFacebookBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to Facebook with Facebook-specific options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -204,7 +198,7 @@ class PostToFacebookBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             facebook_options=facebook_options if facebook_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_gmb.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToGMBBlock(Block):
     """Block for posting to Google My Business with GMB-specific options."""
 
@@ -110,14 +114,13 @@ class PostToGMBBlock(Block):
         )
 
     async def run(
-        self, input_data: "PostToGMBBlock.Input", *, user_id: str, **kwargs
+        self,
+        input_data: "PostToGMBBlock.Input",
+        *,
+        credentials: APIKeyCredentials,
+        **kwargs
     ) -> BlockOutput:
         """Post to Google My Business with GMB-specific options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -202,7 +205,7 @@ class PostToGMBBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             gmb_options=gmb_options if gmb_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_instagram.py

@@ -2,22 +2,21 @@ from typing import Any
 
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import (
-    BaseAyrshareInput,
-    InstagramUserTag,
-    create_ayrshare_client,
-    get_profile_key,
-)
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, InstagramUserTag, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToInstagramBlock(Block):
     """Block for posting to Instagram with Instagram-specific options."""
 
@@ -112,15 +111,10 @@ class PostToInstagramBlock(Block):
         self,
         input_data: "PostToInstagramBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to Instagram with Instagram-specific options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -241,7 +235,7 @@ class PostToInstagramBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             instagram_options=instagram_options if instagram_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_linkedin.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToLinkedInBlock(Block):
     """Block for posting to LinkedIn with LinkedIn-specific options."""
 
@@ -112,15 +116,10 @@ class PostToLinkedInBlock(Block):
         self,
         input_data: "PostToLinkedInBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to LinkedIn with LinkedIn-specific options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -214,7 +213,7 @@ class PostToLinkedInBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             linkedin_options=linkedin_options if linkedin_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_pinterest.py

@@ -1,21 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import (
-    BaseAyrshareInput,
-    PinterestCarouselOption,
-    create_ayrshare_client,
-    get_profile_key,
-)
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, PinterestCarouselOption, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToPinterestBlock(Block):
     """Block for posting to Pinterest with Pinterest-specific options."""
 
@@ -92,15 +91,10 @@ class PostToPinterestBlock(Block):
         self,
         input_data: "PostToPinterestBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to Pinterest with Pinterest-specific options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -206,7 +200,7 @@ class PostToPinterestBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             pinterest_options=pinterest_options if pinterest_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_reddit.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToRedditBlock(Block):
     """Block for posting to Reddit."""
 
@@ -35,12 +39,12 @@ class PostToRedditBlock(Block):
         )
 
     async def run(
-        self, input_data: "PostToRedditBlock.Input", *, user_id: str, **kwargs
+        self,
+        input_data: "PostToRedditBlock.Input",
+        *,
+        credentials: APIKeyCredentials,
+        **kwargs
     ) -> BlockOutput:
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured."
@@ -61,7 +65,7 @@ class PostToRedditBlock(Block):
             random_post=input_data.random_post,
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_snapchat.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToSnapchatBlock(Block):
     """Block for posting to Snapchat with Snapchat-specific options."""
 
@@ -31,6 +35,14 @@ class PostToSnapchatBlock(Block):
             advanced=False,
         )
 
+        # Snapchat is video-only; override the base default so the @cost filter
+        # selects the 5-credit video tier instead of the 2-credit image tier.
+        is_video: bool = SchemaField(
+            description="Whether the media is a video (always True for Snapchat)",
+            default=True,
+            advanced=True,
+        )
+
         # Snapchat-specific options
         story_type: str = SchemaField(
             description="Type of Snapchat content: 'story' (24-hour Stories), 'saved_story' (Saved Stories), or 'spotlight' (Spotlight posts)",
@@ -62,15 +74,10 @@ class PostToSnapchatBlock(Block):
         self,
         input_data: "PostToSnapchatBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to Snapchat with Snapchat-specific options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -121,7 +128,7 @@ class PostToSnapchatBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             snapchat_options=snapchat_options if snapchat_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_telegram.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToTelegramBlock(Block):
     """Block for posting to Telegram with Telegram-specific options."""
 
@@ -57,15 +61,10 @@ class PostToTelegramBlock(Block):
         self,
         input_data: "PostToTelegramBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to Telegram with Telegram-specific validation."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -108,7 +107,7 @@ class PostToTelegramBlock(Block):
             random_post=input_data.random_post,
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_threads.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToThreadsBlock(Block):
     """Block for posting to Threads with Threads-specific options."""
 
@@ -50,15 +54,10 @@ class PostToThreadsBlock(Block):
         self,
         input_data: "PostToThreadsBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to Threads with Threads-specific validation."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -103,7 +102,7 @@ class PostToThreadsBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             threads_options=threads_options if threads_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_tiktok.py

@@ -2,15 +2,18 @@ from enum import Enum
 
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
 class TikTokVisibility(str, Enum):
@@ -19,6 +22,7 @@ class TikTokVisibility(str, Enum):
     FOLLOWERS = "followers"
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToTikTokBlock(Block):
     """Block for posting to TikTok with TikTok-specific options."""
 
@@ -113,14 +117,13 @@ class PostToTikTokBlock(Block):
         )
 
     async def run(
-        self, input_data: "PostToTikTokBlock.Input", *, user_id: str, **kwargs
+        self,
+        input_data: "PostToTikTokBlock.Input",
+        *,
+        credentials: APIKeyCredentials,
+        **kwargs,
     ) -> BlockOutput:
         """Post to TikTok with TikTok-specific validation and options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -235,7 +238,7 @@ class PostToTikTokBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             tiktok_options=tiktok_options if tiktok_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_x.py

@@ -1,16 +1,20 @@
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToXBlock(Block):
     """Block for posting to X / Twitter with Twitter-specific options."""
 
@@ -115,15 +119,10 @@ class PostToXBlock(Block):
         self,
         input_data: "PostToXBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to X / Twitter with enhanced X-specific options."""
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -233,7 +232,7 @@ class PostToXBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             twitter_options=twitter_options if twitter_options else None,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/ayrshare/post_to_youtube.py

@@ -3,15 +3,18 @@ from typing import Any
 
 from backend.integrations.ayrshare import PostIds, PostResponse, SocialPlatform
 from backend.sdk import (
+    APIKeyCredentials,
     Block,
     BlockCategory,
     BlockOutput,
     BlockSchemaOutput,
     BlockType,
     SchemaField,
+    cost,
 )
 
-from ._util import BaseAyrshareInput, create_ayrshare_client, get_profile_key
+from ._cost import AYRSHARE_POST_COSTS
+from ._util import BaseAyrshareInput, create_ayrshare_client
 
 
 class YouTubeVisibility(str, Enum):
@@ -20,6 +23,7 @@ class YouTubeVisibility(str, Enum):
     UNLISTED = "unlisted"
 
 
+@cost(*AYRSHARE_POST_COSTS)
 class PostToYouTubeBlock(Block):
     """Block for posting to YouTube with YouTube-specific options."""
 
@@ -39,6 +43,14 @@ class PostToYouTubeBlock(Block):
             advanced=False,
         )
 
+        # YouTube is video-only; override the base default so the @cost filter
+        # selects the 5-credit video tier instead of the 2-credit image tier.
+        is_video: bool = SchemaField(
+            description="Whether the media is a video (always True for YouTube)",
+            default=True,
+            advanced=True,
+        )
+
         # YouTube-specific required options
         title: str = SchemaField(
             description="Video title (max 100 chars, required). Cannot contain < or > characters.",
@@ -137,16 +149,10 @@ class PostToYouTubeBlock(Block):
         self,
         input_data: "PostToYouTubeBlock.Input",
         *,
-        user_id: str,
+        credentials: APIKeyCredentials,
         **kwargs,
     ) -> BlockOutput:
         """Post to YouTube with YouTube-specific validation and options."""
-
-        profile_key = await get_profile_key(user_id)
-        if not profile_key:
-            yield "error", "Please link a social account via Ayrshare"
-            return
-
         client = create_ayrshare_client()
         if not client:
             yield "error", "Ayrshare integration is not configured. Please set up the AYRSHARE_API_KEY."
@@ -302,7 +308,7 @@ class PostToYouTubeBlock(Block):
             random_media_url=input_data.random_media_url,
             notes=input_data.notes,
             youtube_options=youtube_options,
-            profile_key=profile_key.get_secret_value(),
+            profile_key=credentials.api_key.get_secret_value(),
         )
         yield "post_result", response
         if response.postIds:

autogpt_platform/backend/backend/blocks/baas/_config.py

@@ -7,6 +7,7 @@ from backend.sdk import BlockCostType, ProviderBuilder
 # Configure the Meeting BaaS provider with API key authentication
 baas = (
     ProviderBuilder("baas")
+    .with_description("Meeting recording and transcription")
     .with_api_key("MEETING_BAAS_API_KEY", "Meeting BaaS API Key")
     .with_base_cost(5, BlockCostType.RUN)  # Higher cost for meeting recording service
     .build()

autogpt_platform/backend/backend/blocks/baas/bots.py

@@ -4,21 +4,34 @@ Meeting BaaS bot (recording) blocks.
 
 from typing import Optional
 
+from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
     BlockCategory,
+    BlockCost,
+    BlockCostType,
     BlockOutput,
     BlockSchemaInput,
     BlockSchemaOutput,
     CredentialsMetaInput,
     SchemaField,
+    cost,
 )
 
 from ._api import MeetingBaasAPI
 from ._config import baas
 
+# Meeting BaaS recording rate: $0.69 per hour.
+_MEETING_BAAS_USD_PER_SECOND = 0.69 / 3600
 
+# Join bills a flat 30 cr commit (covers median short meeting);
+# FetchMeetingData bills the duration-scaled remainder from the
+# `duration_seconds` field on the API response. Long meetings no
+# longer under-bill.
+
+
+@cost(BlockCost(cost_type=BlockCostType.RUN, cost_amount=30))
 class BaasBotJoinMeetingBlock(Block):
     """
     Deploy a bot immediately or at a scheduled start_time to join and record a meeting.
@@ -134,6 +147,7 @@ class BaasBotLeaveMeetingBlock(Block):
         yield "left", left
 
