docs: Add workspace and media file architecture documentation (#11989)

### Changes 🏗️

- Added comprehensive architecture documentation at
`docs/platform/workspace-media-architecture.md` covering:
  - Database models (`UserWorkspace`, `UserWorkspaceFile`)
  - `WorkspaceManager` API with session scoping
- `store_media_file()` media normalization pipeline (input types, return
formats)
  - Virus scanning responsibility boundaries
- Decision tree for choosing `WorkspaceManager` vs `store_media_file()`
- Configuration reference including `clamav_max_concurrency` and
`clamav_mark_failed_scans_as_clean`
  - Common patterns with error handling examples
- Updated `autogpt_platform/backend/CLAUDE.md` with a "Workspace & Media
Files" section referencing the new docs
- Removed duplicate `scan_content_safe()` call from
`WriteWorkspaceFileTool` — `WorkspaceManager.write_file()` already scans
internally, so the tool was double-scanning every file
- Replaced removed comment in `workspace.py` with explicit ownership
comment clarifying that `WorkspaceManager` is the single scanning
boundary

### Checklist 📋

#### For code changes:
- [x] I have clearly listed my changes in the PR description
- [x] I have made a test plan
- [x] I have tested my changes according to the test plan:
- [x] Verified `scan_content_safe()` is called inside
`WorkspaceManager.write_file()` (workspace.py:186)
- [x] Verified `store_media_file()` scans all input branches including
local paths (file.py:351)
- [x] Verified documentation accuracy against current source code after
merge with dev
  - [x] CI checks all passing

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Mostly adds documentation and internal developer guidance; the only
code change is a comment clarifying `WorkspaceManager.write_file()` as
the single virus-scanning boundary, with no behavior change.
> 
> **Overview**
> Adds a new `docs/platform/workspace-media-architecture.md` describing
the Workspace storage layer vs the `store_media_file()` media pipeline,
including session scoping and virus-scanning/persistence responsibility
boundaries.
> 
> Updates backend `CLAUDE.md` to point contributors to the new doc when
working on CoPilot uploads/downloads or
`WorkspaceManager`/`store_media_file()`, and clarifies in
`WorkspaceManager.write_file()` (comment-only) that callers should not
duplicate virus scanning.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
18fcfa03f8. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/platform-backend-ci.yml

@@ -5,12 +5,14 @@ on:
     branches: [master, dev, ci-test*]
     paths:
       - ".github/workflows/platform-backend-ci.yml"
+      - ".github/workflows/scripts/get_package_version_from_lockfile.py"
       - "autogpt_platform/backend/**"
       - "autogpt_platform/autogpt_libs/**"
   pull_request:
     branches: [master, dev, release-*]
     paths:
       - ".github/workflows/platform-backend-ci.yml"
+      - ".github/workflows/scripts/get_package_version_from_lockfile.py"
       - "autogpt_platform/backend/**"
       - "autogpt_platform/autogpt_libs/**"
   merge_group:

.github/workflows/platform-frontend-ci.yml

@@ -120,175 +120,6 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
           exitOnceUploaded: true
 
-  e2e_test:
-    name: end-to-end tests
-    runs-on: big-boi
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v6
-        with:
-          submodules: recursive
-
-      - name: Set up Platform - Copy default supabase .env
-        run: |
-          cp ../.env.default ../.env
-
-      - name: Set up Platform - Copy backend .env and set OpenAI API key
-        run: |
-          cp ../backend/.env.default ../backend/.env
-          echo "OPENAI_INTERNAL_API_KEY=${{ secrets.OPENAI_API_KEY }}" >> ../backend/.env
-        env:
-          # Used by E2E test data script to generate embeddings for approved store agents
-          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
-
-      - name: Set up Platform - Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        with:
-          driver: docker-container
-          driver-opts: network=host
-
-      - name: Set up Platform - Expose GHA cache to docker buildx CLI
-        uses: crazy-max/ghaction-github-runtime@v4
-
-      - name: Set up Platform - Build Docker images (with cache)
-        working-directory: autogpt_platform
-        run: |
-          pip install pyyaml
-
-          # Resolve extends and generate a flat compose file that bake can understand
-          docker compose -f docker-compose.yml config > docker-compose.resolved.yml
-
-          # Add cache configuration to the resolved compose file
-          python ../.github/workflows/scripts/docker-ci-fix-compose-build-cache.py \
-            --source docker-compose.resolved.yml \
-            --cache-from "type=gha" \
-            --cache-to "type=gha,mode=max" \
-            --backend-hash "${{ hashFiles('autogpt_platform/backend/Dockerfile', 'autogpt_platform/backend/poetry.lock', 'autogpt_platform/backend/backend') }}" \
-            --frontend-hash "${{ hashFiles('autogpt_platform/frontend/Dockerfile', 'autogpt_platform/frontend/pnpm-lock.yaml', 'autogpt_platform/frontend/src') }}" \
-            --git-ref "${{ github.ref }}"
-
-          # Build with bake using the resolved compose file (now includes cache config)
-          docker buildx bake --allow=fs.read=.. -f docker-compose.resolved.yml --load
-        env:
-          NEXT_PUBLIC_PW_TEST: true
-
-      - name: Set up tests - Cache E2E test data
-        id: e2e-data-cache
-        uses: actions/cache@v5
-        with:
-          path: /tmp/e2e_test_data.sql
-          key: e2e-test-data-${{ hashFiles('autogpt_platform/backend/test/e2e_test_data.py', 'autogpt_platform/backend/migrations/**', '.github/workflows/platform-frontend-ci.yml') }}
-
-      - name: Set up Platform - Start Supabase DB + Auth
-        run: |
-          docker compose -f ../docker-compose.resolved.yml up -d db auth --no-build
-          echo "Waiting for database to be ready..."
-          timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db pg_isready -U postgres 2>/dev/null; do sleep 2; done'
-          echo "Waiting for auth service to be ready..."
-          timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db psql -U postgres -d postgres -c "SELECT 1 FROM auth.users LIMIT 1" 2>/dev/null; do sleep 2; done' || echo "Auth schema check timeout, continuing..."
-
-      - name: Set up Platform - Run migrations
-        run: |
-          echo "Running migrations..."
-          docker compose -f ../docker-compose.resolved.yml run --rm migrate
-          echo "✅ Migrations completed"
-        env:
-          NEXT_PUBLIC_PW_TEST: true
-
-      - name: Set up tests - Load cached E2E test data
-        if: steps.e2e-data-cache.outputs.cache-hit == 'true'
-        run: |
-          echo "✅ Found cached E2E test data, restoring..."
-          {
-            echo "SET session_replication_role = 'replica';"
-            cat /tmp/e2e_test_data.sql
-            echo "SET session_replication_role = 'origin';"
-          } | docker compose -f ../docker-compose.resolved.yml exec -T db psql -U postgres -d postgres -b
-          # Refresh materialized views after restore
-          docker compose -f ../docker-compose.resolved.yml exec -T db \
-            psql -U postgres -d postgres -b -c "SET search_path TO platform; SELECT refresh_store_materialized_views();" || true
-
-          echo "✅ E2E test data restored from cache"
-
-      - name: Set up Platform - Start (all other services)
-        run: |
-          docker compose -f ../docker-compose.resolved.yml up -d --no-build
-          echo "Waiting for rest_server to be ready..."
-          timeout 60 sh -c 'until curl -f http://localhost:8006/health 2>/dev/null; do sleep 2; done' || echo "Rest server health check timeout, continuing..."
-        env:
-          NEXT_PUBLIC_PW_TEST: true
-
-      - name: Set up tests - Create E2E test data
-        if: steps.e2e-data-cache.outputs.cache-hit != 'true'
-        run: |
-          echo "Creating E2E test data..."
-          docker cp ../backend/test/e2e_test_data.py $(docker compose -f ../docker-compose.resolved.yml ps -q rest_server):/tmp/e2e_test_data.py
-          docker compose -f ../docker-compose.resolved.yml exec -T rest_server sh -c "cd /app/autogpt_platform && python /tmp/e2e_test_data.py" || {
-            echo "❌ E2E test data creation failed!"
-            docker compose -f ../docker-compose.resolved.yml logs --tail=50 rest_server
-            exit 1
-          }
-
-          # Dump auth.users + platform schema for cache (two separate dumps)
-          echo "Dumping database for cache..."
-          {
-            docker compose -f ../docker-compose.resolved.yml exec -T db \
-              pg_dump -U postgres --data-only --column-inserts \
-              --table='auth.users' postgres
-            docker compose -f ../docker-compose.resolved.yml exec -T db \
-              pg_dump -U postgres --data-only --column-inserts \
-              --schema=platform \
-              --exclude-table='platform._prisma_migrations' \
-              --exclude-table='platform.apscheduler_jobs' \
-              --exclude-table='platform.apscheduler_jobs_batched_notifications' \
-              postgres
-          } > /tmp/e2e_test_data.sql
-
-          echo "✅ Database dump created for caching ($(wc -l < /tmp/e2e_test_data.sql) lines)"
-
-      - name: Set up tests - Enable corepack
-        run: corepack enable
-
-      - name: Set up tests - Set up Node
-        uses: actions/setup-node@v6
-        with:
-          node-version: "22.18.0"
-          cache: "pnpm"
-          cache-dependency-path: autogpt_platform/frontend/pnpm-lock.yaml
-
-      - name: Set up tests - Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Set up tests - Install browser 'chromium'
-        run: pnpm playwright install --with-deps chromium
-
-      - name: Run Playwright tests
-        run: pnpm test:no-build
-        continue-on-error: false
-
-      - name: Upload Playwright report
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: playwright-report
-          path: playwright-report
-          if-no-files-found: ignore
-          retention-days: 3
-
-      - name: Upload Playwright test results
-        if: always()
-        uses: actions/upload-artifact@v4
-        with:
-          name: playwright-test-results
-          path: test-results
-          if-no-files-found: ignore
-          retention-days: 3
-
-      - name: Print Final Docker Compose logs
-        if: always()
-        run: docker compose -f ../docker-compose.resolved.yml logs
-
   integration_test:
     runs-on: ubuntu-latest
     needs: setup

.github/workflows/platform-fullstack-ci.yml

@@ -1,14 +1,18 @@
-name: AutoGPT Platform - Frontend CI
+name: AutoGPT Platform - Full-stack CI
 
 on:
   push:
     branches: [master, dev]
     paths:
       - ".github/workflows/platform-fullstack-ci.yml"
+      - ".github/workflows/scripts/docker-ci-fix-compose-build-cache.py"
+      - ".github/workflows/scripts/get_package_version_from_lockfile.py"
       - "autogpt_platform/**"
   pull_request:
     paths:
       - ".github/workflows/platform-fullstack-ci.yml"
+      - ".github/workflows/scripts/docker-ci-fix-compose-build-cache.py"
+      - ".github/workflows/scripts/get_package_version_from_lockfile.py"
       - "autogpt_platform/**"
   merge_group:
 
@@ -24,42 +28,28 @@ defaults:
 jobs:
   setup:
     runs-on: ubuntu-latest
-    outputs:
-      cache-key: ${{ steps.cache-key.outputs.key }}
 
     steps:
       - name: Checkout repository
         uses: actions/checkout@v6
 
-      - name: Set up Node.js
-        uses: actions/setup-node@v6
-        with:
-          node-version: "22.18.0"
-
       - name: Enable corepack
         run: corepack enable
 
-      - name: Generate cache key
-        id: cache-key
-        run: echo "key=${{ runner.os }}-pnpm-${{ hashFiles('autogpt_platform/frontend/pnpm-lock.yaml', 'autogpt_platform/frontend/package.json') }}" >> $GITHUB_OUTPUT
-
-      - name: Cache dependencies
-        uses: actions/cache@v5
+      - name: Set up Node
+        uses: actions/setup-node@v6
         with:
-          path: ~/.pnpm-store
-          key: ${{ steps.cache-key.outputs.key }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-${{ hashFiles('autogpt_platform/frontend/pnpm-lock.yaml') }}
-            ${{ runner.os }}-pnpm-
+          node-version: "22.18.0"
+          cache: "pnpm"
+          cache-dependency-path: autogpt_platform/frontend/pnpm-lock.yaml
 
-      - name: Install dependencies
+      - name: Install dependencies to populate cache
         run: pnpm install --frozen-lockfile
 
-  types:
-    runs-on: big-boi
+  check-api-types:
+    name: check API types
+    runs-on: ubuntu-latest
     needs: setup
-    strategy:
-      fail-fast: false
 
     steps:
       - name: Checkout repository
@@ -67,70 +57,256 @@ jobs:
         with:
           submodules: recursive
 
-      - name: Set up Node.js
+      # ------------------------ Backend setup ------------------------
+
+      - name: Set up Backend - Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Set up Backend - Install Poetry
+        working-directory: autogpt_platform/backend
+        run: |
+          POETRY_VERSION=$(python ../../.github/workflows/scripts/get_package_version_from_lockfile.py poetry)
+          echo "Installing Poetry version ${POETRY_VERSION}"
+          curl -sSL https://install.python-poetry.org | POETRY_VERSION=$POETRY_VERSION python3 -
+
+      - name: Set up Backend - Set up dependency cache
+        uses: actions/cache@v5
+        with:
+          path: ~/.cache/pypoetry
+          key: poetry-${{ runner.os }}-${{ hashFiles('autogpt_platform/backend/poetry.lock') }}
+
+      - name: Set up Backend - Install dependencies
+        working-directory: autogpt_platform/backend
+        run: poetry install
+
+      - name: Set up Backend - Generate Prisma client
+        working-directory: autogpt_platform/backend
+        run: poetry run prisma generate && poetry run gen-prisma-stub
+
+      - name: Set up Frontend - Export OpenAPI schema from Backend
+        working-directory: autogpt_platform/backend
+        run: poetry run export-api-schema --output ../frontend/src/app/api/openapi.json
+
+      # ------------------------ Frontend setup ------------------------
+
+      - name: Set up Frontend - Enable corepack
+        run: corepack enable
+
+      - name: Set up Frontend - Set up Node
         uses: actions/setup-node@v6
         with:
           node-version: "22.18.0"
+          cache: "pnpm"
+          cache-dependency-path: autogpt_platform/frontend/pnpm-lock.yaml
 
-      - name: Enable corepack
-        run: corepack enable
-
-      - name: Copy default supabase .env
-        run: |
-          cp ../.env.default ../.env
-
-      - name: Copy backend .env
-        run: |
-          cp ../backend/.env.default ../backend/.env
-
-      - name: Run docker compose
-        run: |
-          docker compose -f ../docker-compose.yml --profile local up -d deps_backend
-
-      - name: Restore dependencies cache
-        uses: actions/cache@v5
-        with:
-          path: ~/.pnpm-store
-          key: ${{ needs.setup.outputs.cache-key }}
-          restore-keys: |
-            ${{ runner.os }}-pnpm-
-
-      - name: Install dependencies
+      - name: Set up Frontend - Install dependencies
         run: pnpm install --frozen-lockfile
 
-      - name: Setup .env
-        run: cp .env.default .env
-
-      - name: Wait for services to be ready
-        run: |
-          echo "Waiting for rest_server to be ready..."
-          timeout 60 sh -c 'until curl -f http://localhost:8006/health 2>/dev/null; do sleep 2; done' || echo "Rest server health check timeout, continuing..."
-          echo "Waiting for database to be ready..."
-          timeout 60 sh -c 'until docker compose -f ../docker-compose.yml exec -T db pg_isready -U postgres 2>/dev/null; do sleep 2; done' || echo "Database ready check timeout, continuing..."
-
-      - name: Generate API queries
-        run: pnpm generate:api:force
+      - name: Set up Frontend - Format OpenAPI schema
+        id: format-schema
+        run: pnpm prettier --write ./src/app/api/openapi.json
 
       - name: Check for API schema changes
         run: |
           if ! git diff --exit-code src/app/api/openapi.json; then
             echo "❌ API schema changes detected in src/app/api/openapi.json"
             echo ""
-            echo "The openapi.json file has been modified after running 'pnpm generate:api-all'."
+            echo "The openapi.json file has been modified after exporting the API schema."
             echo "This usually means changes have been made in the BE endpoints without updating the Frontend."
             echo "The API schema is now out of sync with the Front-end queries."
             echo ""
             echo "To fix this:"
-            echo "1. Pull the backend 'docker compose pull && docker compose up -d --build --force-recreate'"
-            echo "2. Run 'pnpm generate:api' locally"
-            echo "3. Run 'pnpm types' locally"
-            echo "4. Fix any TypeScript errors that may have been introduced"
-            echo "5. Commit and push your changes"
+            echo "\nIn the backend directory:"
+            echo "1. Run 'poetry run export-api-schema --output ../frontend/src/app/api/openapi.json'"
+            echo "\nIn the frontend directory:"
+            echo "2. Run 'pnpm prettier --write src/app/api/openapi.json'"
+            echo "3. Run 'pnpm generate:api'"
+            echo "4. Run 'pnpm types'"
+            echo "5. Fix any TypeScript errors that may have been introduced"
+            echo "6. Commit and push your changes"
             echo ""
             exit 1
           else
             echo "✅ No API schema changes detected"
           fi
 
-      - name: Run Typescript checks
+      - name: Set up Frontend - Generate API client
+        id: generate-api-client
+        run: pnpm orval --config ./orval.config.ts
+        # Continue with type generation & check even if there are schema changes
+        if: success() || (steps.format-schema.outcome == 'success')
+
+      - name: Check for TypeScript errors
         run: pnpm types
+        if: success() || (steps.generate-api-client.outcome == 'success')
+
+  e2e_test:
+    name: end-to-end tests
+    runs-on: big-boi
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          submodules: recursive
+
+      - name: Set up Platform - Copy default supabase .env
+        run: |
+          cp ../.env.default ../.env
+
+      - name: Set up Platform - Copy backend .env and set OpenAI API key
+        run: |
+          cp ../backend/.env.default ../backend/.env
+          echo "OPENAI_INTERNAL_API_KEY=${{ secrets.OPENAI_API_KEY }}" >> ../backend/.env
+        env:
+          # Used by E2E test data script to generate embeddings for approved store agents
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+
+      - name: Set up Platform - Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+        with:
+          driver: docker-container
+          driver-opts: network=host
+
+      - name: Set up Platform - Expose GHA cache to docker buildx CLI
+        uses: crazy-max/ghaction-github-runtime@v4
+
+      - name: Set up Platform - Build Docker images (with cache)
+        working-directory: autogpt_platform
+        run: |
+          pip install pyyaml
+
+          # Resolve extends and generate a flat compose file that bake can understand
+          docker compose -f docker-compose.yml config > docker-compose.resolved.yml
+
+          # Add cache configuration to the resolved compose file
+          python ../.github/workflows/scripts/docker-ci-fix-compose-build-cache.py \
+            --source docker-compose.resolved.yml \
+            --cache-from "type=gha" \
+            --cache-to "type=gha,mode=max" \
+            --backend-hash "${{ hashFiles('autogpt_platform/backend/Dockerfile', 'autogpt_platform/backend/poetry.lock', 'autogpt_platform/backend/backend/**') }}" \
+            --frontend-hash "${{ hashFiles('autogpt_platform/frontend/Dockerfile', 'autogpt_platform/frontend/pnpm-lock.yaml', 'autogpt_platform/frontend/src/**') }}" \
+            --git-ref "${{ github.ref }}"
+
+          # Build with bake using the resolved compose file (now includes cache config)
+          docker buildx bake --allow=fs.read=.. -f docker-compose.resolved.yml --load
+        env:
+          NEXT_PUBLIC_PW_TEST: true
+
+      - name: Set up tests - Cache E2E test data
+        id: e2e-data-cache
+        uses: actions/cache@v5
+        with:
+          path: /tmp/e2e_test_data.sql
+          key: e2e-test-data-${{ hashFiles('autogpt_platform/backend/test/e2e_test_data.py', 'autogpt_platform/backend/migrations/**', '.github/workflows/platform-fullstack-ci.yml') }}
+
+      - name: Set up Platform - Start Supabase DB + Auth
+        run: |
+          docker compose -f ../docker-compose.resolved.yml up -d db auth --no-build
+          echo "Waiting for database to be ready..."
+          timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db pg_isready -U postgres 2>/dev/null; do sleep 2; done'
+          echo "Waiting for auth service to be ready..."
+          timeout 60 sh -c 'until docker compose -f ../docker-compose.resolved.yml exec -T db psql -U postgres -d postgres -c "SELECT 1 FROM auth.users LIMIT 1" 2>/dev/null; do sleep 2; done' || echo "Auth schema check timeout, continuing..."
+
+      - name: Set up Platform - Run migrations
+        run: |
+          echo "Running migrations..."
+          docker compose -f ../docker-compose.resolved.yml run --rm migrate
+          echo "✅ Migrations completed"
+        env:
+          NEXT_PUBLIC_PW_TEST: true
+
+      - name: Set up tests - Load cached E2E test data
+        if: steps.e2e-data-cache.outputs.cache-hit == 'true'
+        run: |
+          echo "✅ Found cached E2E test data, restoring..."
+          {
+            echo "SET session_replication_role = 'replica';"
+            cat /tmp/e2e_test_data.sql
+            echo "SET session_replication_role = 'origin';"
+          } | docker compose -f ../docker-compose.resolved.yml exec -T db psql -U postgres -d postgres -b
+          # Refresh materialized views after restore
+          docker compose -f ../docker-compose.resolved.yml exec -T db \
+            psql -U postgres -d postgres -b -c "SET search_path TO platform; SELECT refresh_store_materialized_views();" || true
+
+          echo "✅ E2E test data restored from cache"
+
+      - name: Set up Platform - Start (all other services)
+        run: |
+          docker compose -f ../docker-compose.resolved.yml up -d --no-build
+          echo "Waiting for rest_server to be ready..."
+          timeout 60 sh -c 'until curl -f http://localhost:8006/health 2>/dev/null; do sleep 2; done' || echo "Rest server health check timeout, continuing..."
+        env:
+          NEXT_PUBLIC_PW_TEST: true
+
+      - name: Set up tests - Create E2E test data
+        if: steps.e2e-data-cache.outputs.cache-hit != 'true'
+        run: |
+          echo "Creating E2E test data..."
+          docker cp ../backend/test/e2e_test_data.py $(docker compose -f ../docker-compose.resolved.yml ps -q rest_server):/tmp/e2e_test_data.py
+          docker compose -f ../docker-compose.resolved.yml exec -T rest_server sh -c "cd /app/autogpt_platform && python /tmp/e2e_test_data.py" || {
+            echo "❌ E2E test data creation failed!"
+            docker compose -f ../docker-compose.resolved.yml logs --tail=50 rest_server
+            exit 1
+          }
+
+          # Dump auth.users + platform schema for cache (two separate dumps)
+          echo "Dumping database for cache..."
+          {
+            docker compose -f ../docker-compose.resolved.yml exec -T db \
+              pg_dump -U postgres --data-only --column-inserts \
+              --table='auth.users' postgres
+            docker compose -f ../docker-compose.resolved.yml exec -T db \
+              pg_dump -U postgres --data-only --column-inserts \
+              --schema=platform \
+              --exclude-table='platform._prisma_migrations' \
+              --exclude-table='platform.apscheduler_jobs' \
+              --exclude-table='platform.apscheduler_jobs_batched_notifications' \
+              postgres
+          } > /tmp/e2e_test_data.sql
+
+          echo "✅ Database dump created for caching ($(wc -l < /tmp/e2e_test_data.sql) lines)"
+
+      - name: Set up tests - Enable corepack
+        run: corepack enable
+
+      - name: Set up tests - Set up Node
+        uses: actions/setup-node@v6
+        with:
+          node-version: "22.18.0"
+          cache: "pnpm"
+          cache-dependency-path: autogpt_platform/frontend/pnpm-lock.yaml
+
+      - name: Set up tests - Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Set up tests - Install browser 'chromium'
+        run: pnpm playwright install --with-deps chromium
+
+      - name: Run Playwright tests
+        run: pnpm test:no-build
+        continue-on-error: false
+
+      - name: Upload Playwright report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-report
+          path: playwright-report
+          if-no-files-found: ignore
+          retention-days: 3
+
+      - name: Upload Playwright test results
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: playwright-test-results
+          path: test-results
+          if-no-files-found: ignore
+          retention-days: 3
+
+      - name: Print Final Docker Compose logs
+        if: always()
+        run: docker compose -f ../docker-compose.resolved.yml logs

autogpt_platform/backend/CLAUDE.md

@@ -178,6 +178,16 @@ yield "image_url", result_url
 3. Write tests alongside the route file
 4. Run `poetry run test` to verify
 
+## Workspace & Media Files
+
+**Read [Workspace & Media Architecture](../../docs/platform/workspace-media-architecture.md) when:**
+- Working on CoPilot file upload/download features
+- Building blocks that handle `MediaFileType` inputs/outputs
+- Modifying `WorkspaceManager` or `store_media_file()`
+- Debugging file persistence or virus scanning issues
+
+Covers: `WorkspaceManager` (persistent storage with session scoping), `store_media_file()` (media normalization pipeline), and responsibility boundaries for virus scanning and persistence.
+
 ## Security Implementation
 
 ### Cache Protection Middleware

autogpt_platform/backend/backend/copilot/baseline/service.py

@@ -40,7 +40,7 @@ from backend.copilot.response_model import (
 from backend.copilot.service import (
     _build_system_prompt,
     _generate_session_title,
-    client,
+    _get_openai_client,
     config,
 )
 from backend.copilot.tools import execute_tool, get_available_tools
@@ -89,7 +89,7 @@ async def _compress_session_messages(
         result = await compress_context(
             messages=messages_dict,
             model=config.model,
-            client=client,
+            client=_get_openai_client(),
         )
     except Exception as e:
         logger.warning("[Baseline] Context compression with LLM failed: %s", e)
@@ -235,7 +235,7 @@ async def stream_chat_completion_baseline(
             )
             if tools:
                 create_kwargs["tools"] = tools
-            response = await client.chat.completions.create(**create_kwargs)  # type: ignore[arg-type]  # dynamic kwargs
+            response = await _get_openai_client().chat.completions.create(**create_kwargs)  # type: ignore[arg-type]  # dynamic kwargs
 
             # Accumulate streamed response (text + tool calls)
             round_text = ""

autogpt_platform/backend/backend/copilot/context.py

@@ -17,17 +17,8 @@ from backend.util.workspace import WorkspaceManager
 if TYPE_CHECKING:
     from e2b import AsyncSandbox
 
-# Allowed base directory for the Read tool.  Public so service.py can use it
-# for sweep operations without depending on a private implementation detail.
-# Respects CLAUDE_CONFIG_DIR env var, consistent with transcript.py's
-# _projects_base() function.
-_config_dir = os.environ.get("CLAUDE_CONFIG_DIR") or os.path.expanduser("~/.claude")
-SDK_PROJECTS_DIR = os.path.realpath(os.path.join(_config_dir, "projects"))
-
-# Compiled UUID pattern for validating conversation directory names.
-# Kept as a module-level constant so the security-relevant pattern is easy
-# to audit in one place and avoids recompilation on every call.
-_UUID_RE = re.compile(r"^[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}$", re.IGNORECASE)
+# Allowed base directory for the Read tool.
+_SDK_PROJECTS_DIR = os.path.realpath(os.path.expanduser("~/.claude/projects"))
 
 # Encoded project-directory name for the current session (e.g.
 # "-private-tmp-copilot-<uuid>").  Set by set_execution_context() so path
@@ -44,20 +35,11 @@ _current_sandbox: ContextVar["AsyncSandbox | None"] = ContextVar(
 _current_sdk_cwd: ContextVar[str] = ContextVar("_current_sdk_cwd", default="")
 
 
-def encode_cwd_for_cli(cwd: str) -> str:
-    """Encode a working directory path the same way the Claude CLI does.
-
-    The Claude CLI encodes the absolute cwd as a directory name by replacing
-    every non-alphanumeric character with ``-``.  For example
-    ``/tmp/copilot-abc`` becomes ``-tmp-copilot-abc``.
-    """
+def _encode_cwd_for_cli(cwd: str) -> str:
+    """Encode a working directory path the same way the Claude CLI does."""
     return re.sub(r"[^a-zA-Z0-9]", "-", os.path.realpath(cwd))
 
 
-# Keep the private alias for internal callers (backwards compat).
-_encode_cwd_for_cli = encode_cwd_for_cli
-
-
 def set_execution_context(
     user_id: str | None,
     session: ChatSession,
@@ -118,9 +100,7 @@ def is_allowed_local_path(path: str, sdk_cwd: str | None = None) -> bool:
 
     Allowed:
     - Files under *sdk_cwd* (``/tmp/copilot-<session>/``)
-    - Files under ``~/.claude/projects/<encoded-cwd>/<uuid>/tool-results/...``.
-      The SDK nests tool-results under a conversation UUID directory;
-      the UUID segment is validated with ``_UUID_RE``.
+    - Files under ``~/.claude/projects/<encoded-cwd>/tool-results/`` (SDK tool-results)
     """
     if not path:
         return False
@@ -139,22 +119,10 @@ def is_allowed_local_path(path: str, sdk_cwd: str | None = None) -> bool:
 
     encoded = _current_project_dir.get("")
     if encoded:
-        project_dir = os.path.realpath(os.path.join(SDK_PROJECTS_DIR, encoded))
-        # Defence-in-depth: ensure project_dir didn't escape the base.
-        if not project_dir.startswith(SDK_PROJECTS_DIR + os.sep):
-            return False
-        # Only allow: <encoded-cwd>/<uuid>/tool-results/<file>
-        # The SDK always creates a conversation UUID directory between
-        # the project dir and tool-results/.
-        if resolved.startswith(project_dir + os.sep):
-            relative = resolved[len(project_dir) + 1 :]
-            parts = relative.split(os.sep)
-            # Require exactly: [<uuid>, "tool-results", <file>, ...]
-            if (
-                len(parts) >= 3
-                and _UUID_RE.match(parts[0])
-                and parts[1] == "tool-results"
-            ):
-                return True
+        tool_results_dir = os.path.join(_SDK_PROJECTS_DIR, encoded, "tool-results")
+        if resolved == tool_results_dir or resolved.startswith(
+            tool_results_dir + os.sep
+        ):
+            return True
 
     return False

autogpt_platform/backend/backend/copilot/context_test.py

@@ -9,7 +9,7 @@ from unittest.mock import MagicMock
 import pytest
 
 from backend.copilot.context import (
-    SDK_PROJECTS_DIR,
+    _SDK_PROJECTS_DIR,
     _current_project_dir,
     get_current_sandbox,
     get_execution_context,
@@ -104,13 +104,11 @@ def test_is_allowed_local_path_no_sdk_cwd_no_project_dir():
     assert not is_allowed_local_path("/tmp/some-file.txt", sdk_cwd=None)
 