 
+@cost(BlockCost(cost_type=BlockCostType.COST_USD, cost_amount=150))
 class BaasBotFetchMeetingDataBlock(Block):
     """
     Pull MP4 URL, transcript & metadata for a completed meeting.
@@ -176,9 +190,21 @@ class BaasBotFetchMeetingDataBlock(Block):
             include_transcripts=input_data.include_transcripts,
         )
 
+        bot_meta = data.get("bot_data", {}).get("bot", {}) or {}
+        # Bill recording duration via COST_USD so multi-hour meetings
+        # scale past the Join block's flat 30 cr deposit.
+        duration_seconds = float(bot_meta.get("duration_seconds") or 0)
+        if duration_seconds > 0:
+            self.merge_stats(
+                NodeExecutionStats(
+                    provider_cost=duration_seconds * _MEETING_BAAS_USD_PER_SECOND,
+                    provider_cost_type="cost_usd",
+                )
+            )
+
         yield "mp4_url", data.get("mp4", "")
         yield "transcript", data.get("bot_data", {}).get("transcripts", [])
-        yield "metadata", data.get("bot_data", {}).get("bot", {})
+        yield "metadata", bot_meta
 
 
 class BaasBotDeleteRecordingBlock(Block):

autogpt_platform/backend/backend/blocks/baas/bots_cost_test.py

@@ -0,0 +1,86 @@
+"""Unit tests for Meeting BaaS duration-based cost emission."""
+
+from unittest.mock import AsyncMock, patch
+
+import pytest
+from pydantic import SecretStr
+
+from backend.blocks.baas.bots import (
+    _MEETING_BAAS_USD_PER_SECOND,
+    BaasBotFetchMeetingDataBlock,
+)
+from backend.data.model import APIKeyCredentials, NodeExecutionStats
+
+TEST_CREDENTIALS = APIKeyCredentials(
+    id="01234567-89ab-cdef-0123-456789abcdef",
+    provider="baas",
+    title="Mock BaaS API Key",
+    api_key=SecretStr("mock-baas-api-key"),
+    expires_at=None,
+)
+
+
+def test_usd_per_second_derives_from_published_rate():
+    """$0.69/hour published rate → ~$0.000192/second."""
+    assert _MEETING_BAAS_USD_PER_SECOND == pytest.approx(0.69 / 3600)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize(
+    "duration_seconds, expected_usd",
+    [
+        (3600, 0.69),  # 1 hour
+        (1800, 0.345),  # 30 min
+        (0, None),  # no recording → no emission
+        (None, None),  # missing duration field → no emission
+    ],
+)
+async def test_fetch_meeting_data_emits_duration_cost_usd(
+    duration_seconds, expected_usd
+):
+    """FetchMeetingData extracts duration_seconds from bot metadata and
+    emits provider_cost / cost_usd scaled by the published $0.69/hr rate.
+    Emission is skipped when duration is 0 or missing.
+    """
+    block = BaasBotFetchMeetingDataBlock()
+
+    bot_meta = {"id": "bot-xyz"}
+    if duration_seconds is not None:
+        bot_meta["duration_seconds"] = duration_seconds
+
+    mock_api = AsyncMock()
+    mock_api.get_meeting_data.return_value = {
+        "mp4": "https://example/recording.mp4",
+        "bot_data": {"bot": bot_meta, "transcripts": []},
+    }
+
+    captured: list[NodeExecutionStats] = []
+    with (
+        patch("backend.blocks.baas.bots.MeetingBaasAPI", return_value=mock_api),
+        patch.object(block, "merge_stats", side_effect=captured.append),
+    ):
+        outputs = []
+        async for name, val in block.run(
+            block.input_schema(
+                credentials={
+                    "id": TEST_CREDENTIALS.id,
+                    "provider": TEST_CREDENTIALS.provider,
+                    "type": TEST_CREDENTIALS.type,
+                },
+                bot_id="bot-xyz",
+                include_transcripts=False,
+            ),
+            credentials=TEST_CREDENTIALS,
+        ):
+            outputs.append((name, val))
+
+    # Always yields the 3 outputs regardless of duration.
+    names = [n for n, _ in outputs]
+    assert "mp4_url" in names and "metadata" in names
+
+    if expected_usd is None:
+        assert captured == []
+    else:
+        assert len(captured) == 1
+        assert captured[0].provider_cost == pytest.approx(expected_usd)
+        assert captured[0].provider_cost_type == "cost_usd"

autogpt_platform/backend/backend/blocks/bannerbear/_config.py

@@ -2,7 +2,8 @@ from backend.sdk import BlockCostType, ProviderBuilder
 
 bannerbear = (
     ProviderBuilder("bannerbear")
+    .with_description("Auto-generate images and videos")
     .with_api_key("BANNERBEAR_API_KEY", "Bannerbear API Key")
-    .with_base_cost(1, BlockCostType.RUN)
+    .with_base_cost(3, BlockCostType.RUN)
     .build()
 )

autogpt_platform/backend/backend/blocks/block_cost_tracking_test.py

@@ -433,7 +433,7 @@ class TestJinaEmbeddingBlockCostTracking:
 class TestUnrealTextToSpeechBlockCostTracking:
     @pytest.mark.asyncio
     async def test_merge_stats_called_with_character_count(self):
-        """provider_cost equals len(text) with type='characters'."""
+        """provider_cost = len(text) * $0.000016 with type='cost_usd'."""
         from backend.blocks.text_to_speech_block import TEST_CREDENTIALS as TTS_CREDS
         from backend.blocks.text_to_speech_block import (
             TEST_CREDENTIALS_INPUT as TTS_CREDS_INPUT,
@@ -461,12 +461,12 @@ class TestUnrealTextToSpeechBlockCostTracking:
 
         mock_merge.assert_called_once()
         stats = mock_merge.call_args[0][0]
-        assert stats.provider_cost == float(len(test_text))
-        assert stats.provider_cost_type == "characters"
+        assert stats.provider_cost == pytest.approx(len(test_text) * 0.000016)
+        assert stats.provider_cost_type == "cost_usd"
 
     @pytest.mark.asyncio
     async def test_empty_text_gives_zero_characters(self):
-        """An empty text string results in provider_cost=0.0."""
+        """An empty text string results in provider_cost=0.0 (cost_usd)."""
         from backend.blocks.text_to_speech_block import TEST_CREDENTIALS as TTS_CREDS
         from backend.blocks.text_to_speech_block import (
             TEST_CREDENTIALS_INPUT as TTS_CREDS_INPUT,
@@ -494,7 +494,7 @@ class TestUnrealTextToSpeechBlockCostTracking:
         mock_merge.assert_called_once()
         stats = mock_merge.call_args[0][0]
         assert stats.provider_cost == 0.0
-        assert stats.provider_cost_type == "characters"
+        assert stats.provider_cost_type == "cost_usd"
 
 
 # ---------------------------------------------------------------------------

autogpt_platform/backend/backend/blocks/claude_code.py

@@ -17,6 +17,7 @@ from backend.data.model import (
     APIKeyCredentials,
     CredentialsField,
     CredentialsMetaInput,
+    NodeExecutionStats,
     SchemaField,
 )
 from backend.integrations.providers import ProviderName
@@ -431,6 +432,7 @@ class ClaudeCodeBlock(Block):
                 # The JSON output contains the result
                 output_data = json.loads(raw_output)
                 response = output_data.get("result", raw_output)
+                self._record_cli_cost(output_data)
 
                 # Build conversation history entry
                 turn_entry = f"User: {prompt}\nClaude: {response}"
@@ -484,6 +486,23 @@ class ClaudeCodeBlock(Block):
         escaped = prompt.replace("'", "'\"'\"'")
         return f"'{escaped}'"
 
+    def _record_cli_cost(self, output_data: dict) -> None:
+        """Feed Claude Code CLI's `total_cost_usd` to the COST_USD resolver.
+
+        The CLI rolls up Anthropic LLM + internal tool-call spend into
+        ``total_cost_usd`` on its JSON response; piping it through
+        ``merge_stats`` lets the wallet reflect real spend.
+        """
+        total_cost_usd = output_data.get("total_cost_usd")
+        if total_cost_usd is None:
+            return
+        self.merge_stats(
+            NodeExecutionStats(
+                provider_cost=float(total_cost_usd),
+                provider_cost_type="cost_usd",
+            )
+        )
+
     async def run(
         self,
         input_data: Input,