 
-def test_is_allowed_local_path_tool_results_with_uuid():
-    """Files under <encoded-cwd>/<uuid>/tool-results/ are allowed."""
+def test_is_allowed_local_path_tool_results_dir():
+    """Files under the tool-results directory for the current project are allowed."""
     encoded = "test-encoded-dir"
-    conv_uuid = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
-    path = os.path.join(
-        SDK_PROJECTS_DIR, encoded, conv_uuid, "tool-results", "output.txt"
-    )
+    tool_results_dir = os.path.join(_SDK_PROJECTS_DIR, encoded, "tool-results")
+    path = os.path.join(tool_results_dir, "output.txt")
 
     _current_project_dir.set(encoded)
     try:
@@ -119,22 +117,10 @@ def test_is_allowed_local_path_tool_results_with_uuid():
         _current_project_dir.set("")
 
 
-def test_is_allowed_local_path_tool_results_without_uuid_rejected():
-    """Direct <encoded-cwd>/tool-results/ (no UUID) is rejected."""
-    encoded = "test-encoded-dir"
-    path = os.path.join(SDK_PROJECTS_DIR, encoded, "tool-results", "output.txt")
-
-    _current_project_dir.set(encoded)
-    try:
-        assert not is_allowed_local_path(path, sdk_cwd=None)
-    finally:
-        _current_project_dir.set("")
-
-
 def test_is_allowed_local_path_sibling_of_tool_results_is_rejected():
     """A path adjacent to tool-results/ but not inside it is rejected."""
     encoded = "test-encoded-dir"
-    sibling_path = os.path.join(SDK_PROJECTS_DIR, encoded, "other-dir", "file.txt")
+    sibling_path = os.path.join(_SDK_PROJECTS_DIR, encoded, "other-dir", "file.txt")
 
     _current_project_dir.set(encoded)
     try:
@@ -143,21 +129,6 @@ def test_is_allowed_local_path_sibling_of_tool_results_is_rejected():
         _current_project_dir.set("")
 
 
-def test_is_allowed_local_path_valid_uuid_wrong_segment_name_rejected():
-    """A valid UUID dir but non-'tool-results' second segment is rejected."""
-    encoded = "test-encoded-dir"
-    uuid_str = "12345678-1234-5678-9abc-def012345678"
-    path = os.path.join(
-        SDK_PROJECTS_DIR, encoded, uuid_str, "not-tool-results", "output.txt"
-    )
-
-    _current_project_dir.set(encoded)
-    try:
-        assert not is_allowed_local_path(path, sdk_cwd=None)
-    finally:
-        _current_project_dir.set("")
-
-
 # ---------------------------------------------------------------------------
 # resolve_sandbox_path
 # ---------------------------------------------------------------------------

autogpt_platform/backend/backend/copilot/prompting.py

@@ -152,13 +152,6 @@ def _build_storage_supplement(
 
 ### File persistence
 Important files (code, configs, outputs) should be saved to workspace to ensure they persist.
-
-### SDK tool-result files
-When tool outputs are large, the SDK truncates them and saves the full output to
-a local file under `~/.claude/projects/.../tool-results/`. To read these files,
-always use `read_file` or `Read` (NOT `read_workspace_file`).
-`read_workspace_file` reads from cloud workspace storage, where SDK
-tool-results are NOT stored.
 {_SHARED_TOOL_NOTES}"""
 
 

autogpt_platform/backend/backend/copilot/sdk/e2b_file_tools.py

@@ -26,41 +26,6 @@ from backend.copilot.context import (
 logger = logging.getLogger(__name__)
 
 
-async def _check_sandbox_symlink_escape(
-    sandbox: Any,
-    parent: str,
-) -> str | None:
-    """Resolve the canonical parent path inside the sandbox to detect symlink escapes.
-
-    ``normpath`` (used by ``resolve_sandbox_path``) only normalises the string;
-    ``readlink -f`` follows actual symlinks on the sandbox filesystem.
-
-    Returns the canonical parent path, or ``None`` if the path escapes
-    ``E2B_WORKDIR``.
-
-    Note: There is an inherent TOCTOU window between this check and the
-    subsequent ``sandbox.files.write()``.  A symlink could theoretically be
-    replaced between the two operations.  This is acceptable in the E2B
-    sandbox model since the sandbox is single-user and ephemeral.
-    """
-    canonical_res = await sandbox.commands.run(
-        f"readlink -f {shlex.quote(parent or E2B_WORKDIR)}",
-        cwd=E2B_WORKDIR,
-        timeout=5,
-    )
-    canonical_parent = (canonical_res.stdout or "").strip()
-    if (
-        canonical_res.exit_code != 0
-        or not canonical_parent
-        or (
-            canonical_parent != E2B_WORKDIR
-            and not canonical_parent.startswith(E2B_WORKDIR + "/")
-        )
-    ):
-        return None
-    return canonical_parent
-
-
 def _get_sandbox():
     return get_current_sandbox()
 
@@ -141,10 +106,6 @@ async def _handle_write_file(args: dict[str, Any]) -> dict[str, Any]:
         parent = os.path.dirname(remote)
         if parent and parent != E2B_WORKDIR:
             await sandbox.files.make_dir(parent)
-        canonical_parent = await _check_sandbox_symlink_escape(sandbox, parent)
-        if canonical_parent is None:
-            return _mcp(f"Path must be within {E2B_WORKDIR}: {parent}", error=True)
-        remote = os.path.join(canonical_parent, os.path.basename(remote))
         await sandbox.files.write(remote, content)
     except Exception as exc:
         return _mcp(f"Failed to write {remote}: {exc}", error=True)
@@ -169,12 +130,6 @@ async def _handle_edit_file(args: dict[str, Any]) -> dict[str, Any]:
         return result
     sandbox, remote = result
 
-    parent = os.path.dirname(remote)
-    canonical_parent = await _check_sandbox_symlink_escape(sandbox, parent)
-    if canonical_parent is None:
-        return _mcp(f"Path must be within {E2B_WORKDIR}: {parent}", error=True)
-    remote = os.path.join(canonical_parent, os.path.basename(remote))
-
     try:
         raw: bytes = await sandbox.files.read(remote, format="bytes")
         content = raw.decode("utf-8", errors="replace")

autogpt_platform/backend/backend/copilot/sdk/e2b_file_tools_test.py

@@ -4,19 +4,15 @@ Pure unit tests with no external dependencies (no E2B, no sandbox).
 """
 
 import os
-import shutil
-from types import SimpleNamespace
-from unittest.mock import AsyncMock
 
 import pytest
 
-from backend.copilot.context import E2B_WORKDIR, SDK_PROJECTS_DIR, _current_project_dir
+from backend.copilot.context import _current_project_dir
+
+from .e2b_file_tools import _read_local, resolve_sandbox_path
+
+_SDK_PROJECTS_DIR = os.path.realpath(os.path.expanduser("~/.claude/projects"))
 
-from .e2b_file_tools import (
-    _check_sandbox_symlink_escape,
-    _read_local,
-    resolve_sandbox_path,
-)
 
 # ---------------------------------------------------------------------------
 # resolve_sandbox_path — sandbox path normalisation & boundary enforcement
@@ -25,48 +21,46 @@ from .e2b_file_tools import (
 
 class TestResolveSandboxPath:
     def test_relative_path_resolved(self):
-        assert resolve_sandbox_path("src/main.py") == f"{E2B_WORKDIR}/src/main.py"
+        assert resolve_sandbox_path("src/main.py") == "/home/user/src/main.py"
 
     def test_absolute_within_sandbox(self):
-        assert (
-            resolve_sandbox_path(f"{E2B_WORKDIR}/file.txt") == f"{E2B_WORKDIR}/file.txt"
-        )
+        assert resolve_sandbox_path("/home/user/file.txt") == "/home/user/file.txt"
 
     def test_workdir_itself(self):
-        assert resolve_sandbox_path(E2B_WORKDIR) == E2B_WORKDIR
+        assert resolve_sandbox_path("/home/user") == "/home/user"
 
     def test_relative_dotslash(self):
-        assert resolve_sandbox_path("./README.md") == f"{E2B_WORKDIR}/README.md"
+        assert resolve_sandbox_path("./README.md") == "/home/user/README.md"
 
     def test_traversal_blocked(self):
-        with pytest.raises(ValueError, match=f"must be within {E2B_WORKDIR}"):
+        with pytest.raises(ValueError, match="must be within /home/user"):
             resolve_sandbox_path("../../etc/passwd")
 
     def test_absolute_traversal_blocked(self):
-        with pytest.raises(ValueError, match=f"must be within {E2B_WORKDIR}"):
-            resolve_sandbox_path(f"{E2B_WORKDIR}/../../etc/passwd")
+        with pytest.raises(ValueError, match="must be within /home/user"):
+            resolve_sandbox_path("/home/user/../../etc/passwd")
 
     def test_absolute_outside_sandbox_blocked(self):
-        with pytest.raises(ValueError, match=f"must be within {E2B_WORKDIR}"):
+        with pytest.raises(ValueError, match="must be within /home/user"):
             resolve_sandbox_path("/etc/passwd")
 
     def test_root_blocked(self):
-        with pytest.raises(ValueError, match=f"must be within {E2B_WORKDIR}"):
+        with pytest.raises(ValueError, match="must be within /home/user"):
             resolve_sandbox_path("/")
 
     def test_home_other_user_blocked(self):
-        with pytest.raises(ValueError, match=f"must be within {E2B_WORKDIR}"):
+        with pytest.raises(ValueError, match="must be within /home/user"):
             resolve_sandbox_path("/home/other/file.txt")
 
     def test_deep_nested_allowed(self):
-        assert resolve_sandbox_path("a/b/c/d/e.txt") == f"{E2B_WORKDIR}/a/b/c/d/e.txt"
+        assert resolve_sandbox_path("a/b/c/d/e.txt") == "/home/user/a/b/c/d/e.txt"
 
     def test_trailing_slash_normalised(self):
-        assert resolve_sandbox_path("src/") == f"{E2B_WORKDIR}/src"
+        assert resolve_sandbox_path("src/") == "/home/user/src"
 
     def test_double_dots_within_sandbox_ok(self):
-        """Path that resolves back within E2B_WORKDIR is allowed."""
-        assert resolve_sandbox_path("a/b/../c.txt") == f"{E2B_WORKDIR}/a/c.txt"
+        """Path that resolves back within /home/user is allowed."""
+        assert resolve_sandbox_path("a/b/../c.txt") == "/home/user/a/c.txt"
 
 
 # ---------------------------------------------------------------------------
@@ -79,13 +73,9 @@ class TestResolveSandboxPath:
 
 
 class TestReadLocal:
-    _CONV_UUID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
-
     def _make_tool_results_file(self, encoded: str, filename: str, content: str) -> str:
-        """Create a tool-results file under <encoded>/<uuid>/tool-results/."""
-        tool_results_dir = os.path.join(
-            SDK_PROJECTS_DIR, encoded, self._CONV_UUID, "tool-results"
-        )
+        """Create a tool-results file and return its path."""
+        tool_results_dir = os.path.join(_SDK_PROJECTS_DIR, encoded, "tool-results")
         os.makedirs(tool_results_dir, exist_ok=True)
         filepath = os.path.join(tool_results_dir, filename)
         with open(filepath, "w") as f:
@@ -117,9 +107,7 @@ class TestReadLocal:
     def test_read_nonexistent_tool_results(self):
         """A tool-results path that doesn't exist returns FileNotFoundError."""
         encoded = "-tmp-copilot-e2b-test-nofile"
-        tool_results_dir = os.path.join(
-            SDK_PROJECTS_DIR, encoded, self._CONV_UUID, "tool-results"
-        )
+        tool_results_dir = os.path.join(_SDK_PROJECTS_DIR, encoded, "tool-results")
         os.makedirs(tool_results_dir, exist_ok=True)
         filepath = os.path.join(tool_results_dir, "nonexistent.txt")
         token = _current_project_dir.set(encoded)
@@ -129,7 +117,7 @@ class TestReadLocal:
             assert "not found" in result["content"][0]["text"].lower()
         finally:
             _current_project_dir.reset(token)
-            shutil.rmtree(os.path.join(SDK_PROJECTS_DIR, encoded), ignore_errors=True)
+            os.rmdir(tool_results_dir)
 
     def test_read_traversal_path_blocked(self):
         """A traversal attempt that escapes allowed directories is blocked."""
@@ -164,66 +152,3 @@ class TestReadLocal:
         """Without _current_project_dir set, all paths are blocked."""
         result = _read_local("/tmp/anything.txt", offset=0, limit=10)
         assert result["isError"] is True
-
-
-# ---------------------------------------------------------------------------
-# _check_sandbox_symlink_escape — symlink escape detection
-# ---------------------------------------------------------------------------
-
-
-def _make_sandbox(stdout: str, exit_code: int = 0) -> SimpleNamespace:
-    """Build a minimal sandbox mock whose commands.run returns a fixed result."""
-    run_result = SimpleNamespace(stdout=stdout, exit_code=exit_code)
-    commands = SimpleNamespace(run=AsyncMock(return_value=run_result))
-    return SimpleNamespace(commands=commands)
-
-
-class TestCheckSandboxSymlinkEscape:
-    @pytest.mark.asyncio
-    async def test_canonical_path_within_workdir_returns_path(self):
-        """When readlink -f resolves to a path inside E2B_WORKDIR, returns it."""
-        sandbox = _make_sandbox(stdout=f"{E2B_WORKDIR}/src\n", exit_code=0)
-        result = await _check_sandbox_symlink_escape(sandbox, f"{E2B_WORKDIR}/src")
-        assert result == f"{E2B_WORKDIR}/src"
-
-    @pytest.mark.asyncio
-    async def test_workdir_itself_returns_workdir(self):
-        """When readlink -f resolves to E2B_WORKDIR exactly, returns E2B_WORKDIR."""
-        sandbox = _make_sandbox(stdout=f"{E2B_WORKDIR}\n", exit_code=0)
-        result = await _check_sandbox_symlink_escape(sandbox, E2B_WORKDIR)
-        assert result == E2B_WORKDIR
-
-    @pytest.mark.asyncio
-    async def test_symlink_escape_returns_none(self):
-        """When readlink -f resolves outside E2B_WORKDIR (symlink escape), returns None."""
-        sandbox = _make_sandbox(stdout="/etc\n", exit_code=0)
-        result = await _check_sandbox_symlink_escape(sandbox, f"{E2B_WORKDIR}/evil")
-        assert result is None
-
-    @pytest.mark.asyncio
-    async def test_nonzero_exit_code_returns_none(self):
-        """A non-zero exit code from readlink -f returns None."""
-        sandbox = _make_sandbox(stdout="", exit_code=1)
-        result = await _check_sandbox_symlink_escape(sandbox, f"{E2B_WORKDIR}/src")
-        assert result is None
-
-    @pytest.mark.asyncio
-    async def test_empty_stdout_returns_none(self):
-        """Empty stdout from readlink (e.g. path doesn't exist yet) returns None."""
-        sandbox = _make_sandbox(stdout="", exit_code=0)
-        result = await _check_sandbox_symlink_escape(sandbox, f"{E2B_WORKDIR}/src")
-        assert result is None
-
-    @pytest.mark.asyncio
-    async def test_prefix_collision_returns_none(self):
-        """A path prefixed with E2B_WORKDIR but not within it is rejected."""
-        sandbox = _make_sandbox(stdout=f"{E2B_WORKDIR}-evil\n", exit_code=0)
-        result = await _check_sandbox_symlink_escape(sandbox, f"{E2B_WORKDIR}-evil")
-        assert result is None
-
-    @pytest.mark.asyncio
-    async def test_deeply_nested_path_within_workdir(self):
-        """Deep nested paths inside E2B_WORKDIR are allowed."""
-        sandbox = _make_sandbox(stdout=f"{E2B_WORKDIR}/a/b/c/d\n", exit_code=0)
-        result = await _check_sandbox_symlink_escape(sandbox, f"{E2B_WORKDIR}/a/b/c/d")
-        assert result == f"{E2B_WORKDIR}/a/b/c/d"

autogpt_platform/backend/backend/copilot/sdk/security_hooks.py

@@ -42,7 +42,7 @@ def _validate_workspace_path(
     Delegates to :func:`is_allowed_local_path` which permits:
     - The SDK working directory (``/tmp/copilot-<session>/``)
     - The current session's tool-results directory
-      (``~/.claude/projects/<encoded-cwd>/<uuid>/tool-results/``)
+      (``~/.claude/projects/<encoded-cwd>/tool-results/``)
     """
     path = tool_input.get("file_path") or tool_input.get("path") or ""
     if not path:
@@ -302,11 +302,7 @@ def create_security_hooks(
             """
             _ = context, tool_use_id
             trigger = input_data.get("trigger", "auto")
-            # Sanitize untrusted input: strip control chars for logging AND
-            # for the value passed downstream.  read_compacted_entries()
-            # validates against _projects_base() as defence-in-depth, but
-            # sanitizing here prevents log injection and rejects obviously
-            # malformed paths early.
+            # Sanitize untrusted input before logging to prevent log injection
             transcript_path = (
                 str(input_data.get("transcript_path", ""))
                 .replace("\n", "")

autogpt_platform/backend/backend/copilot/sdk/security_hooks_test.py

@@ -122,7 +122,7 @@ def test_read_no_cwd_denies_absolute():
 
 def test_read_tool_results_allowed():
     home = os.path.expanduser("~")
-    path = f"{home}/.claude/projects/-tmp-copilot-abc123/a1b2c3d4-e5f6-7890-abcd-ef1234567890/tool-results/12345.txt"
+    path = f"{home}/.claude/projects/-tmp-copilot-abc123/tool-results/12345.txt"
     # is_allowed_local_path requires the session's encoded cwd to be set
     token = _current_project_dir.set("-tmp-copilot-abc123")
     try:

autogpt_platform/backend/backend/copilot/sdk/service.py

@@ -10,7 +10,6 @@ import re
 import shutil
 import subprocess
 import sys
-import time
 import uuid
 from collections.abc import AsyncGenerator
 from typing import Any, cast
@@ -39,7 +38,6 @@ from backend.util.settings import Settings
 
 from ..config import ChatConfig
 from ..constants import COPILOT_ERROR_PREFIX, COPILOT_SYSTEM_PREFIX
-from ..context import encode_cwd_for_cli
 from ..model import (
     ChatMessage,
     ChatSession,
@@ -77,7 +75,7 @@ from .tool_adapter import (
     wait_for_stash,
 )
 from .transcript import (
-    cleanup_stale_project_dirs,
+    cleanup_cli_project_dir,
     download_transcript,
     read_compacted_entries,
     upload_transcript,
@@ -145,9 +143,6 @@ _background_tasks: set[asyncio.Task[Any]] = set()
 
 _SDK_CWD_PREFIX = WORKSPACE_PREFIX
 
-_last_sweep_time: float = 0.0
-_SWEEP_INTERVAL_SECONDS = 300  # 5 minutes
-
 # Heartbeat interval — keep SSE alive through proxies/LBs during tool execution.
 # IMPORTANT: Must be less than frontend timeout (12s in useCopilotPage.ts)
 _HEARTBEAT_INTERVAL = 10.0  # seconds
@@ -286,34 +281,31 @@ def _make_sdk_cwd(session_id: str) -> str:
     return cwd
 
 
-async def _cleanup_sdk_tool_results(cwd: str) -> None:
+def _cleanup_sdk_tool_results(cwd: str) -> None:
     """Remove SDK session artifacts for a specific working directory.
 
-    Cleans up the ephemeral working directory ``/tmp/copilot-<session>/``.
-
-    Also sweeps stale CLI project directories (older than 12 h) to prevent
-    unbounded disk growth.  The sweep is best-effort, rate-limited to once
-    every 5 minutes, and capped at 50 directories per sweep.
+    Cleans up:
+    - ``~/.claude/projects/<encoded-cwd>/`` — CLI session transcripts and
+      tool-result files.  Each SDK turn uses a unique cwd, so this directory
+      is safe to remove entirely.
+    - ``/tmp/copilot-<session>/`` — the ephemeral working directory.
 
     Security: *cwd* MUST be created by ``_make_sdk_cwd()`` which sanitizes
     the session_id.
     """
     normalized = os.path.normpath(cwd)
     if not normalized.startswith(_SDK_CWD_PREFIX):
-        logger.warning("[SDK] Rejecting cleanup for path outside workspace: %s", cwd)
+        logger.warning(f"[SDK] Rejecting cleanup for path outside workspace: {cwd}")
         return
 
-    await asyncio.to_thread(shutil.rmtree, normalized, True)
+    # Clean the CLI's project directory (transcripts + tool-results).
+    cleanup_cli_project_dir(cwd)
 
-    # Best-effort sweep of old project dirs to prevent disk leak.
-    # Pass the encoded cwd so only this session's project directory is swept,
-    # which is safe in multi-tenant environments.
-    global _last_sweep_time
-    now = time.time()
-    if now - _last_sweep_time >= _SWEEP_INTERVAL_SECONDS:
-        _last_sweep_time = now
-        encoded = encode_cwd_for_cli(normalized)
-        await asyncio.to_thread(cleanup_stale_project_dirs, encoded)
+    # Clean up the temp cwd directory itself.
+    try:
+        shutil.rmtree(normalized, ignore_errors=True)
+    except OSError:
+        pass
 
 
 def _format_sdk_content_blocks(blocks: list) -> list[dict[str, Any]]:
@@ -805,7 +797,7 @@ async def stream_chat_completion_sdk(
                 )
             except Exception as transcript_err:
                 logger.warning(
-                    "%s Transcript download failed, continuing without --resume: %s",
+                    "%s Transcript download failed, continuing without " "--resume: %s",
                     log_prefix,
                     transcript_err,
                 )
@@ -828,7 +820,7 @@ async def stream_chat_completion_sdk(
             is_valid = validate_transcript(dl.content)
             dl_lines = dl.content.strip().split("\n") if dl.content else []
             logger.info(
-                "%s Downloaded transcript: %dB, %d lines, msg_count=%d, valid=%s",
+                "%s Downloaded transcript: %dB, %d lines, " "msg_count=%d, valid=%s",
                 log_prefix,
                 len(dl.content),
                 len(dl_lines),
@@ -1062,7 +1054,8 @@ async def stream_chat_completion_sdk(
                         break
 
                     logger.info(
-                        "%s Received: %s %s (unresolved=%d, current=%d, resolved=%d)",
+                        "%s Received: %s %s "
+                        "(unresolved=%d, current=%d, resolved=%d)",
                         log_prefix,
                         type(sdk_msg).__name__,
                         getattr(sdk_msg, "subtype", ""),
@@ -1107,14 +1100,7 @@ async def stream_chat_completion_sdk(
                         and isinstance(sdk_msg, (AssistantMessage, ResultMessage))
                         and not is_parallel_continuation
                     ):
-                        # 2.0 s timeout: the original 0.5 s caused frequent
-                        # timeouts under load (parallel tool calls, large
-                        # outputs).  2.0 s gives margin while still failing
-                        # fast when the hook genuinely will not fire.
-                        if await wait_for_stash(timeout=2.0):
-                            # Yield once so any callbacks scheduled by the
-                            # stash signal can propagate before we process
-                            # the next SDK message.
+                        if await wait_for_stash(timeout=0.5):
                             await asyncio.sleep(0)
                         else:
                             logger.warning(
@@ -1500,14 +1486,11 @@ async def stream_chat_completion_sdk(
                     exc_info=True,
                 )
 
-        try:
-            if sdk_cwd:
-                await _cleanup_sdk_tool_results(sdk_cwd)
-        except Exception:
-            logger.warning("%s SDK cleanup failed", log_prefix, exc_info=True)
-        finally:
-            # Release stream lock to allow new streams for this session
-            await lock.release()
+        if sdk_cwd:
+            _cleanup_sdk_tool_results(sdk_cwd)
+
+        # Release stream lock to allow new streams for this session
+        await lock.release()
 
 
 async def _update_title_async(

autogpt_platform/backend/backend/copilot/sdk/service_test.py

@@ -288,90 +288,3 @@ class TestPromptSupplement:
             # Count how many times this tool appears as a bullet point
             count = docs.count(f"- **`{tool_name}`**")
             assert count == 1, f"Tool '{tool_name}' appears {count} times (should be 1)"
-
-
-# ---------------------------------------------------------------------------
-# _cleanup_sdk_tool_results — orchestration + rate-limiting
-# ---------------------------------------------------------------------------
-
-
-class TestCleanupSdkToolResults:
-    """Tests for _cleanup_sdk_tool_results orchestration and sweep rate-limiting."""
-
-    # All valid cwds must start with /tmp/copilot- (the _SDK_CWD_PREFIX).
-    _CWD_PREFIX = "/tmp/copilot-"
-
-    @pytest.mark.asyncio
-    async def test_removes_cwd_directory(self):
-        """Cleanup removes the session working directory."""
-
-        from .service import _cleanup_sdk_tool_results
-
-        cwd = "/tmp/copilot-test-cleanup-remove"
-        os.makedirs(cwd, exist_ok=True)
-
-        with patch("backend.copilot.sdk.service.cleanup_stale_project_dirs"):
-            import backend.copilot.sdk.service as svc_mod
-
-            svc_mod._last_sweep_time = 0.0
-            await _cleanup_sdk_tool_results(cwd)
-
-        assert not os.path.exists(cwd)
-
-    @pytest.mark.asyncio
-    async def test_sweep_runs_when_interval_elapsed(self):
-        """cleanup_stale_project_dirs is called when 5-minute interval has elapsed."""
-
-        import backend.copilot.sdk.service as svc_mod
-
-        from .service import _cleanup_sdk_tool_results
-
-        cwd = "/tmp/copilot-test-sweep-elapsed"
-        os.makedirs(cwd, exist_ok=True)
-
-        with patch(
-            "backend.copilot.sdk.service.cleanup_stale_project_dirs"
-        ) as mock_sweep:
-            # Set last sweep to a time far in the past
-            svc_mod._last_sweep_time = 0.0
-            await _cleanup_sdk_tool_results(cwd)
-
-        mock_sweep.assert_called_once()
-
-    @pytest.mark.asyncio
-    async def test_sweep_skipped_within_interval(self):
-        """cleanup_stale_project_dirs is NOT called when within 5-minute interval."""
-        import time
-
-        import backend.copilot.sdk.service as svc_mod
-
-        from .service import _cleanup_sdk_tool_results
-
-        cwd = "/tmp/copilot-test-sweep-ratelimit"
-        os.makedirs(cwd, exist_ok=True)
-
-        with patch(
-            "backend.copilot.sdk.service.cleanup_stale_project_dirs"
-        ) as mock_sweep:
-            # Set last sweep to now — interval not elapsed
-            svc_mod._last_sweep_time = time.time()
-            await _cleanup_sdk_tool_results(cwd)
-
-        mock_sweep.assert_not_called()
-
-    @pytest.mark.asyncio
-    async def test_rejects_path_outside_prefix(self, tmp_path):
-        """Cleanup rejects a cwd that does not start with the expected prefix."""
-        from .service import _cleanup_sdk_tool_results
-
-        evil_cwd = str(tmp_path / "evil-path")
-        os.makedirs(evil_cwd, exist_ok=True)
-
-        with patch(
-            "backend.copilot.sdk.service.cleanup_stale_project_dirs"
-        ) as mock_sweep:
-            await _cleanup_sdk_tool_results(evil_cwd)
-
-        # Directory should NOT have been removed (rejected early)
-        assert os.path.exists(evil_cwd)
-        mock_sweep.assert_not_called()

autogpt_platform/backend/backend/copilot/sdk/tool_adapter.py

@@ -146,7 +146,7 @@ def stash_pending_tool_output(tool_name: str, output: Any) -> None:
         event.set()
 
 
-async def wait_for_stash(timeout: float = 2.0) -> bool:
+async def wait_for_stash(timeout: float = 0.5) -> bool:
     """Wait for a PostToolUse hook to stash tool output.
 
     The SDK fires PostToolUse hooks asynchronously via ``start_soon()`` —
@@ -155,12 +155,12 @@ async def wait_for_stash(timeout: float = 2.0) -> bool:
     by waiting on the ``_stash_event``, which is signaled by
     :func:`stash_pending_tool_output`.
 
-    Returns ``True`` if a stash signal was received, ``False`` on timeout.
+    After the event fires, callers should ``await asyncio.sleep(0)`` to
+    give any remaining concurrent hooks a chance to complete.
 
-    The 2.0 s default was chosen based on production metrics: the original
-    0.5 s caused frequent timeouts under load (parallel tool calls, large
-    outputs).  2.0 s gives a comfortable margin while still failing fast
-    when the hook genuinely will not fire.
+    Returns ``True`` if a stash signal was received, ``False`` on timeout.
+    The timeout is a safety net — normally the stash happens within
+    microseconds of yielding to the event loop.
     """
     event = _stash_event.get(None)
     if event is None:
@@ -285,7 +285,7 @@ async def _read_file_handler(args: dict[str, Any]) -> dict[str, Any]:
 
     resolved = os.path.realpath(os.path.expanduser(file_path))
     try:
-        with open(resolved, encoding="utf-8", errors="replace") as f:
+        with open(resolved) as f:
             selected = list(itertools.islice(f, offset, offset + limit))
         # Cleanup happens in _cleanup_sdk_tool_results after session ends;
         # don't delete here — the SDK may read in multiple chunks.

autogpt_platform/backend/backend/copilot/sdk/transcript.py

@@ -151,110 +151,44 @@ def _projects_base() -> str:
     return os.path.realpath(os.path.join(config_dir, "projects"))
 
 
-_STALE_PROJECT_DIR_SECONDS = 12 * 3600  # 12 hours — matches max session lifetime
-_MAX_PROJECT_DIRS_TO_SWEEP = 50  # limit per sweep to avoid long pauses
+def _cli_project_dir(sdk_cwd: str) -> str | None:
+    """Return the CLI's project directory for a given working directory.
 