autogpt_platform/backend/backend/blocks/claude_code_cost_test.py

@@ -0,0 +1,106 @@
+"""Unit tests for ClaudeCodeBlock COST_USD billing migration.
+
+Verifies:
+- Block emits provider_cost / cost_usd when Claude Code CLI returns
+  total_cost_usd.
+- block_usage_cost resolves the COST_USD entry to the expected ceil(usd *
+  cost_amount) credit charge.
+- Missing total_cost_usd gracefully produces provider_cost=None (no bill).
+"""
+
+from unittest.mock import MagicMock, patch
+
+import pytest
+
+from backend.blocks._base import BlockCostType
+from backend.blocks.claude_code import ClaudeCodeBlock
+from backend.data.block_cost_config import BLOCK_COSTS
+from backend.data.model import NodeExecutionStats
+from backend.executor.utils import block_usage_cost
+
+
+def test_claude_code_registered_as_cost_usd_150():
+    """Sanity: BLOCK_COSTS holds the COST_USD, 150 cr/$ entry."""
+    entries = BLOCK_COSTS[ClaudeCodeBlock]
+    assert len(entries) == 1
+    entry = entries[0]
+    assert entry.cost_type == BlockCostType.COST_USD
+    assert entry.cost_amount == 150
+
+
+@pytest.mark.parametrize(
+    "total_cost_usd, expected_credits",
+    [
+        (0.50, 75),  # $0.50 × 150 = 75 cr
+        (1.00, 150),  # $1.00 × 150 = 150 cr
+        (0.0134, 3),  # ceil(0.0134 × 150) = ceil(2.01) = 3
+        (2.00, 300),  # $2 × 150 = 300 cr
+        (0.001, 1),  # ceil(0.001 × 150) = ceil(0.15) = 1 — no 0-cr leak on
+        # sub-cent runs
+    ],
+)
+def test_cost_usd_resolver_applies_150_multiplier(total_cost_usd, expected_credits):
+    """block_usage_cost with cost_usd stats returns ceil(usd * 150)."""
+    block = ClaudeCodeBlock()
+    # cost_filter requires matching e2b_credentials; supply the ones the
+    # registration uses so _is_cost_filter_match accepts the input.
+    entry = BLOCK_COSTS[ClaudeCodeBlock][0]
+    input_data = {"e2b_credentials": entry.cost_filter["e2b_credentials"]}
+    stats = NodeExecutionStats(
+        provider_cost=total_cost_usd,
+        provider_cost_type="cost_usd",
+    )
+    cost, matching_filter = block_usage_cost(
+        block=block, input_data=input_data, stats=stats
+    )
+    assert cost == expected_credits
+    assert matching_filter == entry.cost_filter
+
+
+def test_cost_usd_resolver_returns_zero_when_stats_missing_cost():
+    """Pre-flight (no stats) or unbilled run (provider_cost None) → 0."""
+    block = ClaudeCodeBlock()
+    entry = BLOCK_COSTS[ClaudeCodeBlock][0]
+    input_data = {"e2b_credentials": entry.cost_filter["e2b_credentials"]}
+    # No stats at all → pre-flight path, returns 0.
+    pre_cost, _ = block_usage_cost(block=block, input_data=input_data)
+    assert pre_cost == 0
+    # Stats present but no provider_cost → resolver can't bill.
+    stats = NodeExecutionStats()
+    post_cost, _ = block_usage_cost(block=block, input_data=input_data, stats=stats)
+    assert post_cost == 0
+
+
+def test_record_cli_cost_emits_provider_cost_when_total_cost_present():
+    """``_record_cli_cost`` (the helper called from ``execute_claude_code``)
+    must emit a single ``merge_stats`` with provider_cost + cost_usd tag
+    when the CLI JSON payload carries ``total_cost_usd``.
+    """
+    block = ClaudeCodeBlock()
+    captured: list[NodeExecutionStats] = []
+    with patch.object(block, "merge_stats", side_effect=captured.append):
+        block._record_cli_cost(
+            {
+                "result": "hello from claude",
+                "total_cost_usd": 0.0421,
+                "usage": {"input_tokens": 1234, "output_tokens": 56},
+            }
+        )
+
+    assert len(captured) == 1
+    stats = captured[0]
+    assert stats.provider_cost == pytest.approx(0.0421)
+    assert stats.provider_cost_type == "cost_usd"
+
+
+def test_record_cli_cost_skips_merge_when_total_cost_absent():
+    """If the CLI payload lacks ``total_cost_usd`` (legacy / non-JSON
+    output), ``_record_cli_cost`` must not call ``merge_stats`` — otherwise
+    we'd pollute telemetry with a ``cost_usd`` emission that has no real
+    cost attached.
+    """
+    block = ClaudeCodeBlock()
+    mock = MagicMock()
+    with patch.object(block, "merge_stats", mock):
+        block._record_cli_cost({"result": "hello"})
+    mock.assert_not_called()

autogpt_platform/backend/backend/blocks/codex.py

@@ -151,6 +151,17 @@ class CodeGenerationBlock(Block):
         )
         self.execution_stats = NodeExecutionStats()
 
+    # GPT-5.1-Codex published pricing: $1.25 / 1M input, $10 / 1M output.
+    _INPUT_USD_PER_1M = 1.25
+    _OUTPUT_USD_PER_1M = 10.0
+
+    @staticmethod
+    def _compute_token_usd(input_tokens: int, output_tokens: int) -> float:
+        return (
+            input_tokens * CodeGenerationBlock._INPUT_USD_PER_1M
+            + output_tokens * CodeGenerationBlock._OUTPUT_USD_PER_1M
+        ) / 1_000_000
+
     async def call_codex(
         self,
         *,
@@ -189,13 +200,15 @@ class CodeGenerationBlock(Block):
         response_id = response.id or ""
 
         # Update usage stats
-        self.execution_stats.input_token_count = (
-            response.usage.input_tokens if response.usage else 0
-        )
-        self.execution_stats.output_token_count = (
-            response.usage.output_tokens if response.usage else 0
-        )
+        input_tokens = response.usage.input_tokens if response.usage else 0
+        output_tokens = response.usage.output_tokens if response.usage else 0
+        self.execution_stats.input_token_count = input_tokens
+        self.execution_stats.output_token_count = output_tokens
         self.execution_stats.llm_call_count += 1
+        self.execution_stats.provider_cost = self._compute_token_usd(
+            input_tokens, output_tokens
+        )
+        self.execution_stats.provider_cost_type = "cost_usd"
 
         return CodexCallResult(
             response=text_output,

autogpt_platform/backend/backend/blocks/compass/_config.py

@@ -0,0 +1,10 @@
+"""Provider registration for Compass — metadata only (auth lives elsewhere)."""
+
+from backend.sdk import ProviderBuilder
+
+compass = (
+    ProviderBuilder("compass")
+    .with_description("Geospatial context for agents")
+    .with_supported_auth_types("api_key")
+    .build()
+)

autogpt_platform/backend/backend/blocks/cost_leak_fixes_test.py

@@ -0,0 +1,226 @@
+"""Coverage tests for the cost-leak fixes in this PR.
+
+Each block's ``run()`` / helper emits provider_cost + cost_usd (or items)
+via merge_stats so the post-flight resolver bills real provider spend.
+Tests here drive that emission path directly so a regression on any one
+block surfaces immediately.
+"""
+
+from unittest.mock import patch
+
+import pytest
+from pydantic import SecretStr
+
+from backend.blocks._base import BlockCostType
+from backend.blocks.ai_condition import AIConditionBlock
+from backend.data.block_cost_config import BLOCK_COSTS, LLM_COST
+from backend.data.model import APIKeyCredentials, NodeExecutionStats
+
+# -------- AIConditionBlock registration --------
+
+
+def test_ai_condition_registered_under_llm_cost():
+    """AIConditionBlock was running wallet-free before this PR; verify it
+    now resolves through the same per-model LLM_COST table as every other
+    LLM block.
+    """
+    assert BLOCK_COSTS[AIConditionBlock] is LLM_COST
+
+
+# -------- Pinecone insert ITEMS emission --------
+
+
+@pytest.mark.asyncio
+async def test_pinecone_insert_emits_items_provider_cost():
+    from backend.blocks.pinecone import PineconeInsertBlock
+
+    block = PineconeInsertBlock()
+    captured: list[NodeExecutionStats] = []
+
+    class _FakeIndex:
+        def upsert(self, **_):
+            return None
+
+    class _FakePinecone:
+        def __init__(self, *_, **__):
+            pass
+
+        def Index(self, _name):
+            return _FakeIndex()
+
+    with (
+        patch("backend.blocks.pinecone.Pinecone", _FakePinecone),
+        patch.object(block, "merge_stats", side_effect=captured.append),
+    ):
+        input_data = block.input_schema(
+            credentials={
+                "id": "00000000-0000-0000-0000-000000000000",
+                "provider": "pinecone",
+                "type": "api_key",
+            },
+            index="my-index",
+            chunks=["alpha", "beta", "gamma"],
+            embeddings=[[0.1] * 4, [0.2] * 4, [0.3] * 4],
+            namespace="",
+            metadata={},
+        )
+
+        creds = APIKeyCredentials(
+            id="00000000-0000-0000-0000-000000000000",
+            provider="pinecone",
+            title="mock",
+            api_key=SecretStr("mock-key"),
+            expires_at=None,
+        )
+        outputs = [(n, v) async for n, v in block.run(input_data, credentials=creds)]
+
+    assert any(name == "upsert_response" for name, _ in outputs)
+    assert len(captured) == 1
+    stats = captured[0]
+    assert stats.provider_cost == pytest.approx(3.0)
+    assert stats.provider_cost_type == "items"
+
+
+# -------- Narration model-aware per-char rate --------
+
+
+@pytest.mark.parametrize(
+    "model_id, expected_rate_per_char",
+    [
+        ("eleven_flash_v2_5", 0.000167 * 0.5),
+        ("eleven_turbo_v2_5", 0.000167 * 0.5),
+        ("eleven_multilingual_v2", 0.000167 * 1.0),
+        ("eleven_turbo_v2", 0.000167 * 1.0),
+    ],
+)
+def test_narration_per_char_rate_scales_with_model(model_id, expected_rate_per_char):
+    """Drive VideoNarrationBlock._record_script_cost directly so a regression
+    that drops the model-aware branching (e.g. hardcoding 1.0 cr/char for
+    all models) makes this test fail.
+    """
+    from backend.blocks.video.narration import VideoNarrationBlock
+
+    block = VideoNarrationBlock()
+    captured: list[NodeExecutionStats] = []
+    with patch.object(block, "merge_stats", side_effect=captured.append):
+        block._record_script_cost("x" * 5000, model_id)
+
+    assert len(captured) == 1
+    stats = captured[0]
+    assert stats.provider_cost == pytest.approx(5000 * expected_rate_per_char)
+    assert stats.provider_cost_type == "cost_usd"
+
+
+# -------- Perplexity None-guard on x-total-cost --------
+
+
+@pytest.mark.parametrize(
+    "openrouter_cost, expect_type",
+    [
+        (0.0421, "cost_usd"),  # concrete positive USD → tagged
+        (None, None),  # header missing → no tag (keeps gap observable)
+        (0.0, None),  # zero → no tag (wouldn't bill anything anyway)
+    ],
+)
+def test_perplexity_record_openrouter_cost_tags_only_on_concrete_value(
+    openrouter_cost, expect_type
+):
+    """Drive PerplexityBlock._record_openrouter_cost directly to verify the
+    None/0 guard. A regression that tags cost_usd unconditionally would
+    silently floor the user's bill to 0 via the resolver — this test
+    would catch it.
+    """
+    from backend.blocks.perplexity import PerplexityBlock
+
+    block = PerplexityBlock()
+    with patch(
+        "backend.blocks.perplexity.extract_openrouter_cost",
+        return_value=openrouter_cost,
+    ):
+        block._record_openrouter_cost(response=object())
+
+    assert block.execution_stats.provider_cost == openrouter_cost
+    assert block.execution_stats.provider_cost_type == expect_type
+
+
+# -------- Codex COST_USD registration --------
+
+
+def test_codex_registered_as_cost_usd_150():
+    from backend.blocks.codex import CodeGenerationBlock
+
+    entries = BLOCK_COSTS[CodeGenerationBlock]
+    assert len(entries) == 1
+    entry = entries[0]
+    assert entry.cost_type == BlockCostType.COST_USD
+    assert entry.cost_amount == 150
+
+
+@pytest.mark.parametrize(
+    "input_tokens, output_tokens, expected_usd",
+    [
+        # GPT-5.1-Codex: $1.25 / 1M input, $10 / 1M output.
+        (1_000_000, 0, 1.25),
+        (0, 1_000_000, 10.0),
+        (100_000, 10_000, 0.225),  # 0.125 + 0.100
+        (0, 0, 0.0),
+    ],
+)
+def test_codex_computes_provider_cost_usd_from_token_counts(
+    input_tokens, output_tokens, expected_usd
+):
+    """Drive CodeGenerationBlock._compute_token_usd directly. A regression
+    to the wrong rate constants (e.g. swapping the $1.25 input rate for
+    GPT-4o's $2.50) would fail this test.
+    """
+    from backend.blocks.codex import CodeGenerationBlock
+
+    assert CodeGenerationBlock._compute_token_usd(
+        input_tokens, output_tokens
+    ) == pytest.approx(expected_usd)
+
+
+# -------- ClaudeCode COST_USD registration sanity (already tested in claude_code_cost_test.py) --------
+
+
+# -------- Perplexity COST_USD registration for all 3 tiers --------
+
+
+def test_perplexity_sonar_all_tiers_registered_as_cost_usd_150():
+    from backend.blocks.perplexity import PerplexityBlock
+
+    entries = BLOCK_COSTS[PerplexityBlock]
+    # 3 tiers (SONAR, SONAR_PRO, SONAR_DEEP_RESEARCH) all COST_USD 150.
+    assert len(entries) == 3
+    for entry in entries:
+        assert entry.cost_type == BlockCostType.COST_USD
+        assert entry.cost_amount == 150
+
+
+# -------- Narration COST_USD registration --------
+
+
+def test_narration_registered_as_cost_usd_150():
+    from backend.blocks.video.narration import VideoNarrationBlock
+
+    entries = BLOCK_COSTS[VideoNarrationBlock]
+    assert len(entries) == 1
+    assert entries[0].cost_type == BlockCostType.COST_USD
+    assert entries[0].cost_amount == 150
+
+
+# -------- Pinecone registrations --------
+
+
+def test_pinecone_registrations():
+    from backend.blocks.pinecone import (
+        PineconeInitBlock,
+        PineconeInsertBlock,
+        PineconeQueryBlock,
+    )
+
+    assert BLOCK_COSTS[PineconeInitBlock][0].cost_type == BlockCostType.RUN
+    assert BLOCK_COSTS[PineconeQueryBlock][0].cost_type == BlockCostType.RUN
+    # Insert scales with item count.
+    assert BLOCK_COSTS[PineconeInsertBlock][0].cost_type == BlockCostType.ITEMS
+    assert BLOCK_COSTS[PineconeInsertBlock][0].cost_amount == 1