-
-def cleanup_stale_project_dirs(encoded_cwd: str | None = None) -> int:
-    """Remove CLI project directories older than ``_STALE_PROJECT_DIR_SECONDS``.
-
-    Each CoPilot SDK turn creates a unique ``~/.claude/projects/<encoded-cwd>/``
-    directory.  These are intentionally kept across turns so the model can read
-    tool-result files via ``--resume``.  However, after a session ends they
-    become stale.  This function sweeps old ones to prevent unbounded disk
-    growth.
-
-    When *encoded_cwd* is provided the sweep is scoped to that single
-    directory, making the operation safe in multi-tenant environments where
-    multiple copilot sessions share the same host.  Without it the function
-    falls back to sweeping all directories matching the copilot naming pattern
-    (``-tmp-copilot-``), which is only safe for single-tenant deployments.
-
-    Returns the number of directories removed.
+    Returns ``None`` if the path would escape the projects base.
     """
+    cwd_encoded = re.sub(r"[^a-zA-Z0-9]", "-", os.path.realpath(sdk_cwd))
     projects_base = _projects_base()
-    if not os.path.isdir(projects_base):
-        return 0
+    project_dir = os.path.realpath(os.path.join(projects_base, cwd_encoded))
 
-    now = time.time()
-    removed = 0
-
-    # Scoped mode: only clean up the one directory for the current session.
-    if encoded_cwd:
-        target = Path(projects_base) / encoded_cwd
-        if not target.is_dir():
-            return 0
-        # Guard: only sweep copilot-generated dirs.
-        if "-tmp-copilot-" not in target.name:
-            logger.warning(
-                "[Transcript] Refusing to sweep non-copilot dir: %s", target.name
-            )
-            return 0
-        try:
-            # st_mtime is used as a proxy for session activity. Claude CLI writes
-            # its JSONL transcript into this directory during each turn, so mtime
-            # advances on every turn. A directory whose mtime is older than
-            # _STALE_PROJECT_DIR_SECONDS has not had an active turn in that window
-            # and is safe to remove (the session cannot --resume after cleanup).
-            age = now - target.stat().st_mtime
-        except OSError:
-            return 0
-        if age < _STALE_PROJECT_DIR_SECONDS:
-            return 0
-        try:
-            shutil.rmtree(target, ignore_errors=True)
-            removed = 1
-        except OSError:
-            pass
-        if removed:
-            logger.info(
-                "[Transcript] Swept stale CLI project dir %s (age %ds > %ds)",
-                target.name,
-                int(age),
-                _STALE_PROJECT_DIR_SECONDS,
-            )
-        return removed
-
-    # Unscoped fallback: sweep all copilot dirs across the projects base.
-    # Only safe for single-tenant deployments; callers should prefer the
-    # scoped variant by passing encoded_cwd.
-    try:
-        entries = Path(projects_base).iterdir()
-    except OSError as e:
-        logger.warning("[Transcript] Failed to list projects dir: %s", e)
-        return 0
-
-    for entry in entries:
-        if removed >= _MAX_PROJECT_DIRS_TO_SWEEP:
-            break
-        # Only sweep copilot-generated dirs (pattern: -tmp-copilot- or
-        # -private-tmp-copilot-).
-        if "-tmp-copilot-" not in entry.name:
-            continue
-        if not entry.is_dir():
-            continue
-        try:
-            # See the scoped-mode comment above: st_mtime advances on every turn,
-            # so a stale mtime reliably indicates an inactive session.
-            age = now - entry.stat().st_mtime
-        except OSError:
-            continue
-        if age < _STALE_PROJECT_DIR_SECONDS:
-            continue
-
-        try:
-            shutil.rmtree(entry, ignore_errors=True)
-            removed += 1
-        except OSError:
-            pass
-
-    if removed:
-        logger.info(
-            "[Transcript] Swept %d stale CLI project dirs (older than %ds)",
-            removed,
-            _STALE_PROJECT_DIR_SECONDS,
+    if not project_dir.startswith(projects_base + os.sep):
+        logger.warning(
+            "[Transcript] Project dir escaped projects base: %s", project_dir
         )
-    return removed
+        return None
+    return project_dir
+
+
+def _safe_glob_jsonl(project_dir: str) -> list[Path]:
+    """Glob ``*.jsonl`` files, filtering out symlinks that escape the directory."""
+    try:
+        resolved_base = Path(project_dir).resolve()
+    except OSError as e:
+        logger.warning("[Transcript] Failed to resolve project dir: %s", e)
+        return []
+
+    result: list[Path] = []
+    for candidate in Path(project_dir).glob("*.jsonl"):
+        try:
+            resolved = candidate.resolve()
+            if resolved.is_relative_to(resolved_base):
+                result.append(resolved)
+        except (OSError, RuntimeError) as e:
+            logger.debug(
+                "[Transcript] Skipping invalid CLI session candidate %s: %s",
+                candidate,
+                e,
+            )
+    return result
 
 
 def read_compacted_entries(transcript_path: str) -> list[dict] | None:
@@ -321,6 +255,63 @@ def read_compacted_entries(transcript_path: str) -> list[dict] | None:
     return entries
 
 
+def read_cli_session_file(sdk_cwd: str) -> str | None:
+    """Read the CLI's own session file, which reflects any compaction.
+
+    The CLI writes its session transcript to
+    ``~/.claude/projects/<encoded_cwd>/<session_id>.jsonl``.
+    Since each SDK turn uses a unique ``sdk_cwd``, there should be
+    exactly one ``.jsonl`` file in that directory.
+
+    Returns the file content, or ``None`` if not found.
+    """
+    project_dir = _cli_project_dir(sdk_cwd)
+    if not project_dir or not os.path.isdir(project_dir):
+        return None
+
+    jsonl_files = _safe_glob_jsonl(project_dir)
+    if not jsonl_files:
+        logger.debug("[Transcript] No CLI session file found in %s", project_dir)
+        return None
+
+    # Pick the most recently modified file (should be only one per turn).
+    try:
+        session_file = max(jsonl_files, key=lambda p: p.stat().st_mtime)
+    except OSError as e:
+        logger.warning("[Transcript] Failed to inspect CLI session files: %s", e)
+        return None
+
+    try:
+        content = session_file.read_text()
+        logger.info(
+            "[Transcript] Read CLI session file: %s (%d bytes)",
+            session_file,
+            len(content),
+        )
+        return content
+    except OSError as e:
+        logger.warning("[Transcript] Failed to read CLI session file: %s", e)
+        return None
+
+
+def cleanup_cli_project_dir(sdk_cwd: str) -> None:
+    """Remove the CLI's project directory for a specific working directory.
+
+    The CLI stores session data under ``~/.claude/projects/<encoded_cwd>/``.
+    Each SDK turn uses a unique ``sdk_cwd``, so the project directory is
+    safe to remove entirely after the transcript has been uploaded.
+    """
+    project_dir = _cli_project_dir(sdk_cwd)
+    if not project_dir:
+        return
+
+    if os.path.isdir(project_dir):
+        shutil.rmtree(project_dir, ignore_errors=True)
+        logger.debug("[Transcript] Cleaned up CLI project dir: %s", project_dir)
+    else:
+        logger.debug("[Transcript] Project dir not found: %s", project_dir)
+
+
 def write_transcript_to_tempfile(
     transcript_content: str,
     session_id: str,

autogpt_platform/backend/backend/copilot/sdk/transcript_test.py

@@ -9,7 +9,9 @@ from backend.util import json
 
 from .transcript import (
     STRIPPABLE_TYPES,
+    _cli_project_dir,
     delete_transcript,
+    read_cli_session_file,
     read_compacted_entries,
     strip_progress_entries,
     validate_transcript,
@@ -290,6 +292,85 @@ class TestStripProgressEntries:
         assert asst_entry["parentUuid"] == "u1"  # reparented
 
 
+# --- read_cli_session_file ---
+
+
+class TestReadCliSessionFile:
+    def test_no_matching_files_returns_none(self, tmp_path, monkeypatch):
+        """read_cli_session_file returns None when no .jsonl files exist."""
+        # Create a project dir with no jsonl files
+        project_dir = tmp_path / "projects" / "encoded-cwd"
+        project_dir.mkdir(parents=True)
+        monkeypatch.setattr(
+            "backend.copilot.sdk.transcript._cli_project_dir",
+            lambda sdk_cwd: str(project_dir),
+        )
+        assert read_cli_session_file("/fake/cwd") is None
+
+    def test_one_jsonl_file_returns_content(self, tmp_path, monkeypatch):
+        """read_cli_session_file returns the content of a single .jsonl file."""
+        project_dir = tmp_path / "projects" / "encoded-cwd"
+        project_dir.mkdir(parents=True)
+        jsonl_file = project_dir / "session.jsonl"
+        jsonl_file.write_text("line1\nline2\n")
+        monkeypatch.setattr(
+            "backend.copilot.sdk.transcript._cli_project_dir",
+            lambda sdk_cwd: str(project_dir),
+        )
+        result = read_cli_session_file("/fake/cwd")
+        assert result == "line1\nline2\n"
+
+    def test_symlink_escaping_project_dir_is_skipped(self, tmp_path, monkeypatch):
+        """read_cli_session_file skips symlinks that escape the project dir."""
+        project_dir = tmp_path / "projects" / "encoded-cwd"
+        project_dir.mkdir(parents=True)
+
+        # Create a file outside the project dir
+        outside = tmp_path / "outside"
+        outside.mkdir()
+        outside_file = outside / "evil.jsonl"
+        outside_file.write_text("should not be read\n")
+
+        # Symlink from inside project_dir to outside file
+        symlink = project_dir / "evil.jsonl"
+        symlink.symlink_to(outside_file)
+
+        monkeypatch.setattr(
+            "backend.copilot.sdk.transcript._cli_project_dir",
+            lambda sdk_cwd: str(project_dir),
+        )
+        # The symlink target resolves outside project_dir, so it should be skipped
+        result = read_cli_session_file("/fake/cwd")
+        assert result is None
+
+
+# --- _cli_project_dir ---
+
+
+class TestCliProjectDir:
+    def test_returns_none_for_path_traversal(self, tmp_path, monkeypatch):
+        """_cli_project_dir returns None when the project dir symlink escapes projects base."""
+        config_dir = tmp_path / "config"
+        config_dir.mkdir()
+        projects_dir = config_dir / "projects"
+        projects_dir.mkdir()
+
+        monkeypatch.setenv("CLAUDE_CONFIG_DIR", str(config_dir))
+
+        # Create a symlink inside projects/ that points outside of it.
+        # _cli_project_dir encodes the cwd as all-alnum-hyphens, so use a
+        # cwd whose encoded form matches the symlink name we create.
+        evil_target = tmp_path / "escaped"
+        evil_target.mkdir()
+
+        # The encoded form of "/evil/cwd" is "-evil-cwd"
+        symlink_path = projects_dir / "-evil-cwd"
+        symlink_path.symlink_to(evil_target)
+
+        result = _cli_project_dir("/evil/cwd")
+        assert result is None
+
+
 # --- delete_transcript ---
 
 
@@ -816,209 +897,3 @@ class TestCompactionFlowIntegration:
         output2 = builder2.to_jsonl()
         lines2 = [json.loads(line) for line in output2.strip().split("\n")]
         assert lines2[-1]["parentUuid"] == "a2"
-
-
-# ---------------------------------------------------------------------------
-# cleanup_stale_project_dirs
-# ---------------------------------------------------------------------------
-
-
-class TestCleanupStaleProjectDirs:
-    """Tests for cleanup_stale_project_dirs (disk leak prevention)."""
-
-    def test_removes_old_copilot_dirs(self, tmp_path, monkeypatch):
-        """Directories matching copilot pattern older than threshold are removed."""
-        from backend.copilot.sdk.transcript import (
-            _STALE_PROJECT_DIR_SECONDS,
-            cleanup_stale_project_dirs,
-        )
-
-        projects_dir = tmp_path / "projects"
-        projects_dir.mkdir()
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: str(projects_dir),
-        )
-
-        # Create a stale dir
-        stale = projects_dir / "-tmp-copilot-old-session"
-        stale.mkdir()
-        # Set mtime to past the threshold
-        import time
-
-        old_time = time.time() - _STALE_PROJECT_DIR_SECONDS - 100
-        os.utime(stale, (old_time, old_time))
-
-        # Create a fresh dir
-        fresh = projects_dir / "-tmp-copilot-new-session"
-        fresh.mkdir()
-
-        removed = cleanup_stale_project_dirs()
-        assert removed == 1
-        assert not stale.exists()
-        assert fresh.exists()
-
-    def test_ignores_non_copilot_dirs(self, tmp_path, monkeypatch):
-        """Directories not matching copilot pattern are left alone."""
-        from backend.copilot.sdk.transcript import cleanup_stale_project_dirs
-
-        projects_dir = tmp_path / "projects"
-        projects_dir.mkdir()
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: str(projects_dir),
-        )
-
-        # Non-copilot dir that's old
-        import time
-
-        other = projects_dir / "some-other-project"
-        other.mkdir()
-        old_time = time.time() - 999999
-        os.utime(other, (old_time, old_time))
-
-        removed = cleanup_stale_project_dirs()
-        assert removed == 0
-        assert other.exists()
-
-    def test_ttl_boundary_not_removed(self, tmp_path, monkeypatch):
-        """A directory exactly at the TTL boundary should NOT be removed."""
-        from backend.copilot.sdk.transcript import (
-            _STALE_PROJECT_DIR_SECONDS,
-            cleanup_stale_project_dirs,
-        )
-
-        projects_dir = tmp_path / "projects"
-        projects_dir.mkdir()
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: str(projects_dir),
-        )
-
-        import time
-
-        # Dir that's exactly at the TTL (age == threshold, not >) — should survive
-        boundary = projects_dir / "-tmp-copilot-boundary"
-        boundary.mkdir()
-        boundary_time = time.time() - _STALE_PROJECT_DIR_SECONDS + 1
-        os.utime(boundary, (boundary_time, boundary_time))
-
-        removed = cleanup_stale_project_dirs()
-        assert removed == 0
-        assert boundary.exists()
-
-    def test_skips_non_directory_entries(self, tmp_path, monkeypatch):
-        """Regular files matching the copilot pattern are not removed."""
-        from backend.copilot.sdk.transcript import (
-            _STALE_PROJECT_DIR_SECONDS,
-            cleanup_stale_project_dirs,
-        )
-
-        projects_dir = tmp_path / "projects"
-        projects_dir.mkdir()
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: str(projects_dir),
-        )
-
-        import time
-
-        # Create a regular FILE (not a dir) with the copilot pattern name
-        stale_file = projects_dir / "-tmp-copilot-stale-file"
-        stale_file.write_text("not a dir")
-        old_time = time.time() - _STALE_PROJECT_DIR_SECONDS - 100
-        os.utime(stale_file, (old_time, old_time))
-
-        removed = cleanup_stale_project_dirs()
-        assert removed == 0
-        assert stale_file.exists()
-
-    def test_missing_base_dir_returns_zero(self, tmp_path, monkeypatch):
-        """If the projects base directory doesn't exist, return 0 gracefully."""
-        from backend.copilot.sdk.transcript import cleanup_stale_project_dirs
-
-        nonexistent = str(tmp_path / "does-not-exist" / "projects")
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: nonexistent,
-        )
-
-        removed = cleanup_stale_project_dirs()
-        assert removed == 0
-
-    def test_scoped_removes_only_target_dir(self, tmp_path, monkeypatch):
-        """When encoded_cwd is supplied only that directory is swept."""
-        import time
-
-        from backend.copilot.sdk.transcript import (
-            _STALE_PROJECT_DIR_SECONDS,
-            cleanup_stale_project_dirs,
-        )
-
-        projects_dir = tmp_path / "projects"
-        projects_dir.mkdir()
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: str(projects_dir),
-        )
-
-        old_time = time.time() - _STALE_PROJECT_DIR_SECONDS - 100
-
-        # Two stale copilot dirs
-        target = projects_dir / "-tmp-copilot-session-abc"
-        target.mkdir()
-        os.utime(target, (old_time, old_time))
-
-        other = projects_dir / "-tmp-copilot-session-xyz"
-        other.mkdir()
-        os.utime(other, (old_time, old_time))
-
-        # Only the target dir should be removed
-        removed = cleanup_stale_project_dirs(encoded_cwd="-tmp-copilot-session-abc")
-        assert removed == 1
-        assert not target.exists()
-        assert other.exists()  # untouched — not the current session
-
-    def test_scoped_fresh_dir_not_removed(self, tmp_path, monkeypatch):
-        """Scoped sweep leaves a fresh directory alone."""
-        from backend.copilot.sdk.transcript import cleanup_stale_project_dirs
-
-        projects_dir = tmp_path / "projects"
-        projects_dir.mkdir()
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: str(projects_dir),
-        )
-
-        fresh = projects_dir / "-tmp-copilot-session-new"
-        fresh.mkdir()
-        # mtime is now — well within TTL
-
-        removed = cleanup_stale_project_dirs(encoded_cwd="-tmp-copilot-session-new")
-        assert removed == 0
-        assert fresh.exists()
-
-    def test_scoped_non_copilot_dir_not_removed(self, tmp_path, monkeypatch):
-        """Scoped sweep refuses to remove a non-copilot directory."""
-        import time
-
-        from backend.copilot.sdk.transcript import (
-            _STALE_PROJECT_DIR_SECONDS,
-            cleanup_stale_project_dirs,
-        )
-
-        projects_dir = tmp_path / "projects"
-        projects_dir.mkdir()
-        monkeypatch.setattr(
-            "backend.copilot.sdk.transcript._projects_base",
-            lambda: str(projects_dir),
-        )
-
-        old_time = time.time() - _STALE_PROJECT_DIR_SECONDS - 100
-        non_copilot = projects_dir / "some-other-project"
-        non_copilot.mkdir()
-        os.utime(non_copilot, (old_time, old_time))
-
-        removed = cleanup_stale_project_dirs(encoded_cwd="some-other-project")
-        assert removed == 0
-        assert non_copilot.exists()

autogpt_platform/backend/backend/copilot/service.py

@@ -28,10 +28,24 @@ logger = logging.getLogger(__name__)
 
 config = ChatConfig()
 settings = Settings()
-client = LangfuseAsyncOpenAI(api_key=config.api_key, base_url=config.base_url)
+
+_client: LangfuseAsyncOpenAI | None = None
+_langfuse = None
 
 
-langfuse = get_client()
+def _get_openai_client() -> LangfuseAsyncOpenAI:
+    global _client
+    if _client is None:
+        _client = LangfuseAsyncOpenAI(api_key=config.api_key, base_url=config.base_url)
+    return _client
+
+
+def _get_langfuse():
+    global _langfuse
+    if _langfuse is None:
+        _langfuse = get_client()
+    return _langfuse
+
 
 # Default system prompt used when Langfuse is not configured
 # Provides minimal baseline tone and personality - all workflow, tools, and
@@ -84,7 +98,7 @@ async def _get_system_prompt_template(context: str) -> str:
                 else "latest"
             )
             prompt = await asyncio.to_thread(
-                langfuse.get_prompt,
+                _get_langfuse().get_prompt,
                 config.langfuse_prompt_name,
                 label=label,
                 cache_ttl_seconds=config.langfuse_prompt_cache_ttl,
@@ -158,7 +172,7 @@ async def _generate_session_title(
             "environment": settings.config.app_env.value,
         }
 
-        response = await client.chat.completions.create(
+        response = await _get_openai_client().chat.completions.create(
             model=config.title_model,
             messages=[
                 {

autogpt_platform/backend/backend/copilot/tools/workspace_files.py

@@ -2,7 +2,6 @@
 
 import base64
 import logging
-import mimetypes
 import os
 from typing import Any, Optional
 
@@ -11,9 +10,7 @@ from pydantic import BaseModel
 from backend.copilot.context import (
     E2B_WORKDIR,
     get_current_sandbox,
-    get_sdk_cwd,
     get_workspace_manager,
-    is_allowed_local_path,
     resolve_sandbox_path,
 )
 from backend.copilot.model import ChatSession
@@ -27,10 +24,6 @@ from .models import ErrorResponse, ResponseType, ToolResponseBase
 
 logger = logging.getLogger(__name__)
 
-# Sentinel file_id used when a tool-result file is read directly from the local
-# host filesystem (rather than from workspace storage).
-_LOCAL_TOOL_RESULT_FILE_ID = "local"
-
 
 async def _resolve_write_content(
     content_text: str | None,
@@ -282,93 +275,6 @@ class WorkspaceFileContentResponse(ToolResponseBase):
     content_base64: str
 
 
-_MAX_LOCAL_TOOL_RESULT_BYTES = 10 * 1024 * 1024  # 10 MB
-
-
-def _read_local_tool_result(
-    path: str,
-    char_offset: int,
-    char_length: Optional[int],
-    session_id: str,
-    sdk_cwd: str | None = None,
-) -> ToolResponseBase:
-    """Read an SDK tool-result file from local disk.
-
-    This is a fallback for when the model mistakenly calls
-    ``read_workspace_file`` with an SDK tool-result path that only exists on
-    the host filesystem, not in cloud workspace storage.
-
-    Defence-in-depth: validates *path* via :func:`is_allowed_local_path`
-    regardless of what the caller has already checked.
-    """
-    # TOCTOU: path validated then opened separately. Acceptable because
-    # the tool-results directory is server-controlled, not user-writable.
-    expanded = os.path.realpath(os.path.expanduser(path))
-    # Defence-in-depth: re-check with resolved path (caller checked raw path).
-    if not is_allowed_local_path(expanded, sdk_cwd or get_sdk_cwd()):
-        return ErrorResponse(
-            message=f"Path not allowed: {os.path.basename(path)}", session_id=session_id
-        )
-    try:
-        # The 10 MB cap (_MAX_LOCAL_TOOL_RESULT_BYTES) bounds memory usage.
-        # Pre-read size check prevents loading files far above the cap;
-        # the remaining TOCTOU gap is acceptable for server-controlled paths.
-        file_size = os.path.getsize(expanded)
-        if file_size > _MAX_LOCAL_TOOL_RESULT_BYTES:
-            return ErrorResponse(
-                message=(f"File too large: {os.path.basename(path)}"),
-                session_id=session_id,
-            )
-
-        # Detect binary files: try strict UTF-8 first, fall back to
-        # base64-encoding the raw bytes for binary content.
-        with open(expanded, "rb") as fh:
-            raw = fh.read()
-        try:
-            text_content = raw.decode("utf-8")
-        except UnicodeDecodeError:
-            # Binary file — return raw base64, ignore char_offset/char_length
-            return WorkspaceFileContentResponse(
-                file_id=_LOCAL_TOOL_RESULT_FILE_ID,
-                name=os.path.basename(path),
-                path=path,
-                mime_type=mimetypes.guess_type(path)[0] or "application/octet-stream",
-                content_base64=base64.b64encode(raw).decode("ascii"),
-                message=(
-                    f"Read {file_size:,} bytes (binary) from local tool-result "
-                    f"{os.path.basename(path)}"
-                ),
-                session_id=session_id,
-            )
-
-        end = (
-            char_offset + char_length if char_length is not None else len(text_content)
-        )
-        slice_text = text_content[char_offset:end]
-    except FileNotFoundError:
-        return ErrorResponse(
-            message=f"File not found: {os.path.basename(path)}", session_id=session_id
-        )
-    except Exception as exc:
-        return ErrorResponse(
-            message=f"Error reading file: {type(exc).__name__}", session_id=session_id
-        )
-
-    return WorkspaceFileContentResponse(
-        file_id=_LOCAL_TOOL_RESULT_FILE_ID,
-        name=os.path.basename(path),
-        path=path,
-        mime_type=mimetypes.guess_type(path)[0] or "text/plain",
-        content_base64=base64.b64encode(slice_text.encode("utf-8")).decode("ascii"),
-        message=(
-            f"Read chars {char_offset}\u2013{char_offset + len(slice_text)} "
-            f"of {len(text_content):,} chars from local tool-result "
-            f"{os.path.basename(path)}"
-        ),
-        session_id=session_id,
-    )
-
-
 class WorkspaceFileMetadataResponse(ToolResponseBase):
     """Response containing workspace file metadata and download URL (prevents context bloat)."""
 
@@ -627,14 +533,6 @@ class ReadWorkspaceFileTool(BaseTool):
             manager = await get_workspace_manager(user_id, session_id)
             resolved = await _resolve_file(manager, file_id, path, session_id)
             if isinstance(resolved, ErrorResponse):
-                # Fallback: if the path is an SDK tool-result on local disk,
-                # read it directly instead of failing.  The model sometimes
-                # calls read_workspace_file for these paths by mistake.
-                sdk_cwd = get_sdk_cwd()
-                if path and is_allowed_local_path(path, sdk_cwd):
-                    return _read_local_tool_result(
-                        path, char_offset, char_length, session_id, sdk_cwd=sdk_cwd
-                    )
                 return resolved
             target_file_id, file_info = resolved
 

autogpt_platform/backend/backend/copilot/tools/workspace_files_test.py

@@ -2,25 +2,18 @@
 
 import base64
 import os
-import shutil
-from unittest.mock import AsyncMock, patch
 
 import pytest
 
-from backend.copilot.context import SDK_PROJECTS_DIR, _current_project_dir
 from backend.copilot.tools._test_data import make_session, setup_test_data
-from backend.copilot.tools.models import ErrorResponse
 from backend.copilot.tools.workspace_files import (
-    _MAX_LOCAL_TOOL_RESULT_BYTES,
     DeleteWorkspaceFileTool,
     ListWorkspaceFilesTool,
     ReadWorkspaceFileTool,
     WorkspaceDeleteResponse,
-    WorkspaceFileContentResponse,
     WorkspaceFileListResponse,
     WorkspaceWriteResponse,
     WriteWorkspaceFileTool,
-    _read_local_tool_result,
     _resolve_write_content,
     _validate_ephemeral_path,
 )
@@ -332,294 +325,3 @@ async def test_write_workspace_file_source_path(setup_test_data):
     await delete_tool._execute(
         user_id=user.id, session=session, file_id=write_resp.file_id
     )
-
-
-# ---------------------------------------------------------------------------
-# _read_local_tool_result — local disk fallback for SDK tool-result files
-# ---------------------------------------------------------------------------
-
-_CONV_UUID = "a1b2c3d4-e5f6-7890-abcd-ef1234567890"
-
-
-class TestReadLocalToolResult:
-    """Tests for _read_local_tool_result (local disk fallback)."""
-
-    def _make_tool_result(self, encoded: str, filename: str, content: bytes) -> str:
-        """Create a tool-results file and return its path."""
-        tool_dir = os.path.join(SDK_PROJECTS_DIR, encoded, _CONV_UUID, "tool-results")
-        os.makedirs(tool_dir, exist_ok=True)
-        filepath = os.path.join(tool_dir, filename)
-        with open(filepath, "wb") as f:
-            f.write(content)
-        return filepath
-
-    def _cleanup(self, encoded: str) -> None:
-        shutil.rmtree(os.path.join(SDK_PROJECTS_DIR, encoded), ignore_errors=True)
-
-    def test_read_text_file(self):
-        """Read a UTF-8 text tool-result file."""
-        encoded = "-tmp-copilot-local-read-text"
-        path = self._make_tool_result(encoded, "output.txt", b"hello world")
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 0, None, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            decoded = base64.b64decode(result.content_base64).decode("utf-8")
-            assert decoded == "hello world"
-            assert "text/plain" in result.mime_type
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_read_text_with_offset(self):
-        """Read a slice of a text file using char_offset and char_length."""
-        encoded = "-tmp-copilot-local-read-offset"
-        path = self._make_tool_result(encoded, "data.txt", b"ABCDEFGHIJ")
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 3, 4, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            decoded = base64.b64decode(result.content_base64).decode("utf-8")
-            assert decoded == "DEFG"
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_read_binary_file(self):
-        """Binary files are returned as raw base64."""
-        encoded = "-tmp-copilot-local-read-binary"
-        binary_data = bytes(range(256))
-        path = self._make_tool_result(encoded, "image.png", binary_data)
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 0, None, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            decoded = base64.b64decode(result.content_base64)
-            assert decoded == binary_data
-            assert "binary" in result.message
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_disallowed_path_rejected(self):
-        """Paths not under allowed directories are rejected."""
-        result = _read_local_tool_result("/etc/passwd", 0, None, "s1")
-        assert isinstance(result, ErrorResponse)
-        assert "not allowed" in result.message.lower()
-
-    def test_file_not_found(self):
-        """Missing files return an error."""
-        encoded = "-tmp-copilot-local-read-missing"
-        tool_dir = os.path.join(SDK_PROJECTS_DIR, encoded, _CONV_UUID, "tool-results")
-        os.makedirs(tool_dir, exist_ok=True)
-        path = os.path.join(tool_dir, "nope.txt")
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 0, None, "s1")
-            assert isinstance(result, ErrorResponse)
-            assert "not found" in result.message.lower()
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_file_too_large(self, monkeypatch):
-        """Files exceeding the size limit are rejected."""
-        encoded = "-tmp-copilot-local-read-large"
-        # Create a small file but fake os.path.getsize to return a huge value
-        path = self._make_tool_result(encoded, "big.txt", b"small")
-        token = _current_project_dir.set(encoded)
-        monkeypatch.setattr(
-            "os.path.getsize", lambda _: _MAX_LOCAL_TOOL_RESULT_BYTES + 1
-        )
-        try:
-            result = _read_local_tool_result(path, 0, None, "s1")
-            assert isinstance(result, ErrorResponse)
-            assert "too large" in result.message.lower()
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_offset_beyond_file_length(self):
-        """Offset past end-of-file returns empty content."""
-        encoded = "-tmp-copilot-local-read-past-eof"
-        path = self._make_tool_result(encoded, "short.txt", b"abc")
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 999, 10, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            decoded = base64.b64decode(result.content_base64).decode("utf-8")
-            assert decoded == ""
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_zero_length_read(self):
-        """Requesting zero characters returns empty content."""
-        encoded = "-tmp-copilot-local-read-zero-len"
-        path = self._make_tool_result(encoded, "data.txt", b"ABCDEF")
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 2, 0, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            decoded = base64.b64decode(result.content_base64).decode("utf-8")
-            assert decoded == ""
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_mime_type_from_json_extension(self):
-        """JSON files get application/json MIME type, not hardcoded text/plain."""
-        encoded = "-tmp-copilot-local-read-json"
-        path = self._make_tool_result(encoded, "result.json", b'{"key": "value"}')
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 0, None, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            assert result.mime_type == "application/json"
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_mime_type_from_png_extension(self):
-        """Binary .png files get image/png MIME type via mimetypes."""
-        encoded = "-tmp-copilot-local-read-png-mime"
-        binary_data = bytes(range(256))
-        path = self._make_tool_result(encoded, "chart.png", binary_data)
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 0, None, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            assert result.mime_type == "image/png"
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_explicit_sdk_cwd_parameter(self):
-        """The sdk_cwd parameter overrides get_sdk_cwd() for path validation."""
-        encoded = "-tmp-copilot-local-read-sdkcwd"
-        path = self._make_tool_result(encoded, "out.txt", b"content")
-        token = _current_project_dir.set(encoded)
-        try:
-            # Pass sdk_cwd explicitly — should still succeed because the path
-            # is under SDK_PROJECTS_DIR which is always allowed.
-            result = _read_local_tool_result(
-                path, 0, None, "s1", sdk_cwd="/tmp/copilot-test"
-            )
-            assert isinstance(result, WorkspaceFileContentResponse)
-            decoded = base64.b64decode(result.content_base64).decode("utf-8")
-            assert decoded == "content"
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-    def test_offset_with_no_length_reads_to_end(self):
-        """When char_length is None, read from offset to end of file."""
-        encoded = "-tmp-copilot-local-read-offset-noLen"
-        path = self._make_tool_result(encoded, "data.txt", b"0123456789")
-        token = _current_project_dir.set(encoded)
-        try:
-            result = _read_local_tool_result(path, 5, None, "s1")
-            assert isinstance(result, WorkspaceFileContentResponse)
-            decoded = base64.b64decode(result.content_base64).decode("utf-8")
-            assert decoded == "56789"
-        finally:
-            _current_project_dir.reset(token)
-            self._cleanup(encoded)
-
-
-# ---------------------------------------------------------------------------
-# ReadWorkspaceFileTool fallback to _read_local_tool_result
-# ---------------------------------------------------------------------------
-
-
-@pytest.mark.asyncio(loop_scope="session")
-async def test_read_workspace_file_falls_back_to_local_tool_result(setup_test_data):
-    """When _resolve_file returns ErrorResponse for an allowed local path,
-    ReadWorkspaceFileTool should fall back to _read_local_tool_result."""
-    user = setup_test_data["user"]
-    session = make_session(user.id)
-
-    # Create a real tool-result file on disk so the fallback can read it.
-    encoded = "-tmp-copilot-fallback-test"
-    conv_uuid = "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee"
-    tool_dir = os.path.join(SDK_PROJECTS_DIR, encoded, conv_uuid, "tool-results")
-    os.makedirs(tool_dir, exist_ok=True)
-    filepath = os.path.join(tool_dir, "result.txt")
-    with open(filepath, "w") as f:
-        f.write("fallback content")
-
-    token = _current_project_dir.set(encoded)
-    try:
-        # Mock _resolve_file to return an ErrorResponse (simulating "file not
-        # found in workspace") so the fallback branch is exercised.
-        mock_resolve = AsyncMock(
-            return_value=ErrorResponse(
-                message="File not found at path: result.txt",
-                session_id=session.session_id,
-            )
-        )
-        with patch("backend.copilot.tools.workspace_files._resolve_file", mock_resolve):
-            read_tool = ReadWorkspaceFileTool()
-            result = await read_tool._execute(
-                user_id=user.id,
-                session=session,
-                path=filepath,
-            )
-
-        # Should have fallen back to _read_local_tool_result and succeeded.
-        assert isinstance(result, WorkspaceFileContentResponse), (
-            f"Expected fallback to local read, got {type(result).__name__}: "
-            f"{getattr(result, 'message', '')}"
-        )
-        decoded = base64.b64decode(result.content_base64).decode("utf-8")
-        assert decoded == "fallback content"
-        mock_resolve.assert_awaited_once()
-    finally:
-        _current_project_dir.reset(token)
-        shutil.rmtree(os.path.join(SDK_PROJECTS_DIR, encoded), ignore_errors=True)
-
-
-@pytest.mark.asyncio(loop_scope="session")
-async def test_read_workspace_file_no_fallback_when_resolve_succeeds(setup_test_data):
-    """When _resolve_file succeeds, the local-disk fallback must NOT be invoked."""
-    user = setup_test_data["user"]
-    session = make_session(user.id)
-
-    fake_file_id = "fake-file-id-001"
-    fake_content = b"workspace content"
-
-    # Build a minimal file_info stub that the tool's happy-path needs.
-    class _FakeFileInfo:
-        id = fake_file_id
-        name = "result.json"
-        path = "/result.json"
-        mime_type = "text/plain"
-        size_bytes = len(fake_content)
-
-    mock_resolve = AsyncMock(return_value=(fake_file_id, _FakeFileInfo()))
-
-    mock_manager = AsyncMock()
-    mock_manager.read_file_by_id = AsyncMock(return_value=fake_content)
-
-    with (
-        patch("backend.copilot.tools.workspace_files._resolve_file", mock_resolve),
-        patch(
-            "backend.copilot.tools.workspace_files.get_workspace_manager",
-            AsyncMock(return_value=mock_manager),
-        ),
-        patch(
-            "backend.copilot.tools.workspace_files._read_local_tool_result"
-        ) as patched_local,
-    ):
-        read_tool = ReadWorkspaceFileTool()
-        result = await read_tool._execute(
-            user_id=user.id,
-            session=session,
-            file_id=fake_file_id,
-        )
-
-    # Fallback must not have been called.
-    patched_local.assert_not_called()
-    # Normal workspace path must have produced a content response.
-    assert isinstance(result, WorkspaceFileContentResponse)
-    assert base64.b64decode(result.content_base64) == fake_content

autogpt_platform/backend/backend/util/workspace.py

@@ -183,7 +183,8 @@ class WorkspaceManager:
                 f"{Config().max_file_size_mb}MB limit"
             )
 
-        # Virus scan content before persisting (defense in depth)
+        # Scan here — callers must NOT duplicate this scan.
+        # WorkspaceManager owns virus scanning for all persisted files.
         await scan_content_safe(content, filename=filename)
 
         # Determine path with session scoping

autogpt_platform/frontend/src/app/(platform)/build/__tests__/CustomNode.test.tsx

@@ -0,0 +1,440 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { screen, cleanup } from "@testing-library/react";
+import { render } from "@/tests/integrations/test-utils";
+import React from "react";
+import { BlockUIType } from "../components/types";
+import type {
+  CustomNodeData,
+  CustomNode as CustomNodeType,
+} from "../components/FlowEditor/nodes/CustomNode/CustomNode";
+import type { NodeProps } from "@xyflow/react";
+import type { NodeExecutionResult } from "@/app/api/__generated__/models/nodeExecutionResult";
+
+// ---- Mock sub-components ----
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/NodeContainer",
+  () => ({
+    NodeContainer: ({
+      children,
+      hasErrors,
+    }: {
+      children: React.ReactNode;
+      hasErrors: boolean;
+    }) => (
+      <div data-testid="node-container" data-has-errors={String(!!hasErrors)}>
+        {children}
+      </div>
+    ),
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/NodeHeader",
+  () => ({
+    NodeHeader: ({ data }: { data: CustomNodeData }) => (
+      <div data-testid="node-header">{data.title}</div>
+    ),
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/StickyNoteBlock",
+  () => ({
+    StickyNoteBlock: ({ data }: { data: CustomNodeData }) => (
+      <div data-testid="sticky-note-block">{data.title}</div>
+    ),
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/NodeAdvancedToggle",
+  () => ({
+    NodeAdvancedToggle: () => <div data-testid="node-advanced-toggle" />,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/NodeOutput/NodeOutput",
+  () => ({
+    NodeDataRenderer: () => <div data-testid="node-data-renderer" />,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/NodeExecutionBadge",
+  () => ({
+    NodeExecutionBadge: () => <div data-testid="node-execution-badge" />,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/NodeRightClickMenu",
+  () => ({
+    NodeRightClickMenu: ({ children }: { children: React.ReactNode }) => (
+      <div data-testid="node-right-click-menu">{children}</div>
+    ),
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/WebhookDisclaimer",
+  () => ({
+    WebhookDisclaimer: () => <div data-testid="webhook-disclaimer" />,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/SubAgentUpdate/SubAgentUpdateFeature",
+  () => ({
+    SubAgentUpdateFeature: () => <div data-testid="sub-agent-update" />,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/components/AyrshareConnectButton",
+  () => ({
+    AyrshareConnectButton: () => <div data-testid="ayrshare-connect-button" />,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/FormCreator",
+  () => ({
+    FormCreator: () => <div data-testid="form-creator" />,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/OutputHandler",
+  () => ({
+    OutputHandler: () => <div data-testid="output-handler" />,
+  }),
+);
+
+vi.mock(
+  "@/components/renderers/InputRenderer/utils/input-schema-pre-processor",
+  () => ({
+    preprocessInputSchema: (schema: unknown) => schema,
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/FlowEditor/nodes/CustomNode/useCustomNode",
+  () => ({
+    useCustomNode: ({ data }: { data: CustomNodeData }) => ({
+      inputSchema: data.inputSchema,
+      outputSchema: data.outputSchema,
+      isMCPWithTool: false,
+    }),
+  }),
+);
+
+vi.mock("@xyflow/react", async () => {
+  const actual = await vi.importActual("@xyflow/react");
+  return {
+    ...actual,
+    useReactFlow: () => ({
+      getNodes: () => [],
+      getEdges: () => [],
+      setNodes: vi.fn(),
+      setEdges: vi.fn(),
+      getNode: vi.fn(),
+    }),
+    useNodeId: () => "test-node-id",
+    useUpdateNodeInternals: () => vi.fn(),
+    Handle: ({ children }: { children: React.ReactNode }) => (
+      <div>{children}</div>
+    ),
+    Position: { Left: "left", Right: "right", Top: "top", Bottom: "bottom" },
+  };
+});
+
+import { CustomNode } from "../components/FlowEditor/nodes/CustomNode/CustomNode";
+
+// ---- Helpers ----
+
+function buildNodeData(
+  overrides: Partial<CustomNodeData> = {},
+): CustomNodeData {
+  return {
+    hardcodedValues: {},
+    title: "Test Block",
+    description: "A test block",
+    inputSchema: { type: "object", properties: {} },
+    outputSchema: { type: "object", properties: {} },
+    uiType: BlockUIType.STANDARD,
+    block_id: "block-123",
+    costs: [],
+    categories: [],
+    ...overrides,
+  };
+}
+
+function buildNodeProps(
+  dataOverrides: Partial<CustomNodeData> = {},
+  propsOverrides: Partial<NodeProps<CustomNodeType>> = {},
+): NodeProps<CustomNodeType> {
+  return {
+    id: "node-1",
+    data: buildNodeData(dataOverrides),
+    selected: false,
+    type: "custom",
+    isConnectable: true,
+    positionAbsoluteX: 0,
+    positionAbsoluteY: 0,
+    zIndex: 0,
+    dragging: false,
+    dragHandle: undefined,
+    draggable: true,
+    selectable: true,
+    deletable: true,
+    parentId: undefined,
+    width: undefined,
+    height: undefined,
+    sourcePosition: undefined,
+    targetPosition: undefined,
+    ...propsOverrides,
+  };
+}
+
+function renderCustomNode(
+  dataOverrides: Partial<CustomNodeData> = {},
+  propsOverrides: Partial<NodeProps<CustomNodeType>> = {},
+) {
+  const props = buildNodeProps(dataOverrides, propsOverrides);
+  return render(<CustomNode {...props} />);
+}
+
+function createExecutionResult(
+  overrides: Partial<NodeExecutionResult> = {},
+): NodeExecutionResult {
+  return {
+    node_exec_id: overrides.node_exec_id ?? "exec-1",
+    node_id: overrides.node_id ?? "node-1",
+    graph_exec_id: overrides.graph_exec_id ?? "graph-exec-1",
+    graph_id: overrides.graph_id ?? "graph-1",
+    graph_version: overrides.graph_version ?? 1,
+    user_id: overrides.user_id ?? "test-user",
+    block_id: overrides.block_id ?? "block-1",
+    status: overrides.status ?? "COMPLETED",
+    input_data: overrides.input_data ?? {},
+    output_data: overrides.output_data ?? {},
+    add_time: overrides.add_time ?? new Date("2024-01-01T00:00:00Z"),
+    queue_time: overrides.queue_time ?? new Date("2024-01-01T00:00:00Z"),
+    start_time: overrides.start_time ?? new Date("2024-01-01T00:00:01Z"),
+    end_time: overrides.end_time ?? new Date("2024-01-01T00:00:02Z"),
+  };
+}
+
+// ---- Tests ----
+
+beforeEach(() => {
+  cleanup();
+});
+
+describe("CustomNode", () => {
+  describe("STANDARD type rendering", () => {
+    it("renders NodeHeader with the block title", () => {
+      renderCustomNode({ title: "My Standard Block" });
+
+      const header = screen.getByTestId("node-header");
+      expect(header).toBeDefined();
+      expect(header.textContent).toContain("My Standard Block");
+    });
+
+    it("renders NodeContainer, FormCreator, OutputHandler, and NodeExecutionBadge", () => {
+      renderCustomNode();
+
+      expect(screen.getByTestId("node-container")).toBeDefined();
+      expect(screen.getByTestId("form-creator")).toBeDefined();
+      expect(screen.getByTestId("output-handler")).toBeDefined();
+      expect(screen.getByTestId("node-execution-badge")).toBeDefined();
+      expect(screen.getByTestId("node-data-renderer")).toBeDefined();
+      expect(screen.getByTestId("node-advanced-toggle")).toBeDefined();
+    });
+
+    it("wraps content in NodeRightClickMenu", () => {
+      renderCustomNode();
+
+      expect(screen.getByTestId("node-right-click-menu")).toBeDefined();
+    });
+
+    it("does not render StickyNoteBlock for STANDARD type", () => {
+      renderCustomNode();
+
+      expect(screen.queryByTestId("sticky-note-block")).toBeNull();
+    });
+  });
+
+  describe("NOTE type rendering", () => {
+    it("renders StickyNoteBlock instead of main UI", () => {
+      renderCustomNode({ uiType: BlockUIType.NOTE, title: "My Note" });
+
+      const note = screen.getByTestId("sticky-note-block");
+      expect(note).toBeDefined();
+      expect(note.textContent).toContain("My Note");
+    });
+
+    it("does not render NodeContainer or other standard components", () => {
+      renderCustomNode({ uiType: BlockUIType.NOTE });
+
+      expect(screen.queryByTestId("node-container")).toBeNull();
+      expect(screen.queryByTestId("node-header")).toBeNull();
+      expect(screen.queryByTestId("form-creator")).toBeNull();
+      expect(screen.queryByTestId("output-handler")).toBeNull();
+    });
+  });
+
+  describe("WEBHOOK type rendering", () => {
+    it("renders WebhookDisclaimer for WEBHOOK type", () => {
+      renderCustomNode({ uiType: BlockUIType.WEBHOOK });
+
+      expect(screen.getByTestId("webhook-disclaimer")).toBeDefined();
+    });
+
+    it("renders WebhookDisclaimer for WEBHOOK_MANUAL type", () => {
+      renderCustomNode({ uiType: BlockUIType.WEBHOOK_MANUAL });
+
+      expect(screen.getByTestId("webhook-disclaimer")).toBeDefined();
+    });
+  });
+
+  describe("AGENT type rendering", () => {
+    it("renders SubAgentUpdateFeature for AGENT type", () => {
+      renderCustomNode({ uiType: BlockUIType.AGENT });
+
+      expect(screen.getByTestId("sub-agent-update")).toBeDefined();
+    });
+
+    it("does not render SubAgentUpdateFeature for non-AGENT types", () => {
+      renderCustomNode({ uiType: BlockUIType.STANDARD });
+
+      expect(screen.queryByTestId("sub-agent-update")).toBeNull();
+    });
+  });
+
+  describe("OUTPUT type rendering", () => {
+    it("does not render OutputHandler for OUTPUT type", () => {
+      renderCustomNode({ uiType: BlockUIType.OUTPUT });
+
+      expect(screen.queryByTestId("output-handler")).toBeNull();
+    });
+
+    it("still renders FormCreator and other components for OUTPUT type", () => {
+      renderCustomNode({ uiType: BlockUIType.OUTPUT });
+
+      expect(screen.getByTestId("form-creator")).toBeDefined();
+      expect(screen.getByTestId("node-header")).toBeDefined();
+      expect(screen.getByTestId("node-execution-badge")).toBeDefined();
+    });
+  });
+
+  describe("AYRSHARE type rendering", () => {
+    it("renders AyrshareConnectButton for AYRSHARE type", () => {
+      renderCustomNode({ uiType: BlockUIType.AYRSHARE });
+
+      expect(screen.getByTestId("ayrshare-connect-button")).toBeDefined();
+    });
+
+    it("does not render AyrshareConnectButton for non-AYRSHARE types", () => {
+      renderCustomNode({ uiType: BlockUIType.STANDARD });
+
+      expect(screen.queryByTestId("ayrshare-connect-button")).toBeNull();
+    });
+  });
+
+  describe("error states", () => {
+    it("sets hasErrors on NodeContainer when data.errors has non-empty values", () => {
+      renderCustomNode({
+        errors: { field1: "This field is required" },
+      });
+
+      const container = screen.getByTestId("node-container");
+      expect(container.getAttribute("data-has-errors")).toBe("true");
+    });
+
+    it("does not set hasErrors when data.errors is empty", () => {
+      renderCustomNode({ errors: {} });
+
+      const container = screen.getByTestId("node-container");
+      expect(container.getAttribute("data-has-errors")).toBe("false");
+    });
+
+    it("does not set hasErrors when data.errors values are all empty strings", () => {
+      renderCustomNode({ errors: { field1: "" } });
+
+      const container = screen.getByTestId("node-container");
+      expect(container.getAttribute("data-has-errors")).toBe("false");
+    });
+
+    it("sets hasErrors when last execution result has error in output_data", () => {
+      renderCustomNode({
+        nodeExecutionResults: [
+          createExecutionResult({
+            output_data: { error: ["Something went wrong"] },
+          }),
+        ],
+      });
+
+      const container = screen.getByTestId("node-container");
+      expect(container.getAttribute("data-has-errors")).toBe("true");
+    });
+
+    it("does not set hasErrors when execution results have no error", () => {
+      renderCustomNode({
+        nodeExecutionResults: [
+          createExecutionResult({
+            output_data: { result: ["success"] },
+          }),
+        ],
+      });
+
+      const container = screen.getByTestId("node-container");
+      expect(container.getAttribute("data-has-errors")).toBe("false");
+    });
+  });
+
+  describe("NodeExecutionBadge", () => {
+    it("always renders NodeExecutionBadge for non-NOTE types", () => {
+      renderCustomNode({ uiType: BlockUIType.STANDARD });
+      expect(screen.getByTestId("node-execution-badge")).toBeDefined();
+    });
+
+    it("renders NodeExecutionBadge for AGENT type", () => {
+      renderCustomNode({ uiType: BlockUIType.AGENT });
+      expect(screen.getByTestId("node-execution-badge")).toBeDefined();
+    });
+
+    it("renders NodeExecutionBadge for OUTPUT type", () => {
+      renderCustomNode({ uiType: BlockUIType.OUTPUT });
+      expect(screen.getByTestId("node-execution-badge")).toBeDefined();
+    });
+  });
+
+  describe("edge cases", () => {
+    it("renders without nodeExecutionResults", () => {
+      renderCustomNode({ nodeExecutionResults: undefined });
+
+      const container = screen.getByTestId("node-container");
+      expect(container).toBeDefined();
+      expect(container.getAttribute("data-has-errors")).toBe("false");
+    });
+
+    it("renders without errors property", () => {
+      renderCustomNode({ errors: undefined });
+
+      const container = screen.getByTestId("node-container");
+      expect(container).toBeDefined();
+      expect(container.getAttribute("data-has-errors")).toBe("false");
+    });
+
+    it("renders with empty execution results array", () => {
+      renderCustomNode({ nodeExecutionResults: [] });
+
+      const container = screen.getByTestId("node-container");
+      expect(container).toBeDefined();
+      expect(container.getAttribute("data-has-errors")).toBe("false");
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/NewBlockMenu.test.tsx

@@ -0,0 +1,342 @@
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
+import {
+  render,
+  screen,
+  fireEvent,
+  waitFor,
+  cleanup,
+} from "@/tests/integrations/test-utils";
+import { useBlockMenuStore } from "../stores/blockMenuStore";
+import { useControlPanelStore } from "../stores/controlPanelStore";
+import { DefaultStateType } from "../components/NewControlPanel/NewBlockMenu/types";
+import { SearchEntryFilterAnyOfItem } from "@/app/api/__generated__/models/searchEntryFilterAnyOfItem";
+
+// ---------------------------------------------------------------------------
+// Mocks for heavy child components
+// ---------------------------------------------------------------------------
+vi.mock(
+  "../components/NewControlPanel/NewBlockMenu/BlockMenuDefault/BlockMenuDefault",
+  () => ({
+    BlockMenuDefault: () => (
+      <div data-testid="block-menu-default">Default Content</div>
+    ),
+  }),
+);
+
+vi.mock(
+  "../components/NewControlPanel/NewBlockMenu/BlockMenuSearch/BlockMenuSearch",
+  () => ({
+    BlockMenuSearch: () => (
+      <div data-testid="block-menu-search">Search Results</div>
+    ),
+  }),
+);
+
+// Mock query client used by the search bar hook
+vi.mock("@/lib/react-query/queryClient", () => ({
+  getQueryClient: () => ({
+    invalidateQueries: vi.fn(),
+  }),
+}));
+
+// ---------------------------------------------------------------------------
+// Reset stores before each test
+// ---------------------------------------------------------------------------
+afterEach(() => {
+  cleanup();
+});
+
+beforeEach(() => {
+  useBlockMenuStore.getState().reset();
+  useBlockMenuStore.setState({
+    filters: [],
+    creators: [],
+    creators_list: [],
+    categoryCounts: {
+      blocks: 0,
+      integrations: 0,
+      marketplace_agents: 0,
+      my_agents: 0,
+    },
+  });
+  useControlPanelStore.getState().reset();
+});
+
+// ===========================================================================
+// Section 1: blockMenuStore unit tests
+// ===========================================================================
+describe("blockMenuStore", () => {
+  describe("searchQuery", () => {
+    it("defaults to an empty string", () => {
+      expect(useBlockMenuStore.getState().searchQuery).toBe("");
+    });
+
+    it("sets the search query", () => {
+      useBlockMenuStore.getState().setSearchQuery("timer");
+      expect(useBlockMenuStore.getState().searchQuery).toBe("timer");
+    });
+  });
+
+  describe("defaultState", () => {
+    it("defaults to SUGGESTION", () => {
+      expect(useBlockMenuStore.getState().defaultState).toBe(
+        DefaultStateType.SUGGESTION,
+      );
+    });
+
+    it("sets the default state", () => {
+      useBlockMenuStore.getState().setDefaultState(DefaultStateType.ALL_BLOCKS);
+      expect(useBlockMenuStore.getState().defaultState).toBe(
+        DefaultStateType.ALL_BLOCKS,
+      );
+    });
+  });
+
+  describe("filters", () => {
+    it("defaults to an empty array", () => {
+      expect(useBlockMenuStore.getState().filters).toEqual([]);
+    });
+
+    it("adds a filter", () => {
+      useBlockMenuStore.getState().addFilter(SearchEntryFilterAnyOfItem.blocks);
+      expect(useBlockMenuStore.getState().filters).toEqual([
+        SearchEntryFilterAnyOfItem.blocks,
+      ]);
+    });
+
+    it("removes a filter", () => {
+      useBlockMenuStore
+        .getState()
+        .setFilters([
+          SearchEntryFilterAnyOfItem.blocks,
+          SearchEntryFilterAnyOfItem.integrations,
+        ]);
+      useBlockMenuStore
+        .getState()
+        .removeFilter(SearchEntryFilterAnyOfItem.blocks);
+      expect(useBlockMenuStore.getState().filters).toEqual([
+        SearchEntryFilterAnyOfItem.integrations,
+      ]);
+    });
+
+    it("replaces all filters with setFilters", () => {
+      useBlockMenuStore.getState().addFilter(SearchEntryFilterAnyOfItem.blocks);
+      useBlockMenuStore
+        .getState()
+        .setFilters([SearchEntryFilterAnyOfItem.marketplace_agents]);
+      expect(useBlockMenuStore.getState().filters).toEqual([
+        SearchEntryFilterAnyOfItem.marketplace_agents,
+      ]);
+    });
+  });
+
+  describe("creators", () => {
+    it("adds a creator", () => {
+      useBlockMenuStore.getState().addCreator("alice");
+      expect(useBlockMenuStore.getState().creators).toEqual(["alice"]);
+    });
+
+    it("removes a creator", () => {
+      useBlockMenuStore.getState().setCreators(["alice", "bob"]);
+      useBlockMenuStore.getState().removeCreator("alice");
+      expect(useBlockMenuStore.getState().creators).toEqual(["bob"]);
+    });
+
+    it("replaces all creators with setCreators", () => {
+      useBlockMenuStore.getState().addCreator("alice");
+      useBlockMenuStore.getState().setCreators(["charlie"]);
+      expect(useBlockMenuStore.getState().creators).toEqual(["charlie"]);
+    });
+  });
+
+  describe("categoryCounts", () => {
+    it("sets category counts", () => {
+      const counts = {
+        blocks: 10,
+        integrations: 5,
+        marketplace_agents: 3,
+        my_agents: 2,
+      };
+      useBlockMenuStore.getState().setCategoryCounts(counts);
+      expect(useBlockMenuStore.getState().categoryCounts).toEqual(counts);
+    });
+  });
+
+  describe("searchId", () => {
+    it("defaults to undefined", () => {
+      expect(useBlockMenuStore.getState().searchId).toBeUndefined();
+    });
+
+    it("sets and clears searchId", () => {
+      useBlockMenuStore.getState().setSearchId("search-123");
+      expect(useBlockMenuStore.getState().searchId).toBe("search-123");
+
+      useBlockMenuStore.getState().setSearchId(undefined);
+      expect(useBlockMenuStore.getState().searchId).toBeUndefined();
+    });
+  });
+
+  describe("integration", () => {
+    it("defaults to undefined", () => {
+      expect(useBlockMenuStore.getState().integration).toBeUndefined();
+    });
+
+    it("sets the integration", () => {
+      useBlockMenuStore.getState().setIntegration("slack");
+      expect(useBlockMenuStore.getState().integration).toBe("slack");
+    });
+  });
+
+  describe("reset", () => {
+    it("resets searchQuery, searchId, defaultState, and integration", () => {
+      useBlockMenuStore.getState().setSearchQuery("hello");
+      useBlockMenuStore.getState().setSearchId("id-1");
+      useBlockMenuStore.getState().setDefaultState(DefaultStateType.ALL_BLOCKS);
+      useBlockMenuStore.getState().setIntegration("github");
+
+      useBlockMenuStore.getState().reset();
+
+      const state = useBlockMenuStore.getState();
+      expect(state.searchQuery).toBe("");
+      expect(state.searchId).toBeUndefined();
+      expect(state.defaultState).toBe(DefaultStateType.SUGGESTION);
+      expect(state.integration).toBeUndefined();
+    });
+
+    it("does not reset filters or creators (by design)", () => {
+      useBlockMenuStore
+        .getState()
+        .setFilters([SearchEntryFilterAnyOfItem.blocks]);
+      useBlockMenuStore.getState().setCreators(["alice"]);
+
+      useBlockMenuStore.getState().reset();
+
+      expect(useBlockMenuStore.getState().filters).toEqual([
+        SearchEntryFilterAnyOfItem.blocks,
+      ]);
+      expect(useBlockMenuStore.getState().creators).toEqual(["alice"]);
+    });
+  });
+});
+
+// ===========================================================================
+// Section 2: controlPanelStore unit tests
+// ===========================================================================
+describe("controlPanelStore", () => {
+  it("defaults blockMenuOpen to false", () => {
+    expect(useControlPanelStore.getState().blockMenuOpen).toBe(false);
+  });
+
+  it("sets blockMenuOpen", () => {
+    useControlPanelStore.getState().setBlockMenuOpen(true);
+    expect(useControlPanelStore.getState().blockMenuOpen).toBe(true);
+  });
+
+  it("sets forceOpenBlockMenu", () => {
+    useControlPanelStore.getState().setForceOpenBlockMenu(true);
+    expect(useControlPanelStore.getState().forceOpenBlockMenu).toBe(true);
+  });
+
+  it("resets all control panel state", () => {
+    useControlPanelStore.getState().setBlockMenuOpen(true);
+    useControlPanelStore.getState().setForceOpenBlockMenu(true);
+    useControlPanelStore.getState().setSaveControlOpen(true);
+    useControlPanelStore.getState().setForceOpenSave(true);
+
+    useControlPanelStore.getState().reset();
+
+    const state = useControlPanelStore.getState();
+    expect(state.blockMenuOpen).toBe(false);
+    expect(state.forceOpenBlockMenu).toBe(false);
+    expect(state.saveControlOpen).toBe(false);
+    expect(state.forceOpenSave).toBe(false);
+  });
+});
+
+// ===========================================================================
+// Section 3: BlockMenuContent integration tests
+// ===========================================================================
+// We import BlockMenuContent directly to avoid dealing with the Popover wrapper.
+import { BlockMenuContent } from "../components/NewControlPanel/NewBlockMenu/BlockMenuContent/BlockMenuContent";
+
+describe("BlockMenuContent", () => {
+  it("shows BlockMenuDefault when there is no search query", () => {
+    useBlockMenuStore.getState().setSearchQuery("");
+
+    render(<BlockMenuContent />);
+
+    expect(screen.getByTestId("block-menu-default")).toBeDefined();
+    expect(screen.queryByTestId("block-menu-search")).toBeNull();
+  });
+
+  it("shows BlockMenuSearch when a search query is present", () => {
+    useBlockMenuStore.getState().setSearchQuery("timer");
+
+    render(<BlockMenuContent />);
+
+    expect(screen.getByTestId("block-menu-search")).toBeDefined();
+    expect(screen.queryByTestId("block-menu-default")).toBeNull();
+  });
+
+  it("renders the search bar", () => {
+    render(<BlockMenuContent />);
+
+    expect(
+      screen.getByPlaceholderText(
+        "Blocks, Agents, Integrations or Keywords...",
+      ),
+    ).toBeDefined();
+  });
+
+  it("switches from default to search view when store query changes", () => {
+    const { rerender } = render(<BlockMenuContent />);
+    expect(screen.getByTestId("block-menu-default")).toBeDefined();
+
+    // Simulate typing by setting the store directly
+    useBlockMenuStore.getState().setSearchQuery("webhook");
+    rerender(<BlockMenuContent />);
+
+    expect(screen.getByTestId("block-menu-search")).toBeDefined();
+    expect(screen.queryByTestId("block-menu-default")).toBeNull();
+  });
+
+  it("switches back to default view when search query is cleared", () => {
+    useBlockMenuStore.getState().setSearchQuery("something");
+    const { rerender } = render(<BlockMenuContent />);
+    expect(screen.getByTestId("block-menu-search")).toBeDefined();
+
+    useBlockMenuStore.getState().setSearchQuery("");
+    rerender(<BlockMenuContent />);
+
+    expect(screen.getByTestId("block-menu-default")).toBeDefined();
+    expect(screen.queryByTestId("block-menu-search")).toBeNull();
+  });
+
+  it("typing in the search bar updates the local input value", async () => {
+    render(<BlockMenuContent />);
+
+    const input = screen.getByPlaceholderText(
+      "Blocks, Agents, Integrations or Keywords...",
+    );
+    fireEvent.change(input, { target: { value: "slack" } });
+
+    expect((input as HTMLInputElement).value).toBe("slack");
+  });
+
+  it("shows clear button when input has text and clears on click", async () => {
+    render(<BlockMenuContent />);
+
+    const input = screen.getByPlaceholderText(
+      "Blocks, Agents, Integrations or Keywords...",
+    );
+    fireEvent.change(input, { target: { value: "test" } });
+
+    // The clear button should appear
+    const clearButton = screen.getByRole("button");
+    fireEvent.click(clearButton);
+
+    await waitFor(() => {
+      expect((input as HTMLInputElement).value).toBe("");
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/NewSaveControl.test.tsx