autogpt_platform/backend/backend/blocks/dataforseo/_api.py

@@ -19,6 +19,10 @@ class DataForSeoClient:
             trusted_origins=["https://api.dataforseo.com"],
             raise_for_status=False,
         )
+        # USD cost reported by DataForSEO on the most recent successful call.
+        # Populated by keyword_suggestions / related_keywords so the caller
+        # can surface it via NodeExecutionStats.provider_cost for billing.
+        self.last_cost_usd: float = 0.0
 
     def _get_headers(self) -> Dict[str, str]:
         """Generate the authorization header using Basic Auth."""
@@ -97,6 +101,9 @@ class DataForSeoClient:
         if data.get("tasks") and len(data["tasks"]) > 0:
             task = data["tasks"][0]
             if task.get("status_code") == 20000:  # Success code
+                # DataForSEO reports per-task USD cost; stash it so callers
+                # can populate NodeExecutionStats.provider_cost.
+                self.last_cost_usd = float(task.get("cost") or 0.0)
                 return task.get("result", [])
             else:
                 error_msg = task.get("status_message", "Task failed")
@@ -174,6 +181,9 @@ class DataForSeoClient:
         if data.get("tasks") and len(data["tasks"]) > 0:
             task = data["tasks"][0]
             if task.get("status_code") == 20000:  # Success code
+                # DataForSEO reports per-task USD cost; stash it so callers
+                # can populate NodeExecutionStats.provider_cost.
+                self.last_cost_usd = float(task.get("cost") or 0.0)
                 return task.get("result", [])
             else:
                 error_msg = task.get("status_message", "Task failed")

autogpt_platform/backend/backend/blocks/dataforseo/_config.py

@@ -7,11 +7,17 @@ from backend.sdk import BlockCostType, ProviderBuilder
 # Build the DataForSEO provider with username/password authentication
 dataforseo = (
     ProviderBuilder("dataforseo")
+    .with_description("SEO and SERP data")
     .with_user_password(
         username_env_var="DATAFORSEO_USERNAME",
         password_env_var="DATAFORSEO_PASSWORD",
         title="DataForSEO Credentials",
     )
-    .with_base_cost(1, BlockCostType.RUN)
+    # DataForSEO reports USD cost per task (e.g. $0.001/keyword returned).
+    # DataForSeoClient stashes it on last_cost_usd; each block emits it via
+    # merge_stats so the COST_USD resolver bills against real spend.
+    # 1000 platform credits per USD → 1 credit per $0.001 (≈ 1 credit/
+    # returned keyword on the standard tier).
+    .with_base_cost(1000, BlockCostType.COST_USD)
     .build()
 )

autogpt_platform/backend/backend/blocks/dataforseo/keyword_suggestions.py

@@ -4,6 +4,7 @@ DataForSEO Google Keyword Suggestions block.
 
 from typing import Any, Dict, List, Optional
 
+from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     Block,
     BlockCategory,
@@ -110,8 +111,10 @@ class DataForSeoKeywordSuggestionsBlock(Block):
             test_output=[
                 (
                     "suggestion",
-                    lambda x: hasattr(x, "keyword")
-                    and x.keyword == "digital marketing strategy",
+                    lambda x: (
+                        hasattr(x, "keyword")
+                        and x.keyword == "digital marketing strategy"
+                    ),
                 ),
                 ("suggestions", lambda x: isinstance(x, list) and len(x) == 1),
                 ("total_count", 1),
@@ -167,6 +170,16 @@ class DataForSeoKeywordSuggestionsBlock(Block):
 
             results = await self._fetch_keyword_suggestions(client, input_data)
 
+            # DataForSEO reports per-task USD cost on the response. Feed it
+            # into NodeExecutionStats so the COST_USD resolver bills the
+            # real provider spend at reconciliation time.
+            self.merge_stats(
+                NodeExecutionStats(
+                    provider_cost=client.last_cost_usd,
+                    provider_cost_type="cost_usd",
+                )
+            )
+
             # Process and format the results
             suggestions = []
             if results and len(results) > 0:

autogpt_platform/backend/backend/blocks/dataforseo/related_keywords.py

@@ -4,6 +4,7 @@ DataForSEO Google Related Keywords block.
 
 from typing import Any, Dict, List, Optional
 
+from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     Block,
     BlockCategory,
@@ -177,6 +178,16 @@ class DataForSeoRelatedKeywordsBlock(Block):
 
             results = await self._fetch_related_keywords(client, input_data)
 
+            # DataForSEO reports per-task USD cost on the response. Feed it
+            # into NodeExecutionStats so the COST_USD resolver bills the
+            # real provider spend at reconciliation time.
+            self.merge_stats(
+                NodeExecutionStats(
+                    provider_cost=client.last_cost_usd,
+                    provider_cost_type="cost_usd",
+                )
+            )
+
             # Process and format the results
             related_keywords = []
             if results and len(results) > 0:

autogpt_platform/backend/backend/blocks/discord/_config.py

@@ -0,0 +1,10 @@
+"""Provider registration for Discord — metadata only (auth lives in ``_auth.py``)."""
+
+from backend.sdk import ProviderBuilder
+
+discord = (
+    ProviderBuilder("discord")
+    .with_description("Messages, channels, and servers")
+    .with_supported_auth_types("api_key", "oauth2")
+    .build()
+)

autogpt_platform/backend/backend/blocks/elevenlabs/_config.py

@@ -0,0 +1,10 @@
+"""Provider registration for ElevenLabs — metadata only (auth lives in ``_auth.py``)."""
+
+from backend.sdk import ProviderBuilder
+
+elevenlabs = (
+    ProviderBuilder("elevenlabs")
+    .with_description("Realistic AI voice synthesis")
+    .with_supported_auth_types("api_key")
+    .build()
+)

autogpt_platform/backend/backend/blocks/enrichlayer/_config.py

@@ -0,0 +1,10 @@
+"""Provider registration for Enrichlayer — metadata only (auth lives in ``_auth.py``)."""
+
+from backend.sdk import ProviderBuilder
+
+enrichlayer = (
+    ProviderBuilder("enrichlayer")
+    .with_description("Enrich leads with company data")
+    .with_supported_auth_types("api_key")
+    .build()
+)