@@ -0,0 +1,270 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import {
+  render,
+  screen,
+  fireEvent,
+  waitFor,
+  cleanup,
+} from "@/tests/integrations/test-utils";
+import { UseFormReturn, useForm } from "react-hook-form";
+import { zodResolver } from "@hookform/resolvers/zod";
+import * as z from "zod";
+import { renderHook } from "@testing-library/react";
+import { useControlPanelStore } from "../stores/controlPanelStore";
+import { TooltipProvider } from "@/components/atoms/Tooltip/BaseTooltip";
+import { NewSaveControl } from "../components/NewControlPanel/NewSaveControl/NewSaveControl";
+import { useNewSaveControl } from "../components/NewControlPanel/NewSaveControl/useNewSaveControl";
+
+const formSchema = z.object({
+  name: z.string().min(1, "Name is required").max(100),
+  description: z.string().max(500),
+});
+
+type SaveableGraphFormValues = z.infer<typeof formSchema>;
+
+const mockHandleSave = vi.fn();
+
+vi.mock(
+  "../components/NewControlPanel/NewSaveControl/useNewSaveControl",
+  () => ({
+    useNewSaveControl: vi.fn(),
+  }),
+);
+
+const mockUseNewSaveControl = vi.mocked(useNewSaveControl);
+
+function createMockForm(
+  defaults: SaveableGraphFormValues = { name: "", description: "" },
+): UseFormReturn<SaveableGraphFormValues> {
+  const { result } = renderHook(() =>
+    useForm<SaveableGraphFormValues>({
+      resolver: zodResolver(formSchema),
+      defaultValues: defaults,
+    }),
+  );
+  return result.current;
+}
+
+function setupMock(overrides: {
+  isSaving?: boolean;
+  graphVersion?: number;
+  name?: string;
+  description?: string;
+}) {
+  const form = createMockForm({
+    name: overrides.name ?? "",
+    description: overrides.description ?? "",
+  });
+
+  mockUseNewSaveControl.mockReturnValue({
+    form,
+    isSaving: overrides.isSaving ?? false,
+    graphVersion: overrides.graphVersion,
+    handleSave: mockHandleSave,
+  });
+
+  return form;
+}
+
+function resetStore() {
+  useControlPanelStore.setState({
+    blockMenuOpen: false,
+    saveControlOpen: false,
+    forceOpenBlockMenu: false,
+    forceOpenSave: false,
+  });
+}
+
+beforeEach(() => {
+  cleanup();
+  resetStore();
+  mockHandleSave.mockReset();
+});
+
+afterEach(() => {
+  cleanup();
+});
+
+describe("NewSaveControl", () => {
+  it("renders save button trigger", () => {
+    setupMock({});
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    expect(screen.getByTestId("save-control-save-button")).toBeDefined();
+  });
+
+  it("renders name and description inputs when popover is open", () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({});
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    expect(screen.getByTestId("save-control-name-input")).toBeDefined();
+    expect(screen.getByTestId("save-control-description-input")).toBeDefined();
+  });
+
+  it("does not render popover content when closed", () => {
+    useControlPanelStore.setState({ saveControlOpen: false });
+    setupMock({});
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    expect(screen.queryByTestId("save-control-name-input")).toBeNull();
+    expect(screen.queryByTestId("save-control-description-input")).toBeNull();
+  });
+
+  it("shows version output when graphVersion is set", () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({ graphVersion: 3 });
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    const versionInput = screen.getByTestId("save-control-version-output");
+    expect(versionInput).toBeDefined();
+    expect((versionInput as HTMLInputElement).disabled).toBe(true);
+  });
+
+  it("hides version output when graphVersion is undefined", () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({ graphVersion: undefined });
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    expect(screen.queryByTestId("save-control-version-output")).toBeNull();
+  });
+
+  it("enables save button when isSaving is false", () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({ isSaving: false });
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    const saveButton = screen.getByTestId("save-control-save-agent-button");
+    expect((saveButton as HTMLButtonElement).disabled).toBe(false);
+  });
+
+  it("disables save button when isSaving is true", () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({ isSaving: true });
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    const saveButton = screen.getByRole("button", { name: /save agent/i });
+    expect((saveButton as HTMLButtonElement).disabled).toBe(true);
+  });
+
+  it("calls handleSave on form submission with valid data", async () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    const form = setupMock({ name: "My Agent", description: "A description" });
+
+    form.setValue("name", "My Agent");
+    form.setValue("description", "A description");
+
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    const saveButton = screen.getByTestId("save-control-save-agent-button");
+    fireEvent.click(saveButton);
+
+    await waitFor(() => {
+      expect(mockHandleSave).toHaveBeenCalledWith(
+        { name: "My Agent", description: "A description" },
+        expect.anything(),
+      );
+    });
+  });
+
+  it("does not call handleSave when name is empty (validation fails)", async () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({ name: "", description: "" });
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    const saveButton = screen.getByTestId("save-control-save-agent-button");
+    fireEvent.click(saveButton);
+
+    await waitFor(() => {
+      expect(mockHandleSave).not.toHaveBeenCalled();
+    });
+  });
+
+  it("popover stays open when forceOpenSave is true", () => {
+    useControlPanelStore.setState({
+      saveControlOpen: false,
+      forceOpenSave: true,
+    });
+    setupMock({});
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    expect(screen.getByTestId("save-control-name-input")).toBeDefined();
+  });
+
+  it("allows typing in name and description inputs", () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({});
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    const nameInput = screen.getByTestId(
+      "save-control-name-input",
+    ) as HTMLInputElement;
+    const descriptionInput = screen.getByTestId(
+      "save-control-description-input",
+    ) as HTMLInputElement;
+
+    fireEvent.change(nameInput, { target: { value: "Test Agent" } });
+    fireEvent.change(descriptionInput, {
+      target: { value: "Test Description" },
+    });
+
+    expect(nameInput.value).toBe("Test Agent");
+    expect(descriptionInput.value).toBe("Test Description");
+  });
+
+  it("displays save button text", () => {
+    useControlPanelStore.setState({ saveControlOpen: true });
+    setupMock({});
+    render(
+      <TooltipProvider>
+        <NewSaveControl />
+      </TooltipProvider>,
+    );
+
+    expect(screen.getByText("Save Agent")).toBeDefined();
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/RunGraph.test.tsx

@@ -0,0 +1,147 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { screen, fireEvent, cleanup } from "@testing-library/react";
+import { render } from "@/tests/integrations/test-utils";
+import React from "react";
+import { useGraphStore } from "../stores/graphStore";
+
+vi.mock(
+  "@/app/(platform)/build/components/BuilderActions/components/RunGraph/useRunGraph",
+  () => ({
+    useRunGraph: vi.fn(),
+  }),
+);
+
+vi.mock(
+  "@/app/(platform)/build/components/BuilderActions/components/RunInputDialog/RunInputDialog",
+  () => ({
+    RunInputDialog: ({ isOpen }: { isOpen: boolean }) =>
+      isOpen ? <div data-testid="run-input-dialog">Dialog</div> : null,
+  }),
+);
+
+// Must import after mocks
+import { useRunGraph } from "../components/BuilderActions/components/RunGraph/useRunGraph";
+import { RunGraph } from "../components/BuilderActions/components/RunGraph/RunGraph";
+
+const mockUseRunGraph = vi.mocked(useRunGraph);
+
+function createMockReturnValue(
+  overrides: Partial<ReturnType<typeof useRunGraph>> = {},
+) {
+  return {
+    handleRunGraph: vi.fn(),
+    handleStopGraph: vi.fn(),
+    openRunInputDialog: false,
+    setOpenRunInputDialog: vi.fn(),
+    isExecutingGraph: false,
+    isTerminatingGraph: false,
+    isSaving: false,
+    ...overrides,
+  };
+}
+
+// RunGraph uses Tooltip which requires TooltipProvider
+import { TooltipProvider } from "@/components/atoms/Tooltip/BaseTooltip";
+
+function renderRunGraph(flowID: string | null = "test-flow-id") {
+  return render(
+    <TooltipProvider>
+      <RunGraph flowID={flowID} />
+    </TooltipProvider>,
+  );
+}
+
+describe("RunGraph", () => {
+  beforeEach(() => {
+    cleanup();
+    mockUseRunGraph.mockReturnValue(createMockReturnValue());
+    useGraphStore.setState({ isGraphRunning: false });
+  });
+
+  afterEach(() => {
+    cleanup();
+  });
+
+  it("renders an enabled button when flowID is provided", () => {
+    renderRunGraph("test-flow-id");
+    const button = screen.getByRole("button");
+    expect((button as HTMLButtonElement).disabled).toBe(false);
+  });
+
+  it("renders a disabled button when flowID is null", () => {
+    renderRunGraph(null);
+    const button = screen.getByRole("button");
+    expect((button as HTMLButtonElement).disabled).toBe(true);
+  });
+
+  it("disables the button when isExecutingGraph is true", () => {
+    mockUseRunGraph.mockReturnValue(
+      createMockReturnValue({ isExecutingGraph: true }),
+    );
+    renderRunGraph();
+    expect((screen.getByRole("button") as HTMLButtonElement).disabled).toBe(
+      true,
+    );
+  });
+
+  it("disables the button when isTerminatingGraph is true", () => {
+    mockUseRunGraph.mockReturnValue(
+      createMockReturnValue({ isTerminatingGraph: true }),
+    );
+    renderRunGraph();
+    expect((screen.getByRole("button") as HTMLButtonElement).disabled).toBe(
+      true,
+    );
+  });
+
+  it("disables the button when isSaving is true", () => {
+    mockUseRunGraph.mockReturnValue(createMockReturnValue({ isSaving: true }));
+    renderRunGraph();
+    expect((screen.getByRole("button") as HTMLButtonElement).disabled).toBe(
+      true,
+    );
+  });
+
+  it("uses data-id run-graph-button when not running", () => {
+    renderRunGraph();
+    const button = screen.getByRole("button");
+    expect(button.getAttribute("data-id")).toBe("run-graph-button");
+  });
+
+  it("uses data-id stop-graph-button when running", () => {
+    useGraphStore.setState({ isGraphRunning: true });
+    renderRunGraph();
+    const button = screen.getByRole("button");
+    expect(button.getAttribute("data-id")).toBe("stop-graph-button");
+  });
+
+  it("calls handleRunGraph when clicked and graph is not running", () => {
+    const handleRunGraph = vi.fn();
+    mockUseRunGraph.mockReturnValue(createMockReturnValue({ handleRunGraph }));
+    renderRunGraph();
+    fireEvent.click(screen.getByRole("button"));
+    expect(handleRunGraph).toHaveBeenCalledOnce();
+  });
+
+  it("calls handleStopGraph when clicked and graph is running", () => {
+    const handleStopGraph = vi.fn();
+    mockUseRunGraph.mockReturnValue(createMockReturnValue({ handleStopGraph }));
+    useGraphStore.setState({ isGraphRunning: true });
+    renderRunGraph();
+    fireEvent.click(screen.getByRole("button"));
+    expect(handleStopGraph).toHaveBeenCalledOnce();
+  });
+
+  it("renders RunInputDialog hidden by default", () => {
+    renderRunGraph();
+    expect(screen.queryByTestId("run-input-dialog")).toBeNull();
+  });
+
+  it("renders RunInputDialog when openRunInputDialog is true", () => {
+    mockUseRunGraph.mockReturnValue(
+      createMockReturnValue({ openRunInputDialog: true }),
+    );
+    renderRunGraph();
+    expect(screen.getByTestId("run-input-dialog")).toBeDefined();
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/copyPasteStore.test.ts

@@ -0,0 +1,257 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { CustomNode } from "../components/FlowEditor/nodes/CustomNode/CustomNode";
+import { BlockUIType } from "../components/types";
+
+vi.mock("@/services/storage/local-storage", () => {
+  const store: Record<string, string> = {};
+  return {
+    Key: { COPIED_FLOW_DATA: "COPIED_FLOW_DATA" },
+    storage: {
+      get: (key: string) => store[key] ?? null,
+      set: (key: string, value: string) => {
+        store[key] = value;
+      },
+      clean: (key: string) => {
+        delete store[key];
+      },
+    },
+  };
+});
+
+import { useCopyPasteStore } from "../stores/copyPasteStore";
+import { useNodeStore } from "../stores/nodeStore";
+import { useEdgeStore } from "../stores/edgeStore";
+import { useHistoryStore } from "../stores/historyStore";
+import { storage, Key } from "@/services/storage/local-storage";
+
+function createTestNode(
+  id: string,
+  overrides: Partial<CustomNode> = {},
+): CustomNode {
+  return {
+    id,
+    type: "custom",
+    position: overrides.position ?? { x: 100, y: 200 },
+    selected: overrides.selected,
+    data: {
+      hardcodedValues: {},
+      title: `Node ${id}`,
+      description: "test node",
+      inputSchema: {},
+      outputSchema: {},
+      uiType: BlockUIType.STANDARD,
+      block_id: `block-${id}`,
+      costs: [],
+      categories: [],
+      ...overrides.data,
+    },
+  } as CustomNode;
+}
+
+describe("useCopyPasteStore", () => {
+  beforeEach(() => {
+    useNodeStore.setState({ nodes: [], nodeCounter: 0 });
+    useEdgeStore.setState({ edges: [] });
+    useHistoryStore.getState().clear();
+    storage.clean(Key.COPIED_FLOW_DATA);
+  });
+
+  describe("copySelectedNodes", () => {
+    it("copies a single selected node to localStorage", () => {
+      const node = createTestNode("1", { selected: true });
+      useNodeStore.setState({ nodes: [node] });
+
+      useCopyPasteStore.getState().copySelectedNodes();
+
+      const stored = storage.get(Key.COPIED_FLOW_DATA);
+      expect(stored).not.toBeNull();
+
+      const parsed = JSON.parse(stored!);
+      expect(parsed.nodes).toHaveLength(1);
+      expect(parsed.nodes[0].id).toBe("1");
+      expect(parsed.edges).toHaveLength(0);
+    });
+
+    it("copies only edges between selected nodes", () => {
+      const nodeA = createTestNode("a", { selected: true });
+      const nodeB = createTestNode("b", { selected: true });
+      const nodeC = createTestNode("c", { selected: false });
+      useNodeStore.setState({ nodes: [nodeA, nodeB, nodeC] });
+
+      useEdgeStore.setState({
+        edges: [
+          {
+            id: "e-ab",
+            source: "a",
+            target: "b",
+            sourceHandle: "out",
+            targetHandle: "in",
+          },
+          {
+            id: "e-bc",
+            source: "b",
+            target: "c",
+            sourceHandle: "out",
+            targetHandle: "in",
+          },
+          {
+            id: "e-ac",
+            source: "a",
+            target: "c",
+            sourceHandle: "out",
+            targetHandle: "in",
+          },
+        ],
+      });
+
+      useCopyPasteStore.getState().copySelectedNodes();
+
+      const parsed = JSON.parse(storage.get(Key.COPIED_FLOW_DATA)!);
+      expect(parsed.nodes).toHaveLength(2);
+      expect(parsed.edges).toHaveLength(1);
+      expect(parsed.edges[0].id).toBe("e-ab");
+    });
+
+    it("stores empty data when no nodes are selected", () => {
+      const node = createTestNode("1", { selected: false });
+      useNodeStore.setState({ nodes: [node] });
+
+      useCopyPasteStore.getState().copySelectedNodes();
+
+      const parsed = JSON.parse(storage.get(Key.COPIED_FLOW_DATA)!);
+      expect(parsed.nodes).toHaveLength(0);
+      expect(parsed.edges).toHaveLength(0);
+    });
+  });
+
+  describe("pasteNodes", () => {
+    it("creates new nodes with new IDs via incrementNodeCounter", () => {
+      const node = createTestNode("orig", {
+        selected: true,
+        position: { x: 100, y: 200 },
+      });
+      useNodeStore.setState({ nodes: [node], nodeCounter: 5 });
+
+      useCopyPasteStore.getState().copySelectedNodes();
+      useCopyPasteStore.getState().pasteNodes();
+
+      const { nodes } = useNodeStore.getState();
+      expect(nodes).toHaveLength(2);
+
+      const pastedNode = nodes.find((n) => n.id !== "orig");
+      expect(pastedNode).toBeDefined();
+      expect(pastedNode!.id).not.toBe("orig");
+    });
+
+    it("offsets pasted node positions by +50 x/y", () => {
+      const node = createTestNode("orig", {
+        selected: true,
+        position: { x: 100, y: 200 },
+      });
+      useNodeStore.setState({ nodes: [node], nodeCounter: 5 });
+
+      useCopyPasteStore.getState().copySelectedNodes();
+      useCopyPasteStore.getState().pasteNodes();
+
+      const { nodes } = useNodeStore.getState();
+      const pastedNode = nodes.find((n) => n.id !== "orig");
+      expect(pastedNode).toBeDefined();
+      expect(pastedNode!.position).toEqual({ x: 150, y: 250 });
+    });
+
+    it("preserves internal connections with remapped IDs", () => {
+      const nodeA = createTestNode("a", {
+        selected: true,
+        position: { x: 0, y: 0 },
+      });
+      const nodeB = createTestNode("b", {
+        selected: true,
+        position: { x: 200, y: 0 },
+      });
+      useNodeStore.setState({ nodes: [nodeA, nodeB], nodeCounter: 0 });
+      useEdgeStore.setState({
+        edges: [
+          {
+            id: "e-ab",
+            source: "a",
+            target: "b",
+            sourceHandle: "output",
+            targetHandle: "input",
+          },
+        ],
+      });
+
+      useCopyPasteStore.getState().copySelectedNodes();
+      useCopyPasteStore.getState().pasteNodes();
+
+      const { edges } = useEdgeStore.getState();
+      const newEdges = edges.filter((e) => e.id !== "e-ab");
+      expect(newEdges).toHaveLength(1);
+
+      const newEdge = newEdges[0];
+      expect(newEdge.source).not.toBe("a");
+      expect(newEdge.target).not.toBe("b");
+
+      const { nodes } = useNodeStore.getState();
+      const pastedNodeIDs = nodes
+        .filter((n) => n.id !== "a" && n.id !== "b")
+        .map((n) => n.id);
+
+      expect(pastedNodeIDs).toContain(newEdge.source);
+      expect(pastedNodeIDs).toContain(newEdge.target);
+    });
+
+    it("deselects existing nodes and selects pasted ones", () => {
+      const existingNode = createTestNode("existing", {
+        selected: true,
+        position: { x: 0, y: 0 },
+      });
+      const nodeToCopy = createTestNode("copy-me", {
+        selected: true,
+        position: { x: 100, y: 100 },
+      });
+      useNodeStore.setState({
+        nodes: [existingNode, nodeToCopy],
+        nodeCounter: 0,
+      });
+
+      useCopyPasteStore.getState().copySelectedNodes();
+
+      // Deselect nodeToCopy, keep existingNode selected to verify deselection on paste
+      useNodeStore.setState({
+        nodes: [
+          { ...existingNode, selected: true },
+          { ...nodeToCopy, selected: false },
+        ],
+      });
+
+      useCopyPasteStore.getState().pasteNodes();
+
+      const { nodes } = useNodeStore.getState();
+      const originalNodes = nodes.filter(
+        (n) => n.id === "existing" || n.id === "copy-me",
+      );
+      const pastedNodes = nodes.filter(
+        (n) => n.id !== "existing" && n.id !== "copy-me",
+      );
+
+      originalNodes.forEach((n) => {
+        expect(n.selected).toBe(false);
+      });
+      pastedNodes.forEach((n) => {
+        expect(n.selected).toBe(true);
+      });
+    });
+
+    it("does nothing when clipboard is empty", () => {
+      const node = createTestNode("1", { position: { x: 0, y: 0 } });
+      useNodeStore.setState({ nodes: [node], nodeCounter: 0 });
+
+      useCopyPasteStore.getState().pasteNodes();
+
+      const { nodes } = useNodeStore.getState();
+      expect(nodes).toHaveLength(1);
+      expect(nodes[0].id).toBe("1");
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/edgeStore.test.ts

@@ -0,0 +1,751 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { MarkerType } from "@xyflow/react";
+import { useEdgeStore } from "../stores/edgeStore";
+import { useNodeStore } from "../stores/nodeStore";
+import { useHistoryStore } from "../stores/historyStore";
+import type { CustomEdge } from "../components/FlowEditor/edges/CustomEdge";
+import type { NodeExecutionResult } from "@/app/api/__generated__/models/nodeExecutionResult";
+import type { Link } from "@/app/api/__generated__/models/link";
+
+function makeEdge(overrides: Partial<CustomEdge> & { id: string }): CustomEdge {
+  return {
+    type: "custom",
+    source: "node-a",
+    target: "node-b",
+    sourceHandle: "output",
+    targetHandle: "input",
+    ...overrides,
+  };
+}
+
+function makeExecutionResult(
+  overrides: Partial<NodeExecutionResult>,
+): NodeExecutionResult {
+  return {
+    user_id: "user-1",
+    graph_id: "graph-1",
+    graph_version: 1,
+    graph_exec_id: "gexec-1",
+    node_exec_id: "nexec-1",
+    node_id: "node-1",
+    block_id: "block-1",
+    status: "INCOMPLETE",
+    input_data: {},
+    output_data: {},
+    add_time: new Date(),
+    queue_time: null,
+    start_time: null,
+    end_time: null,
+    ...overrides,
+  };
+}
+
+beforeEach(() => {
+  useEdgeStore.setState({ edges: [] });
+  useNodeStore.setState({ nodes: [] });
+  useHistoryStore.setState({ past: [], future: [] });
+});
+
+describe("edgeStore", () => {
+  describe("setEdges", () => {
+    it("replaces all edges", () => {
+      const edges = [
+        makeEdge({ id: "e1" }),
+        makeEdge({ id: "e2", source: "node-c" }),
+      ];
+
+      useEdgeStore.getState().setEdges(edges);
+
+      expect(useEdgeStore.getState().edges).toHaveLength(2);
+      expect(useEdgeStore.getState().edges[0].id).toBe("e1");
+      expect(useEdgeStore.getState().edges[1].id).toBe("e2");
+    });
+  });
+
+  describe("addEdge", () => {
+    it("adds an edge and auto-generates an ID", () => {
+      const result = useEdgeStore.getState().addEdge({
+        source: "n1",
+        target: "n2",
+        sourceHandle: "out",
+        targetHandle: "in",
+      });
+
+      expect(result.id).toBe("n1:out->n2:in");
+      expect(useEdgeStore.getState().edges).toHaveLength(1);
+      expect(useEdgeStore.getState().edges[0].id).toBe("n1:out->n2:in");
+    });
+
+    it("uses provided ID when given", () => {
+      const result = useEdgeStore.getState().addEdge({
+        id: "custom-id",
+        source: "n1",
+        target: "n2",
+        sourceHandle: "out",
+        targetHandle: "in",
+      });
+
+      expect(result.id).toBe("custom-id");
+    });
+
+    it("sets type to custom and adds arrow marker", () => {
+      const result = useEdgeStore.getState().addEdge({
+        source: "n1",
+        target: "n2",
+        sourceHandle: "out",
+        targetHandle: "in",
+      });
+
+      expect(result.type).toBe("custom");
+      expect(result.markerEnd).toEqual({
+        type: MarkerType.ArrowClosed,
+        strokeWidth: 2,
+        color: "#555",
+      });
+    });
+
+    it("rejects duplicate edges without adding", () => {
+      useEdgeStore.getState().addEdge({
+        source: "n1",
+        target: "n2",
+        sourceHandle: "out",
+        targetHandle: "in",
+      });
+
+      const pushSpy = vi.spyOn(useHistoryStore.getState(), "pushState");
+
+      const duplicate = useEdgeStore.getState().addEdge({
+        source: "n1",
+        target: "n2",
+        sourceHandle: "out",
+        targetHandle: "in",
+      });
+
+      expect(useEdgeStore.getState().edges).toHaveLength(1);
+      expect(duplicate.id).toBe("n1:out->n2:in");
+      expect(pushSpy).not.toHaveBeenCalled();
+
+      pushSpy.mockRestore();
+    });
+
+    it("pushes previous state to history store", () => {
+      const pushSpy = vi.spyOn(useHistoryStore.getState(), "pushState");
+
+      useEdgeStore.getState().addEdge({
+        source: "n1",
+        target: "n2",
+        sourceHandle: "out",
+        targetHandle: "in",
+      });
+
+      expect(pushSpy).toHaveBeenCalledWith({
+        nodes: [],
+        edges: [],
+      });
+
+      pushSpy.mockRestore();
+    });
+  });
+
+  describe("removeEdge", () => {
+    it("removes an edge by ID", () => {
+      useEdgeStore.setState({
+        edges: [makeEdge({ id: "e1" }), makeEdge({ id: "e2" })],
+      });
+
+      useEdgeStore.getState().removeEdge("e1");
+
+      expect(useEdgeStore.getState().edges).toHaveLength(1);
+      expect(useEdgeStore.getState().edges[0].id).toBe("e2");
+    });
+
+    it("does nothing when removing a non-existent edge", () => {
+      useEdgeStore.setState({ edges: [makeEdge({ id: "e1" })] });
+
+      useEdgeStore.getState().removeEdge("nonexistent");
+
+      expect(useEdgeStore.getState().edges).toHaveLength(1);
+    });
+
+    it("pushes previous state to history store", () => {
+      const existingEdges = [makeEdge({ id: "e1" })];
+      useEdgeStore.setState({ edges: existingEdges });
+
+      const pushSpy = vi.spyOn(useHistoryStore.getState(), "pushState");
+
+      useEdgeStore.getState().removeEdge("e1");
+
+      expect(pushSpy).toHaveBeenCalledWith({
+        nodes: [],
+        edges: existingEdges,
+      });
+
+      pushSpy.mockRestore();
+    });
+  });
+
+  describe("upsertMany", () => {
+    it("inserts new edges", () => {
+      useEdgeStore.setState({ edges: [makeEdge({ id: "e1" })] });
+
+      useEdgeStore.getState().upsertMany([makeEdge({ id: "e2" })]);
+
+      expect(useEdgeStore.getState().edges).toHaveLength(2);
+    });
+
+    it("updates existing edges by ID", () => {
+      useEdgeStore.setState({
+        edges: [makeEdge({ id: "e1", source: "old-source" })],
+      });
+
+      useEdgeStore
+        .getState()
+        .upsertMany([makeEdge({ id: "e1", source: "new-source" })]);
+
+      expect(useEdgeStore.getState().edges).toHaveLength(1);
+      expect(useEdgeStore.getState().edges[0].source).toBe("new-source");
+    });
+
+    it("handles mixed inserts and updates", () => {
+      useEdgeStore.setState({
+        edges: [makeEdge({ id: "e1", source: "old" })],
+      });
+
+      useEdgeStore
+        .getState()
+        .upsertMany([
+          makeEdge({ id: "e1", source: "updated" }),
+          makeEdge({ id: "e2", source: "new" }),
+        ]);
+
+      const edges = useEdgeStore.getState().edges;
+      expect(edges).toHaveLength(2);
+      expect(edges.find((e) => e.id === "e1")?.source).toBe("updated");
+      expect(edges.find((e) => e.id === "e2")?.source).toBe("new");
+    });
+  });
+
+  describe("removeEdgesByHandlePrefix", () => {
+    it("removes edges targeting a node with matching handle prefix", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({ id: "e1", target: "node-b", targetHandle: "input_foo" }),
+          makeEdge({ id: "e2", target: "node-b", targetHandle: "input_bar" }),
+          makeEdge({
+            id: "e3",
+            target: "node-b",
+            targetHandle: "other_handle",
+          }),
+          makeEdge({ id: "e4", target: "node-c", targetHandle: "input_foo" }),
+        ],
+      });
+
+      useEdgeStore.getState().removeEdgesByHandlePrefix("node-b", "input_");
+
+      const edges = useEdgeStore.getState().edges;
+      expect(edges).toHaveLength(2);
+      expect(edges.map((e) => e.id).sort()).toEqual(["e3", "e4"]);
+    });
+
+    it("does not remove edges where target does not match nodeId", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            source: "node-b",
+            target: "node-c",
+            targetHandle: "input_x",
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().removeEdgesByHandlePrefix("node-b", "input_");
+
+      expect(useEdgeStore.getState().edges).toHaveLength(1);
+    });
+  });
+
+  describe("getNodeEdges", () => {
+    it("returns edges where node is source", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({ id: "e1", source: "node-a", target: "node-b" }),
+          makeEdge({ id: "e2", source: "node-c", target: "node-d" }),
+        ],
+      });
+
+      const result = useEdgeStore.getState().getNodeEdges("node-a");
+      expect(result).toHaveLength(1);
+      expect(result[0].id).toBe("e1");
+    });
+
+    it("returns edges where node is target", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({ id: "e1", source: "node-a", target: "node-b" }),
+          makeEdge({ id: "e2", source: "node-c", target: "node-d" }),
+        ],
+      });
+
+      const result = useEdgeStore.getState().getNodeEdges("node-b");
+      expect(result).toHaveLength(1);
+      expect(result[0].id).toBe("e1");
+    });
+
+    it("returns edges for both source and target", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({ id: "e1", source: "node-a", target: "node-b" }),
+          makeEdge({ id: "e2", source: "node-b", target: "node-c" }),
+          makeEdge({ id: "e3", source: "node-d", target: "node-e" }),
+        ],
+      });
+
+      const result = useEdgeStore.getState().getNodeEdges("node-b");
+      expect(result).toHaveLength(2);
+      expect(result.map((e) => e.id).sort()).toEqual(["e1", "e2"]);
+    });
+
+    it("returns empty array for unconnected node", () => {
+      useEdgeStore.setState({
+        edges: [makeEdge({ id: "e1", source: "node-a", target: "node-b" })],
+      });
+
+      expect(useEdgeStore.getState().getNodeEdges("node-z")).toHaveLength(0);
+    });
+  });
+
+  describe("isInputConnected", () => {
+    it("returns true when target handle is connected", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: "input",
+          }),
+        ],
+      });
+
+      expect(useEdgeStore.getState().isInputConnected("node-b", "input")).toBe(
+        true,
+      );
+    });
+
+    it("returns false when target handle is not connected", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: "input",
+          }),
+        ],
+      });
+
+      expect(useEdgeStore.getState().isInputConnected("node-b", "other")).toBe(
+        false,
+      );
+    });
+
+    it("returns false when node is source not target", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            source: "node-b",
+            target: "node-c",
+            sourceHandle: "output",
+            targetHandle: "input",
+          }),
+        ],
+      });
+
+      expect(useEdgeStore.getState().isInputConnected("node-b", "output")).toBe(
+        false,
+      );
+    });
+  });
+
+  describe("isOutputConnected", () => {
+    it("returns true when source handle is connected", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            source: "node-a",
+            sourceHandle: "output",
+          }),
+        ],
+      });
+
+      expect(
+        useEdgeStore.getState().isOutputConnected("node-a", "output"),
+      ).toBe(true);
+    });
+
+    it("returns false when source handle is not connected", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            source: "node-a",
+            sourceHandle: "output",
+          }),
+        ],
+      });
+
+      expect(useEdgeStore.getState().isOutputConnected("node-a", "other")).toBe(
+        false,
+      );
+    });
+  });
+
+  describe("getBackendLinks", () => {
+    it("converts edges to Link format", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            source: "n1",
+            target: "n2",
+            sourceHandle: "out",
+            targetHandle: "in",
+            data: { isStatic: true },
+          }),
+        ],
+      });
+
+      const links = useEdgeStore.getState().getBackendLinks();
+
+      expect(links).toHaveLength(1);
+      expect(links[0]).toEqual({
+        id: "e1",
+        source_id: "n1",
+        sink_id: "n2",
+        source_name: "out",
+        sink_name: "in",
+        is_static: true,
+      });
+    });
+  });
+
+  describe("addLinks", () => {
+    it("converts Links to edges and adds them", () => {
+      const links: Link[] = [
+        {
+          id: "link-1",
+          source_id: "n1",
+          sink_id: "n2",
+          source_name: "out",
+          sink_name: "in",
+          is_static: false,
+        },
+      ];
+
+      useEdgeStore.getState().addLinks(links);
+
+      const edges = useEdgeStore.getState().edges;
+      expect(edges).toHaveLength(1);
+      expect(edges[0].source).toBe("n1");
+      expect(edges[0].target).toBe("n2");
+      expect(edges[0].sourceHandle).toBe("out");
+      expect(edges[0].targetHandle).toBe("in");
+      expect(edges[0].data?.isStatic).toBe(false);
+    });
+
+    it("adds multiple links", () => {
+      const links: Link[] = [
+        {
+          id: "link-1",
+          source_id: "n1",
+          sink_id: "n2",
+          source_name: "out",
+          sink_name: "in",
+        },
+        {
+          id: "link-2",
+          source_id: "n3",
+          sink_id: "n4",
+          source_name: "result",
+          sink_name: "value",
+        },
+      ];
+
+      useEdgeStore.getState().addLinks(links);
+
+      expect(useEdgeStore.getState().edges).toHaveLength(2);
+    });
+  });
+
+  describe("getAllHandleIdsOfANode", () => {
+    it("returns targetHandle values for edges targeting the node", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({ id: "e1", target: "node-b", targetHandle: "input_a" }),
+          makeEdge({ id: "e2", target: "node-b", targetHandle: "input_b" }),
+          makeEdge({ id: "e3", target: "node-c", targetHandle: "input_c" }),
+        ],
+      });
+
+      const handles = useEdgeStore.getState().getAllHandleIdsOfANode("node-b");
+      expect(handles).toEqual(["input_a", "input_b"]);
+    });
+
+    it("returns empty array when no edges target the node", () => {
+      useEdgeStore.setState({
+        edges: [makeEdge({ id: "e1", source: "node-b", target: "node-c" })],
+      });
+
+      expect(useEdgeStore.getState().getAllHandleIdsOfANode("node-b")).toEqual(
+        [],
+      );
+    });
+
+    it("returns empty string for edges with no targetHandle", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: undefined,
+          }),
+        ],
+      });
+
+      expect(useEdgeStore.getState().getAllHandleIdsOfANode("node-b")).toEqual([
+        "",
+      ]);
+    });
+  });
+
+  describe("updateEdgeBeads", () => {
+    it("updates bead counts for edges targeting the node", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: "input",
+            data: { beadUp: 0, beadDown: 0, beadData: new Map() },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().updateEdgeBeads(
+        "node-b",
+        makeExecutionResult({
+          node_exec_id: "exec-1",
+          status: "COMPLETED",
+          input_data: { input: "some-value" },
+        }),
+      );
+
+      const edge = useEdgeStore.getState().edges[0];
+      expect(edge.data?.beadUp).toBe(1);
+      expect(edge.data?.beadDown).toBe(1);
+    });
+
+    it("counts INCOMPLETE status in beadUp but not beadDown", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: "input",
+            data: { beadUp: 0, beadDown: 0, beadData: new Map() },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().updateEdgeBeads(
+        "node-b",
+        makeExecutionResult({
+          node_exec_id: "exec-1",
+          status: "INCOMPLETE",
+          input_data: { input: "data" },
+        }),
+      );
+
+      const edge = useEdgeStore.getState().edges[0];
+      expect(edge.data?.beadUp).toBe(1);
+      expect(edge.data?.beadDown).toBe(0);
+    });
+
+    it("does not modify edges not targeting the node", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-c",
+            targetHandle: "input",
+            data: { beadUp: 0, beadDown: 0, beadData: new Map() },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().updateEdgeBeads(
+        "node-b",
+        makeExecutionResult({
+          node_exec_id: "exec-1",
+          status: "COMPLETED",
+          input_data: { input: "data" },
+        }),
+      );
+
+      const edge = useEdgeStore.getState().edges[0];
+      expect(edge.data?.beadUp).toBe(0);
+      expect(edge.data?.beadDown).toBe(0);
+    });
+
+    it("does not update edge when input_data has no matching handle", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: "input",
+            data: { beadUp: 0, beadDown: 0, beadData: new Map() },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().updateEdgeBeads(
+        "node-b",
+        makeExecutionResult({
+          node_exec_id: "exec-1",
+          status: "COMPLETED",
+          input_data: { other_handle: "data" },
+        }),
+      );
+
+      const edge = useEdgeStore.getState().edges[0];
+      expect(edge.data?.beadUp).toBe(0);
+      expect(edge.data?.beadDown).toBe(0);
+    });
+
+    it("accumulates beads across multiple executions", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: "input",
+            data: { beadUp: 0, beadDown: 0, beadData: new Map() },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().updateEdgeBeads(
+        "node-b",
+        makeExecutionResult({
+          node_exec_id: "exec-1",
+          status: "COMPLETED",
+          input_data: { input: "data1" },
+        }),
+      );
+
+      useEdgeStore.getState().updateEdgeBeads(
+        "node-b",
+        makeExecutionResult({
+          node_exec_id: "exec-2",
+          status: "INCOMPLETE",
+          input_data: { input: "data2" },
+        }),
+      );
+
+      const edge = useEdgeStore.getState().edges[0];
+      expect(edge.data?.beadUp).toBe(2);
+      expect(edge.data?.beadDown).toBe(1);
+    });
+
+    it("handles static edges by setting beadUp to beadDown + 1", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            target: "node-b",
+            targetHandle: "input",
+            data: {
+              isStatic: true,
+              beadUp: 0,
+              beadDown: 0,
+              beadData: new Map(),
+            },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().updateEdgeBeads(
+        "node-b",
+        makeExecutionResult({
+          node_exec_id: "exec-1",
+          status: "COMPLETED",
+          input_data: { input: "data" },
+        }),
+      );
+
+      const edge = useEdgeStore.getState().edges[0];
+      expect(edge.data?.beadUp).toBe(2);
+      expect(edge.data?.beadDown).toBe(1);
+    });
+  });
+
+  describe("resetEdgeBeads", () => {
+    it("resets all bead data on all edges", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            data: {
+              beadUp: 5,
+              beadDown: 3,
+              beadData: new Map([["exec-1", "COMPLETED"]]),
+            },
+          }),
+          makeEdge({
+            id: "e2",
+            data: {
+              beadUp: 2,
+              beadDown: 1,
+              beadData: new Map([["exec-2", "INCOMPLETE"]]),
+            },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().resetEdgeBeads();
+
+      const edges = useEdgeStore.getState().edges;
+      for (const edge of edges) {
+        expect(edge.data?.beadUp).toBe(0);
+        expect(edge.data?.beadDown).toBe(0);
+        expect(edge.data?.beadData?.size).toBe(0);
+      }
+    });
+
+    it("preserves other edge data when resetting beads", () => {
+      useEdgeStore.setState({
+        edges: [
+          makeEdge({
+            id: "e1",
+            data: {
+              isStatic: true,
+              edgeColorClass: "text-red-500",
+              beadUp: 3,
+              beadDown: 2,
+              beadData: new Map(),
+            },
+          }),
+        ],
+      });
+
+      useEdgeStore.getState().resetEdgeBeads();
+
+      const edge = useEdgeStore.getState().edges[0];
+      expect(edge.data?.isStatic).toBe(true);
+      expect(edge.data?.edgeColorClass).toBe("text-red-500");
+      expect(edge.data?.beadUp).toBe(0);
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/graphStore.test.ts