autogpt_platform/backend/backend/blocks/exa/_config.py

@@ -9,8 +9,14 @@ from ._webhook import ExaWebhookManager
 # Configure the Exa provider once for all blocks
 exa = (
     ProviderBuilder("exa")
+    .with_description("Neural web search")
     .with_api_key("EXA_API_KEY", "Exa API Key")
     .with_webhook_manager(ExaWebhookManager)
-    .with_base_cost(1, BlockCostType.RUN)
+    # Exa returns `cost_dollars.total` on every response and ExaSearchBlock
+    # (plus ~45 sibling blocks that share this provider config) already
+    # populates NodeExecutionStats.provider_cost with it. Bill 100 credits
+    # per USD (~$0.01/credit): cheap searches stay at 1–2 credits, a Deep
+    # Research run at $0.20 lands at 20 credits, matching provider spend.
+    .with_base_cost(100, BlockCostType.COST_USD)
     .build()
 )

autogpt_platform/backend/backend/blocks/exa/answers.py

@@ -17,6 +17,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 
 class AnswerCitation(BaseModel):
@@ -111,3 +112,7 @@ class ExaAnswerBlock(Block):
         yield "citations", citations
         for citation in citations:
             yield "citation", citation
+
+        # Current SDK AnswerResponse dataclass omits cost_dollars; helper
+        # no-ops today, but keeps billing wired when exa_py adds the field.
+        merge_exa_cost(self, response)

autogpt_platform/backend/backend/blocks/exa/code_context.py

@@ -9,7 +9,6 @@ from typing import Union
 
 from pydantic import BaseModel
 
-from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -23,6 +22,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 
 class CodeContextResponse(BaseModel):
@@ -118,9 +118,5 @@ class ExaCodeContextBlock(Block):
         yield "search_time", context.search_time
         yield "output_tokens", context.output_tokens
 
-        # Parse cost_dollars (API returns as string, e.g. "0.005")
-        try:
-            cost_usd = float(context.cost_dollars)
-            self.merge_stats(NodeExecutionStats(provider_cost=cost_usd))
-        except (ValueError, TypeError):
-            pass
+        # API returns costDollars as a bare numeric string like "0.005".
+        merge_exa_cost(self, data)

autogpt_platform/backend/backend/blocks/exa/contents.py

@@ -4,7 +4,6 @@ from typing import Optional
 from exa_py import AsyncExa
 from pydantic import BaseModel
 
-from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -24,6 +23,7 @@ from .helpers import (
     HighlightSettings,
     LivecrawlTypes,
     SummarySettings,
+    merge_exa_cost,
 )
 
 
@@ -224,6 +224,4 @@ class ExaContentsBlock(Block):
 
         if response.cost_dollars:
             yield "cost_dollars", response.cost_dollars
-            self.merge_stats(
-                NodeExecutionStats(provider_cost=response.cost_dollars.total)
-            )
+        merge_exa_cost(self, response)

autogpt_platform/backend/backend/blocks/exa/cost_tracking_test.py

@@ -143,7 +143,9 @@ class TestExaContentsCostTracking:
             mock_exa_cls.return_value = mock_exa
 
             async for _ in block.run(
-                block.Input(urls=["https://example.com"], credentials=TEST_CREDENTIALS_INPUT),  # type: ignore[arg-type]
+                block.Input(
+                    urls=["https://example.com"], credentials=TEST_CREDENTIALS_INPUT
+                ),  # type: ignore[arg-type]
                 credentials=TEST_CREDENTIALS,
             ):
                 pass
@@ -172,7 +174,9 @@ class TestExaContentsCostTracking:
             mock_exa_cls.return_value = mock_exa
 
             async for _ in block.run(
-                block.Input(urls=["https://example.com"], credentials=TEST_CREDENTIALS_INPUT),  # type: ignore[arg-type]
+                block.Input(
+                    urls=["https://example.com"], credentials=TEST_CREDENTIALS_INPUT
+                ),  # type: ignore[arg-type]
                 credentials=TEST_CREDENTIALS,
             ):
                 pass
@@ -201,7 +205,9 @@ class TestExaContentsCostTracking:
             mock_exa_cls.return_value = mock_exa
 
             async for _ in block.run(
-                block.Input(urls=["https://example.com"], credentials=TEST_CREDENTIALS_INPUT),  # type: ignore[arg-type]
+                block.Input(
+                    urls=["https://example.com"], credentials=TEST_CREDENTIALS_INPUT
+                ),  # type: ignore[arg-type]
                 credentials=TEST_CREDENTIALS,
             ):
                 pass
@@ -297,7 +303,9 @@ class TestExaSimilarCostTracking:
             mock_exa_cls.return_value = mock_exa
 
             async for _ in block.run(
-                block.Input(url="https://example.com", credentials=TEST_CREDENTIALS_INPUT),  # type: ignore[arg-type]
+                block.Input(
+                    url="https://example.com", credentials=TEST_CREDENTIALS_INPUT
+                ),  # type: ignore[arg-type]
                 credentials=TEST_CREDENTIALS,
             ):
                 pass
@@ -326,7 +334,9 @@ class TestExaSimilarCostTracking:
             mock_exa_cls.return_value = mock_exa
 
             async for _ in block.run(
-                block.Input(url="https://example.com", credentials=TEST_CREDENTIALS_INPUT),  # type: ignore[arg-type]
+                block.Input(
+                    url="https://example.com", credentials=TEST_CREDENTIALS_INPUT
+                ),  # type: ignore[arg-type]
                 credentials=TEST_CREDENTIALS,
             ):
                 pass

autogpt_platform/backend/backend/blocks/exa/helpers.py

@@ -1,7 +1,8 @@
 from enum import Enum
 from typing import Any, Dict, Literal, Optional, Union
 
-from backend.sdk import BaseModel, MediaFileType, SchemaField
+from backend.data.model import NodeExecutionStats
+from backend.sdk import BaseModel, Block, MediaFileType, SchemaField
 
 
 class LivecrawlTypes(str, Enum):
@@ -319,7 +320,7 @@ class CostDollars(BaseModel):
 
 # Helper functions for payload processing
 def process_text_field(
-    text: Union[bool, TextEnabled, TextDisabled, TextAdvanced, None]
+    text: Union[bool, TextEnabled, TextDisabled, TextAdvanced, None],
 ) -> Optional[Union[bool, Dict[str, Any]]]:
     """Process text field for API payload."""
     if text is None:
@@ -400,7 +401,7 @@ def process_contents_settings(contents: Optional[ContentSettings]) -> Dict[str,
 
 
 def process_context_field(
-    context: Union[bool, dict, ContextEnabled, ContextDisabled, ContextAdvanced, None]
+    context: Union[bool, dict, ContextEnabled, ContextDisabled, ContextAdvanced, None],
 ) -> Optional[Union[bool, Dict[str, int]]]:
     """Process context field for API payload."""
     if context is None:
@@ -448,3 +449,65 @@ def add_optional_fields(
                 payload[api_field] = value.value
             else:
                 payload[api_field] = value
+
+
+def extract_exa_cost_usd(response: Any) -> Optional[float]:
+    """Return ``cost_dollars.total`` (USD) from an Exa SDK response, or None.
+
+    Handles dataclass/pydantic responses (``response.cost_dollars.total``),
+    dicts with camelCase keys (``response["costDollars"]["total"]``), dicts
+    with snake_case keys, and bare numeric strings. Returns None whenever the
+    shape is missing cost info — the caller then skips merge_stats.
+    """
+    if response is None:
+        return None
+
+    # Dataclass / pydantic: response.cost_dollars
+    cost_obj = getattr(response, "cost_dollars", None)
+
+    # Dict payloads: try both camelCase and snake_case
+    if cost_obj is None and isinstance(response, dict):
+        cost_obj = response.get("costDollars") or response.get("cost_dollars")
+
+    if cost_obj is None:
+        return None
+
+    # Already a scalar (code_context endpoint returns a string)
+    if isinstance(cost_obj, (int, float)):
+        return max(0.0, float(cost_obj))
+    if isinstance(cost_obj, str):
+        try:
+            return max(0.0, float(cost_obj))
+        except ValueError:
+            return None
+
+    # Nested object/dict: grab the `total` field
+    total = getattr(cost_obj, "total", None)
+    if total is None and isinstance(cost_obj, dict):
+        total = cost_obj.get("total")
+
+    if total is None:
+        return None
+
+    try:
+        return max(0.0, float(total))
+    except (TypeError, ValueError):
+        return None
+
+
+def merge_exa_cost(block: Block, response: Any) -> None:
+    """Pull ``cost_dollars.total`` off an Exa response and merge it into stats.
+
+    No-op when the response shape has no cost info (e.g. webset CRUD where
+    the SDK does not expose per-call pricing) — emission happens only when
+    Exa actually reports a USD amount.
+    """
+    cost_usd = extract_exa_cost_usd(response)
+    if cost_usd is None:
+        return
+    block.merge_stats(
+        NodeExecutionStats(
+            provider_cost=cost_usd,
+            provider_cost_type="cost_usd",
+        )
+    )