@@ -0,0 +1,347 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { useGraphStore } from "../stores/graphStore";
+import { AgentExecutionStatus } from "@/app/api/__generated__/models/agentExecutionStatus";
+import { GraphMeta } from "@/app/api/__generated__/models/graphMeta";
+
+function createTestGraphMeta(
+  overrides: Partial<GraphMeta> & { id: string; name: string },
+): GraphMeta {
+  return {
+    version: 1,
+    description: "",
+    is_active: true,
+    user_id: "test-user",
+    created_at: new Date("2024-01-01T00:00:00Z"),
+    ...overrides,
+  };
+}
+
+function resetStore() {
+  useGraphStore.setState({
+    graphExecutionStatus: undefined,
+    isGraphRunning: false,
+    inputSchema: null,
+    credentialsInputSchema: null,
+    outputSchema: null,
+    availableSubGraphs: [],
+  });
+}
+
+beforeEach(() => {
+  resetStore();
+});
+
+describe("graphStore", () => {
+  describe("execution status transitions", () => {
+    it("handles QUEUED -> RUNNING -> COMPLETED transition", () => {
+      const { setGraphExecutionStatus } = useGraphStore.getState();
+
+      setGraphExecutionStatus(AgentExecutionStatus.QUEUED);
+      expect(useGraphStore.getState().graphExecutionStatus).toBe(
+        AgentExecutionStatus.QUEUED,
+      );
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+
+      setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      expect(useGraphStore.getState().graphExecutionStatus).toBe(
+        AgentExecutionStatus.RUNNING,
+      );
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+
+      setGraphExecutionStatus(AgentExecutionStatus.COMPLETED);
+      expect(useGraphStore.getState().graphExecutionStatus).toBe(
+        AgentExecutionStatus.COMPLETED,
+      );
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+
+    it("handles QUEUED -> RUNNING -> FAILED transition", () => {
+      const { setGraphExecutionStatus } = useGraphStore.getState();
+
+      setGraphExecutionStatus(AgentExecutionStatus.QUEUED);
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+
+      setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+
+      setGraphExecutionStatus(AgentExecutionStatus.FAILED);
+      expect(useGraphStore.getState().graphExecutionStatus).toBe(
+        AgentExecutionStatus.FAILED,
+      );
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+  });
+
+  describe("setGraphExecutionStatus auto-sets isGraphRunning", () => {
+    it("sets isGraphRunning to true for RUNNING", () => {
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+    });
+
+    it("sets isGraphRunning to true for QUEUED", () => {
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.QUEUED);
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+    });
+
+    it("sets isGraphRunning to false for COMPLETED", () => {
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.COMPLETED);
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+
+    it("sets isGraphRunning to false for FAILED", () => {
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.FAILED);
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+
+    it("sets isGraphRunning to false for TERMINATED", () => {
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.TERMINATED);
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+
+    it("sets isGraphRunning to false for INCOMPLETE", () => {
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.INCOMPLETE);
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+
+    it("sets isGraphRunning to false for undefined", () => {
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+
+      useGraphStore.getState().setGraphExecutionStatus(undefined);
+      expect(useGraphStore.getState().graphExecutionStatus).toBeUndefined();
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+  });
+
+  describe("setIsGraphRunning", () => {
+    it("sets isGraphRunning independently of status", () => {
+      useGraphStore.getState().setIsGraphRunning(true);
+      expect(useGraphStore.getState().isGraphRunning).toBe(true);
+
+      useGraphStore.getState().setIsGraphRunning(false);
+      expect(useGraphStore.getState().isGraphRunning).toBe(false);
+    });
+  });
+
+  describe("schema management", () => {
+    it("sets all three schemas via setGraphSchemas", () => {
+      const input = { properties: { prompt: { type: "string" } } };
+      const credentials = { properties: { apiKey: { type: "string" } } };
+      const output = { properties: { result: { type: "string" } } };
+
+      useGraphStore.getState().setGraphSchemas(input, credentials, output);
+
+      const state = useGraphStore.getState();
+      expect(state.inputSchema).toEqual(input);
+      expect(state.credentialsInputSchema).toEqual(credentials);
+      expect(state.outputSchema).toEqual(output);
+    });
+
+    it("sets schemas to null", () => {
+      const input = { properties: { prompt: { type: "string" } } };
+      useGraphStore.getState().setGraphSchemas(input, null, null);
+
+      const state = useGraphStore.getState();
+      expect(state.inputSchema).toEqual(input);
+      expect(state.credentialsInputSchema).toBeNull();
+      expect(state.outputSchema).toBeNull();
+    });
+
+    it("overwrites previous schemas", () => {
+      const first = { properties: { a: { type: "string" } } };
+      const second = { properties: { b: { type: "number" } } };
+
+      useGraphStore.getState().setGraphSchemas(first, first, first);
+      useGraphStore.getState().setGraphSchemas(second, null, second);
+
+      const state = useGraphStore.getState();
+      expect(state.inputSchema).toEqual(second);
+      expect(state.credentialsInputSchema).toBeNull();
+      expect(state.outputSchema).toEqual(second);
+    });
+  });
+
+  describe("hasInputs", () => {
+    it("returns false when inputSchema is null", () => {
+      expect(useGraphStore.getState().hasInputs()).toBe(false);
+    });
+
+    it("returns false when inputSchema has no properties", () => {
+      useGraphStore.getState().setGraphSchemas({}, null, null);
+      expect(useGraphStore.getState().hasInputs()).toBe(false);
+    });
+
+    it("returns false when inputSchema has empty properties", () => {
+      useGraphStore.getState().setGraphSchemas({ properties: {} }, null, null);
+      expect(useGraphStore.getState().hasInputs()).toBe(false);
+    });
+
+    it("returns true when inputSchema has properties", () => {
+      useGraphStore
+        .getState()
+        .setGraphSchemas(
+          { properties: { prompt: { type: "string" } } },
+          null,
+          null,
+        );
+      expect(useGraphStore.getState().hasInputs()).toBe(true);
+    });
+  });
+
+  describe("hasCredentials", () => {
+    it("returns false when credentialsInputSchema is null", () => {
+      expect(useGraphStore.getState().hasCredentials()).toBe(false);
+    });
+
+    it("returns false when credentialsInputSchema has empty properties", () => {
+      useGraphStore.getState().setGraphSchemas(null, { properties: {} }, null);
+      expect(useGraphStore.getState().hasCredentials()).toBe(false);
+    });
+
+    it("returns true when credentialsInputSchema has properties", () => {
+      useGraphStore
+        .getState()
+        .setGraphSchemas(
+          null,
+          { properties: { apiKey: { type: "string" } } },
+          null,
+        );
+      expect(useGraphStore.getState().hasCredentials()).toBe(true);
+    });
+  });
+
+  describe("hasOutputs", () => {
+    it("returns false when outputSchema is null", () => {
+      expect(useGraphStore.getState().hasOutputs()).toBe(false);
+    });
+
+    it("returns false when outputSchema has empty properties", () => {
+      useGraphStore.getState().setGraphSchemas(null, null, { properties: {} });
+      expect(useGraphStore.getState().hasOutputs()).toBe(false);
+    });
+
+    it("returns true when outputSchema has properties", () => {
+      useGraphStore.getState().setGraphSchemas(null, null, {
+        properties: { result: { type: "string" } },
+      });
+      expect(useGraphStore.getState().hasOutputs()).toBe(true);
+    });
+  });
+
+  describe("reset", () => {
+    it("clears execution status and schemas but preserves outputSchema and availableSubGraphs", () => {
+      const subGraphs: GraphMeta[] = [
+        createTestGraphMeta({
+          id: "sub-1",
+          name: "Sub Graph",
+          description: "A sub graph",
+        }),
+      ];
+
+      useGraphStore
+        .getState()
+        .setGraphExecutionStatus(AgentExecutionStatus.RUNNING);
+      useGraphStore
+        .getState()
+        .setGraphSchemas(
+          { properties: { a: {} } },
+          { properties: { b: {} } },
+          { properties: { c: {} } },
+        );
+      useGraphStore.getState().setAvailableSubGraphs(subGraphs);
+
+      useGraphStore.getState().reset();
+
+      const state = useGraphStore.getState();
+      expect(state.graphExecutionStatus).toBeUndefined();
+      expect(state.isGraphRunning).toBe(false);
+      expect(state.inputSchema).toBeNull();
+      expect(state.credentialsInputSchema).toBeNull();
+      // reset does not clear outputSchema or availableSubGraphs
+      expect(state.outputSchema).toEqual({ properties: { c: {} } });
+      expect(state.availableSubGraphs).toEqual(subGraphs);
+    });
+
+    it("is idempotent on fresh state", () => {
+      useGraphStore.getState().reset();
+
+      const state = useGraphStore.getState();
+      expect(state.graphExecutionStatus).toBeUndefined();
+      expect(state.isGraphRunning).toBe(false);
+      expect(state.inputSchema).toBeNull();
+      expect(state.credentialsInputSchema).toBeNull();
+    });
+  });
+
+  describe("setAvailableSubGraphs", () => {
+    it("sets sub-graphs list", () => {
+      const graphs: GraphMeta[] = [
+        createTestGraphMeta({
+          id: "graph-1",
+          name: "Graph One",
+          description: "First graph",
+        }),
+        createTestGraphMeta({
+          id: "graph-2",
+          version: 2,
+          name: "Graph Two",
+          description: "Second graph",
+        }),
+      ];
+
+      useGraphStore.getState().setAvailableSubGraphs(graphs);
+      expect(useGraphStore.getState().availableSubGraphs).toEqual(graphs);
+    });
+
+    it("replaces previous sub-graphs", () => {
+      const first: GraphMeta[] = [createTestGraphMeta({ id: "a", name: "A" })];
+      const second: GraphMeta[] = [
+        createTestGraphMeta({ id: "b", name: "B" }),
+        createTestGraphMeta({ id: "c", name: "C" }),
+      ];
+
+      useGraphStore.getState().setAvailableSubGraphs(first);
+      expect(useGraphStore.getState().availableSubGraphs).toHaveLength(1);
+
+      useGraphStore.getState().setAvailableSubGraphs(second);
+      expect(useGraphStore.getState().availableSubGraphs).toHaveLength(2);
+      expect(useGraphStore.getState().availableSubGraphs).toEqual(second);
+    });
+
+    it("can set empty sub-graphs list", () => {
+      useGraphStore
+        .getState()
+        .setAvailableSubGraphs([createTestGraphMeta({ id: "x", name: "X" })]);
+      useGraphStore.getState().setAvailableSubGraphs([]);
+      expect(useGraphStore.getState().availableSubGraphs).toEqual([]);
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/historyStore.test.ts

@@ -0,0 +1,407 @@
+import { describe, it, expect, beforeEach } from "vitest";
+import { useHistoryStore } from "../stores/historyStore";
+import { useNodeStore } from "../stores/nodeStore";
+import { useEdgeStore } from "../stores/edgeStore";
+import { CustomNode } from "../components/FlowEditor/nodes/CustomNode/CustomNode";
+import { CustomEdge } from "../components/FlowEditor/edges/CustomEdge";
+
+function createTestNode(
+  id: string,
+  overrides: Partial<CustomNode> = {},
+): CustomNode {
+  return {
+    id,
+    type: "custom" as const,
+    position: { x: 0, y: 0 },
+    data: {
+      hardcodedValues: {},
+      title: `Node ${id}`,
+      description: "",
+      inputSchema: {},
+      outputSchema: {},
+      uiType: "STANDARD" as never,
+      block_id: `block-${id}`,
+      costs: [],
+      categories: [],
+    },
+    ...overrides,
+  } as CustomNode;
+}
+
+function createTestEdge(
+  id: string,
+  source: string,
+  target: string,
+): CustomEdge {
+  return {
+    id,
+    source,
+    target,
+    type: "custom" as const,
+  } as CustomEdge;
+}
+
+async function flushMicrotasks() {
+  await new Promise<void>((resolve) => queueMicrotask(resolve));
+}
+
+beforeEach(() => {
+  useHistoryStore.getState().clear();
+  useNodeStore.setState({ nodes: [] });
+  useEdgeStore.setState({ edges: [] });
+});
+
+describe("historyStore", () => {
+  describe("undo/redo single action", () => {
+    it("undoes a single pushed state", async () => {
+      const node = createTestNode("1");
+
+      // Initialize history with node present as baseline
+      useNodeStore.setState({ nodes: [node] });
+      useHistoryStore.getState().initializeHistory();
+
+      // Simulate a change: clear nodes
+      useNodeStore.setState({ nodes: [] });
+
+      // Undo should restore to [node]
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([node]);
+      expect(useHistoryStore.getState().future).toHaveLength(1);
+      expect(useHistoryStore.getState().future[0].nodes).toEqual([]);
+    });
+
+    it("redoes after undo", async () => {
+      const node = createTestNode("1");
+
+      useNodeStore.setState({ nodes: [node] });
+      useHistoryStore.getState().initializeHistory();
+
+      // Change: clear nodes
+      useNodeStore.setState({ nodes: [] });
+
+      // Undo → back to [node]
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([node]);
+
+      // Redo → back to []
+      useHistoryStore.getState().redo();
+      expect(useNodeStore.getState().nodes).toEqual([]);
+    });
+  });
+
+  describe("undo/redo multiple actions", () => {
+    it("undoes through multiple states in order", async () => {
+      const node1 = createTestNode("1");
+      const node2 = createTestNode("2");
+      const node3 = createTestNode("3");
+
+      // Initialize with [node1] as baseline
+      useNodeStore.setState({ nodes: [node1] });
+      useHistoryStore.getState().initializeHistory();
+
+      // Second change: add node2, push pre-change state
+      useNodeStore.setState({ nodes: [node1, node2] });
+      useHistoryStore.getState().pushState({ nodes: [node1], edges: [] });
+      await flushMicrotasks();
+
+      // Third change: add node3, push pre-change state
+      useNodeStore.setState({ nodes: [node1, node2, node3] });
+      useHistoryStore
+        .getState()
+        .pushState({ nodes: [node1, node2], edges: [] });
+      await flushMicrotasks();
+
+      // Undo 1: back to [node1, node2]
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([node1, node2]);
+
+      // Undo 2: back to [node1]
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([node1]);
+    });
+  });
+
+  describe("undo past empty history", () => {
+    it("does nothing when there is no history to undo", () => {
+      useHistoryStore.getState().undo();
+
+      expect(useNodeStore.getState().nodes).toEqual([]);
+      expect(useEdgeStore.getState().edges).toEqual([]);
+      expect(useHistoryStore.getState().past).toHaveLength(1);
+    });
+
+    it("does nothing when current state equals last past entry", () => {
+      expect(useHistoryStore.getState().canUndo()).toBe(false);
+
+      useHistoryStore.getState().undo();
+
+      expect(useHistoryStore.getState().past).toHaveLength(1);
+      expect(useHistoryStore.getState().future).toHaveLength(0);
+    });
+  });
+
+  describe("state consistency: undo after node add restores previous, redo restores added", () => {
+    it("undo removes added node, redo restores it", async () => {
+      const node = createTestNode("added");
+
+      useNodeStore.setState({ nodes: [node] });
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([]);
+
+      useHistoryStore.getState().redo();
+      expect(useNodeStore.getState().nodes).toEqual([node]);
+    });
+  });
+
+  describe("history limits", () => {
+    it("does not grow past MAX_HISTORY (50)", async () => {
+      for (let i = 0; i < 60; i++) {
+        const node = createTestNode(`node-${i}`);
+        useNodeStore.setState({ nodes: [node] });
+        useHistoryStore.getState().pushState({
+          nodes: [createTestNode(`node-${i - 1}`)],
+          edges: [],
+        });
+        await flushMicrotasks();
+      }
+
+      expect(useHistoryStore.getState().past.length).toBeLessThanOrEqual(50);
+    });
+  });
+
+  describe("edge cases", () => {
+    it("redo does nothing when future is empty", () => {
+      const nodesBefore = useNodeStore.getState().nodes;
+      const edgesBefore = useEdgeStore.getState().edges;
+
+      useHistoryStore.getState().redo();
+
+      expect(useNodeStore.getState().nodes).toEqual(nodesBefore);
+      expect(useEdgeStore.getState().edges).toEqual(edgesBefore);
+    });
+
+    it("interleaved undo/redo sequence", async () => {
+      const node1 = createTestNode("1");
+      const node2 = createTestNode("2");
+      const node3 = createTestNode("3");
+
+      useNodeStore.setState({ nodes: [node1] });
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      useNodeStore.setState({ nodes: [node1, node2] });
+      useHistoryStore.getState().pushState({ nodes: [node1], edges: [] });
+      await flushMicrotasks();
+
+      useNodeStore.setState({ nodes: [node1, node2, node3] });
+      useHistoryStore.getState().pushState({
+        nodes: [node1, node2],
+        edges: [],
+      });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([node1, node2]);
+
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([node1]);
+
+      useHistoryStore.getState().redo();
+      expect(useNodeStore.getState().nodes).toEqual([node1, node2]);
+
+      useHistoryStore.getState().undo();
+      expect(useNodeStore.getState().nodes).toEqual([node1]);
+
+      useHistoryStore.getState().redo();
+      useHistoryStore.getState().redo();
+      expect(useNodeStore.getState().nodes).toEqual([node1, node2, node3]);
+    });
+  });
+
+  describe("canUndo / canRedo", () => {
+    it("canUndo is false on fresh store", () => {
+      expect(useHistoryStore.getState().canUndo()).toBe(false);
+    });
+
+    it("canUndo is true when current state differs from last past entry", async () => {
+      const node = createTestNode("1");
+      useNodeStore.setState({ nodes: [node] });
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      expect(useHistoryStore.getState().canUndo()).toBe(true);
+    });
+
+    it("canRedo is false on fresh store", () => {
+      expect(useHistoryStore.getState().canRedo()).toBe(false);
+    });
+
+    it("canRedo is true after undo", async () => {
+      const node = createTestNode("1");
+      useNodeStore.setState({ nodes: [node] });
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().undo();
+
+      expect(useHistoryStore.getState().canRedo()).toBe(true);
+    });
+
+    it("canRedo becomes false after redo exhausts future", async () => {
+      const node = createTestNode("1");
+      useNodeStore.setState({ nodes: [node] });
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().undo();
+      useHistoryStore.getState().redo();
+
+      expect(useHistoryStore.getState().canRedo()).toBe(false);
+    });
+  });
+
+  describe("pushState deduplication", () => {
+    it("does not push a state identical to the last past entry", async () => {
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      expect(useHistoryStore.getState().past).toHaveLength(1);
+    });
+
+    it("does not push if state matches current node/edge store state", async () => {
+      const node = createTestNode("1");
+      useNodeStore.setState({ nodes: [node] });
+      useEdgeStore.setState({ edges: [] });
+
+      useHistoryStore.getState().pushState({ nodes: [node], edges: [] });
+      await flushMicrotasks();
+
+      expect(useHistoryStore.getState().past).toHaveLength(1);
+    });
+  });
+
+  describe("initializeHistory", () => {
+    it("resets history with current node/edge store state", async () => {
+      const node = createTestNode("1");
+      const edge = createTestEdge("e1", "1", "2");
+
+      useNodeStore.setState({ nodes: [node] });
+      useEdgeStore.setState({ edges: [edge] });
+
+      useNodeStore.setState({ nodes: [node, createTestNode("2")] });
+      useHistoryStore.getState().pushState({ nodes: [node], edges: [edge] });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().initializeHistory();
+
+      const { past, future } = useHistoryStore.getState();
+      expect(past).toHaveLength(1);
+      expect(past[0].nodes).toEqual(useNodeStore.getState().nodes);
+      expect(past[0].edges).toEqual(useEdgeStore.getState().edges);
+      expect(future).toHaveLength(0);
+    });
+  });
+
+  describe("clear", () => {
+    it("resets to empty initial state", async () => {
+      const node = createTestNode("1");
+      useNodeStore.setState({ nodes: [node] });
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().clear();
+
+      const { past, future } = useHistoryStore.getState();
+      expect(past).toEqual([{ nodes: [], edges: [] }]);
+      expect(future).toEqual([]);
+    });
+  });
+
+  describe("microtask batching", () => {
+    it("only commits the first state when multiple pushState calls happen in the same tick", async () => {
+      const node1 = createTestNode("1");
+      const node2 = createTestNode("2");
+      const node3 = createTestNode("3");
+
+      useNodeStore.setState({ nodes: [node1, node2, node3] });
+
+      useHistoryStore.getState().pushState({ nodes: [node1], edges: [] });
+      useHistoryStore.getState().pushState({ nodes: [node2], edges: [] });
+      useHistoryStore
+        .getState()
+        .pushState({ nodes: [node1, node2], edges: [] });
+      await flushMicrotasks();
+
+      const { past } = useHistoryStore.getState();
+      expect(past).toHaveLength(2);
+      expect(past[1].nodes).toEqual([node1]);
+    });
+
+    it("commits separately when pushState calls are in different ticks", async () => {
+      const node1 = createTestNode("1");
+      const node2 = createTestNode("2");
+
+      useNodeStore.setState({ nodes: [node1, node2] });
+
+      useHistoryStore.getState().pushState({ nodes: [node1], edges: [] });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().pushState({ nodes: [node2], edges: [] });
+      await flushMicrotasks();
+
+      const { past } = useHistoryStore.getState();
+      expect(past).toHaveLength(3);
+      expect(past[1].nodes).toEqual([node1]);
+      expect(past[2].nodes).toEqual([node2]);
+    });
+  });
+
+  describe("edges in undo/redo", () => {
+    it("restores edges on undo and redo", async () => {
+      const edge = createTestEdge("e1", "1", "2");
+      useEdgeStore.setState({ edges: [edge] });
+
+      useHistoryStore.getState().pushState({ nodes: [], edges: [] });
+      await flushMicrotasks();
+
+      useHistoryStore.getState().undo();
+      expect(useEdgeStore.getState().edges).toEqual([]);
+
+      useHistoryStore.getState().redo();
+      expect(useEdgeStore.getState().edges).toEqual([edge]);
+    });
+  });
+
+  describe("pushState clears future", () => {
+    it("clears future when a new state is pushed after undo", async () => {
+      const node1 = createTestNode("1");
+      const node2 = createTestNode("2");
+      const node3 = createTestNode("3");
+
+      // Initialize empty
+      useHistoryStore.getState().initializeHistory();
+
+      // First change: set [node1]
+      useNodeStore.setState({ nodes: [node1] });
+
+      // Second change: set [node1, node2], push pre-change [node1]
+      useNodeStore.setState({ nodes: [node1, node2] });
+      useHistoryStore.getState().pushState({ nodes: [node1], edges: [] });
+      await flushMicrotasks();
+
+      // Undo: back to [node1]
+      useHistoryStore.getState().undo();
+      expect(useHistoryStore.getState().future).toHaveLength(1);
+
+      // New diverging change: add node3 instead of node2
+      useNodeStore.setState({ nodes: [node1, node3] });
+      useHistoryStore.getState().pushState({ nodes: [node1], edges: [] });
+      await flushMicrotasks();
+
+      expect(useHistoryStore.getState().future).toHaveLength(0);
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/nodeStore.test.ts

@@ -0,0 +1,791 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { useNodeStore } from "../stores/nodeStore";
+import { useHistoryStore } from "../stores/historyStore";
+import { useEdgeStore } from "../stores/edgeStore";
+import { BlockUIType } from "../components/types";
+import type { CustomNode } from "../components/FlowEditor/nodes/CustomNode/CustomNode";
+import type { CustomNodeData } from "../components/FlowEditor/nodes/CustomNode/CustomNode";
+import type { NodeExecutionResult } from "@/app/api/__generated__/models/nodeExecutionResult";
+
+function createTestNode(overrides: {
+  id: string;
+  position?: { x: number; y: number };
+  data?: Partial<CustomNodeData>;
+}): CustomNode {
+  const defaults: CustomNodeData = {
+    hardcodedValues: {},
+    title: "Test Block",
+    description: "A test block",
+    inputSchema: {},
+    outputSchema: {},
+    uiType: BlockUIType.STANDARD,
+    block_id: "test-block-id",
+    costs: [],
+    categories: [],
+  };
+
+  return {
+    id: overrides.id,
+    type: "custom",
+    position: overrides.position ?? { x: 0, y: 0 },
+    data: { ...defaults, ...overrides.data },
+  };
+}
+
+function createExecutionResult(
+  overrides: Partial<NodeExecutionResult> = {},
+): NodeExecutionResult {
+  return {
+    node_exec_id: overrides.node_exec_id ?? "exec-1",
+    node_id: overrides.node_id ?? "1",
+    graph_exec_id: overrides.graph_exec_id ?? "graph-exec-1",
+    graph_id: overrides.graph_id ?? "graph-1",
+    graph_version: overrides.graph_version ?? 1,
+    user_id: overrides.user_id ?? "test-user",
+    block_id: overrides.block_id ?? "block-1",
+    status: overrides.status ?? "COMPLETED",
+    input_data: overrides.input_data ?? { input_key: "input_value" },
+    output_data: overrides.output_data ?? { output_key: ["output_value"] },
+    add_time: overrides.add_time ?? new Date("2024-01-01T00:00:00Z"),
+    queue_time: overrides.queue_time ?? new Date("2024-01-01T00:00:00Z"),
+    start_time: overrides.start_time ?? new Date("2024-01-01T00:00:01Z"),
+    end_time: overrides.end_time ?? new Date("2024-01-01T00:00:02Z"),
+  };
+}
+
+function resetStores() {
+  useNodeStore.setState({
+    nodes: [],
+    nodeCounter: 0,
+    nodeAdvancedStates: {},
+    latestNodeInputData: {},
+    latestNodeOutputData: {},
+    accumulatedNodeInputData: {},
+    accumulatedNodeOutputData: {},
+    nodesInResolutionMode: new Set(),
+    brokenEdgeIDs: new Map(),
+    nodeResolutionData: new Map(),
+  });
+  useEdgeStore.setState({ edges: [] });
+  useHistoryStore.setState({ past: [], future: [] });
+}
+
+describe("nodeStore", () => {
+  beforeEach(() => {
+    resetStores();
+    vi.restoreAllMocks();
+  });
+
+  describe("node lifecycle", () => {
+    it("starts with empty nodes", () => {
+      const { nodes } = useNodeStore.getState();
+      expect(nodes).toEqual([]);
+    });
+
+    it("adds a single node with addNode", () => {
+      const node = createTestNode({ id: "1" });
+      useNodeStore.getState().addNode(node);
+
+      const { nodes } = useNodeStore.getState();
+      expect(nodes).toHaveLength(1);
+      expect(nodes[0].id).toBe("1");
+    });
+
+    it("sets nodes with setNodes, replacing existing ones", () => {
+      const node1 = createTestNode({ id: "1" });
+      const node2 = createTestNode({ id: "2" });
+      useNodeStore.getState().addNode(node1);
+
+      useNodeStore.getState().setNodes([node2]);
+
+      const { nodes } = useNodeStore.getState();
+      expect(nodes).toHaveLength(1);
+      expect(nodes[0].id).toBe("2");
+    });
+
+    it("removes nodes via onNodesChange", () => {
+      const node = createTestNode({ id: "1" });
+      useNodeStore.getState().setNodes([node]);
+
+      useNodeStore.getState().onNodesChange([{ type: "remove", id: "1" }]);
+
+      expect(useNodeStore.getState().nodes).toHaveLength(0);
+    });
+
+    it("updates node data with updateNodeData", () => {
+      const node = createTestNode({ id: "1" });
+      useNodeStore.getState().addNode(node);
+
+      useNodeStore.getState().updateNodeData("1", { title: "Updated Title" });
+
+      const updated = useNodeStore.getState().nodes[0];
+      expect(updated.data.title).toBe("Updated Title");
+      expect(updated.data.block_id).toBe("test-block-id");
+    });
+
+    it("updateNodeData does not affect other nodes", () => {
+      const node1 = createTestNode({ id: "1" });
+      const node2 = createTestNode({
+        id: "2",
+        data: { title: "Node 2" },
+      });
+      useNodeStore.getState().setNodes([node1, node2]);
+
+      useNodeStore.getState().updateNodeData("1", { title: "Changed" });
+
+      expect(useNodeStore.getState().nodes[1].data.title).toBe("Node 2");
+    });
+  });
+
+  describe("bulk operations", () => {
+    it("adds multiple nodes with addNodes", () => {
+      const nodes = [
+        createTestNode({ id: "1" }),
+        createTestNode({ id: "2" }),
+        createTestNode({ id: "3" }),
+      ];
+      useNodeStore.getState().addNodes(nodes);
+
+      expect(useNodeStore.getState().nodes).toHaveLength(3);
+    });
+
+    it("removes multiple nodes via onNodesChange", () => {
+      const nodes = [
+        createTestNode({ id: "1" }),
+        createTestNode({ id: "2" }),
+        createTestNode({ id: "3" }),
+      ];
+      useNodeStore.getState().setNodes(nodes);
+
+      useNodeStore.getState().onNodesChange([
+        { type: "remove", id: "1" },
+        { type: "remove", id: "3" },
+      ]);
+
+      const remaining = useNodeStore.getState().nodes;
+      expect(remaining).toHaveLength(1);
+      expect(remaining[0].id).toBe("2");
+    });
+  });
+
+  describe("nodeCounter", () => {
+    it("starts at zero", () => {
+      expect(useNodeStore.getState().nodeCounter).toBe(0);
+    });
+
+    it("increments the counter", () => {
+      useNodeStore.getState().incrementNodeCounter();
+      expect(useNodeStore.getState().nodeCounter).toBe(1);
+
+      useNodeStore.getState().incrementNodeCounter();
+      expect(useNodeStore.getState().nodeCounter).toBe(2);
+    });
+
+    it("sets the counter to a specific value", () => {
+      useNodeStore.getState().setNodeCounter(42);
+      expect(useNodeStore.getState().nodeCounter).toBe(42);
+    });
+  });
+
+  describe("advanced states", () => {
+    it("defaults to false for unknown node IDs", () => {
+      expect(useNodeStore.getState().getShowAdvanced("unknown")).toBe(false);
+    });
+
+    it("toggles advanced state", () => {
+      useNodeStore.getState().toggleAdvanced("node-1");
+      expect(useNodeStore.getState().getShowAdvanced("node-1")).toBe(true);
+
+      useNodeStore.getState().toggleAdvanced("node-1");
+      expect(useNodeStore.getState().getShowAdvanced("node-1")).toBe(false);
+    });
+
+    it("sets advanced state explicitly", () => {
+      useNodeStore.getState().setShowAdvanced("node-1", true);
+      expect(useNodeStore.getState().getShowAdvanced("node-1")).toBe(true);
+
+      useNodeStore.getState().setShowAdvanced("node-1", false);
+      expect(useNodeStore.getState().getShowAdvanced("node-1")).toBe(false);
+    });
+  });
+
+  describe("convertCustomNodeToBackendNode", () => {
+    it("converts a node with minimal data", () => {
+      const node = createTestNode({
+        id: "42",
+        position: { x: 100, y: 200 },
+      });
+
+      const backend = useNodeStore
+        .getState()
+        .convertCustomNodeToBackendNode(node);
+
+      expect(backend.id).toBe("42");
+      expect(backend.block_id).toBe("test-block-id");
+      expect(backend.input_default).toEqual({});
+      expect(backend.metadata).toEqual({ position: { x: 100, y: 200 } });
+    });
+
+    it("includes customized_name when present in metadata", () => {
+      const node = createTestNode({
+        id: "1",
+        data: {
+          metadata: { customized_name: "My Custom Name" },
+        },
+      });
+
+      const backend = useNodeStore
+        .getState()
+        .convertCustomNodeToBackendNode(node);
+
+      expect(backend.metadata).toHaveProperty(
+        "customized_name",
+        "My Custom Name",
+      );
+    });
+
+    it("includes credentials_optional when present in metadata", () => {
+      const node = createTestNode({
+        id: "1",
+        data: {
+          metadata: { credentials_optional: true },
+        },
+      });
+
+      const backend = useNodeStore
+        .getState()
+        .convertCustomNodeToBackendNode(node);
+
+      expect(backend.metadata).toHaveProperty("credentials_optional", true);
+    });
+
+    it("prunes empty values from hardcodedValues", () => {
+      const node = createTestNode({
+        id: "1",
+        data: {
+          hardcodedValues: { filled: "value", empty: "" },
+        },
+      });
+
+      const backend = useNodeStore
+        .getState()
+        .convertCustomNodeToBackendNode(node);
+
+      expect(backend.input_default).toEqual({ filled: "value" });
+      expect(backend.input_default).not.toHaveProperty("empty");
+    });
+  });
+
+  describe("getBackendNodes", () => {
+    it("converts all nodes to backend format", () => {
+      useNodeStore
+        .getState()
+        .setNodes([
+          createTestNode({ id: "1", position: { x: 0, y: 0 } }),
+          createTestNode({ id: "2", position: { x: 100, y: 100 } }),
+        ]);
+
+      const backendNodes = useNodeStore.getState().getBackendNodes();
+
+      expect(backendNodes).toHaveLength(2);
+      expect(backendNodes[0].id).toBe("1");
+      expect(backendNodes[1].id).toBe("2");
+    });
+  });
+
+  describe("node status", () => {
+    it("returns undefined for a node with no status", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+      expect(useNodeStore.getState().getNodeStatus("1")).toBeUndefined();
+    });
+
+    it("updates node status", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore.getState().updateNodeStatus("1", "RUNNING");
+      expect(useNodeStore.getState().getNodeStatus("1")).toBe("RUNNING");
+
+      useNodeStore.getState().updateNodeStatus("1", "COMPLETED");
+      expect(useNodeStore.getState().getNodeStatus("1")).toBe("COMPLETED");
+    });
+
+    it("cleans all node statuses", () => {
+      useNodeStore
+        .getState()
+        .setNodes([createTestNode({ id: "1" }), createTestNode({ id: "2" })]);
+      useNodeStore.getState().updateNodeStatus("1", "RUNNING");
+      useNodeStore.getState().updateNodeStatus("2", "COMPLETED");
+
+      useNodeStore.getState().cleanNodesStatuses();
+
+      expect(useNodeStore.getState().getNodeStatus("1")).toBeUndefined();
+      expect(useNodeStore.getState().getNodeStatus("2")).toBeUndefined();
+    });
+
+    it("updating status for non-existent node does not crash", () => {
+      useNodeStore.getState().updateNodeStatus("nonexistent", "RUNNING");
+      expect(
+        useNodeStore.getState().getNodeStatus("nonexistent"),
+      ).toBeUndefined();
+    });
+  });
+
+  describe("execution result tracking", () => {
+    it("returns empty array for node with no results", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+      expect(useNodeStore.getState().getNodeExecutionResults("1")).toEqual([]);
+    });
+
+    it("tracks a single execution result", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+      const result = createExecutionResult({ node_id: "1" });
+
+      useNodeStore.getState().updateNodeExecutionResult("1", result);
+
+      const results = useNodeStore.getState().getNodeExecutionResults("1");
+      expect(results).toHaveLength(1);
+      expect(results[0].node_exec_id).toBe("exec-1");
+    });
+
+    it("accumulates multiple execution results", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-1",
+          input_data: { key: "val1" },
+          output_data: { key: ["out1"] },
+        }),
+      );
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-2",
+          input_data: { key: "val2" },
+          output_data: { key: ["out2"] },
+        }),
+      );
+
+      expect(useNodeStore.getState().getNodeExecutionResults("1")).toHaveLength(
+        2,
+      );
+    });
+
+    it("updates latest input/output data", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-1",
+          input_data: { key: "first" },
+          output_data: { key: ["first_out"] },
+        }),
+      );
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-2",
+          input_data: { key: "second" },
+          output_data: { key: ["second_out"] },
+        }),
+      );
+
+      expect(useNodeStore.getState().getLatestNodeInputData("1")).toEqual({
+        key: "second",
+      });
+      expect(useNodeStore.getState().getLatestNodeOutputData("1")).toEqual({
+        key: ["second_out"],
+      });
+    });
+
+    it("accumulates input/output data across results", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-1",
+          input_data: { key: "val1" },
+          output_data: { key: ["out1"] },
+        }),
+      );
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-2",
+          input_data: { key: "val2" },
+          output_data: { key: ["out2"] },
+        }),
+      );
+
+      const accInput = useNodeStore.getState().getAccumulatedNodeInputData("1");
+      expect(accInput.key).toEqual(["val1", "val2"]);
+
+      const accOutput = useNodeStore
+        .getState()
+        .getAccumulatedNodeOutputData("1");
+      expect(accOutput.key).toEqual(["out1", "out2"]);
+    });
+
+    it("deduplicates execution results by node_exec_id", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-1",
+          input_data: { key: "original" },
+          output_data: { key: ["original_out"] },
+        }),
+      );
+      useNodeStore.getState().updateNodeExecutionResult(
+        "1",
+        createExecutionResult({
+          node_exec_id: "exec-1",
+          input_data: { key: "updated" },
+          output_data: { key: ["updated_out"] },
+        }),
+      );
+
+      const results = useNodeStore.getState().getNodeExecutionResults("1");
+      expect(results).toHaveLength(1);
+      expect(results[0].input_data).toEqual({ key: "updated" });
+    });
+
+    it("returns the latest execution result", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore
+        .getState()
+        .updateNodeExecutionResult(
+          "1",
+          createExecutionResult({ node_exec_id: "exec-1" }),
+        );
+      useNodeStore
+        .getState()
+        .updateNodeExecutionResult(
+          "1",
+          createExecutionResult({ node_exec_id: "exec-2" }),
+        );
+
+      const latest = useNodeStore.getState().getLatestNodeExecutionResult("1");
+      expect(latest?.node_exec_id).toBe("exec-2");
+    });
+
+    it("returns undefined for latest result on unknown node", () => {
+      expect(
+        useNodeStore.getState().getLatestNodeExecutionResult("unknown"),
+      ).toBeUndefined();
+    });
+
+    it("clears all execution results", () => {
+      useNodeStore
+        .getState()
+        .setNodes([createTestNode({ id: "1" }), createTestNode({ id: "2" })]);
+      useNodeStore
+        .getState()
+        .updateNodeExecutionResult(
+          "1",
+          createExecutionResult({ node_exec_id: "exec-1" }),
+        );
+      useNodeStore
+        .getState()
+        .updateNodeExecutionResult(
+          "2",
+          createExecutionResult({ node_exec_id: "exec-2" }),
+        );
+
+      useNodeStore.getState().clearAllNodeExecutionResults();
+
+      expect(useNodeStore.getState().getNodeExecutionResults("1")).toEqual([]);
+      expect(useNodeStore.getState().getNodeExecutionResults("2")).toEqual([]);
+      expect(
+        useNodeStore.getState().getLatestNodeInputData("1"),
+      ).toBeUndefined();
+      expect(
+        useNodeStore.getState().getLatestNodeOutputData("1"),
+      ).toBeUndefined();
+      expect(useNodeStore.getState().getAccumulatedNodeInputData("1")).toEqual(
+        {},
+      );
+      expect(useNodeStore.getState().getAccumulatedNodeOutputData("1")).toEqual(
+        {},
+      );
+    });
+
+    it("returns empty object for accumulated data on unknown node", () => {
+      expect(
+        useNodeStore.getState().getAccumulatedNodeInputData("unknown"),
+      ).toEqual({});
+      expect(
+        useNodeStore.getState().getAccumulatedNodeOutputData("unknown"),
+      ).toEqual({});
+    });
+  });
+
+  describe("getNodeBlockUIType", () => {
+    it("returns the node UI type", () => {
+      useNodeStore.getState().addNode(
+        createTestNode({
+          id: "1",
+          data: {
+            uiType: BlockUIType.INPUT,
+          },
+        }),
+      );
+
+      expect(useNodeStore.getState().getNodeBlockUIType("1")).toBe(
+        BlockUIType.INPUT,
+      );
+    });
+
+    it("defaults to STANDARD for unknown node IDs", () => {
+      expect(useNodeStore.getState().getNodeBlockUIType("unknown")).toBe(
+        BlockUIType.STANDARD,
+      );
+    });
+  });
+
+  describe("hasWebhookNodes", () => {
+    it("returns false when there are no webhook nodes", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+      expect(useNodeStore.getState().hasWebhookNodes()).toBe(false);
+    });
+
+    it("returns true when a WEBHOOK node exists", () => {
+      useNodeStore.getState().addNode(
+        createTestNode({
+          id: "1",
+          data: {
+            uiType: BlockUIType.WEBHOOK,
+          },
+        }),
+      );
+      expect(useNodeStore.getState().hasWebhookNodes()).toBe(true);
+    });
+
+    it("returns true when a WEBHOOK_MANUAL node exists", () => {
+      useNodeStore.getState().addNode(
+        createTestNode({
+          id: "1",
+          data: {
+            uiType: BlockUIType.WEBHOOK_MANUAL,
+          },
+        }),
+      );
+      expect(useNodeStore.getState().hasWebhookNodes()).toBe(true);
+    });
+  });
+
+  describe("node errors", () => {
+    it("returns undefined for a node with no errors", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+      expect(useNodeStore.getState().getNodeErrors("1")).toBeUndefined();
+    });
+
+    it("sets and retrieves node errors", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      const errors = { field1: "required", field2: "invalid" };
+      useNodeStore.getState().updateNodeErrors("1", errors);
+
+      expect(useNodeStore.getState().getNodeErrors("1")).toEqual(errors);
+    });
+
+    it("clears errors for a specific node", () => {
+      useNodeStore
+        .getState()
+        .setNodes([createTestNode({ id: "1" }), createTestNode({ id: "2" })]);
+      useNodeStore.getState().updateNodeErrors("1", { f: "err" });
+      useNodeStore.getState().updateNodeErrors("2", { g: "err2" });
+
+      useNodeStore.getState().clearNodeErrors("1");
+
+      expect(useNodeStore.getState().getNodeErrors("1")).toBeUndefined();
+      expect(useNodeStore.getState().getNodeErrors("2")).toEqual({ g: "err2" });
+    });
+
+    it("clears all node errors", () => {
+      useNodeStore
+        .getState()
+        .setNodes([createTestNode({ id: "1" }), createTestNode({ id: "2" })]);
+      useNodeStore.getState().updateNodeErrors("1", { a: "err1" });
+      useNodeStore.getState().updateNodeErrors("2", { b: "err2" });
+
+      useNodeStore.getState().clearAllNodeErrors();
+
+      expect(useNodeStore.getState().getNodeErrors("1")).toBeUndefined();
+      expect(useNodeStore.getState().getNodeErrors("2")).toBeUndefined();
+    });
+
+    it("sets errors by backend ID matching node id", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "backend-1" }));
+
+      useNodeStore
+        .getState()
+        .setNodeErrorsForBackendId("backend-1", { x: "error" });
+
+      expect(useNodeStore.getState().getNodeErrors("backend-1")).toEqual({
+        x: "error",
+      });
+    });
+  });
+
+  describe("getHardCodedValues", () => {
+    it("returns hardcoded values for a node", () => {
+      useNodeStore.getState().addNode(
+        createTestNode({
+          id: "1",
+          data: {
+            hardcodedValues: { key: "value" },
+          },
+        }),
+      );
+
+      expect(useNodeStore.getState().getHardCodedValues("1")).toEqual({
+        key: "value",
+      });
+    });
+
+    it("returns empty object for unknown node", () => {
+      expect(useNodeStore.getState().getHardCodedValues("unknown")).toEqual({});
+    });
+  });
+
+  describe("credentials optional", () => {
+    it("sets credentials_optional in node metadata", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore.getState().setCredentialsOptional("1", true);
+
+      const node = useNodeStore.getState().nodes[0];
+      expect(node.data.metadata?.credentials_optional).toBe(true);
+    });
+  });
+
+  describe("resolution mode", () => {
+    it("defaults to not in resolution mode", () => {
+      expect(useNodeStore.getState().isNodeInResolutionMode("1")).toBe(false);
+    });
+
+    it("enters and exits resolution mode", () => {
+      useNodeStore.getState().setNodeResolutionMode("1", true);
+      expect(useNodeStore.getState().isNodeInResolutionMode("1")).toBe(true);
+
+      useNodeStore.getState().setNodeResolutionMode("1", false);
+      expect(useNodeStore.getState().isNodeInResolutionMode("1")).toBe(false);
+    });
+
+    it("tracks broken edge IDs", () => {
+      useNodeStore.getState().setBrokenEdgeIDs("node-1", ["edge-1", "edge-2"]);
+
+      expect(useNodeStore.getState().isEdgeBroken("edge-1")).toBe(true);
+      expect(useNodeStore.getState().isEdgeBroken("edge-2")).toBe(true);
+      expect(useNodeStore.getState().isEdgeBroken("edge-3")).toBe(false);
+    });
+
+    it("removes individual broken edge IDs", () => {
+      useNodeStore.getState().setBrokenEdgeIDs("node-1", ["edge-1", "edge-2"]);
+      useNodeStore.getState().removeBrokenEdgeID("node-1", "edge-1");
+
+      expect(useNodeStore.getState().isEdgeBroken("edge-1")).toBe(false);
+      expect(useNodeStore.getState().isEdgeBroken("edge-2")).toBe(true);
+    });
+
+    it("clears all resolution state", () => {
+      useNodeStore.getState().setNodeResolutionMode("1", true);
+      useNodeStore.getState().setBrokenEdgeIDs("1", ["edge-1"]);
+
+      useNodeStore.getState().clearResolutionState();
+
+      expect(useNodeStore.getState().isNodeInResolutionMode("1")).toBe(false);
+      expect(useNodeStore.getState().isEdgeBroken("edge-1")).toBe(false);
+    });
+
+    it("cleans up broken edges when exiting resolution mode", () => {
+      useNodeStore.getState().setNodeResolutionMode("1", true);
+      useNodeStore.getState().setBrokenEdgeIDs("1", ["edge-1"]);
+
+      useNodeStore.getState().setNodeResolutionMode("1", false);
+
+      expect(useNodeStore.getState().isEdgeBroken("edge-1")).toBe(false);
+    });
+  });
+
+  describe("edge cases", () => {
+    it("handles updating data on a non-existent node gracefully", () => {
+      useNodeStore
+        .getState()
+        .updateNodeData("nonexistent", { title: "New Title" });
+
+      expect(useNodeStore.getState().nodes).toHaveLength(0);
+    });
+
+    it("handles removing a non-existent node gracefully", () => {
+      useNodeStore.getState().addNode(createTestNode({ id: "1" }));
+
+      useNodeStore
+        .getState()
+        .onNodesChange([{ type: "remove", id: "nonexistent" }]);
+
+      expect(useNodeStore.getState().nodes).toHaveLength(1);
+    });
+
+    it("handles duplicate node IDs in addNodes", () => {
+      useNodeStore.getState().addNodes([
+        createTestNode({
+          id: "1",
+          data: { title: "First" },
+        }),
+        createTestNode({
+          id: "1",
+          data: { title: "Second" },
+        }),
+      ]);
+
+      const { nodes } = useNodeStore.getState();
+      expect(nodes).toHaveLength(2);
+      expect(nodes[0].data.title).toBe("First");
+      expect(nodes[1].data.title).toBe("Second");
+    });
+
+    it("updating node status mid-execution preserves other data", () => {
+      useNodeStore.getState().addNode(
+        createTestNode({
+          id: "1",
+          data: {
+            title: "My Node",
+            hardcodedValues: { key: "val" },
+          },
+        }),
+      );
+
+      useNodeStore.getState().updateNodeStatus("1", "RUNNING");
+
+      const node = useNodeStore.getState().nodes[0];
+      expect(node.data.status).toBe("RUNNING");
+      expect(node.data.title).toBe("My Node");
+      expect(node.data.hardcodedValues).toEqual({ key: "val" });
+    });
+
+    it("execution result for non-existent node does not add it", () => {
+      useNodeStore
+        .getState()
+        .updateNodeExecutionResult(
+          "nonexistent",
+          createExecutionResult({ node_exec_id: "exec-1" }),
+        );
+
+      expect(useNodeStore.getState().nodes).toHaveLength(0);
+      expect(
+        useNodeStore.getState().getNodeExecutionResults("nonexistent"),
+      ).toEqual([]);
+    });
+
+    it("getBackendNodes returns empty array when no nodes exist", () => {
+      expect(useNodeStore.getState().getBackendNodes()).toEqual([]);
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/useCopyPaste.test.ts