autogpt_platform/backend/backend/blocks/exa/helpers_cost_test.py

@@ -0,0 +1,65 @@
+"""Unit tests for exa/helpers cost-extraction + merge helpers."""
+
+from types import SimpleNamespace
+from unittest.mock import MagicMock
+
+import pytest
+
+from backend.blocks.exa.helpers import extract_exa_cost_usd, merge_exa_cost
+from backend.data.model import NodeExecutionStats
+
+
+@pytest.mark.parametrize(
+    "response, expected",
+    [
+        # Dataclass / SimpleNamespace with cost_dollars.total
+        (SimpleNamespace(cost_dollars=SimpleNamespace(total=0.05)), 0.05),
+        # Dict camelCase
+        ({"costDollars": {"total": 0.10}}, 0.10),
+        # Dict snake_case
+        ({"cost_dollars": {"total": 0.07}}, 0.07),
+        # code_context endpoint shape: plain numeric string
+        (SimpleNamespace(cost_dollars="0.005"), 0.005),
+        # Scalar float on cost_dollars directly
+        (SimpleNamespace(cost_dollars=0.02), 0.02),
+        # Scalar int on cost_dollars
+        (SimpleNamespace(cost_dollars=3), 3.0),
+        # Missing cost info — returns None
+        ({}, None),
+        (SimpleNamespace(other="foo"), None),
+        (None, None),
+        # Nested total=None
+        (SimpleNamespace(cost_dollars=SimpleNamespace(total=None)), None),
+        # Invalid numeric string
+        (SimpleNamespace(cost_dollars="not-a-number"), None),
+        # Negative values clamp to 0
+        (SimpleNamespace(cost_dollars=SimpleNamespace(total=-1.0)), 0.0),
+    ],
+)
+def test_extract_exa_cost_usd_handles_all_shapes(response, expected):
+    assert extract_exa_cost_usd(response) == expected
+
+
+def test_merge_exa_cost_emits_stats_when_cost_present():
+    block = MagicMock()
+    response = SimpleNamespace(cost_dollars=SimpleNamespace(total=0.0421))
+    merge_exa_cost(block, response)
+
+    block.merge_stats.assert_called_once()
+    stats: NodeExecutionStats = block.merge_stats.call_args.args[0]
+    assert stats.provider_cost == pytest.approx(0.0421)
+    assert stats.provider_cost_type == "cost_usd"
+
+
+def test_merge_exa_cost_noops_when_no_cost():
+    """Webset CRUD endpoints don't surface cost_dollars today — the helper
+    must silently skip instead of emitting a 0-cost telemetry record."""
+    block = MagicMock()
+    merge_exa_cost(block, SimpleNamespace(other_field="nothing"))
+    block.merge_stats.assert_not_called()
+
+
+def test_merge_exa_cost_noops_when_response_is_none():
+    block = MagicMock()
+    merge_exa_cost(block, None)
+    block.merge_stats.assert_not_called()

autogpt_platform/backend/backend/blocks/exa/research.py

@@ -12,7 +12,6 @@ from typing import Any, Dict, List, Optional
 
 from pydantic import BaseModel
 
-from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -26,6 +25,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 
 class ResearchModel(str, Enum):
@@ -233,11 +233,7 @@ class ExaCreateResearchBlock(Block):
 
                     if research.cost_dollars:
                         yield "cost_total", research.cost_dollars.total
-                        self.merge_stats(
-                            NodeExecutionStats(
-                                provider_cost=research.cost_dollars.total
-                            )
-                        )
+                        merge_exa_cost(self, research)
                     return
 
                 await asyncio.sleep(check_interval)
@@ -352,9 +348,7 @@ class ExaGetResearchBlock(Block):
             yield "cost_searches", research.cost_dollars.num_searches
             yield "cost_pages", research.cost_dollars.num_pages
             yield "cost_reasoning_tokens", research.cost_dollars.reasoning_tokens
-            self.merge_stats(
-                NodeExecutionStats(provider_cost=research.cost_dollars.total)
-            )
+            merge_exa_cost(self, research)
 
         yield "error_message", research.error
 
@@ -441,9 +435,7 @@ class ExaWaitForResearchBlock(Block):
 
                 if research.cost_dollars:
                     yield "cost_total", research.cost_dollars.total
-                    self.merge_stats(
-                        NodeExecutionStats(provider_cost=research.cost_dollars.total)
-                    )
+                    merge_exa_cost(self, research)
 
                 return
 

autogpt_platform/backend/backend/blocks/exa/search.py

@@ -4,7 +4,6 @@ from typing import Optional
 
 from exa_py import AsyncExa
 
-from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -21,6 +20,7 @@ from .helpers import (
     ContentSettings,
     CostDollars,
     ExaSearchResults,
+    merge_exa_cost,
     process_contents_settings,
 )
 
@@ -207,6 +207,4 @@ class ExaSearchBlock(Block):
 
         if response.cost_dollars:
             yield "cost_dollars", response.cost_dollars
-            self.merge_stats(
-                NodeExecutionStats(provider_cost=response.cost_dollars.total)
-            )
+        merge_exa_cost(self, response)

autogpt_platform/backend/backend/blocks/exa/similar.py

@@ -3,7 +3,6 @@ from typing import Optional
 
 from exa_py import AsyncExa
 
-from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -20,6 +19,7 @@ from .helpers import (
     ContentSettings,
     CostDollars,
     ExaSearchResults,
+    merge_exa_cost,
     process_contents_settings,
 )
 
@@ -168,6 +168,4 @@ class ExaFindSimilarBlock(Block):
 
         if response.cost_dollars:
             yield "cost_dollars", response.cost_dollars
-            self.merge_stats(
-                NodeExecutionStats(provider_cost=response.cost_dollars.total)
-            )
+        merge_exa_cost(self, response)

autogpt_platform/backend/backend/blocks/exa/websets.py

@@ -39,6 +39,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 
 class SearchEntityType(str, Enum):
@@ -394,6 +395,7 @@ class ExaCreateWebsetBlock(Block):
                     metadata=input_data.metadata,
                 )
             )
+            merge_exa_cost(self, webset)
 
             webset_result = Webset.model_validate(webset.model_dump(by_alias=True))
 
@@ -404,6 +406,7 @@ class ExaCreateWebsetBlock(Block):
                     timeout=input_data.polling_timeout,
                     poll_interval=5,
                 )
+                merge_exa_cost(self, final_webset)
                 completion_time = time.time() - start_time
 
                 item_count = 0
@@ -479,6 +482,7 @@ class ExaCreateOrFindWebsetBlock(Block):
 
         try:
             webset = await aexa.websets.get(id=input_data.external_id)
+            merge_exa_cost(self, webset)
             webset_result = Webset.model_validate(webset.model_dump(by_alias=True))
 
             yield "webset", webset_result
@@ -501,6 +505,7 @@ class ExaCreateOrFindWebsetBlock(Block):
                         metadata=input_data.metadata,
                     )
                 )
+                merge_exa_cost(self, webset)
 
                 webset_result = Webset.model_validate(webset.model_dump(by_alias=True))
 
@@ -555,6 +560,7 @@ class ExaUpdateWebsetBlock(Block):
             payload["metadata"] = input_data.metadata
 
         sdk_webset = await aexa.websets.update(id=input_data.webset_id, params=payload)
+        merge_exa_cost(self, sdk_webset)
 
         status_str = (
             sdk_webset.status.value
@@ -566,8 +572,9 @@ class ExaUpdateWebsetBlock(Block):
         yield "status", status_str
         yield "external_id", sdk_webset.external_id
         yield "metadata", sdk_webset.metadata or {}
-        yield "updated_at", (
-            sdk_webset.updated_at.isoformat() if sdk_webset.updated_at else ""
+        yield (
+            "updated_at",
+            (sdk_webset.updated_at.isoformat() if sdk_webset.updated_at else ""),
         )
 
 
@@ -621,6 +628,7 @@ class ExaListWebsetsBlock(Block):
             cursor=input_data.cursor,
             limit=input_data.limit,
         )
+        merge_exa_cost(self, response)
 
         websets_data = [
             w.model_dump(by_alias=True, exclude_none=True) for w in response.data
@@ -679,6 +687,7 @@ class ExaGetWebsetBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         sdk_webset = await aexa.websets.get(id=input_data.webset_id)
+        merge_exa_cost(self, sdk_webset)
 
         status_str = (
             sdk_webset.status.value
@@ -706,11 +715,13 @@ class ExaGetWebsetBlock(Block):
         yield "enrichments", enrichments_data
         yield "monitors", monitors_data
         yield "metadata", sdk_webset.metadata or {}
-        yield "created_at", (
-            sdk_webset.created_at.isoformat() if sdk_webset.created_at else ""
+        yield (
+            "created_at",
+            (sdk_webset.created_at.isoformat() if sdk_webset.created_at else ""),
         )
-        yield "updated_at", (
-            sdk_webset.updated_at.isoformat() if sdk_webset.updated_at else ""
+        yield (
+            "updated_at",
+            (sdk_webset.updated_at.isoformat() if sdk_webset.updated_at else ""),
         )
 
 
@@ -749,6 +760,7 @@ class ExaDeleteWebsetBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         deleted_webset = await aexa.websets.delete(id=input_data.webset_id)
+        merge_exa_cost(self, deleted_webset)
 
         status_str = (
             deleted_webset.status.value
@@ -799,6 +811,7 @@ class ExaCancelWebsetBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         canceled_webset = await aexa.websets.cancel(id=input_data.webset_id)
+        merge_exa_cost(self, canceled_webset)
 
         status_str = (
             canceled_webset.status.value
@@ -969,6 +982,7 @@ class ExaPreviewWebsetBlock(Block):
             payload["entity"] = entity
 
         sdk_preview = await aexa.websets.preview(params=payload)
+        merge_exa_cost(self, sdk_preview)
 
         preview = PreviewWebsetModel.from_sdk(sdk_preview)
 
@@ -1052,6 +1066,7 @@ class ExaWebsetStatusBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         webset = await aexa.websets.get(id=input_data.webset_id)
+        merge_exa_cost(self, webset)
 
         status = (
             webset.status.value
@@ -1186,6 +1201,7 @@ class ExaWebsetSummaryBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         webset = await aexa.websets.get(id=input_data.webset_id)
+        merge_exa_cost(self, webset)
 
         # Extract basic info
         webset_id = webset.id
@@ -1214,6 +1230,7 @@ class ExaWebsetSummaryBlock(Block):
             items_response = await aexa.websets.items.list(
                 webset_id=input_data.webset_id, limit=input_data.sample_size
             )
+            merge_exa_cost(self, items_response)
             sample_items_data = [
                 item.model_dump(by_alias=True, exclude_none=True)
                 for item in items_response.data
@@ -1363,6 +1380,7 @@ class ExaWebsetReadyCheckBlock(Block):
 