@@ -0,0 +1,567 @@
+import { describe, it, expect, beforeEach, vi } from "vitest";
+import { renderHook, act } from "@testing-library/react";
+import { CustomNode } from "../components/FlowEditor/nodes/CustomNode/CustomNode";
+import { BlockUIType } from "../components/types";
+
+// ---- Mocks ----
+
+const mockGetViewport = vi.fn(() => ({ x: 0, y: 0, zoom: 1 }));
+
+vi.mock("@xyflow/react", async () => {
+  const actual = await vi.importActual("@xyflow/react");
+  return {
+    ...actual,
+    useReactFlow: vi.fn(() => ({
+      getViewport: mockGetViewport,
+    })),
+  };
+});
+
+const mockToast = vi.fn();
+
+vi.mock("@/components/molecules/Toast/use-toast", () => ({
+  useToast: vi.fn(() => ({ toast: mockToast })),
+}));
+
+let uuidCounter = 0;
+vi.mock("uuid", () => ({
+  v4: vi.fn(() => `new-uuid-${++uuidCounter}`),
+}));
+
+// Mock navigator.clipboard
+const mockWriteText = vi.fn(() => Promise.resolve());
+const mockReadText = vi.fn(() => Promise.resolve(""));
+
+Object.defineProperty(navigator, "clipboard", {
+  value: {
+    writeText: mockWriteText,
+    readText: mockReadText,
+  },
+  writable: true,
+  configurable: true,
+});
+
+// Mock window.innerWidth / innerHeight for viewport centering calculations
+Object.defineProperty(window, "innerWidth", { value: 1000, writable: true });
+Object.defineProperty(window, "innerHeight", { value: 800, writable: true });
+
+import { useCopyPaste } from "../components/FlowEditor/Flow/useCopyPaste";
+import { useNodeStore } from "../stores/nodeStore";
+import { useEdgeStore } from "../stores/edgeStore";
+import { useHistoryStore } from "../stores/historyStore";
+import { CustomEdge } from "../components/FlowEditor/edges/CustomEdge";
+
+const CLIPBOARD_PREFIX = "autogpt-flow-data:";
+
+function createTestNode(
+  id: string,
+  overrides: Partial<CustomNode> = {},
+): CustomNode {
+  return {
+    id,
+    type: "custom",
+    position: overrides.position ?? { x: 100, y: 200 },
+    selected: overrides.selected,
+    data: {
+      hardcodedValues: {},
+      title: `Node ${id}`,
+      description: "test node",
+      inputSchema: {},
+      outputSchema: {},
+      uiType: BlockUIType.STANDARD,
+      block_id: `block-${id}`,
+      costs: [],
+      categories: [],
+      ...overrides.data,
+    },
+  } as CustomNode;
+}
+
+function createTestEdge(
+  id: string,
+  source: string,
+  target: string,
+  sourceHandle = "out",
+  targetHandle = "in",
+): CustomEdge {
+  return {
+    id,
+    source,
+    target,
+    sourceHandle,
+    targetHandle,
+  } as CustomEdge;
+}
+
+function makeCopyEvent(): KeyboardEvent {
+  return new KeyboardEvent("keydown", {
+    key: "c",
+    ctrlKey: true,
+    bubbles: true,
+  });
+}
+
+function makePasteEvent(): KeyboardEvent {
+  return new KeyboardEvent("keydown", {
+    key: "v",
+    ctrlKey: true,
+    bubbles: true,
+  });
+}
+
+function clipboardPayload(nodes: CustomNode[], edges: CustomEdge[]): string {
+  return `${CLIPBOARD_PREFIX}${JSON.stringify({ nodes, edges })}`;
+}
+
+describe("useCopyPaste", () => {
+  beforeEach(() => {
+    useNodeStore.setState({ nodes: [], nodeCounter: 0 });
+    useEdgeStore.setState({ edges: [] });
+    useHistoryStore.getState().clear();
+    mockWriteText.mockClear();
+    mockReadText.mockClear();
+    mockToast.mockClear();
+    mockGetViewport.mockReturnValue({ x: 0, y: 0, zoom: 1 });
+    uuidCounter = 0;
+
+    // Ensure no input element is focused
+    if (document.activeElement && document.activeElement !== document.body) {
+      (document.activeElement as HTMLElement).blur();
+    }
+  });
+
+  describe("copy (Ctrl+C)", () => {
+    it("copies a single selected node to clipboard with prefix", async () => {
+      const node = createTestNode("1", { selected: true });
+      useNodeStore.setState({ nodes: [node] });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makeCopyEvent());
+      });
+
+      await vi.waitFor(() => {
+        expect(mockWriteText).toHaveBeenCalledTimes(1);
+      });
+
+      const written = (mockWriteText.mock.calls as string[][])[0][0];
+      expect(written.startsWith(CLIPBOARD_PREFIX)).toBe(true);
+
+      const parsed = JSON.parse(written.slice(CLIPBOARD_PREFIX.length));
+      expect(parsed.nodes).toHaveLength(1);
+      expect(parsed.nodes[0].id).toBe("1");
+      expect(parsed.edges).toHaveLength(0);
+    });
+
+    it("shows a success toast after copying", async () => {
+      const node = createTestNode("1", { selected: true });
+      useNodeStore.setState({ nodes: [node] });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makeCopyEvent());
+      });
+
+      await vi.waitFor(() => {
+        expect(mockToast).toHaveBeenCalledWith(
+          expect.objectContaining({
+            title: "Copied successfully",
+          }),
+        );
+      });
+    });
+
+    it("copies multiple connected nodes and preserves internal edges", async () => {
+      const nodeA = createTestNode("a", { selected: true });
+      const nodeB = createTestNode("b", { selected: true });
+      const nodeC = createTestNode("c", { selected: false });
+      useNodeStore.setState({ nodes: [nodeA, nodeB, nodeC] });
+
+      useEdgeStore.setState({
+        edges: [
+          createTestEdge("e-ab", "a", "b"),
+          createTestEdge("e-bc", "b", "c"),
+        ],
+      });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makeCopyEvent());
+      });
+
+      await vi.waitFor(() => {
+        expect(mockWriteText).toHaveBeenCalledTimes(1);
+      });
+
+      const parsed = JSON.parse(
+        (mockWriteText.mock.calls as string[][])[0][0].slice(
+          CLIPBOARD_PREFIX.length,
+        ),
+      );
+      expect(parsed.nodes).toHaveLength(2);
+      expect(parsed.edges).toHaveLength(1);
+      expect(parsed.edges[0].id).toBe("e-ab");
+    });
+
+    it("drops external edges where one endpoint is not selected", async () => {
+      const nodeA = createTestNode("a", { selected: true });
+      const nodeB = createTestNode("b", { selected: false });
+      useNodeStore.setState({ nodes: [nodeA, nodeB] });
+
+      useEdgeStore.setState({
+        edges: [createTestEdge("e-ab", "a", "b")],
+      });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makeCopyEvent());
+      });
+
+      await vi.waitFor(() => {
+        expect(mockWriteText).toHaveBeenCalledTimes(1);
+      });
+
+      const parsed = JSON.parse(
+        (mockWriteText.mock.calls as string[][])[0][0].slice(
+          CLIPBOARD_PREFIX.length,
+        ),
+      );
+      expect(parsed.nodes).toHaveLength(1);
+      expect(parsed.edges).toHaveLength(0);
+    });
+
+    it("copies nothing when no nodes are selected", async () => {
+      const node = createTestNode("1", { selected: false });
+      useNodeStore.setState({ nodes: [node] });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makeCopyEvent());
+      });
+
+      await vi.waitFor(() => {
+        expect(mockWriteText).toHaveBeenCalledTimes(1);
+      });
+
+      const parsed = JSON.parse(
+        (mockWriteText.mock.calls as string[][])[0][0].slice(
+          CLIPBOARD_PREFIX.length,
+        ),
+      );
+      expect(parsed.nodes).toHaveLength(0);
+      expect(parsed.edges).toHaveLength(0);
+    });
+  });
+
+  describe("paste (Ctrl+V)", () => {
+    it("creates new nodes with new UUIDs", async () => {
+      const node = createTestNode("orig", {
+        selected: true,
+        position: { x: 100, y: 200 },
+      });
+
+      mockReadText.mockResolvedValue(clipboardPayload([node], []));
+
+      useNodeStore.setState({ nodes: [], nodeCounter: 0 });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makePasteEvent());
+      });
+
+      await vi.waitFor(() => {
+        const { nodes } = useNodeStore.getState();
+        expect(nodes).toHaveLength(1);
+      });
+
+      const { nodes } = useNodeStore.getState();
+      expect(nodes[0].id).toBe("new-uuid-1");
+      expect(nodes[0].id).not.toBe("orig");
+    });
+
+    it("centers pasted nodes in the current viewport", async () => {
+      // Viewport at origin, zoom 1 => center = (500, 400)
+      mockGetViewport.mockReturnValue({ x: 0, y: 0, zoom: 1 });
+
+      const node = createTestNode("orig", {
+        selected: true,
+        position: { x: 100, y: 100 },
+      });
+
+      mockReadText.mockResolvedValue(clipboardPayload([node], []));
+
+      useNodeStore.setState({ nodes: [], nodeCounter: 0 });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makePasteEvent());
+      });
+
+      await vi.waitFor(() => {
+        const { nodes } = useNodeStore.getState();
+        expect(nodes).toHaveLength(1);
+      });
+
+      const { nodes } = useNodeStore.getState();
+      // Single node: center of bounds = (100, 100)
+      // Viewport center = (500, 400)
+      // Offset = (400, 300)
+      // New position = (100 + 400, 100 + 300) = (500, 400)
+      expect(nodes[0].position).toEqual({ x: 500, y: 400 });
+    });
+
+    it("deselects existing nodes and selects pasted nodes", async () => {
+      const existingNode = createTestNode("existing", {
+        selected: true,
+        position: { x: 0, y: 0 },
+      });
+
+      useNodeStore.setState({ nodes: [existingNode], nodeCounter: 0 });
+
+      const nodeToPaste = createTestNode("paste-me", {
+        selected: false,
+        position: { x: 100, y: 100 },
+      });
+
+      mockReadText.mockResolvedValue(clipboardPayload([nodeToPaste], []));
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makePasteEvent());
+      });
+
+      await vi.waitFor(() => {
+        const { nodes } = useNodeStore.getState();
+        expect(nodes).toHaveLength(2);
+      });
+
+      const { nodes } = useNodeStore.getState();
+      const originalNode = nodes.find((n) => n.id === "existing");
+      const pastedNode = nodes.find((n) => n.id !== "existing");
+
+      expect(originalNode!.selected).toBe(false);
+      expect(pastedNode!.selected).toBe(true);
+    });
+
+    it("remaps edge source/target IDs to newly created node IDs", async () => {
+      const nodeA = createTestNode("a", {
+        selected: true,
+        position: { x: 0, y: 0 },
+      });
+      const nodeB = createTestNode("b", {
+        selected: true,
+        position: { x: 200, y: 0 },
+      });
+      const edge = createTestEdge("e-ab", "a", "b", "output", "input");
+
+      mockReadText.mockResolvedValue(clipboardPayload([nodeA, nodeB], [edge]));
+
+      useNodeStore.setState({ nodes: [], nodeCounter: 0 });
+      useEdgeStore.setState({ edges: [] });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makePasteEvent());
+      });
+
+      await vi.waitFor(() => {
+        const { nodes } = useNodeStore.getState();
+        expect(nodes).toHaveLength(2);
+      });
+
+      // Wait for edges to be added too
+      await vi.waitFor(() => {
+        const { edges } = useEdgeStore.getState();
+        expect(edges).toHaveLength(1);
+      });
+
+      const { edges } = useEdgeStore.getState();
+      const newEdge = edges[0];
+
+      // Edge source/target should be remapped to new UUIDs, not "a"/"b"
+      expect(newEdge.source).not.toBe("a");
+      expect(newEdge.target).not.toBe("b");
+      expect(newEdge.source).toBe("new-uuid-1");
+      expect(newEdge.target).toBe("new-uuid-2");
+      expect(newEdge.sourceHandle).toBe("output");
+      expect(newEdge.targetHandle).toBe("input");
+    });
+
+    it("does nothing when clipboard does not have the expected prefix", async () => {
+      mockReadText.mockResolvedValue("some random text");
+
+      const existingNode = createTestNode("1", { position: { x: 0, y: 0 } });
+      useNodeStore.setState({ nodes: [existingNode], nodeCounter: 0 });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makePasteEvent());
+      });
+
+      // Give async operations time to settle
+      await vi.waitFor(() => {
+        expect(mockReadText).toHaveBeenCalled();
+      });
+
+      // Ensure no state changes happen after clipboard read
+      await vi.waitFor(() => {
+        const { nodes } = useNodeStore.getState();
+        expect(nodes).toHaveLength(1);
+        expect(nodes[0].id).toBe("1");
+      });
+    });
+
+    it("does nothing when clipboard is empty", async () => {
+      mockReadText.mockResolvedValue("");
+
+      const existingNode = createTestNode("1", { position: { x: 0, y: 0 } });
+      useNodeStore.setState({ nodes: [existingNode], nodeCounter: 0 });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makePasteEvent());
+      });
+
+      await vi.waitFor(() => {
+        expect(mockReadText).toHaveBeenCalled();
+      });
+
+      // Ensure no state changes happen after clipboard read
+      await vi.waitFor(() => {
+        const { nodes } = useNodeStore.getState();
+        expect(nodes).toHaveLength(1);
+        expect(nodes[0].id).toBe("1");
+      });
+    });
+  });
+
+  describe("input field focus guard", () => {
+    it("ignores Ctrl+C when an input element is focused", async () => {
+      const node = createTestNode("1", { selected: true });
+      useNodeStore.setState({ nodes: [node] });
+
+      const input = document.createElement("input");
+      document.body.appendChild(input);
+      input.focus();
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makeCopyEvent());
+      });
+
+      // Clipboard write should NOT be called
+      expect(mockWriteText).not.toHaveBeenCalled();
+
+      document.body.removeChild(input);
+    });
+
+    it("ignores Ctrl+V when a textarea element is focused", async () => {
+      mockReadText.mockResolvedValue(
+        clipboardPayload(
+          [createTestNode("a", { position: { x: 0, y: 0 } })],
+          [],
+        ),
+      );
+
+      useNodeStore.setState({ nodes: [], nodeCounter: 0 });
+
+      const textarea = document.createElement("textarea");
+      document.body.appendChild(textarea);
+      textarea.focus();
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makePasteEvent());
+      });
+
+      expect(mockReadText).not.toHaveBeenCalled();
+
+      const { nodes } = useNodeStore.getState();
+      expect(nodes).toHaveLength(0);
+
+      document.body.removeChild(textarea);
+    });
+
+    it("ignores keypresses when a contenteditable element is focused", async () => {
+      const node = createTestNode("1", { selected: true });
+      useNodeStore.setState({ nodes: [node] });
+
+      const div = document.createElement("div");
+      div.setAttribute("contenteditable", "true");
+      document.body.appendChild(div);
+      div.focus();
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      act(() => {
+        result.current(makeCopyEvent());
+      });
+
+      expect(mockWriteText).not.toHaveBeenCalled();
+
+      document.body.removeChild(div);
+    });
+  });
+
+  describe("meta key support (macOS)", () => {
+    it("handles Cmd+C (metaKey) the same as Ctrl+C", async () => {
+      const node = createTestNode("1", { selected: true });
+      useNodeStore.setState({ nodes: [node] });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      const metaCopyEvent = new KeyboardEvent("keydown", {
+        key: "c",
+        metaKey: true,
+        bubbles: true,
+      });
+
+      act(() => {
+        result.current(metaCopyEvent);
+      });
+
+      await vi.waitFor(() => {
+        expect(mockWriteText).toHaveBeenCalledTimes(1);
+      });
+    });
+
+    it("handles Cmd+V (metaKey) the same as Ctrl+V", async () => {
+      const node = createTestNode("orig", {
+        selected: true,
+        position: { x: 0, y: 0 },
+      });
+      mockReadText.mockResolvedValue(clipboardPayload([node], []));
+      useNodeStore.setState({ nodes: [], nodeCounter: 0 });
+
+      const { result } = renderHook(() => useCopyPaste());
+
+      const metaPasteEvent = new KeyboardEvent("keydown", {
+        key: "v",
+        metaKey: true,
+        bubbles: true,
+      });
+
+      act(() => {
+        result.current(metaPasteEvent);
+      });
+
+      await vi.waitFor(() => {
+        const { nodes } = useNodeStore.getState();
+        expect(nodes).toHaveLength(1);
+      });
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/build/__tests__/useFlow.test.ts

@@ -0,0 +1,134 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { renderHook, act } from "@testing-library/react";
+
+const mockScreenToFlowPosition = vi.fn((pos: { x: number; y: number }) => pos);
+const mockFitView = vi.fn();
+
+vi.mock("@xyflow/react", async () => {
+  const actual = await vi.importActual("@xyflow/react");
+  return {
+    ...actual,
+    useReactFlow: () => ({
+      screenToFlowPosition: mockScreenToFlowPosition,
+      fitView: mockFitView,
+    }),
+  };
+});
+
+const mockSetQueryStates = vi.fn();
+let mockQueryStateValues: {
+  flowID: string | null;
+  flowVersion: number | null;
+  flowExecutionID: string | null;
+} = {
+  flowID: null,
+  flowVersion: null,
+  flowExecutionID: null,
+};
+
+vi.mock("nuqs", () => ({
+  parseAsString: {},
+  parseAsInteger: {},
+  useQueryStates: vi.fn(() => [mockQueryStateValues, mockSetQueryStates]),
+}));
+
+let mockGraphLoading = false;
+let mockBlocksLoading = false;
+
+vi.mock("@/app/api/__generated__/endpoints/graphs/graphs", () => ({
+  useGetV1GetSpecificGraph: vi.fn(() => ({
+    data: undefined,
+    isLoading: mockGraphLoading,
+  })),
+  useGetV1GetExecutionDetails: vi.fn(() => ({
+    data: undefined,
+  })),
+  useGetV1ListUserGraphs: vi.fn(() => ({
+    data: undefined,
+  })),
+}));
+
+vi.mock("@/app/api/__generated__/endpoints/default/default", () => ({
+  useGetV2GetSpecificBlocks: vi.fn(() => ({
+    data: undefined,
+    isLoading: mockBlocksLoading,
+  })),
+}));
+
+vi.mock("@/app/api/helpers", () => ({
+  okData: (res: { data: unknown }) => res?.data,
+}));
+
+vi.mock("../components/helper", () => ({
+  convertNodesPlusBlockInfoIntoCustomNodes: vi.fn(),
+}));
+
+describe("useFlow", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.useFakeTimers({ shouldAdvanceTime: true });
+    mockGraphLoading = false;
+    mockBlocksLoading = false;
+    mockQueryStateValues = {
+      flowID: null,
+      flowVersion: null,
+      flowExecutionID: null,
+    };
+  });
+
+  afterEach(() => {
+    vi.useRealTimers();
+  });
+
+  describe("loading states", () => {
+    it("returns isFlowContentLoading true when graph is loading", async () => {
+      mockGraphLoading = true;
+      mockQueryStateValues = {
+        flowID: "test-flow",
+        flowVersion: 1,
+        flowExecutionID: null,
+      };
+
+      const { useFlow } = await import("../components/FlowEditor/Flow/useFlow");
+      const { result } = renderHook(() => useFlow());
+
+      expect(result.current.isFlowContentLoading).toBe(true);
+    });
+
+    it("returns isFlowContentLoading true when blocks are loading", async () => {
+      mockBlocksLoading = true;
+      mockQueryStateValues = {
+        flowID: "test-flow",
+        flowVersion: 1,
+        flowExecutionID: null,
+      };
+
+      const { useFlow } = await import("../components/FlowEditor/Flow/useFlow");
+      const { result } = renderHook(() => useFlow());
+
+      expect(result.current.isFlowContentLoading).toBe(true);
+    });
+
+    it("returns isFlowContentLoading false when neither is loading", async () => {
+      const { useFlow } = await import("../components/FlowEditor/Flow/useFlow");
+      const { result } = renderHook(() => useFlow());
+
+      expect(result.current.isFlowContentLoading).toBe(false);
+    });
+  });
+
+  describe("initial load completion", () => {
+    it("marks initial load complete for new flows without flowID", async () => {
+      const { useFlow } = await import("../components/FlowEditor/Flow/useFlow");
+      const { result } = renderHook(() => useFlow());
+
+      expect(result.current.isInitialLoadComplete).toBe(false);
+
+      await act(async () => {
+        vi.advanceTimersByTime(300);
+      });
+
+      expect(result.current.isInitialLoadComplete).toBe(true);
+    });
+  });
+});

autogpt_platform/frontend/src/app/(platform)/copilot/components/ChatInput/useChatInput.ts

@@ -1,3 +1,4 @@
+import { useCopilotUIStore } from "@/app/(platform)/copilot/store";
 import { ChangeEvent, FormEvent, useEffect, useState } from "react";
 
 interface Args {
@@ -16,6 +17,16 @@ export function useChatInput({
 }: Args) {
   const [value, setValue] = useState("");
   const [isSending, setIsSending] = useState(false);
+  const { initialPrompt, setInitialPrompt } = useCopilotUIStore();
+
+  useEffect(
+    function consumeInitialPrompt() {
+      if (!initialPrompt) return;
+      setValue((prev) => (prev.length === 0 ? initialPrompt : prev));
+      setInitialPrompt(null);
+    },
+    [initialPrompt, setInitialPrompt],
+  );
 
   useEffect(
     function focusOnMount() {

autogpt_platform/frontend/src/app/(platform)/copilot/store.ts

@@ -7,6 +7,10 @@ export interface DeleteTarget {
 }
 
 interface CopilotUIState {
+  /** Prompt extracted from URL hash (e.g. /copilot#prompt=...) for input prefill. */
+  initialPrompt: string | null;
+  setInitialPrompt: (prompt: string | null) => void;
+
   sessionToDelete: DeleteTarget | null;
   setSessionToDelete: (target: DeleteTarget | null) => void;
 
@@ -31,6 +35,9 @@ interface CopilotUIState {
 }
 
 export const useCopilotUIStore = create<CopilotUIState>((set) => ({
+  initialPrompt: null,
+  setInitialPrompt: (prompt) => set({ initialPrompt: prompt }),
+
   sessionToDelete: null,
   setSessionToDelete: (target) => set({ sessionToDelete: target }),
 

autogpt_platform/frontend/src/app/(platform)/copilot/useCopilotPage.ts

@@ -19,6 +19,42 @@ import { useCopilotStream } from "./useCopilotStream";
 const TITLE_POLL_INTERVAL_MS = 2_000;
 const TITLE_POLL_MAX_ATTEMPTS = 5;
 
+/**
+ * Extract a prompt from the URL hash fragment.
+ * Supports: /copilot#prompt=URL-encoded-text
+ * Optionally auto-submits if ?autosubmit=true is in the query string.
+ * Returns null if no prompt is present.
+ */
+function extractPromptFromUrl(): {
+  prompt: string;
+  autosubmit: boolean;
+} | null {
+  if (typeof window === "undefined") return null;
+
+  const hash = window.location.hash;
+  if (!hash) return null;
+
+  const hashParams = new URLSearchParams(hash.slice(1));
+  const prompt = hashParams.get("prompt");
+
+  if (!prompt || !prompt.trim()) return null;
+
+  const searchParams = new URLSearchParams(window.location.search);
+  const autosubmit = searchParams.get("autosubmit") === "true";
+
+  // Clean up hash + autosubmit param only (preserve other query params)
+  const cleanURL = new URL(window.location.href);
+  cleanURL.hash = "";
+  cleanURL.searchParams.delete("autosubmit");
+  window.history.replaceState(
+    null,
+    "",
+    `${cleanURL.pathname}${cleanURL.search}`,
+  );
+
+  return { prompt: prompt.trim(), autosubmit };
+}
+
 interface UploadedFile {
   file_id: string;
   name: string;
@@ -127,6 +163,28 @@ export function useCopilotPage() {
     }
   }, [sessionId, pendingMessage, sendMessage]);
 
+  // --- Extract prompt from URL hash on mount (e.g. /copilot#prompt=Hello) ---
+  const { setInitialPrompt } = useCopilotUIStore();
+  const hasProcessedUrlPrompt = useRef(false);
+  useEffect(() => {
+    if (hasProcessedUrlPrompt.current) return;
+
+    const urlPrompt = extractPromptFromUrl();
+    if (!urlPrompt) return;
+
+    hasProcessedUrlPrompt.current = true;
+
+    if (urlPrompt.autosubmit) {
+      setPendingMessage(urlPrompt.prompt);
+      void createSession().catch(() => {
+        setPendingMessage(null);
+        setInitialPrompt(urlPrompt.prompt);
+      });
+    } else {
+      setInitialPrompt(urlPrompt.prompt);
+    }
+  }, [createSession, setInitialPrompt]);
+
   async function uploadFiles(
     files: File[],
     sid: string,

docs/platform/workspace-media-architecture.md

@@ -0,0 +1,343 @@
+# Workspace & Media File Architecture
+
+This document describes the architecture for handling user files in AutoGPT Platform, covering persistent user storage (Workspace) and ephemeral media processing pipelines.
+
+## Overview
+
+The platform has two distinct file-handling layers:
+
+| Layer | Purpose | Persistence | Scope |
+|-------|---------|-------------|-------|
+| **Workspace** | Long-term user file storage | Persistent (DB + GCS/local) | Per-user, session-scoped access |
+| **Media Pipeline** | Ephemeral file processing for blocks | Temporary (local disk) | Per-execution |
+
+## Database Models
+
+### UserWorkspace
+
+Represents a user's file storage space. Created on-demand (one per user).
+
+```prisma
+model UserWorkspace {
+  id        String   @id @default(uuid())
+  createdAt DateTime @default(now())
+  updatedAt DateTime @updatedAt
+  userId    String   @unique
+  Files     UserWorkspaceFile[]
+}
+```
+
+**Key points:**
+- One workspace per user (enforced by `@unique` on `userId`)
+- Created lazily via `get_or_create_workspace()` 
+- Uses upsert to handle race conditions
+
+### UserWorkspaceFile
+
+Represents a file stored in a user's workspace.
+
+```prisma
+model UserWorkspaceFile {
+  id          String    @id @default(uuid())
+  workspaceId String
+  name        String    // User-visible filename
+  path        String    // Virtual path (e.g., "/sessions/abc123/image.png")
+  storagePath String    // Actual storage path (gcs://... or local://...)
+  mimeType    String
+  sizeBytes   BigInt
+  checksum    String?   // SHA256 for integrity
+  isDeleted   Boolean   @default(false)
+  deletedAt   DateTime?
+  metadata    Json      @default("{}")
+
+  @@unique([workspaceId, path])  // Enforce unique paths within workspace
+}
+```
+
+**Key points:**
+- `path` is a virtual path for organizing files (not actual filesystem path)
+- `storagePath` contains the actual GCS or local storage location
+- Soft-delete pattern: `isDeleted` flag with `deletedAt` timestamp
+- Path is modified on delete to free up the virtual path for reuse
+
+---
+
+## WorkspaceManager
+
+**Location:** `backend/util/workspace.py`
+
+High-level API for workspace file operations. Combines storage backend operations with database record management.
+
+### Initialization
+
+```python
+from backend.util.workspace import WorkspaceManager
+
+# Basic usage
+manager = WorkspaceManager(user_id="user-123", workspace_id="ws-456")
+
+# With session scoping (CoPilot sessions)
+manager = WorkspaceManager(
+    user_id="user-123",
+    workspace_id="ws-456", 
+    session_id="session-789"
+)
+```
+
+### Session Scoping
+
+When `session_id` is provided, files are isolated to `/sessions/{session_id}/`:
+
+```python
+# With session_id="abc123":
+manager.write_file(content, "image.png")  
+# → stored at /sessions/abc123/image.png
+
+# Cross-session access is explicit:
+manager.read_file("/sessions/other-session/file.txt")  # Works
+```
+
+**Why session scoping?**
+- CoPilot conversations need file isolation
+- Prevents file collisions between concurrent sessions
+- Allows session cleanup without affecting other sessions
+
+### Core Methods
+
+| Method | Description |
+|--------|-------------|
+| `write_file(content, filename, path?, mime_type?, overwrite?)` | Write file to workspace |
+| `read_file(path)` | Read file by virtual path |
+| `read_file_by_id(file_id)` | Read file by ID |
+| `list_files(path?, limit?, offset?, include_all_sessions?)` | List files |
+| `delete_file(file_id)` | Soft-delete a file |
+| `get_download_url(file_id, expires_in?)` | Get signed download URL |
+| `get_file_info(file_id)` | Get file metadata |
+| `get_file_info_by_path(path)` | Get file metadata by path |
+| `get_file_count(path?, include_all_sessions?)` | Count files |
+
+### Storage Backends
+
+WorkspaceManager delegates to `WorkspaceStorageBackend`:
+
+| Backend | When Used | Storage Path Format |
+|---------|-----------|---------------------|
+| `GCSWorkspaceStorage` | `media_gcs_bucket_name` is configured | `gcs://bucket/workspaces/{ws_id}/{file_id}/{filename}` |
+| `LocalWorkspaceStorage` | No GCS bucket configured | `local://{ws_id}/{file_id}/{filename}` |
+
+---
+
+## store_media_file()
+
+**Location:** `backend/util/file.py`
+
+The media normalization pipeline. Handles various input types and normalizes them for processing or output.
+
+### Purpose
+
+Blocks receive files in many formats (URLs, data URIs, workspace references, local paths). `store_media_file()` normalizes these to a consistent format based on what the block needs.
+
+### Input Types Handled
+
+| Input Format | Example | How It's Processed |
+|--------------|---------|-------------------|
+| Data URI | `data:image/png;base64,iVBOR...` | Decoded, virus scanned, written locally |
+| HTTP(S) URL | `https://example.com/image.png` | Downloaded, virus scanned, written locally |
+| Workspace URI | `workspace://abc123` or `workspace:///path/to/file` | Read from workspace, virus scanned, written locally |
+| Cloud path | `gcs://bucket/path` | Downloaded, virus scanned, written locally |
+| Local path | `image.png` | Verified to exist in exec_file directory |
+
+### Return Formats
+
+The `return_format` parameter determines what you get back:
+
+```python
+from backend.util.file import store_media_file
+
+# For local processing (ffmpeg, MoviePy, PIL)
+local_path = await store_media_file(
+    file=input_file,
+    execution_context=ctx,
+    return_format="for_local_processing"
+)
+# Returns: "image.png" (relative path in exec_file dir)
+
+# For external APIs (Replicate, OpenAI, etc.)
+data_uri = await store_media_file(
+    file=input_file,
+    execution_context=ctx,
+    return_format="for_external_api"
+)
+# Returns: "data:image/png;base64,iVBOR..."
+
+# For block output (adapts to execution context)
+output = await store_media_file(
+    file=input_file,
+    execution_context=ctx,
+    return_format="for_block_output"
+)
+# In CoPilot: Returns "workspace://file-id#image/png"
+# In graphs:  Returns "data:image/png;base64,..."
+```
+
+### Execution Context
+
+`store_media_file()` requires an `ExecutionContext` with:
+- `graph_exec_id` - Required for temp file location
+- `user_id` - Required for workspace access
+- `workspace_id` - Optional; enables workspace features
+- `session_id` - Optional; for session scoping in CoPilot
+
+---
+
+## Responsibility Boundaries
+
+### Virus Scanning
+
+| Component | Scans? | Notes |
+|-----------|--------|-------|
+| `store_media_file()` | ✅ Yes | Scans **all** content before writing to local disk |
+| `WorkspaceManager.write_file()` | ✅ Yes | Scans content before persisting |
+
+**Scanning happens at:**
+1. `store_media_file()` — scans everything it downloads/decodes
+2. `WorkspaceManager.write_file()` — scans before persistence
+
+Tools like `WriteWorkspaceFileTool` don't need to scan because `WorkspaceManager.write_file()` handles it.
+
+### Persistence
+
+| Component | Persists To | Lifecycle |
+|-----------|-------------|-----------|
+| `store_media_file()` | Temp dir (`/tmp/exec_file/{exec_id}/`) | Cleaned after execution |
+| `WorkspaceManager` | GCS or local storage + DB | Persistent until deleted |
+
+**Automatic cleanup:** `clean_exec_files(graph_exec_id)` removes temp files after execution completes.
+
+---
+
+## Decision Tree: WorkspaceManager vs store_media_file
+
+```text
+┌─────────────────────────────────────────────────────┐
+│ What do you need to do with the file?               │
+└─────────────────────────────────────────────────────┘
+                         │
+           ┌─────────────┴─────────────┐
+           ▼                           ▼
+    Process in a block          Store for user access
+    (ffmpeg, PIL, etc.)         (CoPilot files, uploads)
+           │                           │
+           ▼                           ▼
+    store_media_file()           WorkspaceManager
+    with appropriate             
+    return_format                
+           │                           
+           │                           
+    ┌──────┴──────┐                    
+    ▼             ▼                    
+ "for_local_   "for_block_
+ processing"   output"
+    │             │
+    ▼             ▼
+ Get local    Auto-saves to
+ path for     workspace in
+ tools        CoPilot context
+
+Store for user access
+    │
+    ├── write_file() ─── Upload + persist (scans internally)
+    ├── read_file() / get_download_url() ─── Retrieve
+    └── list_files() / delete_file() ─── Manage
+```
+
+### Quick Reference
+
+| Scenario | Use |
+|----------|-----|
+| Block needs to process a file with ffmpeg | `store_media_file(..., return_format="for_local_processing")` |
+| Block needs to send file to external API | `store_media_file(..., return_format="for_external_api")` |
+| Block returning a generated file | `store_media_file(..., return_format="for_block_output")` |
+| API endpoint handling file upload | `WorkspaceManager.write_file()` (handles virus scanning internally) |
+| API endpoint serving file download | `WorkspaceManager.get_download_url()` |
+| Listing user's files | `WorkspaceManager.list_files()` |
+
+---
+
+## Key Files Reference
+
+| File | Purpose |
+|------|---------|
+| `backend/data/workspace.py` | Database CRUD operations for UserWorkspace and UserWorkspaceFile |
+| `backend/util/workspace.py` | `WorkspaceManager` class - high-level workspace API |
+| `backend/util/workspace_storage.py` | Storage backends (GCS, local) and `WorkspaceStorageBackend` interface |
+| `backend/util/file.py` | `store_media_file()` and media processing utilities |
+| `backend/util/virus_scanner.py` | `VirusScannerService` and `scan_content_safe()` |
+| `schema.prisma` | Database model definitions |
+
+---
+
+## Common Patterns
+
+### Block Processing a User's File
+
+```python
+async def run(self, input_data, *, execution_context, **kwargs):
+    # Normalize input to local path
+    local_path = await store_media_file(
+        file=input_data.video,
+        execution_context=execution_context,
+        return_format="for_local_processing",
+    )
+    
+    # Process with local tools
+    output_path = process_video(local_path)
+    
+    # Return (auto-saves to workspace in CoPilot)
+    result = await store_media_file(
+        file=output_path,
+        execution_context=execution_context,
+        return_format="for_block_output",
+    )
+    yield "output", result
+```
+
+### API Upload Endpoint
+
+```python
+from backend.util.virus_scanner import VirusDetectedError, VirusScanError
+
+async def upload_file(file: UploadFile, user_id: str, workspace_id: str):
+    content = await file.read()
+
+    # write_file handles virus scanning internally
+    manager = WorkspaceManager(user_id, workspace_id)
+    try:
+        workspace_file = await manager.write_file(
+            content=content,
+            filename=file.filename,
+        )
+    except VirusDetectedError:
+        raise HTTPException(status_code=400, detail="File rejected: virus detected")
+    except VirusScanError:
+        raise HTTPException(status_code=503, detail="Virus scanning unavailable")
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e))
+
+    return {"file_id": workspace_file.id}
+```
+
+---
+
+## Configuration
+
+| Setting | Purpose | Default |
+|---------|---------|---------|
+| `media_gcs_bucket_name` | GCS bucket for workspace storage | None (uses local) |
+| `workspace_storage_dir` | Local storage directory | `{app_data}/workspaces` |
+| `max_file_size_mb` | Maximum file size in MB | 100 |
+| `clamav_service_enabled` | Enable virus scanning | true |
+| `clamav_service_host` | ClamAV daemon host | localhost |
+| `clamav_service_port` | ClamAV daemon port | 3310 |
+| `clamav_max_concurrency` | Max concurrent scans to ClamAV daemon | 5 |
+| `clamav_mark_failed_scans_as_clean` | If true, scan failures pass content through instead of rejecting (⚠️ security risk if ClamAV is unreachable) | false |