         # Get webset details
         webset = await aexa.websets.get(id=input_data.webset_id)
+        merge_exa_cost(self, webset)
 
         status = (
             webset.status.value

autogpt_platform/backend/backend/blocks/exa/websets_enrichment.py

@@ -25,6 +25,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 
 # Mirrored model for stability
@@ -205,6 +206,7 @@ class ExaCreateEnrichmentBlock(Block):
         sdk_enrichment = await aexa.websets.enrichments.create(
             webset_id=input_data.webset_id, params=payload
         )
+        merge_exa_cost(self, sdk_enrichment)
 
         enrichment_id = sdk_enrichment.id
         status = (
@@ -226,6 +228,7 @@ class ExaCreateEnrichmentBlock(Block):
                 current_enrich = await aexa.websets.enrichments.get(
                     webset_id=input_data.webset_id, id=enrichment_id
                 )
+                merge_exa_cost(self, current_enrich)
                 current_status = (
                     current_enrich.status.value
                     if hasattr(current_enrich.status, "value")
@@ -235,6 +238,7 @@ class ExaCreateEnrichmentBlock(Block):
                 if current_status in ["completed", "failed", "cancelled"]:
                     # Estimate items from webset searches
                     webset = await aexa.websets.get(id=input_data.webset_id)
+                    merge_exa_cost(self, webset)
                     if webset.searches:
                         for search in webset.searches:
                             if search.progress:
@@ -332,6 +336,7 @@ class ExaGetEnrichmentBlock(Block):
         sdk_enrichment = await aexa.websets.enrichments.get(
             webset_id=input_data.webset_id, id=input_data.enrichment_id
         )
+        merge_exa_cost(self, sdk_enrichment)
 
         enrichment = WebsetEnrichmentModel.from_sdk(sdk_enrichment)
 
@@ -425,6 +430,7 @@ class ExaUpdateEnrichmentBlock(Block):
         try:
             response = await Requests().patch(url, headers=headers, json=payload)
             data = response.json()
+            # PATCH /websets/{id}/enrichments/{id} doesn't return costDollars.
 
             yield "enrichment_id", data.get("id", "")
             yield "status", data.get("status", "")
@@ -477,6 +483,7 @@ class ExaDeleteEnrichmentBlock(Block):
         deleted_enrichment = await aexa.websets.enrichments.delete(
             webset_id=input_data.webset_id, id=input_data.enrichment_id
         )
+        merge_exa_cost(self, deleted_enrichment)
 
         yield "enrichment_id", deleted_enrichment.id
         yield "success", "true"
@@ -528,12 +535,14 @@ class ExaCancelEnrichmentBlock(Block):
         canceled_enrichment = await aexa.websets.enrichments.cancel(
             webset_id=input_data.webset_id, id=input_data.enrichment_id
         )
+        merge_exa_cost(self, canceled_enrichment)
 
         # Try to estimate how many items were enriched before cancellation
         items_enriched = 0
         items_response = await aexa.websets.items.list(
             webset_id=input_data.webset_id, limit=100
         )
+        merge_exa_cost(self, items_response)
 
         for sdk_item in items_response.data:
             # Check if this enrichment is present

autogpt_platform/backend/backend/blocks/exa/websets_import_export.py

@@ -29,6 +29,7 @@ from backend.sdk import (
 
 from ._config import exa
 from ._test import TEST_CREDENTIALS, TEST_CREDENTIALS_INPUT
+from .helpers import merge_exa_cost
 
 
 # Mirrored model for stability - don't use SDK types directly in block outputs
@@ -297,6 +298,7 @@ class ExaCreateImportBlock(Block):
         sdk_import = await aexa.websets.imports.create(
             params=payload, csv_data=input_data.csv_data
         )
+        merge_exa_cost(self, sdk_import)
 
         import_obj = ImportModel.from_sdk(sdk_import)
 
@@ -361,6 +363,7 @@ class ExaGetImportBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         sdk_import = await aexa.websets.imports.get(import_id=input_data.import_id)
+        merge_exa_cost(self, sdk_import)
 
         import_obj = ImportModel.from_sdk(sdk_import)
 
@@ -430,6 +433,7 @@ class ExaListImportsBlock(Block):
             cursor=input_data.cursor,
             limit=input_data.limit,
         )
+        merge_exa_cost(self, response)
 
         # Convert SDK imports to our stable models
         imports = [ImportModel.from_sdk(i) for i in response.data]
@@ -477,6 +481,7 @@ class ExaDeleteImportBlock(Block):
         deleted_import = await aexa.websets.imports.delete(
             import_id=input_data.import_id
         )
+        merge_exa_cost(self, deleted_import)
 
         yield "import_id", deleted_import.id
         yield "success", "true"
@@ -599,7 +604,7 @@ class ExaExportWebsetBlock(Block):
         try:
             all_items = []
 
-            # Use SDK's list_all iterator to fetch items
+            # list_all paginates internally; cost_dollars is not surfaced per-page
             item_iterator = aexa.websets.items.list_all(
                 webset_id=input_data.webset_id, limit=input_data.max_items
             )

autogpt_platform/backend/backend/blocks/exa/websets_items.py

@@ -30,6 +30,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 
 # Mirrored model for enrichment results
@@ -181,6 +182,7 @@ class ExaGetWebsetItemBlock(Block):
         sdk_item = await aexa.websets.items.get(
             webset_id=input_data.webset_id, id=input_data.item_id
         )
+        merge_exa_cost(self, sdk_item)
 
         item = WebsetItemModel.from_sdk(sdk_item)
 
@@ -293,6 +295,7 @@ class ExaListWebsetItemsBlock(Block):
                 cursor=input_data.cursor,
                 limit=input_data.limit,
             )
+        merge_exa_cost(self, response)
 
         items = [WebsetItemModel.from_sdk(item) for item in response.data]
 
@@ -343,6 +346,7 @@ class ExaDeleteWebsetItemBlock(Block):
         deleted_item = await aexa.websets.items.delete(
             webset_id=input_data.webset_id, id=input_data.item_id
         )
+        merge_exa_cost(self, deleted_item)
 
         yield "item_id", deleted_item.id
         yield "success", "true"
@@ -404,6 +408,7 @@ class ExaBulkWebsetItemsBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         all_items: List[WebsetItemModel] = []
+        # list_all paginates internally; cost_dollars is not surfaced per-page
         item_iterator = aexa.websets.items.list_all(
             webset_id=input_data.webset_id, limit=input_data.max_items
         )
@@ -476,6 +481,7 @@ class ExaWebsetItemsSummaryBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         webset = await aexa.websets.get(id=input_data.webset_id)
+        merge_exa_cost(self, webset)
 
         entity_type = "unknown"
         if webset.searches:
@@ -498,6 +504,7 @@ class ExaWebsetItemsSummaryBlock(Block):
             items_response = await aexa.websets.items.list(
                 webset_id=input_data.webset_id, limit=input_data.sample_size
             )
+            merge_exa_cost(self, items_response)
             # Convert to our stable models
             sample_items = [
                 WebsetItemModel.from_sdk(item) for item in items_response.data
@@ -574,6 +581,7 @@ class ExaGetNewItemsBlock(Block):
             cursor=input_data.since_cursor,
             limit=input_data.max_items,
         )
+        merge_exa_cost(self, response)
 
         # Convert SDK items to our stable models
         new_items = [WebsetItemModel.from_sdk(item) for item in response.data]

autogpt_platform/backend/backend/blocks/exa/websets_monitor.py

@@ -25,6 +25,7 @@ from backend.sdk import (
 
 from ._config import exa
 from ._test import TEST_CREDENTIALS, TEST_CREDENTIALS_INPUT
+from .helpers import merge_exa_cost
 
 
 # Mirrored model for stability - don't use SDK types directly in block outputs
@@ -321,6 +322,7 @@ class ExaCreateMonitorBlock(Block):
             payload["metadata"] = input_data.metadata
 
         sdk_monitor = await aexa.websets.monitors.create(params=payload)
+        merge_exa_cost(self, sdk_monitor)
 
         monitor = MonitorModel.from_sdk(sdk_monitor)
 
@@ -385,6 +387,7 @@ class ExaGetMonitorBlock(Block):
         aexa = AsyncExa(api_key=credentials.api_key.get_secret_value())
 
         sdk_monitor = await aexa.websets.monitors.get(monitor_id=input_data.monitor_id)
+        merge_exa_cost(self, sdk_monitor)
 
         monitor = MonitorModel.from_sdk(sdk_monitor)
 
@@ -479,6 +482,7 @@ class ExaUpdateMonitorBlock(Block):
         sdk_monitor = await aexa.websets.monitors.update(
             monitor_id=input_data.monitor_id, params=payload
         )
+        merge_exa_cost(self, sdk_monitor)
 
         # Convert to our stable model
         monitor = MonitorModel.from_sdk(sdk_monitor)
@@ -525,6 +529,7 @@ class ExaDeleteMonitorBlock(Block):
         deleted_monitor = await aexa.websets.monitors.delete(
             monitor_id=input_data.monitor_id
         )
+        merge_exa_cost(self, deleted_monitor)
 
         yield "monitor_id", deleted_monitor.id
         yield "success", "true"
@@ -586,6 +591,7 @@ class ExaListMonitorsBlock(Block):
             limit=input_data.limit,
             webset_id=input_data.webset_id,
         )
+        merge_exa_cost(self, response)
 
         # Convert SDK monitors to our stable models
         monitors = [MonitorModel.from_sdk(m) for m in response.data]

autogpt_platform/backend/backend/blocks/exa/websets_polling.py

@@ -25,6 +25,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 # Import WebsetItemModel for use in enrichment samples
 # This is safe as websets_items doesn't import from websets_polling
@@ -126,6 +127,7 @@ class ExaWaitForWebsetBlock(Block):
                     timeout=input_data.timeout,
                     poll_interval=input_data.check_interval,
                 )
+                merge_exa_cost(self, final_webset)
 
                 elapsed = time.time() - start_time
 
@@ -165,6 +167,7 @@ class ExaWaitForWebsetBlock(Block):
                 while time.time() - start_time < input_data.timeout:
                     # Get current webset status
                     webset = await aexa.websets.get(id=input_data.webset_id)
+                    merge_exa_cost(self, webset)
                     current_status = (
                         webset.status.value
                         if hasattr(webset.status, "value")
@@ -210,6 +213,7 @@ class ExaWaitForWebsetBlock(Block):
                 # Timeout reached
                 elapsed = time.time() - start_time
                 webset = await aexa.websets.get(id=input_data.webset_id)
+                merge_exa_cost(self, webset)
                 final_status = (
                     webset.status.value
                     if hasattr(webset.status, "value")
@@ -348,6 +352,7 @@ class ExaWaitForSearchBlock(Block):
                 search = await aexa.websets.searches.get(
                     webset_id=input_data.webset_id, id=input_data.search_id
                 )
+                merge_exa_cost(self, search)
 
                 # Extract status
                 status = (
@@ -404,6 +409,7 @@ class ExaWaitForSearchBlock(Block):
             search = await aexa.websets.searches.get(
                 webset_id=input_data.webset_id, id=input_data.search_id
             )
+            merge_exa_cost(self, search)
             final_status = (
                 search.status.value
                 if hasattr(search.status, "value")
@@ -506,6 +512,7 @@ class ExaWaitForEnrichmentBlock(Block):
                 enrichment = await aexa.websets.enrichments.get(
                     webset_id=input_data.webset_id, id=input_data.enrichment_id
                 )
+                merge_exa_cost(self, enrichment)
 
                 # Extract status
                 status = (
@@ -523,16 +530,20 @@ class ExaWaitForEnrichmentBlock(Block):
                     items_enriched = 0
 
                     if input_data.sample_results and status == "completed":
-                        sample_data, items_enriched = (
-                            await self._get_sample_enrichments(
-                                input_data.webset_id, input_data.enrichment_id, aexa
-                            )
+                        (
+                            sample_data,
+                            items_enriched,
+                        ) = await self._get_sample_enrichments(
+                            input_data.webset_id, input_data.enrichment_id, aexa
                         )
 
                     yield "enrichment_id", input_data.enrichment_id
                     yield "final_status", status
                     yield "items_enriched", items_enriched
-                    yield "enrichment_title", enrichment.title or enrichment.description or ""
+                    yield (
+                        "enrichment_title",
+                        enrichment.title or enrichment.description or "",
+                    )
                     yield "elapsed_time", elapsed
                     if input_data.sample_results:
                         yield "sample_data", sample_data
@@ -551,6 +562,7 @@ class ExaWaitForEnrichmentBlock(Block):
             enrichment = await aexa.websets.enrichments.get(
                 webset_id=input_data.webset_id, id=input_data.enrichment_id
             )
+            merge_exa_cost(self, enrichment)
             final_status = (
                 enrichment.status.value
                 if hasattr(enrichment.status, "value")
@@ -576,6 +588,7 @@ class ExaWaitForEnrichmentBlock(Block):
         """Get sample enriched data and count."""
         # Get a few items to see enrichment results using SDK
         response = await aexa.websets.items.list(webset_id=webset_id, limit=5)
+        merge_exa_cost(self, response)
 
         sample_data: list[SampleEnrichmentModel] = []
         enriched_count = 0

autogpt_platform/backend/backend/blocks/exa/websets_search.py

@@ -24,6 +24,7 @@ from backend.sdk import (
 )
 
 from ._config import exa
+from .helpers import merge_exa_cost
 
 
 # Mirrored model for stability
@@ -320,6 +321,7 @@ class ExaCreateWebsetSearchBlock(Block):
         sdk_search = await aexa.websets.searches.create(
             webset_id=input_data.webset_id, params=payload
         )
+        merge_exa_cost(self, sdk_search)
 
         search_id = sdk_search.id
         status = (
@@ -353,6 +355,7 @@ class ExaCreateWebsetSearchBlock(Block):
                 current_search = await aexa.websets.searches.get(
                     webset_id=input_data.webset_id, id=search_id
                 )
+                merge_exa_cost(self, current_search)
                 current_status = (
                     current_search.status.value
                     if hasattr(current_search.status, "value")
@@ -445,6 +448,7 @@ class ExaGetWebsetSearchBlock(Block):
         sdk_search = await aexa.websets.searches.get(
             webset_id=input_data.webset_id, id=input_data.search_id
         )
+        merge_exa_cost(self, sdk_search)
 
         search = WebsetSearchModel.from_sdk(sdk_search)
 
@@ -526,6 +530,7 @@ class ExaCancelWebsetSearchBlock(Block):
         canceled_search = await aexa.websets.searches.cancel(
             webset_id=input_data.webset_id, id=input_data.search_id
         )
+        merge_exa_cost(self, canceled_search)
 
         # Extract items found before cancellation
         items_found = 0
@@ -605,6 +610,7 @@ class ExaFindOrCreateSearchBlock(Block):
 
         # Get webset to check existing searches
         webset = await aexa.websets.get(id=input_data.webset_id)
+        merge_exa_cost(self, webset)
 
         # Look for existing search with same query
         existing_search = None
@@ -639,6 +645,7 @@ class ExaFindOrCreateSearchBlock(Block):
             sdk_search = await aexa.websets.searches.create(
                 webset_id=input_data.webset_id, params=payload
             )
+            merge_exa_cost(self, sdk_search)
 
             search = WebsetSearchModel.from_sdk(sdk_search)
 

autogpt_platform/backend/backend/blocks/fal/_config.py

@@ -0,0 +1,10 @@
+"""Provider registration for fal — metadata only (auth lives in ``_auth.py``)."""
+
+from backend.sdk import ProviderBuilder
+
+fal = (
+    ProviderBuilder("fal")
+    .with_description("Hosted model inference")
+    .with_supported_auth_types("api_key")
+    .build()
+)

autogpt_platform/backend/backend/blocks/firecrawl/_config.py

@@ -1,8 +1,15 @@
 from backend.sdk import BlockCostType, ProviderBuilder
 
+# Firecrawl bills in its own credits (1 credit ≈ $0.001). Each block's
+# run() estimates USD spend from the operation (pages scraped, limit,
+# credits_used on ExtractResponse) and merge_stats populates
+# NodeExecutionStats.provider_cost before billing reconciliation. 1000
+# platform credits per USD means 1 platform credit per Firecrawl credit
+# — roughly matches our existing per-call tier for single-page scrape.
 firecrawl = (
     ProviderBuilder("firecrawl")
+    .with_description("Web scraping and crawling")
     .with_api_key("FIRECRAWL_API_KEY", "Firecrawl API Key")
-    .with_base_cost(1, BlockCostType.RUN)
+    .with_base_cost(1000, BlockCostType.COST_USD)
     .build()
 )

autogpt_platform/backend/backend/blocks/firecrawl/crawl.py

@@ -4,6 +4,7 @@ from firecrawl import FirecrawlApp
 from firecrawl.v2.types import ScrapeOptions
 
 from backend.blocks.firecrawl._api import ScrapeFormat
+from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -86,6 +87,14 @@ class FirecrawlCrawlBlock(Block):
                 wait_for=input_data.wait_for,
             ),
         )
+        # Firecrawl bills 1 credit (~$0.001) per crawled page. crawl_result.data
+        # is the list of scraped pages actually returned.
+        pages = len(crawl_result.data) if crawl_result.data else 0
+        self.merge_stats(
+            NodeExecutionStats(
+                provider_cost=pages * 0.001, provider_cost_type="cost_usd"
+            )
+        )
         yield "data", crawl_result.data
 
         for data in crawl_result.data:

autogpt_platform/backend/backend/blocks/firecrawl/extract.py

@@ -2,25 +2,22 @@ from typing import Any
 
 from firecrawl import FirecrawlApp
 
+from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
     BlockCategory,
-    BlockCost,
-    BlockCostType,
     BlockOutput,
     BlockSchemaInput,
     BlockSchemaOutput,
     CredentialsMetaInput,
     SchemaField,
-    cost,
 )
 from backend.util.exceptions import BlockExecutionError
 
 from ._config import firecrawl
 
 
-@cost(BlockCost(2, BlockCostType.RUN))
 class FirecrawlExtractBlock(Block):
     class Input(BlockSchemaInput):
         credentials: CredentialsMetaInput = firecrawl.credentials_field()
@@ -74,4 +71,13 @@ class FirecrawlExtractBlock(Block):
                 block_id=self.id,
             ) from e
 
+        # Firecrawl surfaces actual credit spend on extract responses
+        # (credits_used). 1 Firecrawl credit ≈ $0.001.
+        credits_used = getattr(extract_result, "credits_used", None) or 0
+        self.merge_stats(
+            NodeExecutionStats(
+                provider_cost=credits_used * 0.001,
+                provider_cost_type="cost_usd",
+            )
+        )
         yield "data", extract_result.data

autogpt_platform/backend/backend/blocks/firecrawl/map.py

@@ -2,6 +2,7 @@ from typing import Any
 
 from firecrawl import FirecrawlApp
 
+from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -50,6 +51,10 @@ class FirecrawlMapWebsiteBlock(Block):
         map_result = app.map(
             url=input_data.url,
         )
+        # Firecrawl bills 1 credit (~$0.001) per map request.
+        self.merge_stats(
+            NodeExecutionStats(provider_cost=0.001, provider_cost_type="cost_usd")
+        )
 
         # Convert SearchResult objects to dicts
         results_data = [

autogpt_platform/backend/backend/blocks/firecrawl/scrape.py

@@ -3,6 +3,7 @@ from typing import Any
 from firecrawl import FirecrawlApp
 
 from backend.blocks.firecrawl._api import ScrapeFormat
+from backend.data.model import NodeExecutionStats
 from backend.sdk import (
     APIKeyCredentials,
     Block,
@@ -81,6 +82,11 @@ class FirecrawlScrapeBlock(Block):
             max_age=input_data.max_age,
             wait_for=input_data.wait_for,
         )
+        # Firecrawl bills 1 credit (~$0.001) per scraped page; scrape is a
+        # single-page operation.
+        self.merge_stats(
+            NodeExecutionStats(provider_cost=0.001, provider_cost_type="cost_usd")
+        )
         yield "data", scrape_result
 
         for f in input_data.formats: