diff --git a/backend/apps/config_app.py b/backend/apps/config_app.py
index fb6a0a4f0..58e2b008b 100644
--- a/backend/apps/config_app.py
+++ b/backend/apps/config_app.py
@@ -6,6 +6,7 @@
 from apps.datamate_app import router as datamate_router
 from apps.vectordatabase_app import router as vectordatabase_router
 from apps.dify_app import router as dify_router
+from apps.idata_app import router as idata_router
 from apps.file_management_app import file_management_config_router as file_manager_router
 from apps.image_app import router as proxy_router
 from apps.knowledge_summary_app import router as summary_router
@@ -39,6 +40,7 @@
 app.include_router(proxy_router)
 app.include_router(tool_config_router)
 app.include_router(dify_router)
+app.include_router(idata_router)
 
 # Choose user management router based on IS_SPEED_MODE
 if IS_SPEED_MODE:
diff --git a/backend/apps/data_process_app.py b/backend/apps/data_process_app.py
index 3ac8b45cf..9138d5ef1 100644
--- a/backend/apps/data_process_app.py
+++ b/backend/apps/data_process_app.py
@@ -11,6 +11,7 @@
     ConvertStateRequest,
     TaskRequest,
 )
+from consts.exceptions import OfficeConversionException
 from data_process.tasks import process_and_forward, process_sync
 from services.data_process_service import get_data_process_service
 
@@ -311,3 +312,35 @@ async def convert_state(request: ConvertStateRequest):
             status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
             detail=f"Error converting state: {str(e)}"
         )
+
+
+@router.post("/convert_to_pdf")
+async def convert_office_to_pdf(
+        object_name: str = Form(...),
+        pdf_object_name: str = Form(...)
+):
+    """
+    Convert an Office document stored in MinIO to PDF.
+
+    Parameters:
+        object_name: Source Office file path in MinIO
+        pdf_object_name: Destination PDF path in MinIO
+    """
+    try:
+        await service.convert_office_to_pdf_impl(
+            object_name=object_name,
+            pdf_object_name=pdf_object_name,
+        )
+        return JSONResponse(status_code=HTTPStatus.OK, content={"success": True})
+    except OfficeConversionException as exc:
+        logger.error(f"Office conversion failed for '{object_name}': {exc}")
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=str(exc)
+        )
+    except Exception as exc:
+        logger.error(f"Unexpected error during conversion for '{object_name}': {exc}")
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"Office conversion failed: {exc}"
+        )
diff --git a/backend/apps/file_management_app.py b/backend/apps/file_management_app.py
index 9ed87cfae..5b7c7bc3c 100644
--- a/backend/apps/file_management_app.py
+++ b/backend/apps/file_management_app.py
@@ -9,22 +9,29 @@
 from fastapi import APIRouter, Body, File, Form, Header, HTTPException, Path as PathParam, Query, UploadFile
 from fastapi.responses import JSONResponse, RedirectResponse, StreamingResponse
 
+from consts.exceptions import FileTooLargeException, NotFoundException, OfficeConversionException, UnsupportedFileTypeException
 from consts.model import ProcessParams
 from services.file_management_service import upload_to_minio, upload_files_impl, \
-    get_file_url_impl, get_file_stream_impl, delete_file_impl, list_files_impl
+    get_file_url_impl, get_file_stream_impl, delete_file_impl, list_files_impl, \
+    preview_file_impl
 from utils.file_management_utils import trigger_data_process
 
 logger = logging.getLogger("file_management_app")
 
 
-def build_content_disposition_header(filename: Optional[str]) -> str:
+def build_content_disposition_header(filename: Optional[str], inline: bool = False) -> str:
     """
     Build a Content-Disposition header that keeps the original filename.
 
+    Args:
+        filename: Original filename to include in header
+        inline: If True, use 'inline' disposition (for preview); otherwise 'attachment' (for download)
+
     - ASCII filenames are returned directly.
     - Non-ASCII filenames include both an ASCII fallback and RFC 5987 encoded value
       so modern browsers keep the original name.
     """
+    disposition = "inline" if inline else "attachment"
     safe_name = (filename or "download").strip() or "download"
 
     def _sanitize_ascii(value: str) -> str:
@@ -40,26 +47,26 @@ def _sanitize_ascii(value: str) -> str:
 
     try:
         safe_name.encode("ascii")
-        return f'attachment; filename="{_sanitize_ascii(safe_name)}"'
+        return f'{disposition}; filename="{_sanitize_ascii(safe_name)}"'
     except UnicodeEncodeError:
         try:
             encoded = quote(safe_name, safe="")
         except Exception:
             # quote failure, fallback to sanitized ASCII only
             logger.warning("Failed to encode filename '%s', using fallback", safe_name)
-            return f'attachment; filename="{_sanitize_ascii(safe_name)}"'
+            return f'{disposition}; filename="{_sanitize_ascii(safe_name)}"'
 
         fallback = _sanitize_ascii(
             safe_name.encode("ascii", "ignore").decode("ascii") or "download"
         )
-        return f'attachment; filename="{fallback}"; filename*=UTF-8\'\'{encoded}'
+        return f'{disposition}; filename="{fallback}"; filename*=UTF-8\'\'{encoded}'
     except Exception as exc:  # pragma: no cover
         logger.warning(
             "Failed to encode filename '%s': %s. Using fallback.",
             safe_name,
             exc,
         )
-        return 'attachment; filename="download"'
+        return f'{disposition}; filename="download"'
 
 # Create API router
 file_management_runtime_router = APIRouter(prefix="/file")
@@ -567,3 +574,69 @@ async def get_storage_file_batch_urls(
         "failed_count": sum(1 for r in results if not r.get("success", False)),
         "results": results
     }
+
+@file_management_config_router.get("/preview/{object_name:path}")
+async def preview_file(
+    object_name: str = PathParam(..., description="File object name to preview"),
+    filename: Optional[str] = Query(None, description="Original filename for display (optional)")
+):
+    """
+    Preview file inline in browser 
+    
+    - **object_name**: File object name in storage
+    - **filename**: Original filename for Content-Disposition header (optional)
+    
+    Returns file stream with Content-Disposition: inline for browser preview
+    """
+    try:
+        # Get file stream from preview service
+        file_stream, content_type = await preview_file_impl(object_name=object_name)
+        
+        # Use provided filename or extract from object_name
+        display_filename = filename
+        if not display_filename:
+            display_filename = object_name.split("/")[-1] if "/" in object_name else object_name
+        
+        # Build Content-Disposition header for inline display
+        content_disposition = build_content_disposition_header(display_filename, inline=True)
+
+        return StreamingResponse(
+            file_stream,
+            media_type=content_type,
+            headers={
+                "Content-Disposition": content_disposition,
+                "Cache-Control": "public, max-age=3600",
+                "ETag": f'"{object_name}"',
+            }
+        )
+    
+    except FileTooLargeException as e:
+        logger.warning(f"[preview_file] File too large: object_name={object_name}, error={str(e)}")
+        raise HTTPException(
+            status_code=HTTPStatus.REQUEST_ENTITY_TOO_LARGE,
+            detail=str(e)
+        )
+    except NotFoundException as e:
+        logger.error(f"[preview_file] File not found: object_name={object_name}, error={str(e)}")
+        raise HTTPException(
+            status_code=HTTPStatus.NOT_FOUND,
+            detail=f"File not found: {object_name}"
+        )
+    except UnsupportedFileTypeException as e:
+        logger.error(f"[preview_file] Unsupported file type: object_name={object_name}, error={str(e)}")
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail=f"File format not supported for preview: {str(e)}"
+        )
+    except OfficeConversionException as e:
+        logger.error(f"[preview_file] Conversion failed: object_name={object_name}, error={str(e)}")
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"Failed to preview file: {str(e)}"
+        )
+    except Exception as e:
+        logger.error(f"[preview_file] Unexpected error: object_name={object_name}, error={str(e)}")
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
+            detail=f"Failed to preview file: {str(e)}"
+        )
\ No newline at end of file
diff --git a/backend/apps/idata_app.py b/backend/apps/idata_app.py
new file mode 100644
index 000000000..278c1b60f
--- /dev/null
+++ b/backend/apps/idata_app.py
@@ -0,0 +1,109 @@
+"""
+iData App Layer
+FastAPI endpoints for iData knowledge space operations.
+
+This module provides API endpoints to interact with iData's API,
+including fetching knowledge spaces and transforming responses to a format
+compatible with the frontend.
+"""
+import logging
+from http import HTTPStatus
+
+from fastapi import APIRouter, Query
+from fastapi.responses import JSONResponse
+
+from consts.error_code import ErrorCode
+from consts.exceptions import AppException
+from services.idata_service import (
+    fetch_idata_knowledge_spaces_impl,
+    fetch_idata_datasets_impl,
+)
+
+router = APIRouter(prefix="/idata")
+logger = logging.getLogger("idata_app")
+
+
+@router.get("/knowledge-space")
+async def fetch_idata_knowledge_spaces_api(
+    idata_api_base: str = Query(..., description="iData API base URL"),
+    api_key: str = Query(..., description="iData API key"),
+    user_id: str = Query(..., description="iData user ID"),
+):
+    """
+    Fetch knowledge spaces from iData API.
+
+    Returns knowledge spaces in a format with id and name for frontend compatibility.
+    """
+    try:
+        # Normalize URL by removing trailing slash
+        idata_api_base = idata_api_base.rstrip('/')
+    except Exception as e:
+        logger.error(f"Invalid iData configuration: {e}")
+        raise AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            f"Invalid URL format: {str(e)}"
+        )
+
+    try:
+        result = fetch_idata_knowledge_spaces_impl(
+            idata_api_base=idata_api_base,
+            api_key=api_key,
+            user_id=user_id,
+        )
+        return JSONResponse(
+            status_code=HTTPStatus.OK,
+            content=result
+        )
+    except AppException:
+        # Re-raise AppException to be handled by global middleware
+        raise
+    except Exception as e:
+        logger.error(f"Failed to fetch iData knowledge spaces: {e}")
+        raise AppException(
+            ErrorCode.IDATA_SERVICE_ERROR,
+            f"Failed to fetch iData knowledge spaces: {str(e)}"
+        )
+
+
+@router.get("/datasets")
+async def fetch_idata_datasets_api(
+    idata_api_base: str = Query(..., description="iData API base URL"),
+    api_key: str = Query(..., description="iData API key"),
+    user_id: str = Query(..., description="iData user ID"),
+    knowledge_space_id: str = Query(..., description="Knowledge space ID"),
+):
+    """
+    Fetch datasets (knowledge bases) from iData API.
+
+    Returns knowledge bases in a format consistent with DataMate for frontend compatibility.
+    """
+    try:
+        # Normalize URL by removing trailing slash
+        idata_api_base = idata_api_base.rstrip('/')
+    except Exception as e:
+        logger.error(f"Invalid iData configuration: {e}")
+        raise AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            f"Invalid URL format: {str(e)}"
+        )
+
+    try:
+        result = fetch_idata_datasets_impl(
+            idata_api_base=idata_api_base,
+            api_key=api_key,
+            user_id=user_id,
+            knowledge_space_id=knowledge_space_id,
+        )
+        return JSONResponse(
+            status_code=HTTPStatus.OK,
+            content=result
+        )
+    except AppException:
+        # Re-raise AppException to be handled by global middleware
+        raise
+    except Exception as e:
+        logger.error(f"Failed to fetch iData datasets: {e}")
+        raise AppException(
+            ErrorCode.IDATA_SERVICE_ERROR,
+            f"Failed to fetch iData datasets: {str(e)}"
+        )
diff --git a/backend/apps/northbound_app.py b/backend/apps/northbound_app.py
index a39877ded..e6aaf4eb6 100644
--- a/backend/apps/northbound_app.py
+++ b/backend/apps/northbound_app.py
@@ -1,12 +1,12 @@
 import logging
 from http import HTTPStatus
-from typing import Optional, Dict
+from typing import Optional, Dict, Any
 import uuid
 
-from fastapi import APIRouter, Body, Header, Request, HTTPException
+from fastapi import APIRouter, Body, Header, Request, HTTPException, Query
 from fastapi.responses import JSONResponse
 
-from consts.exceptions import UnauthorizedError, LimitExceededError, SignatureValidationError
+from consts.exceptions import LimitExceededError, UnauthorizedError
 from services.northbound_service import (
     NorthboundContext,
     get_conversation_history,
@@ -14,86 +14,89 @@
     start_streaming_chat,
     stop_chat,
     get_agent_info_list,
-    update_conversation_title
+    update_conversation_title,
 )
 
-from utils.auth_utils import get_current_user_id, validate_aksk_authentication
+from utils.auth_utils import validate_bearer_token, get_user_and_tenant_by_access_key
 
 
 router = APIRouter(prefix="/nb/v1", tags=["northbound"])
 
 
-def _get_header(headers: Dict[str, str], name: str) -> Optional[str]:
-    for k, v in headers.items():
-        if k.lower() == name.lower():
-            return v
-    return None
+async def _get_northbound_context(request: Request) -> NorthboundContext:
+    """
+    Build northbound context from request.
 
+    Authentication: Bearer Token (API Key) in Authorization header
+    - Authorization: Bearer <access_key>
 
-async def _parse_northbound_context(request: Request) -> NorthboundContext:
-    """
-    Build northbound context from headers.
+    The user_id and tenant_id are derived from the access_key by querying
+    user_token_info_t and user_tenant_t tables.
 
-    - X-Access-Key: Access key for AK/SK authentication
-    - X-Timestamp: Timestamp for signature validation
-    - X-Signature: HMAC-SHA256 signature signed with secret key
-    - Authorization: Bearer <jwt>, jwt contains sub (user_id)
-    - X-Request-Id: optional, generated if not provided
+    Optional headers:
+    - X-Request-Id: Request ID, generated if not provided
     """
-    # 1. Verify AK/SK signature
+    # 1. Validate Bearer Token and extract access_key
     try:
-        # Get request body for signature verification
-        request_body = ""
-        if request.method in ["POST", "PUT", "PATCH"]:
-            try:
-                body_bytes = await request.body()
-                request_body = body_bytes.decode('utf-8') if body_bytes else ""
-            except Exception as e:
-                logging.warning(
-                    f"Cannot read request body for signature verification: {e}")
-                request_body = ""
-
-        validate_aksk_authentication(request.headers, request_body)
-    except (UnauthorizedError, LimitExceededError, SignatureValidationError) as e:
-        raise e
+        auth_header = request.headers.get("Authorization")
+        is_valid, token_info = validate_bearer_token(auth_header)
+
+        if not is_valid or not token_info:
+            raise HTTPException(
+                status_code=HTTPStatus.UNAUTHORIZED,
+                detail="Invalid or missing bearer token"
+            )
+
+        # Extract access_key from the token
+        access_key = auth_header.replace("Bearer ", "") if auth_header.startswith("Bearer ") else auth_header
+
+        # Get user_id and tenant_id from access_key
+        user_tenant_info = get_user_and_tenant_by_access_key(access_key)
+        resolved_user_id = user_tenant_info.get("user_id")
+        resolved_tenant_id = user_tenant_info.get("tenant_id")
+        token_id = user_tenant_info.get("token_id")
+
+    except HTTPException:
+        raise
+    except LimitExceededError as e:
+        logging.error(f"Too Many Requests: rate limit exceeded: {str(e)}", exc_info=e)
+        raise HTTPException(status_code=HTTPStatus.TOO_MANY_REQUESTS,
+                            detail="Too Many Requests: rate limit exceeded")
+    except UnauthorizedError as e:
+        raise HTTPException(
+            status_code=HTTPStatus.UNAUTHORIZED,
+            detail=str(e)
+        )
     except Exception as e:
-        logging.error(f"Failed to parse northbound context: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
-                            detail="Internal Server Error: cannot parse northbound context")
-
-    # 2. Parse JWT token
-    auth_header = _get_header(request.headers, "Authorization")
-    if not auth_header:
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: No authorization header found")
+        logging.error(f"Failed to validate bearer token: {str(e)}", exc_info=e)
+        raise HTTPException(
+            status_code=HTTPStatus.UNAUTHORIZED,
+            detail="Unauthorized: invalid API key"
+        )
 
-    # Use auth_utils to parse JWT token
-    try:
-        user_id, tenant_id = get_current_user_id(auth_header)
+    if not resolved_user_id:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Missing user information for this access key"
+        )
 
-        if not user_id:
-            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                                detail="Unauthorized: missing user_id in JWT token")
-        if not tenant_id:
-            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                                detail="Unauthorized: unregistered user_id in JWT token")
+    if not resolved_tenant_id:
+        raise HTTPException(
+            status_code=HTTPStatus.BAD_REQUEST,
+            detail="Missing tenant information for this access key"
+        )
 
-    except HTTPException as e:
-        # Preserve explicit HTTP errors raised during JWT parsing
-        raise e
-    except Exception as e:
-        logging.error(f"Failed to parse JWT token: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.INTERNAL_SERVER_ERROR,
-                            detail="Internal Server Error: cannot parse JWT token")
+    request_id = request.headers.get("X-Request-Id") or str(uuid.uuid4())
 
-    request_id = _get_header(
-        request.headers, "X-Request-Id") or str(uuid.uuid4())
+    # Get authorization header if present, otherwise use a placeholder
+    auth_header_value = request.headers.get("Authorization", "Bearer placeholder")
 
     return NorthboundContext(
         request_id=request_id,
-        tenant_id=tenant_id,
-        user_id=str(user_id),
-        authorization=auth_header,
+        tenant_id=resolved_tenant_id,
+        user_id=resolved_user_id,
+        authorization=auth_header_value,
+        token_id=token_id,
     )
 
 
@@ -105,34 +108,27 @@ async def health_check():
 @router.post("/chat/run")
 async def run_chat(
     request: Request,
-    conversation_id: str = Body(..., embed=True),
+    conversation_id: Optional[int] = Body(None, embed=True),
     agent_name: str = Body(..., embed=True),
     query: str = Body(..., embed=True),
+    meta_data: Optional[Dict[str, Any]] = Body(None, embed=True),
     idempotency_key: Optional[str] = Header(None, alias="Idempotency-Key"),
 ):
     try:
-        ctx: NorthboundContext = await _parse_northbound_context(request)
+        ctx: NorthboundContext = await _get_northbound_context(request)
         return await start_streaming_chat(
             ctx=ctx,
-            external_conversation_id=conversation_id,
+            conversation_id=conversation_id,
             agent_name=agent_name,
             query=query,
+            meta_data=meta_data,
             idempotency_key=idempotency_key,
         )
-    except UnauthorizedError as e:
-        logging.error(f"Unauthorized: AK/SK authentication failed: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: AK/SK authentication failed")
     except LimitExceededError as e:
         logging.error(f"Too Many Requests: rate limit exceeded: {str(e)}", exc_info=e)
         raise HTTPException(status_code=HTTPStatus.TOO_MANY_REQUESTS,
                             detail="Too Many Requests: rate limit exceeded")
-    except SignatureValidationError as e:
-        logging.error(f"Unauthorized: invalid signature: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: invalid signature")
     except HTTPException as e:
-        # Propagate HTTP errors from context parsing without altering status/detail
         raise e
     except Exception as e:
         logging.error(f"Failed to run chat: {str(e)}", exc_info=e)
@@ -141,22 +137,25 @@ async def run_chat(
 
 
 @router.get("/chat/stop/{conversation_id}")
-async def stop_chat_stream(request: Request, conversation_id: str):
+async def stop_chat_stream(
+    request: Request,
+    conversation_id: int,
+    meta_data: Optional[str] = Query(None, description="Optional metadata as JSON string"),
+):
+    import json
+    parsed_meta_data = None
+    if meta_data:
+        try:
+            parsed_meta_data = json.loads(meta_data)
+        except json.JSONDecodeError:
+            pass
     try:
-        ctx: NorthboundContext = await _parse_northbound_context(request)
-        return await stop_chat(ctx=ctx, external_conversation_id=conversation_id)
-    except UnauthorizedError as e:
-        logging.error(f"Unauthorized: AK/SK authentication failed: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: AK/SK authentication failed")
+        ctx: NorthboundContext = await _get_northbound_context(request)
+        return await stop_chat(ctx=ctx, conversation_id=conversation_id, meta_data=parsed_meta_data)
     except LimitExceededError as e:
         logging.error(f"Too Many Requests: rate limit exceeded: {str(e)}", exc_info=e)
         raise HTTPException(status_code=HTTPStatus.TOO_MANY_REQUESTS,
                             detail="Too Many Requests: rate limit exceeded")
-    except SignatureValidationError as e:
-        logging.error(f"Unauthorized: invalid signature: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: invalid signature")
     except HTTPException as e:
         raise e
     except Exception as e:
@@ -166,22 +165,17 @@ async def stop_chat_stream(request: Request, conversation_id: str):
 
 
 @router.get("/conversations/{conversation_id}")
-async def get_history(request: Request, conversation_id: str):
+async def get_history(
+    request: Request,
+    conversation_id: int,
+):
     try:
-        ctx: NorthboundContext = await _parse_northbound_context(request)
-        return await get_conversation_history(ctx=ctx, external_conversation_id=conversation_id)
-    except UnauthorizedError as e:
-        logging.error(f"Unauthorized: AK/SK authentication failed: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: AK/SK authentication failed")
+        ctx: NorthboundContext = await _get_northbound_context(request)
+        return await get_conversation_history(ctx=ctx, conversation_id=conversation_id)
     except LimitExceededError as e:
         logging.error(f"Too Many Requests: rate limit exceeded: {str(e)}", exc_info=e)
         raise HTTPException(status_code=HTTPStatus.TOO_MANY_REQUESTS,
                             detail="Too Many Requests: rate limit exceeded")
-    except SignatureValidationError as e:
-        logging.error(f"Unauthorized: invalid signature: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: invalid signature")
     except HTTPException as e:
         raise e
     except Exception as e:
@@ -193,20 +187,12 @@ async def get_history(request: Request, conversation_id: str):
 @router.get("/agents")
 async def list_agents(request: Request):
     try:
-        ctx: NorthboundContext = await _parse_northbound_context(request)
+        ctx: NorthboundContext = await _get_northbound_context(request)
         return await get_agent_info_list(ctx=ctx)
-    except UnauthorizedError as e:
-        logging.error(f"Unauthorized: AK/SK authentication failed: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: AK/SK authentication failed")
     except LimitExceededError as e:
         logging.error(f"Too Many Requests: rate limit exceeded: {str(e)}", exc_info=e)
         raise HTTPException(status_code=HTTPStatus.TOO_MANY_REQUESTS,
                             detail="Too Many Requests: rate limit exceeded")
-    except SignatureValidationError as e:
-        logging.error(f"Unauthorized: invalid signature: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: invalid signature")
     except HTTPException as e:
         raise e
     except Exception as e:
@@ -218,20 +204,12 @@ async def list_agents(request: Request):
 @router.get("/conversations")
 async def list_convs(request: Request):
     try:
-        ctx: NorthboundContext = await _parse_northbound_context(request)
+        ctx: NorthboundContext = await _get_northbound_context(request)
         return await list_conversations(ctx=ctx)
-    except UnauthorizedError as e:
-        logging.error(f"Unauthorized: AK/SK authentication failed: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: AK/SK authentication failed")
     except LimitExceededError as e:
         logging.error(f"Too Many Requests: rate limit exceeded: {str(e)}", exc_info=e)
         raise HTTPException(status_code=HTTPStatus.TOO_MANY_REQUESTS,
                             detail="Too Many Requests: rate limit exceeded")
-    except SignatureValidationError as e:
-        logging.error(f"Unauthorized: invalid signature: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: invalid signature")
     except HTTPException as e:
         raise e
     except Exception as e:
@@ -243,34 +221,35 @@ async def list_convs(request: Request):
 @router.put("/conversations/{conversation_id}/title")
 async def update_convs_title(
     request: Request,
-    conversation_id: str,
-    title: str,
+    conversation_id: int,
+    title: str = Query(..., description="New title"),
+    meta_data: Optional[str] = Query(None, description="Optional metadata as JSON string"),
     idempotency_key: Optional[str] = Header(None, alias="Idempotency-Key"),
 ):
+    import json
+    parsed_meta_data = None
+    if meta_data:
+        try:
+            parsed_meta_data = json.loads(meta_data)
+        except json.JSONDecodeError:
+            pass
     try:
-        ctx: NorthboundContext = await _parse_northbound_context(request)
+        ctx: NorthboundContext = await _get_northbound_context(request)
         result = await update_conversation_title(
             ctx=ctx,
-            external_conversation_id=conversation_id,
+            conversation_id=conversation_id,
             title=title,
+            meta_data=parsed_meta_data,
             idempotency_key=idempotency_key,
         )
         headers_out = {
             "Idempotency-Key": result.get("idempotency_key", ""), "X-Request-Id": ctx.request_id}
         return JSONResponse(content=result, headers=headers_out)
 
-    except UnauthorizedError as e:
-        logging.error(f"Unauthorized: AK/SK authentication failed: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: AK/SK authentication failed")
     except LimitExceededError as e:
         logging.error(f"Too Many Requests: rate limit exceeded: {str(e)}", exc_info=e)
         raise HTTPException(status_code=HTTPStatus.TOO_MANY_REQUESTS,
                             detail="Too Many Requests: rate limit exceeded")
-    except SignatureValidationError as e:
-        logging.error(f"Unauthorized: invalid signature: {str(e)}", exc_info=e)
-        raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
-                            detail="Unauthorized: invalid signature")
     except HTTPException as e:
         raise e
     except Exception as e:
diff --git a/backend/apps/remote_mcp_app.py b/backend/apps/remote_mcp_app.py
index cfc82146b..009e5cffa 100644
--- a/backend/apps/remote_mcp_app.py
+++ b/backend/apps/remote_mcp_app.py
@@ -387,7 +387,13 @@ async def add_mcp_from_config(
             except MCPContainerError as e:
                 logger.error(
                     f"Failed to start MCP container {service_name}: {e}")
-                errors.append(f"{service_name}: {str(e)}")
+                error_str = str(e)
+                # Check if error is related to image not found
+                if "not found" in error_str.lower() or "404" in error_str:
+                    errors.append(
+                        f"{service_name}: Image not found - MCP service startup image is missing")
+                else:
+                    errors.append(f"{service_name}: {error_str}")
             except Exception as e:
                 logger.error(
                     f"Unexpected error adding MCP {service_name}: {e}")
diff --git a/backend/apps/user_management_app.py b/backend/apps/user_management_app.py
index c38b4e73c..d50cdc1f0 100644
--- a/backend/apps/user_management_app.py
+++ b/backend/apps/user_management_app.py
@@ -1,9 +1,10 @@
 import logging
 
 from dotenv import load_dotenv
-from fastapi import APIRouter, Request, HTTPException
+from fastapi import APIRouter, Header, Query, Request, HTTPException
 from fastapi.responses import JSONResponse
 from http import HTTPStatus
+from typing import Optional
 
 from supabase_auth.errors import AuthApiError, AuthWeakPasswordError
 
@@ -11,7 +12,7 @@
 from consts.exceptions import NoInviteCodeException, IncorrectInviteCodeException, UserRegistrationException
 from services.user_management_service import get_authorized_client, validate_token, \
     check_auth_service_health, signup_user_with_invitation, signin_user, refresh_user_token, \
-    get_session_by_authorization, get_user_info
+    get_session_by_authorization, get_user_info, create_token, list_tokens_by_user, delete_token
 from services.user_service import delete_user_and_cleanup
 from consts.exceptions import UnauthorizedError
 from utils.auth_utils import get_current_user_id
@@ -44,7 +45,8 @@ async def signup(request: UserSignUpRequest):
     try:
         user_data = await signup_user_with_invitation(email=request.email,
                                                       password=request.password,
-                                                      invite_code=request.invite_code)
+                                                      invite_code=request.invite_code,
+                                                      auto_login=request.auto_login)
         success_message = "🎉 User account registered successfully! Please start experiencing the AI assistant service."
         return JSONResponse(status_code=HTTPStatus.OK,
                             content={"message":success_message, "data":user_data})
@@ -273,3 +275,107 @@ async def revoke_user_account(request: Request):
         logging.error(f"User revoke failed: {str(e)}")
         raise HTTPException(
             status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail="User revoke failed")
+
+@router.post("/tokens")
+async def create_token_endpoint(
+    authorization: Optional[str] = Header(None)
+):
+    """Create a new token for the authenticated user.
+
+    The user_id is extracted from the Authorization header (JWT token).
+    Returns the complete token including the secret key.
+    """
+    try:
+        if not authorization:
+            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
+                                detail="Unauthorized: No authorization header found")
+
+        user_id, _ = get_current_user_id(authorization)
+        if not user_id:
+            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
+                                detail="Unauthorized: missing user_id in JWT token")
+
+        result = create_token(str(user_id))
+        return JSONResponse(
+            status_code=HTTPStatus.OK,
+            content={"message": "success", "data": result}
+        )
+    except HTTPException as e:
+        raise e
+    except Exception as e:
+        logging.error(f"Failed to create token: {str(e)}", exc_info=e)
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail="Internal Server Error")
+
+
+@router.get("/tokens")
+async def list_tokens_endpoint(
+    user_id: str = Query(..., description="User ID to query tokens for"),
+    authorization: Optional[str] = Header(None)
+):
+    """List all tokens for the specified user.
+
+    Returns token information with masked access keys (middle part replaced with *).
+    """
+    try:
+        if not authorization:
+            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
+                                detail="Unauthorized: No authorization header found")
+
+        request_user_id, _ = get_current_user_id(authorization)
+        if not request_user_id:
+            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
+                                detail="Unauthorized: missing user_id in JWT token")
+
+        # Only allow users to list their own tokens
+        if str(request_user_id) != user_id:
+            raise HTTPException(status_code=HTTPStatus.FORBIDDEN,
+                                detail="Forbidden: cannot list tokens for other users")
+
+        tokens = list_tokens_by_user(user_id)
+        return JSONResponse(
+            status_code=HTTPStatus.OK,
+            content={"message": "success", "data": tokens}
+        )
+    except HTTPException as e:
+        raise e
+    except Exception as e:
+        logging.error(f"Failed to list tokens: {str(e)}", exc_info=e)
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail="Internal Server Error")
+
+
+@router.delete("/tokens/{token_id}")
+async def delete_token_endpoint(
+    token_id: int,
+    authorization: Optional[str] = Header(None)
+):
+    """Soft delete a token.
+
+    Only the owner of the token can delete it.
+    """
+    try:
+        if not authorization:
+            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
+                                detail="Unauthorized: No authorization header found")
+
+        user_id, _ = get_current_user_id(authorization)
+        if not user_id:
+            raise HTTPException(status_code=HTTPStatus.UNAUTHORIZED,
+                                detail="Unauthorized: missing user_id in JWT token")
+
+        success = delete_token(token_id, str(user_id))
+        if not success:
+            raise HTTPException(status_code=HTTPStatus.NOT_FOUND,
+                                detail="Token not found or not owned by user")
+
+        return JSONResponse(
+            status_code=HTTPStatus.OK,
+            content={"message": "success", "data": {"token_id": token_id}}
+        )
+    except HTTPException as e:
+        raise e
+    except Exception as e:
+        logging.error(f"Failed to delete token: {str(e)}", exc_info=e)
+        raise HTTPException(
+            status_code=HTTPStatus.INTERNAL_SERVER_ERROR, detail="Internal Server Error")
diff --git a/backend/consts/const.py b/backend/consts/const.py
index 32404bab4..2a48da8ce 100644
--- a/backend/consts/const.py
+++ b/backend/consts/const.py
@@ -36,6 +36,21 @@ class VectorDatabaseType(str, Enum):
 ROOT_DIR = os.getenv("ROOT_DIR")
 
 
+# Preview Configuration
+FILE_PREVIEW_SIZE_LIMIT = 100 * 1024 * 1024  # 100MB
+# Limit concurrent Office-to-PDF conversions
+MAX_CONCURRENT_CONVERSIONS = 5
+# Supported Office file MIME types
+OFFICE_MIME_TYPES = [
+    'application/msword',  # .doc
+    'application/vnd.openxmlformats-officedocument.wordprocessingml.document',  # .docx
+    'application/vnd.ms-excel',  # .xls
+    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',  # .xlsx
+    'application/vnd.ms-powerpoint',  # .ppt
+    'application/vnd.openxmlformats-officedocument.presentationml.presentation'  # .pptx
+]
+
+
 # Supabase Configuration
 SUPABASE_URL = os.getenv('SUPABASE_URL')
 SUPABASE_KEY = os.getenv('SUPABASE_KEY')
@@ -261,6 +276,7 @@ class VectorDatabaseType(str, Enum):
 APP_NAME = "APP_NAME"
 APP_DESCRIPTION = "APP_DESCRIPTION"
 ICON_TYPE = "ICON_TYPE"
+ICON_KEY = "ICON_KEY"
 AVATAR_URI = "AVATAR_URI"
 CUSTOM_ICON_URL = "CUSTOM_ICON_URL"
 TENANT_NAME = "TENANT_NAME"
@@ -307,4 +323,4 @@ class VectorDatabaseType(str, Enum):
 MODEL_ENGINE_ENABLED = os.getenv("MODEL_ENGINE_ENABLED")
 
 # APP Version
-APP_VERSION = "v1.8.0.2"
+APP_VERSION = "v1.8.1"
diff --git a/backend/consts/error_code.py b/backend/consts/error_code.py
index 73decbbf3..072243de4 100644
--- a/backend/consts/error_code.py
+++ b/backend/consts/error_code.py
@@ -121,6 +121,13 @@ class ErrorCode(Enum):
     MODEL_CONFIG_INVALID = "090102"  # Invalid model configuration
     MODEL_HEALTH_CHECK_FAILED = "090103"  # Health check failed
     MODEL_PROVIDER_ERROR = "090104"  # Model provider error
+    MODEL_PROMPT_GENERATION_FAILED = "090105"  # Model prompt generation failed
+    # 02 - Model API errors
+    MODEL_API_KEY_INVALID = "090201"  # API key is invalid or expired
+    MODEL_API_KEY_NO_PERMISSION = "090202"  # API key does not have permission
+    MODEL_RATE_LIMIT_EXCEEDED = "090203"  # Rate limit exceeded
+    MODEL_SERVICE_UNAVAILABLE = "090204"  # Model service is temporarily unavailable
+    MODEL_CONNECTION_ERROR = "090205"  # Failed to connect to model service
 
     # ==================== 10 Memory / 记忆管理 ====================
     # 01 - Memory
@@ -157,6 +164,14 @@ class ErrorCode(Enum):
     # 03 - ME Service
     ME_CONNECTION_FAILED = "130301"  # ME service connection failed
 
+    # 04 - iData Service
+    IDATA_SERVICE_ERROR = "130401"  # iData service error
+    IDATA_CONFIG_INVALID = "130402"  # Invalid iData configuration
+    IDATA_CONNECTION_ERROR = "130403"  # iData connection error
+    IDATA_AUTH_ERROR = "130404"  # iData auth error
+    IDATA_RATE_LIMIT = "130405"  # iData rate limit
+    IDATA_RESPONSE_ERROR = "130406"  # iData response error
+
     # ==================== 14 Northbound / 北向接口 ====================
     # 01 - Request
     NORTHBOUND_REQUEST_FAILED = "140101"  # Northbound request failed
@@ -216,4 +231,10 @@ class ErrorCode(Enum):
     ErrorCode.DIFY_CONNECTION_ERROR: 502,
     ErrorCode.DIFY_RESPONSE_ERROR: 502,
     ErrorCode.DIFY_RATE_LIMIT: 429,
+    # iData (module 13)
+    ErrorCode.IDATA_CONFIG_INVALID: 400,
+    ErrorCode.IDATA_AUTH_ERROR: 401,
+    ErrorCode.IDATA_CONNECTION_ERROR: 502,
+    ErrorCode.IDATA_RESPONSE_ERROR: 502,
+    ErrorCode.IDATA_RATE_LIMIT: 429,
 }
diff --git a/backend/consts/error_message.py b/backend/consts/error_message.py
index aa7bf45e3..4ff1141c7 100644
--- a/backend/consts/error_message.py
+++ b/backend/consts/error_message.py
@@ -84,6 +84,13 @@ class ErrorMessage:
         ErrorCode.MODEL_CONFIG_INVALID: "Model configuration is invalid.",
         ErrorCode.MODEL_HEALTH_CHECK_FAILED: "Model health check failed.",
         ErrorCode.MODEL_PROVIDER_ERROR: "Model provider error.",
+        ErrorCode.MODEL_PROMPT_GENERATION_FAILED: "Model is unavailable. Please check the model status and try again.",
+        # 02 - Model API errors
+        ErrorCode.MODEL_API_KEY_INVALID: "Model API key is invalid or expired. Please check your API key configuration.",
+        ErrorCode.MODEL_API_KEY_NO_PERMISSION: "Model API key does not have permission. Please check your API key permissions.",
+        ErrorCode.MODEL_RATE_LIMIT_EXCEEDED: "Rate limit exceeded. Please try again later.",
+        ErrorCode.MODEL_SERVICE_UNAVAILABLE: "Model service is temporarily unavailable. Please try again later.",
+        ErrorCode.MODEL_CONNECTION_ERROR: "Failed to connect to model service. Please check your network and model configuration.",
 
         # ==================== 10 Memory / 记忆管理 ====================
         ErrorCode.MEMORY_NOT_FOUND: "Memory not found.",
diff --git a/backend/consts/exceptions.py b/backend/consts/exceptions.py
index e9d270673..369c24aab 100644
--- a/backend/consts/exceptions.py
+++ b/backend/consts/exceptions.py
@@ -43,7 +43,7 @@ def __init__(self, error_code: ErrorCode, message: str = None, details: dict = N
 
     def to_dict(self) -> dict:
         return {
-            "code": int(self.error_code.value),
+            "code": str(self.error_code.value),  # Keep as string to preserve leading zeros
             "message": self.message,
             "details": self.details if self.details else None
         }
@@ -115,6 +115,21 @@ class IncorrectInviteCodeException(Exception):
     pass
 
 
+class OfficeConversionException(Exception):
+    """Raised when Office-to-PDF conversion via data-process service fails."""
+    pass
+
+
+class UnsupportedFileTypeException(Exception):
+    """Raised when a file type is not supported for the requested operation."""
+    pass
+
+
+class FileTooLargeException(Exception):
+    """Raised when a file exceeds the maximum allowed size for the requested operation."""
+    pass
+
+
 class UserRegistrationException(Exception):
     """Raised when user registration fails."""
     pass
diff --git a/backend/consts/model.py b/backend/consts/model.py
index ae8e576a8..6aea42fa9 100644
--- a/backend/consts/model.py
+++ b/backend/consts/model.py
@@ -31,6 +31,7 @@ class UserSignUpRequest(BaseModel):
     email: EmailStr
     password: str = Field(..., min_length=6)
     invite_code: Optional[str] = None
+    auto_login: Optional[bool] = True  # Whether to return session after signup
 
 
 class UserSignInRequest(BaseModel):
@@ -114,6 +115,7 @@ class AppConfig(BaseModel):
     appName: str
     appDescription: str
     iconType: str
+    iconKey: Optional[str] = "search"
     customIconUrl: Optional[str] = None
     avatarUri: Optional[str] = None
     modelEngineEnabled: bool = False
diff --git a/backend/consts/provider.py b/backend/consts/provider.py
index 7fd783015..38bbc4027 100644
--- a/backend/consts/provider.py
+++ b/backend/consts/provider.py
@@ -6,11 +6,21 @@ class ProviderEnum(str, Enum):
     SILICON = "silicon"
     OPENAI = "openai"
     MODELENGINE = "modelengine"
+    DASHSCOPE = "dashscope"
+    TOKENPONY = "tokenpony"
 
 
 # Silicon Flow
 SILICON_BASE_URL = "https://api.siliconflow.cn/v1/"
 SILICON_GET_URL = "https://api.siliconflow.cn/v1/models"
 
+# Dashcope
+DASHSCOPE_BASE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1/"
+DASHSCOPE_GET_URL = "https://dashscope.aliyuncs.com/api/v1/models"
+
+# TokenPony
+TOKENPONY_BASE_URL = "https://api.tokenpony.cn/v1/"
+TOKENPONY_GET_URL = "https://api.tokenpony.cn/v1/models"
+
 # ModelEngine
 # Base URL and API key are loaded from environment variables at runtime
diff --git a/backend/database/attachment_db.py b/backend/database/attachment_db.py
index d7764b3a2..2e6249468 100644
--- a/backend/database/attachment_db.py
+++ b/backend/database/attachment_db.py
@@ -169,6 +169,42 @@ def get_file_size_from_minio(object_name: str, bucket: Optional[str] = None) ->
     return minio_client.get_file_size(object_name, bucket)
 
 
+def file_exists(object_name: str, bucket: Optional[str] = None) -> bool:
+    """
+    Check if a file exists in the bucket.
+    
+    Args:
+        object_name: Object name in storage
+        bucket: Bucket name, if not specified will use default bucket
+        
+    Returns:
+        bool: True if file exists, False otherwise
+    """
+    try:
+        return minio_client.file_exists(object_name, bucket)
+    except Exception:
+        return False
+
+
+def copy_file(source_object: str, dest_object: str, bucket: Optional[str] = None) -> Dict[str, Any]:
+    """
+    Copy a file within the same bucket (atomic operation in MinIO).
+    
+    Args:
+        source_object: Source object name
+        dest_object: Destination object name
+        bucket: Bucket name, if not specified will use default bucket
+        
+    Returns:
+        Dict[str, Any]: Result containing success flag and error message (if any)
+    """
+    success, result = minio_client.copy_file(source_object, dest_object, bucket)
+    if success:
+        return {"success": True, "object_name": result}
+    else:
+        return {"success": False, "error": result}
+
+
 def list_files(prefix: str = "", bucket: Optional[str] = None) -> List[Dict[str, Any]]:
     """
     List files in bucket
@@ -269,6 +305,7 @@ def get_content_type(file_path: str) -> str:
                   '.pptx': 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
                   '.txt': 'text/plain',
                   '.csv': 'text/csv',
+                  '.md': 'text/markdown',
                   '.html': 'text/html',
                   '.htm': 'text/html',
                   '.json': 'application/json',
diff --git a/backend/database/client.py b/backend/database/client.py
index c82f78df3..37e5dba03 100644
--- a/backend/database/client.py
+++ b/backend/database/client.py
@@ -213,6 +213,33 @@ def get_file_stream(self, object_name: str, bucket: Optional[str] = None) -> Tup
         """
         return self._storage_client.get_file_stream(object_name, bucket)
 
+    def file_exists(self, object_name: str, bucket: Optional[str] = None) -> bool:
+        """
+        Check if file exists in MinIO
+
+        Args:
+            object_name: Object name
+            bucket: Bucket name, if not specified use default bucket
+
+        Returns:
+            bool: True if file exists, False otherwise
+        """
+        return self._storage_client.exists(object_name, bucket)
+
+    def copy_file(self, source_object: str, dest_object: str, bucket: Optional[str] = None) -> Tuple[bool, str]:
+        """
+        Copy a file within the same bucket (atomic operation)
+
+        Args:
+            source_object: Source object name
+            dest_object: Destination object name
+            bucket: Bucket name, if not specified use default bucket
+
+        Returns:
+            Tuple[bool, str]: (Success status, Destination object name or error message)
+        """
+        return self._storage_client.copy_file(source_object, dest_object, bucket)
+
 
 # Create global database and MinIO client instances
 db_client = PostgresClient()
diff --git a/backend/database/conversation_db.py b/backend/database/conversation_db.py
index 0267d77c2..18c0ee9fc 100644
--- a/backend/database/conversation_db.py
+++ b/backend/database/conversation_db.py
@@ -4,7 +4,7 @@
 
 from sqlalchemy import asc, desc, func, insert, select, update
 
-from .client import as_dict, get_db_session
+from .client import as_dict, db_client, get_db_session
 from .db_models import (
     ConversationMessage,
     ConversationMessageUnit,
@@ -328,11 +328,12 @@ def rename_conversation(conversation_id: int, new_title: str, user_id: Optional[
         # Ensure conversation_id is of integer type
         conversation_id = int(conversation_id)
 
-        # Prepare update data
+        # Prepare update data with UTF-8 encoding for title
         update_data = {
             "conversation_title": new_title,
             "update_time": func.current_timestamp()
         }
+        update_data = db_client.clean_string_values(update_data)
         if user_id:
             update_data = add_update_tracking(update_data, user_id)
 
diff --git a/backend/database/db_models.py b/backend/database/db_models.py
index 36f475f53..80dcc87eb 100644
--- a/backend/database/db_models.py
+++ b/backend/database/db_models.py
@@ -1,4 +1,5 @@
 from sqlalchemy import BigInteger, Boolean, Column, Integer, JSON, Numeric, PrimaryKeyConstraint, Sequence, String, Text, TIMESTAMP
+from sqlalchemy.dialects.postgresql import JSONB
 from sqlalchemy.orm import DeclarativeBase
 from sqlalchemy.sql import func
 
@@ -483,3 +484,31 @@ class AgentVersion(TableBase):
     source_version_no = Column(Integer, doc="Source version number. If this version is a rollback, record the source version")
     source_type = Column(String(30), doc="Source type: NORMAL (normal publish) / ROLLBACK (rollback and republish)")
     status = Column(String(30), default="RELEASED", doc="Version status: RELEASED / DISABLED / ARCHIVED")
+
+
+class UserTokenInfo(TableBase):
+    """
+    User token (AK/SK) information table
+    """
+    __tablename__ = "user_token_info_t"
+    __table_args__ = {"schema": SCHEMA}
+
+    token_id = Column(Integer, Sequence("user_token_info_t_token_id_seq", schema=SCHEMA),
+                      primary_key=True, nullable=False, doc="Token ID, unique primary key")
+    access_key = Column(String(100), nullable=False, doc="Access Key (AK)")
+    user_id = Column(String(100), nullable=False, doc="User ID who owns this token")
+
+
+class UserTokenUsageLog(TableBase):
+    """
+    User token usage log table
+    """
+    __tablename__ = "user_token_usage_log_t"
+    __table_args__ = {"schema": SCHEMA}
+
+    token_usage_id = Column(Integer, Sequence("user_token_usage_log_t_token_usage_id_seq", schema=SCHEMA),
+                            primary_key=True, nullable=False, doc="Token usage log ID, unique primary key")
+    token_id = Column(Integer, nullable=False, doc="Foreign key to user_token_info_t.token_id")
+    call_function_name = Column(String(100), doc="API function name being called")
+    related_id = Column(Integer, doc="Related resource ID (e.g., conversation_id)")
+    meta_data = Column(JSONB, doc="Additional metadata for this usage log entry, stored as JSON")
diff --git a/backend/database/token_db.py b/backend/database/token_db.py
new file mode 100644
index 000000000..70d53a42e
--- /dev/null
+++ b/backend/database/token_db.py
@@ -0,0 +1,189 @@
+"""
+Database operations for user API token (API Key) management.
+"""
+import secrets
+from typing import Any, Dict, List, Optional
+
+from database.client import get_db_session
+from database.db_models import UserTokenInfo, UserTokenUsageLog
+
+
+def generate_access_key() -> str:
+    """Generate a random access key with format nexent-xxxxx..."""
+    random_part = secrets.token_hex(12)  # 24 hex characters for more entropy
+    return f"nexent-{random_part}"
+
+
+def create_token(access_key: str, user_id: str) -> Dict[str, Any]:
+    """Create a new token record in the database.
+
+    Args:
+        access_key: The access key (API Key).
+        user_id: The user ID who owns this token.
+
+    Returns:
+        Dictionary containing the created token information.
+    """
+    with get_db_session() as session:
+        token = UserTokenInfo(
+            access_key=access_key,
+            user_id=user_id,
+            created_by=user_id,
+            updated_by=user_id,
+            delete_flag='N'
+        )
+        session.add(token)
+        session.flush()
+
+        return {
+            "token_id": token.token_id,
+            "access_key": token.access_key,
+            "user_id": token.user_id
+        }
+
+
+def list_tokens_by_user(user_id: str) -> List[Dict[str, Any]]:
+    """List all active tokens for the specified user.
+
+    Args:
+        user_id: The user ID to query tokens for.
+
+    Returns:
+        List of token information with masked access keys.
+    """
+    with get_db_session() as session:
+        tokens = session.query(UserTokenInfo).filter(
+            UserTokenInfo.user_id == user_id,
+            UserTokenInfo.delete_flag == 'N'
+        ).order_by(UserTokenInfo.create_time.desc()).all()
+
+        return [
+            {
+                "token_id": token.token_id,
+                "access_key": token.access_key,
+                "user_id": token.user_id,
+                "create_time": token.create_time.isoformat() if token.create_time else None
+            }
+            for token in tokens
+        ]
+
+
+def get_token_by_id(token_id: int) -> UserTokenInfo:
+    """Get a token by its ID.
+
+    Args:
+        token_id: The token ID to query.
+
+    Returns:
+        UserTokenInfo object if found and active, None otherwise.
+    """
+    with get_db_session() as session:
+        return session.query(UserTokenInfo).filter(
+            UserTokenInfo.token_id == token_id,
+            UserTokenInfo.delete_flag == 'N'
+        ).first()
+
+
+def get_token_by_access_key(access_key: str) -> Optional[Dict[str, Any]]:
+    """Get a token by its access key.
+
+    Args:
+        access_key: The access key to query.
+
+    Returns:
+        Token information dict if found and active, None otherwise.
+    """
+    with get_db_session() as session:
+        token = session.query(UserTokenInfo).filter(
+            UserTokenInfo.access_key == access_key,
+            UserTokenInfo.delete_flag == 'N'
+        ).first()
+
+        if token:
+            return {
+                "token_id": token.token_id,
+                "access_key": token.access_key,
+                "user_id": token.user_id,
+                "delete_flag": token.delete_flag
+            }
+        return None
+
+
+def delete_token(token_id: int, user_id: str) -> bool:
+    """Soft delete a token by setting delete_flag to 'Y'.
+
+    Args:
+        token_id: The token ID to delete.
+        user_id: The user ID who owns this token (for authorization).
+
+    Returns:
+        True if the token was deleted, False if not found or not owned by user.
+    """
+    with get_db_session() as session:
+        token = session.query(UserTokenInfo).filter(
+            UserTokenInfo.token_id == token_id,
+            UserTokenInfo.user_id == user_id,
+            UserTokenInfo.delete_flag == 'N'
+        ).first()
+
+        if not token:
+            return False
+
+        token.delete_flag = 'Y'
+        token.updated_by = user_id
+        return True
+
+
+def log_token_usage(
+    token_id: int,
+    call_function_name: str,
+    related_id: Optional[int],
+    created_by: str,
+    metadata: Optional[Dict[str, Any]] = None
+) -> int:
+    """Log token usage to the database.
+
+    Args:
+        token_id: The token ID used.
+        call_function_name: The API function name being called.
+        related_id: Related resource ID (e.g., conversation_id).
+        created_by: User ID who initiated the call.
+        metadata: Optional additional metadata for this usage log entry.
+
+    Returns:
+        The created token_usage_id.
+    """
+    with get_db_session() as session:
+        usage_log = UserTokenUsageLog(
+            token_id=token_id,
+            call_function_name=call_function_name,
+            related_id=related_id,
+            created_by=created_by,
+            meta_data=metadata
+        )
+        session.add(usage_log)
+        session.flush()
+        return usage_log.token_usage_id
+
+
+def get_latest_usage_metadata(token_id: int, related_id: int, call_function_name: str) -> Optional[Dict[str, Any]]:
+    """Get the latest metadata for a given token, related_id and function name.
+
+    Args:
+        token_id: The token ID used.
+        related_id: Related resource ID (e.g., conversation_id).
+        call_function_name: The API function name.
+
+    Returns:
+        The metadata dict if found, None otherwise.
+    """
+    with get_db_session() as session:
+        usage_log = session.query(UserTokenUsageLog).filter(
+            UserTokenUsageLog.token_id == token_id,
+            UserTokenUsageLog.related_id == related_id,
+            UserTokenUsageLog.call_function_name == call_function_name
+        ).order_by(UserTokenUsageLog.create_time.desc()).first()
+
+        if usage_log and usage_log.meta_data:
+            return usage_log.meta_data
+        return None
diff --git a/backend/database/tool_db.py b/backend/database/tool_db.py
index 0001315a7..2a64c47d6 100644
--- a/backend/database/tool_db.py
+++ b/backend/database/tool_db.py
@@ -4,6 +4,7 @@
 from database.agent_db import logger
 from database.client import get_db_session, filter_property, as_dict
 from database.db_models import ToolInstance, ToolInfo
+from consts.model import ToolSourceEnum
 
 
 def create_tool(tool_info, version_no: int = 0):
@@ -36,7 +37,7 @@ def create_or_update_tool_by_tool_info(tool_info, tenant_id: str, user_id: str,
     Args:
         tool_info: Dictionary containing tool information
         tenant_id: Tenant ID for filtering, mandatory
-        user_id: Optional user ID for filtering
+        user_id: User ID for updating (will be set as the last updater)
         version_no: Version number to filter. Default 0 = draft/editing state
 
     Returns:
@@ -47,9 +48,10 @@ def create_or_update_tool_by_tool_info(tool_info, tenant_id: str, user_id: str,
 
     with get_db_session() as session:
         # Query if there is an existing ToolInstance
+        # Note: Do not filter by user_id to avoid creating duplicate instances
+        # for the same agent_id and tool_id when different users save
         query = session.query(ToolInstance).filter(
             ToolInstance.tenant_id == tenant_id,
-            ToolInstance.user_id == user_id,
             ToolInstance.agent_id == tool_info_dict['agent_id'],
             ToolInstance.delete_flag != 'Y',
             ToolInstance.tool_id == tool_info_dict['tool_id'],
@@ -62,7 +64,12 @@ def create_or_update_tool_by_tool_info(tool_info, tenant_id: str, user_id: str,
                 if hasattr(tool_instance, key):
                     setattr(tool_instance, key, value)
         else:
-            create_tool(tool_info_dict, version_no)
+            # Create a new ToolInstance
+            new_tool_instance = ToolInstance(
+                **filter_property(tool_info_dict, ToolInstance))
+            session.add(new_tool_instance)
+            session.flush()  # Flush to get the ID
+            tool_instance = new_tool_instance
         return tool_instance
 
 
@@ -190,13 +197,23 @@ def check_tool_list_initialized(tenant_id: str) -> bool:
 def update_tool_table_from_scan_tool_list(tenant_id: str, user_id: str, tool_list: List[ToolInfo]):
     """
     scan all tools and update the tool table in PG database, remove the duplicate tools
+    For MCP tools, use name&source&usage as unique key to allow same tool name from different MCP servers
     """
     with get_db_session() as session:
         # get all existing tools (including complete information)
         existing_tools = session.query(ToolInfo).filter(ToolInfo.delete_flag != 'Y',
                                                         ToolInfo.author == tenant_id).all()
-        existing_tool_dict = {
-            f"{tool.name}&{tool.source}": tool for tool in existing_tools}
+        # Build existing_tool_dict with different keys for MCP vs non-MCP tools
+        existing_tool_dict = {}
+        for tool in existing_tools:
+            if tool.source == ToolSourceEnum.MCP.value:
+                # For MCP tools, use name + source + usage (MCP server name) as unique key
+                key = f"{tool.name}&{tool.source}&{tool.usage or ''}"
+            else:
+                # For other tools, use name + source as unique key
+                key = f"{tool.name}&{tool.source}"
+            existing_tool_dict[key] = tool
+
         # set all tools to unavailable
         for tool in existing_tools:
             tool.is_available = False
@@ -208,9 +225,15 @@ def update_tool_table_from_scan_tool_list(tenant_id: str, user_id: str, tool_lis
             is_available = True if re.match(
                 r'^[a-zA-Z_][a-zA-Z0-9_]*$', tool.name) is not None else False
 
-            if f"{tool.name}&{tool.source}" in existing_tool_dict:
-                # by tool name and source to update the existing tool
-                existing_tool = existing_tool_dict[f"{tool.name}&{tool.source}"]
+            # Use same key generation logic as above
+            if tool.source == ToolSourceEnum.MCP.value:
+                tool_key = f"{tool.name}&{tool.source}&{tool.usage or ''}"
+            else:
+                tool_key = f"{tool.name}&{tool.source}"
+
+            if tool_key in existing_tool_dict:
+                # by tool name, source, and usage (for MCP) to update the existing tool
+                existing_tool = existing_tool_dict[tool_key]
                 for key, value in filtered_tool_data.items():
                     setattr(existing_tool, key, value)
                 existing_tool.updated_by = user_id
@@ -308,6 +331,7 @@ def delete_tools_by_agent_id(agent_id, tenant_id, user_id, version_no: int = 0):
             ToolInstance.delete_flag: 'Y', 'updated_by': user_id
         })
 
+
 def search_last_tool_instance_by_tool_id(tool_id: int, tenant_id: str, user_id: str, version_no: int = 0):
     """
     Query the latest ToolInstance by tool_id.
@@ -331,4 +355,4 @@ def search_last_tool_instance_by_tool_id(tool_id: int, tenant_id: str, user_id:
             ToolInstance.delete_flag != 'Y'
         ).order_by(ToolInstance.update_time.desc())
         tool_instance = query.first()
-        return as_dict(tool_instance) if tool_instance else None
\ No newline at end of file
+        return as_dict(tool_instance) if tool_instance else None
diff --git a/backend/middleware/exception_handler.py b/backend/middleware/exception_handler.py
index 14d9ebb38..6ec521f12 100644
--- a/backend/middleware/exception_handler.py
+++ b/backend/middleware/exception_handler.py
@@ -74,7 +74,7 @@ async def dispatch(self, request: Request, call_next: Callable) -> Response:
                 return JSONResponse(
                     status_code=http_status,
                     content={
-                        "code": int(exc.error_code.value),
+                        "code": exc.error_code.value,  # Keep as string to preserve leading zeros
                         "message": exc.message,
                         "trace_id": trace_id,
                         "details": exc.details if exc.details else None
@@ -88,7 +88,7 @@ async def dispatch(self, request: Request, call_next: Callable) -> Response:
                 return JSONResponse(
                     status_code=exc.status_code,
                     content={
-                        "code": int(error_code.value),
+                        "code": error_code.value,  # Keep as string to preserve leading zeros
                         "message": exc.detail,
                         "trace_id": trace_id
                     }
@@ -141,7 +141,7 @@ def create_error_response(
     return JSONResponse(
         status_code=status,
         content={
-            "code": int(error_code.value),
+            "code": error_code.value,  # Keep as string to preserve leading zeros
             "message": message or ErrorMessage.get_message(error_code),
             "trace_id": trace_id,
             "details": details
diff --git a/backend/services/config_sync_service.py b/backend/services/config_sync_service.py
index 7c7c66e7e..9fe50813a 100644
--- a/backend/services/config_sync_service.py
+++ b/backend/services/config_sync_service.py
@@ -13,6 +13,7 @@
     DEFAULT_APP_NAME_ZH,
     DEFAULT_GROUP_ID,
     ICON_TYPE,
+    ICON_KEY,
     LANGUAGE,
     MODEL_CONFIG_MAPPING,
     LANGUAGE,
@@ -139,6 +140,7 @@ def build_app_config(language: str, tenant_id: str) -> dict:
         "defaultGroupId": tenant_config_manager.get_app_config(DEFAULT_GROUP_ID, tenant_id=tenant_id) or "",
         "icon": {
             "type": tenant_config_manager.get_app_config(ICON_TYPE, tenant_id=tenant_id) or "preset",
+            "iconKey": tenant_config_manager.get_app_config(ICON_KEY, tenant_id=tenant_id) or "search",
             "avatarUri": tenant_config_manager.get_app_config(AVATAR_URI, tenant_id=tenant_id) or "",
             "customUrl": tenant_config_manager.get_app_config(CUSTOM_ICON_URL, tenant_id=tenant_id) or ""
         },
diff --git a/backend/services/data_process_service.py b/backend/services/data_process_service.py
index bce279a4c..8c44c15e6 100644
--- a/backend/services/data_process_service.py
+++ b/backend/services/data_process_service.py
@@ -4,6 +4,7 @@
 import io
 import logging
 import os
+import shutil
 import tempfile
 import threading
 import time
@@ -18,12 +19,18 @@
 from transformers import CLIPProcessor, CLIPModel
 from nexent.data_process.core import DataProcessCore
 
-from consts.const import CLIP_MODEL_PATH, IMAGE_FILTER, REDIS_BACKEND_URL, REDIS_URL
+from consts.const import CLIP_MODEL_PATH, IMAGE_FILTER, MAX_CONCURRENT_CONVERSIONS, REDIS_BACKEND_URL, REDIS_URL
+from consts.exceptions import OfficeConversionException
 from consts.model import BatchTaskRequest
+from database.attachment_db import delete_file, file_exists, get_file_size_from_minio, get_file_stream, upload_file
+from utils.file_management_utils import convert_office_to_pdf
 from data_process.app import app as celery_app
 from data_process.tasks import process, forward
 from data_process.utils import get_task_info, get_all_task_ids_from_redis
 
+# Limit concurrent LibreOffice processes to avoid resource exhaustion
+_conversion_semaphore = asyncio.Semaphore(MAX_CONCURRENT_CONVERSIONS)
+
 # Configure logging
 logger = logging.getLogger("data_process.service")
 
@@ -551,6 +558,81 @@ async def process_uploaded_text_file(self, file_content: bytes, filename: str, c
             "chunking_strategy": chunking_strategy
         }
 
+    async def convert_office_to_pdf_impl(self, object_name: str, pdf_object_name: str) -> None:
+        """Full conversion pipeline: download → convert → upload → validate → cleanup.
+
+        All five steps run inside data-process so that LibreOffice only needs to be
+        installed in this container.
+
+        Args:
+            object_name: Source Office file path in MinIO.
+            pdf_object_name: Destination PDF path in MinIO (final, not temp).
+        """
+        async with _conversion_semaphore:
+            temp_dir = None
+            try:
+                temp_dir = tempfile.mkdtemp(prefix='office_convert_')
+
+                # Step 1: Download original Office file from MinIO
+                original_stream = get_file_stream(object_name)
+                if original_stream is None:
+                    raise OfficeConversionException(f"Source file not found in storage: {object_name}")
+
+                original_filename = os.path.basename(object_name)
+                input_path = os.path.join(temp_dir, original_filename)
+                with open(input_path, 'wb') as f:
+                    while chunk := original_stream.read(8192):
+                        f.write(chunk)
+
+                # Step 2: Local conversion using LibreOffice
+                try:
+                    pdf_path = await convert_office_to_pdf(input_path, temp_dir, timeout=30)
+                except Exception as exc:
+                    raise OfficeConversionException(f"LibreOffice conversion failed: {exc}") from exc
+
+                # Step 3: Upload converted PDF to MinIO
+                result = upload_file(file_path=pdf_path, object_name=pdf_object_name)
+                if not result.get('success'):
+                    raise OfficeConversionException(
+                        f"Failed to upload PDF to MinIO: {result.get('error', 'Unknown error')}"
+                    )
+
+                # Step 4: Validate the uploaded PDF (header check + minimum size)
+                remote_size = get_file_size_from_minio(pdf_object_name)
+                if remote_size <= 0:
+                    raise OfficeConversionException("PDF validation failed: cannot read remote file size")
+                if remote_size < 100:
+                    raise OfficeConversionException(
+                        f"PDF validation failed: file too small ({remote_size} bytes)"
+                    )
+                remote_stream = get_file_stream(pdf_object_name)
+                if remote_stream is None:
+                    raise OfficeConversionException("PDF validation failed: cannot read uploaded file")
+                try:
+                    header = remote_stream.read(5)
+                finally:
+                    try:
+                        remote_stream.close()
+                    except Exception:
+                        pass
+                if not header.startswith(b'%PDF-'):
+                    raise OfficeConversionException("PDF validation failed: invalid PDF header")
+
+            except OfficeConversionException:
+                # Clean up any partially-uploaded remote PDF so a future retry starts clean
+                if file_exists(pdf_object_name):
+                    delete_file(pdf_object_name)
+                raise
+            except Exception as exc:
+                raise OfficeConversionException(f"Unexpected error during conversion: {exc}") from exc
+            finally:
+                # Step 5: Clean up local temporary directory
+                if temp_dir and os.path.exists(temp_dir):
+                    try:
+                        shutil.rmtree(temp_dir)
+                    except Exception as cleanup_err:
+                        logger.warning(f"Failed to cleanup temp dir '{temp_dir}': {cleanup_err}")
+
     def convert_celery_states_to_custom(self, process_celery_state: Optional[str], forward_celery_state: Optional[str]) -> str:
         """Map Celery task states to a custom frontend state string.
 
diff --git a/backend/services/file_management_service.py b/backend/services/file_management_service.py
index 8215be810..39b3af858 100644
--- a/backend/services/file_management_service.py
+++ b/backend/services/file_management_service.py
@@ -1,20 +1,33 @@
 import asyncio
+import hashlib
 import logging
 import os
 from io import BytesIO
 from pathlib import Path
-from typing import List, Optional
+from typing import List, Optional, Tuple
 
+import httpx
 from fastapi import UploadFile
 
-from consts.const import UPLOAD_FOLDER, MAX_CONCURRENT_UPLOADS, MODEL_CONFIG_MAPPING
+from consts.const import (
+    DATA_PROCESS_SERVICE,
+    FILE_PREVIEW_SIZE_LIMIT,
+    MAX_CONCURRENT_UPLOADS,
+    MODEL_CONFIG_MAPPING,
+    OFFICE_MIME_TYPES,
+    UPLOAD_FOLDER,
+)
+from consts.exceptions import FileTooLargeException, NotFoundException, OfficeConversionException, UnsupportedFileTypeException
 from database.attachment_db import (
-    upload_fileobj,
-    get_file_url,
+    copy_file,
+    delete_file,
+    file_exists,
     get_content_type,
+    get_file_size_from_minio,
     get_file_stream,
-    delete_file,
-    list_files
+    get_file_url,
+    list_files,
+    upload_fileobj,
 )
 from services.vectordatabase_service import ElasticSearchService, get_vector_db_core
 from utils.config_utils import tenant_config_manager, get_model_name_from_config
@@ -28,6 +41,10 @@
 upload_dir.mkdir(exist_ok=True)
 upload_semaphore = asyncio.Semaphore(MAX_CONCURRENT_UPLOADS)
 
+# Per-file locks prevent duplicate conversions of the same file
+_conversion_locks: dict[str, asyncio.Lock] = {}
+_conversion_locks_guard = asyncio.Lock()
+
 logger = logging.getLogger("file_management_service")
 
 
@@ -195,4 +212,134 @@ def get_llm_model(tenant_id: str):
         max_context_tokens=main_model_config.get("max_tokens"),
         ssl_verify=main_model_config.get("ssl_verify", True),
     )
-    return long_text_to_text_model
\ No newline at end of file
+    return long_text_to_text_model
+
+
+async def preview_file_impl(object_name: str) -> Tuple[BytesIO, str]:
+    """
+    Preview a file by returning its contents as a stream.
+
+    Args:
+        object_name: File object name in storage
+
+    Returns:
+        Tuple[BytesIO, str]: (file_stream, content_type)
+    """
+    file_size = get_file_size_from_minio(object_name)
+    if file_size > FILE_PREVIEW_SIZE_LIMIT:
+        raise FileTooLargeException(
+            f"File size {file_size} bytes exceeds the {FILE_PREVIEW_SIZE_LIMIT // (1024 * 1024)} MB preview limit"
+        )
+
+    content_type = get_content_type(object_name)
+
+    # PDF, images, and text files - return directly
+    if content_type == 'application/pdf' or content_type.startswith('image/') or content_type in ['text/plain', 'text/csv', 'text/markdown']:
+        file_stream = get_file_stream(object_name)
+        if file_stream is None:
+            raise NotFoundException("File not found or failed to read from storage")
+        return file_stream, content_type
+
+    # Office documents - convert to PDF with caching
+    elif content_type in OFFICE_MIME_TYPES:
+        name_without_ext = object_name.rsplit('.', 1)[0] if '.' in object_name else object_name
+        hash_suffix = hashlib.md5(object_name.encode()).hexdigest()[:8]
+        pdf_object_name = f"preview/converted/{name_without_ext}_{hash_suffix}.pdf"
+        temp_pdf_object_name = f"preview/converting/{name_without_ext}_{hash_suffix}.pdf.tmp"
+
+        # Fast path: return from cache without acquiring any lock
+        cached_stream = _get_cached_pdf_stream(pdf_object_name)
+        if cached_stream is not None:
+            return cached_stream, 'application/pdf'
+
+        # Slow path: convert with locking
+        file_stream = await _convert_office_to_cached_pdf(object_name, pdf_object_name, temp_pdf_object_name)
+        return file_stream, 'application/pdf'
+
+    # Unsupported file type
+    else:
+        raise UnsupportedFileTypeException(f"Unsupported file type for preview: {content_type}")
+
+
+def _get_cached_pdf_stream(pdf_object_name: str) -> Optional[BytesIO]:
+    """
+    Return the cached PDF stream if available, or None if missing or corrupted.
+
+    If the file exists but cannot be read, the corrupted entry is deleted so
+    a subsequent call will trigger a fresh conversion.
+    """
+    if file_exists(pdf_object_name):
+        file_stream = get_file_stream(pdf_object_name)
+        if file_stream is None:
+            logger.warning(f"Corrupted cache detected (cannot read), deleting: {pdf_object_name}")
+            delete_file(pdf_object_name)
+            return None
+        return file_stream
+    return None
+
+
+async def _convert_office_to_cached_pdf(
+    object_name: str,
+    pdf_object_name: str,
+    temp_pdf_object_name: str,
+) -> BytesIO:
+    """
+    Convert an Office document to PDF and store the result in MinIO.
+
+    Args:
+        object_name: Source Office file path in MinIO
+        pdf_object_name: Final cached PDF path in MinIO
+        temp_pdf_object_name: Temporary PDF path used during conversion
+
+    Returns:
+        BytesIO stream of the converted PDF
+    """
+    # Get or create a lock for this specific file to prevent duplicate conversions
+    async with _conversion_locks_guard:
+        if object_name not in _conversion_locks:
+            _conversion_locks[object_name] = asyncio.Lock()
+        file_lock = _conversion_locks[object_name]
+
+    try:
+        async with file_lock:
+            # Double-check: another request may have completed the conversion while we waited
+            cached_stream = _get_cached_pdf_stream(pdf_object_name)
+            if cached_stream is not None:
+                return cached_stream
+
+            # Conversion semaphore is enforced inside the data-process service
+            try:
+                # Request conversion: data-process downloads, converts, uploads to temp path, validates
+                async with httpx.AsyncClient(timeout=120.0) as client:
+                    response = await client.post(
+                        f"{DATA_PROCESS_SERVICE}/tasks/convert_to_pdf",
+                        data={
+                            "object_name": object_name,
+                            "pdf_object_name": temp_pdf_object_name,
+                        },
+                    )
+                if response.status_code != 200:
+                    raise Exception(
+                        f"data-process conversion returned {response.status_code}: {response.text}"
+                    )
+
+                # Atomic move from temp to final location, then clean up temp
+                copy_result = copy_file(source_object=temp_pdf_object_name, dest_object=pdf_object_name)
+                if not copy_result.get('success'):
+                    raise Exception(f"Failed to finalize PDF cache: {copy_result.get('error', 'Unknown error')}")
+                delete_file(temp_pdf_object_name)
+
+            except Exception as e:
+                if file_exists(temp_pdf_object_name):
+                    delete_file(temp_pdf_object_name)
+                logger.error(f"Office conversion failed: {str(e)}")
+                raise OfficeConversionException(f"Failed to convert Office document to PDF: {str(e)}") from e
+    finally:
+        # Clean up the file lock (prevents memory leak for many unique files)
+        async with _conversion_locks_guard:
+            _conversion_locks.pop(object_name, None)
+
+    file_stream = get_file_stream(pdf_object_name)
+    if file_stream is None:
+        raise NotFoundException("Converted PDF not found or failed to read from storage")
+    return file_stream
diff --git a/backend/services/idata_service.py b/backend/services/idata_service.py
new file mode 100644
index 000000000..691130dc0
--- /dev/null
+++ b/backend/services/idata_service.py
@@ -0,0 +1,359 @@
+"""
+iData Service Layer
+Handles API calls to iData for knowledge space operations.
+
+This service layer provides functionality to interact with iData's API,
+including fetching knowledge spaces and transforming responses
+to a format compatible with the frontend.
+"""
+import json
+import logging
+from typing import Any, Dict, List
+
+import httpx
+
+from consts.error_code import ErrorCode
+from consts.exceptions import AppException
+from nexent.utils.http_client_manager import http_client_manager
+
+logger = logging.getLogger("idata_service")
+
+
+def _validate_idata_base_params(
+        idata_api_base: str,
+        api_key: str,
+        user_id: str,
+) -> None:
+    """
+    Validate common iData API parameters.
+
+    Args:
+        idata_api_base: iData API base URL
+        api_key: iData API key
+        user_id: iData user ID
+
+    Raises:
+        AppException: If any parameter is invalid
+    """
+    if not idata_api_base or not isinstance(idata_api_base, str):
+        raise AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            "iData API URL is required and must be a non-empty string"
+        )
+
+    if not (idata_api_base.startswith("http://") or idata_api_base.startswith("https://")):
+        raise AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            "iData API URL must start with http:// or https://"
+        )
+
+    if not api_key or not isinstance(api_key, str):
+        raise AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            "iData API key is required and must be a non-empty string"
+        )
+
+    if not user_id or not isinstance(user_id, str):
+        raise AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            "iData user ID is required and must be a non-empty string"
+        )
+
+
+def _normalize_api_base(idata_api_base: str) -> str:
+    """
+    Normalize API base URL by removing trailing slash.
+
+    Args:
+        idata_api_base: iData API base URL
+
+    Returns:
+        Normalized API base URL
+    """
+    return idata_api_base.rstrip("/")
+
+
+def _make_idata_request(
+        api_base: str,
+        url: str,
+        headers: Dict[str, str],
+        request_body: Dict[str, Any],
+) -> Dict[str, Any]:
+    """
+    Make HTTP POST request to iData API and handle common errors.
+
+    Args:
+        api_base: Normalized API base URL
+        url: Full request URL
+        headers: Request headers
+        request_body: Request body as dictionary
+
+    Returns:
+        Parsed JSON response
+
+    Raises:
+        AppException: If request fails or response is invalid
+    """
+    logger.info(f"Making iData API request to: {url}")
+
+    try:
+        # Use shared HttpClientManager for connection pooling
+        # Note: ssl_verify is set to False as per requirement (self-signed certificate)
+        client = http_client_manager.get_sync_client(
+            base_url=api_base,
+            timeout=10.0,
+            verify_ssl=False
+        )
+        response = client.post(url, headers=headers, json=request_body)
+        response.raise_for_status()
+
+        return response.json()
+
+    except httpx.RequestError as e:
+        logger.error(f"iData API request failed: {str(e)}")
+        raise AppException(
+            ErrorCode.IDATA_CONNECTION_ERROR,
+            f"iData API request failed: {str(e)}"
+        )
+    except httpx.HTTPStatusError as e:
+        logger.error(
+            f"iData API HTTP error: {str(e)}, status_code: {e.response.status_code}")
+        # Map HTTP status to specific error code
+        if e.response.status_code == 401:
+            logger.error("Raising IDATA_AUTH_ERROR for 401 error")
+            raise AppException(
+                ErrorCode.IDATA_AUTH_ERROR,
+                f"iData authentication failed: {str(e)}"
+            )
+        elif e.response.status_code == 403:
+            logger.error("Raising IDATA_AUTH_ERROR for 403 error")
+            raise AppException(
+                ErrorCode.IDATA_AUTH_ERROR,
+                f"iData access forbidden: {str(e)}"
+            )
+        elif e.response.status_code == 429:
+            logger.error("Raising IDATA_RATE_LIMIT for 429 error")
+            raise AppException(
+                ErrorCode.IDATA_RATE_LIMIT,
+                f"iData API rate limit exceeded: {str(e)}"
+            )
+        else:
+            logger.error(
+                f"Raising IDATA_SERVICE_ERROR for status {e.response.status_code}")
+            raise AppException(
+                ErrorCode.IDATA_SERVICE_ERROR,
+                f"iData API HTTP error {e.response.status_code}: {str(e)}"
+            )
+    except json.JSONDecodeError as e:
+        logger.error(f"Failed to parse iData API response: {str(e)}")
+        raise AppException(
+            ErrorCode.IDATA_RESPONSE_ERROR,
+            f"Failed to parse iData API response: {str(e)}"
+        )
+
+
+def _parse_idata_response(result: Dict[str, Any]) -> List[Dict[str, Any]]:
+    """
+    Parse iData API response and validate format.
+
+    Args:
+        result: Parsed JSON response from iData API
+
+    Returns:
+        List of data items from response
+
+    Raises:
+        AppException: If response format is invalid
+    """
+    # Expected format: {"code": "1", "msg": "...", "data": [...], "msgParams": null}
+    code = result.get("code", "")
+    if code != "1":
+        msg = result.get("msg", "Unknown error")
+        logger.error(
+            f"iData API returned error code: {code}, message: {msg}")
+        raise AppException(
+            ErrorCode.IDATA_SERVICE_ERROR,
+            f"iData API error: {msg}"
+        )
+
+    data = result.get("data", [])
+    if not isinstance(data, list):
+        logger.error(
+            f"Unexpected iData API response format: data is not a list")
+        raise AppException(
+            ErrorCode.IDATA_RESPONSE_ERROR,
+            "Unexpected iData API response format: data is not a list"
+        )
+
+    return data
+
+
+def fetch_idata_knowledge_spaces_impl(
+        idata_api_base: str,
+        api_key: str,
+        user_id: str,
+) -> List[Dict[str, str]]:
+    """
+    Fetch knowledge spaces from iData API.
+
+    Args:
+        idata_api_base: iData API base URL
+        api_key: iData API key with Bearer token
+        user_id: iData user ID
+
+    Returns:
+        List of dictionaries containing knowledge spaces with id and name:
+        [
+            {
+                "id": "6cbf949946bf4b769c073259406b04f8",
+                "name": "test1"
+            },
+            ...
+        ]
+
+    Raises:
+        AppException: If API request fails or response is invalid
+    """
+    # Validate inputs
+    _validate_idata_base_params(idata_api_base, api_key, user_id)
+
+    # Normalize API base URL
+    api_base = _normalize_api_base(idata_api_base)
+
+    # Build request URL
+    url = f"{api_base}/apiaccess/modelmate/north/machine/v1/knowledgeSpaces/query"
+
+    headers = {
+        "Authorization": f"Bearer {api_key}",
+        "Content-Type": "application/json"
+    }
+
+    # Request body
+    request_body = {
+        "userId": user_id
+    }
+
+    # Make request and parse response
+    result = _make_idata_request(api_base, url, headers, request_body)
+    data = _parse_idata_response(result)
+
+    # Extract id and name from each knowledge space
+    knowledge_spaces = []
+    for item in data:
+        if not isinstance(item, dict):
+            continue
+
+        space_id = item.get("id")
+        space_name = item.get("name")
+
+        if space_id and space_name:
+            knowledge_spaces.append({
+                "id": str(space_id),
+                "name": str(space_name)
+            })
+
+    return knowledge_spaces
+
+
+def fetch_idata_datasets_impl(
+        idata_api_base: str,
+        api_key: str,
+        user_id: str,
+        knowledge_space_id: str,
+) -> Dict[str, Any]:
+    """
+    Fetch datasets (knowledge bases) from iData API and transform to DataMate-compatible format.
+
+    Args:
+        idata_api_base: iData API base URL
+        api_key: iData API key with Bearer token
+        user_id: iData user ID
+        knowledge_space_id: Knowledge space ID
+
+    Returns:
+        Dictionary containing knowledge bases in DataMate-compatible format:
+        {
+            "indices": ["dataset_id_1", "dataset_id_2", ...],
+            "count": 2,
+            "indices_info": [
+                {
+                    "name": "dataset_id_1",
+                    "display_name": "知识库名称",
+                    "stats": {
+                        "base_info": {
+                            "doc_count": 10,
+                            "process_source": "iData"
+                        }
+                    }
+                },
+                ...
+            ]
+        }
+
+    Raises:
+        AppException: If API request fails or response is invalid
+    """
+    # Validate inputs
+    _validate_idata_base_params(idata_api_base, api_key, user_id)
+
+    if not knowledge_space_id or not isinstance(knowledge_space_id, str):
+        raise AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            "Knowledge space ID is required and must be a non-empty string"
+        )
+
+    # Normalize API base URL
+    api_base = _normalize_api_base(idata_api_base)
+
+    # Build request URL
+    url = f"{api_base}/apiaccess/modelmate/north/machine/v1/knowledgeBases/query"
+
+    headers = {
+        "Authorization": f"Bearer {api_key}",
+        "Content-Type": "application/json"
+    }
+
+    # Request body
+    request_body = {
+        "userId": user_id,
+        "knowledgeSpaceId": knowledge_space_id
+    }
+
+    # Make request and parse response
+    result = _make_idata_request(api_base, url, headers, request_body)
+    data = _parse_idata_response(result)
+
+    # Transform to DataMate-compatible format
+    indices = []
+    indices_info = []
+
+    for knowledge_base in data:
+        if not isinstance(knowledge_base, dict):
+            continue
+
+        kb_id = knowledge_base.get("id", "")
+        kb_name = knowledge_base.get("name", "")
+        file_count = knowledge_base.get("fileCount", 0)
+
+        if not kb_id:
+            continue
+
+        indices.append(kb_id)
+
+        # Create indices_info entry (compatible with DataMate format)
+        indices_info.append({
+            "name": kb_id,
+            "display_name": kb_name,
+            "stats": {
+                "base_info": {
+                    "doc_count": file_count,
+                    "process_source": "iData"
+                }
+            }
+        })
+
+    return {
+        "indices": indices,
+        "count": len(indices),
+        "indices_info": indices_info
+    }
diff --git a/backend/services/model_management_service.py b/backend/services/model_management_service.py
index 4b8265028..a18c16c36 100644
--- a/backend/services/model_management_service.py
+++ b/backend/services/model_management_service.py
@@ -3,7 +3,7 @@
 
 from consts.const import LOCALHOST_IP, LOCALHOST_NAME, DOCKER_INTERNAL_HOST
 from consts.model import ModelConnectStatusEnum
-from consts.provider import ProviderEnum, SILICON_BASE_URL
+from consts.provider import ProviderEnum, SILICON_BASE_URL, DASHSCOPE_BASE_URL, TOKENPONY_BASE_URL
 
 from database.model_management_db import (
     create_model_record,
@@ -142,6 +142,10 @@ async def batch_create_models_for_tenant(user_id: str, tenant_id: str, batch_pay
         elif provider == ProviderEnum.MODELENGINE.value:
             # ModelEngine models carry their own base_url in each model dict
             model_url = ""
+        elif provider == ProviderEnum.DASHSCOPE.value:
+            model_url = DASHSCOPE_BASE_URL
+        elif provider == ProviderEnum.TOKENPONY.value:
+            model_url = TOKENPONY_BASE_URL
         else:
             model_url = ""
 
diff --git a/backend/services/model_provider_service.py b/backend/services/model_provider_service.py
index a302eb999..8c397dc70 100644
--- a/backend/services/model_provider_service.py
+++ b/backend/services/model_provider_service.py
@@ -11,6 +11,8 @@
 from services.model_health_service import embedding_dimension_check
 from services.providers.base import AbstractModelProvider
 from services.providers.silicon_provider import SiliconModelProvider
+from services.providers.tokenpony_provider import TokenPonyModelProvider
+from services.providers.dashscope_provider import DashScopeModelProvider
 from services.providers.modelengine_provider import ModelEngineProvider, get_model_engine_raw_url, MODEL_ENGINE_NORTH_PREFIX
 from utils.model_name_utils import split_repo_name, add_repo_to_name
 
@@ -40,6 +42,12 @@ async def get_provider_models(model_data: dict) -> List[dict]:
     elif model_data["provider"] == ProviderEnum.MODELENGINE.value:
         provider = ModelEngineProvider()
         model_list = await provider.get_models(model_data)
+    elif model_data["provider"] == ProviderEnum.DASHSCOPE.value:
+        provider = DashScopeModelProvider()
+        model_list = await provider.get_models(model_data)
+    elif model_data["provider"] == ProviderEnum.TOKENPONY.value:
+        provider = TokenPonyModelProvider()
+        model_list = await provider.get_models(model_data)
 
     return model_list
 
@@ -117,7 +125,8 @@ async def prepare_model_dict(provider: str, model: dict, model_url: str, model_a
     # dimension by performing a real connectivity check.
     if model["model_type"] in ["embedding", "multi_embedding"]:
         if provider != ProviderEnum.MODELENGINE.value:
-            model_dict["base_url"] = f"{model_url}embeddings"
+            # Ensure proper slash between base URL and endpoint
+            model_dict["base_url"] = f"{model_url.rstrip('/')}/embeddings"
         else:
             # For ModelEngine embedding models, append the embeddings path
             model_dict["base_url"] = f"{model_url.rstrip('/')}/{MODEL_ENGINE_NORTH_PREFIX}/embeddings"
diff --git a/backend/services/northbound_service.py b/backend/services/northbound_service.py
index 6f9164269..a6eaed77d 100644
--- a/backend/services/northbound_service.py
+++ b/backend/services/northbound_service.py
@@ -13,11 +13,7 @@
 )
 from consts.model import AgentRequest
 from database.conversation_db import get_conversation_messages
-from database.partner_db import (
-    add_mapping_id,
-    get_external_id_by_internal,
-    get_internal_id_by_external
-)
+from database.token_db import log_token_usage, get_latest_usage_metadata
 from services.agent_service import (
     run_agent_stream,
     stop_agent_tasks,
@@ -40,6 +36,7 @@ class NorthboundContext:
     tenant_id: str
     user_id: str
     authorization: str
+    token_id: int = 0
 
 
 # -----------------------------
@@ -114,26 +111,6 @@ def _build_idempotency_key(*parts: Any) -> str:
     return ":".join(processed)
 
 
-# -----------------------------
-# ID mapping helpers
-# -----------------------------
-async def to_external_conversation_id(internal_id: int) -> str:
-    if not internal_id:
-        raise Exception("invalid internal conversation id")
-    external_id = get_external_id_by_internal(internal_id=internal_id, mapping_type="CONVERSATION")
-    if not external_id:
-        logger.error(f"cannot find external id for conversation_id: {internal_id}")
-        raise Exception("cannot find external id")
-    return external_id
-
-
-async def to_internal_conversation_id(external_id: str) -> int:
-    if not external_id:
-        raise Exception("invalid external conversation id")
-    internal_id = get_internal_id_by_external(external_id=external_id, mapping_type="CONVERSATION")
-    return internal_id
-
-
 # -----------------------------
 # Agent resolver
 # -----------------------------
@@ -146,30 +123,30 @@ async def get_agent_info_by_name(agent_name: str, tenant_id: str) -> int:
 
 async def start_streaming_chat(
     ctx: NorthboundContext,
-    external_conversation_id: str,
+    conversation_id: Optional[int],
     agent_name: str,
     query: str,
+    meta_data: Optional[Dict[str, Any]] = None,
     idempotency_key: Optional[str] = None
 ) -> StreamingResponse:
     try:
         # Simple rate limit
         await check_and_consume_rate_limit(ctx.tenant_id)
 
-        internal_conversation_id = await to_internal_conversation_id(external_conversation_id)
-        # Add mapping to postgres database
-        if internal_conversation_id is None:
-            logging.info(f"Conversation {external_conversation_id} not found, creating a new conversation")
-            # Create a new conversation and get its internal ID
+        # If conversation_id is not provided, create a new conversation
+        if conversation_id is None:
+            logging.info("No conversation_id provided, creating a new conversation")
             new_conversation = create_new_conversation(title="New Conversation", user_id=ctx.user_id)
-            internal_conversation_id = new_conversation["conversation_id"]
-            # Add the new mapping to the database
-            add_mapping_id(internal_id=internal_conversation_id, external_id=external_conversation_id, tenant_id=ctx.tenant_id, user_id=ctx.user_id)
+            conversation_id = new_conversation["conversation_id"]
+            logging.info(f"Created new conversation with id: {conversation_id}")
+
+        internal_conversation_id = conversation_id
 
         # Get history according to internal_conversation_id
-        history_resp = await get_conversation_history(ctx, external_conversation_id)
+        history_resp = await get_conversation_history_internal(ctx, internal_conversation_id)
         agent_id = await get_agent_id_by_name(agent_name=agent_name, tenant_id=ctx.tenant_id)
         # Idempotency: only prevent concurrent duplicate starts
-        composed_key = idempotency_key or _build_idempotency_key(ctx.tenant_id, external_conversation_id, agent_id, query)
+        composed_key = idempotency_key or _build_idempotency_key(ctx.tenant_id, str(conversation_id), agent_id, query)
         await idempotency_start(composed_key)
         agent_request = AgentRequest(
             conversation_id=internal_conversation_id,
@@ -192,7 +169,7 @@ async def start_streaming_chat(
     except UnauthorizedError as _:
         raise UnauthorizedError("Cannot authenticate.")
     except Exception as e:
-        raise Exception(f"Failed to start streaming chat for external conversation id {external_conversation_id}: {str(e)}")
+        raise Exception(f"Failed to start streaming chat for conversation_id {conversation_id}: {str(e)}")
 
     try:
         response = await run_agent_stream(
@@ -207,34 +184,82 @@ async def start_streaming_chat(
         if composed_key:
             asyncio.create_task(_release_idempotency_after_delay(composed_key))
 
-    # Attach request id header
+    # Log token usage
+    if ctx.token_id > 0:
+        try:
+            log_token_usage(
+                token_id=ctx.token_id,
+                call_function_name="run_chat",
+                related_id=conversation_id,
+                created_by=ctx.user_id,
+                metadata=meta_data
+            )
+        except Exception as e:
+            logger.warning(f"Failed to log token usage: {str(e)}")
+
+    # Attach request id header and conversation_id (internal id)
     response.headers["X-Request-Id"] = ctx.request_id
-    response.headers["conversation_id"] = external_conversation_id
+    response.headers["conversation_id"] = str(conversation_id)
     return response
 
 
-async def stop_chat(ctx: NorthboundContext, external_conversation_id: str) -> Dict[str, Any]:
+async def stop_chat(ctx: NorthboundContext, conversation_id: int, meta_data: Optional[Dict[str, Any]] = None) -> Dict[str, Any]:
     try:
-        internal_id = await to_internal_conversation_id(external_conversation_id)
-
-        stop_result = stop_agent_tasks(internal_id, ctx.user_id)
-        return {"message": stop_result.get("message", "success"), "data": external_conversation_id, "requestId": ctx.request_id}
+        stop_result = stop_agent_tasks(conversation_id, ctx.user_id)
+
+        # Log token usage
+        if ctx.token_id > 0:
+            try:
+                log_token_usage(
+                    token_id=ctx.token_id,
+                    call_function_name="stop_chat_stream",
+                    related_id=conversation_id,
+                    created_by=ctx.user_id,
+                    metadata=meta_data
+                )
+            except Exception as e:
+                logger.warning(f"Failed to log token usage: {str(e)}")
+
+        return {"message": stop_result.get("message", "success"), "data": conversation_id, "requestId": ctx.request_id}
     except Exception as e:
-        raise Exception(f"Failed to stop chat for external conversation id {external_conversation_id}: {str(e)}")
+        raise Exception(f"Failed to stop chat for conversation_id {conversation_id}: {str(e)}")
 
 
 async def list_conversations(ctx: NorthboundContext) -> Dict[str, Any]:
     conversations = get_conversation_list_service(ctx.user_id)
     # get_conversation_list_service is sync
-    for item in conversations:
-        item["conversation_id"] = await to_external_conversation_id(int(item["conversation_id"]))
-    return {"message": "success", "data": conversations, "requestId": ctx.request_id}
 
+    # Add meta_data from token usage log if available
+    if ctx.token_id > 0:
+        for item in conversations:
+            # Ensure we do not leak empty meta_data keys
+            if "meta_data" in item and not item.get("meta_data"):
+                item.pop("meta_data", None)
+
+            conversation_id = item.get("conversation_id")
+            if conversation_id:
+                try:
+                    meta_data = get_latest_usage_metadata(
+                        token_id=ctx.token_id,
+                        related_id=int(conversation_id),
+                        call_function_name="run_chat"
+                    )
+                    # Only return meta_data when there is a usage log record and meta_data is non-empty
+                    if meta_data:
+                        item["meta_data"] = meta_data
+                    else:
+                        item.pop("meta_data", None)
+                except Exception as e:
+                    logger.warning(f"Failed to get meta_data for conversation {conversation_id}: {str(e)}")
+                    item.pop("meta_data", None)
+
+    # Now return internal conversation_id directly
+    return {"message": "success", "data": conversations, "requestId": ctx.request_id}
 
-async def get_conversation_history(ctx: NorthboundContext, external_conversation_id: str) -> Dict[str, Any]:
-    internal_id = await to_internal_conversation_id(external_conversation_id)
 
-    history = get_conversation_messages(internal_id)
+async def get_conversation_history_internal(ctx: NorthboundContext, conversation_id: int) -> Dict[str, Any]:
+    """Internal helper to get conversation history without logging."""
+    history = get_conversation_messages(conversation_id)
     # Remove unnecessary fields
     result = []
     for message in history:
@@ -244,44 +269,63 @@ async def get_conversation_history(ctx: NorthboundContext, external_conversation
         })
 
     response = {
-        "conversation_id": external_conversation_id,
+        "conversation_id": conversation_id,
         "history": result
     }
-    # Ensure external id in response
     return {"message": "success", "data": response, "requestId": ctx.request_id}
 
 
+async def get_conversation_history(ctx: NorthboundContext, conversation_id: int) -> Dict[str, Any]:
+    try:
+        return await get_conversation_history_internal(ctx, conversation_id)
+    except Exception as e:
+        raise Exception(f"Failed to get conversation history for conversation_id {conversation_id}: {str(e)}")
+
+
 async def get_agent_info_list(ctx: NorthboundContext) -> Dict[str, Any]:
     try:
-        agent_info_list = await list_all_agent_info_impl(tenant_id=ctx.tenant_id)
+        agent_info_list = await list_all_agent_info_impl(tenant_id=ctx.tenant_id, user_id=ctx.user_id)
         # Remove internal information that partner don't need
         for agent_info in agent_info_list:
             agent_info.pop("agent_id", None)
+
         return {"message": "success", "data": agent_info_list, "requestId": ctx.request_id}
     except Exception as e:
         raise Exception(f"Failed to get agent info list for tenant {ctx.tenant_id}: {str(e)}")
 
 
-async def update_conversation_title(ctx: NorthboundContext, external_conversation_id: str, title: str, idempotency_key: Optional[str] = None) -> Dict[str, Any]:
+async def update_conversation_title(ctx: NorthboundContext, conversation_id: int, title: str, meta_data: Optional[Dict[str, Any]] = None, idempotency_key: Optional[str] = None) -> Dict[str, Any]:
     composed_key: Optional[str] = None
     try:
-        internal_id = await to_internal_conversation_id(external_conversation_id)
-
         # Idempotency: avoid concurrent duplicate title update for same conversation
-        composed_key = idempotency_key or _build_idempotency_key(ctx.tenant_id, external_conversation_id, title)
+        composed_key = idempotency_key or _build_idempotency_key(ctx.tenant_id, str(conversation_id), title)
         await idempotency_start(composed_key)
 
-        update_conversation_title_service(internal_id, title, ctx.user_id)
+        update_conversation_title_service(conversation_id, title, ctx.user_id)
+
+        # Log token usage
+        if ctx.token_id > 0:
+            try:
+                log_token_usage(
+                    token_id=ctx.token_id,
+                    call_function_name="update_conversation_title",
+                    related_id=conversation_id,
+                    created_by=ctx.user_id,
+                    metadata=meta_data
+                )
+            except Exception as e:
+                logger.warning(f"Failed to log token usage: {str(e)}")
+
         return {
             "message": "success",
-            "data": external_conversation_id,
+            "data": conversation_id,
             "requestId": ctx.request_id,
             "idempotency_key": composed_key,
         }
     except LimitExceededError as _:
         raise LimitExceededError("Duplicate request is still running, please wait.")
     except Exception as e:
-        raise Exception(f"Failed to update conversation title for external conversation id {external_conversation_id}: {str(e)}")
+        raise Exception(f"Failed to update conversation title for conversation_id {conversation_id}: {str(e)}")
     finally:
         if composed_key:
             asyncio.create_task(_release_idempotency_after_delay(composed_key))
diff --git a/backend/services/prompt_service.py b/backend/services/prompt_service.py
index a505f28f4..3706c3cc5 100644
--- a/backend/services/prompt_service.py
+++ b/backend/services/prompt_service.py
@@ -7,8 +7,10 @@
 from jinja2 import StrictUndefined, Template
 
 from consts.const import LANGUAGE
-from consts.model import AgentInfoRequest
-from database.agent_db import update_agent, search_agent_info_by_agent_id, query_all_agent_info_by_tenant_id, \
+from consts.error_code import ErrorCode
+from consts.error_message import ErrorMessage
+from consts.exceptions import AppException
+from database.agent_db import search_agent_info_by_agent_id, query_all_agent_info_by_tenant_id, \
     query_sub_agents_id_list
 from database.tool_db import query_tools_by_ids
 from services.agent_service import (
@@ -28,18 +30,30 @@
 
 
 def gen_system_prompt_streamable(agent_id: int, model_id: int, task_description: str, user_id: str, tenant_id: str, language: str, tool_ids: Optional[List[int]] = None, sub_agent_ids: Optional[List[int]] = None):
-    for system_prompt in generate_and_save_system_prompt_impl(
-        agent_id=agent_id,
-        model_id=model_id,
-        task_description=task_description,
-        user_id=user_id,
-        tenant_id=tenant_id,
-        language=language,
-        tool_ids=tool_ids,
-        sub_agent_ids=sub_agent_ids
-    ):
-        # SSE format, each message ends with \n\n
-        yield f"data: {json.dumps({'success': True, 'data': system_prompt}, ensure_ascii=False)}\n\n"
+    try:
+        for system_prompt in generate_and_save_system_prompt_impl(
+            agent_id=agent_id,
+            model_id=model_id,
+            task_description=task_description,
+            user_id=user_id,
+            tenant_id=tenant_id,
+            language=language,
+            tool_ids=tool_ids,
+            sub_agent_ids=sub_agent_ids
+        ):
+            # SSE format, each message ends with \n\n
+            yield f"data: {json.dumps({'success': True, 'data': system_prompt}, ensure_ascii=False)}\n\n"
+    except Exception as e:
+        # Catch model unavailable or other errors and return error through SSE
+        logger.error(f"Error generating prompt: {e}")
+        # Use original error code if it's an AppException, otherwise use default
+        if isinstance(e, AppException):
+            error_code = e.error_code
+            error_message = e.message
+        else:
+            error_code = ErrorCode.MODEL_PROMPT_GENERATION_FAILED
+            error_message = ErrorMessage.get_message(error_code)
+        yield f"data: {json.dumps({'success': False, 'error': {'code': error_code.value, 'message': error_message}}, ensure_ascii=False)}\n\n"
 
 
 def generate_and_save_system_prompt_impl(agent_id: int,
@@ -200,6 +214,14 @@ def generate_and_save_system_prompt_impl(agent_id: int,
             "Updating agent with business_description and prompt segments")
         logger.info("Prompt generation and agent update completed successfully")
 
+    # Check if any content was generated - if all fields are empty, model likely failed
+    all_fields = ["duty", "constraint", "few_shots",
+                  "agent_var_name", "agent_display_name", "agent_description"]
+    has_content = any(final_results.get(field, "").strip()
+                      for field in all_fields)
+    if not has_content:
+        raise Exception("Failed to generate prompt content.")
+
 
 def generate_system_prompt(sub_agent_info_list, task_description, tool_info_list, tenant_id: str, model_id: int, language: str = LANGUAGE["ZH"]):
     """Main function for generating system prompts"""
@@ -222,15 +244,18 @@ def generate_system_prompt(sub_agent_info_list, task_description, tool_info_list
                   "agent_var_name": False, "agent_display_name": False, "agent_description": False}
 
     # Start all generation threads
-    threads = _start_generation_threads(
+    threads, error_holder = _start_generation_threads(
         content, prompt_for_generate, produce_queue, latest, stop_flags, tenant_id, model_id)
 
     # Stream results
-    yield from _stream_results(produce_queue, latest, stop_flags, threads)
+    yield from _stream_results(produce_queue, latest, stop_flags, threads, error_holder)
 
 
 def _start_generation_threads(content, prompt_for_generate, produce_queue, latest, stop_flags, tenant_id, model_id):
     """Start all prompt generation threads"""
+    # Shared error tracking across threads
+    error_holder = {"error": None}
+
     def make_callback(tag):
         def callback_fn(current_text):
             latest[tag] = current_text
@@ -243,6 +268,7 @@ def run_and_flag(tag, sys_prompt):
                 model_id, content, sys_prompt, make_callback(tag), tenant_id)
         except Exception as e:
             logger.error(f"Error in {tag} generation: {e}")
+            error_holder["error"] = e
         finally:
             stop_flags[tag] = True
 
@@ -266,10 +292,10 @@ def run_and_flag(tag, sys_prompt):
         thread.start()
         threads.append(thread)
 
-    return threads
+    return threads, error_holder
 
 
-def _stream_results(produce_queue, latest, stop_flags, threads):
+def _stream_results(produce_queue, latest, stop_flags, threads, error_holder):
     """Stream prompt generation results"""
 
     # Real-time streaming output for the first three sections
@@ -277,6 +303,13 @@ def _stream_results(produce_queue, latest, stop_flags, threads):
                     "agent_var_name": "", "agent_display_name": "", "agent_description": ""}
 
     while not all(stop_flags.values()):
+        # Check if error occurred in any thread - raise immediately
+        if error_holder.get("error"):
+            # Wait for threads to finish
+            for thread in threads:
+                thread.join(timeout=5)
+            raise error_holder["error"]
+
         try:
             produce_queue.get(timeout=0.5)
         except queue.Empty:
@@ -293,6 +326,10 @@ def _stream_results(produce_queue, latest, stop_flags, threads):
                 yield result_data
                 last_results[tag] = latest[tag]
 
+    # Check if error occurred before final output
+    if error_holder.get("error"):
+        raise error_holder["error"]
+
     # Wait for all threads to complete
     for thread in threads:
         thread.join(timeout=5)
diff --git a/backend/services/providers/dashscope_provider.py b/backend/services/providers/dashscope_provider.py
new file mode 100644
index 000000000..4ecbcbb1d
--- /dev/null
+++ b/backend/services/providers/dashscope_provider.py
@@ -0,0 +1,132 @@
+import httpx
+from typing import Dict, List
+import asyncio
+from consts.const import DEFAULT_LLM_MAX_TOKENS
+from consts.provider import DASHSCOPE_GET_URL
+from services.providers.base import AbstractModelProvider, _classify_provider_error
+
+
+class DashScopeModelProvider(AbstractModelProvider):
+    """Concrete implementation for DashScope (Aliyun) provider."""
+
+    async def get_models(self, provider_config: Dict) -> List[Dict]:
+        """
+        Fetch models from DashScope API, categorize them, and return
+        the requested model type.
+
+        Args:
+            provider_config: Configuration dict containing model_type and api_key
+
+        Returns:
+            List of models with canonical fields. Returns error dict if API call fails.
+        """
+        try:
+            target_model_type: str = provider_config["model_type"]
+            model_api_key: str = provider_config["api_key"]
+
+            headers = {"Authorization": f"Bearer {model_api_key}"}
+            base_url = DASHSCOPE_GET_URL
+
+            all_models: List[Dict] = []
+            current_page = 1
+
+            # Fetch all models with pagination asynchronously
+            async with httpx.AsyncClient(verify=False) as client:
+                while True:
+                    params = {"page_size": 100, "page_no": current_page}
+                    response = await client.get(base_url, headers=headers, params=params)
+                    if response.status_code == 429:
+                        await asyncio.sleep(2)
+                        continue
+                    response.raise_for_status()
+
+                    data = response.json()
+                    models = data.get("output", {}).get("models", [])
+
+                    # Break loop if no more models on the current page
+                    if not models:
+                        break
+
+                    all_models.extend(models)
+                    if len(models) < 100:
+                        break
+                    current_page += 1
+                    await asyncio.sleep(0.5)
+
+            # Initialize containers for the 6 main categories
+            categorized_models = {
+                "chat": [],  # Maps to "llm"
+                "vlm": [],  # Maps to "vlm"
+                "embedding": [],  # Maps to "embedding" / "multi_embedding"
+                "reranker": [],  # Maps to "reranker"
+                "tts": [],  # Maps to "tts"
+                "stt": []  # Maps to "stt"
+            }
+
+            # Classify models and inject canonical fields expected downstream
+            for model_obj in all_models:
+                # Extract key fields for logical determination (lowercased for robustness)
+                m_id = model_obj.get('model', '').lower()
+                desc = model_obj.get('description', '')
+                metadata = model_obj.get('inference_metadata', {})
+                req_mod = metadata.get('request_modality', [])
+                res_mod = metadata.get('response_modality', [])
+                model_obj.setdefault("object", model_obj.get("object", "model"))
+                model_obj.setdefault("owned_by", model_obj.get("owned_by", "dashscope"))
+                cleaned_model = {
+                    "id": m_id,
+                    "object": model_obj.get("object"),
+                    "created": 0,
+                    "owned_by": model_obj.get("owned_by"),
+                    "model_tag": "",
+                    "model_type": "",
+                    "max_tokens": DEFAULT_LLM_MAX_TOKENS
+                }
+               # 1. Embedding
+                if 'embedding' in m_id.lower() or '向量' in desc:
+                    cleaned_model.update({"model_tag": "embedding", "model_type": "embedding"})
+                    categorized_models['embedding'].append(cleaned_model)
+                    continue
+
+                # 2. Reranker
+                if 'rerank' in m_id.lower() or '重排序' in desc:
+                    cleaned_model.update({"model_tag": "reranker", "model_type": "reranker"})
+                    categorized_models['reranker'].append(cleaned_model)
+                    continue
+
+                # 3. STT
+                if 'Audio' in req_mod and 'Text' in res_mod:
+                    cleaned_model.update({"model_tag": "stt", "model_type": "stt"})
+                    categorized_models['stt'].append(cleaned_model)
+                    continue
+
+                # 4. TTS
+                if 'Audio' in res_mod and 'Video' not in res_mod:
+                    cleaned_model.update({"model_tag": "tts", "model_type": "tts"})
+                    categorized_models['tts'].append(cleaned_model)
+                    continue
+
+                # 5. VLM
+                vision_mods = {'Image', 'Video'}
+                if (set(req_mod) & vision_mods) or (set(res_mod) & vision_mods) or '视觉' in desc:
+                    cleaned_model.update({"model_tag": "chat", "model_type": "vlm"})
+                    categorized_models['vlm'].append(cleaned_model)
+                    continue
+
+                # 6. Chat / LLM
+                if 'Text' in req_mod or 'Text' in res_mod:
+                    cleaned_model.update({"model_tag": "chat", "model_type": "llm"})
+                    categorized_models['chat'].append(cleaned_model)
+
+            # Return the specific list based on the requested target_model_type
+            if target_model_type == "llm":
+                return categorized_models["chat"]
+            elif target_model_type in ("embedding", "multi_embedding"):
+                return categorized_models["embedding"]
+            elif target_model_type in categorized_models:
+                return categorized_models[target_model_type]
+            else:
+                return []
+        except (httpx.HTTPStatusError, httpx.ConnectTimeout, httpx.ConnectError, Exception) as e:
+            return _classify_provider_error("DashScope", exception=e)
+
diff --git a/backend/services/providers/tokenpony_provider.py b/backend/services/providers/tokenpony_provider.py
new file mode 100644
index 000000000..42e5d178c
--- /dev/null
+++ b/backend/services/providers/tokenpony_provider.py
@@ -0,0 +1,112 @@
+import httpx
+import ssl
+
+from typing import Dict, List
+
+
+from consts.const import DEFAULT_LLM_MAX_TOKENS
+from consts.provider import TOKENPONY_GET_URL
+from services.providers.base import AbstractModelProvider, _classify_provider_error
+
+
+class TokenPonyModelProvider(AbstractModelProvider):
+    """Concrete implementation for TokenPony provider."""
+
+    async def get_models(self, provider_config: Dict) -> List[Dict]:
+        """
+        Fetch models from TokenPony API, categorize them based on modality/ID,
+        and return the requested model type.
+
+        Args:
+            provider_config: Configuration dict containing model_type and api_key
+
+        Returns:
+            List of models with canonical fields. Returns error dict if API call fails.
+        """
+        try:
+            target_model_type: str = provider_config["model_type"]
+            model_api_key: str = provider_config["api_key"]
+
+            headers = {"Authorization": f"Bearer {model_api_key}"}
+            url = TOKENPONY_GET_URL
+
+
+            ssl_context = ssl.create_default_context()
+            ssl_context.check_hostname = False
+            ssl_context.verify_mode = ssl.CERT_NONE
+            ssl_context.set_ciphers("DEFAULT@SECLEVEL=1")
+
+            async with httpx.AsyncClient(http2=True) as client:
+                response = await client.get(url, headers=headers)
+                response.raise_for_status()
+                # OpenAI standard response puts the model list inside the "data" array
+                all_models: List[Dict] = response.json().get("data", [])
+
+            # Initialize containers for the 6 main categories
+            categorized_models = {
+                "chat": [],       # Maps to "llm"
+                "vlm": [],        # Maps to "vlm"
+                "embedding": [],  # Maps to "embedding" / "multi_embedding"
+                "reranker": [],   # Maps to "reranker"
+                "tts": [],        # Maps to "tts"
+                "stt": []         # Maps to "stt"
+            }
+
+            # Classify models and inject canonical fields expected downstream
+            for model_obj in all_models:
+                m_id = model_obj['id'].lower()
+                model_obj.setdefault("object", model_obj.get("object", "model"))
+                model_obj.setdefault("owned_by", model_obj.get("owned_by", "tokenpony"))
+                cleaned_model = {
+                    "id": m_id,
+                    "object": model_obj.get("object"),
+                    "created": 0,
+                    "owned_by": model_obj.get("owned_by"),
+                    "model_tag": "",
+                    "model_type": "",
+                    "max_tokens": DEFAULT_LLM_MAX_TOKENS
+                }
+                # 1. reranker
+                if 'rerank' in m_id:
+                    cleaned_model.update({"model_tag": "reranker", "model_type": "reranker"})
+                    categorized_models['reranker'].append(cleaned_model)
+                #2. embedding
+                elif 'embedding' in m_id or m_id.startswith('bge-'):
+                    cleaned_model.update({"model_tag": "embedding", "model_type": "embedding"})
+                    categorized_models['embedding'].append(cleaned_model)
+
+                # 3. STT (Speech-to-Text / Audio understanding)
+                elif 'stt' in m_id:
+                    cleaned_model.update({"model_tag": "stt", "model_type": "stt"})
+                    categorized_models['stt'].append(cleaned_model)
+
+
+                # 4. TTS (Text-to-Speech)
+                elif 'tts' in m_id:
+                    cleaned_model.update({"model_tag": "tts", "model_type": "tts"})
+                    categorized_models['tts'].append(cleaned_model)
+
+                # 5. VLM (Vision Language Model / Image & Video Generation)
+
+                elif any(keyword in m_id for keyword in ['-vl', 'vl-', 'ocr', 'vision']):
+                    cleaned_model.update({"model_tag": "chat", "model_type": "vlm"})
+                    categorized_models['vlm'].append(cleaned_model)
+
+                # 6. Chat (Pure Text Conversation / Reasoning)
+                # Fallback check added: 'not metadata' catches standard OpenAI models that lack modality data
+                else :
+                    cleaned_model.update({"model_tag": "chat", "model_type": "llm"})
+                    categorized_models['chat'].append(cleaned_model)
+
+            # Return the specific list based on the requested target_model_type
+            if target_model_type == "llm":
+                return categorized_models["chat"]
+            elif target_model_type in ("embedding", "multi_embedding"):
+                return categorized_models["embedding"]
+            elif target_model_type in categorized_models:
+                return categorized_models[target_model_type]
+            else:
+                return []
+
+        except (httpx.HTTPStatusError, httpx.ConnectTimeout, httpx.ConnectError, Exception) as e:
+            return _classify_provider_error("TokenPony", exception=e)
diff --git a/backend/services/user_management_service.py b/backend/services/user_management_service.py
index 792887ec5..39ea8cfbe 100644
--- a/backend/services/user_management_service.py
+++ b/backend/services/user_management_service.py
@@ -1,6 +1,13 @@
 import logging
 from typing import Optional, Any, Tuple, Dict, List
 
+from database.token_db import (
+    create_token as create_token_record,
+    generate_access_key,
+    list_tokens_by_user as list_tokens_by_user_record,
+    delete_token as delete_token_record,
+)
+
 import aiohttp
 from fastapi import Header
 from supabase import Client
@@ -122,11 +129,12 @@ async def check_auth_service_health():
 
 async def signup_user_with_invitation(email: EmailStr,
                                       password: str,
-                                      invite_code: Optional[str] = None):
+                                      invite_code: Optional[str] = None,
+                                      auto_login: Optional[bool] = True):
     """User registration with invitation code support"""
     client = get_supabase_client()
     logging.info(
-        f"Receive registration request: email={email}, invite_code={'provided' if invite_code else 'not provided'}")
+        f"Receive registration request: email={email}, invite_code={'provided' if invite_code else 'not provided'}, auto_login={auto_login}")
 
     # Default user role is USER
     user_role = "USER"
@@ -221,7 +229,7 @@ async def signup_user_with_invitation(email: EmailStr,
                     f"Failed to use invitation code {invite_code} for user {user_id}: {str(e)}")
 
         logging.info(
-            f"User {email} registered successfully, role: {user_role}, tenant: {tenant_id}")
+            f"User {email} registered successfully, role: {user_role}, tenant: {tenant_id}, auto_login={auto_login}")
 
         if user_role == "ADMIN":
             await generate_tts_stt_4_admin(tenant_id, user_id)
@@ -229,7 +237,7 @@ async def signup_user_with_invitation(email: EmailStr,
         # Initialize tool list for the new tenant (only once per tenant)
         await init_tool_list_for_tenant(tenant_id, user_id)
 
-        return await parse_supabase_response(False, response, user_role)
+        return await parse_supabase_response(False, response, user_role, auto_login)
     else:
         logging.error(
             "Supabase registration request returned no user object")
@@ -237,7 +245,7 @@ async def signup_user_with_invitation(email: EmailStr,
             "Registration service is temporarily unavailable, please try again later")
 
 
-async def parse_supabase_response(is_admin, response, user_role):
+async def parse_supabase_response(is_admin, response, user_role, auto_login: bool = True):
     """Parse Supabase response and build standardized user registration response"""
     user_data = {
         "id": response.user.id,
@@ -246,7 +254,7 @@ async def parse_supabase_response(is_admin, response, user_role):
     }
 
     session_data = None
-    if response.session:
+    if response.session and auto_login:
         session_data = {
             "access_token": response.session.access_token,
             "refresh_token": response.session.refresh_token,
@@ -472,3 +480,45 @@ def format_role_permissions(permissions: List[Dict[str, Any]]) -> Dict[str, List
         "permissions": formatted_permissions,
         "accessibleRoutes": accessible_routes
     }
+
+
+# -----------------------------
+# Token Management
+# -----------------------------
+
+def create_token(user_id: str) -> Dict[str, Any]:
+    """Create a new API token for the specified user.
+
+    Args:
+        user_id: The user ID who owns this token.
+
+    Returns:
+        Dictionary containing the API token information including token_id.
+    """
+    access_key = generate_access_key()
+    return create_token_record(access_key, user_id)
+
+
+def list_tokens_by_user(user_id: str) -> List[Dict[str, Any]]:
+    """List all tokens for the specified user.
+
+    Args:
+        user_id: The user ID to query token pairs for.
+
+    Returns:
+        List of token information with masked access keys.
+    """
+    return list_tokens_by_user_record(user_id)
+
+
+def delete_token(token_id: int, user_id: str) -> bool:
+    """Soft delete a token.
+
+    Args:
+        token_id: The token ID to delete.
+        user_id: The user ID who owns this token (for authorization).
+
+    Returns:
+        True if the token was deleted, False if not found or not owned by user.
+    """
+    return delete_token_record(token_id, user_id)
diff --git a/backend/utils/auth_utils.py b/backend/utils/auth_utils.py
index a27a48b38..7b40576e2 100644
--- a/backend/utils/auth_utils.py
+++ b/backend/utils/auth_utils.py
@@ -1,9 +1,9 @@
 import logging
-import hashlib
-import hmac
 import time
+import hmac
+import hashlib
 from datetime import datetime, timedelta
-from typing import Optional, Tuple
+from typing import Dict, Optional, Tuple
 
 import jwt
 from fastapi import Request
@@ -20,189 +20,195 @@
     DEBUG_JWT_EXPIRE_SECONDS,
     LANGUAGE,
 )
-from consts.exceptions import LimitExceededError, SignatureValidationError, UnauthorizedError
+from consts.exceptions import LimitExceededError, UnauthorizedError
 from database.user_tenant_db import get_user_tenant_by_user_id
+from database.token_db import get_token_by_access_key
 
 # Module logger
 logger = logging.getLogger(__name__)
 
 # ---------------------------------------------------------------------------
-# AK/SK authentication helpers (merged from aksk_auth_utils.py)
+# Shared test constants
 # ---------------------------------------------------------------------------
 
-# Mock AK/SK configuration (replace with DB/config lookup in production)
-MOCK_ACCESS_KEY = "mock_access_key_12345"
-MOCK_SECRET_KEY = "mock_secret_key_67890abcdef"
-MOCK_JWT_SECRET_KEY = "mock_jwt_secret_key_67890abcdef"
+# Fixed test secret used by generate_test_jwt and unit tests.
+MOCK_JWT_SECRET_KEY = "nexent-mock-jwt-secret"
 
-# Timestamp validity window in seconds (prevent replay attacks)
-TIMESTAMP_VALIDITY_WINDOW = 300
+# ---------------------------------------------------------------------------
+# AK/SK (Access Key / Secret Key) authentication helpers
+# ---------------------------------------------------------------------------
 
+# Validity window in seconds for X-Timestamp header.
+TIMESTAMP_VALIDITY_WINDOW = 5 * 60
 
-def get_aksk_config(tenant_id: str) -> Tuple[str, str]:
-    """
-    Get AK/SK configuration according to tenant_id
 
-    Returns:
-        Tuple[str, str]: (access_key, secret_key)
+def calculate_hmac_signature(secret_key: str, access_key: str, timestamp: str, body: str) -> str:
     """
+    Calculate HMAC-SHA256 signature for AK/SK authentication.
 
-    # TODO: get ak/sk according to tenant_id from DB
-    return MOCK_ACCESS_KEY, MOCK_SECRET_KEY
+    Returns a lowercase hex digest of length 64.
+    """
+    message = f"{access_key}\n{timestamp}\n{body}".encode("utf-8")
+    return hmac.new(secret_key.encode("utf-8"), message, hashlib.sha256).hexdigest()
 
 
 def validate_timestamp(timestamp: str) -> bool:
-    """
-    Validate timestamp is within validity window
+    """Validate that timestamp is within allowed window."""
+    try:
+        ts = int(timestamp)
+    except (TypeError, ValueError):
+        return False
 
-    Args:
-        timestamp: timestamp string
+    now = int(time.time())
+    return abs(now - ts) <= TIMESTAMP_VALIDITY_WINDOW
 
-    Returns:
-        bool: whether timestamp is valid
+
+def extract_aksk_headers(headers: Dict[str, str]) -> Tuple[str, str, str]:
+    """Extract AK/SK headers or raise UnauthorizedError when missing."""
+    access_key = headers.get("X-Access-Key") if headers else None
+    timestamp = headers.get("X-Timestamp") if headers else None
+    signature = headers.get("X-Signature") if headers else None
+
+    if not access_key or not timestamp or not signature:
+        raise UnauthorizedError("Missing AK/SK authentication headers")
+
+    return access_key, timestamp, signature
+
+
+def get_aksk_config(tenant_id: str) -> Tuple[str, str]:
     """
-    try:
-        timestamp_int = int(timestamp)
-        current_time = int(time.time())
+    Get (access_key, secret_key) configuration for a tenant.
 
-        if abs(current_time - timestamp_int) > TIMESTAMP_VALIDITY_WINDOW:
-            logger.warning(
-                f"Timestamp validation failed: current={current_time}, provided={timestamp_int}"
-            )
-            return False
+    This is intentionally a thin indirection so tests can monkeypatch it.
+    """
+    raise UnauthorizedError("AK/SK authentication is not configured")
 
-        return True
-    except (ValueError, TypeError) as e:
-        logger.error(f"Invalid timestamp format: {timestamp}, error: {e}")
+
+def verify_aksk_signature(access_key: str, timestamp: str, signature: str, body: str, tenant_id: str = None) -> bool:
+    """Verify AK/SK signature; returns False instead of raising on mismatch."""
+    tenant = tenant_id or DEFAULT_TENANT_ID
+    try:
+        expected_access_key, secret_key = get_aksk_config(tenant)
+    except Exception:
         return False
 
+    if access_key != expected_access_key:
+        return False
 
-def calculate_hmac_signature(secret_key: str, access_key: str, timestamp: str, request_body: str = "") -> str:
-    """
-    Calculate HMAC-SHA256 signature
+    expected_sig = calculate_hmac_signature(secret_key, access_key, timestamp, body)
+    return hmac.compare_digest(expected_sig, signature)
 
-    Args:
-        secret_key: secret key
-        access_key: access key
-        timestamp: timestamp
-        request_body: request body (optional)
 
-    Returns:
-        str: HMAC-SHA256 signature (hex string)
+def validate_aksk_authentication(headers: Dict[str, str], body: str, tenant_id: str = None) -> bool:
     """
-    string_to_sign = f"{access_key}{timestamp}{request_body}"
-    signature = hmac.new(
-        secret_key.encode("utf-8"),
-        string_to_sign.encode("utf-8"),
-        hashlib.sha256,
-    ).hexdigest()
-    return signature
-
-
-def verify_aksk_signature(
-    access_key: str, timestamp: str, signature: str, request_body: str = ""
-) -> bool:
-    """
-    Validate AK/SK signature
-
-    Args:
-        access_key: access key
-        timestamp: timestamp
-        signature: provided signature
-        request_body: request body (optional)
+    Validate AK/SK authentication.
 
-    Returns:
-        bool: whether signature is valid
+    Returns True when valid, otherwise raises domain exceptions.
     """
-    try:
-        if not validate_timestamp(timestamp):
-            raise SignatureValidationError("Timestamp is invalid or expired")
+    from consts.exceptions import SignatureValidationError  # imported lazily for test-time stubbing
 
-        # TODO: get ak/sk according to tenant_id from DB
-        mock_access_key, mock_secret_key = get_aksk_config(
-            tenant_id="tenant_id")
+    try:
+        access_key, ts, sig = extract_aksk_headers(headers)
 
-        if access_key != mock_access_key:
-            logger.warning(f"Invalid access key: {access_key}")
-            return False
+        if not validate_timestamp(ts):
+            raise UnauthorizedError("Invalid or expired timestamp")
 
-        expected_signature = calculate_hmac_signature(
-            mock_secret_key, access_key, timestamp, request_body
-        )
+        # Call with positional args so tests can monkeypatch with simple lambdas.
+        if tenant_id is None:
+            ok = verify_aksk_signature(access_key, ts, sig, body)
+        else:
+            ok = verify_aksk_signature(access_key, ts, sig, body, tenant_id)
 
-        if not hmac.compare_digest(signature, expected_signature):
-            logger.warning(
-                f"Signature mismatch: expected={expected_signature}, provided={signature}"
-            )
-            return False
+        if not ok:
+            raise SignatureValidationError("Invalid signature")
 
         return True
-    except Exception as e:
-        logger.error(f"Error during signature verification: {e}")
-        return False
+    except (UnauthorizedError, SignatureValidationError):
+        raise
+    except Exception as exc:
+        logger.exception("Unexpected error during AK/SK authentication")
+        raise UnauthorizedError("Authentication failed") from exc
 
+# ---------------------------------------------------------------------------
+# Bearer Token (API Key) authentication
+# ---------------------------------------------------------------------------
 
-def extract_aksk_headers(headers: dict) -> Tuple[str, str, str]:
+
+def validate_bearer_token(authorization: Optional[str]) -> Tuple[bool, Optional[dict]]:
     """
-    Extract AK/SK related information from request headers
+    Validate Bearer token (API Key) from Authorization header.
 
     Args:
-        headers: request headers dictionary
+        authorization: Authorization header value (e.g., "Bearer nexent-xxxxx")
 
     Returns:
-        Tuple[str, str, str]: (access_key, timestamp, signature)
-
-    Raises:
-        UnauthorizedError: when required headers are missing
+        Tuple of (is_valid, token_info_dict)
+        - is_valid: True if token exists and is active
+        - token_info: Token information dict if valid, None otherwise
     """
+    if not authorization:
+        logger.warning("No authorization header provided")
+        return False, None
 
-    def get_header(headers: dict, name: str) -> Optional[str]:
-        for k, v in headers.items():
-            if k.lower() == name.lower():
-                return v
-        return None
-
-    access_key = get_header(headers, "X-Access-Key")
-    timestamp = get_header(headers, "X-Timestamp")
-    signature = get_header(headers, "X-Signature")
+    # Extract token from "Bearer <token>" format
+    token = authorization.replace("Bearer ", "") if authorization.startswith("Bearer ") else authorization
 
-    if not access_key:
-        raise UnauthorizedError("Missing X-Access-Key header")
-    if not timestamp:
-        raise UnauthorizedError("Missing X-Timestamp header")
-    if not signature:
-        raise UnauthorizedError("Missing X-Signature header")
+    if not token:
+        logger.warning("Empty bearer token")
+        return False, None
 
-    return access_key, timestamp, signature
+    # Look up token in database
+    try:
+        token_info = get_token_by_access_key(token)
+        if token_info and token_info.get("delete_flag") != "Y":
+            logger.debug(f"Token validated successfully for user {token_info.get('user_id')}")
+            return True, token_info
+        else:
+            logger.warning(f"Invalid or inactive token: {token[:20]}...")
+            return False, None
+    except Exception as e:
+        logger.error(f"Error validating bearer token: {str(e)}")
+        return False, None
 
 
-def validate_aksk_authentication(headers: dict, request_body: str = "") -> bool:
+def get_user_and_tenant_by_access_key(access_key: str) -> Dict[str, str]:
     """
-    Validate AK/SK authentication
+    Get user_id and tenant_id from access_key by querying user_token_info_t and user_tenant_t.
 
     Args:
-        headers: request headers dictionary
-        request_body: request body (optional)
+        access_key: The access key (API Key) from the Authorization header.
 
     Returns:
-        bool: whether authentication is successful
+        Dict containing user_id and tenant_id.
 
     Raises:
-        UnauthorizedError: when authentication fails
-        SignatureValidationError: when signature verification fails
+        UnauthorizedError: If the access key is not found or invalid.
     """
-    try:
-        access_key, timestamp, signature = extract_aksk_headers(headers)
-
-        if not verify_aksk_signature(access_key, timestamp, signature, request_body):
-            raise SignatureValidationError("Invalid signature")
-
-        return True
-    except (UnauthorizedError, SignatureValidationError, LimitExceededError) as e:
-        raise e
-    except Exception as e:
-        logger.error(f"Unexpected error during AK/SK authentication: {e}")
-        raise UnauthorizedError("Authentication failed")
+    if not access_key:
+        raise UnauthorizedError("Invalid access key")
+
+    # Query token from user_token_info_t
+    token_info = get_token_by_access_key(access_key)
+    if not token_info or token_info.get("delete_flag") == "Y":
+        raise UnauthorizedError("Invalid or inactive access key")
+
+    user_id = token_info.get("user_id")
+    if not user_id:
+        raise UnauthorizedError("No user associated with this access key")
+
+    # Query tenant from user_tenant_t
+    user_tenant_record = get_user_tenant_by_user_id(user_id)
+    if user_tenant_record and user_tenant_record.get("tenant_id"):
+        tenant_id = user_tenant_record["tenant_id"]
+    else:
+        tenant_id = DEFAULT_TENANT_ID
+        logger.warning(f"No tenant relationship found for user {user_id}, using default tenant")
+
+    return {
+        "user_id": user_id,
+        "tenant_id": tenant_id,
+        "token_id": token_info.get("token_id")
+    }
 
 
 def get_supabase_client():
diff --git a/backend/utils/file_management_utils.py b/backend/utils/file_management_utils.py
index 2a1aa3801..57025e350 100644
--- a/backend/utils/file_management_utils.py
+++ b/backend/utils/file_management_utils.py
@@ -1,5 +1,7 @@
+import asyncio
 import logging
 import os
+import subprocess
 import traceback
 from pathlib import Path
 from typing import List
@@ -337,3 +339,66 @@ def get_file_size(source_type: str, path_or_url: str) -> int:
         logging.error(f"Error getting file size for {path_or_url}: {str(e)}")
         return 0
 
+
+async def convert_office_to_pdf(input_path: str, output_dir: str, timeout: int = 30) -> str:
+    """
+    Convert Office document to PDF using LibreOffice.
+    
+    Args:
+        input_path: Path to input Office file
+        output_dir: Directory for output PDF file
+        timeout: Conversion timeout in seconds (default: 30s)
+        
+    Returns:
+        str: Path to generated PDF file
+    """
+    if not os.path.exists(input_path):
+        raise FileNotFoundError(f"Input file not found: {input_path}")
+
+    def _run_libreoffice_conversion():
+        """Synchronous LibreOffice conversion to run in thread executor."""
+        cmd = [
+            'libreoffice',
+            '--headless',
+            '--convert-to', 'pdf',
+            '--outdir', output_dir,
+            input_path
+        ]
+        return subprocess.run(
+            cmd,
+            capture_output=True,
+            text=True,
+            timeout=timeout
+        )
+    
+    try:
+        # Run blocking subprocess in thread executor to avoid blocking event loop
+        result = await asyncio.to_thread(_run_libreoffice_conversion)
+        
+        if result.returncode != 0:
+            error_msg = result.stderr or result.stdout or "Unknown conversion error"
+            logger.error(f"LibreOffice conversion failed: {error_msg}")
+            raise RuntimeError(f"Office to PDF conversion failed: {error_msg}")
+        
+        # Find generated PDF file
+        input_filename = os.path.basename(input_path)
+        pdf_filename = os.path.splitext(input_filename)[0] + '.pdf'
+        pdf_path = os.path.join(output_dir, pdf_filename)
+        
+        if not os.path.exists(pdf_path):
+            raise RuntimeError(f"Converted PDF not found: {pdf_path}")
+        
+        return pdf_path
+        
+    except subprocess.TimeoutExpired:
+        logger.error(f"Office to PDF conversion timeout after {timeout}s: {input_path}")
+        raise TimeoutError(f"Office to PDF conversion timeout (>{timeout}s)")
+        
+    except FileNotFoundError as e:
+        # LibreOffice executable not found in PATH
+        logger.error(f"LibreOffice not available: {str(e)}")
+        raise FileNotFoundError(
+            "LibreOffice is not installed or not available in PATH. "
+        ) from e
+
+
diff --git a/backend/utils/llm_utils.py b/backend/utils/llm_utils.py
index 0ede9a263..d1aa6fcf3 100644
--- a/backend/utils/llm_utils.py
+++ b/backend/utils/llm_utils.py
@@ -2,8 +2,9 @@
 from typing import Callable, List, Optional
 
 from consts.const import MESSAGE_ROLE, THINK_END_PATTERN, THINK_START_PATTERN
+from consts.error_code import ErrorCode
+from consts.exceptions import AppException
 from database.model_management_db import get_model_by_model_id
-from nexent.core.utils.observer import MessageObserver
 from nexent.core.models import OpenAIModel
 from utils.config_utils import get_model_name_from_config
 
@@ -122,8 +123,23 @@ def call_llm_for_system_prompt(
         return result
     except Exception as exc:
         logger.error("Failed to generate prompt from LLM: %s", str(exc))
-        raise
+        # Parse error code from exception message and raise appropriate AppException
+        # Use specific error codes for different scenarios
+        error_msg = str(exc)
+        if "401" in error_msg or "api key" in error_msg.lower() or "unauthorized" in error_msg.lower():
+            raise AppException(ErrorCode.MODEL_API_KEY_INVALID)
+        elif "403" in error_msg or "forbidden" in error_msg.lower():
+            raise AppException(ErrorCode.MODEL_API_KEY_NO_PERMISSION)
+        elif "404" in error_msg or "not found" in error_msg.lower():
+            raise AppException(ErrorCode.MODEL_NOT_FOUND)
+        elif "429" in error_msg or "rate limit" in error_msg.lower():
+            raise AppException(ErrorCode.MODEL_RATE_LIMIT_EXCEEDED)
+        elif "500" in error_msg or "502" in error_msg or "503" in error_msg or "504" in error_msg:
+            raise AppException(ErrorCode.MODEL_SERVICE_UNAVAILABLE)
+        elif "connection" in error_msg.lower() or "timeout" in error_msg.lower() or "refused" in error_msg.lower():
+            raise AppException(ErrorCode.MODEL_CONNECTION_ERROR)
+        else:
+            raise AppException(ErrorCode.MODEL_PROMPT_GENERATION_FAILED)
 
 
 __all__ = ["call_llm_for_system_prompt", "_process_thinking_tokens"]
-
diff --git a/doc/docs/en/quick-start/installation.md b/doc/docs/en/quick-start/installation.md
index 662eb7c3d..f01576513 100644
--- a/doc/docs/en/quick-start/installation.md
+++ b/doc/docs/en/quick-start/installation.md
@@ -44,13 +44,35 @@ After executing this command, the system will provide two different versions for
 - **Terminal Tool**: Enables openssh-server for AI agent shell command execution
 - **Regional optimization**: Mainland China users can use optimized image sources
 
->⚠️ **Important Note**: When deploying v1.8.0 or later for the first time, please pay special attention to the `suadmin` super administrator account information output in the Docker logs. This account has the highest system privileges, and the password is only displayed upon first generation. It cannot be viewed again later, so please be sure to save it securely.
+### ⚠️ Important Notes
+1️⃣ **When deploying v1.8.0 or later for the first time**, please pay special attention to the `suadmin` super administrator account information output in the Docker logs. This account has the highest system privileges, and the password is only displayed upon first generation. It cannot be viewed again later, so please be sure to save it securely.
+
+2️⃣ Forgot to note the `suadmin` account password? Follow these steps:
+```bash
+# Step1: Delete su account record in supabase container
+docker exec -it supabase-db-mini bash
+psql -U postgres
+select id, email from auth.users;
+# Get the user_id of suadmin@nexent.com account
+delete from auth.users where id = 'your_user_id';
+delete from auth.identities where user_id = 'your_user_id';
+
+# Step2: Delete su account record in nexent database
+docker exec -it nexent-postgresql bash
+psql -U root -d nexent
+delete from nexent.user_tenant_t where user_id = 'your_user_id';
+
+# Step3: Redeploy and record the su account password
+```
 
 ### 3. Access Your Installation
 
 When deployment completes successfully:
 1. Open **http://localhost:3000** in your browser
-2. Refer to the [User Guide](../user-guide/home-page) to develop agents
+2. Log in with the super administrator account
+3. Access tenant resources → Create tenant and tenant administrator
+4. Log in with the tenant administrator account
+5. Refer to the [User Guide](../user-guide/home-page) to develop agents
 
 
 ## 🏗️ Service Architecture
diff --git a/doc/docs/zh/opensource-memorial-wall.md b/doc/docs/zh/opensource-memorial-wall.md
index 54bac7c28..068d5902f 100644
--- a/doc/docs/zh/opensource-memorial-wall.md
+++ b/doc/docs/zh/opensource-memorial-wall.md
@@ -711,3 +711,19 @@ Nexent 加油！希望能达成所愿！
 ::: info sisyphus0x - 2026-03-04
 对多智能体编排和协同工作很感兴趣，学习一下
 :::
+
+::: info hmh_mike - 2026-03-05
+感觉很有意思，试用一下看看对工作有没有帮助
+:::
+
+::: tip GZX- 2026-03-08
+感谢 Nexent 期待与Nexent一起进步。
+:::
+
+::: info xingzhewujiang - 2026-03-09
+偶然发现Nexent是一个开源的零代码智能体自动生成平台，非常值的研究与尝试，祝福Nexent让零代码走向AI全球。
+:::
+
+::: info ichigoichie - 2026-03-10
+被 Nexent 官网吸引，希望深入了解产品并应用于工作场景，提升工作效率。
+:::
diff --git a/doc/docs/zh/quick-start/installation.md b/doc/docs/zh/quick-start/installation.md
index 64840b8d0..87df5abde 100644
--- a/doc/docs/zh/quick-start/installation.md
+++ b/doc/docs/zh/quick-start/installation.md
@@ -45,12 +45,34 @@ bash deploy.sh
 - **区域优化**: 中国大陆用户可使用优化的镜像源
 
 
->⚠️ **重要提示**：首次部署 v1.8.0 及以上版本时，需特别留意 Docker 日志中输出的 `suadmin` 超级管理员账号信息。该账号为系统最高权限账户，密码仅在首次生成时显示，后续无法再次查看，请务必妥善保存。
+### ⚠️ 重要提示
+1️⃣ **首次部署 v1.8.0 及以上版本时**，需特别留意 Docker 日志中输出的 `suadmin` 超级管理员账号信息。该账号为系统最高权限账户，密码仅在首次生成时显示，后续无法再次查看，请务必妥善保存。
+> 该账号仅用于权限管理，无权开发智能体或创建知识库。请登录该账号，依次完成：访问租户资源→创建租户→创建租户管理员，然后使用租户管理员账号登录,即可使用全部功能。角色权限详情参见 [用户管理](../user-guide/user-management)
 
+2️⃣ 忘记留意 `suadmin` 账号密码？请按照以下步骤操作：
+```bash
+# Step1: 在supabase容器中删除su账号记录
+docker exec -it supabase-db-mini bash
+psql -U postgres
+select id, email from auth.users;
+#获取到suadmin@nexent.com账号的user_id
+delete from auth.users where id = '你的user_id';
+delete from auth.identities where user_id = '你的user_id';
+
+#Step2：在nexent的数据库中删除su账号记录
+docker exec -it nexent-postgresql bash
+psql -U root -d nexent
+delete from nexent.user_tenant_t where user_id = '你的user_id';
+
+#Step3：重新部署并记录su账号密码
+```
 ### 3. 访问您的安装
 
 部署成功完成后：
 1. 在浏览器中打开 **http://localhost:3000**
+2. 登录超级管理员账号
+3. 访问租户资源 → 创建租户及租户管理员
+4. 登录租户管理员账号
 2. 参考 [用户指南](../user-guide/home-page) 进行智能体的开发
 
 
diff --git a/docker/create-su.sh b/docker/create-su.sh
index 8d290a726..639e64553 100644
--- a/docker/create-su.sh
+++ b/docker/create-su.sh
@@ -54,10 +54,32 @@ wait_for_postgresql_ready() {
 create_default_super_admin_user() {
   local email="suadmin@nexent.com"
   local password
-  password="$(generate_random_password)"
+  
+  # Get password from command line argument, or generate random one if not provided
+  if [ -n "$1" ]; then
+    password="$1"
+  else
+    # Fallback to random password if no argument provided (for backward compatibility)
+    password="$(generate_random_password)"
+    echo "   ⚠️  Warning: No password provided, using random password"
+  fi
 
   echo "🔧 Creating super admin user..."
-  RESPONSE=$(docker exec nexent-config bash -c "curl -s -X POST http://kong:8000/auth/v1/signup -H \"apikey: ${SUPABASE_KEY}\" -H \"Authorization: Bearer ${SUPABASE_KEY}\" -H \"Content-Type: application/json\" -d '{\"email\":\"${email}\",\"password\":\"${password}\",\"email_confirm\":true}'" 2>/dev/null)
+  
+  # Determine which container to use for curl command
+  local curl_container="nexent-config"
+  if [ "$DEPLOYMENT_MODE" = "infrastructure" ] || ! docker ps | grep -q "nexent-config"; then
+    # In infrastructure mode or if nexent-config is not running, use supabase-db-mini
+    if docker ps | grep -q "supabase-db-mini"; then
+      curl_container="supabase-db-mini"
+      echo "   ℹ️  Using supabase-db-mini container (infrastructure mode)"
+    else
+      echo "   ❌ Neither nexent-config nor supabase-db-mini container is available."
+      return 1
+    fi
+  fi
+
+  RESPONSE=$(docker exec "$curl_container" bash -c "curl -s -X POST http://kong:8000/auth/v1/signup -H \"apikey: ${SUPABASE_KEY}\" -H \"Authorization: Bearer ${SUPABASE_KEY}\" -H \"Content-Type: application/json\" -d '{\"email\":\"${email}\",\"password\":\"${password}\",\"email_confirm\":true}'" 2>/dev/null)
 
   if [ -z "$RESPONSE" ]; then
     echo "   ❌ No response received from Supabase."
@@ -65,21 +87,24 @@ create_default_super_admin_user() {
   elif echo "$RESPONSE" | grep -q '"access_token"' && echo "$RESPONSE" | grep -q '"user"'; then
     echo "   ✅ Default super admin user has been successfully created."
     echo ""
-    echo "      Please save the following credentials carefully, which would ONLY be shown once."
+    echo "      Please save the following credentials carefully."
     echo "   📧 Email:    ${email}"
-    echo "   🔏 Password: ${password}"
+    if [ -n "$1" ]; then
+      echo "   🔏 Password: [User provided password]"
+    else
+      echo "   🔏 Password: ${password}"
+    fi
 
     # Extract user.id from RESPONSE JSON
     local user_id
-    # Try using Python to parse JSON (most reliable)
-    user_id=$(echo "$RESPONSE" | docker exec -i nexent-config python3 -c "import sys, json; data = json.load(sys.stdin); print(data.get('user', {}).get('id', ''))" 2>/dev/null)
-
-    # Fallback to jq if Python fails
-    if [ -z "$user_id" ] && command -v jq >/dev/null 2>&1; then
+    # Try using jq first (if available in the container or on host)
+    if docker exec "$curl_container" command -v jq >/dev/null 2>&1; then
+      user_id=$(echo "$RESPONSE" | docker exec -i "$curl_container" jq -r '.user.id // empty' 2>/dev/null)
+    elif command -v jq >/dev/null 2>&1; then
       user_id=$(echo "$RESPONSE" | jq -r '.user.id // empty' 2>/dev/null)
     fi
 
-    # Final fallback: use grep and sed
+    # Fallback: use grep and sed (works without any special tools)
     if [ -z "$user_id" ]; then
       user_id=$(echo "$RESPONSE" | grep -o '"user"[^}]*"id":"[^"]*"' | sed -n 's/.*"id":"\([^"]*\)".*/\1/p' 2>/dev/null)
     fi
@@ -150,7 +175,8 @@ create_default_super_admin_user() {
 }
 
 # Main execution
-if create_default_super_admin_user; then
+# Pass password as first argument if provided
+if create_default_super_admin_user "$1"; then
   exit 0
 else
   exit 1
diff --git a/docker/deploy.sh b/docker/deploy.sh
index 83d3f7947..e30e6e75a 100755
--- a/docker/deploy.sh
+++ b/docker/deploy.sh
@@ -865,24 +865,98 @@ select_terminal_tool() {
     echo ""
 }
 
-generate_random_password() {
-  # Generate a URL/JSON safe random password (alphanumeric only)
-  local pwd=""
-  if command -v openssl >/dev/null 2>&1; then
-    pwd=$(openssl rand -base64 32 | tr -dc 'A-Za-z0-9' | head -c 20)
-  else
-    pwd=$(tr -dc 'A-Za-z0-9' </dev/urandom | head -c 20)
+check_super_admin_user_exists() {
+  # Check if super admin user exists in Supabase
+  local email="suadmin@nexent.com"
+  local curl_container="nexent-config"
+
+  # Determine which container to use for curl command
+  if [ "$DEPLOYMENT_MODE" = "infrastructure" ] || ! docker ps | grep -q "nexent-config"; then
+    if docker ps | grep -q "supabase-db-mini"; then
+      curl_container="supabase-db-mini"
+    else
+      echo "   ⚠️  Warning: Cannot check user existence - no suitable container available"
+      return 2  # Unknown status
+    fi
+  fi
+
+  # Try to query Supabase auth.users table directly (most reliable)
+  if [ "$DEPLOYMENT_VERSION" = "full" ] && docker ps | grep -q "supabase-db-mini"; then
+    local user_exists
+    user_exists=$(docker exec supabase-db-mini psql -U postgres -d "$SUPABASE_POSTGRES_DB" -t -c "SELECT COUNT(*) FROM auth.users WHERE email = '${email}';" 2>/dev/null | tr -d '[:space:]')
+    if [ "$user_exists" = "1" ]; then
+      return 0  # User exists
+    elif [ "$user_exists" = "0" ]; then
+      return 1  # User does not exist
+    fi
   fi
-  if [ -z "$pwd" ]; then
-    # Fallback (should be extremely rare)
-    pwd=$(date +%s%N | tr -dc '0-9' | head -c 20)
+
+  # Fallback: Try to sign in with a dummy password to check if user exists
+  # This is less reliable but works when database access is not available
+  local test_response
+  test_response=$(docker exec "$curl_container" bash -c "curl -s -X POST http://kong:8000/auth/v1/token?grant_type=password -H \"apikey: ${SUPABASE_KEY}\" -H \"Content-Type: application/json\" -d '{\"email\":\"${email}\",\"password\":\"dummy_password_check\"}'" 2>/dev/null)
+
+  if echo "$test_response" | grep -q '"error_code":"invalid_credentials"'; then
+    return 0  # User exists (wrong password means user exists)
+  elif echo "$test_response" | grep -q '"error_code":"email_not_confirmed"'; then
+    return 0  # User exists
+  else
+    return 1  # User likely does not exist
   fi
-  echo "$pwd"
+}
+
+prompt_super_admin_password() {
+  # Prompt user to enter password for super admin user with confirmation
+  # Note: All prompts go to stderr, only password is returned via stdout
+  local password=""
+  local password_confirm=""
+  local max_attempts=3
+  local attempts=0
+
+  echo "" >&2
+  echo "🔐 Super Admin User Password Setup" >&2
+  echo "   Email: suadmin@nexent.com" >&2
+  echo "" >&2
+
+  while [ $attempts -lt $max_attempts ]; do
+    # First password input
+    echo "   🔐 Please enter password for super admin user:" >&2
+    read -s password
+    echo "" >&2
+
+    # Check if password is empty
+    if [ -z "$password" ]; then
+      echo "   ❌ Password cannot be empty. Please try again." >&2
+      attempts=$((attempts + 1))
+      continue
+    fi
+
+    # Confirm password input
+    echo "   🔐 Please confirm the password:" >&2
+    read -s password_confirm
+    echo "" >&2
+
+    # Check if passwords match
+    if [ "$password" != "$password_confirm" ]; then
+      echo "   ❌ Passwords do not match. Please try again." >&2
+      attempts=$((attempts + 1))
+      continue
+    fi
+
+    # Passwords match, return the password via stdout
+    echo "$password"
+    return 0
+  done
+
+  # Max attempts reached
+  echo "   ❌ Maximum attempts reached. Failed to set password." >&2
+  return 1
 }
 
 create_default_super_admin_user() {
   # Call the dedicated script for creating super admin user
   local script_path="$SCRIPT_DIR/create-su.sh"
+  local email="suadmin@nexent.com"
 
   if [ ! -f "$script_path" ]; then
     echo "   ❌ ERROR create-su.sh not found at $script_path"
@@ -892,15 +966,43 @@ create_default_super_admin_user() {
   # Make sure the script is executable
   chmod +x "$script_path"
 
+  # Check if super admin user already exists
+  echo ""
+  echo "🔍 Checking if super admin user exists..."
+  local check_result
+  check_super_admin_user_exists
+  check_result=$?
+
+  if [ $check_result -eq 0 ]; then
+    echo "   ✅ Super admin user (${email}) already exists."
+    echo "   💡 Skipping user creation. If you need to reset the password, please do so manually."
+    return 0
+  elif [ $check_result -eq 1 ]; then
+    echo "   ℹ️  Super admin user (${email}) does not exist. Proceeding with creation..."
+  else
+    echo "   ⚠️  Warning: Could not determine if user exists. Proceeding with creation..."
+  fi
+
+  # Prompt for password
+  local password
+  password="$(prompt_super_admin_password)"
+  local prompt_result=$?
+
+  if [ $prompt_result -ne 0 ] || [ -z "$password" ]; then
+    echo "   ❌ Failed to get password from user."
+    return 1
+  fi
+
   # Export necessary environment variables for the script
   export SUPABASE_KEY
   export POSTGRES_USER
   export POSTGRES_DB
   export DEPLOYMENT_VERSION
   export SUPABASE_POSTGRES_DB
+  export DEPLOYMENT_MODE
 
-  # Execute the script with current environment variables
-  if bash "$script_path"; then
+  # Execute the script with password as argument
+  if bash "$script_path" "$password"; then
     return 0
   else
     return 1
@@ -984,6 +1086,12 @@ main_deploy() {
   # Special handling for infrastructure mode
   if [ "$DEPLOYMENT_MODE" = "infrastructure" ]; then
     generate_env_for_infrastructure || { echo "❌ Environment generation failed"; exit 1; }
+
+    # Create default super admin user (only for full version)
+    if [ "$DEPLOYMENT_VERSION" = "full" ]; then
+      create_default_super_admin_user || { echo "❌ Default super admin user creation failed"; exit 1; }
+    fi
+
     echo "🎉 Infrastructure deployment completed successfully!"
     echo "     You can now start the core services manually using dev containers"
     echo "     Environment file available at: $(cd .. && pwd)/.env"
diff --git a/docker/docker-compose.prod.yml b/docker/docker-compose.prod.yml
index e9d344461..8eef651ae 100644
--- a/docker/docker-compose.prod.yml
+++ b/docker/docker-compose.prod.yml
@@ -272,6 +272,7 @@ services:
         mc admin policy attach myadmin readwrite --user=$MINIO_ACCESS_KEY
         mc mb myadmin/$MINIO_DEFAULT_BUCKET
         mc anonymous set download myadmin/$MINIO_DEFAULT_BUCKET
+        mc ilm rule add myadmin/$MINIO_DEFAULT_BUCKET --prefix 'preview/' --expiry-days 7 --id expire-converted-pdfs
         wait $$MINIO_PID
       "
 
diff --git a/docker/docker-compose.yml b/docker/docker-compose.yml
index 221ff0c89..321f29665 100644
--- a/docker/docker-compose.yml
+++ b/docker/docker-compose.yml
@@ -298,6 +298,7 @@ services:
         mc admin policy attach myadmin readwrite --user=$MINIO_ACCESS_KEY
         mc mb myadmin/$MINIO_DEFAULT_BUCKET
         mc anonymous set download myadmin/$MINIO_DEFAULT_BUCKET
+        mc ilm rule add myadmin/$MINIO_DEFAULT_BUCKET --prefix 'preview/' --expiry-days 7 --id expire-converted-pdfs
         wait $$MINIO_PID
       "
 
diff --git a/docker/sql/v1.8.1_0306_add_user_token_info.sql b/docker/sql/v1.8.1_0306_add_user_token_info.sql
new file mode 100644
index 000000000..040530334
--- /dev/null
+++ b/docker/sql/v1.8.1_0306_add_user_token_info.sql
@@ -0,0 +1,118 @@
+-- Migration: Add user_token_info_t and user_token_usage_log_t tables
+-- Date: 2026-03-06
+-- Description: Create user token (AK/SK) management tables with audit fields
+
+-- Set search path to nexent schema
+SET search_path TO nexent;
+
+-- Create the user_token_info_t table in the nexent schema
+CREATE TABLE IF NOT EXISTS nexent.user_token_info_t (
+    token_id SERIAL4 PRIMARY KEY NOT NULL,
+    access_key VARCHAR(100) NOT NULL,
+    user_id VARCHAR(100) NOT NULL,
+    create_time TIMESTAMP WITHOUT TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+    update_time TIMESTAMP WITHOUT TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+    created_by VARCHAR(100),
+    updated_by VARCHAR(100),
+    delete_flag VARCHAR(1) DEFAULT 'N'
+);
+
+ALTER TABLE "user_token_info_t" OWNER TO "root";
+
+-- Add comment to the table
+COMMENT ON TABLE nexent.user_token_info_t IS 'User token (AK/SK) information table';
+
+-- Add comments to the columns
+COMMENT ON COLUMN nexent.user_token_info_t.token_id IS 'Token ID, unique primary key';
+COMMENT ON COLUMN nexent.user_token_info_t.access_key IS 'Access Key (AK)';
+COMMENT ON COLUMN nexent.user_token_info_t.user_id IS 'User ID who owns this token';
+COMMENT ON COLUMN nexent.user_token_info_t.create_time IS 'Creation time, audit field';
+COMMENT ON COLUMN nexent.user_token_info_t.update_time IS 'Update time, audit field';
+COMMENT ON COLUMN nexent.user_token_info_t.created_by IS 'Creator ID, audit field';
+COMMENT ON COLUMN nexent.user_token_info_t.updated_by IS 'Last updater ID, audit field';
+COMMENT ON COLUMN nexent.user_token_info_t.delete_flag IS 'Soft delete flag, Y means deleted';
+
+-- Create unique index on access_key to ensure uniqueness
+CREATE UNIQUE INDEX IF NOT EXISTS idx_user_token_info_access_key ON nexent.user_token_info_t(access_key) WHERE delete_flag = 'N';
+
+-- Create index on user_id for query performance
+CREATE INDEX IF NOT EXISTS idx_user_token_info_user_id ON nexent.user_token_info_t(user_id) WHERE delete_flag = 'N';
+
+-- Create a function to update the update_time column
+CREATE OR REPLACE FUNCTION update_user_token_info_update_time()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.update_time = CURRENT_TIMESTAMP;
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- Add comment to the function
+COMMENT ON FUNCTION update_user_token_info_update_time() IS 'Function to update the update_time column when a record in user_token_info_t is updated';
+
+-- Create a trigger to call the function before each update
+DROP TRIGGER IF EXISTS update_user_token_info_update_time_trigger ON nexent.user_token_info_t;
+CREATE TRIGGER update_user_token_info_update_time_trigger
+BEFORE UPDATE ON nexent.user_token_info_t
+FOR EACH ROW
+EXECUTE FUNCTION update_user_token_info_update_time();
+
+-- Add comment to the trigger
+COMMENT ON TRIGGER update_user_token_info_update_time_trigger ON nexent.user_token_info_t IS 'Trigger to call update_user_token_info_update_time function before each update on user_token_info_t table';
+
+
+-- Create the user_token_usage_log_t table in the nexent schema
+CREATE TABLE IF NOT EXISTS nexent.user_token_usage_log_t (
+    token_usage_id SERIAL4 PRIMARY KEY NOT NULL,
+    token_id INT4 NOT NULL,
+    call_function_name VARCHAR(100),
+    related_id INT4,
+    meta_data JSONB,
+    create_time TIMESTAMP WITHOUT TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+    update_time TIMESTAMP WITHOUT TIME ZONE DEFAULT CURRENT_TIMESTAMP,
+    created_by VARCHAR(100),
+    updated_by VARCHAR(100),
+    delete_flag VARCHAR(1) DEFAULT 'N'
+);
+
+ALTER TABLE "user_token_usage_log_t" OWNER TO "root";
+
+-- Add comment to the table
+COMMENT ON TABLE nexent.user_token_usage_log_t IS 'User token usage log table';
+
+-- Add comments to the columns
+COMMENT ON COLUMN nexent.user_token_usage_log_t.token_usage_id IS 'Token usage log ID, unique primary key';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.token_id IS 'Foreign key to user_token_info_t.token_id';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.call_function_name IS 'API function name being called';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.related_id IS 'Related resource ID (e.g., conversation_id)';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.meta_data IS 'Additional metadata for this usage log entry, stored as JSON';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.create_time IS 'Creation time, audit field';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.update_time IS 'Update time, audit field';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.created_by IS 'Creator ID, audit field';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.updated_by IS 'Last updater ID, audit field';
+COMMENT ON COLUMN nexent.user_token_usage_log_t.delete_flag IS 'Soft delete flag, Y means deleted';
+
+-- Create index on token_id for query performance
+CREATE INDEX IF NOT EXISTS idx_user_token_usage_log_token_id ON nexent.user_token_usage_log_t(token_id);
+
+-- Create index on call_function_name for query performance
+CREATE INDEX IF NOT EXISTS idx_user_token_usage_log_function_name ON nexent.user_token_usage_log_t(call_function_name);
+
+-- Add foreign key constraint
+ALTER TABLE nexent.user_token_usage_log_t
+ADD CONSTRAINT fk_user_token_usage_log_token_id
+FOREIGN KEY (token_id)
+REFERENCES nexent.user_token_info_t(token_id)
+ON DELETE CASCADE;
+
+
+-- Migration: Remove partner_mapping_id_t table for northbound conversation ID mapping
+-- Date: 2026-03-10
+-- Description: Remove the external-internal conversation ID mapping table as northbound APIs now use internal conversation IDs directly
+-- Note: This table is no longer needed after refactoring northbound authentication logic
+
+-- Drop the partner_mapping_id_t table if it exists
+DROP TABLE IF EXISTS nexent.partner_mapping_id_t CASCADE;
+
+-- Drop the associated sequence if it exists
+DROP SEQUENCE IF EXISTS nexent.partner_mapping_id_t_id_seq;
diff --git a/frontend/app/[locale]/agents/components/agentConfig/ToolManagement.tsx b/frontend/app/[locale]/agents/components/agentConfig/ToolManagement.tsx
index f5815a094..c16ab969e 100644
--- a/frontend/app/[locale]/agents/components/agentConfig/ToolManagement.tsx
+++ b/frontend/app/[locale]/agents/components/agentConfig/ToolManagement.tsx
@@ -1,17 +1,17 @@
 "use client";
 
-import { useState, useEffect, useCallback, useMemo } from "react";
+import { useState, useEffect, useCallback } from "react";
 import { useTranslation } from "react-i18next";
 import ToolConfigModal from "./tool/ToolConfigModal";
 import { ToolGroup, Tool, ToolParam } from "@/types/agentConfig";
 import { Tabs, Collapse, message, Tooltip } from "antd";
 import { useAgentConfigStore } from "@/stores/agentConfigStore";
 import { useToolList } from "@/hooks/agent/useToolList";
-import { useModelList } from "@/hooks/model/useModelList";
 import { usePrefetchKnowledgeBases } from "@/hooks/useKnowledgeBaseSelector";
 import { useConfig } from "@/hooks/useConfig";
 import { updateToolConfig } from "@/services/agentConfigService";
 import { useQueryClient } from "@tanstack/react-query";
+import { useConfirmModal } from "@/hooks/useConfirmModal";
 
 import { Settings, AlertTriangle } from "lucide-react";
 
@@ -26,6 +26,7 @@ const TOOLS_REQUIRING_KB_SELECTION = [
   "knowledge_base_search",
   "dify_search",
   "datamate_search",
+  "idata_search",
 ];
 
 // Tool types that require Embedding model
@@ -40,10 +41,11 @@ const TOOLS_REQUIRING_VLM = [
 
 function getToolKbType(
   toolName: string
-): "knowledge_base_search" | "dify_search" | "datamate_search" | null {
+): "knowledge_base_search" | "dify_search" | "datamate_search" | "idata_search" | null {
   if (!TOOLS_REQUIRING_KB_SELECTION.includes(toolName)) return null;
   if (toolName === "dify_search") return "dify_search";
   if (toolName === "datamate_search") return "datamate_search";
+  if (toolName === "idata_search") return "idata_search";
   return "knowledge_base_search";
 }
 
@@ -74,6 +76,7 @@ export default function ToolManagement({
 }: ToolManagementProps) {
   const { t } = useTranslation("common");
   const queryClient = useQueryClient();
+  const { confirm } = useConfirmModal();
 
   // Get current agent permission from store
   const currentAgentPermission = useAgentConfigStore(
@@ -98,73 +101,7 @@ export default function ToolManagement({
   // Use tool list hook for data management
   const { availableTools } = useToolList();
 
-  // Get config for model checks
-  const { modelConfig: tenantModelConfig } = useConfig();
-
-  // Get VLM models to check availability
-  const { availableVlmModels, models } = useModelList();
-
-  // Check if VLM is properly configured:
-  // 1. Must have at least one VLM model that passed health check (available)
-  // 2. Must have a VLM model selected in tenant configuration
-  const isVlmConfigured = useMemo(() => {
-    // Check if there's any available VLM model
-    if (!availableVlmModels || availableVlmModels.length === 0) {
-      return false;
-    }
-
-    // Check if tenant configuration has selected a VLM model
-    try {
-      const selectedVlmModelName = tenantModelConfig?.vlm?.modelName || tenantModelConfig?.vlm?.displayName;
-
-      if (!selectedVlmModelName) {
-        return false;
-      }
-
-      // Check if the selected VLM model exists in available models
-      const isSelectedModelAvailable = availableVlmModels.some(
-        (model) => model.name === selectedVlmModelName || model.displayName === selectedVlmModelName
-      );
-
-      return isSelectedModelAvailable;
-    } catch (error) {
-      return false;
-    }
-  }, [availableVlmModels, models, tenantModelConfig]);
-
-  // Get Embedding models to check availability
-  const { availableEmbeddingModels } = useModelList();
-
-  // Check if Embedding is properly configured:
-  // 1. Must have at least one Embedding model that passed health check (available)
-  // 2. Must have an Embedding model selected in tenant configuration
-  const isEmbeddingConfigured = useMemo(() => {
-    // Check if there's any available Embedding model
-    if (!availableEmbeddingModels || availableEmbeddingModels.length === 0) {
-      return false;
-    }
-
-    // Check if tenant configuration has selected an Embedding model
-    try {
-      const selectedEmbeddingModelName =
-        tenantModelConfig?.embedding?.modelName || tenantModelConfig?.embedding?.displayName;
-
-      if (!selectedEmbeddingModelName) {
-        return false;
-      }
-
-      // Check if the selected Embedding model exists in available models
-      const isSelectedModelAvailable = availableEmbeddingModels.some(
-        (model) =>
-          model.name === selectedEmbeddingModelName ||
-          model.displayName === selectedEmbeddingModelName
-      );
-
-      return isSelectedModelAvailable;
-    } catch (error) {
-      return false;
-    }
-  }, [availableEmbeddingModels, models, tenantModelConfig]);
+  const { isVlmAvailable, isEmbeddingAvailable } = useConfig();
 
   // Prefetch knowledge bases for KB tools
   const { prefetchKnowledgeBases } = usePrefetchKnowledgeBases();
@@ -235,9 +172,7 @@ export default function ToolManagement({
       (t) => parseInt(t.id) === parseInt(tool.id)
     );
     // Merge configured tool with original tool to ensure all fields are present
-    const toolToUse = configuredTool
-      ? { ...tool, ...configuredTool, initParams: configuredTool.initParams }
-      : tool;
+    const toolToUse = configuredTool ? { ...tool, ...configuredTool, initParams: configuredTool.initParams } : tool;
 
     // Get merged parameters (for editing mode, merge with instance params)
     const mergedParams = await mergeToolParamsWithInstance(
@@ -264,96 +199,96 @@ export default function ToolManagement({
     }
 
     // Get latest tools directly from store to avoid stale closure issues
-    const currentSelectdTools =
-      useAgentConfigStore.getState().editedAgent.tools;
+    const currentSelectdTools = useAgentConfigStore.getState().editedAgent.tools;
     const isCurrentlySelected = currentSelectdTools.some(
       (t) => parseInt(t.id) === numericId
     );
 
     if (isCurrentlySelected) {
       // If already selected, deselect it
-      const newSelectedTools = currentSelectdTools.filter(
-        (t) => parseInt(t.id) !== numericId
-      );
+      const newSelectedTools = currentSelectdTools.filter((t) => parseInt(t.id) !== numericId);
       updateTools(newSelectedTools);
     } else {
-      // If not selected, determine tool params and check if modal is needed
-      const configuredTool = currentSelectdTools.find(
-        (t) => parseInt(t.id) === numericId
-      );
-      // Merge configured tool with original tool to ensure all fields are present
-      const toolToUse = configuredTool
-        ? { ...tool, ...configuredTool, initParams: configuredTool.initParams }
-        : tool;
-
-      // Get merged parameters (for editing mode, merge with instance params)
-      const mergedParams = await mergeToolParamsWithInstance(
-        tool,
-        toolToUse,
-        isCreatingMode ? undefined : currentAgentId!
-      );
+      // Helper function to proceed with tool selection after duplicate check
+      async function proceedWithToolSelection() {
+        // Get latest tools again to ensure we have the most up-to-date list
+        const currentSelectdTools =
+          useAgentConfigStore.getState().editedAgent.tools;
+
+        // Determine tool params and check if modal is needed
+        const configuredTool = currentSelectdTools.find(
+          (t) => parseInt(t.id) === numericId
+        );
+        // Merge configured tool with original tool to ensure all fields are present
+        const toolToUse = configuredTool
+          ? { ...tool, ...configuredTool, initParams: configuredTool.initParams }
+          : tool;
+
+        // Get merged parameters (for editing mode, merge with instance params)
+        const mergedParams = await mergeToolParamsWithInstance(
+          tool,
+          toolToUse,
+          isCreatingMode ? undefined : currentAgentId!
+        );
+
+        // Check if there are empty required params
+        const hasEmptyRequiredParams = mergedParams.some(
+          (param: ToolParam) =>
+            param.required &&
+            (param.value === undefined ||
+              param.value === "" ||
+              param.value === null)
+        );
+
+        if (hasEmptyRequiredParams) {
+          // Need to configure, open modal
+          setSelectedTool(toolToUse);
+          setToolParams(mergedParams);
+          setIsToolModalOpen(true);
+        } else {
+          // No required params missing, add directly
+          const newSelectedTools = [
+            ...currentSelectdTools,
+            {
+              ...toolToUse,
+              initParams: mergedParams,
+            },
+          ];
+          updateTools(newSelectedTools);
+        }
+      }
 
-      // Check if there are empty required params
-      const hasEmptyRequiredParams = mergedParams.some(
-        (param: ToolParam) =>
-          param.required &&
-          (param.value === undefined ||
-            param.value === "" ||
-            param.value === null)
+      // If not selected, check for duplicate tool names first
+      const duplicateTool = currentSelectdTools.find(
+        (selectedTool) => selectedTool.name === tool.name
       );
 
-      if (hasEmptyRequiredParams) {
-        // Need to configure, open modal
-        setSelectedTool(toolToUse);
-        setToolParams(mergedParams);
-        setIsToolModalOpen(true);
-      } else {
-        // No required params missing, add directly
-        const newSelectedTools = [
-          ...currentSelectdTools,
-          {
-            ...toolToUse,
-            initParams: mergedParams,
-          },
-        ];
-        updateTools(newSelectedTools);
-
-        // In non-creating mode, immediately save tool config to backend
-        if (!isCreatingMode && currentAgentId) {
-          try {
-            // Convert params to backend format
-            const paramsObj = mergedParams.reduce(
-              (acc, param) => {
-                acc[param.name] = param.value;
-                return acc;
-              },
-              {} as Record<string, any>
-            );
-
-            const isEnabled = true; // New tool is enabled by default
-            const result = await updateToolConfig(
-              numericId,
-              currentAgentId,
-              paramsObj,
-              isEnabled
-            );
-
-            if (result.success) {
-              // Invalidate queries to refresh tool info
-              queryClient.invalidateQueries({
-                queryKey: ["toolInfo", numericId, currentAgentId],
-              });
-            } else {
-              message.error(
-                result.message || t("toolConfig.message.saveError")
-              );
-            }
-          } catch (error) {
-            console.error("Failed to save tool config:", error);
-            message.error(t("toolConfig.message.saveError"));
-          }
-        }
+      if (duplicateTool) {
+        // Show confirmation modal for duplicate tool name
+        return new Promise<void>((resolve) => {
+          confirm({
+            title: t("toolPool.duplicateToolName.title"),
+            content: t("toolPool.duplicateToolName.content", {
+              toolName: tool.name,
+            }),
+            okText: t("toolPool.duplicateToolName.confirm"),
+            cancelText: t("toolPool.duplicateToolName.cancel"),
+            danger: true,
+            onOk: async () => {
+              // User confirmed, proceed with tool selection
+              await proceedWithToolSelection();
+              resolve();
+            },
+            onCancel: () => {
+              // User cancelled, do nothing
+              resolve();
+            },
+          });
+        });
       }
+
+      // No duplicate, proceed with normal tool selection
+      await proceedWithToolSelection();
     }
   };
 
@@ -428,8 +363,8 @@ export default function ToolManagement({
                           const isSelected = originalSelectedToolIdsSet.has(
                             tool.id
                           );
-                          const isDisabledDueToVlm = isToolDisabledDueToVlm(tool.name, isVlmConfigured);
-                          const isDisabledDueToEmbedding = isToolDisabledDueToEmbedding(tool.name, isEmbeddingConfigured);
+                          const isDisabledDueToVlm = isToolDisabledDueToVlm(tool.name, isVlmAvailable);
+                          const isDisabledDueToEmbedding = isToolDisabledDueToEmbedding(tool.name, isEmbeddingAvailable);
                           const isDisabled = isDisabledDueToVlm || isDisabledDueToEmbedding || isReadOnly;
                           // Tooltip priority: permission > VLM > Embedding
                           const tooltipTitle = isReadOnly
@@ -533,8 +468,8 @@ export default function ToolManagement({
             >
               {group.tools.map((tool) => {
                 const isSelected = originalSelectedToolIdsSet.has(tool.id);
-                const isDisabledDueToVlm = isToolDisabledDueToVlm(tool.name, isVlmConfigured);
-                const isDisabledDueToEmbedding = isToolDisabledDueToEmbedding(tool.name, isEmbeddingConfigured);
+                const isDisabledDueToVlm = isToolDisabledDueToVlm(tool.name, isVlmAvailable);
+                const isDisabledDueToEmbedding = isToolDisabledDueToEmbedding(tool.name, isEmbeddingAvailable);
                 const isDisabled = isDisabledDueToVlm || isDisabledDueToEmbedding || isReadOnly;
                 // Tooltip priority: permission > VLM > Embedding
                 const tooltipTitle = isReadOnly
diff --git a/frontend/app/[locale]/agents/components/agentConfig/tool/ToolConfigModal.tsx b/frontend/app/[locale]/agents/components/agentConfig/tool/ToolConfigModal.tsx
index 2a616326b..fc927d51d 100644
--- a/frontend/app/[locale]/agents/components/agentConfig/tool/ToolConfigModal.tsx
+++ b/frontend/app/[locale]/agents/components/agentConfig/tool/ToolConfigModal.tsx
@@ -27,6 +27,7 @@ import { useConfig } from "@/hooks/useConfig";
 import { useKnowledgeBasesForToolConfig } from "@/hooks/useKnowledgeBaseSelector";
 import { useKnowledgeBaseConfigChangeHandler } from "@/hooks/useKnowledgeBaseConfigChangeHandler";
 import { API_ENDPOINTS } from "@/services/api";
+import knowledgeBaseService from "@/services/knowledgeBaseService";
 import log from "@/lib/logger";
 
 export interface ToolConfigModalProps {
@@ -45,6 +46,7 @@ const TOOLS_REQUIRING_KB_SELECTION = [
   "knowledge_base_search",
   "dify_search",
   "datamate_search",
+  "idata_search",
 ];
 
 export default function ToolConfigModal({
@@ -91,6 +93,26 @@ export default function ToolConfigModal({
     apiKey: "",
   });
 
+  // iData configuration state
+  const [idataConfig, setIdataConfig] = useState<{
+    serverUrl: string;
+    apiKey: string;
+    userId: string;
+    knowledgeSpaceId: string;
+  }>({
+    serverUrl: "",
+    apiKey: "",
+    userId: "",
+    knowledgeSpaceId: "",
+  });
+
+  // iData knowledge spaces state
+  const [idataKnowledgeSpaces, setIdataKnowledgeSpaces] = useState<
+    Array<{ id: string; name: string }>
+  >([]);
+  const [idataKnowledgeSpacesLoading, setIdataKnowledgeSpacesLoading] =
+    useState(false);
+
   // DataMate URL from knowledge base configuration
   const [knowledgeBaseDataMateUrl, setKnowledgeBaseDataMateUrl] =
     useState<string>("");
@@ -117,11 +139,13 @@ export default function ToolConfigModal({
     | "knowledge_base_search"
     | "dify_search"
     | "datamate_search"
+    | "idata_search"
     | null => {
     if (!toolRequiresKbSelection) return null;
     const name = tool?.name;
     if (name === "dify_search") return "dify_search";
     if (name === "datamate_search") return "datamate_search";
+    if (name === "idata_search") return "idata_search";
     return "knowledge_base_search";
   }, [tool?.name, toolRequiresKbSelection]);
 
@@ -147,6 +171,46 @@ export default function ToolConfigModal({
     }
   }, [toolKbType, difyServerUrlParam, difyApiKeyParam]);
 
+  // Get iData configuration from initial params
+  const idataServerUrlParam = useMemo(() => {
+    return currentParams.find((param) => param.name === "server_url");
+  }, [currentParams]);
+
+  const idataApiKeyParam = useMemo(() => {
+    return currentParams.find((param) => param.name === "api_key");
+  }, [currentParams]);
+
+  const idataUserIdParam = useMemo(() => {
+    return currentParams.find((param) => param.name === "user_id");
+  }, [currentParams]);
+
+  const idataKnowledgeSpaceIdParam = useMemo(() => {
+    return currentParams.find((param) => param.name === "knowledge_space_id");
+  }, [currentParams]);
+
+  // Initialize iData config from params
+  useEffect(() => {
+    if (toolKbType === "idata_search") {
+      const serverUrl = idataServerUrlParam?.value || "";
+      const apiKey = idataApiKeyParam?.value || "";
+      const userId = idataUserIdParam?.value || "";
+      const knowledgeSpaceId = idataKnowledgeSpaceIdParam?.value || "";
+
+      setIdataConfig({
+        serverUrl,
+        apiKey,
+        userId,
+        knowledgeSpaceId,
+      });
+    }
+  }, [
+    toolKbType,
+    idataServerUrlParam,
+    idataApiKeyParam,
+    idataUserIdParam,
+    idataKnowledgeSpaceIdParam,
+  ]);
+
   // Fetch knowledge bases for tool config based on tool type (now uses React Query caching)
   // For datamate_search, use the server_url from the form as config
   const datamateServerUrl = useMemo(() => {
@@ -157,6 +221,40 @@ export default function ToolConfigModal({
     return "";
   }, [toolKbType, currentParams]);
 
+  // Fetch iData knowledge spaces when config is available
+  useEffect(() => {
+    if (
+      toolKbType === "idata_search" &&
+      idataConfig.serverUrl &&
+      idataConfig.apiKey &&
+      idataConfig.userId
+    ) {
+      setIdataKnowledgeSpacesLoading(true);
+      knowledgeBaseService
+        .getIdataKnowledgeSpaces(
+          idataConfig.serverUrl,
+          idataConfig.apiKey,
+          idataConfig.userId
+        )
+        .then((spaces) => {
+          setIdataKnowledgeSpaces(spaces);
+          setIdataKnowledgeSpacesLoading(false);
+        })
+        .catch((error) => {
+          log.error("Failed to fetch iData knowledge spaces:", error);
+          setIdataKnowledgeSpaces([]);
+          setIdataKnowledgeSpacesLoading(false);
+        });
+    } else if (toolKbType === "idata_search") {
+      setIdataKnowledgeSpaces([]);
+    }
+  }, [
+    toolKbType,
+    idataConfig.serverUrl,
+    idataConfig.apiKey,
+    idataConfig.userId,
+  ]);
+
   const {
     data: knowledgeBases = [],
     isLoading: kbLoading,
@@ -168,7 +266,19 @@ export default function ToolConfigModal({
       ? difyConfig
       : toolKbType === "datamate_search"
         ? { serverUrl: datamateServerUrl }
-        : undefined
+        : toolKbType === "idata_search"
+          ? idataConfig.serverUrl &&
+            idataConfig.apiKey &&
+            idataConfig.userId &&
+            idataConfig.knowledgeSpaceId
+            ? {
+                serverUrl: idataConfig.serverUrl,
+                apiKey: idataConfig.apiKey,
+                userId: idataConfig.userId,
+                knowledgeSpaceId: idataConfig.knowledgeSpaceId,
+              }
+            : undefined
+          : undefined
   );
 
   // Handle config change: clear knowledge base selection and refetch
@@ -210,10 +320,92 @@ export default function ToolConfigModal({
         ? difyConfig
         : toolKbType === "datamate_search"
           ? { serverUrl: datamateServerUrl }
-          : undefined,
+          : toolKbType === "idata_search"
+            ? {
+                serverUrl: idataConfig.serverUrl,
+                apiKey: idataConfig.apiKey,
+                userId: idataConfig.userId,
+              }
+            : undefined,
     onConfigChange: handleKbConfigChange,
   });
 
+  // Handle iData knowledge space ID change: clear knowledge base selection and refetch
+  const prevKnowledgeSpaceIdRef = useRef<string>("");
+  useEffect(() => {
+    if (
+      toolKbType === "idata_search" &&
+      idataConfig.knowledgeSpaceId &&
+      idataConfig.serverUrl &&
+      idataConfig.apiKey &&
+      idataConfig.userId
+    ) {
+      // Only trigger if knowledge space ID actually changed
+      // Skip if this is the initial load (prevKnowledgeSpaceIdRef is empty and we have a value from initialParams)
+      if (prevKnowledgeSpaceIdRef.current === idataConfig.knowledgeSpaceId) {
+        return;
+      }
+
+      // If prevKnowledgeSpaceIdRef is empty, this is likely the initial load
+      // Don't clear dataset_ids on initial load, only when space ID actually changes
+      if (prevKnowledgeSpaceIdRef.current === "") {
+        // This is initial load, just update the ref without clearing
+        prevKnowledgeSpaceIdRef.current = idataConfig.knowledgeSpaceId;
+        return;
+      }
+
+      // Update ref
+      prevKnowledgeSpaceIdRef.current = idataConfig.knowledgeSpaceId;
+
+      // Clear previous knowledge base selection when space ID changes
+      setSelectedKbIds([]);
+      setSelectedKbDisplayNames([]);
+
+      // Clear form value for dataset_ids field
+      const kbFieldIndex = currentParams.findIndex(
+        (p) => p.name === "dataset_ids"
+      );
+      if (kbFieldIndex >= 0) {
+        form.setFieldValue(`param_${kbFieldIndex}`, []);
+        const updatedParams = [...currentParams];
+        updatedParams[kbFieldIndex] = {
+          ...updatedParams[kbFieldIndex],
+          value: [],
+        };
+        setCurrentParams(updatedParams);
+      }
+
+      // Refetch knowledge bases with new space ID
+      refetchKnowledgeBases();
+    } else if (toolKbType === "idata_search") {
+      // Reset ref when config is cleared
+      prevKnowledgeSpaceIdRef.current = "";
+    }
+  }, [
+    toolKbType,
+    idataConfig.knowledgeSpaceId,
+    idataConfig.serverUrl,
+    idataConfig.apiKey,
+    idataConfig.userId,
+    refetchKnowledgeBases,
+    currentParams,
+    form,
+  ]);
+
+  // Reset prevKnowledgeSpaceIdRef when modal opens/closes
+  useEffect(() => {
+    if (!isOpen) {
+      // Reset ref when modal closes
+      prevKnowledgeSpaceIdRef.current = "";
+    } else if (isOpen && toolKbType === "idata_search") {
+      // Initialize ref with current knowledgeSpaceId when modal opens
+      // This prevents clearing dataset_ids on initial load
+      if (idataConfig.knowledgeSpaceId) {
+        prevKnowledgeSpaceIdRef.current = idataConfig.knowledgeSpaceId;
+      }
+    }
+  }, [isOpen, toolKbType, idataConfig.knowledgeSpaceId]);
+
   // Get current embedding model from config for model matching
   const currentEmbeddingModel = useMemo(() => {
     try {
@@ -746,51 +938,10 @@ export default function ToolConfigModal({
         newSelectedTools = [...currentTools, updatedTool];
       }
 
-      // For editing mode (when currentAgentId exists), always call API
-      // For creating mode (isCreatingMode=true), update local state only
-      if (isCreatingMode) {
-        // In creating mode, just update local state
-        updateTools(newSelectedTools);
-        message.success(t("toolConfig.message.saveSuccess"));
-        handleClose(); // Close modal
-        return;
-      }
-
-      if (!currentAgentId) {
-        // Should not happen in normal editing mode, but handle gracefully
-        updateTools(newSelectedTools);
-        message.success(t("toolConfig.message.saveSuccess"));
-        handleClose(); // Close modal
-        return;
-      }
-
-      // Edit mode: call API to persist changes
-      try {
-        setIsLoading(true);
-        const isEnabled = true; //  New tool is enabled by default
-        const result = await updateToolConfig(
-          parseInt(toolToSave.id),
-          currentAgentId,
-          paramsObj,
-          isEnabled
-        );
-        setIsLoading(false);
-
-        if (result.success) {
-          // Update local state and invalidate queries
-          updateTools(newSelectedTools);
-          queryClient.invalidateQueries({
-            queryKey: ["toolInfo", parseInt(toolToSave.id), currentAgentId],
-          });
-          message.success(t("toolConfig.message.saveSuccess"));
-          handleClose(); // Close modal
-        } else {
-          message.error(result.message || t("toolConfig.message.saveError"));
-        }
-      } catch (error) {
-        setIsLoading(false);
-        message.error(t("toolConfig.message.saveError"));
-      }
+      // Update local state only - actual save will happen when user clicks "Save Agent"
+      updateTools(newSelectedTools);
+      message.success(t("toolConfig.message.saveSuccess"));
+      handleClose(); // Close modal
 
       // Call original onSave if provided
       if (onSave) {
@@ -888,7 +1039,8 @@ export default function ToolConfigModal({
   const getToolType = ():
     | "knowledge_base_search"
     | "dify_search"
-    | "datamate_search" => {
+    | "datamate_search"
+    | "idata_search" => {
     return toolKbType || "knowledge_base_search";
   };
 
@@ -1025,13 +1177,47 @@ export default function ToolConfigModal({
   );
 
   const renderParamInput = (param: ToolParam, index: number) => {
+    // Get field name for form
+    const fieldName = `param_${index}`;
+
     // Get options from frontend configuration based on tool name and parameter name
     const options = getToolParamOptions(tool.name, param.name);
 
     // Determine if this parameter should be rendered as a select dropdown
     const isSelectType = options && options.length > 0;
 
+    // Special handling for iData knowledge_space_id parameter
+    const isIdataKnowledgeSpaceId =
+      toolKbType === "idata_search" && param.name === "knowledge_space_id";
+
     const inputComponent = (() => {
+      // Handle iData knowledge space ID selector
+      if (isIdataKnowledgeSpaceId) {
+        const currentValue = form.getFieldValue(fieldName);
+        return (
+          <Select
+            placeholder={t("toolConfig.input.string.placeholder", {
+              name: param.description,
+            })}
+            loading={idataKnowledgeSpacesLoading}
+            value={currentValue}
+            options={idataKnowledgeSpaces.map((space) => ({
+              value: space.id,
+              label: space.name,
+            }))}
+            onChange={(value) => {
+              // Update idataConfig when space ID changes
+              setIdataConfig((prev) => ({
+                ...prev,
+                knowledgeSpaceId: value || "",
+              }));
+              // Also update form value
+              form.setFieldValue(fieldName, value);
+            }}
+          />
+        );
+      }
+
       // Handle select type - when options are defined in frontend config
       if (isSelectType) {
         return (
@@ -1406,7 +1592,14 @@ export default function ToolConfigModal({
             ? difyConfig
             : toolKbType === "datamate_search"
               ? { serverUrl: datamateServerUrl }
-              : undefined
+              : toolKbType === "idata_search"
+                ? {
+                    serverUrl: idataConfig.serverUrl,
+                    apiKey: idataConfig.apiKey,
+                    userId: idataConfig.userId,
+                    knowledgeSpaceId: idataConfig.knowledgeSpaceId,
+                  }
+                : undefined
         }
       />
     </>
diff --git a/frontend/app/[locale]/agents/components/agentInfo/AgentGenerateDetail.tsx b/frontend/app/[locale]/agents/components/agentInfo/AgentGenerateDetail.tsx
index 80b48fe34..3b118f5b7 100644
--- a/frontend/app/[locale]/agents/components/agentInfo/AgentGenerateDetail.tsx
+++ b/frontend/app/[locale]/agents/components/agentInfo/AgentGenerateDetail.tsx
@@ -29,6 +29,7 @@ import { generatePromptStream } from "@/services/promptService";
 import { useAuthorizationContext } from "@/components/providers/AuthorizationProvider";
 import { useDeployment } from "@/components/providers/deploymentProvider";
 import { useModelList } from "@/hooks/model/useModelList";
+import { useConfig } from "@/hooks/useConfig";
 import { useTenantList } from "@/hooks/tenant/useTenantList";
 import { useGroupList } from "@/hooks/group/useGroupList";
 import { USER_ROLES } from "@/const/auth";
@@ -62,8 +63,24 @@ export default function AgentGenerateDetail({
   const updateBusinessInfo = useAgentConfigStore((state) => state.updateBusinessInfo);
   const updateProfileInfo = useAgentConfigStore((state) => state.updateProfileInfo);
 
-  // Model data from React Query
-  const { availableLlmModels, defaultLlmModel, isLoading: loadingModels } = useModelList();
+  // Model data: default LLM name from config, resolve to full model from model list
+  const { defaultLlmModelName } = useConfig();
+  const { availableLlmModels, models, isLoading: loadingModels } = useModelList();
+  const defaultLlmModel = useMemo(() => {
+    if (defaultLlmModelName) {
+      const found = availableLlmModels.find(
+        (m) => m.name === defaultLlmModelName || m.displayName === defaultLlmModelName
+      );
+      if (found) return found;
+      return models.find(
+        (m) =>
+          m.type === "llm" &&
+          (m.name === defaultLlmModelName || m.displayName === defaultLlmModelName)
+      );
+    }
+    // No default configured: use the first available LLM, or undefined if none
+    return availableLlmModels[0];
+  }, [defaultLlmModelName, availableLlmModels, models]);
 
   // Tenant & group data for group selection
   const { data: tenantData } = useTenantList();
@@ -524,7 +541,21 @@ export default function AgentGenerateDetail({
         },
         (error) => {
           log.error("Generate prompt stream error:", error);
-          message.error(t("businessLogic.config.message.generateError"));
+          // Try to get i18n translated message using error code, fallback to backend message or default
+          let errorMessage = t("businessLogic.config.message.generateError");
+          if (error?.code) {
+            const i18nKey = `errorCode.${error.code}`;
+            const translated = t(i18nKey);
+            // Check if translation exists (i18next returns the key if not found)
+            if (translated !== i18nKey) {
+              errorMessage = translated;
+            } else if (error?.message) {
+              errorMessage = error.message;
+            }
+          } else if (error?.message) {
+            errorMessage = error.message;
+          }
+          message.error(errorMessage);
           setIsGenerating(false);
         },
         () => {
diff --git a/frontend/app/[locale]/agents/components/agentInfo/DebugConfig.tsx b/frontend/app/[locale]/agents/components/agentInfo/DebugConfig.tsx
index 3d37825ba..e6079d207 100644
--- a/frontend/app/[locale]/agents/components/agentInfo/DebugConfig.tsx
+++ b/frontend/app/[locale]/agents/components/agentInfo/DebugConfig.tsx
@@ -13,6 +13,11 @@ import { TaskWindow } from "@/app/chat/streaming/taskWindow";
 import { transformMessagesToTaskMessages } from "@/app/chat/streaming/messageTransformer";
 import { MESSAGE_ROLES } from "@/const/chatConfig";
 import log from "@/lib/logger";
+import {
+  getCachedDebugError,
+  cacheDebugError,
+  clearCachedDebugError,
+} from "@/lib/agentDebugErrorCache";
 
 // Agent debugging component Props interface
 interface AgentDebuggingProps {
@@ -97,8 +102,10 @@ function AgentDebugging({
                 {message.role === MESSAGE_ROLES.ASSISTANT &&
                   currentTaskMessages.length > 0 && (
                     <TaskWindow
+                      key={message.id || `task-${index}`}
                       messages={currentTaskMessages}
                       isStreaming={isStreaming && index === messages.length - 1}
+                      defaultExpanded={true}
                     />
                   )}
 
@@ -183,6 +190,46 @@ export default function DebugConfig({ agentId }: DebugConfigProps) {
     if (hasActiveStream) {
       handleStop();
     }
+
+    // Check for cached error from previous debug session
+    if (agentId !== undefined && agentId !== null && !isNaN(Number(agentId))) {
+      const cachedError = getCachedDebugError(Number(agentId));
+      if (cachedError) {
+        // Restore the cached error as a message with a step containing the error
+        const errorMessage: ChatMessageType = {
+          id: Date.now().toString(),
+          role: MESSAGE_ROLES.ASSISTANT,
+          content: cachedError,
+          timestamp: new Date(),
+          isComplete: true,
+          error: cachedError,
+          // Add a step with the error info so TaskWindow can display it
+          steps: [
+            {
+              id: "error-step",
+              title: "Error",
+              content: cachedError,
+              expanded: true,
+              metrics: "",
+              thinking: { content: "", expanded: true },
+              code: { content: "", expanded: true },
+              output: { content: cachedError, expanded: true },
+              contents: [
+                {
+                  id: "error-content",
+                  type: "error" as const,
+                  content: cachedError,
+                  expanded: true,
+                  timestamp: Date.now(),
+                  subType: "error",
+                },
+              ],
+            },
+          ],
+        };
+        setMessages([errorMessage]);
+      }
+    }
   }, [agentId]);
 
   // Reset timeout timer
@@ -241,6 +288,10 @@ export default function DebugConfig({ agentId }: DebugConfigProps) {
   const handleClearHistory = async () => {
     setMessages([]);
     stepIdCounter.current.current = 0;
+    // Clear cached error for this agent
+    if (agentId !== undefined && agentId !== null && !isNaN(Number(agentId))) {
+      clearCachedDebugError(Number(agentId));
+    }
   };
 
   // Process test question
@@ -269,16 +320,16 @@ export default function DebugConfig({ agentId }: DebugConfigProps) {
 
     setMessages((prev) => [...prev, userMessage, assistantMessage]);
 
-    try {
-      // Ensure agent_id is a number
-      let agentIdValue = undefined;
-      if (agentId !== undefined && agentId !== null) {
-        agentIdValue = Number(agentId);
-        if (isNaN(agentIdValue)) {
-          agentIdValue = undefined;
-        }
+    // Ensure agent_id is a number
+    let agentIdValue: number | undefined = undefined;
+    if (agentId !== undefined && agentId !== null) {
+      agentIdValue = Number(agentId);
+      if (isNaN(agentIdValue)) {
+        agentIdValue = undefined;
       }
+    }
 
+    try {
       // Call agent_run with AbortSignal
       const reader = await conversationService.runAgent(
         {
@@ -335,6 +386,11 @@ export default function DebugConfig({ agentId }: DebugConfigProps) {
             ? error.message
             : t("agent.debug.processError");
 
+        // Cache the error for future debug sessions
+        if (agentIdValue !== undefined) {
+          cacheDebugError(agentIdValue, errorMessage);
+        }
+
         setMessages((prev) => {
           const newMessages = [...prev];
           const lastMsg = newMessages[newMessages.length - 1];
diff --git a/frontend/app/[locale]/agents/page.tsx b/frontend/app/[locale]/agents/page.tsx
index 9cade7ff4..86a52750b 100644
--- a/frontend/app/[locale]/agents/page.tsx
+++ b/frontend/app/[locale]/agents/page.tsx
@@ -17,6 +17,7 @@ export default function AgentSetupOrchestrator() {
   const { pageVariants, pageTransition } = useSetupFlow();
   const searchParams = useSearchParams();
   const enterCreateMode = useAgentConfigStore((state) => state.enterCreateMode);
+  const reset = useAgentConfigStore((state) => state.reset);
 
   // Local UI state for version panel
   const [isShowVersionManagePanel, setIsShowVersionManagePanel] = useState(false);
@@ -32,6 +33,13 @@ export default function AgentSetupOrchestrator() {
     }
   }, [searchParams, enterCreateMode]);
 
+  // Reset agent selection state when leaving the page
+  useEffect(() => {
+    return () => {
+      reset();
+    };
+  }, [reset]);
+
   return (
     <div className="w-full h-full p-8">
       <motion.div
diff --git a/frontend/app/[locale]/chat/components/chatHeader.tsx b/frontend/app/[locale]/chat/components/chatHeader.tsx
index 730522420..a8a04d404 100644
--- a/frontend/app/[locale]/chat/components/chatHeader.tsx
+++ b/frontend/app/[locale]/chat/components/chatHeader.tsx
@@ -2,17 +2,14 @@
 
 import { useState, useRef, useEffect } from "react";
 import { useTranslation } from "react-i18next";
-import { Button } from "antd";
 
 import { Input } from "@/components/ui/input";
 import { loadMemoryConfig, setMemorySwitch } from "@/services/memoryService";
 import { useConfig } from "@/hooks/useConfig";
 import log from "@/lib/logger";
-import { useRouter } from "next/navigation";
 import { useAuthorizationContext } from "@/components/providers/AuthorizationProvider";
 import { useDeployment } from "@/components/providers/deploymentProvider";
 import { USER_ROLES } from "@/const/auth";
-import { saveView } from "@/lib/viewPersistence";
 import { useConfirmModal } from "@/hooks/useConfirmModal";
 
 interface ChatHeaderProps {
@@ -21,11 +18,9 @@ interface ChatHeaderProps {
 }
 
 export function ChatHeader({ title, onRename }: ChatHeaderProps) {
-  const router = useRouter();
   const [isEditing, setIsEditing] = useState(false);
   const [editTitle, setEditTitle] = useState(title);
 
-
   const inputRef = useRef<HTMLInputElement>(null);
   const { t, i18n } = useTranslation("common");
   const { user } = useAuthorizationContext();
@@ -124,40 +119,26 @@ export function ChatHeader({ title, onRename }: ChatHeaderProps) {
   return (
     <>
       <header className="border-b border-transparent bg-background">
-        <div className="p-3 pb-1">
-          <div className="relative flex flex-1">
-            <div className="absolute left-0 top-1/2 transform -translate-y-1/2">
-              {/* Left button area */}
-            </div>
-
-            <div className="w-full flex justify-center">
-              <div className="max-w-3xl w-full flex justify-center mt-2 mb-0">
-                {isEditing ? (
-                  <Input
-                    ref={inputRef}
-                    value={editTitle}
-                    onChange={(e) => setEditTitle(e.target.value)}
-                    onKeyDown={handleKeyDown}
-                    onBlur={handleSubmit}
-                    className="text-xl font-bold text-center h-9 max-w-xs"
-                    autoFocus
-                  />
-                ) : (
-                  <h1
-                    className="text-xl font-bold cursor-pointer px-2 py-1 rounded border border-transparent hover:border-slate-200"
-                    onDoubleClick={handleDoubleClick}
-                    title={t("chatHeader.doubleClickToEdit")}
-                  >
-                    {title}
-                  </h1>
-                )}
-              </div>
-            </div>
-
-            <div className="absolute right-0 top-1/2 transform -translate-y-1/2 flex items-center space-x-1 gap-1">
-              {/* Right side controls - now handled by navigation bar */}
-            </div>
-          </div>
+        <div className="w-full flex justify-center pt-4 pb-2">
+          {isEditing ? (
+            <Input
+              ref={inputRef}
+              value={editTitle}
+              onChange={(e) => setEditTitle(e.target.value)}
+              onKeyDown={handleKeyDown}
+              onBlur={handleSubmit}
+              className="text-xl font-bold text-center h-9 max-w-xs"
+              autoFocus
+            />
+          ) : (
+            <h1
+              className="text-xl font-bold cursor-pointer px-2 py-1 rounded border border-transparent hover:border-slate-200"
+              onDoubleClick={handleDoubleClick}
+              title={t("chatHeader.doubleClickToEdit")}
+            >
+              {title}
+            </h1>
+          )}
         </div>
       </header>
 
diff --git a/frontend/app/[locale]/chat/components/chatInput.tsx b/frontend/app/[locale]/chat/components/chatInput.tsx
index 7665b934c..9b175c8cd 100644
--- a/frontend/app/[locale]/chat/components/chatInput.tsx
+++ b/frontend/app/[locale]/chat/components/chatInput.tsx
@@ -1257,7 +1257,7 @@ export function ChatInput({
           </div>
         </div>
       ) : (
-        <div className="border-t-0 border-transparent bg-background">
+        <div className="border-t-0 border-transparent bg-background bg-white">
           <div className="max-w-3xl mx-auto">
             <div
               ref={dropAreaRef}
diff --git a/frontend/app/[locale]/chat/components/chatLeftSidebar.tsx b/frontend/app/[locale]/chat/components/chatLeftSidebar.tsx
index baf569c36..8ade0d72a 100644
--- a/frontend/app/[locale]/chat/components/chatLeftSidebar.tsx
+++ b/frontend/app/[locale]/chat/components/chatLeftSidebar.tsx
@@ -1,4 +1,4 @@
-import { useState, useRef, useEffect } from "react";
+import { useState } from "react";
 import {
   Clock,
   Plus,
@@ -8,15 +8,16 @@ import {
   ChevronLeft,
   ChevronRight,
 } from "lucide-react";
-import { useRouter } from "next/navigation";
 
-import { Button, Dropdown } from "antd";
-import { Input } from "@/components/ui/input";
-import { Tooltip, TooltipProvider } from "@/components/ui/tooltip";
-import { StaticScrollArea } from "@/components/ui/scrollArea";
+import { Button, Dropdown, Input, Layout, Tooltip, message } from "antd";
 import { useTranslation } from "react-i18next";
 import { useConfirmModal } from "@/hooks/useConfirmModal";
-import { ConversationListItem, ChatSidebarProps } from "@/types/chat";
+import { conversationService } from "@/services/conversationService";
+import {
+  type ConversationManagement,
+} from "@/hooks/chat/useConversationManagement";
+import { ConversationListItem, SettingsMenuItem } from "@/types/chat";
+import log from "@/lib/logger";
 
 // conversation status indicator component
 const ConversationStatusIndicator = ({
@@ -50,7 +51,7 @@ const ConversationStatusIndicator = ({
 };
 
 // Helper function - dialog classification
-const categorizeDialogs = (dialogs: ConversationListItem[]) => {
+const categorizeConversations = (conversations: ConversationListItem[]) => {
   const now = new Date();
   const today = new Date(
     now.getFullYear(),
@@ -59,248 +60,278 @@ const categorizeDialogs = (dialogs: ConversationListItem[]) => {
   ).getTime();
   const weekAgo = today - 7 * 24 * 60 * 60 * 1000;
 
-  const todayDialogs: ConversationListItem[] = [];
-  const weekDialogs: ConversationListItem[] = [];
-  const olderDialogs: ConversationListItem[] = [];
+  const todayConversations: ConversationListItem[] = [];
+  const weekConversations: ConversationListItem[] = [];
+  const olderConversations: ConversationListItem[] = [];
 
-  dialogs.forEach((dialog) => {
-    const dialogTime = dialog.create_time;
+  conversations.forEach((conversations) => {
+    const conversationTime = conversations.create_time;
 
-    if (dialogTime >= today) {
-      todayDialogs.push(dialog);
-    } else if (dialogTime >= weekAgo) {
-      weekDialogs.push(dialog);
+    if (conversationTime >= today) {
+      todayConversations.push(conversations);
+    } else if (conversationTime >= weekAgo) {
+      weekConversations.push(conversations);
     } else {
-      olderDialogs.push(dialog);
+      olderConversations.push(conversations);
     }
   });
 
   return {
-    today: todayDialogs,
-    week: weekDialogs,
-    older: olderDialogs,
+    today: todayConversations,
+    week: weekConversations,
+    older: olderConversations,
   };
 };
 
+// Chat sidebar props type
+export interface ChatSidebarProps {
+  streamingConversations: Set<number>;
+  completedConversations: Set<number>;
+  conversationManagement: ConversationManagement;
+  /** Called when user clicks a conversation - loads messages and updates selection */
+  onConversationSelect: (conversation: ConversationListItem) => void | Promise<void>;
+}
+
+const CONVERSATION_TITLE_MAX_LENGTH = 100;
+
 export function ChatSidebar({
-  conversationList,
-  selectedConversationId,
-  openDropdownId,
   streamingConversations,
   completedConversations,
-  onNewConversation,
-  onDialogClick,
-  onRename,
-  onDelete,
-  onSettingsClick,
-  onDropdownOpenChange,
-  onToggleSidebar,
-  expanded,
-  userEmail,
-  userAvatarUrl
+  conversationManagement,
+  onConversationSelect,
 }: ChatSidebarProps) {
   const { t } = useTranslation();
   const { confirm } = useConfirmModal();
-  const router = useRouter();
-  const { today, week, older } = categorizeDialogs(conversationList);
+  const { today, week, older } = categorizeConversations(conversationManagement.conversationList);
   const [editingId, setEditingId] = useState<number | null>(null);
-  const [editingTitle, setEditingTitle] = useState("");
-  const inputRef = useRef<HTMLInputElement>(null);
-
-  const [animationComplete, setAnimationComplete] = useState(false);
+  const [renameValue, setRenameValue] = useState("");
+  const [renameError, setRenameError] = useState<string | null>(null);
+  const [collapsed, setCollapsed] = useState(false);
+  const [openDropdownId, setOpenDropdownId] = useState<number | null>(null);
 
-  useEffect(() => {
-    // Reset animation state when expanded changes
-    setAnimationComplete(false);
+  const onToggleSidebar = () => setCollapsed((prev) => !prev);
 
-    // Set animation complete after the transition duration (200ms)
-    const timer = setTimeout(() => {
-      setAnimationComplete(true);
-    }, 200);
-
-    return () => clearTimeout(timer);
-  }, [expanded]);
-
-  // Handle edit start
-  const handleStartEdit = (dialogId: number, title: string) => {
-    setEditingId(dialogId);
-    setEditingTitle(title);
-    // Close any open dropdown menus
-    onDropdownOpenChange(false, null);
+  const handleRenameClick = (conversationId: number, currentTitle: string) => {
+    setEditingId(conversationId);
+    setRenameValue(currentTitle);
+    setRenameError(null);
+    setOpenDropdownId(null);
+  };
 
-    // Use setTimeout to ensure that the input box is focused after the DOM is updated
-    setTimeout(() => {
-      if (inputRef.current) {
-        inputRef.current.focus();
-        inputRef.current.select();
-      }
-    }, 10);
+  const validateRenameTitle = (title: string): string | null => {
+    const trimmedTitle = title.trim();
+    if (!trimmedTitle) {
+      return t("chatLeftSidebar.renameErrorEmpty");
+    }
+    if (trimmedTitle.length > CONVERSATION_TITLE_MAX_LENGTH) {
+      return t("chatLeftSidebar.renameErrorTooLong", {
+        max: CONVERSATION_TITLE_MAX_LENGTH,
+      });
+    }
+    return null;
   };
 
-  // Handle edit submission
-  const handleSubmitEdit = () => {
-    if (editingId !== null && editingTitle.trim()) {
-      onRename(editingId, editingTitle.trim());
+  const handleRename = async (conversationId: number, newTitle: string) => {
+    const trimmedTitle = newTitle.trim();
+    if (!trimmedTitle) return false;
+    try {
+      await conversationService.rename(conversationId, trimmedTitle);
+      await conversationManagement.fetchConversationList();
+      if (conversationManagement.selectedConversationId === conversationId) {
+        conversationManagement.setConversationTitle(trimmedTitle);
+      }
       setEditingId(null);
+      setRenameError(null);
+      return true;
+    } catch (error) {
+      log.error(t("chatInterface.renameFailed"), error);
+      setRenameError(t("chatLeftSidebar.renameErrorSubmitFailed"));
+      message.error(t("chatLeftSidebar.renameErrorSubmitFailed"));
+      return false;
     }
   };
 
-  // Handle edit cancellation
-  const handleCancelEdit = () => {
-    setEditingId(null);
-  };
+  const handleRenameSubmit = async (conversationId: number) => {
+    const validationError = validateRenameTitle(renameValue);
+    if (validationError) {
+      setRenameError(validationError);
+      message.warning(validationError);
+      return;
+    }
 
-  // Handle key events
-  const handleKeyDown = (e: React.KeyboardEvent) => {
-    if (e.key === "Enter") {
-      handleSubmitEdit();
-    } else if (e.key === "Escape") {
-      handleCancelEdit();
+    const success = await handleRename(conversationId, renameValue);
+    if (success) {
+      setRenameValue("");
     }
   };
 
-  // Handle delete click
-  const handleDeleteClick = (dialogId: number) => {
-    // Close dropdown menus
-    onDropdownOpenChange(false, null);
+  const handleRenameCancel = () => {
+    setEditingId(null);
+    setRenameValue("");
+    setRenameError(null);
+  };
+
+  // Handle delete
+  const handleDelete = (conversationId: number) => {
 
-    // Show confirmation modal
     confirm({
       title: t("chatLeftSidebar.confirmDeletionTitle"),
       content: t("chatLeftSidebar.confirmDeletionDescription"),
-      onOk: () => {
-        onDelete(dialogId);
+      onOk: async () => {
+        try {
+          await conversationService.delete(conversationId);
+          await conversationManagement.fetchConversationList();
+          if (conversationManagement.selectedConversationId === conversationId) {
+            conversationManagement.setSelectedConversationId(null);
+            conversationManagement.setConversationTitle(
+              t("chatInterface.newConversation")
+            );
+            conversationManagement.handleNewConversation();
+          }
+        } catch (error) {
+          log.error(t("chatInterface.deleteFailed"), error);
+        }
       },
     });
   };
 
   // Render dialog list items
-  const renderDialogList = (dialogs: ConversationListItem[], title: string) => {
-    if (dialogs.length === 0) return null;
+  const renderConversationList = (conversation: ConversationListItem[], title: string) => {
+    if (conversation.length === 0) return null;
 
     return (
-      <div className="space-y-1">
+      <div className="space-y-1 h-full w-full">
         <p
-          className="px-2 pr-3 text-sm font-medium text-gray-500 tracking-wide font-sans py-1"
-          style={{
-            fontWeight: "bold",
-            color: "#4d4d4d",
-            backgroundColor: "rgb(242 248 255)",
-            fontSize: "16px",
-            whiteSpace: "nowrap",
-          }}
+          className="flex items-center gap-1.5 px-3 py-1.5 text-s font-medium tracking-wide text-neutral-500 rounded-r whitespace-nowrap"
         >
           {title}
         </p>
-        {dialogs.map((dialog) => (
-          <div
-            key={dialog.conversation_id}
-            className={`flex items-center group rounded-md ${
-              selectedConversationId === dialog.conversation_id
-                ? "bg-blue-100"
-                : "hover:bg-slate-100"
-            }`}
-          >
-            {editingId === dialog.conversation_id ? (
-              // Edit mode
-              <div className="flex-1 px-3 py-2">
-                <Input
-                  ref={inputRef}
-                  value={editingTitle}
-                  onChange={(e) => setEditingTitle(e.target.value)}
-                  onKeyDown={handleKeyDown}
-                  onBlur={handleSubmitEdit}
-                  className="h-8 text-base"
-                  autoFocus
-                />
-              </div>
-            ) : (
-              // Display mode
-              <>
-                <TooltipProvider>
-                  <Tooltip
-                    title={
-                      <p className="break-words">{dialog.conversation_title}</p>
+        {conversation.map((conversation) => {
+          const isEditing = editingId === conversation.conversation_id;
+          return (
+            <div
+              key={conversation.conversation_id}
+              className={`flex items-center group rounded-md ${
+                conversationManagement.selectedConversationId ===
+                conversation.conversation_id
+                  ? "bg-blue-100"
+                  : "hover:bg-slate-100"
+              }`}
+            >
+            <div className="flex-1 min-w-0 overflow-hidden">
+              <Tooltip
+                title={!isEditing ? (
+                  <span className="break-words max-w-[300px] block">
+                    {conversation.conversation_title}
+                  </span>
+                ) : null}
+                placement="bottom"
+              >
+                <div
+                  className="flex items-center min-h-10 min-w-0 w-full px-3 py-1 cursor-pointer"
+                  onClick={() => {
+                    if (!isEditing) {
+                      onConversationSelect(conversation);
                     }
-                    placement="right"
-                    styles={{ root: { maxWidth: "300px" } }}
-                  >
-                    <Button
-                      type="text"
-                      size="middle"
-                      className="flex-1 justify-start text-left min-w-0 max-w-[250px] px-3 py-2 h-auto border-0 shadow-none bg-transparent hover:!bg-transparent active:!bg-transparent"
-                      onClick={() => onDialogClick(dialog)}
-                    >
-                      <ConversationStatusIndicator
-                        isStreaming={streamingConversations.has(
-                          dialog.conversation_id
-                        )}
-                        isCompleted={completedConversations.has(
-                          dialog.conversation_id
-                        )}
+                  }}
+                >
+                  <ConversationStatusIndicator
+                    isStreaming={streamingConversations.has(
+                      conversation.conversation_id
+                    )}
+                    isCompleted={completedConversations.has(
+                      conversation.conversation_id
+                    )}
+                  />
+                  <div className="chat-sidebar-editable-title flex items-center self-stretch flex-1 min-w-0 overflow-hidden">
+                    {isEditing ? (
+                      <Input
+                        autoFocus
+                        size="small"
+                        value={renameValue}
+                        status={renameError ? "error" : ""}
+                        onChange={(event) => {
+                          const nextValue = event.target.value;
+                          setRenameValue(nextValue);
+                          setRenameError(validateRenameTitle(nextValue));
+                        }}
+                        onPressEnter={() => handleRenameSubmit(conversation.conversation_id)}
+                        onBlur={() => handleRenameSubmit(conversation.conversation_id)}
+                        onKeyDown={(event) => {
+                          if (event.key === "Escape") {
+                            event.preventDefault();
+                            handleRenameCancel();
+                          }
+                        }}
+                        onClick={(event) => event.stopPropagation()}
+                        className="ml-0.5 flex-1 min-w-0 !h-8 !leading-8 !py-0 !text-base whitespace-nowrap"
                       />
-                      <span className="truncate block text-base font-normal text-gray-800 tracking-wide font-sans">
-                        {dialog.conversation_title}
+                    ) : (
+                      <span className="chat-sidebar-title-fade block whitespace-nowrap text-base font-normal text-gray-800 tracking-wide font-sans ml-0.5 flex-1 min-w-0 overflow-hidden [text-overflow:clip]">
+                        {conversation.conversation_title}
                       </span>
-                    </Button>
-                  </Tooltip>
-                </TooltipProvider>
+                    )}
+                </div>
+              </div>
+            </Tooltip>
+            </div>
 
-                <Dropdown
-                  open={openDropdownId === dialog.conversation_id.toString()}
-                  onOpenChange={(open) =>
-                    onDropdownOpenChange(
-                      open,
-                      dialog.conversation_id.toString()
-                    )
+            <div
+              className={`shrink-0 overflow-hidden flex items-center justify-center transition-opacity duration-150 ${
+                openDropdownId === conversation.conversation_id
+                  ? "w-9 opacity-100"
+                  : "w-0 opacity-0 group-hover:w-9 group-hover:opacity-100"
+              }`}
+            >
+              <Dropdown
+              onOpenChange={(open) => setOpenDropdownId(open ? conversation.conversation_id : null)}
+              menu={{
+                items: [
+                  {
+                    key: "rename",
+                    label: (
+                      <span className="flex items-center">
+                        <Pencil className="mr-2 h-5 w-5" />
+                        {t("chatLeftSidebar.rename")}
+                      </span>
+                    ),
+                  },
+                  {
+                    key: "delete",
+                    label: (
+                      <span className="flex items-center text-red-500">
+                        <Trash2 className="mr-2 h-5 w-5" />
+                        {t("chatLeftSidebar.delete")}
+                      </span>
+                    ),
+                  },
+                ],
+                onClick: ({ key }) => {
+                  if (key === "rename") {
+                    handleRenameClick(
+                      conversation.conversation_id,
+                      conversation.conversation_title
+                    );
+                  } else if (key === "delete") {
+                    handleDelete(conversation.conversation_id);
                   }
-                  menu={{
-                    items: [
-                      {
-                        key: "rename",
-                        label: (
-                          <span className="flex items-center">
-                            <Pencil className="mr-2 h-5 w-5" />
-                            {t("chatLeftSidebar.rename")}
-                          </span>
-                        ),
-                      },
-                      {
-                        key: "delete",
-                        label: (
-                          <span className="flex items-center text-red-500">
-                            <Trash2 className="mr-2 h-5 w-5" />
-                            {t("chatLeftSidebar.delete")}
-                          </span>
-                        ),
-                      },
-                    ],
-                    onClick: ({ key }) => {
-                      if (key === "rename") {
-                        handleStartEdit(
-                          dialog.conversation_id,
-                          dialog.conversation_title
-                        );
-                      } else if (key === "delete") {
-                        handleDeleteClick(dialog.conversation_id);
-                      }
-                    },
-                  }}
-                  placement="bottomRight"
-                  trigger={["click"]}
-                >
-                  <Button
-                    type="text"
-                    size="small"
-                    className="h-6 w-6 min-w-[24px] p-0 flex-shrink-0 opacity-0 group-hover:opacity-100 hover:bg-slate-100 hover:border hover:border-slate-200 mr-1 focus:outline-none focus:ring-0 rounded-full transition-opacity duration-200 flex items-center justify-center"
-                  >
-                    <MoreHorizontal className="h-4 w-4" />
-                  </Button>
-                </Dropdown>
-              </>
-            )}
-          </div>
-        ))}
+                },
+              }}
+              placement="bottomRight"
+              trigger={["click"]}
+            >
+              <Button
+                type="text"
+                size="small"
+                className="hover:!bg-transparent text-neutral-500"
+              >
+                <MoreHorizontal className="h-4 w-4" />
+              </Button>
+            </Dropdown>
+            </div>
+            </div>
+          );
+        })}
       </div>
     );
   };
@@ -311,40 +342,30 @@ export function ChatSidebar({
       <>
         {/* Expand/Collapse button */}
         <div className="py-3 flex justify-center">
-          <TooltipProvider>
-            <Tooltip
-              title={t("chatLeftSidebar.expandSidebar")}
-              placement="right"
+          <Tooltip title={t("chatLeftSidebar.expandSidebar")} placement="right">
+            <Button
+              type="text"
+              size="middle"
+              className="h-10 w-10 min-w-[40px] p-0 flex-shrink-0 hover:bg-slate-100 active:bg-slate-200 flex items-center justify-center rounded-full transition-colors duration-200"
+              onClick={onToggleSidebar}
             >
-              <Button
-                type="text"
-                size="middle"
-                className="h-10 w-10 min-w-[40px] p-0 flex-shrink-0 hover:bg-slate-100 active:bg-slate-200 flex items-center justify-center rounded-full transition-colors duration-200"
-                onClick={onToggleSidebar}
-              >
-                <ChevronRight className="h-5 w-5" />
-              </Button>
-            </Tooltip>
-          </TooltipProvider>
+              <ChevronRight className="h-5 w-5" />
+            </Button>
+          </Tooltip>
         </div>
 
         {/* New conversation button */}
-        <div className="py-3 flex justify-center">
-          <TooltipProvider>
-            <Tooltip
-              title={t("chatLeftSidebar.newConversation")}
-              placement="right"
+        <div className="py-1 flex justify-center">
+          <Tooltip title={t("chatLeftSidebar.newConversation")} placement="right">
+            <Button
+              type="text"
+              size="middle"
+              className="h-10 w-10 min-w-[40px] p-0 flex-shrink-0 hover:bg-slate-100 active:bg-slate-200 flex items-center justify-center rounded-full transition-colors duration-200"
+              onClick={conversationManagement.handleNewConversation}
             >
-              <Button
-                type="text"
-                size="middle"
-                className="h-10 w-10 min-w-[40px] p-0 flex-shrink-0 hover:bg-slate-100 active:bg-slate-200 flex items-center justify-center rounded-full transition-colors duration-200"
-                onClick={onNewConversation}
-              >
-                <Plus className="h-5 w-5" />
-              </Button>
-            </Tooltip>
-          </TooltipProvider>
+              <Plus className="h-5 w-5" />
+            </Button>
+          </Tooltip>
         </div>
 
         {/* Spacer */}
@@ -354,20 +375,26 @@ export function ChatSidebar({
   };
 
   return (
-    <>
-      <div
-        className="hidden md:flex w-64 flex-col border-r border-transparent bg-primary/5 text-base transition-all duration-300 ease-in-out overflow-hidden"
-        style={{ width: expanded ? "300px" : "70px" }}
-      >
-        {expanded || !animationComplete ? (
-          <div className="hidden md:flex flex-col h-full overflow-hidden">
+    <Layout.Sider
+      collapsible
+      collapsed={collapsed}
+      onCollapse={setCollapsed}
+      breakpoint="lg"
+      width={260}
+      collapsedWidth={40}
+      trigger={null}
+      theme="light"
+      className="border-r border-transparent !bg-[rgb(242,248,255)] w-full"
+    >
+      {!collapsed ? (
+        <div className="flex flex-col h-full w-full overflow-hidden space-between">
             <div className="m-4 mt-3">
               <div className="flex items-center gap-2">
                 <Button
                   type="default"
                   size="middle"
                   className="flex-1 justify-start text-base overflow-hidden h-10 border border-slate-300 hover:border-slate-400 hover:bg-white transition-colors duration-200"
-                  onClick={onNewConversation}
+                  onClick={conversationManagement.handleNewConversation}
                 >
                   <Plus
                     className="mr-2 flex-shrink-0"
@@ -377,53 +404,82 @@ export function ChatSidebar({
                     {t("chatLeftSidebar.newConversation")}
                   </span>
                 </Button>
-                <TooltipProvider>
-                  <Tooltip>
-                    <Tooltip title={t("chatLeftSidebar.collapseSidebar")}>
+                <Tooltip title={t("chatLeftSidebar.collapseSidebar")}>
+                  <Button
+                    type="text"
+                    size="middle"
+                    className="h-10 w-10 min-w-[40px] p-0 flex-shrink-0 hover:bg-slate-100 active:bg-slate-200 flex items-center justify-center rounded-full transition-colors duration-200"
+                    onClick={onToggleSidebar}
+                  >
+                    <ChevronLeft className="h-5 w-5" />
+                  </Button>
+                </Tooltip>
+              </div>
+            </div>
+
+            <div className="flex-1 min-h-0 p-3 pt-0 w-full flex flex-col overflow-hidden">
+              <div className="flex-1 min-h-0 flex flex-col overflow-y-auto">
+                <div className="flex flex-col gap-4 pb-4">
+                  {conversationManagement.conversationList.length > 0 ? 
+                  (
+                    <>
+                      {renderConversationList(today, t("chatLeftSidebar.today"))}
+                      {renderConversationList(week, t("chatLeftSidebar.last7Days"))}
+                      {renderConversationList(older, t("chatLeftSidebar.older"))}
+                    </>
+                  ) : (
+                    <div className="space-y-1">
+                      <p className="px-2 text-sm font-medium text-muted-foreground">
+                        {t("chatLeftSidebar.recentConversations")}
+                      </p>
                       <Button
                         type="text"
                         size="middle"
-                        className="h-10 w-10 min-w-[40px] p-0 flex-shrink-0 hover:bg-slate-100 active:bg-slate-200 flex items-center justify-center rounded-full transition-colors duration-200"
-                        onClick={onToggleSidebar}
+                        className="w-full justify-start flex items-center px-3 py-2 h-auto hover:bg-slate-50 transition-colors duration-200"
                       >
-                        <ChevronLeft className="h-5 w-5" />
+                        <Clock className="mr-2 h-5 w-5" />
+                        {t("chatLeftSidebar.noHistory")}
                       </Button>
-                    </Tooltip>
-                  </Tooltip>
-                </TooltipProvider>
+                    </div>
+                  )}
+                </div>
               </div>
             </div>
-
-            <StaticScrollArea className="flex-1 m-2">
-              <div className="space-y-4 pr-2">
-                {conversationList.length > 0 ? (
-                  <>
-                    {renderDialogList(today, t("chatLeftSidebar.today"))}
-                    {renderDialogList(week, t("chatLeftSidebar.last7Days"))}
-                    {renderDialogList(older, t("chatLeftSidebar.older"))}
-                  </>
-                ) : (
-                  <div className="space-y-1">
-                    <p className="px-2 text-sm font-medium text-muted-foreground">
-                      {t("chatLeftSidebar.recentConversations")}
-                    </p>
-                    <Button
-                      type="text"
-                      size="middle"
-                      className="w-full justify-start flex items-center px-3 py-2 h-auto hover:bg-slate-50 transition-colors duration-200"
-                    >
-                      <Clock className="mr-2 h-5 w-5" />
-                      {t("chatLeftSidebar.noHistory")}
-                    </Button>
-                  </div>
-                )}
-              </div>
-            </StaticScrollArea>
           </div>
         ) : (
           renderCollapsedSidebar()
         )}
-      </div>
-    </>
+      <style jsx global>{`
+        .chat-sidebar-title-fade {
+          -webkit-mask-image: linear-gradient(
+            to right,
+            #000 0%,
+            #000 88%,
+            transparent 100%
+          );
+          mask-image: linear-gradient(
+            to right,
+            #000 0%,
+            #000 88%,
+            transparent 100%
+          );
+        }
+
+        .group:hover .chat-sidebar-title-fade {
+          -webkit-mask-image: linear-gradient(
+            to right,
+            #000 0%,
+            #000 76%,
+            transparent 100%
+          );
+          mask-image: linear-gradient(
+            to right,
+            #000 0%,
+            #000 76%,
+            transparent 100%
+          );
+        }
+      `}</style>
+    </Layout.Sider>
   );
 }
diff --git a/frontend/app/[locale]/chat/components/chatRightPanel.tsx b/frontend/app/[locale]/chat/components/chatRightPanel.tsx
index 83b25c4b5..9eb9f6a7d 100644
--- a/frontend/app/[locale]/chat/components/chatRightPanel.tsx
+++ b/frontend/app/[locale]/chat/components/chatRightPanel.tsx
@@ -473,13 +473,13 @@ export function ChatRightPanel({
     <div
       className={`transition-all duration-300 ease-in-out ${
         isVisible ? "lg:flex w-[400px]" : "lg:flex w-0 opacity-0"
-      } hidden border-l bg-background relative flex-col h-full`}
+      } hidden border-l bg-background relative flex-col h-full bg-white`}
       style={{ maxWidth: "400px", overflow: "hidden" }}
     >
       {/* Image viewer modal */}
       {viewingImage && (
         <div
-          className="fixed inset-0 z-50 flex items-center justify-center bg-black/80"
+          className="fixed inset-0 z-[1000] flex items-center justify-center bg-black/80"
           onClick={() => setViewingImage(null)}
         >
           <div className="relative max-w-[90vw] max-h-[90vh]">
diff --git a/frontend/app/[locale]/chat/internal/chatInterface.tsx b/frontend/app/[locale]/chat/internal/chatInterface.tsx
index 2bbdc7ff3..785ff3c1c 100644
--- a/frontend/app/[locale]/chat/internal/chatInterface.tsx
+++ b/frontend/app/[locale]/chat/internal/chatInterface.tsx
@@ -30,8 +30,6 @@ import {
   createMessageAttachments,
   cleanupAttachmentUrls,
 } from "@/app/chat/internal/chatPreprocess";
-import { Tooltip, TooltipProvider } from "@/components/ui/tooltip";
-
 import { ConversationListItem, ApiConversationDetail } from "@/types/chat";
 import { ChatMessageType } from "@/types/chat";
 import { handleStreamResponse } from "@/app/chat/streaming/chatStreamHandler";
@@ -40,7 +38,7 @@ import {
   extractAssistantMsgFromResponse,
 } from "./extractMsgFromHistoryResponse";
 
-import { X } from "lucide-react";
+import { Layout } from "antd";
 import log from "@/lib/logger";
 
 const stepIdCounter = { current: 0 };
@@ -55,33 +53,20 @@ const getI18nKeyByType = (type: string): string => {
 };
 
 export function ChatInterface() {
-  const router = useRouter();
-  const { user } = useAuthorizationContext();
-  const { isSpeedMode } = useDeployment();
   const [input, setInput] = useState("");
   // Replace the original messages state
-  const [sessionMessages, setSessionMessages] = useState<{
-    [conversationId: number]: ChatMessageType[];
-  }>({});
+  const [sessionMessages, setSessionMessages] = useState<{[conversationId: number]: ChatMessageType[];}>({});
   const [isSwitchedConversation, setIsSwitchedConversation] = useState(false); // Add conversation switching tracking state
   const [isLoading, setIsLoading] = useState(false);
   const { t } = useTranslation("common");
 
   // Use conversation management hook
   const conversationManagement = useConversationManagement();
-  const [openDropdownId, setOpenDropdownId] = useState<string | null>(null);
-  const { appConfig } = useConfig();
 
   // For each conversation, maintain independent SSE connections and states
-  const [streamingConversations, setStreamingConversations] = useState<
-    Set<number>
-  >(new Set());
-  const conversationControllersRef = useRef<Map<number, AbortController>>(
-    new Map()
-  );
-  const conversationTimeoutsRef = useRef<Map<number, NodeJS.Timeout>>(
-    new Map()
-  );
+  const [streamingConversations, setStreamingConversations] = useState<Set<number>>(new Set());
+  const conversationControllersRef = useRef<Map<number, AbortController>>(new Map());
+  const conversationTimeoutsRef = useRef<Map<number, NodeJS.Timeout>>(new Map());
 
   // Place the declaration of currentMessages after the definition of selectedConversationId
   // If a historical conversation is being loaded and there are no cached messages, return an empty array to avoid displaying error content
@@ -92,8 +77,8 @@ export function ChatInterface() {
   // Monitor changes in currentMessages
   // Calculate if the current conversation is streaming
   const isCurrentConversationStreaming =
-    conversationManagement.conversationId && conversationManagement.conversationId !== -1
-      ? streamingConversations.has(conversationManagement.conversationId)
+    conversationManagement.selectedConversationId != null
+      ? streamingConversations.has(conversationManagement.selectedConversationId)
       : false;
 
   const [viewingImage, setViewingImage] = useState<string | null>(null);
@@ -106,8 +91,6 @@ export function ChatInterface() {
   const abortControllerRef = useRef<AbortController | null>(null); // Add AbortController reference
   const timeoutRef = useRef<NodeJS.Timeout | null>(null); // Add timeout reference
 
-  // Add sidebar state control
-  const [sidebarOpen, setSidebarOpen] = useState(true);
 
   // Add a state to track if we're loading a historical conversation
   const [isLoadingHistoricalConversation, setIsLoadingHistoricalConversation] =
@@ -118,9 +101,6 @@ export function ChatInterface() {
     Set<number>
   >(new Set());
 
-  // Add a ref to track the currently selected conversation ID for real-time access
-  const currentSelectedConversationRef = useRef<number | null>(null);
-
   // Ensure right sidebar is closed by default
   const [showRightPanel, setShowRightPanel] = useState(false);
 
@@ -178,64 +158,43 @@ export function ChatInterface() {
     setAttachments(newAttachments);
   };
 
-  // Define sidebar toggle function
-  const toggleSidebar = () => {
-    setSidebarOpen(!sidebarOpen);
-  };
 
   // Handle right panel toggle - keep it simple and clear
   const toggleRightPanel = () => {
     setShowRightPanel(!showRightPanel);
   };
 
-  useEffect(() => {
-    if (!conversationManagement.initialized.current) {
-      conversationManagement.initialized.current = true;
-
-      // Get conversation history list, but don't auto-select the latest conversation
-      conversationManagement.fetchConversationList()
-        .then((dialogData) => {
-          // Create new conversation by default regardless of history
-          handleNewConversation();
-        })
-        .catch((err) => {
-          log.error(t("chatInterface.errorFetchingConversationList"), err);
-          // Create new conversation even if getting conversation list fails
-          handleNewConversation();
-        });
-    }
-  }, [appConfig]); // Add appConfig as dependency
-
   // Add useEffect to listen for conversationId changes, ensure right sidebar is always closed when conversation switches
   useEffect(() => {
     // Ensure right sidebar is reset to closed state whenever conversation ID changes
     setSelectedMessageId(undefined);
     setShowRightPanel(false);
-  }, [conversationManagement.conversationId]);
+  }, [conversationManagement.selectedConversationId]);
 
   // Helper function to clear completed conversation indicator
   const clearCompletedIndicator = useCallback(() => {
     if (
-      conversationManagement.conversationId &&
-      conversationManagement.conversationId !== -1
+      conversationManagement.selectedConversationId != null
     ) {
       setCompletedConversations((prev) => {
         // Use functional update to avoid dependency on completedConversations
-        if (prev.has(conversationManagement.conversationId)) {
+        if (conversationManagement.selectedConversationId != null && prev.has(conversationManagement.selectedConversationId)) {
           const newSet = new Set(prev);
-          newSet.delete(conversationManagement.conversationId);
+          newSet.delete(conversationManagement.selectedConversationId);
           return newSet;
         }
         return prev;
       });
     }
-  }, [conversationManagement.conversationId]);
+  }, [conversationManagement.selectedConversationId]);
+
+
 
   // Add useEffect to clear completed conversation indicator when user is viewing the current conversation
   useEffect(() => {
     // If current conversation is in completedConversations, clear it when user is viewing it
     clearCompletedIndicator();
-  }, [conversationManagement.conversationId, clearCompletedIndicator]);
+  }, [conversationManagement.selectedConversationId, clearCompletedIndicator]);
 
   // Add click event listener to clear completed conversation indicator when user clicks anywhere on the page
   useEffect(() => {
@@ -291,13 +250,9 @@ export function ChatInterface() {
     const userMessageId = uuidv4();
     const userMessageContent = input.trim();
 
-    // Get current conversation ID
-    let currentConversationId = conversationManagement.conversationId;
-
-    // Ensure ref reflects the current conversation state
-    if (currentConversationId && currentConversationId !== -1) {
-      conversationManagement.currentSelectedConversationRef.current = currentConversationId;
-    }
+    // Get current conversation ID (null when new conversation)
+    let currentConversationId = conversationManagement.selectedConversationId;
+    let cid: number | null = null; // set after guard, used in try/catch/finally
 
     // Prepare attachment information
     // Handle file upload
@@ -357,8 +312,8 @@ export function ChatInterface() {
 
     try {
       // Check if need to create new conversation
-      if (!currentConversationId || currentConversationId === -1) {
-        // If no session ID or ID is -1, create new conversation first
+      if (currentConversationId == null) {
+        // No conversation selected: create new conversation first
         try {
           const createData = await conversationService.create(
             t("chatInterface.newConversation")
@@ -366,18 +321,14 @@ export function ChatInterface() {
           currentConversationId = createData.conversation_id;
 
           // Update current session state
-          conversationManagement.setConversationId(currentConversationId);
           conversationManagement.setSelectedConversationId(currentConversationId);
-          // Update ref to track current selected conversation
-          conversationManagement.currentSelectedConversationRef.current = currentConversationId;
           conversationManagement.setConversationTitle(
             createData.conversation_title || t("chatInterface.newConversation")
           );
 
           // After creating new conversation, add it to streaming list
           setStreamingConversations((prev) => {
-            const newSet = new Set(prev).add(currentConversationId);
-
+            const newSet = new Set(prev).add(createData.conversation_id);
             return newSet;
           });
 
@@ -408,25 +359,25 @@ export function ChatInterface() {
         }
       }
 
-      // Ensure valid conversation ID before registering controller and streaming state
-      if (currentConversationId && currentConversationId !== -1) {
-        conversationControllersRef.current.set(
-          currentConversationId,
-          currentController
-        );
-        setStreamingConversations((prev) => {
-          const newSet = new Set(prev);
-          newSet.add(currentConversationId);
-          return newSet;
-        });
-      }
+      // Type guard: we have a number here (either from selection or from create above)
+      if (currentConversationId == null) return;
+      const id = currentConversationId;
+      cid = id;
+
+      // Register controller and streaming state for this conversation
+      conversationControllersRef.current.set(id, currentController);
+      setStreamingConversations((prev) => {
+        const newSet = new Set(prev);
+        newSet.add(id);
+        return newSet;
+      });
 
       // Now add messages after conversation is created/confirmed
       // 1. When sending user message, complete ChatMessageType fields
       setSessionMessages((prev) => ({
         ...prev,
-        [currentConversationId]: [
-          ...(prev[currentConversationId] || []),
+        [id]: [
+          ...(prev[id] || []),
           {
             ...userMessage,
             id: userMessage.id || uuidv4(),
@@ -442,8 +393,8 @@ export function ChatInterface() {
       // 2. When adding AI reply message, complete ChatMessageType fields
       setSessionMessages((prev) => ({
         ...prev,
-        [currentConversationId]: [
-          ...(prev[currentConversationId] || []),
+        [id]: [
+          ...(prev[id] || []),
           {
             ...initialAssistantMessage,
             id: initialAssistantMessage.id || uuidv4(),
@@ -480,7 +431,7 @@ export function ChatInterface() {
       // Send request to backend API, add signal parameter
       const runAgentParams: any = {
         query: finalQuery, // Use preprocessed query or original query
-        conversation_id: currentConversationId,
+        conversation_id: id,
         is_set: isSwitchedConversation || currentMessages.length <= 1,
         history: currentMessages
           .filter((msg) => msg.id !== userMessage.id)
@@ -551,16 +502,12 @@ export function ChatInterface() {
 
       // Create resetTimeout function for current conversation
       const resetTimeout = () => {
-        const timeout = conversationTimeoutsRef.current.get(
-          currentConversationId
-        );
+        const timeout = conversationTimeoutsRef.current.get(id);
         if (timeout) {
           clearTimeout(timeout);
         }
         const newTimeout = setTimeout(async () => {
-          const controller = conversationControllersRef.current.get(
-            currentConversationId
-          );
+          const controller = conversationControllersRef.current.get(id);
           if (controller && !controller.signal.aborted) {
             try {
               controller.abort(t("chatInterface.requestTimeout"));
@@ -568,9 +515,7 @@ export function ChatInterface() {
               setSessionMessages((prev) => {
                 const newMessages = { ...prev };
                 const lastMsg =
-                  newMessages[currentConversationId]?.[
-                    newMessages[currentConversationId].length - 1
-                  ];
+                  newMessages[id]?.[newMessages[id].length - 1];
                 if (lastMsg && lastMsg.role === ROLE_ASSISTANT) {
                   lastMsg.error = t("chatInterface.requestTimeoutRetry");
                   lastMsg.isComplete = true;
@@ -579,23 +524,21 @@ export function ChatInterface() {
                 return newMessages;
               });
 
-              if (currentConversationId && currentConversationId !== -1) {
-                try {
-                  await conversationService.stop(currentConversationId);
-                } catch (error) {
-                  log.error(
-                    t("chatInterface.stopTimeoutRequestFailed"),
-                    error
-                  );
-                }
+              try {
+                await conversationService.stop(id);
+              } catch (error) {
+                log.error(
+                  t("chatInterface.stopTimeoutRequestFailed"),
+                  error
+                );
               }
             } catch (error) {
               log.error(t("chatInterface.errorCancelingRequest"), error);
             }
           }
-          conversationTimeoutsRef.current.delete(currentConversationId);
+          conversationTimeoutsRef.current.delete(id);
         }, 120000);
-        conversationTimeoutsRef.current.set(currentConversationId, newTimeout);
+        conversationTimeoutsRef.current.set(id, newTimeout);
       };
 
       // Before processing streaming response, set an initial timeout first
@@ -605,14 +548,14 @@ export function ChatInterface() {
       // Compatible with both function and direct assignment
       await handleStreamResponse(
         reader,
-        setCurrentSessionMessagesFactory(currentConversationId),
+        setCurrentSessionMessagesFactory(id),
         resetTimeout,
         stepIdCounter,
         setIsSwitchedConversation,
         conversationManagement.isNewConversation,
         conversationManagement.setConversationTitle,
         conversationManagement.fetchConversationList,
-        currentConversationId,
+        id,
         conversationService,
         false, // isDebug: false for normal chat mode
         t
@@ -623,101 +566,88 @@ export function ChatInterface() {
       setIsStreaming(false);
 
       // Clean up controller and timeout for current conversation
-      conversationControllersRef.current.delete(currentConversationId);
-      const timeout = conversationTimeoutsRef.current.get(
-        currentConversationId
-      );
+      conversationControllersRef.current.delete(id);
+      const timeout = conversationTimeoutsRef.current.get(id);
       if (timeout) {
         clearTimeout(timeout);
-        conversationTimeoutsRef.current.delete(currentConversationId);
+        conversationTimeoutsRef.current.delete(id);
       }
 
-      // Remove from streaming list (only when conversationId is not -1)
-      if (currentConversationId !== -1) {
-        setStreamingConversations((prev) => {
+      // Remove from streaming list when we have a valid conversation id
+      setStreamingConversations((prev) => {
+        const newSet = new Set(prev);
+        newSet.delete(id);
+        return newSet;
+      });
+
+      // When conversation is completed, only add to completed conversation list when user is not in current conversation interface
+      const currentUserConversation = conversationManagement.selectedConversationId;
+      if (currentUserConversation !== id) {
+        setCompletedConversations((prev) => {
           const newSet = new Set(prev);
-          newSet.delete(currentConversationId);
+          newSet.add(id);
           return newSet;
         });
-
-        // When conversation is completed, only add to completed conversation list when user is not in current conversation interface
-        // Use ref to get the actual conversation the user is in
-        const currentUserConversation = currentSelectedConversationRef.current;
-        if (currentUserConversation !== currentConversationId) {
-          setCompletedConversations((prev) => {
-            const newSet = new Set(prev);
-            newSet.add(currentConversationId);
-            return newSet;
-          });
-        }
       }
 
       // Note: Save operation is already implemented in agent run API, no need to save again in frontend
     } catch (error) {
       // If user actively canceled, don't show error message
       const err = error as Error;
-      if (err.name === "AbortError") {
-        setSessionMessages((prev) => {
-          const newMessages = { ...prev };
-          const lastMsg =
-            newMessages[currentConversationId]?.[
-              newMessages[currentConversationId].length - 1
-            ];
-          if (lastMsg && lastMsg.role === ROLE_ASSISTANT) {
-            lastMsg.content = t("chatInterface.conversationStopped");
-            lastMsg.isComplete = true;
-            lastMsg.thinking = undefined; // Explicitly clear thinking state
-          }
-          return newMessages;
-        });
-      } else {
-        log.error(t("chatInterface.errorLabel"), error);
-        // Show user-friendly error message instead of technical error details
-        const errorMessage = t("chatInterface.errorProcessingRequest");
-        setSessionMessages((prev) => {
-          const newMessages = { ...prev };
-          const lastMsg =
-            newMessages[currentConversationId]?.[
-              newMessages[currentConversationId].length - 1
-            ];
-          if (lastMsg && lastMsg.role === ROLE_ASSISTANT) {
-            lastMsg.content = errorMessage;
-            lastMsg.isComplete = true;
-            lastMsg.error = errorMessage;
-            lastMsg.thinking = undefined; // Explicitly clear thinking state
-          }
-          return newMessages;
-        });
+      if (cid != null) {
+        const idForCatch = cid;
+        if (err.name === "AbortError") {
+          setSessionMessages((prev) => {
+            const newMessages = { ...prev };
+            const lastMsg =
+              newMessages[idForCatch]?.[newMessages[idForCatch].length - 1];
+            if (lastMsg && lastMsg.role === ROLE_ASSISTANT) {
+              lastMsg.content = t("chatInterface.conversationStopped");
+              lastMsg.isComplete = true;
+              lastMsg.thinking = undefined; // Explicitly clear thinking state
+            }
+            return newMessages;
+          });
+        } else {
+          log.error(t("chatInterface.errorLabel"), error);
+          const errorMessage = t("chatInterface.errorProcessingRequest");
+          setSessionMessages((prev) => {
+            const newMessages = { ...prev };
+            const lastMsg =
+              newMessages[idForCatch]?.[newMessages[idForCatch].length - 1];
+            if (lastMsg && lastMsg.role === ROLE_ASSISTANT) {
+              lastMsg.content = errorMessage;
+              lastMsg.isComplete = true;
+              lastMsg.error = errorMessage;
+              lastMsg.thinking = undefined; // Explicitly clear thinking state
+            }
+            return newMessages;
+          });
+        }
       }
 
       setIsLoading(false);
       setIsStreaming(false);
 
-      // Clean up controller and timeout for current conversation
-      conversationControllersRef.current.delete(currentConversationId);
-      const timeout = conversationTimeoutsRef.current.get(
-        currentConversationId
-      );
-      if (timeout) {
-        clearTimeout(timeout);
-        conversationTimeoutsRef.current.delete(currentConversationId);
-      }
-
-      // Remove from streaming list (only when conversationId is not -1)
-      if (currentConversationId !== -1) {
+      // Clean up when we had a conversation id (cid is set after the guard in try)
+      if (cid != null) {
+        const idForCatch = cid;
+        conversationControllersRef.current.delete(idForCatch);
+        const timeout = conversationTimeoutsRef.current.get(idForCatch);
+        if (timeout) {
+          clearTimeout(timeout);
+          conversationTimeoutsRef.current.delete(idForCatch);
+        }
         setStreamingConversations((prev) => {
           const newSet = new Set(prev);
-          newSet.delete(currentConversationId);
+          newSet.delete(idForCatch);
           return newSet;
         });
-
-        // When conversation is completed, only add to completed conversation list when user is not in current conversation interface
-        // Use ref to get the actual conversation the user is in
-        const currentUserConversation = currentSelectedConversationRef.current;
-        if (currentUserConversation !== currentConversationId) {
+        const currentUserConversation = conversationManagement.selectedConversationId;
+        if (currentUserConversation !== idForCatch) {
           setCompletedConversations((prev) => {
             const newSet = new Set(prev);
-            newSet.add(currentConversationId);
+            newSet.add(idForCatch);
             return newSet;
           });
         }
@@ -800,9 +730,8 @@ export function ChatInterface() {
     });
 
     // Check if there are cached messages
-    const hasCachedMessages =
-      sessionMessages[dialog.conversation_id] !== undefined;
-    const isCurrentActive = dialog.conversation_id === conversationManagement.conversationId;
+    const hasCachedMessages = sessionMessages[dialog.conversation_id] !== undefined;
+    const isCurrentActive = dialog.conversation_id === conversationManagement.selectedConversationId;
 
     // Log: click conversation
     // If there are cached messages, ensure not to show loading state
@@ -1059,7 +988,7 @@ export function ChatInterface() {
     // Create a copy to avoid directly modifying parameters
     const updatedMessages = [...messages];
     let hasUpdates = false;
-    const conversationIdToUse = targetConversationId || conversationManagement.conversationId;
+    const conversationIdToUse = targetConversationId ?? conversationManagement.selectedConversationId;
 
     // Process attachments for each message
     for (const message of updatedMessages) {
@@ -1088,8 +1017,8 @@ export function ChatInterface() {
       }
     }
 
-    // If there are updates, set new message array
-    if (hasUpdates) {
+    // If there are updates and we have a conversation id, set new message array
+    if (hasUpdates && conversationIdToUse != null) {
       setSessionMessages((prev) => ({
         ...prev,
         [conversationIdToUse]: updatedMessages,
@@ -1097,76 +1026,6 @@ export function ChatInterface() {
     }
   };
 
-  // Left sidebar conversation title update
-  const handleConversationRename = async (dialogId: number, title: string) => {
-    try {
-      await conversationService.rename(dialogId, title);
-      await conversationManagement.fetchConversationList();
-
-      if (conversationManagement.selectedConversationId === dialogId) {
-        conversationManagement.setConversationTitle(title);
-      }
-    } catch (error) {
-      log.error(t("chatInterface.renameFailed"), error);
-    }
-  };
-
-  // Left sidebar conversation deletion
-  const handleConversationDeleteClick = async (dialogId: number) => {
-    try {
-      // If deleting the currently active conversation, stop conversation first
-      if (
-        conversationManagement.selectedConversationId === dialogId &&
-        isStreaming &&
-        conversationManagement.conversationId === dialogId
-      ) {
-        // Cancel current ongoing request first
-        if (abortControllerRef.current) {
-          try {
-            abortControllerRef.current.abort(
-              t("chatInterface.deleteConversation")
-            );
-          } catch (error) {
-            log.error(t("chatInterface.errorCancelingRequest"), error);
-          }
-          abortControllerRef.current = null;
-        }
-
-        // Clear timeout timer
-        if (timeoutRef.current) {
-          clearTimeout(timeoutRef.current);
-          timeoutRef.current = null;
-        }
-
-        setIsStreaming(false);
-        setIsLoading(false);
-
-        try {
-          await conversationService.stop(dialogId);
-        } catch (error) {
-          log.error(
-            t("chatInterface.stopConversationToDeleteFailed"),
-            error
-          );
-          // Continue deleting even if stopping fails
-        }
-      }
-
-      await conversationService.delete(dialogId);
-      await conversationManagement.fetchConversationList();
-
-      if (conversationManagement.selectedConversationId === dialogId) {
-        conversationManagement.setSelectedConversationId(null);
-        // Update ref to track current selected conversation
-        conversationManagement.currentSelectedConversationRef.current = null;
-        conversationManagement.setConversationTitle(t("chatInterface.newConversation"));
-        handleNewConversation();
-      }
-    } catch (error) {
-      log.error(t("chatInterface.deleteFailed"), error);
-    }
-  };
-
   // Add image error handling function
   const handleImageError = (imageUrl: string) => {
     log.error(t("chatInterface.imageLoadFailed"), imageUrl);
@@ -1175,7 +1034,7 @@ export function ChatInterface() {
     setSessionMessages((prev) => {
       const newMessages = { ...prev };
       const lastMsg =
-        newMessages[conversationManagement.conversationId]?.[newMessages[conversationManagement.conversationId].length - 1];
+        newMessages[conversationManagement.selectedConversationId!]?.[newMessages[conversationManagement.selectedConversationId!].length - 1];
 
       if (lastMsg && lastMsg.role === ROLE_ASSISTANT && lastMsg.images) {
         // Filter out failed images
@@ -1195,21 +1054,21 @@ export function ChatInterface() {
   const handleStop = async () => {
     // Stop agent_run of current conversation
     const currentController =
-      conversationControllersRef.current.get(conversationManagement.conversationId);
+      conversationControllersRef.current.get(conversationManagement.selectedConversationId!);
     if (currentController) {
       try {
         currentController.abort(t("chatInterface.userManuallyStopped"));
       } catch (error) {
         log.error(t("chatInterface.errorCancelingRequest"), error);
       }
-      conversationControllersRef.current.delete(conversationManagement.conversationId);
+      conversationControllersRef.current.delete(conversationManagement.selectedConversationId!);
     }
 
     // Clear timeout timer for current conversation
-    const currentTimeout = conversationTimeoutsRef.current.get(conversationManagement.conversationId);
+    const currentTimeout = conversationTimeoutsRef.current.get(conversationManagement.selectedConversationId!);
     if (currentTimeout) {
       clearTimeout(currentTimeout);
-      conversationTimeoutsRef.current.delete(conversationManagement.conversationId);
+      conversationTimeoutsRef.current.delete(conversationManagement.selectedConversationId!);
     }
 
     // Immediately update frontend state
@@ -1217,19 +1076,19 @@ export function ChatInterface() {
     setIsLoading(false);
 
     // If no valid conversation ID, just reset frontend state
-    if (!conversationManagement.conversationId || conversationManagement.conversationId === -1) {
+    if (conversationManagement.selectedConversationId == null) {
       return;
     }
 
     try {
       // Call backend stop API - this will stop both agent run and preprocess tasks
-      await conversationService.stop(conversationManagement.conversationId);
+      await conversationService.stop(conversationManagement.selectedConversationId!);
 
       // Manually update messages, clear thinking state
       setSessionMessages((prev) => {
         const newMessages = { ...prev };
         const lastMsg =
-          newMessages[conversationManagement.conversationId]?.[newMessages[conversationManagement.conversationId].length - 1];
+          newMessages[conversationManagement.selectedConversationId!]?.[newMessages[conversationManagement.selectedConversationId!].length - 1];
         if (lastMsg && lastMsg.role === ROLE_ASSISTANT) {
           lastMsg.isComplete = true;
           lastMsg.thinking = undefined; // Explicitly clear thinking state
@@ -1240,16 +1099,16 @@ export function ChatInterface() {
       // remove from streaming list
       setStreamingConversations((prev) => {
         const newSet = new Set(prev);
-        newSet.delete(conversationManagement.conversationId);
+        newSet.delete(conversationManagement.selectedConversationId!);
         return newSet;
       });
 
       // when conversation is stopped, only add to completed conversations list when user is not in current conversation interface
-      const currentUserConversation = currentSelectedConversationRef.current;
-      if (currentUserConversation !== conversationManagement.conversationId) {
+      const currentUserConversation = conversationManagement.selectedConversationId;
+      if (currentUserConversation != null && currentUserConversation !== conversationManagement.selectedConversationId) {
         setCompletedConversations((prev) => {
           const newSet = new Set(prev);
-          newSet.add(conversationManagement.conversationId);
+          newSet.add(conversationManagement.selectedConversationId!);
           return newSet;
         });
       }
@@ -1260,7 +1119,7 @@ export function ChatInterface() {
       setSessionMessages((prev) => {
         const newMessages = { ...prev };
         const lastMsg =
-          newMessages[conversationManagement.conversationId]?.[newMessages[conversationManagement.conversationId].length - 1];
+          newMessages[conversationManagement.selectedConversationId!]?.[newMessages[conversationManagement.selectedConversationId!].length - 1];
         if (lastMsg && lastMsg.role === ROLE_ASSISTANT) {
           lastMsg.isComplete = true;
           lastMsg.thinking = undefined; // Explicitly clear thinking state
@@ -1362,30 +1221,15 @@ export function ChatInterface() {
 
 
   return (
-    <>
-      <div className="flex h-full">
-        <ChatSidebar
-          conversationList={conversationManagement.conversationList}
-          selectedConversationId={conversationManagement.selectedConversationId}
-          openDropdownId={openDropdownId}
-          streamingConversations={streamingConversations}
-          completedConversations={completedConversations}
-          onNewConversation={handleNewConversation}
-          onDialogClick={handleDialogClick}
-          onRename={handleConversationRename}
-          onDelete={handleConversationDeleteClick}
-          onSettingsClick={handleSettingsClick}
-          onDropdownOpenChange={(open: boolean, id: string | null) =>
-            setOpenDropdownId(open ? id : null)
-          }
-          onToggleSidebar={toggleSidebar}
-          expanded={sidebarOpen}
-          userEmail={user?.email}
-          userAvatarUrl={user?.avatarUrl}
-          userRole={user?.role}
-        />
-
-        <div className="flex-1 flex flex-col overflow-hidden">
+    <Layout hasSider className="flex h-full">
+      <ChatSidebar
+        streamingConversations={streamingConversations}
+        completedConversations={completedConversations}
+        conversationManagement={conversationManagement}
+        onConversationSelect={handleDialogClick}
+      />
+
+      <Layout className="flex-1 flex flex-col overflow-hidden min-w-0">
           <div className="flex flex-1 overflow-hidden">
             <div className="flex-1 flex flex-col">
               <ChatHeader
@@ -1415,7 +1259,7 @@ export function ChatInterface() {
                 onFileUpload={handleFileUpload}
                 onImageUpload={handleImageUpload}
                 onOpinionChange={handleOpinionChange}
-                currentConversationId={conversationManagement.conversationId}
+                currentConversationId={conversationManagement.selectedConversationId ?? undefined}
                 shouldScrollToBottom={shouldScrollToBottom}
                 selectedAgentId={selectedAgentId}
                 onAgentSelect={setSelectedAgentId}
@@ -1432,18 +1276,8 @@ export function ChatInterface() {
               toggleRightPanel={toggleRightPanel}
               selectedMessageId={selectedMessageId}
             />
-          </div>
         </div>
-      </div>
-      <TooltipProvider>
-        <Tooltip
-          title={t("chatInterface.stopGenerating")}
-          open={false}
-          placement="top"
-        >
-          <div className="fixed inset-0 pointer-events-none" />
-        </Tooltip>
-      </TooltipProvider>
-    </>
+      </Layout>
+    </Layout>
   );
 }
diff --git a/frontend/app/[locale]/chat/streaming/chatStreamFinalMessage.tsx b/frontend/app/[locale]/chat/streaming/chatStreamFinalMessage.tsx
index 2ab22de16..e047a775a 100644
--- a/frontend/app/[locale]/chat/streaming/chatStreamFinalMessage.tsx
+++ b/frontend/app/[locale]/chat/streaming/chatStreamFinalMessage.tsx
@@ -1,4 +1,4 @@
-import { useEffect, useRef, useState } from "react";
+import React, { useEffect, useRef, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
   Copy,
@@ -39,7 +39,7 @@ interface FinalMessageProps {
 // TTS playback status
 type TTSStatus = typeof chatConfig.ttsStatus[keyof typeof chatConfig.ttsStatus];
 
-export function ChatStreamFinalMessage({
+function ChatStreamFinalMessageInner({
   message,
   onSelectMessage,
   isSelected = false,
@@ -411,3 +411,20 @@ export function ChatStreamFinalMessage({
     </div>
   );
 }
+
+function areEqualFinalMessage(prev: FinalMessageProps, next: FinalMessageProps): boolean {
+  return (
+    // Message object reference covers content, finalAnswer, isComplete, opinion_flag, attachments, etc.
+    prev.message === next.message &&
+    prev.isSelected === next.isSelected &&
+    prev.searchResultsCount === next.searchResultsCount &&
+    prev.imagesCount === next.imagesCount &&
+    prev.hideButtons === next.hideButtons &&
+    prev.index === next.index &&
+    prev.currentConversationId === next.currentConversationId
+    // Callbacks (onSelectMessage, onOpinionChange, onCitationHover, onImageClick) are intentionally
+    // excluded: they do not affect rendered output and will be stabilized with useCallback (Phase 1.2).
+  );
+}
+
+export const ChatStreamFinalMessage = React.memo(ChatStreamFinalMessageInner, areEqualFinalMessage);
diff --git a/frontend/app/[locale]/chat/streaming/chatStreamHandler.tsx b/frontend/app/[locale]/chat/streaming/chatStreamHandler.tsx
index 815e9ee4d..484d5cb4a 100644
--- a/frontend/app/[locale]/chat/streaming/chatStreamHandler.tsx
+++ b/frontend/app/[locale]/chat/streaming/chatStreamHandler.tsx
@@ -555,19 +555,19 @@ export const handleStreamResponse = async (
                         return recordMessages;
                       }
 
-                      if (!lastMsg.searchResults) {
-                        lastMsg.searchResults = [];
-                      }
-
                       // Use the public deduplication function to process search results
                       if (
                         searchResultsContent &&
                         searchResultsContent.length > 0
                       ) {
-                        lastMsg.searchResults = deduplicateSearchResults(
-                          lastMsg.searchResults,
-                          searchResultsContent
-                        );
+                        const updatedMsg = {
+                          ...lastMsg,
+                          searchResults: deduplicateSearchResults(
+                            lastMsg.searchResults || [],
+                            searchResultsContent
+                          ),
+                        };
+                        recordMessages[recordMessages.length - 1] = updatedMsg;
                       }
 
                       return recordMessages;
@@ -596,16 +596,15 @@ export const handleStreamResponse = async (
                           return newMessages;
                         }
 
-                        // If there is no image array, initialize it
-                        if (!lastMsg.images) {
-                          lastMsg.images = [];
-                        }
-
-                        // Use the public deduplication function to process images
-                        lastMsg.images = deduplicateImages(
-                          lastMsg.images,
-                          imageUrls
-                        );
+                        // Create a new object reference so React.memo detects the change
+                        const updatedMsg = {
+                          ...lastMsg,
+                          images: deduplicateImages(
+                            lastMsg.images || [],
+                            imageUrls
+                          ),
+                        };
+                        newMessages[newMessages.length - 1] = updatedMsg;
                         return newMessages;
                       });
                     }
@@ -848,29 +847,35 @@ export const handleStreamResponse = async (
                 const lastMsg = newMessages[newMessages.length - 1];
 
                 if (lastMsg && lastMsg.role === MESSAGE_ROLES.ASSISTANT) {
+                  // Create a new object reference so React.memo detects the change
+                  const updatedMsg = { ...lastMsg };
+
                   // Update the current step
                   if (currentStep) {
-                    if (!lastMsg.steps) lastMsg.steps = [];
+                    const steps = updatedMsg.steps ? [...updatedMsg.steps] : [];
 
                     // Find and update existing steps
-                    const stepIndex = lastMsg.steps.findIndex(
+                    const stepIndex = steps.findIndex(
                       (s) => s.id === currentStep?.id
                     );
                     if (stepIndex >= 0) {
-                      lastMsg.steps[stepIndex] = currentStep;
+                      steps[stepIndex] = currentStep;
                     } else {
                       // Only add new steps when there is content
                       if (
                         currentStep.contents &&
                         currentStep.contents.length > 0
                       ) {
-                        lastMsg.steps.push(currentStep);
+                        steps.push(currentStep);
                       }
                     }
+                    updatedMsg.steps = steps;
                   }
 
                   // Update other special content
-                  if (finalAnswer) lastMsg.finalAnswer = finalAnswer;
+                  if (finalAnswer) updatedMsg.finalAnswer = finalAnswer;
+
+                  newMessages[newMessages.length - 1] = updatedMsg;
                 }
 
                 return newMessages;
@@ -909,14 +914,15 @@ export const handleStreamResponse = async (
       const lastMsg = newMessages[newMessages.length - 1];
 
       if (lastMsg && lastMsg.role === MESSAGE_ROLES.ASSISTANT) {
-        lastMsg.isComplete = true;
+        // Create a new object reference so React.memo detects the change
+        const updatedMsg = { ...lastMsg, isComplete: true };
 
         // Check and remove duplicate steps
-        if (lastMsg.steps && lastMsg.steps.length > 0) {
+        if (updatedMsg.steps && updatedMsg.steps.length > 0) {
           const uniqueSteps = [];
           const seenTitles = new Set();
 
-          for (const step of lastMsg.steps) {
+          for (const step of updatedMsg.steps) {
             // If it is an empty step or there is already a step with the same title, skip it
             if (
               !step.contents ||
@@ -931,8 +937,13 @@ export const handleStreamResponse = async (
           }
 
           // Update to the deduplicated step list
-          lastMsg.steps = uniqueSteps;
+          updatedMsg.steps = uniqueSteps;
         }
+
+        // Also persist any finalAnswer accumulated in the trailing buffer
+        if (finalAnswer) updatedMsg.finalAnswer = finalAnswer;
+
+        newMessages[newMessages.length - 1] = updatedMsg;
       }
 
       return newMessages;
diff --git a/frontend/app/[locale]/chat/streaming/chatStreamMain.tsx b/frontend/app/[locale]/chat/streaming/chatStreamMain.tsx
index ec3d0a7fa..912450372 100644
--- a/frontend/app/[locale]/chat/streaming/chatStreamMain.tsx
+++ b/frontend/app/[locale]/chat/streaming/chatStreamMain.tsx
@@ -311,9 +311,9 @@ export function ChatStreamMain({
   ]);
 
   return (
-    <div className="flex-1 flex flex-col overflow-hidden relative custom-scrollbar">
+    <div className="flex-1 flex flex-col overflow-hidden relative custom-scrollbar bg-white">
       {/* Main message area */}
-      <ScrollArea className="flex-1 px-4 pt-4" ref={scrollAreaRef}>
+      <ScrollArea className="flex-1 px-4 pt-4 bg-white" ref={scrollAreaRef}>
         <div className="max-w-3xl mx-auto">
           {processedMessages.finalMessages.length === 0 ? (
             isLoadingHistoricalConversation ? (
diff --git a/frontend/app/[locale]/chat/streaming/taskWindow.tsx b/frontend/app/[locale]/chat/streaming/taskWindow.tsx
index 42f054b3c..6e48e52d4 100644
--- a/frontend/app/[locale]/chat/streaming/taskWindow.tsx
+++ b/frontend/app/[locale]/chat/streaming/taskWindow.tsx
@@ -1,4 +1,4 @@
-import { useRef, useEffect, useState } from "react";
+import React, { useRef, useEffect, useState } from "react";
 import { useTranslation } from "react-i18next";
 import {
   Globe,
@@ -1105,14 +1105,15 @@ const messageHandlers: MessageHandler[] = [
 interface TaskWindowProps {
   messages: TaskMessageType[];
   isStreaming?: boolean;
+  defaultExpanded?: boolean;
 }
 
-export function TaskWindow({ messages, isStreaming = false }: TaskWindowProps) {
+function TaskWindowInner({ messages, isStreaming = false, defaultExpanded = true }: TaskWindowProps) {
   const { t } = useTranslation("common");
   const { appConfig } = useConfig();
   const scrollAreaRef = useRef<HTMLDivElement>(null);
   const [autoScroll, setAutoScroll] = useState(true);
-  const [isExpanded, setIsExpanded] = useState(true); // default expand task details interface
+  const [isExpanded, setIsExpanded] = useState(defaultExpanded); // default expand task details interface
   const [contentHeight, setContentHeight] = useState(0);
   const contentRef = useRef<HTMLDivElement>(null);
 
@@ -1146,6 +1147,20 @@ export function TaskWindow({ messages, isStreaming = false }: TaskWindowProps) {
     }
   }, [isExpanded, groupedMessages, messages]);
 
+  // Force recalculate content height after mount for cached error messages
+  useEffect(() => {
+    if (isExpanded && contentHeight === 0) {
+      // Delay to ensure DOM is rendered
+      const timer = setTimeout(() => {
+        if (contentRef.current) {
+          const height = contentRef.current.scrollHeight;
+          setContentHeight(height);
+        }
+      }, 100);
+      return () => clearTimeout(timer);
+    }
+  }, [isExpanded, contentHeight]);
+
   // Dynamic threshold calculation based on content growth
   const calculateDynamicThreshold = (baseThreshold: number) => {
     const contentGrowth = contentHeight - prevContentHeightRef.current;
@@ -1576,3 +1591,18 @@ export function TaskWindow({ messages, isStreaming = false }: TaskWindowProps) {
     </>
   );
 }
+
+function areEqualTaskWindow(prev: TaskWindowProps, next: TaskWindowProps): boolean {
+  if (prev.isStreaming !== next.isStreaming) return false;
+  if (prev.messages.length !== next.messages.length) return false;
+  // During streaming the last message grows in content without the array length changing.
+  if (prev.messages.length > 0) {
+    const prevLast = prev.messages[prev.messages.length - 1];
+    const nextLast = next.messages[next.messages.length - 1];
+    if (prevLast.id !== nextLast.id || prevLast.content !== nextLast.content) return false;
+  }
+  // defaultExpanded is only meaningful on initial mount; exclude from equality check.
+  return true;
+}
+
+export const TaskWindow = React.memo(TaskWindowInner, areEqualTaskWindow);
diff --git a/frontend/app/[locale]/knowledges/KnowledgeBaseConfiguration.tsx b/frontend/app/[locale]/knowledges/KnowledgeBaseConfiguration.tsx
index c014c1d16..e1c6e2c2c 100644
--- a/frontend/app/[locale]/knowledges/KnowledgeBaseConfiguration.tsx
+++ b/frontend/app/[locale]/knowledges/KnowledgeBaseConfiguration.tsx
@@ -604,6 +604,10 @@ function DataConfig({ isActive }: DataConfigProps) {
 
   // Handle new knowledge base creation
   const handleCreateNew = () => {
+    // Clear active knowledge base selection when entering create mode
+    // This prevents issues with chunk loading from previously selected KB
+    setActiveKnowledgeBase(null);
+
     // Generate default knowledge base name
     const defaultName = generateUniqueKbName(kbState.knowledgeBases);
     setNewKbName(defaultName);
@@ -917,6 +921,7 @@ function DataConfig({ isActive }: DataConfigProps) {
           >
             {isCreatingMode ? (
               <DocumentList
+                key="create-mode"
                 documents={[]}
                 onDelete={() => {}}
                 knowledgeBaseSource={""}
@@ -942,6 +947,7 @@ function DataConfig({ isActive }: DataConfigProps) {
               />
             ) : kbState.activeKnowledgeBase ? (
               <DocumentList
+                key={`kb-${kbState.activeKnowledgeBase.id}`}
                 documents={viewingDocuments}
                 onDelete={handleDeleteDocument}
                 knowledgeBaseSource={kbState.activeKnowledgeBase?.source}
diff --git a/frontend/app/[locale]/knowledges/components/document/DocumentList.tsx b/frontend/app/[locale]/knowledges/components/document/DocumentList.tsx
index 01c074045..3ce8ac803 100644
--- a/frontend/app/[locale]/knowledges/components/document/DocumentList.tsx
+++ b/frontend/app/[locale]/knowledges/components/document/DocumentList.tsx
@@ -276,6 +276,16 @@ const DocumentListContainer = forwardRef<DocumentListRef, DocumentListProps>(
       }
     }, [isCreatingMode, tenantId]);
 
+    // Clear group IDs when permission is set to PRIVATE
+    React.useEffect(() => {
+      if (ingroupPermission === "PRIVATE" && onSelectedGroupIdsChange) {
+        onSelectedGroupIdsChange([]);
+      }
+    }, [ingroupPermission, onSelectedGroupIdsChange]);
+
+    // Check if group select should be disabled (when permission is PRIVATE)
+    const isGroupSelectDisabled = ingroupPermission === "PRIVATE";
+
     // Load available models when showing detail
     useEffect(() => {
       const loadModels = async () => {
@@ -283,7 +293,7 @@ const DocumentListContainer = forwardRef<DocumentListRef, DocumentListProps>(
           setIsLoadingModels(true);
           try {
             const models = await modelService.getLLMModels();
-            setAvailableModels(models);
+            setAvailableModels(models.filter(m => m.connect_status === "available"));
 
             // Determine initial selection order:
             // 1) Knowledge base's own configured model (server-side config)
@@ -472,13 +482,14 @@ const DocumentListContainer = forwardRef<DocumentListRef, DocumentListProps>(
                     <Can permission="kb.groups:update">
                       <Select
                         mode="multiple"
-                        value={selectedGroupIds}
+                        value={isGroupSelectDisabled ? [] : selectedGroupIds}
                         onChange={onSelectedGroupIdsChange}
                         style={{ minWidth: 200, justifyContent: "center", alignItems: "flex-end" }}
                         placeholder={t("knowledgeBase.create.permission.groupPlaceholder")}
                         options={groupOptions}
                         maxTagCount={2}
                         allowClear
+                        disabled={isGroupSelectDisabled}
                       />
                     </Can>
                     {/* Group permission dropdown - second position */}
diff --git a/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseEditModal.tsx b/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseEditModal.tsx
index 9baf3a95d..360eb9efd 100644
--- a/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseEditModal.tsx
+++ b/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseEditModal.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import React, { useState, useRef } from "react";
+import React, { useState, useRef, useEffect } from "react";
 import { useTranslation } from "react-i18next";
 import { Modal, Form, Input, Select, message } from "antd";
 import { useGroupList } from "@/hooks/group/useGroupList";
@@ -35,6 +35,9 @@ export function KnowledgeBaseEditModal({
   // Store original name for comparison
   const originalNameRef = useRef<string>("");
 
+  // Track current permission value for conditional logic
+  const [currentPermission, setCurrentPermission] = useState<string>("READ_ONLY");
+
   // Fetch groups for group selection
   const { data: groupData } = useGroupList(tenantId);
   const groups = groupData?.groups || [];
@@ -42,15 +45,18 @@ export function KnowledgeBaseEditModal({
   // Reset form and states when knowledge base changes
   React.useEffect(() => {
     if (knowledgeBase && open) {
+      const permission = knowledgeBase.ingroup_permission || "READ_ONLY";
       form.setFieldsValue({
         knowledge_name: knowledgeBase.name,
-        ingroup_permission: knowledgeBase.ingroup_permission || "READ_ONLY",
-        group_ids: knowledgeBase.group_ids || [],
+        ingroup_permission: permission,
+        group_ids: permission === "PRIVATE" ? [] : (knowledgeBase.group_ids || []),
       });
       // Store original name for comparison
       originalNameRef.current = knowledgeBase.name;
       // Reset error state
       setNameError(null);
+      // Set current permission
+      setCurrentPermission(permission);
     }
   }, [knowledgeBase, open, form]);
 
@@ -90,10 +96,13 @@ export function KnowledgeBaseEditModal({
         return; // Error message is displayed via Form.Item help
       }
 
+      // Ensure group_ids is empty when permission is PRIVATE
+      const groupIds = values.ingroup_permission === "PRIVATE" ? [] : values.group_ids;
+
       await knowledgeBaseService.updateKnowledgeBase(knowledgeBase.id, {
         knowledge_name: values.knowledge_name,
         ingroup_permission: values.ingroup_permission,
-        group_ids: values.group_ids,
+        group_ids: groupIds,
       });
 
       message.success(t("tenantResources.knowledgeBase.updated"));
@@ -103,7 +112,7 @@ export function KnowledgeBaseEditModal({
         ...knowledgeBase,
         name: values.knowledge_name,
         ingroup_permission: values.ingroup_permission,
-        group_ids: values.group_ids,
+        group_ids: groupIds,
       };
 
       // Trigger knowledge base list refresh to seamlessly update UI
@@ -119,6 +128,17 @@ export function KnowledgeBaseEditModal({
     }
   };
 
+  // Handle permission change - clear group_ids when PRIVATE is selected
+  const handlePermissionChange = (value: string) => {
+    setCurrentPermission(value);
+    if (value === "PRIVATE") {
+      form.setFieldsValue({ group_ids: [] });
+    }
+  };
+
+  // Check if group select should be disabled
+  const isGroupSelectDisabled = currentPermission === "PRIVATE";
+
   return (
     <Modal
       title={t("tenantResources.knowledgeBase.edit")}
@@ -152,6 +172,7 @@ export function KnowledgeBaseEditModal({
           >
             <Select
               placeholder={t("tenantResources.knowledgeBase.permission")}
+              onChange={handlePermissionChange}
               options={[
                 { value: "EDIT", label: t("tenantResources.knowledgeBase.permission.EDIT") },
                 { value: "READ_ONLY", label: t("tenantResources.knowledgeBase.permission.READ_ONLY") },
@@ -165,11 +186,13 @@ export function KnowledgeBaseEditModal({
           <Form.Item name="group_ids" label={t("tenantResources.knowledgeBase.groupNames")}>
             <Select
               mode="multiple"
-              placeholder={t("tenantResources.knowledgeBase.groupNames")}
+              placeholder={isGroupSelectDisabled ? t("knowledgeBase.create.permission.groupPlaceholder") : t("tenantResources.knowledgeBase.groupNames")}
+              value={isGroupSelectDisabled ? [] : form.getFieldValue("group_ids")}
               options={groups.map((group) => ({
                 label: group.group_name,
                 value: group.group_id,
               }))}
+              disabled={isGroupSelectDisabled}
             />
           </Form.Item>
         </Can>
diff --git a/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseList.tsx b/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseList.tsx
index 4a03650fe..d5ec5cdb7 100644
--- a/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseList.tsx
+++ b/frontend/app/[locale]/knowledges/components/knowledge/KnowledgeBaseList.tsx
@@ -589,16 +589,17 @@ const KnowledgeBaseList: React.FC<KnowledgeBaseListProps> = ({
                                 </span>
                               )}
 
-                            {/* User group tags */}
+                            {/* User group tags - only show when not PRIVATE */}
                             <Can permission="group:read">
-                              {getGroupNames(kb.group_ids).map((groupName, idx) => (
-                                <span
-                                  key={idx}
-                                  className={`inline-flex items-center ${KB_LAYOUT.TAG_PADDING} ${KB_LAYOUT.TAG_ROUNDED} ${KB_LAYOUT.TAG_TEXT} ${KB_LAYOUT.SECOND_ROW_TAG_MARGIN} bg-blue-100 text-blue-800 border border-blue-200 mr-1`}
-                                >
-                                  {groupName}
-                                </span>
-                              ))}
+                              {kb.ingroup_permission !== "PRIVATE" &&
+                                getGroupNames(kb.group_ids).map((groupName, idx) => (
+                                  <span
+                                    key={idx}
+                                    className={`inline-flex items-center ${KB_LAYOUT.TAG_PADDING} ${KB_LAYOUT.TAG_ROUNDED} ${KB_LAYOUT.TAG_TEXT} ${KB_LAYOUT.SECOND_ROW_TAG_MARGIN} bg-blue-100 text-blue-800 border border-blue-200 mr-1`}
+                                  >
+                                    {groupName}
+                                  </span>
+                                ))}
                             </Can>
                           </>
                         )}
diff --git a/frontend/app/[locale]/knowledges/contexts/KnowledgeBaseContext.tsx b/frontend/app/[locale]/knowledges/contexts/KnowledgeBaseContext.tsx
index 177d5591c..0a07774be 100644
--- a/frontend/app/[locale]/knowledges/contexts/KnowledgeBaseContext.tsx
+++ b/frontend/app/[locale]/knowledges/contexts/KnowledgeBaseContext.tsx
@@ -113,7 +113,7 @@ export const KnowledgeBaseContext = createContext<{
   ) => Promise<KnowledgeBase | null>;
   deleteKnowledgeBase: (id: string) => Promise<boolean>;
   selectKnowledgeBase: (id: string) => void;
-  setActiveKnowledgeBase: (kb: KnowledgeBase) => void;
+  setActiveKnowledgeBase: (kb: KnowledgeBase | null) => void;
   isKnowledgeBaseSelectable: (kb: KnowledgeBase) => boolean;
   hasKnowledgeBaseModelMismatch: (kb: KnowledgeBase) => boolean;
   refreshKnowledgeBaseData: (forceRefresh?: boolean) => Promise<void>;
@@ -304,7 +304,7 @@ export const KnowledgeBaseProvider: React.FC<KnowledgeBaseProviderProps> = ({
   );
 
   // Set current active knowledge base - memoized with useCallback
-  const setActiveKnowledgeBase = useCallback((kb: KnowledgeBase) => {
+  const setActiveKnowledgeBase = useCallback((kb: KnowledgeBase | null) => {
     dispatch({ type: KNOWLEDGE_BASE_ACTION_TYPES.SET_ACTIVE, payload: kb });
   }, []);
 
diff --git a/frontend/app/[locale]/layout.client.tsx b/frontend/app/[locale]/layout.client.tsx
index 75b49d111..5f8c7d5fa 100644
--- a/frontend/app/[locale]/layout.client.tsx
+++ b/frontend/app/[locale]/layout.client.tsx
@@ -112,6 +112,7 @@ export function ClientLayout({ children }: { children: ReactNode }) {
           style={siderStyle}
           width={SIDER_CONFIG.EXPANDED_WIDTH}
           collapsed={collapsed}
+          onCollapse={setCollapsed}
           trigger={null}
           breakpoint="lg"
           collapsedWidth={SIDER_CONFIG.COLLAPSED_WIDTH}
diff --git a/frontend/app/[locale]/models/components/appConfig.tsx b/frontend/app/[locale]/models/components/appConfig.tsx
index de2c35421..3fccd35c3 100644
--- a/frontend/app/[locale]/models/components/appConfig.tsx
+++ b/frontend/app/[locale]/models/components/appConfig.tsx
@@ -42,9 +42,11 @@ export const AppConfigSection: React.FC = () => {
   // Avatar-related state
   const [isAvatarModalOpen, setIsAvatarModalOpen] = useState(false);
   const [selectedIconKey, setSelectedIconKey] = useState<string>(
-    presetIcons[0].key
+    appConfig.iconKey || presetIcons[0].key
+  );
+  const [tempIconKey, setTempIconKey] = useState<string>(
+    appConfig.iconKey || presetIcons[0].key
   );
-  const [tempIconKey, setTempIconKey] = useState<string>(presetIcons[0].key);
   const [tempColor, setTempColor] = useState<string>("#2689cb");
   const [avatarType, setAvatarType] = useState<
     (typeof ICON_TYPES)[keyof typeof ICON_TYPES]
@@ -114,11 +116,13 @@ export const AppConfigSection: React.FC = () => {
     }
     setAvatarType(appConfig.iconType);
     setCustomAvatarUrl(appConfig.customIconUrl);
+    setSelectedIconKey(appConfig.iconKey || presetIcons[0].key);
   }, [
     appConfig.appName,
     appConfig.appDescription,
     appConfig.iconType,
     appConfig.customIconUrl,
+    appConfig.iconKey,
   ]);
 
   // Listen for highlight missing field events
@@ -253,6 +257,7 @@ export const AppConfigSection: React.FC = () => {
 
         updateAppConfig({
           iconType: ICON_TYPES.PRESET,
+          iconKey: tempIconKey,
           customIconUrl: null,
           avatarUri: avatarUri,
         });
@@ -558,4 +563,4 @@ export const AppConfigSection: React.FC = () => {
       )}
     </div>
   );
-}; 
\ No newline at end of file
+};
diff --git a/frontend/app/[locale]/models/components/model/ModelAddDialog.tsx b/frontend/app/[locale]/models/components/model/ModelAddDialog.tsx
index 2df9643a9..cd258abc8 100644
--- a/frontend/app/[locale]/models/components/model/ModelAddDialog.tsx
+++ b/frontend/app/[locale]/models/components/model/ModelAddDialog.tsx
@@ -16,6 +16,8 @@ import { modelService } from "@/services/modelService";
 import { ModelType, SingleModelConfig } from "@/types/modelConfig";
 import { MODEL_TYPES, PROVIDER_LINKS } from "@/const/modelConfig";
 import { useSiliconModelList } from "@/hooks/model/useSiliconModelList";
+import { useDashscopeModelList } from "@/hooks/model/useDashscopeModelList";
+import { useTokenPonyModelList } from "@/hooks/model/useTokenponyModelList";
 import log from "@/lib/logger";
 import {
   ModelChunkSizeSlider,
@@ -248,7 +250,7 @@ export const ModelAddDialog = ({
   const [modelMaxTokens, setModelMaxTokens] = useState("4096");
 
   // Use the silicon model list hook
-  const { getModelList, getProviderSelectedModalList } = useSiliconModelList({
+  const siliconHook  = useSiliconModelList({
     form,
     setModelList,
     setSelectedModelIds,
@@ -256,7 +258,33 @@ export const ModelAddDialog = ({
     setLoadingModelList,
     tenantId,
   });
-
+  const dashscopeHook = useDashscopeModelList({
+    form,
+    setModelList,
+    setSelectedModelIds,
+    setShowModelList,
+    setLoadingModelList,
+    tenantId,
+  });
+  const tokenponyHook = useTokenPonyModelList({
+    form,
+    setModelList,
+    setSelectedModelIds,
+    setShowModelList,
+    setLoadingModelList,
+    tenantId,
+  });
+  let getModelList;
+  let getProviderSelectedModalList;
+
+// 2. 根据条件赋值
+  if (form.provider === "silicon") {
+    ({ getModelList, getProviderSelectedModalList } = siliconHook);
+  } else if (form.provider === "dashscope") {
+    ({ getModelList, getProviderSelectedModalList } = dashscopeHook);
+  } else if (form.provider === "tokenpony") {
+    ({ getModelList, getProviderSelectedModalList } = tokenponyHook);
+  }
   // Reset form to default state
   const resetForm = useCallback(() => {
     setForm(DEFAULT_FORM_STATE);
@@ -794,6 +822,8 @@ export const ModelAddDialog = ({
                 {t("model.provider.modelengine")}
               </Option>
               <Option value="silicon">{t("model.provider.silicon")}</Option>
+              <Option value="dashscope">{t("model.provider.dashscope")}</Option>
+              <Option value="tokenpony">{t("model.provider.tokenpony")}</Option>
             </Select>
             {/* ModelEngine URL input (only when provider is ModelEngine) */}
             {form.provider === "modelengine" && (
diff --git a/frontend/app/[locale]/models/components/model/ModelDeleteDialog.tsx b/frontend/app/[locale]/models/components/model/ModelDeleteDialog.tsx
index 541ed6266..579908d95 100644
--- a/frontend/app/[locale]/models/components/model/ModelDeleteDialog.tsx
+++ b/frontend/app/[locale]/models/components/model/ModelDeleteDialog.tsx
@@ -183,6 +183,10 @@ export const ModelDeleteDialog = ({
         return t("model.source.modelEngine");
       case MODEL_SOURCES.OPENAI_API_COMPATIBLE:
         return t("model.source.custom");
+      case MODEL_SOURCES.DASHSCOPE:
+        return t("model.source.dashscope");
+      case MODEL_SOURCES.TOKENPONY:
+        return t("model.source.tokenpony");
       default:
         return t("model.source.unknown");
     }
@@ -217,6 +221,18 @@ export const ModelDeleteDialog = ({
           text: "text-rose-600",
           border: "border-rose-100",
         };
+      case MODEL_SOURCES.DASHSCOPE:
+        return {
+          bg: "bg-orange-50",
+          text: "text-orange-600",
+          border: "border-orange-100",
+        };
+      case MODEL_SOURCES.TOKENPONY:
+        return {
+          bg: "bg-cyan-50",
+          text: "text-cyan-600",
+          border: "border-cyan-100",
+        };
       default:
         return {
           bg: "bg-gray-50",
@@ -253,6 +269,14 @@ export const ModelDeleteDialog = ({
             🛠️
           </span>
         );
+      case MODEL_SOURCES.DASHSCOPE:
+        return (
+          <img src="/aliyuncs.png" alt="DashScope" className="w-5 h-5" />
+        );
+      case MODEL_SOURCES.TOKENPONY:
+        return (
+          <img src="/tokenpony.png" alt="TokenPony" className="w-5 h-5" />
+        );
       default:
         return (
           <span role="img" aria-label="box">
@@ -288,6 +312,16 @@ export const ModelDeleteDialog = ({
     );
     if (byModelEngine?.apiKey) return byModelEngine.apiKey;
 
+    const byDashScope = models.find(
+      (m) => m.source === MODEL_SOURCES.DASHSCOPE && m.type === type && m.apiKey
+    );
+    if (byDashScope?.apiKey) return byDashScope.apiKey;
+
+    const byTokenPony = models.find(
+      (m) => m.source === MODEL_SOURCES.TOKENPONY && m.type === type && m.apiKey
+    );
+    if (byTokenPony?.apiKey) return byTokenPony.apiKey;
+
     // Fallback: any model that has apiKey
     const anyWithKey = models.find((m) => m.apiKey);
     return anyWithKey?.apiKey || "";
@@ -327,7 +361,7 @@ export const ModelDeleteDialog = ({
     return anyModelWithUrl?.apiUrl || undefined;
   };
 
-  // Prefetch provider model list (supports Silicon and ModelEngine)
+  // Prefetch provider model list (supports Silicon, ModelEngine, DashScope, TokenPony)
   const prefetchProviderModels = async (
     provider: ModelSource,
     modelType: ModelType | null
@@ -351,6 +385,20 @@ export const ModelDeleteDialog = ({
           apiKey: apiKey && apiKey.trim() !== "" ? apiKey : "sk-no-api-key",
           baseUrl: baseUrl || undefined,
         });
+      } else if (provider === MODEL_SOURCES.DASHSCOPE) {
+        const apiKey = getApiKeyByType(modelType, MODEL_SOURCES.DASHSCOPE);
+        result = await modelService.addProviderModel({
+          provider: MODEL_SOURCES.DASHSCOPE,
+          type: modelType,
+          apiKey: apiKey && apiKey.trim() !== "" ? apiKey : "sk-no-api-key",
+        });
+      } else if (provider === MODEL_SOURCES.TOKENPONY) {
+        const apiKey = getApiKeyByType(modelType, MODEL_SOURCES.TOKENPONY);
+        result = await modelService.addProviderModel({
+          provider: MODEL_SOURCES.TOKENPONY,
+          type: modelType,
+          apiKey: apiKey && apiKey.trim() !== "" ? apiKey : "sk-no-api-key",
+        });
       } else {
         // Unsupported provider for prefetching
         return;
@@ -383,7 +431,12 @@ export const ModelDeleteDialog = ({
   const handleSourceSelect = async (source: ModelSource) => {
     setLoadingSource(source);
     try {
-      if (source === MODEL_SOURCES.SILICON || source === MODEL_SOURCES.MODELENGINE) {
+      if (
+        source === MODEL_SOURCES.SILICON ||
+        source === MODEL_SOURCES.MODELENGINE ||
+        source === MODEL_SOURCES.DASHSCOPE ||
+        source === MODEL_SOURCES.TOKENPONY
+      ) {
         await prefetchProviderModels(source, deletingModelType);
       } else if (source === MODEL_SOURCES.OPENAI) {
         // For OpenAI source, just set the selected source without prefetching
@@ -543,7 +596,9 @@ export const ModelDeleteDialog = ({
     setMaxTokens(maxTokens);
     if (
       (selectedSource === MODEL_SOURCES.SILICON ||
-        selectedSource === MODEL_SOURCES.MODELENGINE) &&
+        selectedSource === MODEL_SOURCES.MODELENGINE ||
+        selectedSource === MODEL_SOURCES.DASHSCOPE ||
+        selectedSource === MODEL_SOURCES.TOKENPONY) &&
       deletingModelType
     ) {
       try {
@@ -839,6 +894,98 @@ export const ModelDeleteDialog = ({
                         t("model.dialog.error.addFailed", { error: e as any })
                       );
                     }
+                  } else if (
+                    selectedSource === MODEL_SOURCES.DASHSCOPE &&
+                    deletingModelType
+                  ) {
+                    try {
+                      const allEnabledModels = providerModels.filter(
+                        (pm: any) => pendingSelectedProviderIds.has(pm.id)
+                      );
+
+                      if (allEnabledModels) {
+                        const apiKey = getApiKeyByType(deletingModelType, MODEL_SOURCES.DASHSCOPE);
+                        const isEmbeddingType =
+                          deletingModelType === MODEL_TYPES.EMBEDDING ||
+                          deletingModelType === MODEL_TYPES.MULTI_EMBEDDING;
+                        await modelService.addBatchCustomModel({
+                          api_key:
+                            apiKey && apiKey.trim() !== ""
+                              ? apiKey
+                              : "sk-no-api-key",
+                          provider: MODEL_SOURCES.DASHSCOPE,
+                          type: deletingModelType,
+                          models: allEnabledModels.map((model) => {
+                            if (isEmbeddingType) {
+                              const { max_tokens, ...modelWithoutMaxTokens } =
+                                model;
+                              return modelWithoutMaxTokens;
+                            } else {
+                              return {
+                                ...model,
+                                max_tokens: model.max_tokens || 4096,
+                              };
+                            }
+                          }),
+                        });
+                      }
+
+                      await onSuccess();
+                      await prefetchProviderModels(selectedSource, deletingModelType);
+                      message.success(t("model.dialog.success.updateSuccess"));
+                      handleClose();
+                    } catch (e) {
+                      log.error("Failed to apply DashScope model updates", e);
+                      message.error(
+                        t("model.dialog.error.addFailed", { error: e as any })
+                      );
+                    }
+                  } else if (
+                    selectedSource === MODEL_SOURCES.TOKENPONY &&
+                    deletingModelType
+                  ) {
+                    try {
+                      const allEnabledModels = providerModels.filter(
+                        (pm: any) => pendingSelectedProviderIds.has(pm.id)
+                      );
+
+                      if (allEnabledModels) {
+                        const apiKey = getApiKeyByType(deletingModelType, MODEL_SOURCES.TOKENPONY);
+                        const isEmbeddingType =
+                          deletingModelType === MODEL_TYPES.EMBEDDING ||
+                          deletingModelType === MODEL_TYPES.MULTI_EMBEDDING;
+                        await modelService.addBatchCustomModel({
+                          api_key:
+                            apiKey && apiKey.trim() !== ""
+                              ? apiKey
+                              : "sk-no-api-key",
+                          provider: MODEL_SOURCES.TOKENPONY,
+                          type: deletingModelType,
+                          models: allEnabledModels.map((model) => {
+                            if (isEmbeddingType) {
+                              const { max_tokens, ...modelWithoutMaxTokens } =
+                                model;
+                              return modelWithoutMaxTokens;
+                            } else {
+                              return {
+                                ...model,
+                                max_tokens: model.max_tokens || 4096,
+                              };
+                            }
+                          }),
+                        });
+                      }
+
+                      await onSuccess();
+                      await prefetchProviderModels(selectedSource, deletingModelType);
+                      message.success(t("model.dialog.success.updateSuccess"));
+                      handleClose();
+                    } catch (e) {
+                      log.error("Failed to apply TokenPony model updates", e);
+                      message.error(
+                        t("model.dialog.error.addFailed", { error: e as any })
+                      );
+                    }
                   } else if (
                     selectedSource === MODEL_SOURCES.OPENAI &&
                     deletingModelType
@@ -976,6 +1123,8 @@ export const ModelDeleteDialog = ({
                 MODEL_SOURCES.OPENAI,
                 MODEL_SOURCES.SILICON,
                 MODEL_SOURCES.OPENAI_API_COMPATIBLE,
+                MODEL_SOURCES.DASHSCOPE,
+                MODEL_SOURCES.TOKENPONY,
               ] as ModelSource[]
             ).map((source) => {
               const modelsOfSource = models.filter(
@@ -1074,7 +1223,9 @@ export const ModelDeleteDialog = ({
                   onClick={async () => {
                     if (
                       (selectedSource === MODEL_SOURCES.SILICON ||
-                        selectedSource === MODEL_SOURCES.MODELENGINE) &&
+                        selectedSource === MODEL_SOURCES.MODELENGINE ||
+                        selectedSource === MODEL_SOURCES.DASHSCOPE ||
+                        selectedSource === MODEL_SOURCES.TOKENPONY) &&
                       deletingModelType
                     ) {
                       try {
diff --git a/frontend/app/[locale]/models/components/model/ModelListCard.tsx b/frontend/app/[locale]/models/components/model/ModelListCard.tsx
index ae966ae35..8bf6e00a6 100644
--- a/frontend/app/[locale]/models/components/model/ModelListCard.tsx
+++ b/frontend/app/[locale]/models/components/model/ModelListCard.tsx
@@ -33,12 +33,12 @@ const PULSE_ANIMATION = `
       transform: scale(0.95);
       box-shadow: 0 0 0 0 rgba(41, 128, 185, 0.7);
     }
-    
+
     70% {
       transform: scale(1);
       box-shadow: 0 0 0 5px rgba(41, 128, 185, 0);
     }
-    
+
     100% {
       transform: scale(0.95);
       box-shadow: 0 0 0 0 rgba(41, 128, 185, 0);
@@ -162,27 +162,33 @@ export const ModelListCard = ({
     const model = modelsData.find(
       (m) => m.type === type && m.displayName === displayName
     );
-    
+
     if (!model) return t("model.source.unknown");
-    
+
     // Return source label based on model.source
     if (model.source === "modelengine") {
       return t("model.source.modelEngine");
     } else if (model.source === "silicon") {
       return t("model.source.silicon");
+    } else if (model.source==="dashscope"){
+      return t("model.source.dashscope");
+    }else  if (model.source==="tokenpony"){
+      return t("model.source.tokenpony");
     } else if (model.source === "OpenAI-API-Compatible") {
       return t("model.source.custom");
     }
-    
+
     return t("model.source.unknown");
   };
 
   const filteredModels = getFilteredModels();
-  
+
   // Group models by source for display
   const groupedModels = {
     modelengine: filteredModels.filter((m) => m.source === "modelengine"),
     silicon: filteredModels.filter((m) => m.source === "silicon"),
+    dashscope: filteredModels.filter((m) => m.source === "dashscope"),
+    tokenpony: filteredModels.filter((m) => m.source === "tokenpony"),
     custom: filteredModels.filter((m) => m.source === "OpenAI-API-Compatible"),
   };
 
@@ -343,6 +349,102 @@ export const ModelListCard = ({
             ))}
           </Select.OptGroup>
         )}
+        {groupedModels.dashscope.length > 0 && (
+          <Select.OptGroup label={t("model.group.dashscope")}>
+            {groupedModels.dashscope.map((model) => (
+              <Option
+                key={`${type}-${model.displayName}-dashscope`}
+                value={model.displayName}
+              >
+                <div
+                  className="flex items-center justify-between"
+                  style={{ minWidth: 0 }}
+                >
+                  <div
+                    className="flex items-center font-medium truncate"
+                    style={{ flex: "1 1 auto", minWidth: 0 }}
+                    title={model.displayName}
+                  >
+                    <img
+                      src={getProviderIconByUrl(model.apiUrl)}
+                      alt="provider"
+                      className="w-4 h-4 rounded mr-2 flex-shrink-0"
+                    />
+                    <span className="truncate">{model.displayName}</span>
+                  </div>
+                  <div
+                    style={{
+                      flex: "0 0 auto",
+                      display: "flex",
+                      alignItems: "center",
+                      marginLeft: "8px",
+                    }}
+                  >
+                    <Tooltip title={t("model.status.tooltip")}>
+                      <span
+                        onClick={(e) => handleStatusClick(e, model.displayName)}
+                        onMouseDown={(e: React.MouseEvent) => {
+                          e.stopPropagation();
+                          e.preventDefault();
+                        }}
+                        style={getStatusStyle(model.connect_status)}
+                        className="status-indicator"
+                      />
+                    </Tooltip>
+                  </div>
+                </div>
+              </Option>
+            ))}
+          </Select.OptGroup>
+        )}
+        {groupedModels.tokenpony.length > 0 && (
+          <Select.OptGroup label={t("model.group.tokenpony")}>
+            {groupedModels.tokenpony.map((model) => (
+              <Option
+                key={`${type}-${model.displayName}-tokenpony`}
+                value={model.displayName}
+              >
+                <div
+                  className="flex items-center justify-between"
+                  style={{ minWidth: 0 }}
+                >
+                  <div
+                    className="flex items-center font-medium truncate"
+                    style={{ flex: "1 1 auto", minWidth: 0 }}
+                    title={model.displayName}
+                  >
+                    <img
+                      src={getProviderIconByUrl(model.apiUrl)}
+                      alt="provider"
+                      className="w-4 h-4 rounded mr-2 flex-shrink-0"
+                    />
+                    <span className="truncate">{model.displayName}</span>
+                  </div>
+                  <div
+                    style={{
+                      flex: "0 0 auto",
+                      display: "flex",
+                      alignItems: "center",
+                      marginLeft: "8px",
+                    }}
+                  >
+                    <Tooltip title={t("model.status.tooltip")}>
+                      <span
+                        onClick={(e) => handleStatusClick(e, model.displayName)}
+                        onMouseDown={(e: React.MouseEvent) => {
+                          e.stopPropagation();
+                          e.preventDefault();
+                        }}
+                        style={getStatusStyle(model.connect_status)}
+                        className="status-indicator"
+                      />
+                    </Tooltip>
+                  </div>
+                </div>
+              </Option>
+            ))}
+          </Select.OptGroup>
+        )}
         {groupedModels.custom.length > 0 && (
           <Select.OptGroup label={t("model.group.custom")}>
             {groupedModels.custom.map((model) => (
@@ -394,4 +496,4 @@ export const ModelListCard = ({
       </Select>
     </div>
   );
-}; 
\ No newline at end of file
+};
diff --git a/frontend/app/[locale]/page.tsx b/frontend/app/[locale]/page.tsx
index d56e06728..d90cf8062 100644
--- a/frontend/app/[locale]/page.tsx
+++ b/frontend/app/[locale]/page.tsx
@@ -11,7 +11,7 @@ import {
   TextQuote,
   AlertTriangle,
 } from "lucide-react";
-import { Button } from "antd";
+import { Button, Row, Col } from "antd";
 import { Card, CardContent } from "@/components/ui/card";
 import { motion } from "framer-motion";
 import { useDeployment } from "@/components/providers/deploymentProvider";
@@ -55,9 +55,9 @@ export default function Homepage() {
   const navigateToSpace = () => navigateWithPermissionCheck("/space");
 
   return (
-    <div className="w-full h-full flex flex-col items-center justify-center">
+    <div className="w-full min-h-full flex flex-col items-center justify-center pt-6 pb-8">
       {/* Hero area */}
-      <section className="relative w-full py-4 flex flex-col items-center justify-center text-center">
+      <section className="relative w-full p-4 flex flex-col items-center justify-center text-center flex-shrink-0">
         <div className="absolute inset-0 bg-grid-slate-200 dark:bg-grid-slate-800 [mask-image:radial-gradient(ellipse_at_center,white_20%,transparent_75%)] -z-10"></div>
         <motion.h2
           initial={{ opacity: 0, y: -20 }}
@@ -80,37 +80,41 @@ export default function Homepage() {
           {t("page.description")}
         </motion.p>
 
-        {/* Three parallel buttons */}
+        {/* Three parallel buttons - responsive: row on wide, column on narrow */}
         <motion.div
           initial={{ opacity: 0, y: 20 }}
           animate={{ opacity: 1, y: 0 }}
           transition={{ duration: 0.8, delay: 0.4 }}
-          className="flex flex-col sm:flex-row gap-4"
         >
-          
-          <Button
-            onClick={navigateToChat}
-            className="bg-blue-600 hover:bg-blue-700 text-white px-8 py-6 rounded-full text-lg font-medium shadow-lg hover:shadow-xl transition-all duration-300 group"
-          >
-            <Bot className="mr-2 h-5 w-5 group-hover:animate-pulse" />
-            {t("page.startChat")}
-          </Button>
-
-          <Button
-            onClick={navigateToSetup}
-            className="bg-blue-600 hover:bg-blue-700 text-white px-8 py-6 rounded-full text-lg font-medium shadow-lg hover:shadow-xl transition-all duration-300 group"
-          >
-            <Zap className="mr-2 h-5 w-5 group-hover:animate-pulse" />
-            {t("page.quickConfig")}
-          </Button>
-
-          <Button
-            onClick={navigateToSpace}
-            className="bg-blue-600 hover:bg-blue-700 text-white px-8 py-6 rounded-full text-lg font-medium shadow-lg hover:shadow-xl transition-all duration-300 group"
-          >
-            <Globe className="mr-2 h-5 w-5 group-hover:animate-pulse" />
-            {t("page.agentSpace")}
-          </Button>
+          <Row gutter={[16, 16]} justify="center">
+            <Col xs={24} sm={24} md={8}>
+              <Button
+                onClick={navigateToChat}
+                className="w-full bg-blue-600 hover:bg-blue-700 text-white px-8 py-6 rounded-full text-lg font-medium shadow-lg hover:shadow-xl transition-all duration-300 group"
+              >
+                <Bot className="mr-2 h-6 w-6 shrink-0 group-hover:animate-pulse" />
+                {t("page.startChat")}
+              </Button>
+            </Col>
+            <Col xs={24} sm={24} md={8}>
+              <Button
+                onClick={navigateToSetup}
+                className="w-full bg-blue-600 hover:bg-blue-700 text-white px-8 py-6 rounded-full text-lg font-medium shadow-lg hover:shadow-xl transition-all duration-300 group"
+              >
+                <Zap className="mr-2 h-6 w-6 shrink-0 group-hover:animate-pulse" />
+                {t("page.quickConfig")}
+              </Button>
+            </Col>
+            <Col xs={24} sm={24} md={8}>
+              <Button
+                onClick={navigateToSpace}
+                className="w-full bg-blue-600 hover:bg-blue-700 text-white px-8 py-6 rounded-full text-lg font-medium shadow-lg hover:shadow-xl transition-all duration-300 group"
+              >
+                <Globe className="mr-2 h-6 w-6 shrink-0 group-hover:animate-pulse" />
+                {t("page.agentSpace")}
+              </Button>
+            </Col>
+          </Row>
         </motion.div>
 
         {/* Data protection notice - only shown in full version */}
@@ -132,7 +136,7 @@ export default function Homepage() {
         initial={{ opacity: 0, y: 30 }}
         animate={{ opacity: 1, y: 0 }}
         transition={{ duration: 0.8, delay: 0.6 }}
-        className="w-full mt-1 max-w-7xl"
+        className="w-full mt-1 max-w-7xl py-4 px-8"
       >
         <motion.h3
           initial={{ opacity: 0, y: -20 }}
@@ -207,7 +211,7 @@ function FeatureCard({ icon, title, description }: FeatureCardProps) {
           {icon}
         </div>
         <div className="flex-1 min-w-0 flex flex-col justify-center">
-          <h4 className="text-lg font-semibold text-slate-900 dark:text-white mb-2">
+          <h4 className="text-lg font-semibold text-slate-900 dark:text-white mb-2 truncate">
             {title}
           </h4>
           <p className="text-sm text-slate-600 dark:text-slate-300 line-clamp-3">
diff --git a/frontend/app/[locale]/tenant-resources/components/UserManageComp.tsx b/frontend/app/[locale]/tenant-resources/components/UserManageComp.tsx
index ffa68f62b..75760887c 100644
--- a/frontend/app/[locale]/tenant-resources/components/UserManageComp.tsx
+++ b/frontend/app/[locale]/tenant-resources/components/UserManageComp.tsx
@@ -1,6 +1,7 @@
 "use client";
 
 import React, { useState, useEffect, useRef } from "react";
+import { useQuery } from "@tanstack/react-query";
 import {
   Row,
   Col,
@@ -27,6 +28,7 @@ import {
   updateTenant,
   deleteTenant,
   getTenantUsers,
+  getTenant,
 } from "@/services/tenantService";
 import { createInvitation, deleteInvitation } from "@/services/invitationService";
 import { authService } from "@/services/authService";
@@ -191,10 +193,12 @@ function TenantList({
             });
 
             // Register admin account using the invitation code
+            // Do not auto-login for tenant admin creation
             const signupResult = await authService.signUp(
               values.adminEmail,
               values.adminPassword,
-              invitation.invitation_code
+              invitation.invitation_code,
+              false
             );
 
             if (signupResult.error) {
@@ -562,6 +566,31 @@ export default function UserManageComp() {
     refetch: refetchTenants,
   } = useTenantList({ page: currentPage, page_size: DEFAULT_PAGE_SIZE });
 
+  // For non-super admins, automatically select their own tenant based on user.tenantId
+  // This must be declared before useQuery that uses tenantId
+  const [tenantId, setTenantId] = useState<string | null>(null);
+  useEffect(() => {
+    if (!isSuperAdmin && user?.tenantId && !tenantId) {
+      setTenantId(user.tenantId);
+    }
+  }, [isSuperAdmin, tenantId, user?.tenantId]);
+
+  // For non-super-admin users, directly fetch their tenant details
+  // This ensures they always get the correct tenant info regardless of pagination
+  const {
+    data: directTenantData,
+    isLoading: directTenantLoading,
+    refetch: refetchDirectTenant,
+  } = useQuery({
+    queryKey: ["tenant", tenantId],
+    queryFn: async () => {
+      if (!tenantId || isSuperAdmin) return null;
+      return await getTenant(tenantId);
+    },
+    enabled: !!tenantId && !isSuperAdmin,
+    staleTime: 1000 * 60, // Cache for 1 minute
+  });
+
   // Handle page change
   const handlePageChange = (page: number) => {
     setCurrentPage(page);
@@ -583,17 +612,21 @@ export default function UserManageComp() {
   // Invitation list refresh key - increment to trigger invitation list refetch
   const [invitationListRefreshKey, setInvitationListRefreshKey] = useState(0);
 
-  // For non-super admins, automatically select their own tenant based on user.tenantId
-  const [tenantId, setTenantId] = useState<string | null>(null);
-  useEffect(() => {
-    if (!isSuperAdmin && user?.tenantId && !tenantId) {
-      setTenantId(user.tenantId);
-    }
-  }, [isSuperAdmin, tenantId, user?.tenantId]);
-
   // Get current tenant name
-  const currentTenant = tenantData?.data?.find((t: Tenant) => t.tenant_id === tenantId);
-  const currentTenantName = currentTenant?.tenant_name || t("tenantResources.tenants.unnamed");
+  // For non-super-admin: use directly fetched tenant data (directTenantData)
+  // For super-admin: use paginated tenant list (tenantData)
+  let currentTenant: Tenant | undefined;
+  let currentTenantName: string;
+
+  if (!isSuperAdmin && directTenantData) {
+    // Non-super-admin: use directly fetched tenant info
+    currentTenant = directTenantData;
+    currentTenantName = directTenantData.tenant_name || t("tenantResources.tenants.unnamed");
+  } else {
+    // Super-admin: search in paginated list
+    currentTenant = tenantData?.data?.find((t: Tenant) => t.tenant_id === tenantId);
+    currentTenantName = currentTenant?.tenant_name || t("tenantResources.tenants.unnamed");
+  }
 
   // Tenant name editing states
   const [isEditingTenantName, setIsEditingTenantName] = useState(false);
@@ -625,7 +658,12 @@ export default function UserManageComp() {
     }
     try {
       await updateTenant(tenantId, { tenant_name: trimmedName });
-      await refetchTenants();
+      // For non-super-admin, refetch the direct tenant data; for super-admin, refetch the list
+      if (!isSuperAdmin) {
+        await refetchDirectTenant();
+      } else {
+        await refetchTenants();
+      }
       message.success(t("tenantResources.tenants.updated"));
       setIsEditingTenantName(false);
     } catch (error) {
@@ -651,29 +689,27 @@ export default function UserManageComp() {
   return (
     <div className="w-full h-full">
       {/* Page header: grouped header without dividing line */}
-      <div className="w-full px-4 md:px-8 lg:px-16 py-6">
-        <div className="max-w-7xl mx-auto">
-          <motion.div
-            initial={{ opacity: 0, y: -8 }}
-            animate={{ opacity: 1, y: 0 }}
-            transition={{ duration: 0.35 }}
-          >
-            <div className="flex items-center gap-3">
-              <div className="w-12 h-12 rounded-full bg-gradient-to-br from-purple-500 to-indigo-500 flex items-center justify-center shadow-sm">
-                <Building2 className="h-6 w-6 text-white" />
-              </div>
-              <div>
-                <h1 className="text-2xl font-bold text-purple-600 dark:text-purple-500">
-                  {t("tenantResources.title") || "Tenant Resource Management"}
-                </h1>
-                <p className="text-slate-600 dark:text-slate-300 mt-1">
-                  {t("tenantResources.subtitle") ||
-                    "Manage tenants, users, groups and resources"}
-                </p>
-              </div>
+      <div className="w-full px-10 pt-10">
+        <motion.div
+          initial={{ opacity: 0, y: -8 }}
+          animate={{ opacity: 1, y: 0 }}
+          transition={{ duration: 0.35 }}
+        >
+          <div className="flex items-center gap-3">
+            <div className="w-12 h-12 rounded-full bg-gradient-to-br from-purple-500 to-indigo-500 flex items-center justify-center shadow-sm">
+              <Building2 className="h-6 w-6 text-white" />
             </div>
-          </motion.div>
-        </div>
+            <div>
+              <h1 className="text-2xl font-bold text-purple-600 dark:text-purple-500">
+                {t("tenantResources.title") || "Tenant Resource Management"}
+              </h1>
+              <p className="text-slate-600 dark:text-slate-300 mt-1">
+                {t("tenantResources.subtitle") ||
+                  "Manage tenants, users, groups and resources"}
+              </p>
+            </div>
+          </div>
+        </motion.div>
       </div>
       <Row className="flex-1 min-h-0 h-full" align="stretch">
         <Can permission="tenant.list:read">
diff --git a/frontend/app/[locale]/tenant-resources/components/resources/ModelList.tsx b/frontend/app/[locale]/tenant-resources/components/resources/ModelList.tsx
index f3abbe011..6de719127 100644
--- a/frontend/app/[locale]/tenant-resources/components/resources/ModelList.tsx
+++ b/frontend/app/[locale]/tenant-resources/components/resources/ModelList.tsx
@@ -6,6 +6,8 @@ import { Table, Button, Popconfirm, message, Tag, Pagination } from "antd";
 import { Edit, Trash2, RefreshCw } from "lucide-react";
 import { Tooltip } from "@/components/ui/tooltip";
 import { ColumnsType } from "antd/es/table";
+import type { TablePaginationConfig } from "antd";
+import { FilterValue, SorterResult } from "antd/es/table/interface";
 import { useManageTenantModels } from "@/hooks/model/useManageTenantModels";
 import { modelService } from "@/services/modelService";
 import { type ModelOption, type ModelType } from "@/types/modelConfig";
@@ -121,11 +123,16 @@ export default function ModelList({ tenantId }: { tenantId: string | null }) {
   };
 
   // Handle pagination change
-  const handlePageChange = (newPage: number, newPageSize: number) => {
+  const handlePageChange = (
+    pagination: TablePaginationConfig,
+    _filters: Record<string, FilterValue | null>,
+    _sorter: SorterResult<ModelOption> | SorterResult<ModelOption>[]
+  ) => {
+    const newPage = pagination.current || 1;
+    const newPageSize = pagination.pageSize || 10;
     setPage(newPage);
     if (newPageSize !== pageSize) {
       setPageSize(newPageSize);
-      setPage(1);
     }
   };
 
@@ -135,13 +142,8 @@ export default function ModelList({ tenantId }: { tenantId: string | null }) {
       title: t("common.name"),
       dataIndex: "displayName",
       key: "displayName",
-      width: 170,
-      render: (text: string, record: ModelOption) => (
-        <div>
-          <div className="font-medium">{text || record.name}</div>
-          <div className="text-sm text-gray-500">{record.name}</div>
-        </div>
-      ),
+      width: 200,
+      ellipsis: true,
     },
     {
       title: t("common.type"),
@@ -245,7 +247,12 @@ export default function ModelList({ tenantId }: { tenantId: string | null }) {
         dataSource={models}
         loading={isLoading}
         rowKey="id"
-        pagination={{ pageSize: 10 }}
+        pagination={{
+          current: page,
+          pageSize: pageSize,
+          total: total
+        }}
+        onChange={handlePageChange}
         scroll={{ x: true }}
         className="flex-1"
       />
diff --git a/frontend/app/[locale]/users/components/UserProfileComp.tsx b/frontend/app/[locale]/users/components/UserProfileComp.tsx
index 6d45b4db0..2a66bd89e 100644
--- a/frontend/app/[locale]/users/components/UserProfileComp.tsx
+++ b/frontend/app/[locale]/users/components/UserProfileComp.tsx
@@ -1,6 +1,6 @@
 "use client";
 
-import React, { useState } from "react";
+import React, { useState, useEffect } from "react";
 import {
   Button,
   Typography,
@@ -25,6 +25,9 @@ import {
   Edit,
   Key,
   ChevronRight,
+  KeySquare,
+  KeyRound,
+  Copy,
 } from "lucide-react";
 import { USER_ROLES } from "@/const/modelConfig";
 import { useAuthorizationContext } from "@/components/providers/AuthorizationProvider";
@@ -32,6 +35,12 @@ import { useAuthenticationContext } from "@/components/providers/AuthenticationP
 import { useGroupList } from "@/hooks/group/useGroupList";
 import { useMemo } from "react";
 import { DeleteAccountModal } from "@/components/auth/DeleteAccountModal";
+import log from "@/lib/logger";
+import {
+  getUserTokens,
+  deleteUserToken,
+  createUserToken,
+} from "@/services/tokenService";
 
 /**
  * UserProfileComp - User profile and account settings component
@@ -77,6 +86,12 @@ export default function UserProfileComp() {
   const [isPasswordModalOpen, setIsPasswordModalOpen] = useState(false);
   const [isDeleteModalOpen, setIsDeleteModalOpen] = useState(false);
 
+  // AK/SK state
+  const [akInfo, setAkInfo] = useState<string | null>(null);
+  const [existingTokenIds, setExistingTokenIds] = useState<number[]>([]);
+  const [isLoadingAkSk, setIsLoadingAkSk] = useState(false);
+  const [isGeneratingAkSk, setIsGeneratingAkSk] = useState(false);
+
   // Form instances
   const [editForm] = Form.useForm();
   const [passwordForm] = Form.useForm();
@@ -121,6 +136,58 @@ export default function UserProfileComp() {
     }
   };
 
+  // Fetch AK/SK info on mount
+  useEffect(() => {
+    const fetchAkSkInfo = async () => {
+      if (!user?.id) return;
+      setIsLoadingAkSk(true);
+      try {
+        const tokens = await getUserTokens(user.id);
+        if (tokens.length > 0) {
+          setAkInfo(tokens[0].access_key);
+          setExistingTokenIds(tokens.map((t) => t.token_id));
+        }
+      } catch (error) {
+        log.error("Failed to fetch AK/SK info:", error);
+      } finally {
+        setIsLoadingAkSk(false);
+      }
+    };
+
+    fetchAkSkInfo();
+  }, [user?.id]);
+
+  // Handle generate AK/SK: delete existing tokens first, then create a new one
+  const handleGenerateAkSk = async () => {
+    setIsGeneratingAkSk(true);
+    try {
+      for (const tokenId of existingTokenIds) {
+        await deleteUserToken(tokenId);
+      }
+
+      const newToken = await createUserToken();
+      setAkInfo(newToken.access_key);
+      setExistingTokenIds([newToken.token_id]);
+      antdMessage.success(t("profile.generateAkSkSuccess") || "Access key generated successfully");
+    } catch (error) {
+      antdMessage.error(t("profile.generateAkSkFailed") || "Failed to generate access key");
+    } finally {
+      setIsGeneratingAkSk(false);
+    }
+  };
+
+  // Handle copy AK to clipboard
+  const handleCopyAk = async () => {
+    if (akInfo) {
+      try {
+        await navigator.clipboard.writeText(akInfo);
+        antdMessage.success(t("profile.copyAkSuccess") || "Access key copied to clipboard");
+      } catch (error) {
+        antdMessage.error(t("profile.copyAkFailed") || "Failed to copy access key");
+      }
+    }
+  };
+
   // Open edit modal
   // const openEditModal = () => {
   //   editForm.setFieldsValue({
@@ -272,7 +339,7 @@ export default function UserProfileComp() {
                 >
                   <div className="flex items-center gap-3">
                     <div className="w-8 h-8 rounded-lg bg-green-50 dark:bg-green-900/20 flex items-center justify-center">
-                      <Key className="h-4 w-4 text-green-500" />
+                      <KeyRound className="h-4 w-4 text-green-500" />
                     </div>
                     <div>
                       <div className="text-sm font-medium text-gray-900 dark:text-gray-100">
@@ -286,6 +353,86 @@ export default function UserProfileComp() {
                   <ChevronRight className="h-4 w-4 text-gray-400" />
                 </div>
 
+                {/* Generate Access Token Option */}
+                <div
+                  className="w-full px-6 py-3 flex items-center justify-between hover:bg-gray-50 dark:hover:bg-gray-700/50 transition-colors cursor-pointer"
+                  onClick={() => {
+                    if (akInfo) {
+                      Modal.confirm({
+                        title: t("profile.generateAkSkConfirmTitle") || "Generate New Access Key",
+                        content: t("profile.generateAkSkConfirmContent") || "You already have an access key. Generating a new one will overwrite the existing key. Continue?",
+                        okText: t("common.confirm") || "Confirm",
+                        cancelText: t("common.cancel") || "Cancel",
+                        onOk: handleGenerateAkSk,
+                        okButtonProps: { loading: isGeneratingAkSk },
+                      });
+                    } else {
+                      handleGenerateAkSk();
+                    }
+                  }}
+                >
+                  <div className="flex items-center gap-3">
+                    <div className="w-8 h-8 rounded-lg bg-purple-50 dark:bg-purple-900/20 flex items-center justify-center">
+                      <KeySquare className="h-4 w-4 text-purple-500" />
+                    </div>
+                    <div>
+                      <div className="text-sm font-medium text-gray-900 dark:text-gray-100">
+                        {t("profile.generateAkSk") || "Generate Access Token"}
+                      </div>
+                      {akInfo ? (
+                        <div className="flex items-center gap-1">
+                          <span className="text-xs font-mono text-purple-600 dark:text-purple-400">
+                            {akInfo}
+                          </span>
+                          <Button
+                            type="text"
+                            size="small"
+                            icon={<Copy className="h-3 w-3" />}
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              handleCopyAk();
+                            }}
+                            className="text-gray-400 hover:text-purple-500 p-0 h-auto"
+                          />
+                          <Button
+                            type="text"
+                            size="small"
+                            icon={<Trash2 className="h-3 w-3" />}
+                            onClick={(e) => {
+                              e.stopPropagation();
+                              Modal.confirm({
+                                title: t("profile.deleteAkSkConfirmTitle") || "Delete Access Key",
+                                content: t("profile.deleteAkSkConfirmContent") || "Are you sure you want to delete this access key? This action cannot be undone.",
+                                okText: t("common.confirm") || "Confirm",
+                                cancelText: t("common.cancel") || "Cancel",
+                                okButtonProps: { danger: true },
+                                onOk: async () => {
+                                  try {
+                                    for (const tokenId of existingTokenIds) {
+                                      await deleteUserToken(tokenId);
+                                    }
+                                    setAkInfo(null);
+                                    setExistingTokenIds([]);
+                                    antdMessage.success(t("profile.deleteAkSkSuccess") || "Access key deleted successfully");
+                                  } catch (error) {
+                                    antdMessage.error(t("profile.deleteAkSkFailed") || "Failed to delete access key");
+                                  }
+                                },
+                              });
+                            }}
+                            className="text-gray-400 hover:text-red-500 p-0 h-auto"
+                          />
+                        </div>
+                      ) : (
+                        <div className="text-xs text-gray-500 dark:text-gray-400">
+                          {t("profile.generateAkSkDesc") || "Create or regenerate your API access key"}
+                        </div>
+                      )}
+                    </div>
+                  </div>
+                  <ChevronRight className="h-4 w-4 text-gray-400" />
+                </div>
+
                 <button
                   onClick={() => setIsDeleteModalOpen(true)}
                   className="w-full px-6 py-3 flex items-center justify-between hover:bg-red-50 dark:hover:bg-red-900/20 transition-colors text-left"
diff --git a/frontend/components/auth/index.ts b/frontend/components/auth/index.ts
deleted file mode 100644
index b54ca123a..000000000
--- a/frontend/components/auth/index.ts
+++ /dev/null
@@ -1,8 +0,0 @@
-/**
- * Export all authentication related components
- */
-
-export * from "./avatarDropdown";
-export * from "./loginModal";
-export * from "./registerModal";
-export * from "./DeleteAccountModal";
diff --git a/frontend/components/tool-config/KnowledgeBaseSelectorModal.tsx b/frontend/components/tool-config/KnowledgeBaseSelectorModal.tsx
index 61a94d62a..6ab2da3a2 100644
--- a/frontend/components/tool-config/KnowledgeBaseSelectorModal.tsx
+++ b/frontend/components/tool-config/KnowledgeBaseSelectorModal.tsx
@@ -18,12 +18,45 @@ import {
 } from "@ant-design/icons";
 
 import { KnowledgeBase } from "@/types/knowledgeBase";
-import {
-  KnowledgeBaseSelectorProps,
-  getKnowledgeBaseSourcesForTool,
-} from "./index";
 import { KB_LAYOUT, KB_TAG_VARIANTS } from "@/const/knowledgeBaseLayout";
 
+interface KnowledgeBaseSelectorProps {
+  isOpen: boolean;
+  onClose: () => void;
+  onConfirm: (selectedKnowledgeBases: KnowledgeBase[]) => void;
+  selectedIds: string[];
+  toolType: "knowledge_base_search" | "dify_search" | "datamate_search" | "idata_search";
+  title?: string;
+  maxSelect?: number;
+  showCreateButton?: boolean;
+  showDeleteButton?: boolean;
+  showCheckbox?: boolean;
+  // Dify/iData configuration for fetching knowledge bases
+  difyConfig?: {
+    serverUrl?: string;
+    apiKey?: string;
+    userId?: string;
+    knowledgeSpaceId?: string;
+  };
+}
+
+function getKnowledgeBaseSourcesForTool(
+  toolType: "knowledge_base_search" | "dify_search" | "datamate_search" | "idata_search"
+): string[] {
+  switch (toolType) {
+    case "knowledge_base_search":
+      return ["nexent"];
+    case "dify_search":
+      return ["dify"];
+    case "datamate_search":
+      return ["datamate"];
+    case "idata_search":
+      return ["idata"];
+    default:
+      return ["nexent"];
+  }
+}
+
 interface KnowledgeBaseSelectorModalProps extends KnowledgeBaseSelectorProps {
   knowledgeBases: KnowledgeBase[];
   isLoading?: boolean;
@@ -38,10 +71,12 @@ interface KnowledgeBaseSelectorModalProps extends KnowledgeBaseSelectorProps {
   // Selection validation props
   isSelectable?: (kb: KnowledgeBase) => boolean;
   currentEmbeddingModel?: string | null;
-  // Dify configuration for fetching Dify knowledge bases
+  // Dify/iData configuration for fetching knowledge bases
   difyConfig?: {
     serverUrl?: string;
     apiKey?: string;
+    userId?: string;
+    knowledgeSpaceId?: string;
   };
 }
 
diff --git a/frontend/components/tool-config/index.ts b/frontend/components/tool-config/index.ts
index b424b3225..18a8ae98e 100644
--- a/frontend/components/tool-config/index.ts
+++ b/frontend/components/tool-config/index.ts
@@ -8,22 +8,24 @@ export interface KnowledgeBaseSelectorProps {
   onClose: () => void;
   onConfirm: (selectedKnowledgeBases: KnowledgeBase[]) => void;
   selectedIds: string[];
-  toolType: "knowledge_base_search" | "dify_search" | "datamate_search";
+  toolType: "knowledge_base_search" | "dify_search" | "datamate_search" | "idata_search";
   title?: string;
   maxSelect?: number;
   showCreateButton?: boolean;
   showDeleteButton?: boolean;
   showCheckbox?: boolean;
-  // Dify configuration for fetching Dify knowledge bases
+  // Dify/iData configuration for fetching knowledge bases
   difyConfig?: {
     serverUrl?: string;
     apiKey?: string;
+    userId?: string;
+    knowledgeSpaceId?: string;
   };
 }
 
 // Get supported knowledge base sources for a tool type
 export function getKnowledgeBaseSourcesForTool(
-  toolType: "knowledge_base_search" | "dify_search" | "datamate_search"
+  toolType: "knowledge_base_search" | "dify_search" | "datamate_search" | "idata_search"
 ): string[] {
   switch (toolType) {
     case "knowledge_base_search":
@@ -32,6 +34,8 @@ export function getKnowledgeBaseSourcesForTool(
       return ["dify"];
     case "datamate_search":
       return ["datamate"];
+    case "idata_search":
+      return ["idata"];
     default:
       return ["nexent"];
   }
diff --git a/frontend/const/errorCode.ts b/frontend/const/errorCode.ts
index 88b8ba0cb..9d1154dc6 100644
--- a/frontend/const/errorCode.ts
+++ b/frontend/const/errorCode.ts
@@ -118,6 +118,13 @@ export const ErrorCode = {
   MODEL_CONFIG_INVALID: "090102",
   MODEL_HEALTH_CHECK_FAILED: "090103",
   MODEL_PROVIDER_ERROR: "090104",
+  MODEL_PROMPT_GENERATION_FAILED: "090105",
+  // 02 - Model API errors
+  MODEL_API_KEY_INVALID: "090201",
+  MODEL_API_KEY_NO_PERMISSION: "090202",
+  MODEL_RATE_LIMIT_EXCEEDED: "090203",
+  MODEL_SERVICE_UNAVAILABLE: "090204",
+  MODEL_CONNECTION_ERROR: "090205",
 
   // ==================== 10 Memory / 记忆管理 ====================
   // 01 - Memory
diff --git a/frontend/const/errorMessage.ts b/frontend/const/errorMessage.ts
index 90ae1c286..02026f9d4 100644
--- a/frontend/const/errorMessage.ts
+++ b/frontend/const/errorMessage.ts
@@ -105,6 +105,19 @@ export const DEFAULT_ERROR_MESSAGES: Record<string, string> = {
   [ErrorCode.MODEL_CONFIG_INVALID]: "Model configuration is invalid.",
   [ErrorCode.MODEL_HEALTH_CHECK_FAILED]: "Model health check failed.",
   [ErrorCode.MODEL_PROVIDER_ERROR]: "Model provider error.",
+  [ErrorCode.MODEL_PROMPT_GENERATION_FAILED]:
+    "Model is unavailable. Please check the model status and try again.",
+  // 02 - Model API errors
+  [ErrorCode.MODEL_API_KEY_INVALID]:
+    "Model API key is invalid or expired. Please check your API key configuration.",
+  [ErrorCode.MODEL_API_KEY_NO_PERMISSION]:
+    "Model API key does not have permission. Please check your API key permissions.",
+  [ErrorCode.MODEL_RATE_LIMIT_EXCEEDED]:
+    "Rate limit exceeded. Please try again later.",
+  [ErrorCode.MODEL_SERVICE_UNAVAILABLE]:
+    "Model service is temporarily unavailable. Please try again later.",
+  [ErrorCode.MODEL_CONNECTION_ERROR]:
+    "Failed to connect to model service. Please check your network and model configuration.",
 
   // ==================== 10 Memory / 记忆管理 ====================
   // 01 - Memory
diff --git a/frontend/const/modelConfig.ts b/frontend/const/modelConfig.ts
index ce7f1841d..4c412824a 100644
--- a/frontend/const/modelConfig.ts
+++ b/frontend/const/modelConfig.ts
@@ -16,6 +16,8 @@ export const MODEL_SOURCES = {
   MODELENGINE: "modelengine",
   OPENAI_API_COMPATIBLE: "OpenAI-API-Compatible",
   CUSTOM: "custom",
+  DASHSCOPE: "dashscope",
+  TOKENPONY: "tokenpony",
 } as const;
 
 // Model status constants
@@ -40,6 +42,8 @@ export const MODEL_PROVIDER_KEYS = [
   "jina",
   "deepseek",
   "aliyuncs",
+  "tokenpony",
+  "dashscope",
 ] as const;
 
 export type ModelProviderKey = (typeof MODEL_PROVIDER_KEYS)[number];
@@ -52,6 +56,8 @@ export const PROVIDER_HINTS: Record<ModelProviderKey, string> = {
   jina: "jina",
   deepseek: "deepseek",
   aliyuncs: "aliyuncs",
+  tokenpony: "tokenpony",
+  dashscope: "dashscope",
 };
 
 // Icon filenames for providers
@@ -62,6 +68,8 @@ export const PROVIDER_ICON_MAP: Record<ModelProviderKey, string> = {
   jina: "/jina.png",
   deepseek: "/deepseek.png",
   aliyuncs: "/aliyuncs.png",
+  dashscope:"/aliyuncs.png",
+  tokenpony: "/tokenpony.png",
 };
 
 export const OFFICIAL_PROVIDER_ICON = "/modelengine-logo.png";
diff --git a/frontend/hooks/agent/useSaveGuard.ts b/frontend/hooks/agent/useSaveGuard.ts
index a1f4cea35..76a231e8b 100644
--- a/frontend/hooks/agent/useSaveGuard.ts
+++ b/frontend/hooks/agent/useSaveGuard.ts
@@ -4,10 +4,78 @@ import { App } from "antd";
 import { useQueryClient } from "@tanstack/react-query";
 import { useConfirmModal } from "../useConfirmModal";
 import { useAgentConfigStore } from "@/stores/agentConfigStore";
-import { updateAgentInfo, updateToolConfig } from "@/services/agentConfigService";
+import { updateAgentInfo, updateToolConfig, searchToolConfig } from "@/services/agentConfigService";
 import { Agent } from "@/types/agentConfig";
 import log from "@/lib/logger";
 
+/**
+ * Batch update tool configurations for an agent
+ * Handles create, update, and enable/disable operations
+ * 
+ * Logic:
+ * 1. For newly selected tools (not in baseline): Create tool instance with enable=true
+ * 2. For previously selected tools (in baseline): Update tool params with enable=true
+ * 3. For deselected tools (in baseline but not in current): Set enable=false
+ * 
+ * @param agentId - The agent ID
+ * @param currentTools - Current tool list from edited agent
+ * @param baselineTools - Baseline tool list (original state before editing)
+ */
+async function batchUpdateToolConfigs(
+  agentId: number,
+  currentTools: any[],
+  baselineTools: any[]
+) {
+  // Get the set of currently selected tool IDs
+  const currentToolIds = new Set(
+    currentTools.map((tool) => parseInt(tool.id))
+  );
+
+  // Get the set of baseline (original) tool IDs
+  const baselineToolIds = new Set(
+    baselineTools.map((tool) => parseInt(tool.id))
+  );
+
+  // Process each tool in the current selection
+  for (const tool of currentTools) {
+    const toolId = parseInt(tool.id);
+    const isEnabled = true; // Selected tools are always enabled
+    const params = tool.initParams?.reduce((acc: Record<string, any>, param: any) => {
+      acc[param.name] = param.value;
+      return acc;
+    }, {} as Record<string, any>) || {};
+
+    try {
+      // Update or create tool instance with current params and enabled status
+      await updateToolConfig(toolId, agentId, params, isEnabled);
+    } catch (error) {
+      log.error(`Failed to save tool config for tool ${toolId}:`, error);
+      // Continue with other tools even if one fails
+    }
+  }
+
+  // Disable tools that were previously selected but are now deselected
+  const toolsToDisable = Array.from(baselineToolIds).filter(
+    (toolId) => !currentToolIds.has(toolId)
+  );
+
+  for (const toolId of toolsToDisable) {
+    try {
+      // Fetch existing params to preserve them when disabling
+      const toolInstance = await searchToolConfig(toolId, agentId);
+      const existingParams = toolInstance.success && toolInstance.data?.params 
+        ? toolInstance.data.params 
+        : {};
+      
+      // Disable the tool while preserving its params
+      await updateToolConfig(toolId, agentId, existingParams, false);
+    } catch (error) {
+      log.error(`Failed to disable tool ${toolId}:`, error);
+      // Continue with other tools even if one fails
+    }
+  }
+}
+
 /**
  * Hook for handling agent save guard logic
  * Provides two functions: one with confirmation dialog, one for direct save
@@ -83,28 +151,9 @@ export const useSaveGuard = () => {
           throw new Error("Failed to get agent ID after save operation");
         }
 
-        // Handle new agent creation - save tool configurations
-        if (!currentAgentId && result.data?.agent_id) {
-          // Save tool configurations for the newly created agent
-          const agentIdNumber = result.data.agent_id;
-          if (currentEditedAgent.tools && currentEditedAgent.tools.length > 0) {
-            for (const tool of currentEditedAgent.tools) {
-              const toolId = parseInt(tool.id);
-              const isEnabled = tool.is_available !== false; // Default to true if not explicitly set to false
-              const params = tool.initParams?.reduce((acc, param) => {
-                acc[param.name] = param.value;
-                return acc;
-              }, {} as Record<string, any>) || {};
-
-              try {
-                await updateToolConfig(toolId, agentIdNumber, params, isEnabled);
-              } catch (error) {
-                log.error(`Failed to save tool config for tool ${toolId}:`, error);
-                // Continue with other tools even if one fails
-              }
-            }
-          }
-        }
+        // Batch process tool configurations for both create and update modes
+        const baselineTools = useAgentConfigStore.getState().baselineAgent?.tools || [];
+        await batchUpdateToolConfigs(finalAgentId, currentEditedAgent.tools || [], baselineTools);
 
         // Common logic for both creation and update: refresh cache and update store
         await queryClient.invalidateQueries({
diff --git a/frontend/hooks/auth/useAuthenticationUI.ts b/frontend/hooks/auth/useAuthenticationUI.ts
index c158b2d8d..8891790e6 100644
--- a/frontend/hooks/auth/useAuthenticationUI.ts
+++ b/frontend/hooks/auth/useAuthenticationUI.ts
@@ -80,16 +80,6 @@ export function useAuthenticationUI({
     handleUnauthenticatedModalClose();
   }, [handleUnauthenticatedModalClose]);
 
-  /**
-   * Check if current path is home page
-   * Home page paths: "/", "/zh", "/en"
-   */
-  const isLocaleHomePath = (path?: string | null) => {
-    if (!path) return false;
-    const segments = path.split("/").filter(Boolean);
-    return segments.length <= 1;
-  };
-
   useEffect(() => {
     if (isSpeedMode) return;
 
@@ -131,14 +121,7 @@ export function useAuthenticationUI({
     if (isSessionExpiredModalOpen) return;
     if (isLoginModalOpen) return;
     if (isRegisterModalOpen) return;
-    // Skip if already on home page
-    if (isLocaleHomePath(pathname)) return;
-
-    // For unauthenticated users accessing protected routes, show auth prompt
-    const effectivePath = getEffectiveRoutePath(pathname);
-    if (effectivePath !== "/") {
-      openAuthPromptModal();
-    }
+    openAuthPromptModal();
   }, [pathname, isAuthenticated, isSpeedMode, isAuthChecking, isSessionExpiredModalOpen, openAuthPromptModal]);
 
 
diff --git a/frontend/hooks/chat/useConversationManagement.ts b/frontend/hooks/chat/useConversationManagement.ts
index 5e53680f3..c07726df7 100644
--- a/frontend/hooks/chat/useConversationManagement.ts
+++ b/frontend/hooks/chat/useConversationManagement.ts
@@ -1,79 +1,93 @@
-import { useState, useRef, useEffect } from "react";
+import type React from "react";
+import { useState } from "react";
 import { useTranslation } from "react-i18next";
+import type { UseQueryResult } from "@tanstack/react-query";
+import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { conversationService } from "@/services/conversationService";
 import { ConversationListItem } from "@/types/chat";
 import log from "@/lib/logger";
 
-export const useConversationManagement = () => {
-  const { t } = useTranslation("common");
-  
-  // Conversation state
-  const [conversationId, setConversationId] = useState<number>(0);
-  const [conversationTitle, setConversationTitle] = useState(
-    t("chatInterface.newConversation")
-  );
-  const [conversationList, setConversationList] = useState<
-    ConversationListItem[]
-  >([]);
-  const [selectedConversationId, setSelectedConversationId] = useState<
-    number | null
-  >(null);
-  const [isNewConversation, setIsNewConversation] = useState(true);
-  const [conversationLoadError, setConversationLoadError] = useState<{
-    [conversationId: number]: string;
-  }>({});
+const CONVERSATION_LIST_QUERY_KEY = ["conversations"] as const;
 
-  // Refs
-  const currentSelectedConversationRef = useRef<number | null>(null);
-  const initialized = useRef(false);
+/**
+ * Return type of useConversationManagement hook.
+ * Use this type when passing conversation management state/handlers between parent and child components.
+ */
+export interface ConversationManagement {
+  conversationTitle: string;
+  conversationList: ConversationListItem[];
+  selectedConversationId: number | null;
+  isNewConversation: boolean;
+  conversationLoadError: Record<number, string>;
+  conversationListQuery: UseQueryResult<ConversationListItem[], Error>;
+  fetchConversationList: () => Promise<ConversationListItem[]>;
+  invalidateConversationList: () => void;
+  handleNewConversation: () => void;
+  handleConversationSelect: (conversation: ConversationListItem) => Promise<void>;
+  updateConversationTitle: (conversationId: number, title: string) => Promise<void>;
+  clearConversationLoadError: (conversationId: number) => void;
+  setConversationLoadErrorForId: (conversationId: number, error: string) => void;
+  setSelectedConversationId: React.Dispatch<React.SetStateAction<number | null>>;
+  setConversationTitle: React.Dispatch<React.SetStateAction<string>>;
+  setIsNewConversation: React.Dispatch<React.SetStateAction<boolean>>;
+}
 
-  // Ensure currentSelectedConversationRef is synchronized with selectedConversationId
-  useEffect(() => {
-    currentSelectedConversationRef.current = selectedConversationId;
-  }, [selectedConversationId]);
+export const useConversationManagement = (): ConversationManagement => {
+  const { t } = useTranslation("common");
+  const queryClient = useQueryClient();
 
-  // Fetch conversation list
-  const fetchConversationList = async (): Promise<ConversationListItem[]> => {
-    try {
+  const conversationListQuery = useQuery({
+    queryKey: CONVERSATION_LIST_QUERY_KEY,
+    queryFn: async (): Promise<ConversationListItem[]> => {
       const dialogHistory = await conversationService.getList();
-      // Sort by creation time, newest first
       dialogHistory.sort((a, b) => b.create_time - a.create_time);
-      setConversationList(dialogHistory);
       return dialogHistory;
-    } catch (error) {
-      log.error(t("chatInterface.errorFetchingConversationList"), error);
-      throw error;
+    },
+    staleTime: 30_000,
+  });
+
+  const conversationList = conversationListQuery.data ?? [];
+
+  const fetchConversationList = async (): Promise<ConversationListItem[]> => {
+    const result = await conversationListQuery.refetch();
+    if (result.error) {
+      log.error(t("chatInterface.errorFetchingConversationList"), result.error);
+      throw result.error;
     }
+    return result.data ?? [];
   };
 
+  const invalidateConversationList = () => queryClient.invalidateQueries({ queryKey: CONVERSATION_LIST_QUERY_KEY });
+
+  // Conversation state: null = no selection / new conversation, number = current conversation id
+  const [conversationTitle, setConversationTitle] = useState(t("chatInterface.newConversation"));
+  const [selectedConversationId, setSelectedConversationId] = useState<number | null>(null);
+  const [isNewConversation, setIsNewConversation] = useState(true);
+  const [conversationLoadError, setConversationLoadError] = useState<{[conversationId: number]: string;}>({});
+
+  // Refs
+
   // Handle new conversation
   const handleNewConversation = () => {
-    setConversationId(-1);
     setSelectedConversationId(null);
     setConversationTitle(t("chatInterface.newConversation"));
     setIsNewConversation(true);
-    currentSelectedConversationRef.current = null;
   };
 
   // Handle conversation selection
-  const handleConversationSelect = async (dialog: ConversationListItem) => {
-    // Immediately set conversation state, avoid flashing new conversation interface
-    setSelectedConversationId(dialog.conversation_id);
-    setConversationId(dialog.conversation_id);
-    setConversationTitle(dialog.conversation_title);
-
-    // Update ref to track current selected conversation
-    currentSelectedConversationRef.current = dialog.conversation_id;
+  const handleConversationSelect = async (conversation: ConversationListItem) => {
+    setSelectedConversationId(conversation.conversation_id);
+    setConversationTitle(conversation.conversation_title);
     setIsNewConversation(false);
   };
 
   // Update conversation title
-  const updateConversationTitle = async (dialogId: number, title: string) => {
+  const updateConversationTitle = async (conversationId: number, title: string) => {
     try {
-      await conversationService.rename(dialogId, title);
+      await conversationService.rename(conversationId, title);
       await fetchConversationList();
 
-      if (selectedConversationId === dialogId) {
+      if (selectedConversationId === conversationId) {
         setConversationTitle(title);
       }
     } catch (error) {
@@ -101,27 +115,23 @@ export const useConversationManagement = () => {
 
   return {
     // State (read-only)
-    conversationId,
     conversationTitle,
     conversationList,
     selectedConversationId,
     isNewConversation,
     conversationLoadError,
-    
-    // Refs
-    currentSelectedConversationRef,
-    initialized,
-    
+    conversationListQuery,
+
     // Methods
     fetchConversationList,
+    invalidateConversationList,
     handleNewConversation,
     handleConversationSelect,
     updateConversationTitle,
     clearConversationLoadError,
     setConversationLoadErrorForId,
-    
+
     // Setters (for internal use by components)
-    setConversationId,
     setSelectedConversationId,
     setConversationTitle,
     setIsNewConversation,
diff --git a/frontend/hooks/model/useDashscopeModelList.ts b/frontend/hooks/model/useDashscopeModelList.ts
new file mode 100644
index 000000000..b44348fe5
--- /dev/null
+++ b/frontend/hooks/model/useDashscopeModelList.ts
@@ -0,0 +1,133 @@
+import { useEffect } from "react";
+import { message } from "antd";
+import { useTranslation } from "react-i18next";
+import { modelService } from "@/services/modelService";
+import { ModelType } from "@/types/modelConfig";
+import { processProviderResponse } from "@/lib/providerError";
+import log from "@/lib/logger";
+
+interface UseDashscopeModelListProps {
+  form: {
+    type: ModelType;
+    isBatchImport: boolean;
+    apiKey: string;
+    provider: string; // Expected to be "dashscope"
+    maxTokens: string;
+    isMultimodal: boolean;
+  };
+  setModelList: (models: any[]) => void;
+  setSelectedModelIds: (ids: Set<string>) => void;
+  setShowModelList: (show: boolean) => void;
+  setLoadingModelList: (loading: boolean) => void;
+  tenantId?: string; // Optional tenant ID for manage operations
+}
+
+export const useDashscopeModelList = ({
+  form,
+  setModelList,
+  setSelectedModelIds,
+  setShowModelList,
+  setLoadingModelList,
+  tenantId,
+}: UseDashscopeModelListProps) => {
+  const { t } = useTranslation();
+
+  const getModelList = async () => {
+    setShowModelList(true);
+    setLoadingModelList(true);
+
+    const modelType =
+      form.type === "embedding" && form.isMultimodal
+        ? ("multi_embedding" as ModelType)
+        : form.type;
+
+    try {
+      // Use manage interface if tenantId is provided (for super admin)
+      const result = tenantId
+        ? await modelService.addManageProviderModel({
+            tenantId,
+            provider: form.provider,
+            type: modelType,
+            apiKey: form.apiKey.trim() === "" ? "sk-no-api-key" : form.apiKey,
+          })
+        : await modelService.addProviderModel({
+            provider: form.provider,
+            type: modelType,
+            apiKey: form.apiKey.trim() === "" ? "sk-no-api-key" : form.apiKey,
+          });
+
+      // Use centralized error processing
+      const { models, error } = processProviderResponse(
+        result,
+        form.provider,
+        t
+      );
+
+      if (error) {
+        message.error(error);
+        setModelList([]);
+        setSelectedModelIds(new Set());
+        setLoadingModelList(false);
+        return;
+      }
+
+      // Ensure each model has a default max_tokens value
+      const modelsWithDefaults = models.map((model: any) => ({
+        ...model,
+        max_tokens: model.max_tokens || parseInt(form.maxTokens) || 4096,
+      }));
+      setModelList(modelsWithDefaults);
+
+      const selectedModels = (await getProviderSelectedModalList()) || [];
+
+      // Key logic: Sync previously selected models
+      if (!selectedModels.length) {
+        // Select none
+        setSelectedModelIds(new Set());
+      } else {
+        // Only select selectedModels
+        setSelectedModelIds(new Set(selectedModels.map((m: any) => m.id)));
+      }
+    } catch (error) {
+      message.error(t("model.dialog.error.addFailed", { error }));
+      log.error(t("model.dialog.error.addFailedLog"), error);
+    } finally {
+      setLoadingModelList(false);
+    }
+  };
+
+  const getProviderSelectedModalList = async () => {
+    const modelType =
+      form.type === "embedding" && form.isMultimodal
+        ? ("multi_embedding" as ModelType)
+        : form.type;
+
+    // Use manage interface if tenantId is provided (for super admin)
+    const result = tenantId
+      ? await modelService.getManageProviderSelectedModalList({
+          tenantId,
+          provider: form.provider,
+          type: modelType,
+        })
+      : await modelService.getProviderSelectedModalList({
+          provider: form.provider,
+          type: modelType,
+          api_key: form.apiKey.trim() === "" ? "sk-no-api-key" : form.apiKey,
+        });
+
+    return result;
+  };
+
+  // Auto-fetch model list when batch import is enabled and API key is provided
+  useEffect(() => {
+    if (form.isBatchImport && form.apiKey.trim() !== "") {
+      getModelList();
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [form.type, form.isBatchImport]);
+
+  return {
+    getModelList,
+    getProviderSelectedModalList,
+  };
+};
diff --git a/frontend/hooks/model/useModelList.ts b/frontend/hooks/model/useModelList.ts
index 7a30255be..f6ff1dce1 100644
--- a/frontend/hooks/model/useModelList.ts
+++ b/frontend/hooks/model/useModelList.ts
@@ -2,8 +2,6 @@ import { useQuery, useQueryClient } from "@tanstack/react-query";
 import { modelService } from "@/services/modelService";
 import { ModelOption } from "@/types/modelConfig";
 import { useMemo } from "react";
-import { useConfig } from "@/hooks/useConfig";
-
 export function useModelList(options?: { enabled?: boolean; staleTime?: number }) {
 	const queryClient = useQueryClient();
 
@@ -48,41 +46,6 @@ export function useModelList(options?: { enabled?: boolean; staleTime?: number }
 		return models.filter((model) => model.type === "vlm" && model.connect_status === "available");
 	}, [models]);
 
-  const { modelConfig: tenantModelConfig } = useConfig();
-
-  // Get default LLM model from tenant configuration
-  const defaultLlmModel = useMemo(() => {
-    try {
-      const defaultModelName = tenantModelConfig?.llm?.modelName || tenantModelConfig?.llm?.displayName;
-
-      if (defaultModelName) {
-        // First try to find by name in available LLM models (should be available)
-        let defaultModel = availableLlmModels.find(model =>
-          model.name === defaultModelName ||
-          model.displayName === defaultModelName
-        );
-
-        // If not found in available models, try all models but only if they're LLM type
-        if (!defaultModel) {
-          defaultModel = models.find(model =>
-            model.type === "llm" && (
-              model.name === defaultModelName ||
-              model.displayName === defaultModelName
-            )
-          );
-        }
-
-        return defaultModel; // Return the found model or undefined if not found
-      }
-
-      // If no default configured, return undefined
-      return undefined;
-    } catch (error) {
-      return undefined;
-    }
-  }, [models, availableLlmModels, tenantModelConfig]);
-
-
 	return {
 		...query,
 		models,
@@ -92,8 +55,7 @@ export function useModelList(options?: { enabled?: boolean; staleTime?: number }
 		embeddingModels,
 		availableEmbeddingModels,
 		vlmModels,
-    availableVlmModels,
-    defaultLlmModel,
+		availableVlmModels,
 		invalidate: () => queryClient.invalidateQueries({ queryKey: ["models"] }),
 	};
 }
diff --git a/frontend/hooks/model/useTokenponyModelList.ts b/frontend/hooks/model/useTokenponyModelList.ts
new file mode 100644
index 000000000..0a7e23581
--- /dev/null
+++ b/frontend/hooks/model/useTokenponyModelList.ts
@@ -0,0 +1,133 @@
+import { useEffect } from "react";
+import { message } from "antd";
+import { useTranslation } from "react-i18next";
+import { modelService } from "@/services/modelService";
+import { ModelType } from "@/types/modelConfig";
+import { processProviderResponse } from "@/lib/providerError";
+import log from "@/lib/logger";
+
+interface UseTokenPonyModelListProps {
+  form: {
+    type: ModelType;
+    isBatchImport: boolean;
+    apiKey: string;
+    provider: string; // Expected to be "tokenpony"
+    maxTokens: string;
+    isMultimodal: boolean;
+  };
+  setModelList: (models: any[]) => void;
+  setSelectedModelIds: (ids: Set<string>) => void;
+  setShowModelList: (show: boolean) => void;
+  setLoadingModelList: (loading: boolean) => void;
+  tenantId?: string; // Optional tenant ID for manage operations
+}
+
+export const useTokenPonyModelList = ({
+  form,
+  setModelList,
+  setSelectedModelIds,
+  setShowModelList,
+  setLoadingModelList,
+  tenantId,
+}: UseTokenPonyModelListProps) => {
+  const { t } = useTranslation();
+
+  const getModelList = async () => {
+    setShowModelList(true);
+    setLoadingModelList(true);
+
+    const modelType =
+      form.type === "embedding" && form.isMultimodal
+        ? ("multi_embedding" as ModelType)
+        : form.type;
+
+    try {
+      // Use manage interface if tenantId is provided (for super admin)
+      const result = tenantId
+        ? await modelService.addManageProviderModel({
+            tenantId,
+            provider: form.provider,
+            type: modelType,
+            apiKey: form.apiKey.trim() === "" ? "sk-no-api-key" : form.apiKey,
+          })
+        : await modelService.addProviderModel({
+            provider: form.provider,
+            type: modelType,
+            apiKey: form.apiKey.trim() === "" ? "sk-no-api-key" : form.apiKey,
+          });
+
+      // Use centralized error processing
+      const { models, error } = processProviderResponse(
+        result,
+        form.provider,
+        t
+      );
+
+      if (error) {
+        message.error(error);
+        setModelList([]);
+        setSelectedModelIds(new Set());
+        setLoadingModelList(false);
+        return;
+      }
+
+      // Ensure each model has a default max_tokens value
+      const modelsWithDefaults = models.map((model: any) => ({
+        ...model,
+        max_tokens: model.max_tokens || parseInt(form.maxTokens) || 4096,
+      }));
+      setModelList(modelsWithDefaults);
+
+      const selectedModels = (await getProviderSelectedModalList()) || [];
+
+      // Key logic: Sync previously selected models
+      if (!selectedModels.length) {
+        // Select none
+        setSelectedModelIds(new Set());
+      } else {
+        // Only select selectedModels
+        setSelectedModelIds(new Set(selectedModels.map((m: any) => m.id)));
+      }
+    } catch (error) {
+      message.error(t("model.dialog.error.addFailed", { error }));
+      log.error(t("model.dialog.error.addFailedLog"), error);
+    } finally {
+      setLoadingModelList(false);
+    }
+  };
+
+  const getProviderSelectedModalList = async () => {
+    const modelType =
+      form.type === "embedding" && form.isMultimodal
+        ? ("multi_embedding" as ModelType)
+        : form.type;
+
+    // Use manage interface if tenantId is provided (for super admin)
+    const result = tenantId
+      ? await modelService.getManageProviderSelectedModalList({
+          tenantId,
+          provider: form.provider,
+          type: modelType,
+        })
+      : await modelService.getProviderSelectedModalList({
+          provider: form.provider,
+          type: modelType,
+          api_key: form.apiKey.trim() === "" ? "sk-no-api-key" : form.apiKey,
+        });
+
+    return result;
+  };
+
+  // Auto-fetch model list when batch import is enabled and API key is provided
+  useEffect(() => {
+    if (form.isBatchImport && form.apiKey.trim() !== "") {
+      getModelList();
+    }
+    // eslint-disable-next-line react-hooks/exhaustive-deps
+  }, [form.type, form.isBatchImport]);
+
+  return {
+    getModelList,
+    getProviderSelectedModalList,
+  };
+};
diff --git a/frontend/hooks/useConfig.ts b/frontend/hooks/useConfig.ts
index 0032c80c1..70aee0df2 100644
--- a/frontend/hooks/useConfig.ts
+++ b/frontend/hooks/useConfig.ts
@@ -26,6 +26,7 @@ const defaultConfig: GlobalConfig = {
     appName: "",
     appDescription: "",
     iconType: ICON_TYPES.PRESET,
+    iconKey: "search",
     customIconUrl: "",
     avatarUri: "",
     modelEngineEnabled: false,
@@ -112,12 +113,16 @@ function transformModelEntry(
  * Transform backend config format to frontend format
  */
 function transformBackendToFrontend(backendConfig: any): GlobalConfig {
+  // Get iconKey from backend - if not available, use default "search"
+  const iconKey = backendConfig.app?.icon?.iconKey || "search";
+
   const app: AppConfig = backendConfig.app
     ? {
         appName: backendConfig.app.name || "",
         appDescription: backendConfig.app.description || "",
         iconType:
           (backendConfig.app.icon?.type as "preset" | "custom") || "preset",
+        iconKey: iconKey,
         customIconUrl: backendConfig.app.icon?.customUrl || null,
         avatarUri: backendConfig.app.icon?.avatarUri || null,
         modelEngineEnabled: backendConfig.app.modelEngineEnabled ?? false,
@@ -258,6 +263,15 @@ export function useConfig() {
 
   const config: GlobalConfig = (query.data as GlobalConfig | undefined) ?? defaultConfig;
 
+  // Whether config has selected a VLM model
+  const isVlmAvailable = !!(config?.models?.vlm?.modelName || config?.models?.vlm?.displayName);
+
+  // Whether config has selected an Embedding model
+  const isEmbeddingAvailable = !!(config?.models?.embedding?.modelName || config?.models?.embedding?.displayName);
+
+  // Default LLM model name from config (modelName or displayName)
+  const defaultLlmModelName = config?.models?.llm?.modelName || config?.models?.llm?.displayName || "";
+
   const updateAppConfig = useCallback(
     (partial: Partial<AppConfig>) => {
       if (!config) return;
@@ -332,6 +346,9 @@ export function useConfig() {
     config,
     appConfig: config?.app,
     modelConfig: config?.models,
+    isVlmAvailable,
+    isEmbeddingAvailable,
+    defaultLlmModelName,
     updateAppConfig,
     updateModelConfig,
     updateConfig,
diff --git a/frontend/hooks/useKnowledgeBaseConfigChangeHandler.ts b/frontend/hooks/useKnowledgeBaseConfigChangeHandler.ts
index 286ea1567..dcb98e6d4 100644
--- a/frontend/hooks/useKnowledgeBaseConfigChangeHandler.ts
+++ b/frontend/hooks/useKnowledgeBaseConfigChangeHandler.ts
@@ -8,7 +8,8 @@ import { useRef, useEffect, useCallback } from "react";
 export type ToolKbType =
   | "knowledge_base_search"
   | "dify_search"
-  | "datamate_search";
+  | "datamate_search"
+  | "idata_search";
 
 /**
  * Configuration for Dify tool
@@ -25,12 +26,21 @@ export interface DatamateConfig {
   serverUrl: string;
 }
 
+/**
+ * Configuration for iData tool
+ */
+export interface IdataConfig {
+  serverUrl: string;
+  apiKey: string;
+  userId: string;
+}
+
 /**
  * Options for useKnowledgeBaseConfigChangeHandler hook
  */
 export interface UseKnowledgeBaseConfigChangeHandlerOptions {
   toolKbType: ToolKbType | null;
-  config: DifyConfig | DatamateConfig | undefined;
+  config: DifyConfig | DatamateConfig | IdataConfig | undefined;
   onConfigChange: () => void;
 }
 
@@ -53,6 +63,13 @@ export function useKnowledgeBaseConfigChangeHandler({
   // Track previous DataMate URL to detect changes
   const prevDatamateServerUrl = useRef<string>("");
 
+  // Track previous iData config to detect changes
+  const prevIdataConfig = useRef<IdataConfig>({
+    serverUrl: "",
+    apiKey: "",
+    userId: "",
+  });
+
   // Track if initial load is complete to avoid duplicate API calls
   const isInitialLoadComplete = useRef(false);
 
@@ -116,10 +133,47 @@ export function useKnowledgeBaseConfigChangeHandler({
     }
   }, [toolKbType, config, onConfigChange]);
 
+  // Handle iData config change
+  useEffect(() => {
+    if (toolKbType !== "idata_search" || !config) {
+      return;
+    }
+
+    const idataConfig = config as IdataConfig;
+
+    // Skip initial load - only handle actual config changes
+    if (
+      !prevIdataConfig.current.serverUrl &&
+      !prevIdataConfig.current.apiKey &&
+      !prevIdataConfig.current.userId
+    ) {
+      prevIdataConfig.current = { ...idataConfig };
+      return;
+    }
+
+    const hasUrlChanged =
+      idataConfig.serverUrl !== prevIdataConfig.current.serverUrl;
+    const hasApiKeyChanged =
+      idataConfig.apiKey !== prevIdataConfig.current.apiKey;
+    const hasUserIdChanged =
+      idataConfig.userId !== prevIdataConfig.current.userId;
+
+    // If URL, API key, or user ID has changed, trigger callback
+    if (hasUrlChanged || hasApiKeyChanged || hasUserIdChanged) {
+      // Clear knowledge base list when config is cleared
+      onConfigChange();
+
+      // Update previous config
+      prevIdataConfig.current = { ...idataConfig };
+      isInitialLoadComplete.current = true;
+    }
+  }, [toolKbType, config, onConfigChange]);
+
   // Reset handler - useful when modal closes to reset the tracking state
   const resetTracker = useCallback(() => {
     prevDifyConfig.current = { serverUrl: "", apiKey: "" };
     prevDatamateServerUrl.current = "";
+    prevIdataConfig.current = { serverUrl: "", apiKey: "", userId: "" };
     isInitialLoadComplete.current = false;
   }, []);
 
diff --git a/frontend/hooks/useKnowledgeBaseSelector.ts b/frontend/hooks/useKnowledgeBaseSelector.ts
index 7b768a72a..25d750358 100644
--- a/frontend/hooks/useKnowledgeBaseSelector.ts
+++ b/frontend/hooks/useKnowledgeBaseSelector.ts
@@ -30,10 +30,13 @@ export function useKnowledgeBasesForToolConfig(
     | "knowledge_base_search"
     | "dify_search"
     | "datamate_search"
+    | "idata_search"
     | null = null,
   config?: {
     serverUrl?: string;
     apiKey?: string;
+    userId?: string;
+    knowledgeSpaceId?: string;
   }
 ) {
   const { t } = useTranslation();
@@ -42,6 +45,7 @@ export function useKnowledgeBasesForToolConfig(
   // Support both difyConfig and datamateConfig naming conventions
   const difyConfig = config;
   const datamateConfig = config;
+  const idataConfig = config;
 
   const query = useQuery({
     queryKey: knowledgeBaseKeys.list(
@@ -104,6 +108,31 @@ export function useKnowledgeBasesForToolConfig(
           // No Dify config provided, return empty
           kbs = [];
         }
+      } else if (toolType === "idata_search") {
+        // For iData, fetch knowledge bases using provided config
+        if (
+          idataConfig?.serverUrl &&
+          idataConfig?.apiKey &&
+          idataConfig?.userId &&
+          idataConfig?.knowledgeSpaceId
+        ) {
+          try {
+            kbs = await knowledgeBaseService.getIdataKnowledgeBases(
+              idataConfig.serverUrl,
+              idataConfig.apiKey,
+              idataConfig.userId,
+              idataConfig.knowledgeSpaceId
+            );
+          } catch (error: any) {
+            log.error("Failed to fetch iData knowledge bases:", error);
+            // Show i18n error message to user
+            showErrorToUser(error, t);
+            kbs = [];
+          }
+        } else {
+          // No iData config provided, return empty
+          kbs = [];
+        }
       } else {
         // Default: knowledge_base_search or unknown - only get Nexent knowledge bases
         const result = await knowledgeBaseService.getKnowledgeBasesInfo(false, false);
@@ -150,10 +179,13 @@ export function usePrefetchKnowledgeBases() {
         | "knowledge_base_search"
         | "dify_search"
         | "datamate_search"
+        | "idata_search"
         | null,
       difyConfig?: {
         serverUrl?: string;
         apiKey?: string;
+        userId?: string;
+        knowledgeSpaceId?: string;
       }
     ) => {
       if (!toolType) return;
@@ -215,6 +247,29 @@ export function usePrefetchKnowledgeBases() {
             } else {
               kbs = [];
             }
+          } else if (toolType === "idata_search") {
+            if (
+              difyConfig?.serverUrl &&
+              difyConfig?.apiKey &&
+              difyConfig?.userId &&
+              difyConfig?.knowledgeSpaceId
+            ) {
+              try {
+                kbs = await knowledgeBaseService.getIdataKnowledgeBases(
+                  difyConfig.serverUrl,
+                  difyConfig.apiKey,
+                  difyConfig.userId,
+                  difyConfig.knowledgeSpaceId
+                );
+              } catch (error: any) {
+                log.error("Failed to prefetch iData knowledge bases:", error);
+                // Show i18n error message to user
+                showErrorToUser(error, t);
+                kbs = [];
+              }
+            } else {
+              kbs = [];
+            }
           } else {
             const result = await knowledgeBaseService.getKnowledgeBasesInfo(false, false);
             kbs = result.knowledgeBases;
@@ -248,6 +303,8 @@ export function useSyncKnowledgeBases() {
       config?: {
         serverUrl?: string;
         apiKey?: string;
+        userId?: string;
+        knowledgeSpaceId?: string;
       }
     ): Promise<void> => {
       setIsSyncing(toolType);
@@ -272,6 +329,22 @@ export function useSyncKnowledgeBases() {
               );
             }
             break;
+          case "idata_search":
+            // iData sync requires API credentials and knowledge space ID
+            if (
+              config?.serverUrl &&
+              config?.apiKey &&
+              config?.userId &&
+              config?.knowledgeSpaceId
+            ) {
+              await knowledgeBaseService.getIdataKnowledgeBases(
+                config.serverUrl,
+                config.apiKey,
+                config.userId,
+                config.knowledgeSpaceId
+              );
+            }
+            break;
           default:
             // Default sync behavior - sync Nexent only
             await knowledgeBaseService.getKnowledgeBasesInfo(false, false);
diff --git a/frontend/hooks/useMcpConfig.ts b/frontend/hooks/useMcpConfig.ts
index 8478e931a..386a777bf 100644
--- a/frontend/hooks/useMcpConfig.ts
+++ b/frontend/hooks/useMcpConfig.ts
@@ -255,7 +255,11 @@ export function useMcpConfig(options: UseMcpConfigOptions = {}) {
         options.onContainerAdded?.();
         return { success: true, messageKey: "mcpService.message.addContainerSuccess" };
       } else {
-        return { success: false, message: result.message, messageKey: "mcpConfig.message.addContainerFailed" };
+        return { 
+          success: false, 
+          message: result.message, 
+          messageKey: (result as any).messageKey || "mcpConfig.message.addContainerFailed" 
+        };
       }
     } catch (error) {
       log.error("Failed to add container:", error);
diff --git a/frontend/lib/agentDebugErrorCache.ts b/frontend/lib/agentDebugErrorCache.ts
new file mode 100644
index 000000000..53ff62bb4
--- /dev/null
+++ b/frontend/lib/agentDebugErrorCache.ts
@@ -0,0 +1,117 @@
+/**
+ * Agent debug error cache utilities
+ * Persists debug errors in localStorage so users can see previous errors
+ * when re-entering debug mode for the same agent
+ */
+
+const DEBUG_ERROR_CACHE_KEY = "nexent_agent_debug_errors";
+
+export interface DebugErrorInfo {
+  agentId: number;
+  errorMessage: string;
+  timestamp: number;
+}
+
+/**
+ * Get cached debug errors for a specific agent
+ * @param agentId The agent ID to get cached errors for
+ * @returns The cached error message or null if no cached error
+ */
+export function getCachedDebugError(agentId: number): string | null {
+  if (typeof window === "undefined") {
+    return null;
+  }
+
+  try {
+    const cachedData = localStorage.getItem(DEBUG_ERROR_CACHE_KEY);
+    if (!cachedData) {
+      return null;
+    }
+
+    const errors: DebugErrorInfo[] = JSON.parse(cachedData);
+    const agentError = errors.find((e) => e.agentId === agentId);
+
+    return agentError ? agentError.errorMessage : null;
+  } catch (error) {
+    console.warn("Failed to read cached debug error:", error);
+    return null;
+  }
+}
+
+/**
+ * Cache a debug error for a specific agent
+ * @param agentId The agent ID
+ * @param errorMessage The error message to cache
+ */
+export function cacheDebugError(agentId: number, errorMessage: string): void {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  try {
+    const cachedData = localStorage.getItem(DEBUG_ERROR_CACHE_KEY);
+    let errors: DebugErrorInfo[] = cachedData ? JSON.parse(cachedData) : [];
+
+    // Remove existing error for this agent if any
+    errors = errors.filter((e) => e.agentId !== agentId);
+
+    // Add new error
+    errors.push({
+      agentId,
+      errorMessage,
+      timestamp: Date.now(),
+    });
+
+    // Keep only the most recent 10 errors to avoid localStorage bloat
+    if (errors.length > 10) {
+      errors = errors.slice(-10);
+    }
+
+    localStorage.setItem(DEBUG_ERROR_CACHE_KEY, JSON.stringify(errors));
+  } catch (error) {
+    console.warn("Failed to cache debug error:", error);
+  }
+}
+
+/**
+ * Clear cached debug error for a specific agent
+ * @param agentId The agent ID to clear cached error for
+ */
+export function clearCachedDebugError(agentId: number): void {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  try {
+    const cachedData = localStorage.getItem(DEBUG_ERROR_CACHE_KEY);
+    if (!cachedData) {
+      return;
+    }
+
+    const errors: DebugErrorInfo[] = JSON.parse(cachedData);
+    const filteredErrors = errors.filter((e) => e.agentId !== agentId);
+
+    if (filteredErrors.length === 0) {
+      localStorage.removeItem(DEBUG_ERROR_CACHE_KEY);
+    } else {
+      localStorage.setItem(DEBUG_ERROR_CACHE_KEY, JSON.stringify(filteredErrors));
+    }
+  } catch (error) {
+    console.warn("Failed to clear cached debug error:", error);
+  }
+}
+
+/**
+ * Clear all cached debug errors
+ */
+export function clearAllCachedDebugErrors(): void {
+  if (typeof window === "undefined") {
+    return;
+  }
+
+  try {
+    localStorage.removeItem(DEBUG_ERROR_CACHE_KEY);
+  } catch (error) {
+    console.warn("Failed to clear all cached debug errors:", error);
+  }
+}
diff --git a/frontend/package.json b/frontend/package.json
index 6c436aa47..0ef597071 100644
--- a/frontend/package.json
+++ b/frontend/package.json
@@ -25,6 +25,7 @@
     "bootstrap-icons": "^1.11.3",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "cross-env": "^10.1.0",
     "cookie": "^1.1.1",
     "dayjs": "^1.11.19",
     "dicebear": "^9.2.2",
diff --git a/frontend/public/locales/en/common.json b/frontend/public/locales/en/common.json
index 775eae675..a0a49d494 100644
--- a/frontend/public/locales/en/common.json
+++ b/frontend/public/locales/en/common.json
@@ -108,6 +108,9 @@
   "chatLeftSidebar.settingsMenu.agentConfig": "Agent Configuration",
   "chatLeftSidebar.confirmDeletionTitle": "Delete Conversation",
   "chatLeftSidebar.confirmDeletionDescription": "Are you sure you want to delete this conversation? This action cannot be undone.",
+  "chatLeftSidebar.renameErrorEmpty": "Title cannot be empty",
+  "chatLeftSidebar.renameErrorTooLong": "Title cannot exceed {{max}} characters",
+  "chatLeftSidebar.renameErrorSubmitFailed": "Rename failed. Please try again later",
   "chatLeftSidebar.cancel": "Cancel",
   "chatLeftSidebar.collapseSidebar": "Collapse Sidebar",
   "chatLeftSidebar.running": "Running",
@@ -439,6 +442,10 @@
   "toolPool.vlmDisabledTooltip": "Please contact your administrator to configure an available Vision Language Model",
   "toolPool.embeddingDisabledTooltip": "Please contact your administrator to configure an available Embedding model",
   "toolPool.tooltip.functionGuide": "1. For local knowledge base search functionality, please enable the knowledge_base_search tool;\n2. For text file parsing functionality, please enable the analyze_text_file tool;\n3. For image parsing functionality, please enable the analyze_image tool.",
+  "toolPool.duplicateToolName.title": "Duplicate Tool Name Detected",
+  "toolPool.duplicateToolName.content": "You have selected tools with the same name ({{toolName}}). Duplicate tool names will cause the agent to fail during runtime. Do you want to continue selecting this tool?",
+  "toolPool.duplicateToolName.confirm": "Continue",
+  "toolPool.duplicateToolName.cancel": "Cancel",
 
   "tool.message.unavailable": "This tool is currently unavailable and cannot be selected",
   "tool.error.noMainAgentId": "Main Agent ID is not set, cannot update tool status",
@@ -541,7 +548,7 @@
   "knowledgeBase.summary.notGenerated": "Knowledge base summary was not generated, please change model configuration and retry",
   "knowledgeBase.name.new": "new_base",
   "knowledgeBase.message.getDocumentsFailed": "Failed to get documents",
-  "knowledgeBase.create.permission.groupPlaceholder": "User groups of this knowledge base",
+  "knowledgeBase.create.permission.groupPlaceholder": "No user group",
   "knowledgeBase.ingroup.permission.EDIT": "In Group Read/Write",
   "knowledgeBase.ingroup.permission.READ_ONLY": "In Group Read Only",
   "knowledgeBase.ingroup.permission.PRIVATE": "Personal Private",
@@ -674,6 +681,8 @@
   "model.dialog.hint.batchImportEnabled": "Batch add enabled. Multiple models will be added at once.",
   "model.dialog.hint.batchImportDisabled": "Batch add disabled. Only a single model will be added.",
   "model.provider.silicon": "SiliconFlow",
+  "model.provider.dashscope": "DashScope",
+  "model.provider.tokenpony": "TokenPony",
   "model.provider.modelengine": "ModelEngine",
   "model.dialog.modelList.title": "Show Models",
   "model.dialog.modelList.searchPlaceholder": "Search models by name",
@@ -746,12 +755,16 @@
   "model.source.modelEngine": "ModelEngine",
   "model.source.openai": "OpenAI",
   "model.source.silicon": "Silicon Flow",
+  "model.source.dashscope": "DashScope",
+  "model.source.tokenpony": "TokenPony",
   "model.source.unknown": "Unknown Source",
   "model.warning.updateNotFound": "Model not found for update: {{displayName}}, type: {{type}}",
   "model.type.main": "LLM Model",
   "model.select.placeholder": "Select Model",
   "model.group.modelEngine": "ModelEngine Models",
   "model.group.silicon": "Silicon Flow Models",
+  "model.group.dashscope": "DashScope Models",
+  "model.group.tokenpony": "TokenPony Models",
   "model.group.custom": "Custom Models",
   "model.status.tooltip": "Click to verify connectivity",
   "model.dialog.embeddingConfig.title": "Edit Embedding Model: {{modelName}}",
@@ -1082,6 +1095,7 @@
   "mcpService.message.invalidUploadParameters": "Invalid upload parameters",
   "mcpService.message.serviceNameAlreadyExists": "MCP service name already exists",
   "mcpService.message.fileTooLarge": "File size exceeds limit",
+  "mcpService.message.missingMcpImage": "Failed to add container: MCP service startup image is missing",
 
   "agentConfig.tools.refreshSuccess": "Tool list refreshed successfully",
   "agentConfig.tools.refreshFailed": "Failed to refresh tool list",
@@ -1718,6 +1732,19 @@
   "profile.deleteWarning2": "All your conversations and data will be removed",
   "profile.deleteWarning3": "This action cannot be reversed",
   "profile.adminRestrictionTitle": "Administrator Restriction",
+  "profile.generateAkSk": "Generate API Key",
+  "profile.generateAkSkDesc": "Create or regenerate your API key",
+  "profile.generateAkSkConfirmTitle": "Generate New API Key",
+  "profile.generateAkSkConfirmContent": "You already have an API key. Generating a new one will overwrite the existing key.",
+  "profile.generateAkSkSuccess": "API key generated successfully",
+  "profile.generateAkSkFailed": "Failed to generate API key",
+  "profile.accessKey": "API Key",
+  "profile.copyAkSuccess": "API key copied to clipboard",
+  "profile.copyAkFailed": "Failed to copy API key",
+  "profile.deleteAkSkConfirmTitle": "Delete API Key",
+  "profile.deleteAkSkConfirmContent": "Are you sure you want to delete the API key?",
+  "profile.deleteAkSkSuccess": "API key deleted successfully",
+  "profile.deleteAkSkFailed": "Failed to delete API key",
 
   "agent.version.manage": "Version Management",
   "agent.version.currentVersion": "Current Version",
@@ -1853,67 +1880,73 @@
   "errorCode.130206": "Failed to parse Dify response. Please check API URL.",
   "errorCode.130301": "Failed to connect to ME service.",
 
-  "errorCode.101": "Validation failed.",
-  "errorCode.102": "Invalid parameter.",
-  "errorCode.103": "Required field is missing.",
-
-  "errorCode.201": "You are not authorized to perform this action.",
-  "errorCode.202": "Access forbidden.",
-  "errorCode.203": "Your session has expired. Please login again.",
-  "errorCode.204": "Invalid token. Please login again.",
-
-  "errorCode.301": "External service error.",
-  "errorCode.302": "Too many requests. Please try again later.",
-
-  "errorCode.401": "File not found.",
-  "errorCode.402": "Failed to upload file.",
-  "errorCode.403": "File size exceeds limit.",
-  "errorCode.404": "File type not allowed.",
-  "errorCode.405": "File preprocessing failed.",
-
-  "errorCode.501": "Resource not found.",
-  "errorCode.502": "Resource already exists.",
-  "errorCode.503": "Resource is disabled.",
-
-  "errorCode.10101": "Conversation not found.",
-  "errorCode.10102": "Message not found.",
-  "errorCode.10103": "Failed to save conversation.",
-  "errorCode.10104": "Failed to generate conversation title.",
-
-  "errorCode.20101": "Invalid configuration.",
-  "errorCode.20102": "Sync configuration failed.",
-
-  "errorCode.30101": "Agent not found.",
-  "errorCode.30102": "Agent is disabled.",
-  "errorCode.30103": "Failed to run agent. Please try again later.",
-  "errorCode.30104": "Agent name already exists.",
-  "errorCode.30105": "Agent version not found.",
-
-  "errorCode.40101": "Agent not found in market.",
-
-  "errorCode.50101": "Invalid agent configuration.",
-  "errorCode.50102": "Invalid prompt.",
-
-  "errorCode.60101": "Knowledge base not found.",
-  "errorCode.60102": "Failed to upload knowledge.",
-  "errorCode.60103": "Failed to sync knowledge base.",
-  "errorCode.60104": "Search index not found.",
-  "errorCode.60105": "Knowledge search failed.",
-
-  "errorCode.70101": "Tool not found.",
-  "errorCode.70102": "Tool execution failed.",
-  "errorCode.70103": "Tool configuration is invalid.",
-  "errorCode.70201": "Failed to connect to MCP service.",
-  "errorCode.70202": "MCP container operation failed.",
-  "errorCode.70301": "MCP name contains invalid characters.",
-
-  "errorCode.80101": "Metric query failed.",
-  "errorCode.80201": "Invalid alert configuration.",
-
-  "errorCode.90101": "Model not found.",
-  "errorCode.90102": "Model configuration is invalid.",
-  "errorCode.90103": "Model health check failed.",
-  "errorCode.90104": "Model provider error.",
+  "errorCode.000101": "Validation failed.",
+  "errorCode.000102": "Invalid parameter.",
+  "errorCode.000103": "Required field is missing.",
+
+  "errorCode.000201": "You are not authorized to perform this action.",
+  "errorCode.000202": "Access forbidden.",
+  "errorCode.000203": "Your session has expired. Please login again.",
+  "errorCode.000204": "Invalid token. Please login again.",
+
+  "errorCode.000301": "External service error.",
+  "errorCode.000302": "Too many requests. Please try again later.",
+
+  "errorCode.000401": "File not found.",
+  "errorCode.000402": "Failed to upload file.",
+  "errorCode.000403": "File size exceeds limit.",
+  "errorCode.000404": "File type not allowed.",
+  "errorCode.000405": "File preprocessing failed.",
+
+  "errorCode.000501": "Resource not found.",
+  "errorCode.000502": "Resource already exists.",
+  "errorCode.000503": "Resource is disabled.",
+
+  "errorCode.010101": "Conversation not found.",
+  "errorCode.010102": "Message not found.",
+  "errorCode.010103": "Failed to save conversation.",
+  "errorCode.010104": "Failed to generate conversation title.",
+
+  "errorCode.020101": "Invalid configuration.",
+  "errorCode.020102": "Sync configuration failed.",
+
+  "errorCode.030101": "Agent not found.",
+  "errorCode.030102": "Agent is disabled.",
+  "errorCode.030103": "Failed to run agent. Please try again later.",
+  "errorCode.030104": "Agent name already exists.",
+  "errorCode.030105": "Agent version not found.",
+
+  "errorCode.040101": "Agent not found in market.",
+
+  "errorCode.050101": "Invalid agent configuration.",
+  "errorCode.050102": "Invalid prompt.",
+
+  "errorCode.060101": "Knowledge base not found.",
+  "errorCode.060102": "Failed to upload knowledge.",
+  "errorCode.060103": "Failed to sync knowledge base.",
+  "errorCode.060104": "Search index not found.",
+  "errorCode.060105": "Knowledge search failed.",
+
+  "errorCode.070101": "Tool not found.",
+  "errorCode.070102": "Tool execution failed.",
+  "errorCode.070103": "Tool configuration is invalid.",
+  "errorCode.070201": "Failed to connect to MCP service.",
+  "errorCode.070202": "MCP container operation failed.",
+  "errorCode.070301": "MCP name contains invalid characters.",
+
+  "errorCode.080101": "Metric query failed.",
+  "errorCode.080201": "Invalid alert configuration.",
+
+  "errorCode.090101": "Model not found.",
+  "errorCode.090102": "Model configuration is invalid.",
+  "errorCode.090103": "Model health check failed.",
+  "errorCode.090104": "Model provider error.",
+  "errorCode.090105": "Model is unavailable. Please check the model status and try again.",
+  "errorCode.090201": "Model API key is invalid or expired. Please check your API key configuration.",
+  "errorCode.090202": "Model API key does not have permission. Please check your API key permissions.",
+  "errorCode.090203": "Rate limit exceeded. Please try again later.",
+  "errorCode.090204": "Model service is temporarily unavailable. Please try again later.",
+  "errorCode.090205": "Failed to connect to model service. Please check your network and model configuration.",
 
   "errorCode.100101": "Memory not found.",
   "errorCode.100102": "Failed to prepare memory.",
diff --git a/frontend/public/locales/zh/common.json b/frontend/public/locales/zh/common.json
index 88ef18fdc..baa614b56 100644
--- a/frontend/public/locales/zh/common.json
+++ b/frontend/public/locales/zh/common.json
@@ -108,6 +108,9 @@
   "chatLeftSidebar.settingsMenu.agentConfig": "智能体配置",
   "chatLeftSidebar.confirmDeletionTitle": "删除对话",
   "chatLeftSidebar.confirmDeletionDescription": "确定要删除这个对话吗？此操作无法撤销。",
+  "chatLeftSidebar.renameErrorEmpty": "标题不能为空",
+  "chatLeftSidebar.renameErrorTooLong": "标题长度不能超过 {{max}} 个字符",
+  "chatLeftSidebar.renameErrorSubmitFailed": "重命名失败，请稍后重试",
   "chatLeftSidebar.cancel": "取消",
   "chatLeftSidebar.collapseSidebar": "收起侧边栏",
   "chatLeftSidebar.running": "正在运行中",
@@ -442,6 +445,10 @@
   "toolPool.vlmDisabledTooltip": "请联系管理员配置可用的视觉语言模型",
   "toolPool.embeddingDisabledTooltip": "请联系管理员配置可用的向量模型",
   "toolPool.tooltip.functionGuide": "1. 本地知识库检索功能，请启用knowledge_base_search工具；\n2. 文本文件解析功能，请启用analyze_text_file工具；\n3. 图片解析功能，请启用analyze_image工具。",
+  "toolPool.duplicateToolName.title": "检测到重复工具名",
+  "toolPool.duplicateToolName.content": "您已勾选相同工具名的工具（{{toolName}}），重复选择会导致智能体无法正常运行。是否继续勾选？",
+  "toolPool.duplicateToolName.confirm": "继续",
+  "toolPool.duplicateToolName.cancel": "取消",
 
   "tool.message.unavailable": "该工具当前不可用，无法选择",
   "tool.error.noMainAgentId": "主代理ID未设置，无法更新工具状态",
@@ -543,7 +550,7 @@
   "knowledgeBase.summary.notGenerated": "未生成知识库总结，请更换模型配置重试",
   "knowledgeBase.name.new": "新知识库",
   "knowledgeBase.message.getDocumentsFailed": "获取文档列表失败",
-  "knowledgeBase.create.permission.groupPlaceholder": "该知识库所属用户组",
+  "knowledgeBase.create.permission.groupPlaceholder": "无所属用户组",
   "knowledgeBase.ingroup.permission.EDIT": "同组可编辑",
   "knowledgeBase.ingroup.permission.READ_ONLY": "同组只读",
   "knowledgeBase.ingroup.permission.PRIVATE": "私有",
@@ -676,6 +683,8 @@
   "model.dialog.hint.batchImportEnabled": "批量添加模式已启用，可通过API Key一次性导入多个模型",
   "model.dialog.hint.batchImportDisabled": "批量添加模式已关闭，仅添加单个模型",
   "model.provider.silicon": "硅基流动",
+  "model.provider.dashscope": "阿里灵积",
+  "model.provider.tokenpony": "小马算力",
   "model.provider.modelengine": "ModelEngine",
   "model.dialog.modelList.title": "显示模型",
   "model.dialog.modelList.searchPlaceholder": "按名称搜索模型",
@@ -748,11 +757,15 @@
   "model.source.unknown": "未知来源",
   "model.source.openai": "OpenAI",
   "model.source.silicon": "硅基流动",
+  "model.source.dashscope": "阿里灵积",
+  "model.source.tokenpony": "小马算力",
   "model.warning.updateNotFound": "未找到要更新的模型: {{displayName}}, 类型: {{type}}",
   "model.type.main": "大语言模型",
   "model.select.placeholder": "选择模型",
   "model.group.modelEngine": "ModelEngine模型",
   "model.group.silicon": "硅基流动模型",
+  "model.group.dashscope": "阿里灵积模型",
+  "model.group.tokenpony": "小马算力模型",
   "model.group.custom": "自定义模型",
   "model.status.tooltip": "点击可验证连通性",
   "model.dialog.success.updateSuccess": "更新成功",
@@ -1084,6 +1097,7 @@
   "mcpService.message.invalidUploadParameters": "上传参数无效",
   "mcpService.message.serviceNameAlreadyExists": "MCP服务名称已存在",
   "mcpService.message.fileTooLarge": "文件大小超过限制",
+  "mcpService.message.missingMcpImage": "添加容器失败：缺少mcp服务启动镜像",
 
   "agentConfig.tools.refreshSuccess": "工具列表已刷新",
   "agentConfig.tools.refreshFailed": "刷新工具列表失败",
@@ -1720,6 +1734,19 @@
   "profile.deleteWarning2": "所有对话和数据将被移除",
   "profile.deleteWarning3": "此操作无法恢复",
   "profile.adminRestrictionTitle": "管理员限制",
+  "profile.generateAkSk": "生成 API 密钥",
+  "profile.generateAkSkDesc": "生成您的 API 密钥",
+  "profile.generateAkSkConfirmTitle": "生成新的 API 密钥",
+  "profile.generateAkSkConfirmContent": "您已有 API 密钥，生成新的将覆盖现有的密钥。",
+  "profile.generateAkSkSuccess": "API 密钥生成成功",
+  "profile.generateAkSkFailed": "API 密钥生成失败",
+  "profile.accessKey": "API 密钥",
+  "profile.copyAkSuccess": "API 密钥已复制",
+  "profile.copyAkFailed": "复制 API 密钥失败",
+  "profile.deleteAkSkConfirmTitle": "删除 API 密钥",
+  "profile.deleteAkSkConfirmContent": "您确定要删除 API 密钥吗？",
+  "profile.deleteAkSkSuccess": "API 密钥删除成功",
+  "profile.deleteAkSkFailed": "删除 API 密钥失败",
 
   "agent.version.manage": "版本管理",
   "agent.version.currentVersion": "当前版本",
@@ -1870,67 +1897,73 @@
   "errorCode.130206": "Dify响应解析失败，请检查API URL",
   "errorCode.130301": "连接ME服务失败",
 
-  "errorCode.101": "验证失败",
-  "errorCode.102": "参数无效",
-  "errorCode.103": "缺少必填字段",
-
-  "errorCode.201": "您没有执行此操作的权限",
-  "errorCode.202": "禁止访问",
-  "errorCode.203": "您的登录已过期，请重新登录",
-  "errorCode.204": "登录令牌无效，请重新登录",
-
-  "errorCode.301": "外部服务错误",
-  "errorCode.302": "请求过于频繁，请稍后重试",
-
-  "errorCode.401": "文件不存在",
-  "errorCode.402": "文件上传失败",
-  "errorCode.403": "文件大小超出限制",
-  "errorCode.404": "不支持的文件类型",
-  "errorCode.405": "文件预处理失败",
-
-  "errorCode.501": "资源不存在",
-  "errorCode.502": "资源已存在",
-  "errorCode.503": "资源已被禁用",
-
-  "errorCode.10101": "对话不存在",
-  "errorCode.10102": "消息不存在",
-  "errorCode.10103": "保存对话失败",
-  "errorCode.10104": "生成对话标题失败",
-
-  "errorCode.20101": "配置无效",
-  "errorCode.20102": "同步配置失败",
-
-  "errorCode.30101": "智能体不存在",
-  "errorCode.30102": "智能体已被禁用",
-  "errorCode.30103": "运行智能体失败，请稍后重试",
-  "errorCode.30104": "智能体名称已存在",
-  "errorCode.30105": "智能体版本不存在",
-
-  "errorCode.40101": "市场中智能体不存在",
-
-  "errorCode.50101": "智能体配置无效",
-  "errorCode.50102": "提示词无效",
-
-  "errorCode.60101": "知识库不存在",
-  "errorCode.60102": "上传知识失败",
-  "errorCode.60103": "同步知识库失败",
-  "errorCode.60104": "搜索索引不存在",
-  "errorCode.60105": "知识搜索失败",
-
-  "errorCode.70101": "工具不存在",
-  "errorCode.70102": "工具执行失败",
-  "errorCode.70103": "工具配置无效",
-  "errorCode.70201": "连接MCP服务失败",
-  "errorCode.70202": "MCP容器操作失败",
-  "errorCode.70301": "MCP名称包含非法字符",
-
-  "errorCode.80101": "指标查询失败",
-  "errorCode.80201": "告警配置无效",
-
-  "errorCode.90101": "模型不存在",
-  "errorCode.90102": "模型配置无效",
-  "errorCode.90103": "模型健康检查失败",
-  "errorCode.90104": "模型提供商错误",
+  "errorCode.000101": "验证失败",
+  "errorCode.000102": "参数无效",
+  "errorCode.000103": "缺少必填字段",
+
+  "errorCode.000201": "您没有执行此操作的权限",
+  "errorCode.000202": "禁止访问",
+  "errorCode.000203": "您的登录已过期，请重新登录",
+  "errorCode.000204": "登录令牌无效，请重新登录",
+
+  "errorCode.000301": "外部服务错误",
+  "errorCode.000302": "请求过于频繁，请稍后重试",
+
+  "errorCode.000401": "文件不存在",
+  "errorCode.000402": "文件上传失败",
+  "errorCode.000403": "文件大小超出限制",
+  "errorCode.000404": "不支持的文件类型",
+  "errorCode.000405": "文件预处理失败",
+
+  "errorCode.000501": "资源不存在",
+  "errorCode.000502": "资源已存在",
+  "errorCode.000503": "资源已被禁用",
+
+  "errorCode.010101": "对话不存在",
+  "errorCode.010102": "消息不存在",
+  "errorCode.010103": "保存对话失败",
+  "errorCode.010104": "生成对话标题失败",
+
+  "errorCode.020101": "配置无效",
+  "errorCode.020102": "同步配置失败",
+
+  "errorCode.030101": "智能体不存在",
+  "errorCode.030102": "智能体已被禁用",
+  "errorCode.030103": "运行智能体失败，请稍后重试",
+  "errorCode.030104": "智能体名称已存在",
+  "errorCode.030105": "智能体版本不存在",
+
+  "errorCode.040101": "市场中智能体不存在",
+
+  "errorCode.050101": "智能体配置无效",
+  "errorCode.050102": "提示词无效",
+
+  "errorCode.060101": "知识库不存在",
+  "errorCode.060102": "上传知识失败",
+  "errorCode.060103": "同步知识库失败",
+  "errorCode.060104": "搜索索引不存在",
+  "errorCode.060105": "知识搜索失败",
+
+  "errorCode.070101": "工具不存在",
+  "errorCode.070102": "工具执行失败",
+  "errorCode.070103": "工具配置无效",
+  "errorCode.070201": "连接MCP服务失败",
+  "errorCode.070202": "MCP容器操作失败",
+  "errorCode.070301": "MCP名称包含非法字符",
+
+  "errorCode.080101": "指标查询失败",
+  "errorCode.080201": "告警配置无效",
+
+  "errorCode.090101": "模型不存在",
+  "errorCode.090102": "模型配置无效",
+  "errorCode.090103": "模型健康检查失败",
+  "errorCode.090104": "模型提供商错误",
+  "errorCode.090105": "模型不可用，请检查模型状态后重试",
+  "errorCode.090201": "模型 API 密钥无效或已过期，请检查 API 密钥配置",
+  "errorCode.090202": "模型 API 密钥没有权限，请检查 API 密钥权限",
+  "errorCode.090203": "请求频率超限，请稍后重试",
+  "errorCode.090204": "模型服务暂时不可用，请稍后重试",
+  "errorCode.090205": "连接模型服务失败，请检查网络和模型配置",
 
   "errorCode.100101": "记忆不存在",
   "errorCode.100102": "准备记忆失败",
diff --git a/frontend/public/tokenpony.png b/frontend/public/tokenpony.png
new file mode 100644
index 000000000..d582ae86b
Binary files /dev/null and b/frontend/public/tokenpony.png differ
diff --git a/frontend/server.js b/frontend/server.js
index 798b019fd..05f098402 100644
--- a/frontend/server.js
+++ b/frontend/server.js
@@ -47,7 +47,7 @@ const isProduction = process.env.NODE_ENV === "production";
 function buildCookieOptions(httpOnly) {
   return {
     httpOnly,
-    secure: isProduction,
+    secure: false, // cookie can be send through http
     sameSite: "lax",
     path: "/",
   };
diff --git a/frontend/services/api.ts b/frontend/services/api.ts
index 31174e830..0d20c2e4f 100644
--- a/frontend/services/api.ts
+++ b/frontend/services/api.ts
@@ -17,6 +17,8 @@ export const API_ENDPOINTS = {
     currentUserInfo: `${API_BASE_URL}/user/current_user_info`,
     serviceHealth: `${API_BASE_URL}/user/service_health`,
     revoke: `${API_BASE_URL}/user/revoke`,
+    tokens: `${API_BASE_URL}/user/tokens`,
+    deleteToken: (tokenId: number) => `${API_BASE_URL}/user/tokens/${tokenId}`,
   },
   conversation: {
     list: `${API_BASE_URL}/conversation/list`,
@@ -184,6 +186,10 @@ export const API_ENDPOINTS = {
   dify: {
     datasets: `${API_BASE_URL}/dify/datasets`,
   },
+  idata: {
+    knowledgeSpaces: `${API_BASE_URL}/idata/knowledge-space`,
+    datasets: `${API_BASE_URL}/idata/datasets`,
+  },
   datamate: {
     syncDatamateKnowledges: `${API_BASE_URL}/datamate/sync_datamate_knowledges`,
     testConnection: `${API_BASE_URL}/datamate/test_connection`,
diff --git a/frontend/services/authService.ts b/frontend/services/authService.ts
index 8d2bac942..fa5281989 100644
--- a/frontend/services/authService.ts
+++ b/frontend/services/authService.ts
@@ -173,6 +173,7 @@ export const authService = {
           email,
           password,
           invite_code: inviteCode || null,
+          auto_login: autoLogin,
         }),
       });
 
diff --git a/frontend/services/knowledgeBaseService.ts b/frontend/services/knowledgeBaseService.ts
index 07b436f0a..d381d1570 100644
--- a/frontend/services/knowledgeBaseService.ts
+++ b/frontend/services/knowledgeBaseService.ts
@@ -134,6 +134,144 @@ class KnowledgeBaseService {
     }
   }
 
+  // Get iData knowledge spaces
+  async getIdataKnowledgeSpaces(
+    idataApiBase: string,
+    apiKey: string,
+    userId: string
+  ): Promise<Array<{ id: string; name: string }>> {
+    try {
+      const url = new URL(API_ENDPOINTS.idata.knowledgeSpaces, window.location.origin);
+      url.searchParams.set("idata_api_base", idataApiBase);
+      url.searchParams.set("api_key", apiKey);
+      url.searchParams.set("user_id", userId);
+
+      const response = await fetch(url.toString(), {
+        method: "GET",
+        headers: getAuthHeaders(),
+      });
+
+      const result = await response.json();
+
+      // Check for error response from middleware (has code field)
+      if (result.code !== undefined && result.code !== 0) {
+        const errorCode = result.code || response.status;
+        const errorMessage = result.message || "Failed to fetch iData knowledge spaces";
+        log.error("iData API error:", { code: errorCode, message: errorMessage });
+        throw new ApiError(errorCode, errorMessage);
+      }
+
+      // Success: result is directly the array of knowledge spaces
+      return Array.isArray(result) ? result : [];
+    } catch (error) {
+      log.error("Failed to get iData knowledge spaces:", error);
+      throw error;
+    }
+  }
+
+  // Sync iData knowledge bases (datasets)
+  async syncIdataKnowledgeBases(
+    idataApiBase: string,
+    apiKey: string,
+    userId: string,
+    knowledgeSpaceId: string
+  ): Promise<{
+    indices: string[];
+    count: number;
+    indices_info: any[];
+  }> {
+    try {
+      const url = new URL(API_ENDPOINTS.idata.datasets, window.location.origin);
+      url.searchParams.set("idata_api_base", idataApiBase);
+      url.searchParams.set("api_key", apiKey);
+      url.searchParams.set("user_id", userId);
+      url.searchParams.set("knowledge_space_id", knowledgeSpaceId);
+
+      const response = await fetch(url.toString(), {
+        method: "GET",
+        headers: getAuthHeaders(),
+      });
+
+      const result = await response.json();
+
+      // Check for error response from middleware (has code field)
+      if (result.code !== undefined && result.code !== 0) {
+        const errorCode = result.code || response.status;
+        const errorMessage = result.message || "Failed to fetch iData datasets";
+        log.error("iData API error:", { code: errorCode, message: errorMessage });
+        throw new ApiError(errorCode, errorMessage);
+      }
+
+      // Success: result is directly the data (indices, count, indices_info)
+      return {
+        indices: result.indices || [],
+        count: result.count || 0,
+        indices_info: result.indices_info || [],
+      };
+    } catch (error) {
+      log.error("Failed to sync iData knowledge bases:", error);
+      throw error;
+    }
+  }
+
+  // Get iData knowledge bases as KnowledgeBase array
+  async getIdataKnowledgeBases(
+    idataApiBase: string,
+    apiKey: string,
+    userId: string,
+    knowledgeSpaceId: string
+  ): Promise<KnowledgeBase[]> {
+    try {
+      const syncResult = await this.syncIdataKnowledgeBases(
+        idataApiBase,
+        apiKey,
+        userId,
+        knowledgeSpaceId
+      );
+
+      if (!syncResult.indices_info || syncResult.indices_info.length === 0) {
+        return [];
+      }
+
+      // Transform to KnowledgeBase format
+      const idataKnowledgeBases: KnowledgeBase[] = syncResult.indices_info.map(
+        (indexInfo: any) => {
+          const stats = indexInfo.stats?.base_info || {};
+          return {
+            id: indexInfo.name,
+            name: indexInfo.display_name || indexInfo.name,
+            display_name: indexInfo.display_name || indexInfo.name,
+            description: "iData knowledge base",
+            documentCount: stats.doc_count || 0,
+            chunkCount: stats.chunk_count || 0,
+            createdAt: stats.creation_date || null,
+            updatedAt: stats.update_date || stats.creation_date || null,
+            embeddingModel: stats.embedding_model || "unknown",
+            knowledge_sources: "idata",
+            ingroup_permission: "",
+            group_ids: [],
+            store_size: stats.store_size || "",
+            process_source: stats.process_source || "iData",
+            avatar: "",
+            chunkNum: 0,
+            language: "",
+            nickname: "",
+            parserId: "",
+            permission: "",
+            tokenNum: 0,
+            source: "idata",
+            tenant_id: "",
+          };
+        }
+      );
+
+      return idataKnowledgeBases;
+    } catch (error) {
+      log.error("Failed to get iData knowledge bases:", error);
+      throw error;
+    }
+  }
+
   // Sync DataMate knowledge bases and create local records
   async syncDataMateAndCreateRecords(datamateUrl?: string): Promise<{
     indices: string[];
diff --git a/frontend/services/mcpService.ts b/frontend/services/mcpService.ts
index 1b656cd8d..20383809f 100644
--- a/frontend/services/mcpService.ts
+++ b/frontend/services/mcpService.ts
@@ -433,17 +433,30 @@ export const addMcpFromConfig = async (mcpConfig: { mcpServers: Record<string, {
       };
     } else {
       let errorMessage = data.detail || data.message || t('mcpService.message.addFromConfigFailed');
+      let messageKey: string | undefined;
 
       if (response.status === 400) {
-        errorMessage = data.detail || t('mcpService.message.invalidConfig');
+        const rawError = data.detail || data.message || '';
+        // Check if error is related to image not found
+        const errorLower = rawError.toLowerCase();
+        if (rawError && (errorLower.includes('image not found') || 
+            errorLower.includes('mcp service startup image is missing') ||
+            (errorLower.includes('not found') && errorLower.includes('image')))) {
+          messageKey = 'mcpService.message.missingMcpImage';
+          errorMessage = t('mcpService.message.missingMcpImage');
+        } else {
+          errorMessage = rawError || t('mcpService.message.invalidConfig');
+        }
       } else if (response.status === 503) {
+        messageKey = 'mcpService.message.dockerServiceUnavailable';
         errorMessage = t('mcpService.message.dockerServiceUnavailable');
       }
 
       return {
         success: false,
         data: null,
-        message: errorMessage
+        message: errorMessage,
+        messageKey: messageKey
       };
     }
   } catch (error) {
@@ -451,7 +464,8 @@ export const addMcpFromConfig = async (mcpConfig: { mcpServers: Record<string, {
     return {
       success: false,
       data: null,
-      message: t('mcpService.message.networkError')
+      message: t('mcpService.message.networkError'),
+      messageKey: 'mcpService.message.networkError'
     };
   }
 };
diff --git a/frontend/services/promptService.ts b/frontend/services/promptService.ts
index 8d066556f..3b6c49395 100644
--- a/frontend/services/promptService.ts
+++ b/frontend/services/promptService.ts
@@ -30,6 +30,7 @@ export const generatePromptStream = async (
     const reader = response.body.getReader();
     const decoder = new TextDecoder('utf-8');
     let buffer = '';
+    let hasError = false;
 
     while (true) {
       const { value, done } = await reader.read();
@@ -44,6 +45,10 @@ export const generatePromptStream = async (
             const json = JSON.parse(line.replace('data: ', ''));
             if (json.success) {
               onData(json.data);
+            } else if (json.success === false && json.error) {
+              // Handle error response from backend
+              hasError = true;
+              if (onError) onError(json.error);
             }
           } catch (e) {
             if (onError) onError(e);
@@ -51,7 +56,8 @@ export const generatePromptStream = async (
         }
       }
     }
-    if (onComplete) onComplete();
+    // Only call onComplete if no error occurred
+    if (!hasError && onComplete) onComplete();
   } catch (err) {
     if (onError) onError(err);
     if (onComplete) onComplete();
diff --git a/frontend/services/tokenService.ts b/frontend/services/tokenService.ts
new file mode 100644
index 000000000..c4ecf7594
--- /dev/null
+++ b/frontend/services/tokenService.ts
@@ -0,0 +1,69 @@
+import { API_ENDPOINTS, ApiError, fetchWithErrorHandling } from "./api";
+
+export interface UserToken {
+  token_id: number;
+  access_key: string;
+}
+
+interface TokenListResponse {
+  data: UserToken[];
+  message: string;
+}
+
+interface TokenCreateResponse {
+  data: UserToken;
+  message: string;
+}
+
+/**
+ * Fetch all API tokens for a given user
+ */
+export async function getUserTokens(userId: string | number): Promise<UserToken[]> {
+  try {
+    const response = await fetchWithErrorHandling(
+      `${API_ENDPOINTS.user.tokens}?user_id=${userId}`
+    );
+    const result: TokenListResponse = await response.json();
+    return result.data ?? [];
+  } catch (error) {
+    if (error instanceof ApiError) {
+      throw error;
+    }
+    throw new ApiError(500, "Failed to fetch user tokens");
+  }
+}
+
+/**
+ * Delete an API token by its ID
+ */
+export async function deleteUserToken(tokenId: number): Promise<void> {
+  try {
+    await fetchWithErrorHandling(API_ENDPOINTS.user.deleteToken(tokenId), {
+      method: "DELETE",
+    });
+  } catch (error) {
+    if (error instanceof ApiError) {
+      throw error;
+    }
+    throw new ApiError(500, "Failed to delete token");
+  }
+}
+
+/**
+ * Create a new API token for the current user.
+ * Replaces any existing tokens by deleting them first.
+ */
+export async function createUserToken(): Promise<UserToken> {
+  try {
+    const response = await fetchWithErrorHandling(API_ENDPOINTS.user.tokens, {
+      method: "POST",
+    });
+    const result: TokenCreateResponse = await response.json();
+    return result.data;
+  } catch (error) {
+    if (error instanceof ApiError) {
+      throw error;
+    }
+    throw new ApiError(500, "Failed to create token");
+  }
+}
diff --git a/frontend/stores/agentConfigStore.ts b/frontend/stores/agentConfigStore.ts
index 1cd323b76..2ea19d309 100644
--- a/frontend/stores/agentConfigStore.ts
+++ b/frontend/stores/agentConfigStore.ts
@@ -252,7 +252,39 @@ const isToolsDirty = (baselineAgent: EditableAgent | null, editedAgent: Editable
     // Compare each param's name and value
     for (const baseParam of baseParams) {
       const editParam = editParams.find(p => p.name === baseParam.name);
-      if (!editParam || baseParam.value !== editParam.value) {
+      if (!editParam) {
+        return true;
+      }
+      
+      // Deep comparison for array and object values
+      const baseValue = baseParam.value;
+      const editValue = editParam.value;
+      
+      // If both are arrays, compare their contents
+      if (Array.isArray(baseValue) && Array.isArray(editValue)) {
+        if (baseValue.length !== editValue.length) {
+          return true;
+        }
+        // Sort and compare array elements
+        const sortedBase = [...baseValue].sort();
+        const sortedEdit = [...editValue].sort();
+        if (JSON.stringify(sortedBase) !== JSON.stringify(sortedEdit)) {
+          return true;
+        }
+      } 
+      // If both are objects (but not arrays), compare their JSON representation
+      else if (
+        baseValue !== null && 
+        editValue !== null && 
+        typeof baseValue === 'object' && 
+        typeof editValue === 'object'
+      ) {
+        if (JSON.stringify(baseValue) !== JSON.stringify(editValue)) {
+          return true;
+        }
+      }
+      // For primitive values, use strict equality
+      else if (baseValue !== editValue) {
         return true;
       }
     }
@@ -321,9 +353,7 @@ export const useAgentConfigStore = create<AgentConfigStoreState>((set, get) => (
       const editedAgent = { ...state.editedAgent, sub_agent_id_list: nextIds };
       // If there are already unsaved changes, keep it true and skip recalculation.
       // Only when state is clean do we need to check whether sub-agent IDs changed.
-      const hasUnsavedChanges = state.hasUnsavedChanges
-        ? true
-        : isSubAgentIdsDirty(state.baselineAgent, editedAgent);
+      const hasUnsavedChanges = isSubAgentIdsDirty(state.baselineAgent, editedAgent);
       return {
         editedAgent,
         hasUnsavedChanges,
@@ -336,9 +366,7 @@ export const useAgentConfigStore = create<AgentConfigStoreState>((set, get) => (
       const editedAgent = { ...state.editedAgent, ...payload };
       // If there are already unsaved changes, keep it true and skip recalculation.
       // Only when state is clean do we need to check whether business info changed.
-      const hasUnsavedChanges = state.hasUnsavedChanges
-        ? true
-        : isBusinessInfoDirty(state.baselineAgent, editedAgent);
+      const hasUnsavedChanges = isBusinessInfoDirty(state.baselineAgent, editedAgent);
       return {
         editedAgent,
         hasUnsavedChanges,
@@ -351,9 +379,7 @@ export const useAgentConfigStore = create<AgentConfigStoreState>((set, get) => (
       const editedAgent = { ...state.editedAgent, ...payload };
       // If there are already unsaved changes, keep it true and skip recalculation.
       // Only when state is clean do we need to check whether profile info changed.
-      const hasUnsavedChanges = state.hasUnsavedChanges
-        ? true
-        : isProfileInfoDirty(state.baselineAgent, editedAgent);
+      const hasUnsavedChanges = isProfileInfoDirty(state.baselineAgent, editedAgent);
       return {
         editedAgent,
         hasUnsavedChanges,
diff --git a/frontend/types/chat.ts b/frontend/types/chat.ts
index 3e9835d0a..af5751295 100644
--- a/frontend/types/chat.ts
+++ b/frontend/types/chat.ts
@@ -262,27 +262,6 @@ export interface SettingsMenuItem {
   onClick: () => void;
 }
 
-// Chat sidebar props type
-export interface ChatSidebarProps {
-  conversationList: ConversationListItem[];
-  selectedConversationId: number | null;
-  openDropdownId: string | null;
-  streamingConversations: Set<number>;
-  completedConversations: Set<number>;
-  onNewConversation: () => void;
-  onDialogClick: (dialog: ConversationListItem) => void;
-  onRename: (dialogId: number, title: string) => void;
-  onDelete: (dialogId: number) => void;
-  onSettingsClick: () => void;
-  settingsMenuItems?: SettingsMenuItem[];
-  onDropdownOpenChange: (open: boolean, id: string | null) => void;
-  onToggleSidebar: () => void;
-  expanded: boolean;
-  userEmail: string | undefined;
-  userAvatarUrl: string | undefined;
-  userRole: string | undefined;
-}
-
 // Image item type for chat right panel
 export interface ImageItem {
   base64Data: string;
diff --git a/frontend/types/modelConfig.ts b/frontend/types/modelConfig.ts
index 04d6a5ff3..829f3f183 100644
--- a/frontend/types/modelConfig.ts
+++ b/frontend/types/modelConfig.ts
@@ -17,6 +17,8 @@ export type ModelSource =
   | "openai"
   | "custom"
   | "silicon"
+  | "dashscope"
+  | "tokenpony"
   | "OpenAI-API-Compatible"
   | "modelengine";
 
@@ -51,6 +53,7 @@ export interface AppConfig {
   appName: string;
   appDescription: string;
   iconType: "preset" | "custom";
+  iconKey: string; // Selected preset icon key
   customIconUrl: string | null;
   avatarUri: string | null;
   modelEngineEnabled: boolean;
diff --git a/make/data_process/Dockerfile b/make/data_process/Dockerfile
index 35d7a6c48..7903cfd92 100644
--- a/make/data_process/Dockerfile
+++ b/make/data_process/Dockerfile
@@ -24,6 +24,9 @@ RUN apt-get update && \
         libreoffice \
         libgl1 \
         coreutils \
+        fontconfig \
+        fonts-noto-cjk \
+    && fc-cache -fv \
     && apt-get autoremove -y \
     && apt-get clean \
     && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
diff --git a/sdk/nexent/core/agents/nexent_agent.py b/sdk/nexent/core/agents/nexent_agent.py
index 4f2c38d07..5ee09fdc0 100644
--- a/sdk/nexent/core/agents/nexent_agent.py
+++ b/sdk/nexent/core/agents/nexent_agent.py
@@ -8,7 +8,7 @@
 
 from ..models.openai_llm import OpenAIModel
 from ..tools import *  # Used for tool creation, do not delete!!!
-from ..utils.constants import THINK_TAG_PATTERN
+from ..utils.constants import THINK_TAG_PATTERN, THINK_PREFIX_PATTERN
 from ..utils.observer import MessageObserver, ProcessType
 from .agent_model import AgentConfig, AgentHistory, ModelConfig, ToolConfig
 from .core_agent import CoreAgent, convert_code_format
@@ -225,8 +225,13 @@ def agent_run_with_observer(self, query: str, reset=True):
             else:
                 # prepare for multi-modal final_answer
                 final_answer_str = convert_code_format(str(final_answer))
-            final_answer_str = re.sub(THINK_TAG_PATTERN, "", final_answer_str, flags=re.DOTALL | re.IGNORECASE)
-            observer.add_message(self.agent.agent_name, ProcessType.FINAL_ANSWER, final_answer_str)
+            final_answer_str = re.sub(
+                THINK_TAG_PATTERN, "", final_answer_str, flags=re.DOTALL | re.IGNORECASE)
+            # Remove "思考：" or "思考:" prefix content (until two newlines)
+            final_answer_str = re.sub(
+                THINK_PREFIX_PATTERN, "", final_answer_str, flags=re.DOTALL)
+            observer.add_message(self.agent.agent_name,
+                                 ProcessType.FINAL_ANSWER, final_answer_str)
 
             # Check if we need to stop from external stop_event
             if self.agent.stop_event.is_set():
diff --git a/sdk/nexent/core/tools/__init__.py b/sdk/nexent/core/tools/__init__.py
index cdd61af14..5bbdfe7ed 100644
--- a/sdk/nexent/core/tools/__init__.py
+++ b/sdk/nexent/core/tools/__init__.py
@@ -3,6 +3,7 @@
 from .knowledge_base_search_tool import KnowledgeBaseSearchTool
 from .dify_search_tool import DifySearchTool
 from .datamate_search_tool import DataMateSearchTool
+from .idata_search_tool import IdataSearchTool
 from .send_email_tool import SendEmailTool
 from .tavily_search_tool import TavilySearchTool
 from .linkup_search_tool import LinkupSearchTool
@@ -22,6 +23,7 @@
     "KnowledgeBaseSearchTool",
     "DifySearchTool",
     "DataMateSearchTool",
+    "IdataSearchTool",
     "SendEmailTool",
     "GetEmailTool",
     "TavilySearchTool",
diff --git a/sdk/nexent/core/tools/idata_search_tool.py b/sdk/nexent/core/tools/idata_search_tool.py
new file mode 100644
index 000000000..920b8c129
--- /dev/null
+++ b/sdk/nexent/core/tools/idata_search_tool.py
@@ -0,0 +1,355 @@
+import json
+import logging
+from typing import Dict, List, Optional, Any
+import httpx
+from urllib.parse import urlencode
+
+from pydantic import Field
+from smolagents.tools import Tool
+
+from ..utils.observer import MessageObserver, ProcessType
+from ..utils.tools_common_message import SearchResultTextMessage, ToolCategory, ToolSign
+from ...utils.http_client_manager import http_client_manager
+
+
+# Get logger instance
+logger = logging.getLogger("idata_search_tool")
+
+
+class IdataSearchTool(Tool):
+    """iData knowledge base search tool"""
+
+    name = "idata_search"
+    description = (
+        "Performs a search on an iData knowledge base based on your query then returns the top search results. "
+        "A tool for retrieving domain-specific knowledge, documents, and information stored in iData knowledge bases. "
+        "Use this tool when users ask questions related to specialized knowledge, technical documentation, "
+        "domain expertise, or any information that has been indexed in iData knowledge bases. "
+        "Suitable for queries requiring access to stored knowledge that may not be publicly available."
+    )
+    inputs = {
+        "question": {"type": "string", "description": "The search query to perform."},
+    }
+    output_type = "string"
+    category = ToolCategory.SEARCH.value
+    tool_sign = ToolSign.IDATA_SEARCH.value
+
+    def __init__(
+        self,
+        server_url: str = Field(description="iData API base URL"),
+        api_key: str = Field(description="iData API key with Bearer token"),
+        user_id: str = Field(description="iData user ID"),
+        knowledge_space_id: str = Field(
+            description="iData knowledge space ID"),
+        dataset_ids: str = Field(
+            description="JSON string array of iData knowledge base IDs"),
+        rerank_model_id: str = Field(description="Rerank model ID"),
+        top_k: int = Field(
+            description="Maximum number of search results", default=10),
+        similarity_threshold: float = Field(
+            description="Rerank similarity threshold score", default=-10.0),
+        keyword_similarity_weight: float = Field(
+            description="Keyword similarity weight", default=0.10),
+        vector_similarity_weight: float = Field(
+            description="Vector similarity weight", default=0.3),
+        observer: MessageObserver = Field(
+            description="Message observer", default=None, exclude=True),
+    ):
+        """Initialize the IdataSearchTool.
+
+        Args:
+            server_url (str): iData API base URL
+            api_key (str): iData API key with Bearer token
+            user_id (str): iData user ID
+            knowledge_space_id (str): iData knowledge space ID
+            dataset_ids (str): JSON string array of iData knowledge base IDs, e.g., '["kb_id_1", "kb_id_2"]'
+            rerank_model_id (str): Rerank model ID
+            top_k (int, optional): Number of results to return. Defaults to 10.
+            similarity_threshold (float, optional): Rerank similarity threshold. Defaults to -10.0.
+            keyword_similarity_weight (float, optional): Keyword similarity weight. Defaults to 0.10.
+            vector_similarity_weight (float, optional): Vector similarity weight. Defaults to 0.3.
+            observer (MessageObserver, optional): Message observer instance. Defaults to None.
+        """
+        super().__init__()
+
+        # Validate server_url
+        if not server_url or not isinstance(server_url, str):
+            raise ValueError(
+                "server_url is required and must be a non-empty string")
+
+        # Validate api_key
+        if not api_key or not isinstance(api_key, str):
+            raise ValueError(
+                "api_key is required and must be a non-empty string")
+
+        # Validate user_id
+        if not user_id or not isinstance(user_id, str):
+            raise ValueError(
+                "user_id is required and must be a non-empty string")
+
+        # Validate knowledge_space_id
+        if not knowledge_space_id or not isinstance(knowledge_space_id, str):
+            raise ValueError(
+                "knowledge_space_id is required and must be a non-empty string")
+
+        # Validate rerank_model_id
+        if not rerank_model_id or not isinstance(rerank_model_id, str):
+            raise ValueError(
+                "rerank_model_id is required and must be a non-empty string")
+
+        # Parse and validate dataset_ids from string or list
+        if not dataset_ids:
+            raise ValueError(
+                "dataset_ids is required and must be a non-empty JSON string array or list")
+        try:
+            # Handle both JSON string array and plain list
+            if isinstance(dataset_ids, str):
+                parsed_ids = json.loads(dataset_ids)
+            else:
+                parsed_ids = dataset_ids
+            if not isinstance(parsed_ids, list) or not parsed_ids:
+                raise ValueError(
+                    "dataset_ids must be a non-empty array of strings")
+            self.dataset_ids = [str(item) for item in parsed_ids]
+        except (json.JSONDecodeError, TypeError) as e:
+            raise ValueError(
+                f"dataset_ids must be a valid JSON string array or list: {str(e)}")
+
+        self.server_url = server_url.rstrip("/")
+        self.api_key = api_key
+        self.user_id = user_id
+        self.knowledge_space_id = knowledge_space_id
+        self.rerank_model_id = rerank_model_id
+        self.top_k = top_k
+        self.similarity_threshold = similarity_threshold
+        self.keyword_similarity_weight = keyword_similarity_weight
+        self.vector_similarity_weight = vector_similarity_weight
+        self.observer = observer
+
+        # Cache HTTP client for reuse (uses shared HttpClientManager internally)
+        # Note: ssl_verify is set to False as per requirement (self-signed certificate)
+        self._http_client = http_client_manager.get_sync_client(
+            base_url=self.server_url,
+            timeout=30.0,
+            verify_ssl=False
+        )
+
+        self.record_ops = 1  # To record serial number
+        self.running_prompt_zh = "iData知识库检索中..."
+        self.running_prompt_en = "Searching iData knowledge base..."
+
+    def forward(
+        self,
+        question: str
+    ) -> str:
+        # Send tool run message
+        if self.observer:
+            running_prompt = self.running_prompt_zh if self.observer.lang == "zh" else self.running_prompt_en
+            self.observer.add_message("", ProcessType.TOOL, running_prompt)
+            card_content = [{"icon": "search", "text": question}]
+            self.observer.add_message("", ProcessType.CARD, json.dumps(
+                card_content, ensure_ascii=False))
+
+        # Log the search parameters
+        logger.info(
+            f"IdataSearchTool called with question: '{question}', top_k: {self.top_k}"
+        )
+
+        search_results_json = []  # Organize search results into a unified format
+        search_results_return = []  # Format for input to the large model
+
+        try:
+            # Build knowledge base filter
+            knowledge_base_filter = []
+            for kb_id in self.dataset_ids:
+                knowledge_base_filter.append({
+                    "knowledgeBaseId": kb_id,
+                    "metas": []
+                })
+
+            # Build request payload
+            payload = {
+                "userId": self.user_id,
+                "knowledgeBaseFilter": knowledge_base_filter,
+                "question": question,
+                "rankTopN": self.top_k,
+                "rerankModelId": self.rerank_model_id,
+                "similarityThreshold": self.similarity_threshold,
+                "keywordSimilarityWeight": self.keyword_similarity_weight,
+                "vectorSimilarityWeight": self.vector_similarity_weight
+            }
+
+            # Perform search
+            result = self._search_idata_knowledge_base(payload)
+
+            # Parse response
+            data = result.get("data", {})
+            retrieval_data = data.get("retrievalData", [])
+
+            if not retrieval_data:
+                raise Exception(
+                    "No results found! Try a less restrictive/shorter query.")
+
+            # Extract chunks from the first retrieval data entry
+            chunks = retrieval_data[0].get("chunks", [])
+
+            if not chunks:
+                raise Exception(
+                    "No chunks found in search results! Try a different query.")
+
+            # Process all chunks
+            for index, chunk in enumerate(chunks):
+                # Extract chunk information
+                document_id = chunk.get("documentId", "")
+                document_name = chunk.get("documentName", "")
+                content = chunk.get("content", "")
+                dataset_id = chunk.get("datasetId", "")
+                create_time = chunk.get("createTime", 0)
+                re_rank_score = chunk.get("reRankScore", 0)
+                vs_score = chunk.get("vsScore", 0)
+                es_score = chunk.get("esScore", 0)
+                title = chunk.get("title", document_name)
+
+                # Build download URL
+                download_url = self._build_download_url(
+                    document_id, dataset_id)
+
+                # Build score details
+                score_details = {
+                    "reRankScore": re_rank_score,
+                    "vsScore": vs_score,
+                    "esScore": es_score
+                }
+
+                # Convert create_time from milliseconds to ISO format string
+                published_date = ""
+                if create_time:
+                    try:
+                        from datetime import datetime
+                        # Convert milliseconds to seconds
+                        timestamp = create_time / 1000
+                        published_date = datetime.fromtimestamp(
+                            timestamp).isoformat()
+                    except Exception:
+                        published_date = ""
+
+                # Build the search result message
+                search_result_message = SearchResultTextMessage(
+                    title=title or document_name,
+                    text=content,
+                    source_type="idata",  # iData knowledge base source type
+                    url=download_url,
+                    filename=document_name,
+                    published_date=published_date,
+                    score=str(re_rank_score) if re_rank_score else None,
+                    score_details=score_details,
+                    cite_index=self.record_ops + index,
+                    search_type=self.name,
+                    tool_sign=self.tool_sign,
+                )
+
+                search_results_json.append(search_result_message.to_dict())
+                search_results_return.append(
+                    search_result_message.to_model_dict())
+
+            self.record_ops += len(search_results_return)
+
+            # Record the detailed content of this search
+            if self.observer:
+                search_results_data = json.dumps(
+                    search_results_json, ensure_ascii=False)
+                self.observer.add_message(
+                    "", ProcessType.SEARCH_CONTENT, search_results_data)
+
+            return json.dumps(search_results_return, ensure_ascii=False)
+
+        except Exception as e:
+            error_msg = f"Error searching iData knowledge base: {str(e)}"
+            logger.error(error_msg)
+            raise Exception(error_msg)
+
+    def _build_download_url(self, document_id: str, dataset_id: str) -> str:
+        """Build download URL for a document from iData API.
+
+        Args:
+            document_id (str): Document ID from search results
+            dataset_id (str): Dataset/Knowledge base ID from chunk
+
+        Returns:
+            str: Download URL for the document
+        """
+        if not document_id:
+            return ""
+
+        # If dataset_id is empty, try to use the first knowledge base ID as fallback
+        knowledge_base_id = dataset_id
+        if not knowledge_base_id and self.dataset_ids:
+            knowledge_base_id = self.dataset_ids[0]
+
+        if not knowledge_base_id:
+            return ""
+
+        # Build URL with query parameters
+        params = {
+            "userId": self.user_id,
+            "knowledgeBaseId": knowledge_base_id,
+            "documentId": document_id
+        }
+        query_string = urlencode(params)
+        url = f"{self.server_url}/apiaccess/modelmate/north/machine/v1/documents/download?{query_string}"
+
+        return url
+
+    def _search_idata_knowledge_base(self, payload: Dict[str, Any]) -> Dict[str, Any]:
+        """Perform search on iData knowledge base via API.
+
+        Args:
+            payload (Dict[str, Any]): Request payload
+
+        Returns:
+            Dict: Search results with retrievalData
+        """
+        url = f"{self.server_url}/apiaccess/modelmate/north/machine/v1/retrievals"
+
+        headers = {
+            "Content-Type": "application/json",
+            "Authorization": f"Bearer {self.api_key}"
+        }
+
+        try:
+            # Use cached HTTP client for requests
+            # Note: All requests use self._http_client which was configured with verify_ssl=False
+            # to support self-signed certificates (see __init__ method)
+            response = self._http_client.post(
+                url, headers=headers, json=payload)
+            response.raise_for_status()
+
+            result = response.json()
+
+            # Validate response format
+            code = result.get("code", "")
+            if code != "1":
+                msg = result.get("msg", "Unknown error")
+                raise Exception(f"iData API error: {msg}")
+
+            # Validate that required keys are present
+            if "data" not in result:
+                raise Exception(
+                    "Unexpected iData API response format: missing 'data' key")
+
+            data = result.get("data", {})
+            if "retrievalData" not in data:
+                raise Exception(
+                    "Unexpected iData API response format: missing 'retrievalData' key")
+
+            return result
+
+        except httpx.RequestError as e:
+            raise Exception(f"iData API request failed: {str(e)}")
+        except httpx.HTTPStatusError as e:
+            raise Exception(f"iData API HTTP error: {str(e)}")
+        except json.JSONDecodeError as e:
+            raise Exception(f"Failed to parse iData API response: {str(e)}")
+        except KeyError as e:
+            raise Exception(
+                f"Unexpected iData API response format: missing key {str(e)}")
diff --git a/sdk/nexent/core/tools/tavily_search_tool.py b/sdk/nexent/core/tools/tavily_search_tool.py
index df64474b8..1c6fe1418 100644
--- a/sdk/nexent/core/tools/tavily_search_tool.py
+++ b/sdk/nexent/core/tools/tavily_search_tool.py
@@ -37,7 +37,7 @@ def __init__(self, tavily_api_key:str=Field(description="Tavily API key"),
         self.tavily = TavilyClient(api_key=tavily_api_key)
         self.max_results = max_results
         self.image_filter = image_filter
-        self.record_ops = 0  # Used to record sequence number
+        self.record_ops = 1  # Used to record sequence number
         self.running_prompt_en = "Searching the web..."
         self.running_prompt_zh = "网络搜索中..."
         
diff --git a/sdk/nexent/core/utils/constants.py b/sdk/nexent/core/utils/constants.py
index f956687b6..ff297b2ca 100644
--- a/sdk/nexent/core/utils/constants.py
+++ b/sdk/nexent/core/utils/constants.py
@@ -1 +1,3 @@
 THINK_TAG_PATTERN = r"(?:<think>)?.*?</think>"
+# Pattern to match "思考：" or "思考:" followed by content until two newlines
+THINK_PREFIX_PATTERN = r"思考[：:].*?\n\n"
diff --git a/sdk/nexent/core/utils/tools_common_message.py b/sdk/nexent/core/utils/tools_common_message.py
index 7c73f827b..1893aab47 100644
--- a/sdk/nexent/core/utils/tools_common_message.py
+++ b/sdk/nexent/core/utils/tools_common_message.py
@@ -11,9 +11,10 @@ class ToolSign(Enum):
     TAVILY_SEARCH = "d"  # Tavily search tool identifier
     DATAMATE_SEARCH = "e"  # DataMate search tool identifier
     DIFY_SEARCH = "g"  # Dify search tool identifier
+    IDATA_SEARCH = "h"  # iData search tool identifier
     FILE_OPERATION = "f"      # File operation tool identifier
     TERMINAL_OPERATION = "t"  # Terminal operation tool identifier
-    MULTIMODAL_OPERATION = "m" # Multimodal operation tool identifier
+    MULTIMODAL_OPERATION = "m"  # Multimodal operation tool identifier
 
 
 # Tool sign mapping for backward compatibility
@@ -24,6 +25,7 @@ class ToolSign(Enum):
     "exa_search": ToolSign.EXA_SEARCH.value,
     "datamate_search": ToolSign.DATAMATE_SEARCH.value,
     "dify_search": ToolSign.DIFY_SEARCH.value,
+    "idata_search": ToolSign.IDATA_SEARCH.value,
     "file_operation": ToolSign.FILE_OPERATION.value,
     "terminal_operation": ToolSign.TERMINAL_OPERATION.value,
     "multimodal_operation": ToolSign.MULTIMODAL_OPERATION.value,
@@ -67,9 +69,9 @@ def __init__(self, title: str, url: str, text: str, published_date: Optional[str
     def to_dict(self) -> Dict[str, Any]:
         """Convert SearchResult object to dictionary format to save all data."""
         return {"title": self.title, "url": self.url, "text": self.text, "published_date": self.published_date,
-            "source_type": self.source_type, "filename": self.filename, "score": self.score,
-            "score_details": self.score_details, "cite_index": self.cite_index, "search_type": self.search_type,
-            "tool_sign": self.tool_sign}
+                "source_type": self.source_type, "filename": self.filename, "score": self.score,
+                "score_details": self.score_details, "cite_index": self.cite_index, "search_type": self.search_type,
+                "tool_sign": self.tool_sign}
 
     def to_model_dict(self) -> Dict[str, Any]:
         """Format for input to the large model summary."""
diff --git a/sdk/nexent/storage/minio.py b/sdk/nexent/storage/minio.py
index 8815d8751..3a80b6607 100644
--- a/sdk/nexent/storage/minio.py
+++ b/sdk/nexent/storage/minio.py
@@ -396,3 +396,35 @@ def exists(
         except ClientError:
             return False
 
+    def copy_file(
+        self,
+        source_object: str,
+        dest_object: str,
+        bucket: Optional[str] = None
+    ) -> Tuple[bool, str]:
+        """
+        Copy a file within the same bucket.
+
+        Args:
+            source_object: Source object name
+            dest_object: Destination object name
+            bucket: Bucket name, if not specified use default bucket
+
+        Returns:
+            Tuple[bool, str]: (Success status, Destination object name or error message)
+        """
+        bucket = bucket or self.default_bucket
+        if bucket is None:
+            return False, "Bucket name is required"
+
+        try:
+            copy_source = {"Bucket": bucket, "Key": source_object}
+            self.client.copy_object(
+                Bucket=bucket,
+                Key=dest_object,
+                CopySource=copy_source
+            )
+            return True, dest_object
+        except Exception as e:
+            logger.error(f"Failed to copy object {source_object} to {dest_object}: {e}")
+            return False, str(e)
diff --git a/sdk/nexent/storage/storage_client_base.py b/sdk/nexent/storage/storage_client_base.py
index 095dc43fc..90a37f395 100644
--- a/sdk/nexent/storage/storage_client_base.py
+++ b/sdk/nexent/storage/storage_client_base.py
@@ -217,3 +217,22 @@ def exists(
         """
         pass
 
+    @abstractmethod
+    def copy_file(
+        self,
+        source_object: str,
+        dest_object: str,
+        bucket: Optional[str] = None
+    ) -> Tuple[bool, str]:
+        """
+        Copy a file within the same bucket.
+
+        Args:
+            source_object: Source object name
+            dest_object: Destination object name
+            bucket: Bucket name, if not specified use default bucket
+
+        Returns:
+            Tuple[bool, str]: (Success status, Destination object name or error message)
+        """
+        pass
\ No newline at end of file
diff --git a/test/backend/app/test_config_app.py b/test/backend/app/test_config_app.py
index a4dd4566b..63e410fcc 100644
--- a/test/backend/app/test_config_app.py
+++ b/test/backend/app/test_config_app.py
@@ -9,7 +9,8 @@
 import atexit
 
 # Add the backend directory to path so we can import modules
-backend_path = os.path.abspath(os.path.join(os.path.dirname(__file__), '../../../backend'))
+backend_path = os.path.abspath(os.path.join(
+    os.path.dirname(__file__), '../../../backend'))
 sys.path.insert(0, backend_path)
 
 # Apply patches before importing any app modules
@@ -190,6 +191,16 @@ def test_all_routers_included(self):
         # Should have many routes from all routers
         self.assertGreater(len(app.routes), 10)
 
+    def test_idata_router_included(self):
+        """Test that idata_router is imported and included in the app."""
+        # Verify that idata_router is imported
+        from apps.config_app import idata_router
+        self.assertIsNotNone(idata_router)
+
+        # Verify that the app has been properly initialized with routers
+        # The idata_router should be included, which means we should have routes
+        self.assertGreater(len(app.routes), 10)
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/test/backend/app/test_data_process_app.py b/test/backend/app/test_data_process_app.py
index acbfe889e..b59b0f817 100644
--- a/test/backend/app/test_data_process_app.py
+++ b/test/backend/app/test_data_process_app.py
@@ -8,6 +8,18 @@
 from fastapi.testclient import TestClient
 from pydantic import BaseModel
 
+# Install consts.exceptions at module level so OfficeConversionException is bound
+# in the app module's namespace on first import.
+_exc_mod = types.ModuleType("consts.exceptions")
+
+
+class _OfficeConversionException(Exception):
+    """Stub exception for Office document conversion failures."""
+
+
+_exc_mod.OfficeConversionException = _OfficeConversionException  # type: ignore[attr-defined]
+sys.modules["consts.exceptions"] = _exc_mod
+
 
 class _TaskRequest(BaseModel):
     source: str
@@ -136,6 +148,14 @@ def convert_celery_states_to_custom(self, process_celery_state: str, forward_cel
             return "COMPLETED"
         return "WAIT_FOR_PROCESSING"
 
+    async def convert_office_to_pdf_impl(self, object_name: str, pdf_object_name: str) -> None:
+        """Stub: raise OfficeConversionException for sentinel inputs, otherwise succeed."""
+        from consts.exceptions import OfficeConversionException
+        if object_name == "fail.docx":
+            raise OfficeConversionException("conversion failed")
+        if object_name == "err.docx":
+            raise RuntimeError("unexpected error")
+
 
 @pytest.fixture(autouse=True)
 def stub_modules(monkeypatch):
@@ -451,3 +471,47 @@ def raise_convert_http(*args, **kwargs):
     resp = client.post("/tasks/convert_state",
                        json={"process_state": "PENDING", "forward_state": ""})
     assert resp.status_code == HTTPStatus.NOT_ACCEPTABLE
+
+
+def test_convert_to_pdf_success():
+    """Valid request returns 200 {success: True}."""
+    app = _build_app()
+    client = TestClient(app)
+    resp = client.post(
+        "/tasks/convert_to_pdf",
+        data={"object_name": "uploads/doc.docx", "pdf_object_name": "converted/doc.pdf"},
+    )
+    assert resp.status_code == HTTPStatus.OK
+    assert resp.json()["success"] is True
+
+
+def test_convert_to_pdf_office_conversion_exception(monkeypatch):
+    """OfficeConversionException from service maps to HTTP 500."""
+    app = _build_app()
+    client = TestClient(app)
+    # Trigger the sentinel path in _ServiceStub
+    resp = client.post(
+        "/tasks/convert_to_pdf",
+        data={"object_name": "fail.docx", "pdf_object_name": "converted/fail.pdf"},
+    )
+    assert resp.status_code == HTTPStatus.INTERNAL_SERVER_ERROR
+    assert "conversion failed" in resp.json()["detail"]
+
+
+def test_convert_to_pdf_unexpected_exception():
+    """Unexpected RuntimeError from service also maps to HTTP 500."""
+    app = _build_app()
+    client = TestClient(app)
+    resp = client.post(
+        "/tasks/convert_to_pdf",
+        data={"object_name": "err.docx", "pdf_object_name": "converted/err.pdf"},
+    )
+    assert resp.status_code == HTTPStatus.INTERNAL_SERVER_ERROR
+
+
+def test_convert_to_pdf_missing_params():
+    """Missing required form fields returns HTTP 422 Unprocessable Entity."""
+    app = _build_app()
+    client = TestClient(app)
+    resp = client.post("/tasks/convert_to_pdf", data={})
+    assert resp.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
diff --git a/test/backend/app/test_file_management_app.py b/test/backend/app/test_file_management_app.py
index a337a1434..1721b5f98 100644
--- a/test/backend/app/test_file_management_app.py
+++ b/test/backend/app/test_file_management_app.py
@@ -55,6 +55,12 @@ async def _stub_preprocess_files_generator(*_: Any, **__: Any) -> AsyncGenerator
     yield "data: {\"type\": \"progress\", \"progress\": 0}\n\n"
     yield "data: {\"type\": \"complete\", \"progress\": 100}\n\n"
 
+async def _stub_preview_file_impl(object_name: str):
+    """Default stub for preview_file_impl"""
+    from io import BytesIO
+    return BytesIO(b"PDF content"), "application/pdf"
+
+sfms_stub.preview_file_impl = _stub_preview_file_impl
 sfms_stub.upload_to_minio = _stub_upload_to_minio
 sfms_stub.upload_files_impl = _stub_upload_files_impl
 sfms_stub.get_file_url_impl = _stub_get_file_url_impl
@@ -101,9 +107,22 @@ def __init__(self, chunking_strategy: str, source_type: str, index_name: str, au
         self.index_name = index_name
         self.authorization = authorization
 model_stub.ProcessParams = ProcessParams
-sys.modules["consts.model"] = model_stub
+sys.modules.setdefault("consts.model", model_stub)
 setattr(consts_pkg, "model", model_stub)
 
+# Stub consts.exceptions with real exception classes so isinstance checks work
+exceptions_stub = types.ModuleType("consts.exceptions")
+class NotFoundException(Exception): pass
+class OfficeConversionException(Exception): pass
+class UnsupportedFileTypeException(Exception): pass
+class FileTooLargeException(Exception): pass
+exceptions_stub.NotFoundException = NotFoundException
+exceptions_stub.OfficeConversionException = OfficeConversionException
+exceptions_stub.UnsupportedFileTypeException = UnsupportedFileTypeException
+exceptions_stub.FileTooLargeException = FileTooLargeException
+sys.modules["consts.exceptions"] = exceptions_stub
+setattr(consts_pkg, "exceptions", exceptions_stub)
+
 
 # Import the module under test after stubbing deps
 file_management_app = __import__(
@@ -444,6 +463,40 @@ def boom(_value: str, safe: str = "") -> str:
     assert 'filename*=UTF-8' not in result
 
 
+def test_build_content_disposition_header_inline_ascii():
+    """Test build_content_disposition_header with inline=True for ASCII filename"""
+    result = file_management_app.build_content_disposition_header("test.pdf", inline=True)
+    assert result == 'inline; filename="test.pdf"'
+    assert 'attachment' not in result
+
+
+def test_build_content_disposition_header_inline_non_ascii():
+    """Test build_content_disposition_header with inline=True for non-ASCII filename"""
+    result = file_management_app.build_content_disposition_header("测试文档.pdf", inline=True)
+    assert 'inline; filename=' in result
+    assert 'attachment' not in result
+    assert 'filename*=UTF-8' in result
+
+
+def test_build_content_disposition_header_inline_false_explicit():
+    """Test build_content_disposition_header with inline=False explicitly"""
+    result = file_management_app.build_content_disposition_header("test.pdf", inline=False)
+    assert result == 'attachment; filename="test.pdf"'
+    assert 'inline' not in result
+
+
+def test_build_content_disposition_header_inline_exception_handling(monkeypatch):
+    """Test build_content_disposition_header inline mode exception handling"""
+    def boom(_value: str, safe: str = "") -> str:
+        raise RuntimeError("quote failure")
+
+    monkeypatch.setattr("backend.apps.file_management_app.quote", boom)
+
+    result = file_management_app.build_content_disposition_header("中文.pdf", inline=True)
+    assert 'inline; filename=' in result
+    assert 'attachment' not in result
+
+
 # --- Tests for get_storage_file with filename parameter ---
 
 @pytest.mark.asyncio
@@ -872,3 +925,254 @@ def test_build_datamate_url_from_parts_empty_base_url():
     assert "base_url is required" in str(ei.value)
 
 
+# --- Tests for preview_file endpoint ---
+
+@pytest.mark.asyncio
+async def test_preview_file_pdf_success(monkeypatch):
+    """Test previewing a PDF file returns StreamingResponse with inline disposition"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        return BytesIO(b"PDF content"), "application/pdf"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="documents/test.pdf",
+        filename="test.pdf"
+    )
+    
+    assert resp.media_type == "application/pdf"
+    content_disposition = resp.headers.get("content-disposition", "")
+    assert "inline" in content_disposition
+    assert "test.pdf" in content_disposition
+    assert resp.headers.get("cache-control") == "public, max-age=3600"
+
+
+@pytest.mark.asyncio
+async def test_preview_file_image_success(monkeypatch):
+    """Test previewing an image file returns correct content type"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        return BytesIO(b"PNG image data"), "image/png"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="images/photo.png",
+        filename="photo.png"
+    )
+    
+    assert resp.media_type == "image/png"
+    content_disposition = resp.headers.get("content-disposition", "")
+    assert "inline" in content_disposition
+
+
+@pytest.mark.asyncio
+async def test_preview_file_text_success(monkeypatch):
+    """Test previewing a text file returns correct content type"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        return BytesIO(b"Hello World"), "text/plain"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="files/readme.txt",
+        filename="readme.txt"
+    )
+    
+    assert resp.media_type == "text/plain"
+    content_disposition = resp.headers.get("content-disposition", "")
+    assert "inline" in content_disposition
+
+
+@pytest.mark.asyncio
+async def test_preview_file_without_filename_extracts_from_path(monkeypatch):
+    """Test previewing without filename parameter extracts name from object_name"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        return BytesIO(b"PDF content"), "application/pdf"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="folder/subfolder/document.pdf",
+        filename=None
+    )
+    
+    content_disposition = resp.headers.get("content-disposition", "")
+    assert "document.pdf" in content_disposition
+
+
+@pytest.mark.asyncio
+async def test_preview_file_chinese_filename(monkeypatch):
+    """Test previewing with Chinese filename uses UTF-8 encoding"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        return BytesIO(b"PDF content"), "application/pdf"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="documents/test.pdf",
+        filename="测试文档.pdf"
+    )
+    
+    content_disposition = resp.headers.get("content-disposition", "")
+    assert "inline" in content_disposition
+    assert "filename*=UTF-8" in content_disposition or "测试文档" in content_disposition
+
+
+@pytest.mark.asyncio
+async def test_preview_file_too_large_error(monkeypatch):
+    """Test previewing a file exceeding size limit returns 413"""
+    _FileTooLargeException = sys.modules["consts.exceptions"].FileTooLargeException
+
+    async def fake_preview(object_name):
+        raise _FileTooLargeException("File size 110 MB exceeds the 100 MB preview limit")
+
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+
+    with pytest.raises(Exception) as ei:
+        await file_management_app.preview_file(
+            object_name="files/huge.pdf",
+            filename=None
+        )
+    assert "100 MB" in str(ei.value)
+
+
+@pytest.mark.asyncio
+async def test_preview_file_unsupported_format_error(monkeypatch):
+    """Test previewing an unsupported file format returns 400"""
+    _UnsupportedFileTypeException = sys.modules["consts.exceptions"].UnsupportedFileTypeException
+
+    async def fake_preview(object_name):
+        raise _UnsupportedFileTypeException("Unsupported file format for preview")
+
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    with pytest.raises(Exception) as ei:
+        await file_management_app.preview_file(
+            object_name="files/archive.zip",
+            filename=None
+        )
+    assert "not supported for preview" in str(ei.value)
+
+
+@pytest.mark.asyncio
+async def test_preview_file_internal_error(monkeypatch):
+    """Test previewing with internal error returns 500"""
+    async def fake_preview(object_name):
+        raise Exception("Internal server error")
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    with pytest.raises(Exception) as ei:
+        await file_management_app.preview_file(
+            object_name="files/test.pdf",
+            filename=None
+        )
+    assert "Failed to preview file" in str(ei.value)
+
+
+@pytest.mark.asyncio
+async def test_preview_file_office_converted_to_pdf(monkeypatch):
+    """Test previewing an Office document returns converted PDF"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        # Office documents are converted to PDF by preview_file_impl
+        return BytesIO(b"Converted PDF content"), "application/pdf"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="documents/report.docx",
+        filename="report.docx"
+    )
+    
+    # Content type should be PDF after conversion
+    assert resp.media_type == "application/pdf"
+    content_disposition = resp.headers.get("content-disposition", "")
+    assert "inline" in content_disposition
+
+
+@pytest.mark.asyncio
+async def test_preview_file_has_etag_header(monkeypatch):
+    """Test preview response includes ETag header for caching"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        return BytesIO(b"PDF content"), "application/pdf"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="documents/test.pdf",
+        filename="test.pdf"
+    )
+    
+    etag = resp.headers.get("etag", "")
+    assert "documents/test.pdf" in etag
+
+
+@pytest.mark.asyncio
+async def test_preview_file_simple_object_name_without_slash(monkeypatch):
+    """Test previewing with simple object name without slash"""
+    from io import BytesIO
+    
+    async def fake_preview(object_name):
+        return BytesIO(b"PDF content"), "application/pdf"
+    
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    resp = await file_management_app.preview_file(
+        object_name="simple.pdf",
+        filename=None
+    )
+    
+    content_disposition = resp.headers.get("content-disposition", "")
+    assert "simple.pdf" in content_disposition
+
+
+@pytest.mark.asyncio
+async def test_preview_file_does_not_exist_error(monkeypatch):
+    """Test previewing with 'does not exist' error message returns 404"""
+    _NotFoundException = sys.modules["consts.exceptions"].NotFoundException
+
+    async def fake_preview(object_name):
+        raise _NotFoundException("The specified key does not exist")
+
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+    
+    with pytest.raises(Exception) as ei:
+        await file_management_app.preview_file(
+            object_name="missing/file.pdf",
+            filename=None
+        )
+    assert "File not found" in str(ei.value)
+
+
+@pytest.mark.asyncio
+async def test_preview_file_office_conversion_error(monkeypatch):
+    """OfficeConversionException from preview_file_impl → HTTP 500 with conversion detail."""
+    _OfficeConversionException = sys.modules["consts.exceptions"].OfficeConversionException
+
+    async def fake_preview(object_name):
+        raise _OfficeConversionException("LibreOffice conversion failed")
+
+    monkeypatch.setattr(file_management_app, "preview_file_impl", fake_preview)
+
+    with pytest.raises(Exception) as ei:
+        await file_management_app.preview_file(
+            object_name="files/report.docx",
+            filename=None
+        )
+    assert "Failed to preview file" in str(ei.value)
+
+
diff --git a/test/backend/app/test_idata_app.py b/test/backend/app/test_idata_app.py
new file mode 100644
index 000000000..66b213f96
--- /dev/null
+++ b/test/backend/app/test_idata_app.py
@@ -0,0 +1,545 @@
+"""
+Unit tests for iData App Layer.
+
+Tests the FastAPI endpoints for iData knowledge space operations.
+"""
+import sys
+import os
+from unittest.mock import patch, MagicMock
+
+import pytest
+from fastapi import FastAPI
+from fastapi.testclient import TestClient
+from http import HTTPStatus
+
+# Add backend directory to Python path for proper imports
+project_root = os.path.abspath(os.path.join(
+    os.path.dirname(__file__), '../../../'))
+backend_dir = os.path.join(project_root, 'backend')
+if backend_dir not in sys.path:
+    sys.path.insert(0, backend_dir)
+
+# Mock the storage client factory BEFORE importing any backend modules that depend on it.
+# This prevents MinIO connection attempts during module import.
+
+
+def _mock_create_storage_client_from_config(config):
+    """Mock function to replace create_storage_client_from_config."""
+    mock_client = MagicMock()
+    mock_client.default_bucket = getattr(config, 'default_bucket', None)
+    mock_client.upload_file.return_value = (True, "/mock-bucket/mock-file")
+    mock_client.download_file.return_value = (True, "Downloaded successfully")
+    mock_client.get_file_url.return_value = (True, "http://mock-url/file")
+    mock_client.list_files.return_value = []
+    mock_client.delete_file.return_value = (True, "Deleted successfully")
+    mock_client.get_file_stream.return_value = (True, MagicMock())
+    mock_client.get_file_size.return_value = 0
+    return mock_client
+
+
+# Apply the mock to the SDK module where create_storage_client_from_config is defined
+with patch('nexent.storage.storage_client_factory.create_storage_client_from_config',
+           side_effect=_mock_create_storage_client_from_config):
+    # Also mock the MinIO client initialization in database.client
+    with patch('backend.database.client.MinioClient') as MockMinioClient:
+        mock_minio_instance = MagicMock()
+        MockMinioClient.return_value = mock_minio_instance
+
+        # Now it's safe to import backend modules
+        from backend.apps.idata_app import router
+        from backend.apps.app_factory import register_exception_handlers
+        # Import ErrorCode and AppException the same way as the endpoint function does
+        # The endpoint uses: from consts.error_code import ErrorCode
+        # The endpoint uses: from consts.exceptions import AppException
+        # So we import them the same way to ensure type matching
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+        from backend.services.idata_service import (
+            fetch_idata_knowledge_spaces_impl,
+            fetch_idata_datasets_impl,
+        )
+
+
+def _build_app():
+    """Build FastAPI app with idata router and exception handlers for testing."""
+    app = FastAPI()
+    app.include_router(router)
+    register_exception_handlers(app)
+    return app
+
+
+class TestFetchIdataKnowledgeSpacesApi:
+    """Test class for fetch_idata_knowledge_spaces_api endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_fetch_knowledge_spaces_success(self):
+        """Test successful fetching of iData knowledge spaces."""
+        app = _build_app()
+        client = TestClient(app)
+
+        expected_result = [
+            {"id": "space-1", "name": "Knowledge Space 1"},
+            {"id": "space-2", "name": "Knowledge Space 2"},
+        ]
+
+        with patch('backend.apps.idata_app.fetch_idata_knowledge_spaces_impl') as mock_fetch:
+            mock_fetch.return_value = expected_result
+
+            response = client.get(
+                "/idata/knowledge-space",
+                params={
+                    "idata_api_base": "https://idata.example.com",
+                    "api_key": "test-api-key",
+                    "user_id": "test-user-id",
+                }
+            )
+
+            assert response.status_code == HTTPStatus.OK
+            assert response.json() == expected_result
+            mock_fetch.assert_called_once_with(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+            )
+
+    @pytest.mark.asyncio
+    async def test_fetch_knowledge_spaces_url_normalization_with_trailing_slash(self):
+        """Test that trailing slash is removed from idata_api_base."""
+        app = _build_app()
+        client = TestClient(app)
+
+        expected_result = [
+            {"id": "space-1", "name": "Knowledge Space 1"},
+        ]
+
+        with patch('backend.apps.idata_app.fetch_idata_knowledge_spaces_impl') as mock_fetch:
+            mock_fetch.return_value = expected_result
+
+            response = client.get(
+                "/idata/knowledge-space",
+                params={
+                    "idata_api_base": "https://idata.example.com/",
+                    "api_key": "test-api-key",
+                    "user_id": "test-user-id",
+                }
+            )
+
+            assert response.status_code == HTTPStatus.OK
+            assert response.json() == expected_result
+            # Verify that the URL was normalized (trailing slash removed)
+            mock_fetch.assert_called_once_with(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+            )
+
+    @pytest.mark.asyncio
+    async def test_fetch_knowledge_spaces_url_normalization_exception(self):
+        """Test exception handling during URL normalization."""
+        from backend.apps import idata_app
+
+        # Since we can't patch str.rstrip (str is immutable), we'll directly test
+        # the exception handling logic by patching the endpoint function to simulate
+        # an exception during rstrip
+        original_func = idata_app.fetch_idata_knowledge_spaces_api
+
+        async def mock_func_with_rstrip_exception(
+            idata_api_base: str,
+            api_key: str,
+            user_id: str,
+        ):
+            # Simulate exception during rstrip (first try block)
+            try:
+                # This simulates rstrip raising an exception
+                raise ValueError("Invalid URL format")
+            except Exception as e:
+                idata_app.logger.error(f"Invalid iData configuration: {e}")
+                raise AppException(
+                    ErrorCode.IDATA_CONFIG_INVALID,
+                    f"Invalid URL format: {str(e)}"
+                )
+
+        # Patch the endpoint function
+        with patch.object(idata_app, 'fetch_idata_knowledge_spaces_api', mock_func_with_rstrip_exception):
+            # Call the endpoint function directly
+            with pytest.raises(AppException) as exc_info:
+                await idata_app.fetch_idata_knowledge_spaces_api(
+                    idata_api_base="https://idata.example.com",
+                    api_key="test-api-key",
+                    user_id="test-user-id",
+                )
+
+            # Verify the exception
+            assert exc_info.value.error_code == ErrorCode.IDATA_CONFIG_INVALID
+
+    @pytest.mark.asyncio
+    async def test_fetch_knowledge_spaces_app_exception_re_raise(self):
+        """Test that AppException is re-raised and handled by global middleware."""
+        from backend.apps import idata_app
+
+        app_exception = AppException(
+            ErrorCode.IDATA_CONFIG_INVALID,
+            "Invalid iData configuration"
+        )
+
+        # Patch the service implementation to raise AppException
+        with patch('backend.apps.idata_app.fetch_idata_knowledge_spaces_impl', side_effect=app_exception):
+            # Call the endpoint function directly to verify exception is re-raised
+            with pytest.raises(AppException) as exc_info:
+                await idata_app.fetch_idata_knowledge_spaces_api(
+                    idata_api_base="https://idata.example.com",
+                    api_key="test-api-key",
+                    user_id="test-user-id",
+                )
+
+            # Verify the exception is re-raised (not converted)
+            # The exception should have the same error code as the original
+            assert exc_info.value.error_code == ErrorCode.IDATA_CONFIG_INVALID
+            # Verify it's the same exception (re-raised, not converted to IDATA_SERVICE_ERROR)
+            assert exc_info.value.error_code == app_exception.error_code
+            assert exc_info.value.message == app_exception.message
+
+    @pytest.mark.asyncio
+    async def test_fetch_knowledge_spaces_generic_exception(self):
+        """Test handling of generic exceptions."""
+        from backend.apps import idata_app
+
+        # Patch the service implementation to raise a generic exception
+        with patch('backend.apps.idata_app.fetch_idata_knowledge_spaces_impl', side_effect=RuntimeError("Service unavailable")), \
+                patch('backend.apps.idata_app.logger') as mock_logger:
+            # Call the endpoint function directly to verify exception is converted
+            with pytest.raises(AppException) as exc_info:
+                await idata_app.fetch_idata_knowledge_spaces_api(
+                    idata_api_base="https://idata.example.com",
+                    api_key="test-api-key",
+                    user_id="test-user-id",
+                )
+
+            # Generic exception should be caught and converted to AppException
+            # Compare by value to avoid import path issues
+            assert exc_info.value.error_code.value == ErrorCode.IDATA_SERVICE_ERROR.value
+            assert "Failed to fetch iData knowledge spaces" in str(
+                exc_info.value.message)
+            mock_logger.error.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_fetch_knowledge_spaces_missing_required_params(self):
+        """Test that missing required query parameters return validation error."""
+        app = _build_app()
+        client = TestClient(app)
+
+        # Missing idata_api_base
+        response = client.get(
+            "/idata/knowledge-space",
+            params={
+                "api_key": "test-api-key",
+                "user_id": "test-user-id",
+            }
+        )
+        assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+        # Missing api_key
+        response = client.get(
+            "/idata/knowledge-space",
+            params={
+                "idata_api_base": "https://idata.example.com",
+                "user_id": "test-user-id",
+            }
+        )
+        assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+        # Missing user_id
+        response = client.get(
+            "/idata/knowledge-space",
+            params={
+                "idata_api_base": "https://idata.example.com",
+                "api_key": "test-api-key",
+            }
+        )
+        assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+
+class TestFetchIdataDatasetsApi:
+    """Test class for fetch_idata_datasets_api endpoint."""
+
+    @pytest.mark.asyncio
+    async def test_fetch_datasets_success(self):
+        """Test successful fetching of iData datasets."""
+        app = _build_app()
+        client = TestClient(app)
+
+        expected_result = {
+            "indices": ["dataset-1", "dataset-2"],
+            "count": 2,
+            "indices_info": [
+                {
+                    "name": "dataset-1",
+                    "display_name": "Dataset 1",
+                    "stats": {
+                        "base_info": {
+                            "doc_count": 10,
+                            "process_source": "iData"
+                        }
+                    }
+                },
+                {
+                    "name": "dataset-2",
+                    "display_name": "Dataset 2",
+                    "stats": {
+                        "base_info": {
+                            "doc_count": 20,
+                            "process_source": "iData"
+                        }
+                    }
+                }
+            ]
+        }
+
+        with patch('backend.apps.idata_app.fetch_idata_datasets_impl') as mock_fetch:
+            mock_fetch.return_value = expected_result
+
+            response = client.get(
+                "/idata/datasets",
+                params={
+                    "idata_api_base": "https://idata.example.com",
+                    "api_key": "test-api-key",
+                    "user_id": "test-user-id",
+                    "knowledge_space_id": "space-1",
+                }
+            )
+
+            assert response.status_code == HTTPStatus.OK
+            assert response.json() == expected_result
+            mock_fetch.assert_called_once_with(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1",
+            )
+
+    @pytest.mark.asyncio
+    async def test_fetch_datasets_url_normalization_with_trailing_slash(self):
+        """Test that trailing slash is removed from idata_api_base."""
+        app = _build_app()
+        client = TestClient(app)
+
+        expected_result = {
+            "indices": ["dataset-1"],
+            "count": 1,
+            "indices_info": [
+                {
+                    "name": "dataset-1",
+                    "display_name": "Dataset 1",
+                    "stats": {
+                        "base_info": {
+                            "doc_count": 10,
+                            "process_source": "iData"
+                        }
+                    }
+                }
+            ]
+        }
+
+        with patch('backend.apps.idata_app.fetch_idata_datasets_impl') as mock_fetch:
+            mock_fetch.return_value = expected_result
+
+            response = client.get(
+                "/idata/datasets",
+                params={
+                    "idata_api_base": "https://idata.example.com/",
+                    "api_key": "test-api-key",
+                    "user_id": "test-user-id",
+                    "knowledge_space_id": "space-1",
+                }
+            )
+
+            assert response.status_code == HTTPStatus.OK
+            assert response.json() == expected_result
+            # Verify that the URL was normalized (trailing slash removed)
+            mock_fetch.assert_called_once_with(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1",
+            )
+
+    @pytest.mark.asyncio
+    async def test_fetch_datasets_url_normalization_exception(self):
+        """Test exception handling during URL normalization."""
+        from backend.apps import idata_app
+
+        # Since we can't patch str.rstrip (str is immutable), we'll directly test
+        # the exception handling logic by patching the endpoint function to simulate
+        # an exception during rstrip
+        original_func = idata_app.fetch_idata_datasets_api
+
+        async def mock_func_with_rstrip_exception(
+            idata_api_base: str,
+            api_key: str,
+            user_id: str,
+            knowledge_space_id: str,
+        ):
+            # Simulate exception during rstrip (first try block)
+            try:
+                # This simulates rstrip raising an exception
+                raise ValueError("Invalid URL format")
+            except Exception as e:
+                idata_app.logger.error(f"Invalid iData configuration: {e}")
+                raise AppException(
+                    ErrorCode.IDATA_CONFIG_INVALID,
+                    f"Invalid URL format: {str(e)}"
+                )
+
+        # Patch the endpoint function
+        with patch.object(idata_app, 'fetch_idata_datasets_api', mock_func_with_rstrip_exception):
+            # Call the endpoint function directly
+            with pytest.raises(AppException) as exc_info:
+                await idata_app.fetch_idata_datasets_api(
+                    idata_api_base="https://idata.example.com",
+                    api_key="test-api-key",
+                    user_id="test-user-id",
+                    knowledge_space_id="space-1",
+                )
+
+            # Verify the exception
+            assert exc_info.value.error_code == ErrorCode.IDATA_CONFIG_INVALID
+
+    @pytest.mark.asyncio
+    async def test_fetch_datasets_app_exception_re_raise(self):
+        """Test that AppException is re-raised and handled by global middleware."""
+        from backend.apps import idata_app
+
+        app_exception = AppException(
+            ErrorCode.IDATA_AUTH_ERROR,
+            "iData authentication failed"
+        )
+
+        # Patch the service implementation to raise AppException
+        with patch('backend.apps.idata_app.fetch_idata_datasets_impl', side_effect=app_exception):
+            # Call the endpoint function directly to verify exception is re-raised
+            with pytest.raises(AppException) as exc_info:
+                await idata_app.fetch_idata_datasets_api(
+                    idata_api_base="https://idata.example.com",
+                    api_key="test-api-key",
+                    user_id="test-user-id",
+                    knowledge_space_id="space-1",
+                )
+
+            # Verify the exception is re-raised (not converted)
+            # The exception should have the same error code as the original
+            assert exc_info.value.error_code == ErrorCode.IDATA_AUTH_ERROR
+            # Verify it's the same exception (re-raised, not converted to IDATA_SERVICE_ERROR)
+            assert exc_info.value.error_code == app_exception.error_code
+            assert exc_info.value.message == app_exception.message
+
+    @pytest.mark.asyncio
+    async def test_fetch_datasets_generic_exception(self):
+        """Test handling of generic exceptions."""
+        from backend.apps import idata_app
+
+        # Patch the service implementation to raise a generic exception
+        with patch('backend.apps.idata_app.fetch_idata_datasets_impl', side_effect=RuntimeError("Service unavailable")), \
+                patch('backend.apps.idata_app.logger') as mock_logger:
+            # Call the endpoint function directly to verify exception is converted
+            with pytest.raises(AppException) as exc_info:
+                await idata_app.fetch_idata_datasets_api(
+                    idata_api_base="https://idata.example.com",
+                    api_key="test-api-key",
+                    user_id="test-user-id",
+                    knowledge_space_id="space-1",
+                )
+
+            # Generic exception should be caught and converted to AppException
+            # Compare by value to avoid import path issues
+            assert exc_info.value.error_code.value == ErrorCode.IDATA_SERVICE_ERROR.value
+            assert "Failed to fetch iData datasets" in str(
+                exc_info.value.message)
+            mock_logger.error.assert_called_once()
+
+    @pytest.mark.asyncio
+    async def test_fetch_datasets_missing_required_params(self):
+        """Test that missing required query parameters return validation error."""
+        app = _build_app()
+        client = TestClient(app)
+
+        # Missing idata_api_base
+        response = client.get(
+            "/idata/datasets",
+            params={
+                "api_key": "test-api-key",
+                "user_id": "test-user-id",
+                "knowledge_space_id": "space-1",
+            }
+        )
+        assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+        # Missing api_key
+        response = client.get(
+            "/idata/datasets",
+            params={
+                "idata_api_base": "https://idata.example.com",
+                "user_id": "test-user-id",
+                "knowledge_space_id": "space-1",
+            }
+        )
+        assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+        # Missing user_id
+        response = client.get(
+            "/idata/datasets",
+            params={
+                "idata_api_base": "https://idata.example.com",
+                "api_key": "test-api-key",
+                "knowledge_space_id": "space-1",
+            }
+        )
+        assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+        # Missing knowledge_space_id
+        response = client.get(
+            "/idata/datasets",
+            params={
+                "idata_api_base": "https://idata.example.com",
+                "api_key": "test-api-key",
+                "user_id": "test-user-id",
+            }
+        )
+        assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
+
+
+class TestIdataAppRouter:
+    """Test class for router configuration."""
+
+    def test_router_prefix(self):
+        """Test that router has correct prefix."""
+        assert router.prefix == "/idata"
+
+    def test_routes_registered(self):
+        """Test that all routes are registered."""
+        app = _build_app()
+        routes = [route.path for route in app.routes]
+
+        assert "/idata/knowledge-space" in routes
+        assert "/idata/datasets" in routes
+
+    def test_router_methods(self):
+        """Test that routes have correct HTTP methods."""
+        app = _build_app()
+
+        # Find routes by path
+        knowledge_space_route = None
+        datasets_route = None
+
+        for route in app.routes:
+            if hasattr(route, 'path'):
+                if route.path == "/idata/knowledge-space":
+                    knowledge_space_route = route
+                elif route.path == "/idata/datasets":
+                    datasets_route = route
+
+        assert knowledge_space_route is not None
+        assert datasets_route is not None
+
+        # Check HTTP methods
+        assert "GET" in [method for method in knowledge_space_route.methods]
+        assert "GET" in [method for method in datasets_route.methods]
diff --git a/test/backend/app/test_northbound_app.py b/test/backend/app/test_northbound_app.py
index 672703cac..b50222265 100644
--- a/test/backend/app/test_northbound_app.py
+++ b/test/backend/app/test_northbound_app.py
@@ -2,7 +2,7 @@
 import sys
 from unittest.mock import MagicMock, AsyncMock
 import pytest
-from fastapi import FastAPI
+from fastapi import FastAPI, HTTPException
 from fastapi.responses import StreamingResponse
 from fastapi.testclient import TestClient
 import types
@@ -79,14 +79,19 @@ async def test_health_check():
 
 
 def test_run_chat_calls_service(monkeypatch):
-    monkeypatch.setattr("apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
-    monkeypatch.setattr("apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    # Mock Bearer token validation to return valid token
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    # Mock user/tenant lookup to return user and tenant
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     async def _gen():
         yield b"data: hello\n\n"
     start_mock = AsyncMock(return_value=StreamingResponse(_gen(), media_type="text/event-stream"))
     monkeypatch.setattr("apps.northbound_app.start_streaming_chat", start_mock)
 
-    payload = {"conversation_id": "nb-1", "agent_name": "agent-a", "query": "hi"}
+    # Use integer conversation_id as the endpoint expects Optional[int]
+    payload = {"conversation_id": 1, "agent_name": "agent-a", "query": "hi"}
     headers = {**_build_headers(), "Idempotency-Key": "idem-1"}
     resp = client.post("/nb/v1/chat/run", json=payload, headers=headers)
 
@@ -95,37 +100,45 @@ async def _gen():
     # Validate call into service
     assert start_mock.await_count == 1
     args, kwargs = start_mock.call_args
-    assert kwargs["external_conversation_id"] == "nb-1"
+    assert kwargs["conversation_id"] == 1
     assert kwargs["agent_name"] == "agent-a"
     assert kwargs["query"] == "hi"
     assert kwargs["idempotency_key"] == "idem-1"
 
 
 def test_stop_chat_calls_service(monkeypatch):
-    monkeypatch.setattr("apps.northbound_app.validate_aksk_authentication", lambda headers, body=None: True)
-    monkeypatch.setattr("apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     stop_mock = AsyncMock(return_value={"message": "success"})
     monkeypatch.setattr("apps.northbound_app.stop_chat", stop_mock)
 
-    resp = client.get("/nb/v1/chat/stop/nb-2", headers=_build_headers())
+    # Use integer conversation_id in URL path
+    resp = client.get("/nb/v1/chat/stop/123", headers=_build_headers())
     assert resp.status_code == 200
     assert stop_mock.await_count == 1
 
 
 def test_get_history_calls_service(monkeypatch):
-    monkeypatch.setattr("apps.northbound_app.validate_aksk_authentication", lambda headers, body=None: True)
-    monkeypatch.setattr("apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     hist_mock = AsyncMock(return_value={"message": "success"})
     monkeypatch.setattr("apps.northbound_app.get_conversation_history", hist_mock)
 
-    resp = client.get("/nb/v1/conversations/nb-3", headers=_build_headers())
+    # Use integer conversation_id in URL path
+    resp = client.get("/nb/v1/conversations/123", headers=_build_headers())
     assert resp.status_code == 200
     assert hist_mock.await_count == 1
 
 
 def test_list_agents_calls_service(monkeypatch):
-    monkeypatch.setattr("apps.northbound_app.validate_aksk_authentication", lambda headers, body=None: True)
-    monkeypatch.setattr("apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     agents_mock = AsyncMock(return_value={"message": "success", "data": []})
     monkeypatch.setattr("apps.northbound_app.get_agent_info_list", agents_mock)
 
@@ -135,8 +148,10 @@ def test_list_agents_calls_service(monkeypatch):
 
 
 def test_list_conversations_calls_service(monkeypatch):
-    monkeypatch.setattr("apps.northbound_app.validate_aksk_authentication", lambda headers, body=None: True)
-    monkeypatch.setattr("apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     list_mock = AsyncMock(return_value={"message": "success", "data": []})
     monkeypatch.setattr("apps.northbound_app.list_conversations", list_mock)
 
@@ -146,21 +161,24 @@ def test_list_conversations_calls_service(monkeypatch):
 
 
 def test_update_title_sets_headers(monkeypatch):
-    monkeypatch.setattr("apps.northbound_app.validate_aksk_authentication", lambda headers, body=None: True)
-    monkeypatch.setattr("apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     # Ensure NorthboundContext yields plain string fields (avoid MagicMock in headers)
     class _NCtx:
-        def __init__(self, request_id: str, tenant_id: str, user_id: str, authorization: str):
+        def __init__(self, request_id: str, tenant_id: str, user_id: str, authorization: str, token_id: int = 0):
             self.request_id = request_id
             self.tenant_id = tenant_id
             self.user_id = user_id
             self.authorization = authorization
+            self.token_id = token_id
     monkeypatch.setattr("apps.northbound_app.NorthboundContext", _NCtx)
     update_mock = AsyncMock(return_value={"message": "success", "data": "nb-4", "idempotency_key": "ide-xyz"})
     monkeypatch.setattr("apps.northbound_app.update_conversation_title", update_mock)
 
     headers = {**_build_headers(request_id="req-999"), "Idempotency-Key": "ide-xyz"}
-    resp = client.put("/nb/v1/conversations/nb-4/title", params={"title": "New Title"}, headers=headers)
+    resp = client.put("/nb/v1/conversations/123/title", params={"title": "New Title"}, headers=headers)
     assert resp.status_code == 200
     # Router wraps JSONResponse and should echo idempotency and request id
     assert resp.headers.get("Idempotency-Key") == "ide-xyz"
@@ -181,118 +199,119 @@ def _std_headers(auth="Bearer test_jwt"):
     (SignatureValidationError, 401),
 ])
 def test_run_chat_auth_exceptions_are_mapped(monkeypatch, exc_cls, status):
-    # Force AK/SK validation to raise domain exceptions
+    # Force Bearer token validation to raise domain exceptions
     def _raise(*_, **__):
         raise exc_cls("boom")
 
     monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", _raise)
-    # Even if provided, auth should not be parsed because AK/SK fails first
+        "apps.northbound_app.validate_bearer_token", _raise)
+    # Even if provided, auth should not be parsed because token validation fails first
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
+        json={"conversation_id": 1, "agent_name": "a", "query": "hi"},
         headers=_std_headers(),
     )
     assert resp.status_code == status
 
 
 def test_run_chat_missing_authorization_header_returns_401(monkeypatch):
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
+    # When no Authorization header, validate_bearer_token returns (False, None)
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (False, None))
     # No Authorization header
     headers = {k: v for k, v in _std_headers().items() if k.lower()
                != "authorization"}
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
+        json={"conversation_id": 1, "agent_name": "a", "query": "hi"},
         headers=headers,
     )
     assert resp.status_code == 401
-    assert resp.json()["detail"].startswith(
-        "Unauthorized: No authorization header")
+    assert "bearer token" in resp.json()["detail"].lower()
 
 
-def test_run_chat_jwt_parse_exception_returns_500(monkeypatch):
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
+def test_run_chat_jwt_parse_exception_returns_401(monkeypatch):
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
 
-    def _raise_jwt(_auth):
-        raise Exception("jwt parse error")
-    monkeypatch.setattr("apps.northbound_app.get_current_user_id", _raise_jwt)
+    def _raise_user_lookup(_access_key):
+        raise Exception("user lookup error")
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", _raise_user_lookup)
 
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
+        json={"conversation_id": 1, "agent_name": "a", "query": "hi"},
         headers=_std_headers(),
     )
-    assert resp.status_code == 500
-    assert "cannot parse JWT token" in resp.json()["detail"]
+    # When user lookup fails due to an invalid API key, return 401
+    assert resp.status_code == 401
+    assert "invalid api key" in resp.json()["detail"].lower()
 
 
-def test_run_chat_jwt_missing_user_id_returns_401(monkeypatch):
+def test_run_chat_jwt_missing_user_id_returns_400(monkeypatch):
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
     monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda _auth: (None, "t1"))
+        "apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+            "user_id": None, "tenant_id": "t1", "token_id": "t1"
+        })
 
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
+        json={"conversation_id": 1, "agent_name": "a", "query": "hi"},
         headers=_std_headers(),
     )
-    assert resp.status_code == 401
-    assert "missing user_id" in resp.json()["detail"]
+    assert resp.status_code == 400
+    assert "user" in resp.json()["detail"].lower()
 
 
-def test_run_chat_jwt_missing_tenant_id_returns_401(monkeypatch):
+def test_run_chat_jwt_missing_tenant_id_returns_400(monkeypatch):
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
     monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda _auth: ("u1", None))
+        "apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+            "user_id": "u1", "tenant_id": None, "token_id": "t1"
+        })
 
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
+        json={"conversation_id": 1, "agent_name": "a", "query": "hi"},
         headers=_std_headers(),
     )
-    assert resp.status_code == 401
-    assert "unregistered user_id" in resp.json()["detail"]
+    assert resp.status_code == 400
+    assert "tenant" in resp.json()["detail"].lower()
 
 
-def test_run_chat_internal_error_when_parsing_context_returns_500(monkeypatch):
+def test_run_chat_internal_error_when_parsing_context_returns_401(monkeypatch):
     def _raise(*_, **__):
         raise Exception("unexpected")
     monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", _raise)
+        "apps.northbound_app.validate_bearer_token", _raise)
 
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
+        json={"conversation_id": 1, "agent_name": "a", "query": "hi"},
         headers=_std_headers(),
     )
-    assert resp.status_code == 500
-    assert "cannot parse northbound context" in resp.json()["detail"]
+    # Any exception during validation returns 401
+    assert resp.status_code == 401
 
 
 def test_run_chat_unexpected_service_error_maps_500(monkeypatch):
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     start_mock = AsyncMock(side_effect=Exception("boom"))
     monkeypatch.setattr("apps.northbound_app.start_streaming_chat", start_mock)
 
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
+        json={"conversation_id": 1, "agent_name": "a", "query": "hi"},
         headers=_std_headers(),
     )
     assert resp.status_code == 500
 
 
 @pytest.mark.parametrize("path", [
-    "/nb/v1/chat/stop/nb-x",
-    "/nb/v1/conversations/nb-x",
+    "/nb/v1/chat/stop/123",
+    "/nb/v1/conversations/123",
     "/nb/v1/agents",
     "/nb/v1/conversations",
 ])
@@ -305,7 +324,7 @@ def test_other_endpoints_auth_exceptions_are_mapped(monkeypatch, path, exc_cls,
     def _raise(*_, **__):
         raise exc_cls("boom")
     monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", _raise)
+        "apps.northbound_app.validate_bearer_token", _raise)
 
     resp = client.get(path, headers=_build_headers())
     assert resp.status_code == status
@@ -314,17 +333,17 @@ def _raise(*_, **__):
 @pytest.mark.parametrize(
     "path, target",
     [
-        ("/nb/v1/chat/stop/nb-x", "apps.northbound_app.stop_chat"),
-        ("/nb/v1/conversations/nb-x", "apps.northbound_app.get_conversation_history"),
+        ("/nb/v1/chat/stop/123", "apps.northbound_app.stop_chat"),
+        ("/nb/v1/conversations/123", "apps.northbound_app.get_conversation_history"),
         ("/nb/v1/agents", "apps.northbound_app.get_agent_info_list"),
         ("/nb/v1/conversations", "apps.northbound_app.list_conversations"),
     ],
 )
 def test_other_endpoints_unexpected_service_error_maps_500(monkeypatch, path, target):
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body=None: True)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     monkeypatch.setattr(target, AsyncMock(side_effect=Exception("boom")))
 
     resp = client.get(path, headers=_build_headers())
@@ -332,101 +351,47 @@ def test_other_endpoints_unexpected_service_error_maps_500(monkeypatch, path, ta
 
 
 def test_update_title_unexpected_service_error_maps_500(monkeypatch):
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body=None: True)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
     monkeypatch.setattr("apps.northbound_app.update_conversation_title", AsyncMock(
         side_effect=Exception("boom")))
 
     resp = client.put(
-        "/nb/v1/conversations/nb-4/title",
+        "/nb/v1/conversations/123/title",
         params={"title": "x"},
         headers=_build_headers(),
     )
     assert resp.status_code == 500
 
 
-def test_request_body_read_failure_is_tolerated(monkeypatch):
-    """If reading body fails inside context parsing, it should use empty body and continue."""
-    captured = {"seen": None}
-
-    def _validate(headers, body):
-        captured["seen"] = body
-        return True
-
-    # Patch AK/SK validator and JWT parser
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", _validate)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
-
-    # Ensure NorthboundContext yields plain string fields
-    class _NCtx:
-        def __init__(self, request_id: str, tenant_id: str, user_id: str, authorization: str):
-            self.request_id = request_id
-            self.tenant_id = tenant_id
-            self.user_id = user_id
-            self.authorization = authorization
-
-    monkeypatch.setattr("apps.northbound_app.NorthboundContext", _NCtx)
-
-    # Monkeypatch context builder to simulate body read failure behavior (pass empty string to validator)
-    async def _ctx_builder(request):
-        # Simulate body read failure: validator sees empty string body
-        _validate(request.headers, "")
-        auth = next((v for k, v in request.headers.items()
-                    if k.lower() == "authorization"), "")
-        req_id = next((v for k, v in request.headers.items()
-                      if k.lower() == "x-request-id"), "req-ctx")
-        return _NCtx(request_id=req_id, tenant_id="t1", user_id="u1", authorization=auth)
-
-    monkeypatch.setattr(
-        "apps.northbound_app._parse_northbound_context", _ctx_builder)
-
-    async def _gen():
-        yield b"data: ok\n\n"
-    start_mock = AsyncMock(return_value=StreamingResponse(
-        _gen(), media_type="text/event-stream"))
-    monkeypatch.setattr("apps.northbound_app.start_streaming_chat", start_mock)
-
-    resp = client.post(
-        "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1", "agent_name": "a", "query": "hi"},
-        headers=_std_headers(),
-    )
-
-    # Should continue with empty body and succeed
-    assert resp.status_code == 200
-    assert captured["seen"] == ""
-    assert "text/event-stream" in resp.headers["content-type"]
-
-
 def test_run_chat_sets_headers_from_service_response(monkeypatch):
-    # Bypass AK/SK and JWT parsing in app layer
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    # Mock Bearer token and user lookup
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
 
     # Ensure NorthboundContext yields plain string fields (avoid MagicMock in headers)
     class _NCtx:
-        def __init__(self, request_id: str, tenant_id: str, user_id: str, authorization: str):
+        def __init__(self, request_id: str, tenant_id: str, user_id: str, authorization: str, token_id: int = 0):
             self.request_id = request_id
             self.tenant_id = tenant_id
             self.user_id = user_id
             self.authorization = authorization
+            self.token_id = token_id
 
     monkeypatch.setattr("apps.northbound_app.NorthboundContext", _NCtx)
 
     async def _gen():
         yield b"data: ok\n\n"
 
-    async def _start(ctx, external_conversation_id, agent_name, query, idempotency_key=None):
+    async def _start(ctx, conversation_id, agent_name, query, meta_data=None, idempotency_key=None):
         resp = StreamingResponse(_gen(), media_type="text/event-stream")
         # Service attaches headers in latest logic; emulate here
         resp.headers["X-Request-Id"] = ctx.request_id
-        resp.headers["conversation_id"] = external_conversation_id
+        resp.headers["conversation_id"] = str(conversation_id)
         return resp
 
     monkeypatch.setattr("apps.northbound_app.start_streaming_chat", _start)
@@ -434,21 +399,21 @@ async def _start(ctx, external_conversation_id, agent_name, query, idempotency_k
     headers = {**_std_headers(), "X-Request-Id": "rid-123"}
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1",
+        json={"conversation_id": 1,
               "agent_name": "agent-a", "query": "hello"},
         headers=headers,
     )
 
     assert resp.status_code == 200
     assert resp.headers.get("X-Request-Id") == "rid-123"
-    assert resp.headers.get("conversation_id") == "nb-1"
+    assert resp.headers.get("conversation_id") == "1"
 
 
 def test_run_chat_service_error_maps_500(monkeypatch):
-    monkeypatch.setattr(
-        "apps.northbound_app.validate_aksk_authentication", lambda headers, body: True)
-    monkeypatch.setattr(
-        "apps.northbound_app.get_current_user_id", lambda auth: ("u1", "t1"))
+    monkeypatch.setattr("apps.northbound_app.validate_bearer_token", lambda auth: (True, {"token_id": "t1"}))
+    monkeypatch.setattr("apps.northbound_app.get_user_and_tenant_by_access_key", lambda access_key: {
+        "user_id": "u1", "tenant_id": "t1", "token_id": "t1"
+    })
 
     async def _raise(*args, **kwargs):
         raise Exception("Failed to persist user message: boom")
@@ -457,7 +422,7 @@ async def _raise(*args, **kwargs):
 
     resp = client.post(
         "/nb/v1/chat/run",
-        json={"conversation_id": "nb-1",
+        json={"conversation_id": 1,
               "agent_name": "agent-a", "query": "hello"},
         headers=_std_headers(),
     )
diff --git a/test/backend/app/test_remote_mcp_app.py b/test/backend/app/test_remote_mcp_app.py
index 5b423a3c0..d8701cb9d 100644
--- a/test/backend/app/test_remote_mcp_app.py
+++ b/test/backend/app/test_remote_mcp_app.py
@@ -1152,6 +1152,163 @@ def test_add_mcp_from_config_container_error(self, mock_check_name, mock_contain
         assert "All MCP servers failed" in data["detail"]
         assert "Container failed" in data["detail"]
 
+    @patch('apps.remote_mcp_app.get_current_user_info')
+    @patch('apps.remote_mcp_app.MCPContainerManager')
+    @patch('apps.remote_mcp_app.check_mcp_name_exists', return_value=False)
+    def test_add_mcp_from_config_image_not_found_lowercase(self, mock_check_name, mock_container_manager_class, mock_get_user_info):
+        """Test adding MCP server when image not found (lowercase 'not found')"""
+        from consts.exceptions import MCPContainerError
+
+        mock_get_user_info.return_value = ("user123", "tenant456", "en")
+
+        mock_container_manager = MagicMock()
+        mock_container_manager_class.return_value = mock_container_manager
+        # Error message contains "not found" (lowercase)
+        mock_container_manager.start_mcp_container = AsyncMock(
+            side_effect=MCPContainerError("Container startup failed: Container startup failed: 404 Client Error for http+docker://localnpipe/v1.52/images/create?tag=latest&fromImage=nexent%2Fnexent-mcp: Not Found (\"failed to resolve reference \"docker.io/nexent/nexent-mcp:latest\": docker.io/nexent/nexent-mcp:latest: not found\")"))
+
+        response = client.post(
+            "/mcp/add-from-config",
+            json={
+                "mcpServers": {
+                    "test-service": {
+                        "command": "npx",
+                        "args": ["-y", "test-mcp"],
+                        "port": 5020
+                    }
+                }
+            },
+            headers={"Authorization": "Bearer test_token"}
+        )
+
+        assert response.status_code == HTTPStatus.BAD_REQUEST
+        data = response.json()
+        assert "All MCP servers failed" in data["detail"]
+        assert "Image not found - MCP service startup image is missing" in data["detail"]
+        assert "test-service" in data["detail"]
+
+    @patch('apps.remote_mcp_app.get_current_user_info')
+    @patch('apps.remote_mcp_app.MCPContainerManager')
+    @patch('apps.remote_mcp_app.check_mcp_name_exists', return_value=False)
+    def test_add_mcp_from_config_image_not_found_uppercase(self, mock_check_name, mock_container_manager_class, mock_get_user_info):
+        """Test adding MCP server when image not found (uppercase 'Not Found')"""
+        from consts.exceptions import MCPContainerError
+
+        mock_get_user_info.return_value = ("user123", "tenant456", "en")
+
+        mock_container_manager = MagicMock()
+        mock_container_manager_class.return_value = mock_container_manager
+        # Error message contains "Not Found" (uppercase)
+        mock_container_manager.start_mcp_container = AsyncMock(
+            side_effect=MCPContainerError("Container startup failed: Image Not Found"))
+
+        response = client.post(
+            "/mcp/add-from-config",
+            json={
+                "mcpServers": {
+                    "test-service": {
+                        "command": "npx",
+                        "args": ["-y", "test-mcp"],
+                        "port": 5020
+                    }
+                }
+            },
+            headers={"Authorization": "Bearer test_token"}
+        )
+
+        assert response.status_code == HTTPStatus.BAD_REQUEST
+        data = response.json()
+        assert "All MCP servers failed" in data["detail"]
+        assert "Image not found - MCP service startup image is missing" in data["detail"]
+        assert "test-service" in data["detail"]
+
+    @patch('apps.remote_mcp_app.get_current_user_info')
+    @patch('apps.remote_mcp_app.MCPContainerManager')
+    @patch('apps.remote_mcp_app.check_mcp_name_exists', return_value=False)
+    def test_add_mcp_from_config_image_not_found_with_404(self, mock_check_name, mock_container_manager_class, mock_get_user_info):
+        """Test adding MCP server when image not found (contains '404')"""
+        from consts.exceptions import MCPContainerError
+
+        mock_get_user_info.return_value = ("user123", "tenant456", "en")
+
+        mock_container_manager = MagicMock()
+        mock_container_manager_class.return_value = mock_container_manager
+        # Error message contains "404"
+        mock_container_manager.start_mcp_container = AsyncMock(
+            side_effect=MCPContainerError("Container startup failed: 404 Client Error for http+docker://localnpipe/v1.52/images/create"))
+
+        response = client.post(
+            "/mcp/add-from-config",
+            json={
+                "mcpServers": {
+                    "test-service": {
+                        "command": "npx",
+                        "args": ["-y", "test-mcp"],
+                        "port": 5020
+                    }
+                }
+            },
+            headers={"Authorization": "Bearer test_token"}
+        )
+
+        assert response.status_code == HTTPStatus.BAD_REQUEST
+        data = response.json()
+        assert "All MCP servers failed" in data["detail"]
+        assert "Image not found - MCP service startup image is missing" in data["detail"]
+        assert "test-service" in data["detail"]
+
+    @patch('apps.remote_mcp_app.get_current_user_info')
+    @patch('apps.remote_mcp_app.MCPContainerManager')
+    @patch('apps.remote_mcp_app.add_remote_mcp_server_list')
+    @patch('apps.remote_mcp_app.check_mcp_name_exists', return_value=False)
+    def test_add_mcp_from_config_image_not_found_multiple_services(self, mock_check_name, mock_add_server, mock_container_manager_class, mock_get_user_info):
+        """Test adding multiple MCP servers when one has image not found error"""
+        from consts.exceptions import MCPContainerError
+
+        mock_get_user_info.return_value = ("user123", "tenant456", "en")
+
+        mock_container_manager = MagicMock()
+        mock_container_manager_class.return_value = mock_container_manager
+        # First service fails with image not found, second succeeds
+        mock_container_manager.start_mcp_container = AsyncMock(side_effect=[
+            MCPContainerError("Container startup failed: Image not found"),
+            {
+                "container_id": "container-2",
+                "mcp_url": "http://localhost:5021/mcp",
+                "host_port": "5021",
+                "status": "started",
+                "container_name": "service2-user1234"
+            }
+        ])
+        mock_add_server.return_value = None
+
+        response = client.post(
+            "/mcp/add-from-config",
+            json={
+                "mcpServers": {
+                    "service1": {
+                        "command": "npx",
+                        "args": ["-y", "service1"],
+                        "port": 5020
+                    },
+                    "service2": {
+                        "command": "npx",
+                        "args": ["-y", "service2"],
+                        "port": 5021
+                    }
+                }
+            },
+            headers={"Authorization": "Bearer test_token"}
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        data = response.json()
+        assert data["status"] == "success"
+        assert len(data["results"]) == 1
+        assert data["results"][0]["service_name"] == "service2"
+        assert len(data["errors"]) == 1
+        assert "Image not found - MCP service startup image is missing" in data["errors"][0]
+
     @patch('apps.remote_mcp_app.get_current_user_info')
     @patch('apps.remote_mcp_app.MCPContainerManager')
     @patch('apps.remote_mcp_app.check_mcp_name_exists', return_value=False)
diff --git a/test/backend/app/test_user_management_app.py b/test/backend/app/test_user_management_app.py
index 8a8d212b0..30e8479dc 100644
--- a/test/backend/app/test_user_management_app.py
+++ b/test/backend/app/test_user_management_app.py
@@ -117,7 +117,34 @@ def test_signup_success_regular_user(self):
             mock_signup.assert_called_once_with(
                 email="test@example.com",
                 password="password123",
-                invite_code=None
+                invite_code=None,
+                auto_login=True
+            )
+
+    def test_signup_success_regular_user_with_auto_login_false(self):
+        """Test successful regular user registration with auto_login=false"""
+        with patch('apps.user_management_app.signup_user_with_invitation') as mock_signup:
+            mock_signup.return_value = {"user_id": "123", "email": "test@example.com"}
+
+            response = client.post(
+                "/user/signup",
+                json={
+                    "email": "test@example.com",
+                    "password": "password123",
+                    "invite_code": None,
+                    "auto_login": False
+                }
+            )
+
+            assert response.status_code == HTTPStatus.OK
+            data = response.json()
+            assert "registered successfully" in data["message"]
+            assert "data" in data
+            mock_signup.assert_called_once_with(
+                email="test@example.com",
+                password="password123",
+                invite_code=None,
+                auto_login=False
             )
 
     def test_signup_success_admin_user(self):
@@ -141,7 +168,33 @@ def test_signup_success_admin_user(self):
             mock_signup.assert_called_once_with(
                 email="admin@example.com",
                 password="password123",
-                invite_code="admin_code"
+                invite_code="admin_code",
+                auto_login=True
+            )
+
+    def test_signup_success_admin_user_with_auto_login_false(self):
+        """Test successful admin user registration with auto_login=false (tenant management scenario)"""
+        with patch('apps.user_management_app.signup_user_with_invitation') as mock_signup:
+            mock_signup.return_value = {"user_id": "123", "email": "admin@example.com"}
+
+            response = client.post(
+                "/user/signup",
+                json={
+                    "email": "admin@example.com",
+                    "password": "password123",
+                    "invite_code": "admin_code",
+                    "auto_login": False
+                }
+            )
+
+            assert response.status_code == HTTPStatus.OK
+            data = response.json()
+            assert "registered successfully" in data["message"]
+            mock_signup.assert_called_once_with(
+                email="admin@example.com",
+                password="password123",
+                invite_code="admin_code",
+                auto_login=False
             )
 
     def test_signup_no_invite_code_exception(self):
@@ -821,5 +874,205 @@ def test_signup_invalid_email_format(self):
         assert response.status_code == HTTPStatus.UNPROCESSABLE_ENTITY
 
 
+class TestCreateTokenEndpoint:
+    """Tests for POST /tokens endpoint."""
+
+    @patch('apps.user_management_app.create_token')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_create_token_success(self, mock_get_user_id, mock_create_token):
+        """Test successful token creation."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_create_token.return_value = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": "user-123"
+        }
+
+        response = client.post(
+            "/user/tokens",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        data = response.json()
+        assert data["message"] == "success"
+        assert data["data"]["token_id"] == 1
+
+    @patch('apps.user_management_app.create_token')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_create_token_no_authorization(self, mock_get_user_id, mock_create_token):
+        """Test token creation without authorization header."""
+        response = client.post("/user/tokens")
+
+        assert response.status_code == HTTPStatus.UNAUTHORIZED
+        data = response.json()
+        assert "No authorization header" in data["detail"]
+
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_create_token_missing_user_id(self, mock_get_user_id):
+        """Test token creation when user_id is missing from JWT."""
+        mock_get_user_id.return_value = (None, None)
+
+        response = client.post(
+            "/user/tokens",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.UNAUTHORIZED
+        data = response.json()
+        assert "missing user_id" in data["detail"]
+
+    @patch('apps.user_management_app.create_token')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_create_token_exception(self, mock_get_user_id, mock_create_token):
+        """Test token creation with exception."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_create_token.side_effect = Exception("Database error")
+
+        response = client.post(
+            "/user/tokens",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.INTERNAL_SERVER_ERROR
+
+
+class TestListTokensEndpoint:
+    """Tests for GET /tokens endpoint."""
+
+    @patch('apps.user_management_app.list_tokens_by_user')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_list_tokens_success(self, mock_get_user_id, mock_list_tokens):
+        """Test successful token listing."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_list_tokens.return_value = [
+            {"token_id": 1, "access_key": "nexent-key1", "user_id": "user-123"},
+            {"token_id": 2, "access_key": "nexent-key2", "user_id": "user-123"}
+        ]
+
+        response = client.get(
+            "/user/tokens?user_id=user-123",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        data = response.json()
+        assert data["message"] == "success"
+        assert len(data["data"]) == 2
+
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_list_tokens_no_authorization(self, mock_get_user_id):
+        """Test token listing without authorization header."""
+        response = client.get("/user/tokens?user_id=user-123")
+
+        assert response.status_code == HTTPStatus.UNAUTHORIZED
+        data = response.json()
+        assert "No authorization header" in data["detail"]
+
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_list_tokens_forbidden_other_user(self, mock_get_user_id):
+        """Test listing tokens for a different user is forbidden."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+
+        response = client.get(
+            "/user/tokens?user_id=user-other",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.FORBIDDEN
+        data = response.json()
+        assert "cannot list tokens for other users" in data["detail"]
+
+    @patch('apps.user_management_app.list_tokens_by_user')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_list_tokens_empty(self, mock_get_user_id, mock_list_tokens):
+        """Test listing tokens when user has none."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_list_tokens.return_value = []
+
+        response = client.get(
+            "/user/tokens?user_id=user-123",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        data = response.json()
+        assert data["data"] == []
+
+    @patch('apps.user_management_app.list_tokens_by_user')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_list_tokens_exception(self, mock_get_user_id, mock_list_tokens):
+        """Test token listing with exception."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_list_tokens.side_effect = Exception("Database error")
+
+        response = client.get(
+            "/user/tokens?user_id=user-123",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.INTERNAL_SERVER_ERROR
+
+
+class TestDeleteTokenEndpoint:
+    """Tests for DELETE /tokens/{token_id} endpoint."""
+
+    @patch('apps.user_management_app.delete_token')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_delete_token_success(self, mock_get_user_id, mock_delete_token):
+        """Test successful token deletion."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_delete_token.return_value = True
+
+        response = client.delete(
+            "/user/tokens/1",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.OK
+        data = response.json()
+        assert data["message"] == "success"
+        assert data["data"]["token_id"] == 1
+
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_delete_token_no_authorization(self, mock_get_user_id):
+        """Test token deletion without authorization header."""
+        response = client.delete("/user/tokens/1")
+
+        assert response.status_code == HTTPStatus.UNAUTHORIZED
+        data = response.json()
+        assert "No authorization header" in data["detail"]
+
+    @patch('apps.user_management_app.delete_token')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_delete_token_not_found(self, mock_get_user_id, mock_delete_token):
+        """Test deleting non-existent token."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_delete_token.return_value = False
+
+        response = client.delete(
+            "/user/tokens/999",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.NOT_FOUND
+        data = response.json()
+        assert "not found" in data["detail"]
+
+    @patch('apps.user_management_app.delete_token')
+    @patch('apps.user_management_app.get_current_user_id')
+    def test_delete_token_exception(self, mock_get_user_id, mock_delete_token):
+        """Test token deletion with exception."""
+        mock_get_user_id.return_value = ("user-123", "tenant-456")
+        mock_delete_token.side_effect = Exception("Database error")
+
+        response = client.delete(
+            "/user/tokens/1",
+            headers={"Authorization": "Bearer test-jwt-token"}
+        )
+
+        assert response.status_code == HTTPStatus.INTERNAL_SERVER_ERROR
+
+
 if __name__ == "__main__":
     pytest.main([__file__]) 
\ No newline at end of file
diff --git a/test/backend/consts/test_error_code.py b/test/backend/consts/test_error_code.py
index 11e8aea80..dcf957b94 100644
--- a/test/backend/consts/test_error_code.py
+++ b/test/backend/consts/test_error_code.py
@@ -28,6 +28,15 @@ def test_me_error_codes_exist(self):
         """Test that ME service error code is defined."""
         assert ErrorCode.ME_CONNECTION_FAILED is not None
 
+    def test_idata_error_codes_exist(self):
+        """Test that all iData-related error codes are defined."""
+        assert ErrorCode.IDATA_SERVICE_ERROR is not None
+        assert ErrorCode.IDATA_CONFIG_INVALID is not None
+        assert ErrorCode.IDATA_CONNECTION_ERROR is not None
+        assert ErrorCode.IDATA_AUTH_ERROR is not None
+        assert ErrorCode.IDATA_RATE_LIMIT is not None
+        assert ErrorCode.IDATA_RESPONSE_ERROR is not None
+
 
 class TestErrorCodeValues:
     """Test class for ErrorCode string values with leading zeros."""
@@ -64,6 +73,30 @@ def test_me_connection_failed_value(self):
         """Test ME_CONNECTION_FAILED has correct string value."""
         assert ErrorCode.ME_CONNECTION_FAILED.value == "130301"
 
+    def test_idata_service_error_value(self):
+        """Test IDATA_SERVICE_ERROR has correct string value."""
+        assert ErrorCode.IDATA_SERVICE_ERROR.value == "130401"
+
+    def test_idata_config_invalid_value(self):
+        """Test IDATA_CONFIG_INVALID has correct string value."""
+        assert ErrorCode.IDATA_CONFIG_INVALID.value == "130402"
+
+    def test_idata_connection_error_value(self):
+        """Test IDATA_CONNECTION_ERROR has correct string value."""
+        assert ErrorCode.IDATA_CONNECTION_ERROR.value == "130403"
+
+    def test_idata_auth_error_value(self):
+        """Test IDATA_AUTH_ERROR has correct string value."""
+        assert ErrorCode.IDATA_AUTH_ERROR.value == "130404"
+
+    def test_idata_rate_limit_value(self):
+        """Test IDATA_RATE_LIMIT has correct string value."""
+        assert ErrorCode.IDATA_RATE_LIMIT.value == "130405"
+
+    def test_idata_response_error_value(self):
+        """Test IDATA_RESPONSE_ERROR has correct string value."""
+        assert ErrorCode.IDATA_RESPONSE_ERROR.value == "130406"
+
     def test_common_validation_error_value(self):
         """Test COMMON_VALIDATION_ERROR has correct string value."""
         assert ErrorCode.COMMON_VALIDATION_ERROR.value == "000101"
@@ -216,6 +249,26 @@ def test_system_timeout_maps_to_504(self):
         """Test SYSTEM_TIMEOUT maps to HTTP 504."""
         assert ERROR_CODE_HTTP_STATUS[ErrorCode.SYSTEM_TIMEOUT] == 504
 
+    def test_idata_auth_error_maps_to_401(self):
+        """Test IDATA_AUTH_ERROR maps to HTTP 401."""
+        assert ERROR_CODE_HTTP_STATUS[ErrorCode.IDATA_AUTH_ERROR] == 401
+
+    def test_idata_config_invalid_maps_to_400(self):
+        """Test IDATA_CONFIG_INVALID maps to HTTP 400."""
+        assert ERROR_CODE_HTTP_STATUS[ErrorCode.IDATA_CONFIG_INVALID] == 400
+
+    def test_idata_connection_error_maps_to_502(self):
+        """Test IDATA_CONNECTION_ERROR maps to HTTP 502."""
+        assert ERROR_CODE_HTTP_STATUS[ErrorCode.IDATA_CONNECTION_ERROR] == 502
+
+    def test_idata_response_error_maps_to_502(self):
+        """Test IDATA_RESPONSE_ERROR maps to HTTP 502."""
+        assert ERROR_CODE_HTTP_STATUS[ErrorCode.IDATA_RESPONSE_ERROR] == 502
+
+    def test_idata_rate_limit_maps_to_429(self):
+        """Test IDATA_RATE_LIMIT maps to HTTP 429."""
+        assert ERROR_CODE_HTTP_STATUS[ErrorCode.IDATA_RATE_LIMIT] == 429
+
 
 class TestErrorCodeFormat:
     """Test class for error code format consistency."""
@@ -231,7 +284,8 @@ def test_all_dify_codes_start_with_1302(self):
             ErrorCode.DIFY_RESPONSE_ERROR,
         ]
         for code in dify_codes:
-            assert str(code.value).startswith("1302"), f"{code} should start with 1302"
+            assert str(code.value).startswith(
+                "1302"), f"{code} should start with 1302"
 
     def test_all_datamate_codes_start_with_1301(self):
         """Test DataMate error code starts with 1301 (module 13, sub-module 01)."""
@@ -241,6 +295,20 @@ def test_all_me_codes_start_with_1303(self):
         """Test ME service error code starts with 1303 (module 13, sub-module 03)."""
         assert str(ErrorCode.ME_CONNECTION_FAILED.value).startswith("1303")
 
+    def test_all_idata_codes_start_with_1304(self):
+        """Test all iData error codes start with 1304 (module 13, sub-module 04)."""
+        idata_codes = [
+            ErrorCode.IDATA_SERVICE_ERROR,
+            ErrorCode.IDATA_CONFIG_INVALID,
+            ErrorCode.IDATA_CONNECTION_ERROR,
+            ErrorCode.IDATA_AUTH_ERROR,
+            ErrorCode.IDATA_RATE_LIMIT,
+            ErrorCode.IDATA_RESPONSE_ERROR,
+        ]
+        for code in idata_codes:
+            assert str(code.value).startswith(
+                "1304"), f"{code} should start with 1304"
+
     def test_all_common_auth_codes_start_with_0002(self):
         """Test common auth error codes start with 0002."""
         auth_codes = [
@@ -250,7 +318,8 @@ def test_all_common_auth_codes_start_with_0002(self):
             ErrorCode.COMMON_FORBIDDEN,
         ]
         for code in auth_codes:
-            assert str(code.value).startswith("0002"), f"{code} should start with 0002"
+            assert str(code.value).startswith(
+                "0002"), f"{code} should start with 0002"
 
     def test_all_common_validation_codes_start_with_0001(self):
         """Test common validation error codes start with 0001."""
@@ -260,7 +329,8 @@ def test_all_common_validation_codes_start_with_0001(self):
             ErrorCode.COMMON_MISSING_REQUIRED_FIELD,
         ]
         for code in validation_codes:
-            assert str(code.value).startswith("0001"), f"{code} should start with 0001"
+            assert str(code.value).startswith(
+                "0001"), f"{code} should start with 0001"
 
     def test_all_system_codes_start_with_99(self):
         """Test system error codes start with 99."""
@@ -272,7 +342,8 @@ def test_all_system_codes_start_with_99(self):
             ErrorCode.SYSTEM_INTERNAL_ERROR,
         ]
         for code in system_codes:
-            assert str(code.value).startswith("99"), f"{code} should start with 99"
+            assert str(code.value).startswith(
+                "99"), f"{code} should start with 99"
 
     def test_all_chat_codes_start_with_01(self):
         """Test chat error codes start with 01."""
@@ -330,6 +401,8 @@ def test_error_code_length_is_six(self):
             ErrorCode.KNOWLEDGE_NOT_FOUND,
             ErrorCode.MCP_CONNECTION_FAILED,
             ErrorCode.SYSTEM_UNKNOWN_ERROR,
+            ErrorCode.IDATA_AUTH_ERROR,
+            ErrorCode.IDATA_SERVICE_ERROR,
         ]
         for code in all_codes:
             assert len(code.value) == 6, f"{code} should have 6 digits"
@@ -343,6 +416,7 @@ def test_error_code_can_be_converted_to_int(self):
         # The response should use int() to convert string to number
         assert int(ErrorCode.DIFY_AUTH_ERROR.value) == 130204
         assert int(ErrorCode.COMMON_VALIDATION_ERROR.value) == 101
+        assert int(ErrorCode.IDATA_AUTH_ERROR.value) == 130404
 
     def test_error_code_in_conditional(self):
         """Test ErrorCode can be used in conditionals."""
diff --git a/test/backend/consts/test_exceptions.py b/test/backend/consts/test_exceptions.py
index 4ec5d0234..8c954aff9 100644
--- a/test/backend/consts/test_exceptions.py
+++ b/test/backend/consts/test_exceptions.py
@@ -44,8 +44,8 @@ def test_app_exception_to_dict(self):
         """Test AppException.to_dict() method."""
         exc = AppException(ErrorCode.DIFY_AUTH_ERROR, "Auth failed", {"key": "value"})
         result = exc.to_dict()
-        
-        assert result["code"] == 130204
+
+        assert result["code"] == "130204"
         assert result["message"] == "Auth failed"
         assert result["details"] == {"key": "value"}
 
@@ -53,7 +53,7 @@ def test_app_exception_to_dict_null_details(self):
         """Test that to_dict() returns null for empty details."""
         exc = AppException(ErrorCode.DIFY_AUTH_ERROR, "Auth failed")
         result = exc.to_dict()
-        
+
         assert result["details"] is None
 
     def test_app_exception_http_status_property(self):
@@ -71,7 +71,7 @@ def test_app_exception_http_status_for_different_codes(self):
             (ErrorCode.COMMON_TOKEN_EXPIRED, 401),
             (ErrorCode.COMMON_FORBIDDEN, 403),
         ]
-        
+
         for error_code, expected_status in test_cases:
             exc = AppException(error_code)
             assert exc.http_status == expected_status, \
diff --git a/test/backend/database/test_attachment_db.py b/test/backend/database/test_attachment_db.py
index 4053877fe..7abdd3a07 100644
--- a/test/backend/database/test_attachment_db.py
+++ b/test/backend/database/test_attachment_db.py
@@ -26,6 +26,14 @@
 boto3_mock = MagicMock()
 sys.modules['boto3'] = boto3_mock
 
+# Mock minio module
+minio_mock = MagicMock()
+minio_commonconfig_mock = MagicMock()
+minio_commonconfig_mock.CopySource = MagicMock()
+minio_mock.commonconfig = minio_commonconfig_mock
+sys.modules['minio'] = minio_mock
+sys.modules['minio.commonconfig'] = minio_commonconfig_mock
+
 # Mock nexent.storage modules
 nexent_mock = MagicMock()
 nexent_storage_mock = MagicMock()
@@ -58,6 +66,8 @@
         download_file,
         get_file_url,
         get_file_size_from_minio,
+        file_exists,
+        copy_file,
         list_files,
         delete_file,
         get_file_stream,
@@ -485,3 +495,82 @@ def test_get_content_type_case_insensitive(self):
         assert get_content_type('test.PNG') == 'image/png'
         assert get_content_type('test.PDF') == 'application/pdf'
 
+
+class TestFileExists:
+    """Test cases for file_exists function"""
+
+    def test_file_exists_returns_true_when_file_exists(self):
+        """Test file_exists returns True when file exists in bucket"""
+        with patch('backend.database.attachment_db.minio_client') as mock_client:
+            mock_client.file_exists.return_value = True
+            
+            result = file_exists('test/file.txt')
+            
+            assert result is True
+            mock_client.file_exists.assert_called_once_with('test/file.txt', None)
+
+    def test_file_exists_returns_false_when_file_not_exists(self):
+        """Test file_exists returns False when file does not exist"""
+        with patch('backend.database.attachment_db.minio_client') as mock_client:
+            mock_client.file_exists.return_value = False
+            
+            result = file_exists('nonexistent/file.txt')
+            
+            assert result is False
+            mock_client.file_exists.assert_called_once_with('nonexistent/file.txt', None)
+
+    def test_file_exists_with_custom_bucket(self):
+        """Test file_exists with custom bucket parameter"""
+        with patch('backend.database.attachment_db.minio_client') as mock_client:
+            mock_client.file_exists.return_value = True
+            
+            result = file_exists('test/file.txt', bucket='custom-bucket')
+            
+            assert result is True
+            mock_client.file_exists.assert_called_once_with('test/file.txt', 'custom-bucket')
+
+    def test_file_exists_handles_any_exception(self):
+        """Test file_exists handles any exception and returns False"""
+        with patch('backend.database.attachment_db.minio_client') as mock_client:
+            mock_client.file_exists.side_effect = RuntimeError('Connection failed')
+            
+            result = file_exists('test/file.txt')
+            
+            assert result is False
+            mock_client.file_exists.assert_called_once_with('test/file.txt', None)
+
+
+class TestCopyFile:
+    """Test cases for copy_file function"""
+
+    def test_copy_file_success(self):
+        """Test successful file copy"""
+        with patch('backend.database.attachment_db.minio_client') as mock_client:
+            mock_client.copy_file.return_value = (True, 'dest/file.pdf')
+            
+            result = copy_file('source/file.pdf', 'dest/file.pdf')
+            
+            assert result['success'] is True
+            assert result['object_name'] == 'dest/file.pdf'
+            mock_client.copy_file.assert_called_once_with('source/file.pdf', 'dest/file.pdf', None)
+
+    def test_copy_file_with_custom_bucket(self):
+        """Test copy_file with custom bucket"""
+        with patch('backend.database.attachment_db.minio_client') as mock_client:
+            mock_client.copy_file.return_value = (True, 'dest/file.pdf')
+            
+            result = copy_file('source/file.pdf', 'dest/file.pdf', bucket='custom-bucket')
+            
+            assert result['success'] is True
+            mock_client.copy_file.assert_called_once_with('source/file.pdf', 'dest/file.pdf', 'custom-bucket')
+
+    def test_copy_file_failure(self):
+        """Test copy_file handles errors"""
+        with patch('backend.database.attachment_db.minio_client') as mock_client:
+            mock_client.copy_file.return_value = (False, 'Copy failed')
+            
+            result = copy_file('source/file.pdf', 'dest/file.pdf')
+            
+            assert result['success'] is False
+            assert 'Copy failed' in result['error']
+
diff --git a/test/backend/database/test_client.py b/test/backend/database/test_client.py
index b11c7f998..9514fb143 100644
--- a/test/backend/database/test_client.py
+++ b/test/backend/database/test_client.py
@@ -346,6 +346,107 @@ def test_minio_client_get_file_stream(self, mock_config_class, mock_create_clien
         mock_storage_client.get_file_stream.assert_called_once_with(
             'file.txt', 'bucket')
 
+    @patch('backend.database.client.create_storage_client_from_config')
+    @patch('backend.database.client.MinIOStorageConfig')
+    def test_minio_client_file_exists_true(self, mock_config_class, mock_create_client):
+        """Test MinioClient.file_exists returns True when file exists"""
+        MinioClient._instance = None
+
+        mock_storage_client = MagicMock()
+        mock_storage_client.exists.return_value = True
+        mock_create_client.return_value = mock_storage_client
+        mock_config_class.return_value = MagicMock()
+
+        client = MinioClient()
+        result = client.file_exists('file.txt', 'bucket')
+
+        assert result is True
+        mock_storage_client.exists.assert_called_once_with('file.txt', 'bucket')
+
+    @patch('backend.database.client.create_storage_client_from_config')
+    @patch('backend.database.client.MinIOStorageConfig')
+    def test_minio_client_file_exists_false(self, mock_config_class, mock_create_client):
+        """Test MinioClient.file_exists returns False when file does not exist"""
+        MinioClient._instance = None
+
+        mock_storage_client = MagicMock()
+        mock_storage_client.exists.return_value = False
+        mock_create_client.return_value = mock_storage_client
+        mock_config_class.return_value = MagicMock()
+
+        client = MinioClient()
+        result = client.file_exists('file.txt', 'bucket')
+
+        assert result is False
+        mock_storage_client.exists.assert_called_once_with('file.txt', 'bucket')
+
+    @patch('backend.database.client.create_storage_client_from_config')
+    @patch('backend.database.client.MinIOStorageConfig')
+    def test_minio_client_copy_file_success(self, mock_config_class, mock_create_client):
+        """Test MinioClient.copy_file successfully copies file"""
+        MinioClient._instance = None
+
+        mock_storage_client = MagicMock()
+        mock_storage_client.copy_file.return_value = (True, 'dest/file.pdf')
+        mock_create_client.return_value = mock_storage_client
+        mock_config = MagicMock()
+        mock_config.default_bucket = 'test-bucket'
+        mock_config_class.return_value = mock_config
+
+        client = MinioClient()
+        success, result = client.copy_file('source/file.pdf', 'dest/file.pdf', 'bucket')
+
+        assert success is True
+        assert result == 'dest/file.pdf'
+        mock_storage_client.copy_file.assert_called_once_with(
+            'source/file.pdf',
+            'dest/file.pdf',
+            'bucket'
+        )
+
+    @patch('backend.database.client.create_storage_client_from_config')
+    @patch('backend.database.client.MinIOStorageConfig')
+    def test_minio_client_copy_file_with_default_bucket(self, mock_config_class, mock_create_client):
+        """Test MinioClient.copy_file uses default bucket when not specified"""
+        MinioClient._instance = None
+
+        mock_storage_client = MagicMock()
+        mock_storage_client.copy_file.return_value = (True, 'dest/file.pdf')
+        mock_create_client.return_value = mock_storage_client
+        mock_config = MagicMock()
+        mock_config.default_bucket = 'default-bucket'
+        mock_config_class.return_value = mock_config
+
+        client = MinioClient()
+        success, result = client.copy_file('source/file.pdf', 'dest/file.pdf')
+
+        assert success is True
+        assert result == 'dest/file.pdf'
+        mock_storage_client.copy_file.assert_called_once_with(
+            'source/file.pdf',
+            'dest/file.pdf',
+            None
+        )
+
+    @patch('backend.database.client.create_storage_client_from_config')
+    @patch('backend.database.client.MinIOStorageConfig')
+    def test_minio_client_copy_file_failure(self, mock_config_class, mock_create_client):
+        """Test MinioClient.copy_file handles errors properly"""
+        MinioClient._instance = None
+
+        mock_storage_client = MagicMock()
+        mock_storage_client.copy_file.return_value = (False, 'Copy failed')
+        mock_create_client.return_value = mock_storage_client
+        mock_config = MagicMock()
+        mock_config.default_bucket = 'test-bucket'
+        mock_config_class.return_value = mock_config
+
+        client = MinioClient()
+        success, result = client.copy_file('source/file.pdf', 'dest/file.pdf')
+
+        assert success is False
+        assert 'Copy failed' in result
+
 
 class TestGetDbSession:
     """Test cases for get_db_session context manager"""
diff --git a/test/backend/database/test_conversation_db.py b/test/backend/database/test_conversation_db.py
index 04a99750f..83a8ef512 100644
--- a/test/backend/database/test_conversation_db.py
+++ b/test/backend/database/test_conversation_db.py
@@ -24,6 +24,9 @@
 client_mod = types.ModuleType("database.client")
 client_mod.get_db_session = MagicMock(name="get_db_session")
 client_mod.as_dict = MagicMock(name="as_dict")
+
+# Add db_client with clean_string_values method to the stub
+client_mod.db_client = MagicMock(name="db_client")
 sys.modules["database.client"] = client_mod
 sys.modules["backend.database.client"] = client_mod
 
@@ -83,7 +86,11 @@ class ConversationSourceImage:
 
 
 # Import module under test after stubbing
-from backend.database.conversation_db import delete_conversation, soft_delete_all_conversations_by_user
+from backend.database.conversation_db import (
+    delete_conversation,
+    rename_conversation,
+    soft_delete_all_conversations_by_user,
+)
 
 
 @pytest.fixture
@@ -152,3 +159,164 @@ def test_delete_conversation_noop(monkeypatch, mock_session_ctx):
 
     assert ok is False
     assert session.execute.call_count == 5
+
+
+# Tests for rename_conversation
+
+
+def test_rename_conversation_success_ascii(monkeypatch, mock_session_ctx):
+    """rename_conversation returns True when conversation rowcount > 0 with ASCII title."""
+    session, ctx = mock_session_ctx
+    conversation_result = MagicMock()
+    conversation_result.rowcount = 1
+    session.execute.return_value = conversation_result
+
+    # Create fresh mock for this test
+    test_db_client = MagicMock(name="db_client_test")
+    test_db_client.clean_string_values = MagicMock(
+        side_effect=lambda data: {k: v for k, v in data.items()}
+    )
+
+    monkeypatch.setattr("backend.database.conversation_db.get_db_session", lambda: ctx)
+    monkeypatch.setattr("backend.database.conversation_db.db_client", test_db_client)
+
+    ok = rename_conversation(123, "New Title", user_id="actor")
+
+    assert ok is True
+    session.execute.assert_called_once()
+    # Verify clean_string_values was called
+    test_db_client.clean_string_values.assert_called_once()
+
+
+def test_rename_conversation_success_chinese(monkeypatch, mock_session_ctx):
+    """rename_conversation returns True when conversation rowcount > 0 with Chinese title."""
+    session, ctx = mock_session_ctx
+    conversation_result = MagicMock()
+    conversation_result.rowcount = 1
+    session.execute.return_value = conversation_result
+
+    # Create fresh mock for this test
+    test_db_client = MagicMock(name="db_client_test")
+    test_db_client.clean_string_values = MagicMock(
+        side_effect=lambda data: {k: v for k, v in data.items()}
+    )
+
+    monkeypatch.setattr("backend.database.conversation_db.get_db_session", lambda: ctx)
+    monkeypatch.setattr("backend.database.conversation_db.db_client", test_db_client)
+
+    ok = rename_conversation(456, "测试会话标题", user_id="user-1")
+
+    assert ok is True
+    session.execute.assert_called_once()
+    test_db_client.clean_string_values.assert_called_once()
+
+
+def test_rename_conversation_success_mixed(monkeypatch, mock_session_ctx):
+    """rename_conversation returns True with mixed ASCII and Chinese characters."""
+    session, ctx = mock_session_ctx
+    conversation_result = MagicMock()
+    conversation_result.rowcount = 1
+    session.execute.return_value = conversation_result
+
+    # Create fresh mock for this test
+    test_db_client = MagicMock(name="db_client_test")
+    test_db_client.clean_string_values = MagicMock(
+        side_effect=lambda data: {k: v for k, v in data.items()}
+    )
+
+    monkeypatch.setattr("backend.database.conversation_db.get_db_session", lambda: ctx)
+    monkeypatch.setattr("backend.database.conversation_db.db_client", test_db_client)
+
+    ok = rename_conversation(789, "Project 项目 Alpha", user_id="developer")
+
+    assert ok is True
+    session.execute.assert_called_once()
+
+
+def test_rename_conversation_not_found(monkeypatch, mock_session_ctx):
+    """rename_conversation returns False when no conversation row affected."""
+    session, ctx = mock_session_ctx
+    conversation_result = MagicMock()
+    conversation_result.rowcount = 0
+    session.execute.return_value = conversation_result
+
+    # Create fresh mock for this test
+    test_db_client = MagicMock(name="db_client_test")
+    test_db_client.clean_string_values = MagicMock(
+        side_effect=lambda data: {k: v for k, v in data.items()}
+    )
+
+    monkeypatch.setattr("backend.database.conversation_db.get_db_session", lambda: ctx)
+    monkeypatch.setattr("backend.database.conversation_db.db_client", test_db_client)
+
+    ok = rename_conversation(999, "Nonexistent Title")
+
+    assert ok is False
+    session.execute.assert_called_once()
+
+
+def test_rename_conversation_without_user_id(monkeypatch, mock_session_ctx):
+    """rename_conversation works without user_id parameter."""
+    session, ctx = mock_session_ctx
+    conversation_result = MagicMock()
+    conversation_result.rowcount = 1
+    session.execute.return_value = conversation_result
+
+    # Create fresh mock for this test
+    test_db_client = MagicMock(name="db_client_test")
+    test_db_client.clean_string_values = MagicMock(
+        side_effect=lambda data: {k: v for k, v in data.items()}
+    )
+
+    monkeypatch.setattr("backend.database.conversation_db.get_db_session", lambda: ctx)
+    monkeypatch.setattr("backend.database.conversation_db.db_client", test_db_client)
+
+    ok = rename_conversation(123, "Title Only")
+
+    assert ok is True
+    session.execute.assert_called_once()
+
+
+def test_rename_conversation_conversation_id_as_string(monkeypatch, mock_session_ctx):
+    """rename_conversation handles conversation_id passed as string."""
+    session, ctx = mock_session_ctx
+    conversation_result = MagicMock()
+    conversation_result.rowcount = 1
+    session.execute.return_value = conversation_result
+
+    # Create fresh mock for this test
+    test_db_client = MagicMock(name="db_client_test")
+    test_db_client.clean_string_values = MagicMock(
+        side_effect=lambda data: {k: v for k, v in data.items()}
+    )
+
+    monkeypatch.setattr("backend.database.conversation_db.get_db_session", lambda: ctx)
+    monkeypatch.setattr("backend.database.conversation_db.db_client", test_db_client)
+
+    ok = rename_conversation("456", "String ID Title")
+
+    assert ok is True
+    session.execute.assert_called_once()
+
+
+def test_rename_conversation_with_emoji(monkeypatch, mock_session_ctx):
+    """rename_conversation handles emoji characters."""
+    session, ctx = mock_session_ctx
+    conversation_result = MagicMock()
+    conversation_result.rowcount = 1
+    session.execute.return_value = conversation_result
+
+    # Create fresh mock for this test
+    test_db_client = MagicMock(name="db_client_test")
+    test_db_client.clean_string_values = MagicMock(
+        side_effect=lambda data: {k: v for k, v in data.items()}
+    )
+
+    monkeypatch.setattr("backend.database.conversation_db.get_db_session", lambda: ctx)
+    monkeypatch.setattr("backend.database.conversation_db.db_client", test_db_client)
+
+    ok = rename_conversation(123, "Hello World 🌍", user_id="user-1")
+
+    assert ok is True
+    session.execute.assert_called_once()
+    test_db_client.clean_string_values.assert_called_once()
diff --git a/test/backend/database/test_token_db.py b/test/backend/database/test_token_db.py
new file mode 100644
index 000000000..d4d273ddb
--- /dev/null
+++ b/test/backend/database/test_token_db.py
@@ -0,0 +1,392 @@
+import sys
+import os
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "../../.."))
+
+import pytest
+from unittest.mock import MagicMock, patch
+
+
+# First mock the consts module to avoid ModuleNotFoundError
+consts_mock = MagicMock()
+consts_mock.const = MagicMock()
+consts_mock.const.MINIO_ENDPOINT = "http://localhost:9000"
+consts_mock.const.MINIO_ACCESS_KEY = "test_access_key"
+consts_mock.const.MINIO_SECRET_KEY = "test_secret_key"
+consts_mock.const.MINIO_REGION = "us-east-1"
+consts_mock.const.MINIO_DEFAULT_BUCKET = "test-bucket"
+consts_mock.const.POSTGRES_HOST = "localhost"
+consts_mock.const.POSTGRES_USER = "test_user"
+consts_mock.const.NEXENT_POSTGRES_PASSWORD = "test_password"
+consts_mock.const.POSTGRES_DB = "test_db"
+consts_mock.const.POSTGRES_PORT = 5432
+consts_mock.const.DEFAULT_TENANT_ID = "default_tenant"
+
+sys.modules['consts'] = consts_mock
+sys.modules['consts.const'] = consts_mock.const
+
+# Mock database client
+client_mock = MagicMock()
+client_mock.MinioClient = MagicMock()
+client_mock.PostgresClient = MagicMock()
+client_mock.db_client = MagicMock()
+client_mock.get_db_session = MagicMock()
+client_mock.as_dict = MagicMock()
+client_mock.filter_property = MagicMock()
+
+sys.modules['database.client'] = client_mock
+sys.modules['backend.database.client'] = client_mock
+
+
+# Create mock classes that work with SQLAlchemy query
+class MockUserTokenInfo:
+    """Mock UserTokenInfo for testing."""
+    _instances = []
+    
+    def __init__(self, token_id=1, access_key="nexent-abc123", user_id="user123",
+                 delete_flag="N", create_time=None, update_time=None, created_by=None, updated_by=None):
+        self.token_id = token_id
+        self.access_key = access_key
+        self.user_id = user_id
+        self.delete_flag = delete_flag
+        self.create_time = create_time
+        self.update_time = update_time
+        self.created_by = created_by or user_id
+        self.updated_by = updated_by or user_id
+        MockUserTokenInfo._instances.append(self)
+    
+    @property
+    def token_id(self):
+        return self._token_id
+    
+    @token_id.setter
+    def token_id(self, value):
+        self._token_id = value
+    
+    @property
+    def user_id(self):
+        return self._user_id
+    
+    @user_id.setter
+    def user_id(self, value):
+        self._user_id = value
+    
+    @property
+    def access_key(self):
+        return self._access_key
+    
+    @access_key.setter
+    def access_key(self, value):
+        self._access_key = value
+    
+    @property
+    def delete_flag(self):
+        return self._delete_flag
+    
+    @delete_flag.setter
+    def delete_flag(self, value):
+        self._delete_flag = value
+    
+    @property
+    def create_time(self):
+        return self._create_time
+    
+    @create_time.setter
+    def create_time(self, value):
+        self._create_time = value
+    
+    @classmethod
+    def reset(cls):
+        cls._instances = []
+
+
+class MockUserTokenUsageLog:
+    """Mock UserTokenUsageLog for testing."""
+    _instances = []
+    
+    def __init__(self, token_usage_id=1, token_id=1, call_function_name="run_chat",
+                 related_id=123, created_by="user123", meta_data=None, create_time=None):
+        self.token_usage_id = token_usage_id
+        self.token_id = token_id
+        self.call_function_name = call_function_name
+        self.related_id = related_id
+        self.created_by = created_by
+        self.meta_data = meta_data
+        self.create_time = create_time
+        MockUserTokenUsageLog._instances.append(self)
+    
+    @classmethod
+    def reset(cls):
+        cls._instances = []
+
+
+# Set class attributes for SQLAlchemy filter operations
+MockUserTokenInfo.token_id = 1
+MockUserTokenInfo.access_key = "test"
+MockUserTokenInfo.user_id = "test"
+MockUserTokenInfo.delete_flag = "N"
+
+# Mock the create_time attribute with a mock that supports .desc()
+class MockColumn:
+    def desc(self):
+        return "desc"
+
+MockUserTokenInfo.create_time = MockColumn()
+
+MockUserTokenUsageLog.token_usage_id = 1
+MockUserTokenUsageLog.token_id = 1
+MockUserTokenUsageLog.call_function_name = "test"
+MockUserTokenUsageLog.related_id = 1
+MockUserTokenUsageLog.create_time = MockColumn()
+
+db_models_mock = MagicMock()
+db_models_mock.UserTokenInfo = MockUserTokenInfo
+db_models_mock.UserTokenUsageLog = MockUserTokenUsageLog
+sys.modules['database.db_models'] = db_models_mock
+sys.modules['backend.database.db_models'] = db_models_mock
+
+# Mock exceptions
+exceptions_mock = MagicMock()
+sys.modules['consts.exceptions'] = exceptions_mock
+sys.modules['backend.consts.exceptions'] = exceptions_mock
+
+# Mock sqlalchemy
+sqlalchemy_mock = MagicMock()
+sqlalchemy_mock.exc.SQLAlchemyError = type("SQLAlchemyError", (Exception,), {})
+sys.modules['sqlalchemy'] = sqlalchemy_mock
+sys.modules['sqlalchemy.exc'] = sqlalchemy_mock.exc
+
+
+# Import the module under test
+from backend.database import token_db
+
+
+class MockQuery:
+    """Mock query object for testing."""
+    def __init__(self, model_class, instances):
+        self._model_class = model_class
+        self._instances = instances
+        self._filters = []
+        self._order_by = None
+
+    def filter(self, *args):
+        self._filters.append(args)
+        return self
+
+    def filter_by(self, **kwargs):
+        self._filters.append(kwargs)
+        return self
+
+    def order_by(self, *args):
+        self._order_by = args
+        return self
+
+    def first(self):
+        # Simple implementation - return first matching instance
+        if not self._instances:
+            return None
+        return self._instances[0] if self._instances else None
+
+    def all(self):
+        return list(self._instances)
+
+
+class MockSession:
+    """Mock database session for testing."""
+    def __init__(self):
+        self.added_objects = []
+        MockUserTokenInfo.reset()
+        MockUserTokenUsageLog.reset()
+        self._tokens = []
+        self._usage_logs = []
+
+    def __enter__(self):
+        return self
+
+    def __exit__(self, exc_type, exc_val, exc_tb):
+        pass
+
+    def add(self, obj):
+        self.added_objects.append(obj)
+        if isinstance(obj, MockUserTokenInfo):
+            obj.token_id = len(self._tokens) + 1
+            self._tokens.append(obj)
+        if isinstance(obj, MockUserTokenUsageLog):
+            obj.token_usage_id = len(self._usage_logs) + 1
+            self._usage_logs.append(obj)
+
+    def flush(self):
+        pass
+
+    def query(self, model_class):
+        if model_class == MockUserTokenInfo:
+            return MockQuery(model_class, self._tokens)
+        if model_class == MockUserTokenUsageLog:
+            return MockQuery(model_class, self._usage_logs)
+        return MockQuery(model_class, [])
+
+
+@pytest.fixture
+def mock_session():
+    """Fixture to provide a mock database session."""
+    return MockSession()
+
+
+@pytest.fixture
+def mock_db_session(mock_session):
+    """Fixture to mock get_db_session."""
+    with patch.object(token_db, 'get_db_session', return_value=mock_session):
+        yield mock_session
+
+
+class TestGenerateAccessKey:
+    """Tests for generate_access_key function."""
+
+    def test_generate_access_key_format(self):
+        """Test that generated access key has correct format."""
+        key = token_db.generate_access_key()
+        assert key.startswith("nexent-")
+        assert len(key) > len("nexent-")
+
+    def test_generate_access_key_unique(self):
+        """Test that generated access keys are unique."""
+        keys = [token_db.generate_access_key() for _ in range(10)]
+        assert len(set(keys)) == 10
+
+
+class TestCreateToken:
+    """Tests for create_token function."""
+
+    def test_create_token_success(self, mock_db_session):
+        """Test successful token creation."""
+        result = token_db.create_token("nexent-test123", "user123")
+
+        assert result["token_id"] is not None
+        assert result["access_key"] == "nexent-test123"
+        assert result["user_id"] == "user123"
+        assert len(mock_db_session.added_objects) == 1
+
+
+class TestListTokensByUser:
+    """Tests for list_tokens_by_user function."""
+
+    def test_list_tokens_by_user_success(self, mock_db_session):
+        """Test successful token listing."""
+        # Add some tokens
+        token1 = MockUserTokenInfo(token_id=1, access_key="nexent-key1", user_id="user123")
+        token2 = MockUserTokenInfo(token_id=2, access_key="nexent-key2", user_id="user123")
+        mock_db_session._tokens.extend([token1, token2])
+
+        result = token_db.list_tokens_by_user("user123")
+
+        assert len(result) >= 1
+
+    def test_list_tokens_by_user_empty(self, mock_db_session):
+        """Test listing tokens when user has none."""
+        result = token_db.list_tokens_by_user("user_nonexistent")
+        assert isinstance(result, list)
+
+
+class TestGetTokenById:
+    """Tests for get_token_by_id function."""
+
+    def test_get_token_by_id_success(self, mock_db_session):
+        """Test successful token retrieval by ID."""
+        token = MockUserTokenInfo(token_id=1, access_key="nexent-key1", user_id="user123")
+        mock_db_session._tokens.append(token)
+
+        result = token_db.get_token_by_id(1)
+        assert result is not None
+
+    def test_get_token_by_id_not_found(self, mock_db_session):
+        """Test token retrieval with non-existent ID."""
+        result = token_db.get_token_by_id(999)
+        assert result is None
+
+
+class TestGetTokenByAccessKey:
+    """Tests for get_token_by_access_key function."""
+
+    def test_get_token_by_access_key_success(self, mock_db_session):
+        """Test successful token retrieval by access key."""
+        token = MockUserTokenInfo(token_id=1, access_key="nexent-key1", user_id="user123", delete_flag="N")
+        mock_db_session._tokens.append(token)
+
+        result = token_db.get_token_by_access_key("nexent-key1")
+        assert result is not None
+        assert result["access_key"] == "nexent-key1"
+        assert result["user_id"] == "user123"
+
+    def test_get_token_by_access_key_not_found(self, mock_db_session):
+        """Test token retrieval with non-existent access key."""
+        result = token_db.get_token_by_access_key("nexent-nonexistent")
+        assert result is None
+
+
+class TestDeleteToken:
+    """Tests for delete_token function."""
+
+    def test_delete_token_success(self, mock_db_session):
+        """Test successful token deletion."""
+        token = MockUserTokenInfo(token_id=1, access_key="nexent-key1", user_id="user123", delete_flag="N")
+        mock_db_session._tokens.append(token)
+
+        result = token_db.delete_token(1, "user123")
+        assert result is True
+        assert token.delete_flag == "Y"
+
+    def test_delete_token_not_found(self, mock_db_session):
+        """Test deletion of non-existent token."""
+        result = token_db.delete_token(999, "user123")
+        assert result is False
+
+
+class TestLogTokenUsage:
+    """Tests for log_token_usage function."""
+
+    def test_log_token_usage_success(self, mock_db_session):
+        """Test successful token usage logging."""
+        result = token_db.log_token_usage(
+            token_id=1,
+            call_function_name="run_chat",
+            related_id=123,
+            created_by="user123",
+            metadata={"query": "test"}
+        )
+
+        assert result is not None
+        assert len(mock_db_session.added_objects) == 1
+
+    def test_log_token_usage_without_metadata(self, mock_db_session):
+        """Test token usage logging without metadata."""
+        result = token_db.log_token_usage(
+            token_id=1,
+            call_function_name="get_agent_info_list",
+            related_id=None,
+            created_by="user123"
+        )
+
+        assert result is not None
+
+
+class TestGetLatestUsageMetadata:
+    """Tests for get_latest_usage_metadata function."""
+
+    def test_get_latest_usage_metadata_success(self, mock_db_session):
+        """Test successful metadata retrieval."""
+        usage_log = MockUserTokenUsageLog(
+            token_usage_id=1,
+            token_id=1,
+            call_function_name="run_chat",
+            related_id=123,
+            meta_data={"query": "test query"}
+        )
+        mock_db_session._usage_logs.append(usage_log)
+
+        result = token_db.get_latest_usage_metadata(1, 123, "run_chat")
+        assert result is not None
+        assert result["query"] == "test query"
+
+    def test_get_latest_usage_metadata_not_found(self, mock_db_session):
+        """Test metadata retrieval with no matching records."""
+        result = token_db.get_latest_usage_metadata(999, 999, "nonexistent")
+        assert result is None
diff --git a/test/backend/database/test_tool_db.py b/test/backend/database/test_tool_db.py
index 604997187..1eeb9fceb 100644
--- a/test/backend/database/test_tool_db.py
+++ b/test/backend/database/test_tool_db.py
@@ -18,14 +18,38 @@
 consts_mock.const.POSTGRES_PORT = 5432
 consts_mock.const.DEFAULT_TENANT_ID = "default_tenant"
 
+# Mock consts.model module and ToolSourceEnum
+# Create a mock ToolSourceEnum that supports .value attribute access
+
+class MockEnumMember:
+    def __init__(self, value):
+        self.value = value
+
+
+class MockToolSourceEnum:
+    LOCAL = MockEnumMember("local")
+    MCP = MockEnumMember("mcp")
+    LANGCHAIN = MockEnumMember("langchain")
+
+# Create consts.model as a proper module-like object
+
+
+class MockModelModule:
+    ToolSourceEnum = MockToolSourceEnum
+
+
+consts_mock.model = MockModelModule()
+
 # Add the mocked consts module to sys.modules
 sys.modules['consts'] = consts_mock
 sys.modules['consts.const'] = consts_mock.const
+sys.modules['consts.model'] = consts_mock.model
 
 # Mock utils module
 utils_mock = MagicMock()
 utils_mock.auth_utils = MagicMock()
-utils_mock.auth_utils.get_current_user_id_from_token = MagicMock(return_value="test_user_id")
+utils_mock.auth_utils.get_current_user_id_from_token = MagicMock(
+    return_value="test_user_id")
 
 # Add the mocked utils module to sys.modules
 sys.modules['utils'] = utils_mock
@@ -103,6 +127,7 @@ def __init__(self):
             "delete_flag": "N"
         }
 
+
 class MockToolInfo:
     def __init__(self):
         self.tool_id = 1
@@ -132,6 +157,7 @@ def __init__(self):
             "class_name": "TestTool"
         }
 
+
 @pytest.fixture
 def mock_session():
     """Create a mock database session"""
@@ -140,6 +166,7 @@ def mock_session():
     mock_session.query.return_value = mock_query
     return mock_session, mock_query
 
+
 def test_create_tool_success(monkeypatch, mock_session):
     """Test successful tool creation"""
     session, query = mock_session
@@ -148,15 +175,19 @@ def test_create_tool_success(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.filter_property", lambda data, model: data)
-    monkeypatch.setattr("backend.database.tool_db.ToolInstance", lambda **kwargs: MagicMock())
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+    monkeypatch.setattr("backend.database.tool_db.ToolInstance",
+                        lambda **kwargs: MagicMock())
 
     tool_info = {"tool_id": 1, "agent_id": 1, "tenant_id": "tenant1"}
     create_tool(tool_info)
 
     session.add.assert_called_once()
 
+
 def test_create_or_update_tool_by_tool_info_update_existing(monkeypatch, mock_session):
     """Test updating an existing tool instance"""
     session, query = mock_session
@@ -171,7 +202,8 @@ def test_create_or_update_tool_by_tool_info_update_existing(monkeypatch, mock_se
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     tool_info = MagicMock()
     tool_info.__dict__ = {"agent_id": 1, "tool_id": 1}
@@ -180,6 +212,7 @@ def test_create_or_update_tool_by_tool_info_update_existing(monkeypatch, mock_se
 
     assert result == mock_tool_instance
 
+
 def test_create_or_update_tool_by_tool_info_create_new(monkeypatch, mock_session):
     """Test creating a new tool instance"""
     session, query = mock_session
@@ -192,15 +225,46 @@ def test_create_or_update_tool_by_tool_info_create_new(monkeypatch, mock_session
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.create_tool", MagicMock())
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Mock ToolInstance class - needs to have column attributes for query building
+    mock_tool_instance = MockToolInstance()
+
+    # Create a Mock class that can be used both as a class (for query) and instantiated
+    class MockToolInstanceClass:
+        tenant_id = MagicMock()
+        agent_id = MagicMock()
+        tool_id = MagicMock()
+        delete_flag = MagicMock()
+        version_no = MagicMock()
+
+        def __init__(self, **kwargs):
+            # Copy attributes from mock_tool_instance
+            for key, value in mock_tool_instance.__dict__.items():
+                setattr(self, key, value)
+            # Update with any kwargs passed
+            for key, value in kwargs.items():
+                setattr(self, key, value)
+
+    monkeypatch.setattr(
+        "backend.database.tool_db.ToolInstance", MockToolInstanceClass)
+
+    session.add = MagicMock()
+    session.flush = MagicMock()
 
     tool_info = MagicMock()
     tool_info.__dict__ = {"agent_id": 1, "tool_id": 1}
 
     result = create_or_update_tool_by_tool_info(tool_info, "tenant1", "user1")
 
-    assert result is None
+    assert isinstance(result, MockToolInstanceClass)
+    session.add.assert_called_once()
+    session.flush.assert_called_once()
+
+
 
 def test_query_all_tools(monkeypatch, mock_session):
     """Test querying all tools"""
@@ -216,8 +280,10 @@ def test_query_all_tools(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = query_all_tools("tenant1")
 
@@ -225,6 +291,7 @@ def test_query_all_tools(monkeypatch, mock_session):
     assert result[0]["tool_id"] == 1
     assert result[0]["name"] == "test_tool"
 
+
 def test_query_tool_instances_by_id_found(monkeypatch, mock_session):
     """Test successfully querying tool instances"""
     session, query = mock_session
@@ -239,14 +306,17 @@ def test_query_tool_instances_by_id_found(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = query_tool_instances_by_id(1, 1, "tenant1")
 
     assert result["tool_instance_id"] == 1
     assert result["tool_id"] == 1
 
+
 def test_query_tool_instances_by_id_not_found(monkeypatch, mock_session):
     """Test querying non-existent tool instances"""
     session, query = mock_session
@@ -259,12 +329,14 @@ def test_query_tool_instances_by_id_not_found(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     result = query_tool_instances_by_id(1, 1, "tenant1")
 
     assert result is None
 
+
 def test_query_tools_by_ids(monkeypatch, mock_session):
     """Test querying tools by ID list"""
     session, query = mock_session
@@ -281,14 +353,17 @@ def test_query_tools_by_ids(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = query_tools_by_ids([1, 2])
 
     assert len(result) == 1
     assert result[0]["tool_id"] == 1
 
+
 def test_query_all_enabled_tool_instances(monkeypatch, mock_session):
     """Test querying all enabled tool instances"""
     session, query = mock_session
@@ -303,14 +378,17 @@ def test_query_all_enabled_tool_instances(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = query_all_enabled_tool_instances(1, "tenant1")
 
     assert len(result) == 1
     assert result[0]["tool_instance_id"] == 1
 
+
 def test_update_tool_table_from_scan_tool_list_success(monkeypatch, mock_session):
     """Test successfully updating tool table"""
     session, query = mock_session
@@ -327,8 +405,10 @@ def test_update_tool_table_from_scan_tool_list_success(monkeypatch, mock_session
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.filter_property", lambda data, model: data)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
 
     # Create a mock for ToolInfo class with properly accessible attributes
     mock_tool_info_class = MagicMock()
@@ -336,13 +416,15 @@ def test_update_tool_table_from_scan_tool_list_success(monkeypatch, mock_session
     mock_tool_info_class.author = "tenant1"
     mock_tool_info_class.name = "test_tool"
     mock_tool_info_class.source = "test_source"
-    monkeypatch.setattr("backend.database.tool_db.ToolInfo", mock_tool_info_class)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
 
     tool_list = [MockToolInfo()]
     update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
 
     # Function executes successfully without throwing exceptions
 
+
 def test_update_tool_table_from_scan_tool_list_create_new_tool(monkeypatch, mock_session):
     """Test creating new tool when tool doesn't exist in database"""
     session, query = mock_session
@@ -363,13 +445,16 @@ def test_update_tool_table_from_scan_tool_list_create_new_tool(monkeypatch, mock
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.filter_property", lambda data, model: data)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
 
     # Create a mock for ToolInfo class constructor
     mock_tool_info_instance = MagicMock()
     mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
-    monkeypatch.setattr("backend.database.tool_db.ToolInfo", mock_tool_info_class)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
 
     # Create a new tool with different name&source that doesn't exist in database
     new_tool = MockToolInfo()
@@ -391,6 +476,7 @@ def test_update_tool_table_from_scan_tool_list_create_new_tool(monkeypatch, mock
     })
     mock_tool_info_class.assert_called_once_with(**expected_call_args)
 
+
 def test_update_tool_table_from_scan_tool_list_create_new_tool_invalid_name(monkeypatch, mock_session):
     """Test creating new tool with invalid name (is_available=False)"""
     session, query = mock_session
@@ -411,13 +497,16 @@ def test_update_tool_table_from_scan_tool_list_create_new_tool_invalid_name(monk
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.filter_property", lambda data, model: data)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
 
     # Create a mock for ToolInfo class constructor
     mock_tool_info_instance = MagicMock()
     mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
-    monkeypatch.setattr("backend.database.tool_db.ToolInfo", mock_tool_info_class)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
 
     # Create a new tool with invalid name (contains special characters)
     new_tool = MockToolInfo()
@@ -439,6 +528,466 @@ def test_update_tool_table_from_scan_tool_list_create_new_tool_invalid_name(monk
     })
     mock_tool_info_class.assert_called_once_with(**expected_call_args)
 
+
+def test_update_tool_table_mcp_tools_same_name_different_usage(monkeypatch, mock_session):
+    """Test MCP tools with same name but different usage (MCP server) should be treated as different tools"""
+    session, query = mock_session
+
+    # Mock existing tools - one MCP tool from server1
+    existing_tool = MockToolInfo()
+    existing_tool.name = "get_tickets"
+    existing_tool.source = "mcp"
+    existing_tool.usage = "mcp_server_1"
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a mock for ToolInfo class constructor
+    mock_tool_info_instance = MagicMock()
+    mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
+
+    # Create a new MCP tool with same name but different usage (different MCP server)
+    new_tool = MockToolInfo()
+    new_tool.name = "get_tickets"
+    new_tool.source = "mcp"
+    new_tool.usage = "mcp_server_2"  # Different MCP server
+    tool_list = [new_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was called to add the new tool (different usage = different tool)
+    session.add.assert_called_once_with(mock_tool_info_instance)
+    # Verify that ToolInfo constructor was called with correct parameters
+    expected_call_args = new_tool.__dict__.copy()
+    expected_call_args.update({
+        "created_by": "user1",
+        "updated_by": "user1",
+        "author": "tenant1",
+        "is_available": True
+    })
+    mock_tool_info_class.assert_called_once_with(**expected_call_args)
+
+
+def test_update_tool_table_mcp_tools_same_name_same_usage(monkeypatch, mock_session):
+    """Test MCP tools with same name and same usage should update existing tool"""
+    session, query = mock_session
+
+    # Mock existing MCP tool
+    existing_tool = MockToolInfo()
+    existing_tool.name = "get_tickets"
+    existing_tool.source = "mcp"
+    existing_tool.usage = "mcp_server_1"
+    existing_tool.description = "old description"
+    existing_tool.is_available = True
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a new MCP tool with same name and same usage (should update existing)
+    new_tool = MockToolInfo()
+    new_tool.name = "get_tickets"
+    new_tool.source = "mcp"
+    new_tool.usage = "mcp_server_1"  # Same MCP server
+    new_tool.description = "new description"
+    tool_list = [new_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was NOT called (tool should be updated, not created)
+    session.add.assert_not_called()
+    # Verify that existing tool was updated
+    assert existing_tool.description == "new description"
+    assert existing_tool.updated_by == "user1"
+    assert existing_tool.is_available is True
+
+
+def test_update_tool_table_mcp_tools_empty_usage(monkeypatch, mock_session):
+    """Test MCP tools with empty/null usage should be handled correctly"""
+    session, query = mock_session
+
+    # Mock existing MCP tool with empty usage
+    existing_tool = MockToolInfo()
+    existing_tool.name = "get_tickets"
+    existing_tool.source = "mcp"
+    existing_tool.usage = None  # Empty usage
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a mock for ToolInfo class constructor
+    mock_tool_info_instance = MagicMock()
+    mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
+
+    # Create a new MCP tool with same name and empty usage (should update existing)
+    new_tool = MockToolInfo()
+    new_tool.name = "get_tickets"
+    new_tool.source = "mcp"
+    new_tool.usage = ""  # Empty usage (same as None)
+    tool_list = [new_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was NOT called (tool should be updated, not created)
+    session.add.assert_not_called()
+    # Verify that existing tool was updated
+    assert existing_tool.updated_by == "user1"
+
+
+def test_update_tool_table_non_mcp_tools_use_name_source(monkeypatch, mock_session):
+    """Test non-MCP tools should still use name&source as unique key"""
+    session, query = mock_session
+
+    # Mock existing non-MCP tool
+    existing_tool = MockToolInfo()
+    existing_tool.name = "test_tool"
+    existing_tool.source = "local"
+    existing_tool.usage = "some_usage"  # Usage should be ignored for non-MCP tools
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a new non-MCP tool with same name and source but different usage
+    new_tool = MockToolInfo()
+    new_tool.name = "test_tool"
+    new_tool.source = "local"
+    # Different usage, but should still match existing tool
+    new_tool.usage = "different_usage"
+    tool_list = [new_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was NOT called (tool should be updated, not created)
+    # because non-MCP tools use name&source as unique key, ignoring usage
+    session.add.assert_not_called()
+    # Verify that existing tool was updated
+    assert existing_tool.updated_by == "user1"
+
+
+def test_update_tool_table_mcp_tools_multiple_different_servers(monkeypatch, mock_session):
+    """Test multiple MCP tools from different servers with same name should all be created"""
+    session, query = mock_session
+
+    # Mock existing MCP tool from server1
+    existing_tool = MockToolInfo()
+    existing_tool.name = "get_tickets"
+    existing_tool.source = "mcp"
+    existing_tool.usage = "mcp_server_1"
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a mock for ToolInfo class constructor
+    mock_tool_info_instance = MagicMock()
+    mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
+
+    # Create two new MCP tools with same name but different usage (different servers)
+    new_tool1 = MockToolInfo()
+    new_tool1.name = "get_tickets"
+    new_tool1.source = "mcp"
+    new_tool1.usage = "mcp_server_2"  # Different server
+
+    new_tool2 = MockToolInfo()
+    new_tool2.name = "get_tickets"
+    new_tool2.source = "mcp"
+    new_tool2.usage = "mcp_server_3"  # Another different server
+
+    tool_list = [new_tool1, new_tool2]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was called twice (one for each new tool)
+    assert session.add.call_count == 2
+
+
+def test_update_tool_table_mixed_mcp_and_non_mcp_tools(monkeypatch, mock_session):
+    """Test mixed scenario with both MCP and non-MCP tools"""
+    session, query = mock_session
+
+    # Mock existing tools: one MCP tool and one non-MCP tool
+    existing_mcp_tool = MockToolInfo()
+    existing_mcp_tool.name = "get_tickets"
+    existing_mcp_tool.source = "mcp"
+    existing_mcp_tool.usage = "mcp_server_1"
+
+    existing_local_tool = MockToolInfo()
+    existing_local_tool.name = "local_tool"
+    existing_local_tool.source = "local"
+    existing_local_tool.usage = "some_usage"
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_mcp_tool, existing_local_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a mock for ToolInfo class constructor
+    mock_tool_info_instance = MagicMock()
+    mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
+
+    # Create tools: update existing MCP tool, update existing local tool, create new MCP tool
+    update_mcp_tool = MockToolInfo()
+    update_mcp_tool.name = "get_tickets"
+    update_mcp_tool.source = "mcp"
+    update_mcp_tool.usage = "mcp_server_1"  # Same as existing, should update
+
+    update_local_tool = MockToolInfo()
+    update_local_tool.name = "local_tool"
+    update_local_tool.source = "local"  # Same as existing, should update
+
+    new_mcp_tool = MockToolInfo()
+    new_mcp_tool.name = "get_tickets"
+    new_mcp_tool.source = "mcp"
+    new_mcp_tool.usage = "mcp_server_2"  # Different server, should create
+
+    tool_list = [update_mcp_tool, update_local_tool, new_mcp_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was called once (only for the new MCP tool)
+    assert session.add.call_count == 1
+    # Verify that existing tools were updated
+    assert existing_mcp_tool.updated_by == "user1"
+    assert existing_local_tool.updated_by == "user1"
+
+
+def test_update_tool_table_mcp_tool_update_existing_attributes(monkeypatch, mock_session):
+    """Test that updating existing MCP tool properly updates all attributes"""
+    session, query = mock_session
+
+    # Mock existing MCP tool
+    existing_tool = MockToolInfo()
+    existing_tool.name = "get_tickets"
+    existing_tool.source = "mcp"
+    existing_tool.usage = "mcp_server_1"
+    existing_tool.description = "old description"
+    existing_tool.params = [{"name": "old_param"}]
+    existing_tool.is_available = True
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create updated MCP tool with same name and usage
+    updated_tool = MockToolInfo()
+    updated_tool.name = "get_tickets"
+    updated_tool.source = "mcp"
+    updated_tool.usage = "mcp_server_1"
+    updated_tool.description = "new description"
+    updated_tool.params = [{"name": "new_param"}]
+    tool_list = [updated_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was NOT called (tool should be updated, not created)
+    session.add.assert_not_called()
+    # Verify that existing tool attributes were updated
+    assert existing_tool.description == "new description"
+    assert existing_tool.params == [{"name": "new_param"}]
+    assert existing_tool.updated_by == "user1"
+    assert existing_tool.is_available is True
+
+
+def test_update_tool_table_existing_tools_set_unavailable(monkeypatch, mock_session):
+    """Test that all existing tools are set to unavailable before processing tool list"""
+    session, query = mock_session
+
+    # Mock multiple existing tools
+    existing_tool1 = MockToolInfo()
+    existing_tool1.name = "tool1"
+    existing_tool1.source = "local"
+    existing_tool1.is_available = True
+
+    existing_tool2 = MockToolInfo()
+    existing_tool2.name = "get_tickets"
+    existing_tool2.source = "mcp"
+    existing_tool2.usage = "mcp_server_1"
+    existing_tool2.is_available = True
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool1, existing_tool2]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a mock for ToolInfo class constructor
+    mock_tool_info_instance = MagicMock()
+    mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
+
+    # Create tool list with only one tool (tool2 will be updated, tool1 will remain unavailable)
+    updated_tool = MockToolInfo()
+    updated_tool.name = "get_tickets"
+    updated_tool.source = "mcp"
+    updated_tool.usage = "mcp_server_1"
+    tool_list = [updated_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that existing_tool1 is set to unavailable (not in tool_list)
+    assert existing_tool1.is_available is False
+    # Verify that existing_tool2 is set to available (updated from tool_list)
+    assert existing_tool2.is_available is True
+
+
+def test_update_tool_table_mcp_tool_invalid_name(monkeypatch, mock_session):
+    """Test MCP tool with invalid name should set is_available=False"""
+    session, query = mock_session
+
+    # Mock existing tools
+    existing_tool = MockToolInfo()
+    existing_tool.name = "existing_tool"
+    existing_tool.source = "local"
+
+    mock_all = MagicMock()
+    mock_all.return_value = [existing_tool]
+    mock_filter = MagicMock()
+    mock_filter.all = mock_all
+    query.filter.return_value = mock_filter
+
+    session.add = MagicMock()
+
+    mock_ctx = MagicMock()
+    mock_ctx.__enter__.return_value = session
+    mock_ctx.__exit__.return_value = None
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.filter_property", lambda data, model: data)
+
+    # Create a mock for ToolInfo class constructor
+    mock_tool_info_instance = MagicMock()
+    mock_tool_info_class = MagicMock(return_value=mock_tool_info_instance)
+    monkeypatch.setattr("backend.database.tool_db.ToolInfo",
+                        mock_tool_info_class)
+
+    # Create a new MCP tool with invalid name (contains special characters)
+    new_tool = MockToolInfo()
+    new_tool.name = "invalid-tool-name!"  # Contains dash and exclamation mark
+    new_tool.source = "mcp"
+    new_tool.usage = "mcp_server_1"
+    tool_list = [new_tool]
+
+    update_tool_table_from_scan_tool_list("tenant1", "user1", tool_list)
+
+    # Verify that session.add was called to add the new tool
+    session.add.assert_called_once_with(mock_tool_info_instance)
+    # Verify that ToolInfo constructor was called with is_available=False for invalid name
+    expected_call_args = new_tool.__dict__.copy()
+    expected_call_args.update({
+        "created_by": "user1",
+        "updated_by": "user1",
+        "author": "tenant1",
+        "is_available": False  # Should be False for invalid tool name
+    })
+    mock_tool_info_class.assert_called_once_with(**expected_call_args)
+
+
 def test_add_tool_field(monkeypatch, mock_session):
     """Test adding tool field"""
     session, query = mock_session
@@ -453,8 +1002,10 @@ def test_add_tool_field(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     tool_info = {"tool_id": 1, "params": {"param1": "value1"}}
     result = add_tool_field(tool_info)
@@ -463,6 +1014,7 @@ def test_add_tool_field(monkeypatch, mock_session):
     assert result["description"] == "test description"
     assert result["source"] == "test_source"
 
+
 def test_search_tools_for_sub_agent(monkeypatch, mock_session):
     """Test searching tools for sub-agent"""
     session, query = mock_session
@@ -477,15 +1029,19 @@ def test_search_tools_for_sub_agent(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
-    monkeypatch.setattr("backend.database.tool_db.add_tool_field", lambda data: data)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.add_tool_field", lambda data: data)
 
     result = search_tools_for_sub_agent(1, "tenant1")
 
     assert len(result) == 1
     assert result[0]["tool_instance_id"] == 1
 
+
 def test_check_tool_is_available(monkeypatch, mock_session):
     """Test checking if tool is available"""
     session, query = mock_session
@@ -499,12 +1055,14 @@ def test_check_tool_is_available(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     result = check_tool_is_available([1, 2])
 
     assert result == [True]
 
+
 def test_delete_tools_by_agent_id_success(monkeypatch, mock_session):
     """Test successfully deleting agent's tools"""
     session, query = mock_session
@@ -516,7 +1074,8 @@ def test_delete_tools_by_agent_id_success(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     # Function returns no value, only verify successful execution
     delete_tools_by_agent_id(1, "tenant1", "user1")
@@ -542,8 +1101,10 @@ def test_search_last_tool_instance_by_tool_id_found(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = search_last_tool_instance_by_tool_id(1, "tenant1", "user1")
 
@@ -551,6 +1112,7 @@ def test_search_last_tool_instance_by_tool_id_found(monkeypatch, mock_session):
     assert result["tool_id"] == 1
     assert result["params"] == {"param1": "value1", "param2": "value2"}
 
+
 def test_search_last_tool_instance_by_tool_id_not_found(monkeypatch, mock_session):
     """Test searching for non-existent last tool instance"""
     session, query = mock_session
@@ -565,12 +1127,14 @@ def test_search_last_tool_instance_by_tool_id_not_found(monkeypatch, mock_sessio
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     result = search_last_tool_instance_by_tool_id(999, "tenant1", "user1")
 
     assert result is None
 
+
 def test_search_last_tool_instance_by_tool_id_with_deleted_flag(monkeypatch, mock_session):
     """Test searching for tool instance with deleted flag filter"""
     session, query = mock_session
@@ -588,8 +1152,10 @@ def test_search_last_tool_instance_by_tool_id_with_deleted_flag(monkeypatch, moc
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = search_last_tool_instance_by_tool_id(1, "tenant1", "user1")
 
@@ -597,6 +1163,7 @@ def test_search_last_tool_instance_by_tool_id_with_deleted_flag(monkeypatch, moc
     # Verify that the filter was called with correct parameters
     assert query.filter.call_count == 1
 
+
 def test_search_last_tool_instance_by_tool_id_ordering(monkeypatch, mock_session):
     """Test that results are ordered by update_time desc"""
     session, query = mock_session
@@ -613,8 +1180,10 @@ def test_search_last_tool_instance_by_tool_id_ordering(monkeypatch, mock_session
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = search_last_tool_instance_by_tool_id(1, "tenant1", "user1")
 
@@ -622,6 +1191,7 @@ def test_search_last_tool_instance_by_tool_id_ordering(monkeypatch, mock_session
     mock_filter.order_by.assert_called_once()
     assert result is not None
 
+
 def test_search_last_tool_instance_by_tool_id_different_tenants(monkeypatch, mock_session):
     """Test searching with different tenant and user IDs"""
     session, query = mock_session
@@ -640,8 +1210,10 @@ def test_search_last_tool_instance_by_tool_id_different_tenants(monkeypatch, moc
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = search_last_tool_instance_by_tool_id(1, "tenant2", "user2")
 
@@ -665,8 +1237,10 @@ def test_query_tool_instances_by_agent_id(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = query_tool_instances_by_agent_id(agent_id=1, tenant_id="tenant1")
 
@@ -687,8 +1261,10 @@ def test_query_tool_instances_by_agent_id_empty(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
     result = query_tool_instances_by_agent_id(agent_id=1, tenant_id="tenant1")
 
@@ -709,10 +1285,13 @@ def test_query_tool_instances_by_agent_id_with_version(monkeypatch, mock_session
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
-    monkeypatch.setattr("backend.database.tool_db.as_dict", lambda obj: obj.__dict__)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr("backend.database.tool_db.as_dict",
+                        lambda obj: obj.__dict__)
 
-    result = query_tool_instances_by_agent_id(agent_id=1, tenant_id="tenant1", version_no=2)
+    result = query_tool_instances_by_agent_id(
+        agent_id=1, tenant_id="tenant1", version_no=2)
 
     assert len(result) == 1
     assert result[0]["tool_id"] == 1
@@ -730,7 +1309,8 @@ def test_check_tool_list_initialized_has_tools(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     result = check_tool_list_initialized("tenant1")
 
@@ -750,7 +1330,8 @@ def test_check_tool_list_initialized_no_tools(monkeypatch, mock_session):
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     result = check_tool_list_initialized("new_tenant")
 
@@ -770,7 +1351,8 @@ def test_check_tool_list_initialized_with_deleted_tools_only(monkeypatch, mock_s
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     result = check_tool_list_initialized("tenant_with_only_deleted_tools")
 
@@ -789,7 +1371,8 @@ def test_check_tool_list_initialized_correct_tenant_filter(monkeypatch, mock_ses
     mock_ctx = MagicMock()
     mock_ctx.__enter__.return_value = session
     mock_ctx.__exit__.return_value = None
-    monkeypatch.setattr("backend.database.tool_db.get_db_session", lambda: mock_ctx)
+    monkeypatch.setattr(
+        "backend.database.tool_db.get_db_session", lambda: mock_ctx)
 
     target_tenant = "specific_tenant_id"
     check_tool_list_initialized(target_tenant)
diff --git a/test/backend/middleware/test_exception_handler.py b/test/backend/middleware/test_exception_handler.py
index 0b2bfc865..0b234ef4b 100644
--- a/test/backend/middleware/test_exception_handler.py
+++ b/test/backend/middleware/test_exception_handler.py
@@ -412,8 +412,7 @@ def test_error_response_contains_code_as_int(self):
         import json
         body = json.loads(response.body)
         assert "code" in body
-        # Code should be integer when converted (string "130204" -> int 130204)
-        assert body["code"] == 130204
+        assert body["code"] == "130204"
 
     def test_error_response_contains_message(self):
         """Test that error response contains message."""
@@ -516,7 +515,7 @@ def test_to_dict_contains_code(self):
         """Test that to_dict contains code as integer."""
         exc = AppException(ErrorCode.DIFY_AUTH_ERROR, "Auth failed")
         result = exc.to_dict()
-        assert result["code"] == 130204
+        assert result["code"] == "130204"
 
     def test_to_dict_contains_message(self):
         """Test that to_dict contains message."""
diff --git a/test/backend/services/providers/test_dashscope_provider.py b/test/backend/services/providers/test_dashscope_provider.py
new file mode 100644
index 000000000..0bc2d3ad8
--- /dev/null
+++ b/test/backend/services/providers/test_dashscope_provider.py
@@ -0,0 +1,669 @@
+"""Unit tests for DashScopeModelProvider module.
+
+Tests cover model fetching, type classification, and error handling.
+"""
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, patch, Mock
+from pytest_mock import MockFixture
+
+import httpx
+
+from backend.services.providers.dashscope_provider import DashScopeModelProvider
+
+
+class TestDashScopeModelProvider:
+    """Tests for DashScopeModelProvider class."""
+
+    def _setup_mock_client(self, mocker, mock_response):
+        """Set up mock for httpx.AsyncClient with proper context manager."""
+        # Create mock client that handles the get request
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        # Create context manager mock
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        # Create a mock class that can be called with verify=False
+        mock_client_class = Mock(return_value=mock_cm)
+        
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.httpx.AsyncClient",
+            mock_client_class
+        )
+        
+        return mock_client_class
+
+    @pytest.mark.asyncio
+    async def test_get_models_llm_success(self, mocker: MockFixture):
+        """Test successful model retrieval for LLM models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "qwen-turbo",
+                        "description": "Text generation model",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    },
+                    {
+                        "model": "qwen-plus",
+                        "description": "Advanced text generation",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DEFAULT_LLM_MAX_TOKENS",
+            4096
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 2
+        assert result[0]["id"] == "qwen-turbo"
+        assert result[0]["model_type"] == "llm"
+        assert result[0]["model_tag"] == "chat"
+        assert result[0]["max_tokens"] == 4096
+
+    @pytest.mark.asyncio
+    async def test_get_models_embedding_success(self, mocker: MockFixture):
+        """Test successful model retrieval for embedding models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "text-embedding-v3",
+                        "description": "Embedding model",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "embedding",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "text-embedding-v3"
+        assert result[0]["model_type"] == "embedding"
+        assert result[0]["model_tag"] == "embedding"
+
+    @pytest.mark.asyncio
+    async def test_get_models_vlm_success(self, mocker: MockFixture):
+        """Test successful model retrieval for VLM models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "qwen-vl-plus",
+                        "description": "Vision language model",
+                        "inference_metadata": {
+                            "request_modality": ["Image", "Text"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "vlm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "qwen-vl-plus"
+        assert result[0]["model_type"] == "vlm"
+        assert result[0]["model_tag"] == "chat"
+
+    @pytest.mark.asyncio
+    async def test_get_models_reranker_success(self, mocker: MockFixture):
+        """Test successful model retrieval for reranker models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "gte-reranker",
+                        "description": "Reranking model",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "reranker",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "gte-reranker"
+        assert result[0]["model_type"] == "reranker"
+        assert result[0]["model_tag"] == "reranker"
+
+    @pytest.mark.asyncio
+    async def test_get_models_tts_success(self, mocker: MockFixture):
+        """Test successful model retrieval for TTS models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "sambert-tts",
+                        "description": "Text to speech",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Audio"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "tts",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "sambert-tts"
+        assert result[0]["model_type"] == "tts"
+        assert result[0]["model_tag"] == "tts"
+
+    @pytest.mark.asyncio
+    async def test_get_models_stt_success(self, mocker: MockFixture):
+        """Test successful model retrieval for STT models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "paraformer-realtime-v2",
+                        "description": "Speech recognition",
+                        "inference_metadata": {
+                            "request_modality": ["Audio"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "stt",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "paraformer-realtime-v2"
+        assert result[0]["model_type"] == "stt"
+        assert result[0]["model_tag"] == "stt"
+
+    @pytest.mark.asyncio
+    async def test_get_models_multi_embedding_success(self, mocker: MockFixture):
+        """Test successful model retrieval for multi-embedding models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "text-embedding-multimodal-v3",
+                        "description": "Multimodal embedding",
+                        "inference_metadata": {
+                            "request_modality": ["Text", "Image"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "multi_embedding",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "text-embedding-multimodal-v3"
+        assert result[0]["model_type"] == "embedding"
+
+    @pytest.mark.asyncio
+    async def test_get_models_empty_response(self, mocker: MockFixture):
+        """Test handling of empty model list from API."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"output": {"models": []}}
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models"
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert result == []
+
+    @pytest.mark.asyncio
+    async def test_get_models_http_error(self, mocker: MockFixture):
+        """Test handling of HTTP error."""
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = httpx.HTTPStatusError(
+            "Error",
+            request=MagicMock(),
+            response=MagicMock(status_code=500)
+        )
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert isinstance(result, list)
+        assert len(result) == 1
+        assert result[0]["_error"] == "connection_failed"
+
+    @pytest.mark.asyncio
+    async def test_get_models_connect_error(self, mocker: MockFixture):
+        """Test handling of connection error."""
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = httpx.ConnectError("Connection failed")
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert isinstance(result, list)
+        assert len(result) == 1
+        assert result[0]["_error"] == "connection_failed"
+
+    @pytest.mark.asyncio
+    async def test_get_models_timeout(self, mocker: MockFixture):
+        """Test handling of connection timeout."""
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = httpx.ConnectTimeout("Timeout")
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert isinstance(result, list)
+        assert len(result) == 1
+        assert result[0]["_error"] == "connection_failed"
+
+    @pytest.mark.asyncio
+    async def test_get_models_authorization_header(self, mocker: MockFixture):
+        """Test that Authorization header is correctly set."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "qwen-turbo",
+                        "description": "Test",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "my-secret-key"
+        }
+
+        await provider.get_models(provider_config)
+
+        # Verify Authorization header
+        call_args = mock_client.get.call_args
+        headers = call_args[1]["headers"]
+        assert headers["Authorization"] == "Bearer my-secret-key"
+
+    @pytest.mark.asyncio
+    async def test_get_models_pagination(self, mocker: MockFixture):
+        """Test that pagination works correctly."""
+        # First page returns 100 models
+        mock_response_page1 = MagicMock()
+        mock_response_page1.status_code = 200
+        mock_response_page1.json.return_value = {
+            "output": {
+                "models": [{"model": f"model-{i}", "description": "test",
+                           "inference_metadata": {"request_modality": ["Text"], "response_modality": ["Text"]}}
+                           for i in range(100)]
+            }
+        }
+        mock_response_page1.raise_for_status = MagicMock()
+
+        # Second page returns 50 models (less than page_size)
+        mock_response_page2 = MagicMock()
+        mock_response_page2.status_code = 200
+        mock_response_page2.json.return_value = {
+            "output": {
+                "models": [{"model": f"model-{i}", "description": "test",
+                           "inference_metadata": {"request_modality": ["Text"], "response_modality": ["Text"]}}
+                           for i in range(100, 150)]
+            }
+        }
+        mock_response_page2.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = [mock_response_page1, mock_response_page2]
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        # Should get models from both pages
+        assert len(result) == 150
+
+    @pytest.mark.asyncio
+    async def test_get_models_unknown_type_returns_empty(self, mocker: MockFixture):
+        """Test that unknown model type returns empty list."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "qwen-turbo",
+                        "description": "Text generation",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        provider = DashScopeModelProvider()
+        provider_config = {
+            "model_type": "unknown_type",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert result == []
+
+    @pytest.mark.asyncio
+    async def test_get_models_rate_limit_retry(self, mocker: MockFixture):
+        """Test that a 429 response triggers a retry after sleeping."""
+        rate_limit_response = MagicMock()
+        rate_limit_response.status_code = 429
+
+        ok_response = MagicMock()
+        ok_response.status_code = 200
+        ok_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "qwen-turbo",
+                        "description": "Text generation",
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"],
+                        },
+                    }
+                ]
+            }
+        }
+        ok_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = [rate_limit_response, ok_response]
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.httpx.AsyncClient",
+            return_value=mock_cm,
+        )
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.DASHSCOPE_GET_URL",
+            "https://dashscope.aliyuncs.com/api/v1/models",
+        )
+        mocker.patch(
+            "backend.services.providers.dashscope_provider.asyncio.sleep",
+            new=AsyncMock(),
+        )
+
+        provider = DashScopeModelProvider()
+        result = await provider.get_models({"model_type": "llm", "api_key": "test-key"})
+
+        assert mock_client.get.call_count == 2
+        assert len(result) == 1
+        assert result[0]["id"] == "qwen-turbo"
+
+    @pytest.mark.asyncio
+    async def test_get_models_with_chinese_description(self, mocker: MockFixture):
+        """Test model classification by Chinese description."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "output": {
+                "models": [
+                    {
+                        "model": "embedding-v1",
+                        "description": "向量embedding模型",  # Chinese description
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    },
+                    {
+                        "model": "rerank-v1",
+                        "description": "重排序模型",  # Chinese description
+                        "inference_metadata": {
+                            "request_modality": ["Text"],
+                            "response_modality": ["Text"]
+                        }
+                    }
+                ]
+            }
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        self._setup_mock_client(mocker, mock_response)
+
+        provider = DashScopeModelProvider()
+
+        # Test embedding classification by Chinese description
+        result = await provider.get_models({"model_type": "embedding", "api_key": "test-key"})
+        assert len(result) == 1
+        assert result[0]["id"] == "embedding-v1"
+
+        # Test reranker classification by Chinese description
+        result = await provider.get_models({"model_type": "reranker", "api_key": "test-key"})
+        assert len(result) == 1
+        assert result[0]["id"] == "rerank-v1"
diff --git a/test/backend/services/providers/test_tokenpony_provider.py b/test/backend/services/providers/test_tokenpony_provider.py
new file mode 100644
index 000000000..7fd9df9eb
--- /dev/null
+++ b/test/backend/services/providers/test_tokenpony_provider.py
@@ -0,0 +1,711 @@
+"""Unit tests for TokenPonyModelProvider module.
+
+Tests cover model fetching, type classification, and error handling.
+"""
+
+import pytest
+from unittest.mock import MagicMock, AsyncMock, patch
+from pytest_mock import MockFixture
+
+import httpx
+
+from backend.services.providers.tokenpony_provider import TokenPonyModelProvider
+
+
+class TestTokenPonyModelProvider:
+    """Tests for TokenPonyModelProvider class."""
+
+    @pytest.mark.asyncio
+    async def test_get_models_llm_success(self, mocker: MockFixture):
+        """Test successful model retrieval for LLM models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "gpt-4",
+                    "object": "model",
+                    "owned_by": "openai"
+                },
+                {
+                    "id": "claude-3-opus",
+                    "object": "model",
+                    "owned_by": "anthropic"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.DEFAULT_LLM_MAX_TOKENS",
+            4096
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 2
+        assert result[0]["id"] == "gpt-4"
+        assert result[0]["model_type"] == "llm"
+        assert result[0]["model_tag"] == "chat"
+        assert result[0]["max_tokens"] == 4096
+
+    @pytest.mark.asyncio
+    async def test_get_models_embedding_success(self, mocker: MockFixture):
+        """Test successful model retrieval for embedding models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "text-embedding-ada-002",
+                    "object": "model",
+                    "owned_by": "openai"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "embedding",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "text-embedding-ada-002"
+        assert result[0]["model_type"] == "embedding"
+        assert result[0]["model_tag"] == "embedding"
+
+    @pytest.mark.asyncio
+    async def test_get_models_vlm_success(self, mocker: MockFixture):
+        """Test successful model retrieval for VLM models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "qwen-vl-plus",
+                    "object": "model",
+                    "owned_by": "qwen"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "vlm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "qwen-vl-plus"
+        assert result[0]["model_type"] == "vlm"
+        assert result[0]["model_tag"] == "chat"
+
+    @pytest.mark.asyncio
+    async def test_get_models_reranker_success(self, mocker: MockFixture):
+        """Test successful model retrieval for reranker models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "gte-reranker-base",
+                    "object": "model",
+                    "owned_by": "gte"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "reranker",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "gte-reranker-base"
+        assert result[0]["model_type"] == "reranker"
+        assert result[0]["model_tag"] == "reranker"
+
+    @pytest.mark.asyncio
+    async def test_get_models_tts_success(self, mocker: MockFixture):
+        """Test successful model retrieval for TTS models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "tts-1-hd",
+                    "object": "model",
+                    "owned_by": "openai"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "tts",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "tts-1-hd"
+        assert result[0]["model_type"] == "tts"
+        assert result[0]["model_tag"] == "tts"
+
+    @pytest.mark.asyncio
+    async def test_get_models_stt_success(self, mocker: MockFixture):
+        """Test successful model retrieval for STT models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "stt-whisper-1",
+                    "object": "model",
+                    "owned_by": "openai"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "stt",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "stt-whisper-1"
+        assert result[0]["model_type"] == "stt"
+        assert result[0]["model_tag"] == "stt"
+
+    @pytest.mark.asyncio
+    async def test_get_models_multi_embedding_success(self, mocker: MockFixture):
+        """Test successful model retrieval for multi-embedding models."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "bge-large",
+                    "object": "model",
+                    "owned_by": "bge"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "multi_embedding",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["id"] == "bge-large"
+        assert result[0]["model_type"] == "embedding"
+
+    @pytest.mark.asyncio
+    async def test_get_models_empty_response(self, mocker: MockFixture):
+        """Test handling of empty model list from API."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {"data": []}
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert result == []
+
+    @pytest.mark.asyncio
+    async def test_get_models_http_error(self, mocker: MockFixture):
+        """Test handling of HTTP error."""
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = httpx.HTTPStatusError(
+            "Error",
+            request=MagicMock(),
+            response=MagicMock(status_code=500)
+        )
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert isinstance(result, list)
+        assert len(result) == 1
+        assert result[0]["_error"] == "connection_failed"
+
+    @pytest.mark.asyncio
+    async def test_get_models_connect_error(self, mocker: MockFixture):
+        """Test handling of connection error."""
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = httpx.ConnectError("Connection failed")
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert isinstance(result, list)
+        assert len(result) == 1
+        assert result[0]["_error"] == "connection_failed"
+
+    @pytest.mark.asyncio
+    async def test_get_models_timeout(self, mocker: MockFixture):
+        """Test handling of connection timeout."""
+        mock_client = AsyncMock()
+        mock_client.get.side_effect = httpx.ConnectTimeout("Timeout")
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert isinstance(result, list)
+        assert len(result) == 1
+        assert result[0]["_error"] == "connection_failed"
+
+    @pytest.mark.asyncio
+    async def test_get_models_authorization_header(self, mocker: MockFixture):
+        """Test that Authorization header is correctly set."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "gpt-4",
+                    "object": "model",
+                    "owned_by": "openai"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "my-secret-key"
+        }
+
+        await provider.get_models(provider_config)
+
+        # Verify Authorization header
+        call_args = mock_client.get.call_args
+        headers = call_args[1]["headers"]
+        assert headers["Authorization"] == "Bearer my-secret-key"
+
+    @pytest.mark.asyncio
+    async def test_get_models_unknown_type_returns_empty(self, mocker: MockFixture):
+        """Test that unknown model type returns empty list."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "gpt-4",
+                    "object": "model",
+                    "owned_by": "openai"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "unknown_type",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert result == []
+
+    @pytest.mark.asyncio
+    async def test_get_models_vlm_by_keyword(self, mocker: MockFixture):
+        """Test VLM classification by keywords like -vl, vl-, ocr, vision."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "qwen-vl-plus",
+                    "object": "model",
+                    "owned_by": "qwen"
+                },
+                {
+                    "id": "vl-ocr-v1",
+                    "object": "model",
+                    "owned_by": "ocr"
+                },
+                {
+                    "id": "vision-model-v2",
+                    "object": "model",
+                    "owned_by": "vision"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "vlm",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 3
+        for model in result:
+            assert model["model_type"] == "vlm"
+            assert model["model_tag"] == "chat"
+
+    @pytest.mark.asyncio
+    async def test_get_models_bge_prefix_embedding(self, mocker: MockFixture):
+        """Test that models with bge- prefix are classified as embedding."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "bge-large-zh-v1.5",
+                    "object": "model",
+                    "owned_by": "bge"
+                },
+                {
+                    "id": "bge-base-en-v1.5",
+                    "object": "model",
+                    "owned_by": "bge"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "embedding",
+            "api_key": "test-api-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 2
+        for model in result:
+            assert model["model_type"] == "embedding"
+            assert model["model_tag"] == "embedding"
+
+    @pytest.mark.asyncio
+    async def test_get_models_llm_has_max_tokens(self, mocker: MockFixture):
+        """Test that LLM models have max_tokens set."""
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.json.return_value = {
+            "data": [
+                {
+                    "id": "gpt-4",
+                    "object": "model",
+                    "owned_by": "openai"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = AsyncMock()
+        mock_client.get.return_value = mock_response
+
+        mock_cm = MagicMock()
+        mock_cm.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_cm.__aexit__ = AsyncMock(return_value=None)
+
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.httpx.AsyncClient",
+            return_value=mock_cm
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.TOKENPONY_GET_URL",
+            "https://api.tokenpony.cn/v1/models"
+        )
+        mocker.patch(
+            "backend.services.providers.tokenpony_provider.DEFAULT_LLM_MAX_TOKENS",
+            4096
+        )
+
+        provider = TokenPonyModelProvider()
+        provider_config = {
+            "model_type": "llm",
+            "api_key": "test-key"
+        }
+
+        result = await provider.get_models(provider_config)
+
+        assert len(result) == 1
+        assert result[0]["max_tokens"] == 4096
+
diff --git a/test/backend/services/test_config_sync_service.py b/test/backend/services/test_config_sync_service.py
index 3fe97a573..0748a71b7 100644
--- a/test/backend/services/test_config_sync_service.py
+++ b/test/backend/services/test_config_sync_service.py
@@ -994,6 +994,7 @@ def mock_get_app_config(key, tenant_id=None):
                 "TENANT_NAME": "Test Tenant",
                 "DEFAULT_GROUP_ID": "default-group-123",
                 "ICON_TYPE": "preset",
+                "ICON_KEY": "keyboard",
                 "AVATAR_URI": "avatar-uri",
                 "CUSTOM_ICON_URL": "https://custom-icon.com",
                 "DATAMATE_URL": "https://datamate.example.com"
@@ -1022,6 +1023,7 @@ def mock_get_app_config(key, tenant_id=None):
         assert result["app"]["tenantName"] == "Test Tenant"
         assert result["app"]["defaultGroupId"] == "default-group-123"
         assert result["app"]["icon"]["type"] == "preset"
+        assert result["app"]["icon"]["iconKey"] == "keyboard"
         assert result["app"]["icon"]["avatarUri"] == "avatar-uri"
         assert result["app"]["icon"]["customUrl"] == "https://custom-icon.com"
         assert result["models"]["llm"]["displayName"] == "Test LLM"
@@ -1406,6 +1408,7 @@ def mock_get_app_config(key, tenant_id=None):
                 "TENANT_NAME": None,  # TENANT_NAME (use default)
                 "DEFAULT_GROUP_ID": None,  # DEFAULT_GROUP_ID (use default)
                 "ICON_TYPE": "custom",
+                "ICON_KEY": "book",
                 "AVATAR_URI": "avatar-uri",
                 "CUSTOM_ICON_URL": "https://custom-icon.com",
                 "DATAMATE_URL": "https://datamate.example.com"
@@ -1425,6 +1428,7 @@ def mock_get_app_config(key, tenant_id=None):
             assert result["tenantName"] == ""  # None returns default empty string
             assert result["defaultGroupId"] == ""  # None returns default empty string
             assert result["icon"]["type"] == "custom"
+            assert result["icon"]["iconKey"] == "book"
             assert result["icon"]["avatarUri"] == "avatar-uri"
             assert result["icon"]["customUrl"] == "https://custom-icon.com"
             assert result["modelEngineEnabled"] == False
@@ -1436,11 +1440,12 @@ def mock_get_app_config(key, tenant_id=None):
             ("TENANT_NAME", tenant_id),
             ("DEFAULT_GROUP_ID", tenant_id),
             ("ICON_TYPE", tenant_id),
+            ("ICON_KEY", tenant_id),
             ("AVATAR_URI", tenant_id),
             ("CUSTOM_ICON_URL", tenant_id),
             ("DATAMATE_URL", tenant_id)
         ]
-        assert service_mocks['tenant_config_manager'].get_app_config.call_count == 8
+        assert service_mocks['tenant_config_manager'].get_app_config.call_count == 9
         service_mocks['tenant_config_manager'].get_app_config.assert_has_calls(
             [call(key, tenant_id=tenant_id)
              for key, _ in expected_calls]
@@ -1465,6 +1470,7 @@ def test_build_app_config_chinese_defaults(self, service_mocks):
             # DEFAULT_APP_DESCRIPTION_ZH
             assert result["description"] == "Nexent 是一个开源智能体平台，基于 MCP 工具生态系统，提供灵活的多模态问答、检索、数据分析、处理等能力。"
             assert result["icon"]["type"] == "preset"
+            assert result["icon"]["iconKey"] == "search"  # Default value
             assert result["icon"]["avatarUri"] == ""
             assert result["icon"]["customUrl"] == ""
             assert result["modelEngineEnabled"] == False
@@ -1488,6 +1494,7 @@ def test_build_app_config_english_defaults(self, service_mocks):
             # DEFAULT_APP_DESCRIPTION_EN
             assert result["description"] == "Nexent is an open-source agent platform built on the MCP tool ecosystem, providing flexible multi-modal Q&A, retrieval, data analysis, and processing capabilities."
             assert result["icon"]["type"] == "preset"
+            assert result["icon"]["iconKey"] == "search"  # Default value
             assert result["icon"]["avatarUri"] == ""
             assert result["icon"]["customUrl"] == ""
             assert result["modelEngineEnabled"] == False
@@ -1504,6 +1511,7 @@ def side_effect(config_key, tenant_id=None):
                 "APP_NAME": "Custom App Name",
                 "APP_DESCRIPTION": None,  # Will use default
                 "ICON_TYPE": "custom",
+                "ICON_KEY": "globe2",
                 "AVATAR_URI": None,  # Will use empty string
                 "CUSTOM_ICON_URL": "https://custom-icon.com"
             }
@@ -1521,6 +1529,7 @@ def side_effect(config_key, tenant_id=None):
             # Default
             assert result["description"] == "Nexent is an open-source agent platform built on the MCP tool ecosystem, providing flexible multi-modal Q&A, retrieval, data analysis, and processing capabilities."
             assert result["icon"]["type"] == "custom"
+            assert result["icon"]["iconKey"] == "globe2"
             assert result["icon"]["avatarUri"] == ""  # Default empty
             assert result["icon"]["customUrl"] == "https://custom-icon.com"
             assert result["modelEngineEnabled"] == False
@@ -1541,6 +1550,113 @@ def test_build_app_config_exception_handling(self, service_mocks):
 
         assert "Database timeout" in str(exc_info.value)
 
+    def test_build_app_config_with_icon_key(self, service_mocks):
+        """Test build_app_config with iconKey value present"""
+        # Setup
+        language = "en"
+        tenant_id = "test_tenant_id"
+
+        # Mock all app config values including ICON_KEY
+        def mock_get_app_config(key, tenant_id=None):
+            config_map = {
+                "APP_NAME": "Custom App Name",
+                "APP_DESCRIPTION": "Custom description",
+                "TENANT_NAME": None,
+                "DEFAULT_GROUP_ID": None,
+                "ICON_TYPE": "preset",
+                "ICON_KEY": "keyboard",
+                "AVATAR_URI": "avatar-uri",
+                "CUSTOM_ICON_URL": "https://custom-icon.com",
+                "DATAMATE_URL": "https://datamate.example.com"
+            }
+            return config_map.get(key)
+
+        service_mocks['tenant_config_manager'].get_app_config.side_effect = mock_get_app_config
+
+        # Mock MODEL_ENGINE_ENABLED
+        with patch('backend.services.config_sync_service.MODEL_ENGINE_ENABLED', 'false'):
+            # Execute
+            result = build_app_config(language, tenant_id)
+
+            # Assert - verify iconKey is returned correctly
+            assert result["name"] == "Custom App Name"
+            assert result["icon"]["type"] == "preset"
+            assert result["icon"]["iconKey"] == "keyboard"
+            assert result["icon"]["avatarUri"] == "avatar-uri"
+            assert result["icon"]["customUrl"] == "https://custom-icon.com"
+
+        # Verify ICON_KEY was called
+        service_mocks['tenant_config_manager'].get_app_config.assert_any_call(
+            "ICON_KEY", tenant_id=tenant_id
+        )
+
+    def test_build_app_config_icon_key_defaults(self, service_mocks):
+        """Test build_app_config with iconKey missing (should use default 'search')"""
+        # Setup
+        language = "en"
+        tenant_id = "test_tenant_id"
+
+        # Mock app config values without ICON_KEY
+        def mock_get_app_config(key, tenant_id=None):
+            config_map = {
+                "APP_NAME": "Test App",
+                "APP_DESCRIPTION": "Test description",
+                "TENANT_NAME": None,
+                "DEFAULT_GROUP_ID": None,
+                "ICON_TYPE": "preset",
+                # ICON_KEY not present - should default to "search"
+                "AVATAR_URI": "",
+                "CUSTOM_ICON_URL": "",
+                "DATAMATE_URL": ""
+            }
+            return config_map.get(key)
+
+        service_mocks['tenant_config_manager'].get_app_config.side_effect = mock_get_app_config
+
+        # Mock MODEL_ENGINE_ENABLED
+        with patch('backend.services.config_sync_service.MODEL_ENGINE_ENABLED', 'false'):
+            # Execute
+            result = build_app_config(language, tenant_id)
+
+            # Assert - verify iconKey defaults to "search"
+            assert result["name"] == "Test App"
+            assert result["icon"]["type"] == "preset"
+            assert result["icon"]["iconKey"] == "search"  # Default value
+
+    def test_build_app_config_all_icon_fields(self, service_mocks):
+        """Test build_app_config with all icon-related fields present"""
+        # Setup
+        language = "zh"
+        tenant_id = "test_tenant_id"
+
+        # Mock all icon-related config values
+        def mock_get_app_config(key, tenant_id=None):
+            config_map = {
+                "APP_NAME": "Test App",
+                "APP_DESCRIPTION": "Test description",
+                "TENANT_NAME": None,
+                "DEFAULT_GROUP_ID": None,
+                "ICON_TYPE": "custom",
+                "ICON_KEY": "lightbulb",
+                "AVATAR_URI": "generated-avatar-uri",
+                "CUSTOM_ICON_URL": "https://example.com/custom.png",
+                "DATAMATE_URL": ""
+            }
+            return config_map.get(key)
+
+        service_mocks['tenant_config_manager'].get_app_config.side_effect = mock_get_app_config
+
+        # Mock MODEL_ENGINE_ENABLED
+        with patch('backend.services.config_sync_service.MODEL_ENGINE_ENABLED', 'false'):
+            # Execute
+            result = build_app_config(language, tenant_id)
+
+            # Assert - verify all icon fields
+            assert result["icon"]["type"] == "custom"
+            assert result["icon"]["iconKey"] == "lightbulb"
+            assert result["icon"]["avatarUri"] == "generated-avatar-uri"
+            assert result["icon"]["customUrl"] == "https://example.com/custom.png"
+
 
 class TestBuildModelConfig:
     """Test cases for build_model_config function"""
diff --git a/test/backend/services/test_data_process_service.py b/test/backend/services/test_data_process_service.py
index 02c3b11a3..c52e496bb 100644
--- a/test/backend/services/test_data_process_service.py
+++ b/test/backend/services/test_data_process_service.py
@@ -4,6 +4,7 @@
 import io
 import base64
 import asyncio
+import types
 from unittest.mock import patch, MagicMock, AsyncMock
 import warnings
 from PIL import Image
@@ -42,8 +43,27 @@
 mock_const.IMAGE_FILTER = True
 mock_const.REDIS_BACKEND_URL = "redis://mock:6379/0"
 mock_const.REDIS_URL = "redis://mock:6379/0"
+mock_const.MAX_CONCURRENT_CONVERSIONS = 3
 sys.modules['consts.const'] = mock_const
 
+# Stub consts.exceptions with a *real* exception class so assertRaises works correctly
+_exceptions_mod = types.ModuleType('consts.exceptions')
+
+
+class OfficeConversionException(Exception):
+    """Stub OfficeConversionException used in tests."""
+
+
+_exceptions_mod.OfficeConversionException = OfficeConversionException
+sys.modules['consts.exceptions'] = _exceptions_mod
+
+# Stub utils.file_management_utils (new import in data_process_service)
+if 'utils.file_management_utils' not in sys.modules:
+    import types as _types
+    _utils_mod = _types.ModuleType('utils.file_management_utils')
+    _utils_mod.convert_office_to_pdf = AsyncMock()
+    sys.modules['utils.file_management_utils'] = _utils_mod
+
 # from backend.services.data_process_service import DataProcessService, get_data_process_service
 with patch('data_process.utils.get_task_info') as mock_get_task_info, \
         patch('data_process.utils.get_all_task_ids_from_redis') as mock_get_redis_task_ids:
@@ -51,6 +71,21 @@
 
 
 class TestDataProcessService(unittest.TestCase):
+
+    class _NopSemaphore:
+        """Drop-in asyncio.Semaphore that never blocks.
+
+        asyncio.Semaphore is bound to the event loop at creation time; using
+        asyncio.run() in tests creates a new loop each time, so the module-level
+        semaphore would deadlock. This stub avoids that issue completely.
+        """
+
+        async def __aenter__(self):
+            return self
+
+        async def __aexit__(self, *args):
+            return False
+
     def setUp(self):
         """Set up test environment before each test"""
         # Create a clean instance for each test
@@ -60,18 +95,32 @@ def setUp(self):
         # Suppress warnings during tests
         warnings.filterwarnings('ignore', category=UserWarning)
 
+        # Replace module-level semaphore with a no-op to avoid asyncio loop issues
+        import backend.services.data_process_service as _dm
+        self._dm = _dm
+        self._orig_sem = _dm._conversion_semaphore
+        self._nop_sem = TestDataProcessService._NopSemaphore()
+        _dm._conversion_semaphore = self._nop_sem
+
         # Reset mocks for each test to prevent interference
-        # Do not import data_process.app here - use the already mocked module
         mock_celery_app = sys.modules['data_process.app'].app
         mock_celery_app.reset_mock()
         self.mock_celery_app = mock_celery_app
 
     def tearDown(self):
         """Clean up after each test"""
+        # Restore the original semaphore
+        self._dm._conversion_semaphore = self._orig_sem
         # Restore environment variables
         os.environ.clear()
         os.environ.update(self.original_env)
 
+    @staticmethod
+    def _make_stream(data: bytes):
+        """Return a BytesIO stream containing *data*."""
+        from io import BytesIO
+        return BytesIO(data)
+
     @patch('backend.services.data_process_service.redis.ConnectionPool.from_url')
     @patch('backend.services.data_process_service.redis.Redis')
     def test_init_redis_client_with_url(self, mock_redis, mock_pool):
@@ -2162,5 +2211,346 @@ def test_convert_to_base64(self):
         asyncio.run(self.async_test_convert_to_base64())
 
 
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_size_from_minio')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_success(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_get_size, mock_upload, mock_convert
+    ):
+        """Happy path: full pipeline completes and temp dir is cleaned up."""
+        mock_get_stream.side_effect = [
+            self._make_stream(b'DOC data'),      # Step 1: original file
+            self._make_stream(b'%PDF-1.4 ok'),   # Step 4: header check
+        ]
+        mock_get_size.return_value = 208
+        mock_upload.return_value = {'success': True}
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+
+        with patch('builtins.open', MagicMock()):
+            asyncio.run(
+                self.service.convert_office_to_pdf_impl(
+                    'uploads/doc.docx', 'converted/doc.pdf'
+                )
+            )
+
+        mock_convert.assert_called_once()
+        mock_rmtree.assert_called_once_with('/tmp/test_cv')
+
+    @patch('backend.services.data_process_service.get_file_stream',
+           return_value=None)
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_source_not_found(
+        self, _exists, _mkdtemp, mock_rmtree, _get_stream
+    ):
+        """Source file missing → OfficeConversionException."""
+        # Prevent cleanup path from calling real delete_file
+        sys.modules['database.attachment_db'].file_exists = MagicMock(
+            return_value=False
+        )
+        with self.assertRaises(OfficeConversionException) as ctx:
+            asyncio.run(
+                self.service.convert_office_to_pdf_impl(
+                    'uploads/missing.docx', 'converted/missing.pdf'
+                )
+            )
+        self.assertIn('Source file not found', str(ctx.exception))
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_libreoffice_failure(
+        self, _exists, _mkdtemp, mock_rmtree, mock_get_stream, mock_convert
+    ):
+        """LibreOffice error → OfficeConversionException."""
+        mock_get_stream.return_value = self._make_stream(b'DOC data')
+        mock_convert.side_effect = RuntimeError('soffice not found')
+        sys.modules['database.attachment_db'].file_exists = MagicMock(
+            return_value=False
+        )
+        with patch('builtins.open', MagicMock()):
+            with self.assertRaises(OfficeConversionException) as ctx:
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        self.assertIn('LibreOffice conversion failed', str(ctx.exception))
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_upload_failure(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_upload, mock_convert
+    ):
+        """Upload failure → OfficeConversionException with error detail."""
+        mock_get_stream.return_value = self._make_stream(b'DOC data')
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+        mock_upload.return_value = {'success': False, 'error': 'quota exceeded'}
+        sys.modules['database.attachment_db'].file_exists = MagicMock(
+            return_value=False
+        )
+        with patch('builtins.open', MagicMock()):
+            with self.assertRaises(OfficeConversionException) as ctx:
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        self.assertIn('Failed to upload PDF', str(ctx.exception))
+
+    @patch('backend.services.data_process_service.delete_file')
+    @patch('backend.services.data_process_service.file_exists', return_value=True)
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_size_from_minio')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_invalid_pdf_header(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_get_size, mock_upload, mock_convert,
+        mock_file_exists, mock_delete_file
+    ):
+        """Invalid PDF header → OfficeConversionException; remote file deleted."""
+        mock_get_stream.side_effect = [
+            self._make_stream(b'DOC data'),      # Step 1: original file
+            self._make_stream(b'NOT-PDF'),       # Step 4: header check
+        ]
+        mock_get_size.return_value = 208
+        mock_upload.return_value = {'success': True}
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+
+        with patch('builtins.open', MagicMock()):
+            with self.assertRaises(OfficeConversionException) as ctx:
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        self.assertIn('invalid PDF header', str(ctx.exception))
+        mock_delete_file.assert_called_once_with('converted/doc.pdf')
+
+    @patch('backend.services.data_process_service.file_exists', return_value=False)
+    @patch('backend.services.data_process_service.get_file_stream', return_value=None)
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_no_remote_cleanup_when_not_exists(
+        self, _exists, _mkdtemp, mock_rmtree, _get_stream, mock_file_exists
+    ):
+        """OfficeConversionException raised and file_exists=False → delete_file never called."""
+        with patch('backend.services.data_process_service.delete_file') as mock_del:
+            with self.assertRaises(OfficeConversionException):
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        mock_del.assert_not_called()
+
+    @patch('backend.services.data_process_service.get_file_stream', return_value=None)
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', side_effect=OSError('no space left on device'))
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_mkdtemp_failure(
+        self, _exists, mock_mkdtemp, mock_rmtree, _get_stream
+    ):
+        """tempfile.mkdtemp raises → temp_dir stays None → finally skips cleanup."""
+        with self.assertRaises(OfficeConversionException) as ctx:
+            asyncio.run(
+                self.service.convert_office_to_pdf_impl(
+                    'uploads/doc.docx', 'converted/doc.pdf'
+                )
+            )
+        self.assertIn('Unexpected error', str(ctx.exception))
+        mock_rmtree.assert_not_called()
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_size_from_minio')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_size_zero(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_get_size, mock_upload, mock_convert
+    ):
+        """remote_size == 0 → OfficeConversionException: cannot read remote file size."""
+        mock_get_stream.return_value = self._make_stream(b'DOC data')
+        mock_get_size.return_value = 0
+        mock_upload.return_value = {'success': True}
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+        sys.modules['database.attachment_db'].file_exists = MagicMock(return_value=False)
+        with patch('builtins.open', MagicMock()):
+            with self.assertRaises(OfficeConversionException) as ctx:
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        self.assertIn('cannot read remote file size', str(ctx.exception))
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_size_from_minio')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_size_too_small(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_get_size, mock_upload, mock_convert
+    ):
+        """remote_size < 100 (but > 0) → OfficeConversionException: file too small."""
+        mock_get_stream.return_value = self._make_stream(b'DOC data')
+        mock_get_size.return_value = 50
+        mock_upload.return_value = {'success': True}
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+        sys.modules['database.attachment_db'].file_exists = MagicMock(return_value=False)
+        with patch('builtins.open', MagicMock()):
+            with self.assertRaises(OfficeConversionException) as ctx:
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        self.assertIn('file too small', str(ctx.exception))
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_size_from_minio')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_stream_none(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_get_size, mock_upload, mock_convert
+    ):
+        """get_file_stream returns None for header check → OfficeConversionException."""
+        mock_get_stream.side_effect = [
+            self._make_stream(b'DOC data'),  # Step 1: original file
+            None,                            # Step 4: header check stream
+        ]
+        mock_get_size.return_value = 208
+        mock_upload.return_value = {'success': True}
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+        sys.modules['database.attachment_db'].file_exists = MagicMock(return_value=False)
+        with patch('builtins.open', MagicMock()):
+            with self.assertRaises(OfficeConversionException) as ctx:
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        self.assertIn('cannot read uploaded file', str(ctx.exception))
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_size_from_minio')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_close_raises(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_get_size, mock_upload, mock_convert
+    ):
+        """stream.close() raises during header check → exception swallowed, pipeline succeeds."""
+        header_stream = MagicMock()
+        header_stream.read.return_value = b'%PDF-1.4'
+        header_stream.close.side_effect = OSError('close failed')
+        mock_get_stream.side_effect = [
+            self._make_stream(b'DOC data'),  # Step 1: original file
+            header_stream,                   # Step 4: header check
+        ]
+        mock_get_size.return_value = 208
+        mock_upload.return_value = {'success': True}
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+        with patch('builtins.open', MagicMock()):
+            asyncio.run(
+                self.service.convert_office_to_pdf_impl(
+                    'uploads/doc.docx', 'converted/doc.pdf'
+                )
+            )
+        mock_convert.assert_called_once()
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_unexpected_exception(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_upload, mock_convert
+    ):
+        """Non-OfficeConversionException from upload_file → wrapped as OfficeConversionException."""
+        mock_get_stream.return_value = self._make_stream(b'DOC data')
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+        mock_upload.side_effect = ConnectionError('storage unreachable')
+        with patch('builtins.open', MagicMock()):
+            with self.assertRaises(OfficeConversionException) as ctx:
+                asyncio.run(
+                    self.service.convert_office_to_pdf_impl(
+                        'uploads/doc.docx', 'converted/doc.pdf'
+                    )
+                )
+        self.assertIn('Unexpected error', str(ctx.exception))
+
+    @patch('backend.services.data_process_service.convert_office_to_pdf',
+           new_callable=AsyncMock)
+    @patch('backend.services.data_process_service.upload_file')
+    @patch('backend.services.data_process_service.get_file_size_from_minio')
+    @patch('backend.services.data_process_service.get_file_stream')
+    @patch('shutil.rmtree')
+    @patch('tempfile.mkdtemp', return_value='/tmp/test_cv')
+    @patch('os.path.exists', return_value=True)
+    def test_convert_office_to_pdf_impl_cleanup_failure(
+        self, _exists, _mkdtemp, mock_rmtree,
+        mock_get_stream, mock_get_size, mock_upload, mock_convert
+    ):
+        """shutil.rmtree raises during cleanup → error is logged, not re-raised."""
+        mock_get_stream.side_effect = [
+            self._make_stream(b'DOC data'),     # Step 1: original file
+            self._make_stream(b'%PDF-1.4 ok'),  # Step 4: header check
+        ]
+        mock_get_size.return_value = 208
+        mock_upload.return_value = {'success': True}
+        mock_convert.return_value = '/tmp/test_cv/doc.pdf'
+        mock_rmtree.side_effect = OSError('permission denied')
+        with patch('builtins.open', MagicMock()):
+            # Cleanup error must not propagate
+            asyncio.run(
+                self.service.convert_office_to_pdf_impl(
+                    'uploads/doc.docx', 'converted/doc.pdf'
+                )
+            )
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/test/backend/services/test_file_management_service.py b/test/backend/services/test_file_management_service.py
index f46f87f13..2e7e4f43a 100644
--- a/test/backend/services/test_file_management_service.py
+++ b/test/backend/services/test_file_management_service.py
@@ -82,6 +82,7 @@ def setup_patches():
         patch('backend.database.attachment_db.get_file_stream', MagicMock()),
         patch('backend.database.attachment_db.delete_file', MagicMock()),
         patch('backend.database.attachment_db.list_files', MagicMock()),
+        patch('backend.services.file_management_service.get_file_size_from_minio', MagicMock(return_value=0)),
         patch('backend.services.file_management_service.save_upload_file', AsyncMock()),
         patch('backend.services.file_management_service.upload_semaphore', MagicMock()),
         patch('backend.services.file_management_service.upload_dir',
@@ -1011,3 +1012,465 @@ def test_get_llm_model_with_different_tenant_ids(self, mock_tenant_config, mock_
         assert mock_tenant_config.get_model_config.call_count == 2
         assert mock_tenant_config.get_model_config.call_args_list[0][1]["tenant_id"] == "tenant1"
         assert mock_tenant_config.get_model_config.call_args_list[1][1]["tenant_id"] == "tenant2"
+
+
+class TestPreviewFileImpl:
+    """Test cases for preview_file_impl function"""
+
+    @pytest.mark.asyncio
+    async def test_preview_pdf_file_success(self):
+        """Test previewing a PDF file returns stream directly"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        mock_stream = BytesIO(b"PDF content")
+        
+        with patch('backend.services.file_management_service.get_content_type', return_value='application/pdf'), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=mock_stream):
+            
+            result_stream, result_type = await preview_file_impl("test/document.pdf")
+            
+            assert result_type == 'application/pdf'
+            assert result_stream == mock_stream
+
+    @pytest.mark.asyncio
+    async def test_preview_image_file_success(self):
+        """Test previewing an image file returns stream directly"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        mock_stream = BytesIO(b"PNG content")
+        
+        with patch('backend.services.file_management_service.get_content_type', return_value='image/png'), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=mock_stream):
+            
+            result_stream, result_type = await preview_file_impl("test/image.png")
+            
+            assert result_type == 'image/png'
+            assert result_stream == mock_stream
+
+    @pytest.mark.asyncio
+    async def test_preview_text_file_success(self):
+        """Test previewing a text file returns stream directly"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        mock_stream = BytesIO(b"Text content")
+        
+        with patch('backend.services.file_management_service.get_content_type', return_value='text/plain'), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=mock_stream):
+            
+            result_stream, result_type = await preview_file_impl("test/readme.txt")
+            
+            assert result_type == 'text/plain'
+            assert result_stream == mock_stream
+
+    @pytest.mark.asyncio
+    async def test_preview_csv_file_success(self):
+        """Test previewing a CSV file returns stream directly"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        mock_stream = BytesIO(b"col1,col2\nval1,val2")
+        
+        with patch('backend.services.file_management_service.get_content_type', return_value='text/csv'), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=mock_stream):
+            
+            result_stream, result_type = await preview_file_impl("test/data.csv")
+            
+            assert result_type == 'text/csv'
+            assert result_stream == mock_stream
+
+    @pytest.mark.asyncio
+    async def test_preview_markdown_file_success(self):
+        """Test previewing a Markdown file returns stream directly"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        mock_stream = BytesIO(b"# Heading\nContent")
+        
+        with patch('backend.services.file_management_service.get_content_type', return_value='text/markdown'), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=mock_stream):
+            
+            result_stream, result_type = await preview_file_impl("test/readme.md")
+            
+            assert result_type == 'text/markdown'
+            assert result_stream == mock_stream
+
+    @pytest.mark.asyncio
+    async def test_preview_office_docx_with_cache_hit(self):
+        """Test previewing a Word document with cached PDF available"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        mock_pdf_stream = BytesIO(b"Cached PDF content")
+        
+        with patch('backend.services.file_management_service.get_content_type', 
+                   return_value='application/vnd.openxmlformats-officedocument.wordprocessingml.document'), \
+             patch('backend.services.file_management_service.file_exists', return_value=True), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=mock_pdf_stream):
+            
+            result_stream, result_type = await preview_file_impl("test/document.docx")
+            
+            assert result_type == 'application/pdf'
+            assert result_stream == mock_pdf_stream
+
+    @pytest.mark.asyncio
+    async def test_preview_office_docx_cache_miss_convert_success(self):
+        """Cache miss: delegates conversion to data-process via HTTP, then serves resulting PDF."""
+        from backend.services.file_management_service import preview_file_impl
+
+        mock_pdf_stream = BytesIO(b"%PDF-1.4 converted content")
+
+        # Simulate data-process returning HTTP 200
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.text = ""
+
+        mock_client = AsyncMock()
+        mock_client.post = AsyncMock(return_value=mock_response)
+
+        mock_http_ctx = MagicMock()
+        mock_http_ctx.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_http_ctx.__aexit__ = AsyncMock(return_value=False)
+
+        with patch('backend.services.file_management_service.get_content_type',
+                   return_value='application/vnd.openxmlformats-officedocument.wordprocessingml.document'), \
+             patch('backend.services.file_management_service.file_exists', return_value=False), \
+             patch('backend.services.file_management_service.get_file_stream',
+                   return_value=mock_pdf_stream), \
+             patch('httpx.AsyncClient', return_value=mock_http_ctx), \
+             patch('backend.services.file_management_service.copy_file',
+                   return_value={'success': True}), \
+             patch('backend.services.file_management_service.delete_file'):
+
+            result_stream, result_type = await preview_file_impl("test/document.docx")
+
+            assert result_type == 'application/pdf'
+            assert result_stream == mock_pdf_stream
+            mock_client.post.assert_called_once()
+            url_called = mock_client.post.call_args[0][0]
+            assert "convert_to_pdf" in url_called
+
+    @pytest.mark.asyncio
+    async def test_preview_office_conversion_failure(self):
+        """HTTP error from data-process service propagates as conversion failure."""
+        from backend.services.file_management_service import preview_file_impl
+
+        # Simulate data-process returning HTTP 500
+        mock_response = MagicMock()
+        mock_response.status_code = 500
+        mock_response.text = "Internal Server Error"
+
+        mock_client = AsyncMock()
+        mock_client.post = AsyncMock(return_value=mock_response)
+
+        mock_http_ctx = MagicMock()
+        mock_http_ctx.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_http_ctx.__aexit__ = AsyncMock(return_value=False)
+
+        with patch('backend.services.file_management_service.get_content_type',
+                   return_value='application/vnd.openxmlformats-officedocument.wordprocessingml.document'), \
+             patch('backend.services.file_management_service.file_exists', return_value=False), \
+             patch('httpx.AsyncClient', return_value=mock_http_ctx), \
+             patch('backend.services.file_management_service.delete_file'):
+
+            with pytest.raises(Exception) as exc_info:
+                await preview_file_impl("test/document.docx")
+
+            assert "Failed to convert Office document to PDF" in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    async def test_preview_unsupported_file_type(self):
+        """Test previewing an unsupported file type raises exception"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        with patch('backend.services.file_management_service.get_content_type', 
+                   return_value='application/octet-stream'):
+            
+            with pytest.raises(Exception) as exc_info:
+                await preview_file_impl("test/unknown.bin")
+            
+            assert "Unsupported file type for preview" in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    async def test_preview_file_not_found(self):
+        """Test previewing a non-existent file raises exception"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        with patch('backend.services.file_management_service.get_content_type', return_value='application/pdf'), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=None):
+            
+            with pytest.raises(Exception) as exc_info:
+                await preview_file_impl("test/nonexistent.pdf")
+            
+            assert "File not found" in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    async def test_preview_file_too_large(self):
+        """Test that files exceeding FILE_PREVIEW_SIZE_LIMIT raise FileTooLargeException"""
+        from backend.services.file_management_service import preview_file_impl, FILE_PREVIEW_SIZE_LIMIT
+
+        oversized = FILE_PREVIEW_SIZE_LIMIT + 1
+        with patch('backend.services.file_management_service.get_file_size_from_minio', return_value=oversized):
+            with pytest.raises(Exception) as exc_info:
+                await preview_file_impl("test/large_file.pdf")
+
+        assert str(FILE_PREVIEW_SIZE_LIMIT // (1024 * 1024)) in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    @pytest.mark.parametrize("content_type,expected_direct", [
+        ('application/pdf', True),
+        ('image/jpeg', True),
+        ('image/png', True),
+        ('image/gif', True),
+        ('image/webp', True),
+        ('text/plain', True),
+        ('text/csv', True),
+        ('text/markdown', True),
+        ('application/vnd.openxmlformats-officedocument.wordprocessingml.document', False),
+        ('application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', False),
+        ('application/vnd.openxmlformats-officedocument.presentationml.presentation', False),
+        ('application/msword', False),
+        ('application/vnd.ms-excel', False),
+        ('application/vnd.ms-powerpoint', False),
+    ])
+    async def test_preview_file_type_routing(self, content_type, expected_direct):
+        """Test that different file types are routed correctly"""
+        from backend.services.file_management_service import preview_file_impl
+        
+        mock_stream = BytesIO(b"test content")
+        get_stream_call_count = 0
+        
+        def mock_get_file_stream(object_name):
+            nonlocal get_stream_call_count
+            get_stream_call_count += 1
+            return mock_stream
+        
+        with patch('backend.services.file_management_service.get_content_type', return_value=content_type), \
+             patch('backend.services.file_management_service.file_exists', return_value=True), \
+             patch('backend.services.file_management_service.get_file_stream', side_effect=mock_get_file_stream):
+            
+            result_stream, result_type = await preview_file_impl("test/file")
+            
+            assert result_stream == mock_stream
+            if expected_direct:
+                # Direct file types should call get_file_stream once
+                assert get_stream_call_count == 1
+                assert result_type == content_type
+            else:
+                # Office files return PDF type
+                assert result_type == 'application/pdf'
+
+
+class TestGetCachedPdfStream:
+    """Unit tests for _get_cached_pdf_stream helper."""
+
+    def test_returns_stream_when_cache_valid(self):
+        """Returns the stream when file exists and is readable."""
+        from backend.services.file_management_service import _get_cached_pdf_stream
+
+        mock_stream = BytesIO(b"%PDF-1.4")
+        with patch('backend.services.file_management_service.file_exists', return_value=True), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=mock_stream):
+            result = _get_cached_pdf_stream("preview/converted/doc_abc12345.pdf")
+            assert result is mock_stream
+
+    def test_returns_none_when_file_not_exist(self):
+        """Returns None immediately when the cached file does not exist."""
+        from backend.services.file_management_service import _get_cached_pdf_stream
+
+        with patch('backend.services.file_management_service.file_exists', return_value=False):
+            result = _get_cached_pdf_stream("preview/converted/doc_abc12345.pdf")
+            assert result is None
+
+    def test_deletes_and_returns_none_when_cache_corrupted(self):
+        """Deletes the corrupted cache entry and returns None when stream cannot be read."""
+        from backend.services.file_management_service import _get_cached_pdf_stream
+
+        with patch('backend.services.file_management_service.file_exists', return_value=True), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=None), \
+             patch('backend.services.file_management_service.delete_file') as mock_delete:
+            result = _get_cached_pdf_stream("preview/converted/doc_abc12345.pdf")
+            assert result is None
+            mock_delete.assert_called_once_with("preview/converted/doc_abc12345.pdf")
+
+
+class TestConvertOfficeToCachedPdf:
+    """Unit tests for _convert_office_to_cached_pdf helper."""
+
+    @pytest.mark.asyncio
+    async def test_returns_stream_on_double_check_cache_hit(self):
+        """If another coroutine completes conversion while we waited for the lock, serves from cache."""
+        from backend.services.file_management_service import _convert_office_to_cached_pdf
+
+        mock_stream = BytesIO(b"%PDF-1.4 already done")
+        # file_exists returns False on the outer check but the helper is called after lock acquisition
+        with patch('backend.services.file_management_service._get_cached_pdf_stream',
+                   return_value=mock_stream):
+            result = await _convert_office_to_cached_pdf(
+                "docs/report.docx",
+                "preview/converted/docs/report_deadbeef.pdf",
+                "preview/converting/docs/report_deadbeef.pdf.tmp",
+            )
+            assert result is mock_stream
+
+    @pytest.mark.asyncio
+    async def test_full_conversion_success(self):
+        """Happy path: calls data-process, copies result, deletes temp, returns stream."""
+        from backend.services.file_management_service import _convert_office_to_cached_pdf
+
+        final_stream = BytesIO(b"%PDF-1.4 fresh")
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.text = ""
+
+        mock_client = AsyncMock()
+        mock_client.post = AsyncMock(return_value=mock_response)
+
+        mock_http_ctx = MagicMock()
+        mock_http_ctx.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_http_ctx.__aexit__ = AsyncMock(return_value=False)
+
+        with patch('backend.services.file_management_service._get_cached_pdf_stream',
+                   return_value=None), \
+             patch('httpx.AsyncClient', return_value=mock_http_ctx), \
+             patch('backend.services.file_management_service.copy_file',
+                   return_value={'success': True}), \
+             patch('backend.services.file_management_service.delete_file') as mock_delete, \
+             patch('backend.services.file_management_service.file_exists', return_value=False), \
+             patch('backend.services.file_management_service.get_file_stream',
+                   return_value=final_stream):
+
+            result = await _convert_office_to_cached_pdf(
+                "docs/report.docx",
+                "preview/converted/docs/report_deadbeef.pdf",
+                "preview/converting/docs/report_deadbeef.pdf.tmp",
+            )
+
+        assert result is final_stream
+        mock_client.post.assert_called_once()
+        called_url = mock_client.post.call_args[0][0]
+        assert "convert_to_pdf" in called_url
+        # Temp file should be deleted after successful copy
+        mock_delete.assert_called_with("preview/converting/docs/report_deadbeef.pdf.tmp")
+
+    @pytest.mark.asyncio
+    async def test_http_error_raises_office_conversion_exception(self):
+        """Non-200 HTTP response from data-process raises OfficeConversionException."""
+        from backend.services.file_management_service import _convert_office_to_cached_pdf
+        from consts.exceptions import OfficeConversionException
+
+        mock_response = MagicMock()
+        mock_response.status_code = 503
+        mock_response.text = "Service Unavailable"
+
+        mock_client = AsyncMock()
+        mock_client.post = AsyncMock(return_value=mock_response)
+
+        mock_http_ctx = MagicMock()
+        mock_http_ctx.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_http_ctx.__aexit__ = AsyncMock(return_value=False)
+
+        with patch('backend.services.file_management_service._get_cached_pdf_stream',
+                   return_value=None), \
+             patch('httpx.AsyncClient', return_value=mock_http_ctx), \
+             patch('backend.services.file_management_service.file_exists', return_value=False), \
+             patch('backend.services.file_management_service.delete_file'):
+
+            with pytest.raises(OfficeConversionException) as exc_info:
+                await _convert_office_to_cached_pdf(
+                    "docs/report.docx",
+                    "preview/converted/docs/report_deadbeef.pdf",
+                    "preview/converting/docs/report_deadbeef.pdf.tmp",
+                )
+
+        assert "Failed to convert Office document to PDF" in str(exc_info.value)
+        assert "503" in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    async def test_copy_failure_raises_office_conversion_exception(self):
+        """copy_file failure raises OfficeConversionException and cleans up temp file."""
+        from backend.services.file_management_service import _convert_office_to_cached_pdf
+        from consts.exceptions import OfficeConversionException
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.text = ""
+
+        mock_client = AsyncMock()
+        mock_client.post = AsyncMock(return_value=mock_response)
+
+        mock_http_ctx = MagicMock()
+        mock_http_ctx.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_http_ctx.__aexit__ = AsyncMock(return_value=False)
+
+        with patch('backend.services.file_management_service._get_cached_pdf_stream',
+                   return_value=None), \
+             patch('httpx.AsyncClient', return_value=mock_http_ctx), \
+             patch('backend.services.file_management_service.copy_file',
+                   return_value={'success': False, 'error': 'bucket full'}), \
+             patch('backend.services.file_management_service.file_exists', return_value=True), \
+             patch('backend.services.file_management_service.delete_file') as mock_delete:
+
+            with pytest.raises(OfficeConversionException):
+                await _convert_office_to_cached_pdf(
+                    "docs/report.docx",
+                    "preview/converted/docs/report_deadbeef.pdf",
+                    "preview/converting/docs/report_deadbeef.pdf.tmp",
+                )
+
+        # Cleanup: temp file must be deleted on failure
+        mock_delete.assert_called_with("preview/converting/docs/report_deadbeef.pdf.tmp")
+
+    @pytest.mark.asyncio
+    async def test_converted_pdf_not_readable_raises_not_found(self):
+        """Raises NotFoundException when the final PDF cannot be read after successful conversion."""
+        from backend.services.file_management_service import _convert_office_to_cached_pdf
+        from consts.exceptions import NotFoundException
+
+        mock_response = MagicMock()
+        mock_response.status_code = 200
+        mock_response.text = ""
+
+        mock_client = AsyncMock()
+        mock_client.post = AsyncMock(return_value=mock_response)
+
+        mock_http_ctx = MagicMock()
+        mock_http_ctx.__aenter__ = AsyncMock(return_value=mock_client)
+        mock_http_ctx.__aexit__ = AsyncMock(return_value=False)
+
+        with patch('backend.services.file_management_service._get_cached_pdf_stream',
+                   return_value=None), \
+             patch('httpx.AsyncClient', return_value=mock_http_ctx), \
+             patch('backend.services.file_management_service.copy_file',
+                   return_value={'success': True}), \
+             patch('backend.services.file_management_service.delete_file'), \
+             patch('backend.services.file_management_service.file_exists', return_value=False), \
+             patch('backend.services.file_management_service.get_file_stream', return_value=None):
+
+            with pytest.raises(NotFoundException):
+                await _convert_office_to_cached_pdf(
+                    "docs/report.docx",
+                    "preview/converted/docs/report_deadbeef.pdf",
+                    "preview/converting/docs/report_deadbeef.pdf.tmp",
+                )
+
+    @pytest.mark.asyncio
+    async def test_reuses_existing_lock_for_same_object(self):
+        """If a lock for object_name already exists, it is reused."""
+        import asyncio as _asyncio
+        import backend.services.file_management_service as _svc
+        from backend.services.file_management_service import _convert_office_to_cached_pdf
+
+        existing_lock = _asyncio.Lock()
+        _svc._conversion_locks["docs/existing.docx"] = existing_lock
+
+        mock_stream = BytesIO(b"%PDF-1.4 cached")
+        try:
+            with patch('backend.services.file_management_service._get_cached_pdf_stream',
+                       return_value=mock_stream):
+                result = await _convert_office_to_cached_pdf(
+                    "docs/existing.docx",
+                    "preview/converted/docs/existing_aabbccdd.pdf",
+                    "preview/converting/docs/existing_aabbccdd.pdf.tmp",
+                )
+        finally:
+            _svc._conversion_locks.pop("docs/existing.docx", None)
+
+        assert result is mock_stream
diff --git a/test/backend/services/test_idata_service.py b/test/backend/services/test_idata_service.py
new file mode 100644
index 000000000..1e9139d37
--- /dev/null
+++ b/test/backend/services/test_idata_service.py
@@ -0,0 +1,976 @@
+"""
+Unit tests for iData Service Layer.
+
+Tests the iData service functions which handle API calls to iData
+for knowledge space and knowledge base operations.
+"""
+import json
+import pytest
+from unittest.mock import MagicMock, patch
+import httpx
+
+from backend.consts.error_code import ErrorCode
+from backend.consts.exceptions import AppException
+
+
+def _create_mock_client(mock_response):
+    """
+    Create a properly configured mock client that works with the HttpClientManager.
+
+    The http_client_manager.get_sync_client() returns a client instance directly.
+    """
+    mock_client = MagicMock()
+    mock_client.post.return_value = mock_response
+    return mock_client
+
+
+class TestValidateIdataBaseParams:
+    """Test class for _validate_idata_base_params function."""
+
+    def test_validate_idata_base_params_success(self):
+        """Test validation with valid parameters."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        # Should not raise any exception
+        _validate_idata_base_params(
+            idata_api_base="https://idata.example.com",
+            api_key="test-api-key",
+            user_id="test-user-id"
+        )
+
+    def test_validate_idata_base_params_empty_api_base(self):
+        """Test validation fails when API base is empty."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="",
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+        assert "iData API URL is required" in str(exc_info.value)
+
+    def test_validate_idata_base_params_none_api_base(self):
+        """Test validation fails when API base is None."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base=None,
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_validate_idata_base_params_non_string_api_base(self):
+        """Test validation fails when API base is not a string."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base=123,
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_validate_idata_base_params_invalid_scheme(self):
+        """Test validation fails when API base doesn't start with http:// or https://."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="ftp://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+        assert "must start with http:// or https://" in str(exc_info.value)
+
+    def test_validate_idata_base_params_http_scheme(self):
+        """Test validation succeeds with http:// scheme."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        # Should not raise any exception
+        _validate_idata_base_params(
+            idata_api_base="http://idata.example.com",
+            api_key="test-api-key",
+            user_id="test-user-id"
+        )
+
+    def test_validate_idata_base_params_https_scheme(self):
+        """Test validation succeeds with https:// scheme."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        # Should not raise any exception
+        _validate_idata_base_params(
+            idata_api_base="https://idata.example.com",
+            api_key="test-api-key",
+            user_id="test-user-id"
+        )
+
+    def test_validate_idata_base_params_empty_api_key(self):
+        """Test validation fails when API key is empty."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="https://idata.example.com",
+                api_key="",
+                user_id="test-user-id"
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+        assert "iData API key is required" in str(exc_info.value)
+
+    def test_validate_idata_base_params_none_api_key(self):
+        """Test validation fails when API key is None."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="https://idata.example.com",
+                api_key=None,
+                user_id="test-user-id"
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_validate_idata_base_params_non_string_api_key(self):
+        """Test validation fails when API key is not a string."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="https://idata.example.com",
+                api_key=12345,
+                user_id="test-user-id"
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_validate_idata_base_params_empty_user_id(self):
+        """Test validation fails when user ID is empty."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id=""
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+        assert "iData user ID is required" in str(exc_info.value)
+
+    def test_validate_idata_base_params_none_user_id(self):
+        """Test validation fails when user ID is None."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id=None
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_validate_idata_base_params_non_string_user_id(self):
+        """Test validation fails when user ID is not a string."""
+        from backend.services.idata_service import _validate_idata_base_params
+
+        with pytest.raises(Exception) as exc_info:
+            _validate_idata_base_params(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id=12345
+            )
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+
+class TestNormalizeApiBase:
+    """Test class for _normalize_api_base function."""
+
+    def test_normalize_api_base_with_trailing_slash(self):
+        """Test normalization removes trailing slash."""
+        from backend.services.idata_service import _normalize_api_base
+
+        result = _normalize_api_base("https://idata.example.com/")
+        assert result == "https://idata.example.com"
+
+    def test_normalize_api_base_without_trailing_slash(self):
+        """Test normalization doesn't change URL without trailing slash."""
+        from backend.services.idata_service import _normalize_api_base
+
+        result = _normalize_api_base("https://idata.example.com")
+        assert result == "https://idata.example.com"
+
+    def test_normalize_api_base_multiple_trailing_slashes(self):
+        """Test normalization removes multiple trailing slashes."""
+        from backend.services.idata_service import _normalize_api_base
+
+        result = _normalize_api_base("https://idata.example.com///")
+        assert result == "https://idata.example.com"
+
+
+class TestMakeIdataRequest:
+    """Test class for _make_idata_request function."""
+
+    def test_make_idata_request_success(self):
+        """Test successful API request."""
+        from backend.services.idata_service import _make_idata_request
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {"code": "1", "data": []}
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = _make_idata_request(
+                api_base="https://idata.example.com",
+                url="https://idata.example.com/api/test",
+                headers={"Authorization": "Bearer token"},
+                request_body={"userId": "user-1"}
+            )
+
+        assert result == {"code": "1", "data": []}
+        mock_client.post.assert_called_once()
+        mock_response.raise_for_status.assert_called_once()
+
+    def test_make_idata_request_connection_error(self):
+        """Test request error handling."""
+        from backend.services.idata_service import _make_idata_request
+
+        mock_client = MagicMock()
+        mock_client.post.side_effect = httpx.RequestError("Connection failed")
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            with pytest.raises(Exception) as exc_info:
+                _make_idata_request(
+                    api_base="https://idata.example.com",
+                    url="https://idata.example.com/api/test",
+                    headers={},
+                    request_body={}
+                )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONNECTION_ERROR.value
+        assert "iData API request failed" in str(exc_info.value)
+
+    def test_make_idata_request_http_401_error(self):
+        """Test HTTP 401 error handling."""
+        from backend.services.idata_service import _make_idata_request
+
+        mock_response = MagicMock()
+        mock_response.status_code = 401
+        mock_http_error = httpx.HTTPStatusError(
+            "Unauthorized",
+            request=MagicMock(),
+            response=mock_response
+        )
+
+        mock_client = MagicMock()
+        mock_client.post.return_value = mock_response
+        mock_response.raise_for_status.side_effect = mock_http_error
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            with pytest.raises(Exception) as exc_info:
+                _make_idata_request(
+                    api_base="https://idata.example.com",
+                    url="https://idata.example.com/api/test",
+                    headers={},
+                    request_body={}
+                )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_AUTH_ERROR.value
+        assert "iData authentication failed" in str(exc_info.value)
+
+    def test_make_idata_request_http_403_error(self):
+        """Test HTTP 403 error handling."""
+        from backend.services.idata_service import _make_idata_request
+
+        mock_response = MagicMock()
+        mock_response.status_code = 403
+        mock_http_error = httpx.HTTPStatusError(
+            "Forbidden",
+            request=MagicMock(),
+            response=mock_response
+        )
+
+        mock_client = MagicMock()
+        mock_client.post.return_value = mock_response
+        mock_response.raise_for_status.side_effect = mock_http_error
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            with pytest.raises(Exception) as exc_info:
+                _make_idata_request(
+                    api_base="https://idata.example.com",
+                    url="https://idata.example.com/api/test",
+                    headers={},
+                    request_body={}
+                )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_AUTH_ERROR.value
+        assert "iData access forbidden" in str(exc_info.value)
+
+    def test_make_idata_request_http_429_error(self):
+        """Test HTTP 429 error handling."""
+        from backend.services.idata_service import _make_idata_request
+
+        mock_response = MagicMock()
+        mock_response.status_code = 429
+        mock_http_error = httpx.HTTPStatusError(
+            "Too Many Requests",
+            request=MagicMock(),
+            response=mock_response
+        )
+
+        mock_client = MagicMock()
+        mock_client.post.return_value = mock_response
+        mock_response.raise_for_status.side_effect = mock_http_error
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            with pytest.raises(Exception) as exc_info:
+                _make_idata_request(
+                    api_base="https://idata.example.com",
+                    url="https://idata.example.com/api/test",
+                    headers={},
+                    request_body={}
+                )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_RATE_LIMIT.value
+        assert "iData API rate limit exceeded" in str(exc_info.value)
+
+    def test_make_idata_request_http_500_error(self):
+        """Test HTTP 500 error handling."""
+        from backend.services.idata_service import _make_idata_request
+
+        mock_response = MagicMock()
+        mock_response.status_code = 500
+        mock_http_error = httpx.HTTPStatusError(
+            "Internal Server Error",
+            request=MagicMock(),
+            response=mock_response
+        )
+
+        mock_client = MagicMock()
+        mock_client.post.return_value = mock_response
+        mock_response.raise_for_status.side_effect = mock_http_error
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            with pytest.raises(Exception) as exc_info:
+                _make_idata_request(
+                    api_base="https://idata.example.com",
+                    url="https://idata.example.com/api/test",
+                    headers={},
+                    request_body={}
+                )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_SERVICE_ERROR.value
+        assert "iData API HTTP error 500" in str(exc_info.value)
+
+    def test_make_idata_request_json_decode_error(self):
+        """Test JSON decode error handling."""
+        from backend.services.idata_service import _make_idata_request
+
+        mock_response = MagicMock()
+        mock_response.raise_for_status = MagicMock()
+        mock_response.json.side_effect = json.JSONDecodeError("Invalid JSON", "", 0)
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            with pytest.raises(Exception) as exc_info:
+                _make_idata_request(
+                    api_base="https://idata.example.com",
+                    url="https://idata.example.com/api/test",
+                    headers={},
+                    request_body={}
+                )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_RESPONSE_ERROR.value
+        assert "Failed to parse iData API response" in str(exc_info.value)
+
+
+class TestParseIdataResponse:
+    """Test class for _parse_idata_response function."""
+
+    def test_parse_idata_response_success(self):
+        """Test successful response parsing."""
+        from backend.services.idata_service import _parse_idata_response
+
+        result = {
+            "code": "1",
+            "msg": "Success",
+            "data": [{"id": "1", "name": "Test"}],
+            "msgParams": None
+        }
+
+        data = _parse_idata_response(result)
+        assert data == [{"id": "1", "name": "Test"}]
+
+    def test_parse_idata_response_error_code(self):
+        """Test response parsing with error code."""
+        from backend.services.idata_service import _parse_idata_response
+
+        result = {
+            "code": "0",
+            "msg": "Error occurred",
+            "data": []
+        }
+
+        with pytest.raises(Exception) as exc_info:
+            _parse_idata_response(result)
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_SERVICE_ERROR.value
+        assert "iData API error: Error occurred" in str(exc_info.value)
+
+    def test_parse_idata_response_error_code_no_msg(self):
+        """Test response parsing with error code but no message."""
+        from backend.services.idata_service import _parse_idata_response
+
+        result = {
+            "code": "0",
+            "data": []
+        }
+
+        with pytest.raises(Exception) as exc_info:
+            _parse_idata_response(result)
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_SERVICE_ERROR.value
+        assert "iData API error: Unknown error" in str(exc_info.value)
+
+    def test_parse_idata_response_data_not_list(self):
+        """Test response parsing when data is not a list."""
+        from backend.services.idata_service import _parse_idata_response
+
+        result = {
+            "code": "1",
+            "msg": "Success",
+            "data": {"id": "1"}
+        }
+
+        with pytest.raises(Exception) as exc_info:
+            _parse_idata_response(result)
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_RESPONSE_ERROR.value
+        assert "data is not a list" in str(exc_info.value)
+
+    def test_parse_idata_response_empty_data(self):
+        """Test response parsing with empty data list."""
+        from backend.services.idata_service import _parse_idata_response
+
+        result = {
+            "code": "1",
+            "msg": "Success",
+            "data": []
+        }
+
+        data = _parse_idata_response(result)
+        assert data == []
+
+
+class TestFetchIdataKnowledgeSpacesImpl:
+    """Test class for fetch_idata_knowledge_spaces_impl function."""
+
+    def test_fetch_idata_knowledge_spaces_impl_success(self):
+        """Test successful fetching of knowledge spaces."""
+        from backend.services.idata_service import fetch_idata_knowledge_spaces_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [
+                {
+                    "id": "6cbf949946bf4b769c073259406b04f8",
+                    "name": "test1"
+                },
+                {
+                    "id": "7dbf949946bf4b769c073259406b04f9",
+                    "name": "test2"
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_knowledge_spaces_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+
+        assert len(result) == 2
+        assert result[0]["id"] == "6cbf949946bf4b769c073259406b04f8"
+        assert result[0]["name"] == "test1"
+        assert result[1]["id"] == "7dbf949946bf4b769c073259406b04f9"
+        assert result[1]["name"] == "test2"
+
+        # Verify request was made correctly
+        call_args = mock_client.post.call_args
+        assert "/knowledgeSpaces/query" in call_args[0][0]
+        assert call_args[1]["headers"]["Authorization"] == "Bearer test-api-key"
+        assert call_args[1]["json"]["userId"] == "test-user-id"
+
+    def test_fetch_idata_knowledge_spaces_impl_with_trailing_slash(self):
+        """Test fetching with API base URL that has trailing slash."""
+        from backend.services.idata_service import fetch_idata_knowledge_spaces_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [{"id": "1", "name": "test"}]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_knowledge_spaces_impl(
+                idata_api_base="https://idata.example.com/",
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+
+        assert len(result) == 1
+        # Verify URL normalization worked (no double slash)
+        call_args = mock_client.post.call_args
+        assert "//apiaccess" not in call_args[0][0]
+
+    def test_fetch_idata_knowledge_spaces_impl_empty_response(self):
+        """Test fetching when API returns empty list."""
+        from backend.services.idata_service import fetch_idata_knowledge_spaces_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": []
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_knowledge_spaces_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+
+        assert result == []
+
+    def test_fetch_idata_knowledge_spaces_impl_skips_invalid_items(self):
+        """Test fetching skips items that are not dicts or missing required fields."""
+        from backend.services.idata_service import fetch_idata_knowledge_spaces_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [
+                {"id": "1", "name": "valid1"},
+                "invalid_string",
+                {"id": "2"},  # missing name
+                {"name": "test"},  # missing id
+                {"id": "3", "name": "valid2"},
+                None,  # None item
+                {"id": "", "name": "empty_id"},  # empty id
+                {"id": "4", "name": ""}  # empty name
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_knowledge_spaces_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+
+        # Only valid items should be included
+        assert len(result) == 2
+        assert result[0]["id"] == "1"
+        assert result[0]["name"] == "valid1"
+        assert result[1]["id"] == "3"
+        assert result[1]["name"] == "valid2"
+
+    def test_fetch_idata_knowledge_spaces_impl_validation_error(self):
+        """Test fetching with invalid parameters raises validation error."""
+        from backend.services.idata_service import fetch_idata_knowledge_spaces_impl
+
+        with pytest.raises(Exception) as exc_info:
+            fetch_idata_knowledge_spaces_impl(
+                idata_api_base="",
+                api_key="test-api-key",
+                user_id="test-user-id"
+            )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_fetch_idata_knowledge_spaces_impl_api_error(self):
+        """Test fetching when API returns error code."""
+        from backend.services.idata_service import fetch_idata_knowledge_spaces_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "0",
+            "msg": "API Error",
+            "data": []
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            with pytest.raises(Exception) as exc_info:
+                fetch_idata_knowledge_spaces_impl(
+                    idata_api_base="https://idata.example.com",
+                    api_key="test-api-key",
+                    user_id="test-user-id"
+                )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_SERVICE_ERROR.value
+
+
+class TestFetchIdataDatasetsImpl:
+    """Test class for fetch_idata_datasets_impl function."""
+
+    def test_fetch_idata_datasets_impl_success(self):
+        """Test successful fetching of datasets."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [
+                {
+                    "id": "kb-1",
+                    "name": "Knowledge Base 1",
+                    "fileCount": 10
+                },
+                {
+                    "id": "kb-2",
+                    "name": "Knowledge Base 2",
+                    "fileCount": 20
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1"
+            )
+
+        assert result["count"] == 2
+        assert result["indices"] == ["kb-1", "kb-2"]
+        assert len(result["indices_info"]) == 2
+
+        # Verify first knowledge base
+        assert result["indices_info"][0]["name"] == "kb-1"
+        assert result["indices_info"][0]["display_name"] == "Knowledge Base 1"
+        assert result["indices_info"][0]["stats"]["base_info"]["doc_count"] == 10
+        assert result["indices_info"][0]["stats"]["base_info"]["process_source"] == "iData"
+
+        # Verify second knowledge base
+        assert result["indices_info"][1]["name"] == "kb-2"
+        assert result["indices_info"][1]["display_name"] == "Knowledge Base 2"
+        assert result["indices_info"][1]["stats"]["base_info"]["doc_count"] == 20
+        assert result["indices_info"][1]["stats"]["base_info"]["process_source"] == "iData"
+
+        # Verify request was made correctly
+        call_args = mock_client.post.call_args
+        assert "/knowledgeBases/query" in call_args[0][0]
+        assert call_args[1]["headers"]["Authorization"] == "Bearer test-api-key"
+        assert call_args[1]["json"]["userId"] == "test-user-id"
+        assert call_args[1]["json"]["knowledgeSpaceId"] == "space-1"
+
+    def test_fetch_idata_datasets_impl_empty_response(self):
+        """Test fetching when API returns empty list."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": []
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1"
+            )
+
+        assert result["count"] == 0
+        assert result["indices"] == []
+        assert result["indices_info"] == []
+
+    def test_fetch_idata_datasets_impl_skips_invalid_items(self):
+        """Test fetching skips items that are not dicts or missing id."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [
+                {"id": "kb-1", "name": "KB 1", "fileCount": 5},
+                "invalid_string",
+                {"name": "KB 2", "fileCount": 10},  # missing id
+                {"id": "", "name": "KB 3", "fileCount": 15},  # empty id
+                {"id": "kb-4", "name": "KB 4", "fileCount": 20},
+                None  # None item
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1"
+            )
+
+        # Only valid items should be included
+        assert result["count"] == 2
+        assert result["indices"] == ["kb-1", "kb-4"]
+        assert len(result["indices_info"]) == 2
+
+    def test_fetch_idata_datasets_impl_missing_file_count(self):
+        """Test fetching handles missing fileCount field."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [
+                {
+                    "id": "kb-1",
+                    "name": "Knowledge Base 1"
+                    # fileCount missing
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1"
+            )
+
+        assert result["count"] == 1
+        assert result["indices_info"][0]["stats"]["base_info"]["doc_count"] == 0
+
+    def test_fetch_idata_datasets_impl_missing_name(self):
+        """Test fetching handles missing name field."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [
+                {
+                    "id": "kb-1",
+                    "fileCount": 10
+                    # name missing
+                }
+            ]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1"
+            )
+
+        assert result["count"] == 1
+        assert result["indices_info"][0]["display_name"] == ""
+
+    def test_fetch_idata_datasets_impl_validation_error_api_base(self):
+        """Test fetching with invalid API base raises validation error."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        with pytest.raises(Exception) as exc_info:
+            fetch_idata_datasets_impl(
+                idata_api_base="",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1"
+            )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_fetch_idata_datasets_impl_validation_error_knowledge_space_id_empty(self):
+        """Test fetching with empty knowledge space ID raises validation error."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        with pytest.raises(Exception) as exc_info:
+            fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id=""
+            )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+        assert "Knowledge space ID is required" in str(exc_info.value)
+
+    def test_fetch_idata_datasets_impl_validation_error_knowledge_space_id_none(self):
+        """Test fetching with None knowledge space ID raises validation error."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        with pytest.raises(Exception) as exc_info:
+            fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id=None
+            )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_fetch_idata_datasets_impl_validation_error_knowledge_space_id_non_string(self):
+        """Test fetching with non-string knowledge space ID raises validation error."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        with pytest.raises(Exception) as exc_info:
+            fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id=12345
+            )
+
+        assert hasattr(exc_info.value, 'error_code')
+        assert exc_info.value.error_code.value == ErrorCode.IDATA_CONFIG_INVALID.value
+
+    def test_fetch_idata_datasets_impl_with_trailing_slash(self):
+        """Test fetching with API base URL that has trailing slash."""
+        from backend.services.idata_service import fetch_idata_datasets_impl
+
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "msg": "Success",
+            "data": [{"id": "kb-1", "name": "KB 1", "fileCount": 5}]
+        }
+        mock_response.raise_for_status = MagicMock()
+
+        mock_client = _create_mock_client(mock_response)
+
+        with patch('backend.services.idata_service.http_client_manager') as mock_manager:
+            mock_manager.get_sync_client.return_value = mock_client
+
+            result = fetch_idata_datasets_impl(
+                idata_api_base="https://idata.example.com/",
+                api_key="test-api-key",
+                user_id="test-user-id",
+                knowledge_space_id="space-1"
+            )
+
+        assert result["count"] == 1
+        # Verify URL normalization worked (no double slash)
+        call_args = mock_client.post.call_args
+        assert "//apiaccess" not in call_args[0][0]
diff --git a/test/backend/services/test_model_management_service.py b/test/backend/services/test_model_management_service.py
index 6d0806299..6e504e90a 100644
--- a/test/backend/services/test_model_management_service.py
+++ b/test/backend/services/test_model_management_service.py
@@ -120,10 +120,14 @@ class _Func:
 class _ProviderEnum:
     SILICON = _EnumItem("silicon")
     MODELENGINE = _EnumItem("modelengine")
+    DASHSCOPE = _EnumItem("dashscope")
+    TOKENPONY = _EnumItem("tokenpony")
 
 
 consts_provider_mod.ProviderEnum = _ProviderEnum
 consts_provider_mod.SILICON_BASE_URL = "http://silicon.test"
+consts_provider_mod.DASHSCOPE_BASE_URL = "https://dashscope.aliyuncs.com/compatible-mode/v1/"
+consts_provider_mod.TOKENPONY_BASE_URL = "https://api.tokenpony.cn/v1/"
 sys.modules["consts.provider"] = consts_provider_mod
 
 # Stub services.model_provider_service used by service
@@ -553,6 +557,58 @@ async def test_create_provider_models_for_tenant_exception():
         assert "Failed to create provider models" in str(exc.value)
 
 
+@pytest.mark.asyncio
+async def test_batch_create_models_for_tenant_dashscope_provider():
+    """Test batch_create_models_for_tenant with DASHSCOPE provider uses DASHSCOPE_BASE_URL."""
+    svc = import_svc()
+
+    batch_payload = {
+        "provider": "dashscope",
+        "type": "llm",
+        "models": [{"id": "qwen/qwen-turbo", "max_tokens": 8192}],
+        "api_key": "dash-key",
+    }
+
+    with mock.patch.object(svc, "get_models_by_tenant_factory_type", return_value=[]), \
+            mock.patch.object(svc, "delete_model_record"), \
+            mock.patch.object(svc, "split_repo_name", return_value=("qwen", "qwen-turbo")), \
+            mock.patch.object(svc, "add_repo_to_name", return_value="qwen/qwen-turbo"), \
+            mock.patch.object(svc, "get_model_by_display_name", return_value=None), \
+            mock.patch.object(svc, "prepare_model_dict", new=mock.AsyncMock(return_value={"model_id": 1})), \
+            mock.patch.object(svc, "create_model_record", return_value=True):
+
+        await svc.batch_create_models_for_tenant("u1", "t1", batch_payload)
+
+        call_args = svc.prepare_model_dict.call_args
+        assert call_args[1]["model_url"] == "https://dashscope.aliyuncs.com/compatible-mode/v1/"
+
+
+@pytest.mark.asyncio
+async def test_batch_create_models_for_tenant_tokenpony_provider():
+    """Test batch_create_models_for_tenant with TOKENPONY provider uses TOKENPONY_BASE_URL."""
+    svc = import_svc()
+
+    batch_payload = {
+        "provider": "tokenpony",
+        "type": "llm",
+        "models": [{"id": "gpt/gpt-4o", "max_tokens": 128000}],
+        "api_key": "tp-key",
+    }
+
+    with mock.patch.object(svc, "get_models_by_tenant_factory_type", return_value=[]), \
+            mock.patch.object(svc, "delete_model_record"), \
+            mock.patch.object(svc, "split_repo_name", return_value=("gpt", "gpt-4o")), \
+            mock.patch.object(svc, "add_repo_to_name", return_value="gpt/gpt-4o"), \
+            mock.patch.object(svc, "get_model_by_display_name", return_value=None), \
+            mock.patch.object(svc, "prepare_model_dict", new=mock.AsyncMock(return_value={"model_id": 2})), \
+            mock.patch.object(svc, "create_model_record", return_value=True):
+
+        await svc.batch_create_models_for_tenant("u1", "t1", batch_payload)
+
+        call_args = svc.prepare_model_dict.call_args
+        assert call_args[1]["model_url"] == "https://api.tokenpony.cn/v1/"
+
+
 @pytest.mark.asyncio
 async def test_batch_create_models_for_tenant_other_provider():
     """Test batch_create_models_for_tenant with non-Silicon/ModelEngine provider (covers lines 138-140)"""
diff --git a/test/backend/services/test_model_provider_service.py b/test/backend/services/test_model_provider_service.py
index f81222056..992025754 100644
--- a/test/backend/services/test_model_provider_service.py
+++ b/test/backend/services/test_model_provider_service.py
@@ -157,6 +157,8 @@ def __init__(self):
 class _ProviderEnumStub:
     SILICON = mock.Mock(value="silicon")
     MODELENGINE = mock.Mock(value="modelengine")
+    DASHSCOPE = mock.Mock(value="dashscope")
+    TOKENPONY = mock.Mock(value="tokenpony")
 
 
 sys.modules["consts.provider"].ProviderEnum = _ProviderEnumStub
@@ -1903,3 +1905,125 @@ def test_get_model_engine_raw_url_trailing_slash():
     for input_url, expected in test_cases:
         result = get_model_engine_raw_url(input_url)
         assert result == expected, f"Failed for input: {input_url}"
+
+
+# ============================================================================
+# Test-cases for get_provider_models with DashScope provider
+# ============================================================================
+
+
+@pytest.mark.asyncio
+async def test_get_provider_models_dashscope_success():
+    """Should successfully get models from DashScope provider."""
+    from backend.services.model_provider_service import DashScopeModelProvider
+
+    model_data = {
+        "provider": "dashscope",
+        "model_type": "llm",
+        "api_key": "test-key",
+    }
+
+    expected_models = [
+        {
+            "id": "qwen-turbo",
+            "model_tag": "chat",
+            "model_type": "llm",
+            "max_tokens": sys.modules["consts.const"].DEFAULT_LLM_MAX_TOKENS,
+        }
+    ]
+
+    with mock.patch(
+        "backend.services.model_provider_service.DashScopeModelProvider"
+    ) as mock_provider_class:
+        mock_provider_instance = mock.AsyncMock()
+        mock_provider_instance.get_models.return_value = expected_models
+        mock_provider_class.return_value = mock_provider_instance
+
+        result = await get_provider_models(model_data)
+
+        assert result == expected_models
+        mock_provider_class.assert_called_once()
+        mock_provider_instance.get_models.assert_called_once_with(model_data)
+
+
+@pytest.mark.asyncio
+async def test_get_provider_models_dashscope_empty_result():
+    """Should handle empty result from DashScope provider."""
+    model_data = {
+        "provider": "dashscope",
+        "model_type": "embedding",
+        "api_key": "test-key",
+    }
+
+    with mock.patch(
+        "backend.services.model_provider_service.DashScopeModelProvider"
+    ) as mock_provider_class:
+        mock_provider_instance = mock.AsyncMock()
+        mock_provider_instance.get_models.return_value = []
+        mock_provider_class.return_value = mock_provider_instance
+
+        result = await get_provider_models(model_data)
+
+        assert result == []
+        mock_provider_instance.get_models.assert_called_once_with(model_data)
+
+
+# ============================================================================
+# Test-cases for get_provider_models with TokenPony provider
+# ============================================================================
+
+
+@pytest.mark.asyncio
+async def test_get_provider_models_tokenpony_success():
+    """Should successfully get models from TokenPony provider."""
+    from backend.services.model_provider_service import TokenPonyModelProvider
+
+    model_data = {
+        "provider": "tokenpony",
+        "model_type": "llm",
+        "api_key": "test-key",
+    }
+
+    expected_models = [
+        {
+            "id": "gpt-4",
+            "model_tag": "chat",
+            "model_type": "llm",
+            "max_tokens": sys.modules["consts.const"].DEFAULT_LLM_MAX_TOKENS,
+        }
+    ]
+
+    with mock.patch(
+        "backend.services.model_provider_service.TokenPonyModelProvider"
+    ) as mock_provider_class:
+        mock_provider_instance = mock.AsyncMock()
+        mock_provider_instance.get_models.return_value = expected_models
+        mock_provider_class.return_value = mock_provider_instance
+
+        result = await get_provider_models(model_data)
+
+        assert result == expected_models
+        mock_provider_class.assert_called_once()
+        mock_provider_instance.get_models.assert_called_once_with(model_data)
+
+
+@pytest.mark.asyncio
+async def test_get_provider_models_tokenpony_empty_result():
+    """Should handle empty result from TokenPony provider."""
+    model_data = {
+        "provider": "tokenpony",
+        "model_type": "embedding",
+        "api_key": "test-key",
+    }
+
+    with mock.patch(
+        "backend.services.model_provider_service.TokenPonyModelProvider"
+    ) as mock_provider_class:
+        mock_provider_instance = mock.AsyncMock()
+        mock_provider_instance.get_models.return_value = []
+        mock_provider_class.return_value = mock_provider_instance
+
+        result = await get_provider_models(model_data)
+
+        assert result == []
+        mock_provider_instance.get_models.assert_called_once_with(model_data)
\ No newline at end of file
diff --git a/test/backend/services/test_northbound_service.py b/test/backend/services/test_northbound_service.py
index acd1b2839..0d658e198 100644
--- a/test/backend/services/test_northbound_service.py
+++ b/test/backend/services/test_northbound_service.py
@@ -1,321 +1,385 @@
 import sys
-import types
-from typing import Any
+import os
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), "../../.."))
 
 import pytest
-from unittest.mock import AsyncMock, MagicMock
-
-
-# -----------------------------
-# Stub external modules before import
-# -----------------------------
-
-# consts.model stubs used by northbound_service
-consts_mod = types.ModuleType("consts")
-consts_mod.__path__ = []  # Mark as namespace package so that submodule imports work
-consts_model_mod = types.ModuleType("consts.model")
-consts_exceptions_mod = types.ModuleType("consts.exceptions")
-
-
-# Define the custom exception classes expected by northbound_service
+from unittest.mock import MagicMock, AsyncMock, patch
+
+
+# First mock the consts module to avoid ModuleNotFoundError
+consts_mock = MagicMock()
+consts_mock.const = MagicMock()
+consts_mock.const.MINIO_ENDPOINT = "http://localhost:9000"
+consts_mock.const.MINIO_ACCESS_KEY = "test_access_key"
+consts_mock.const.MINIO_SECRET_KEY = "test_secret_key"
+consts_mock.const.MINIO_REGION = "us-east-1"
+consts_mock.const.MINIO_DEFAULT_BUCKET = "test-bucket"
+consts_mock.const.POSTGRES_HOST = "localhost"
+consts_mock.const.POSTGRES_USER = "test_user"
+consts_mock.const.NEXENT_POSTGRES_PASSWORD = "test_password"
+consts_mock.const.POSTGRES_DB = "test_db"
+consts_mock.const.POSTGRES_PORT = 5432
+consts_mock.const.DEFAULT_TENANT_ID = "default_tenant"
+
+sys.modules['consts'] = consts_mock
+sys.modules['consts.const'] = consts_mock.const
+
+# Mock exceptions module
 class LimitExceededError(Exception):
-    """Raised when the rate limit or similar guard is violated."""
-
+    pass
 
 class UnauthorizedError(Exception):
-    """Raised when authentication or authorization fails."""
-
-
-class SignatureValidationError(Exception):
-    """Raised when request signature header is missing or invalid."""
-
-
-# Attach them to the stub module so that `from consts.exceptions import ...` works
-consts_exceptions_mod.LimitExceededError = LimitExceededError
-consts_exceptions_mod.UnauthorizedError = UnauthorizedError
-consts_exceptions_mod.SignatureValidationError = SignatureValidationError
-
+    pass
+
+exceptions_mock = MagicMock()
+exceptions_mock.LimitExceededError = LimitExceededError
+exceptions_mock.UnauthorizedError = UnauthorizedError
+sys.modules['consts.exceptions'] = exceptions_mock
+sys.modules['backend.consts.exceptions'] = exceptions_mock
+
+# Mock database client
+client_mock = MagicMock()
+client_mock.MinioClient = MagicMock()
+client_mock.get_db_session = MagicMock()
+sys.modules['database.client'] = client_mock
+sys.modules['backend.database.client'] = client_mock
+
+# Mock token_db module
+token_db_mock = MagicMock()
+token_db_mock.log_token_usage = MagicMock(return_value=1)
+token_db_mock.get_latest_usage_metadata = MagicMock(return_value={"query": "test"})
+sys.modules['database.token_db'] = token_db_mock
+sys.modules['backend.database.token_db'] = token_db_mock
+
+# Mock conversation_db module
+conversation_db_mock = MagicMock()
+conversation_db_mock.get_conversation_messages = MagicMock(return_value=[
+    {"message_role": "user", "message_content": "Hello"}
+])
+sys.modules['database.conversation_db'] = conversation_db_mock
+sys.modules['backend.database.conversation_db'] = conversation_db_mock
+
+# Mock agent_service module
+agent_service_mock = MagicMock()
+agent_service_mock.run_agent_stream = AsyncMock()
+agent_service_mock.stop_agent_tasks = MagicMock(return_value={"message": "stopped"})
+agent_service_mock.list_all_agent_info_impl = AsyncMock(return_value=[{"agent_id": 1, "name": "test_agent"}])
+agent_service_mock.get_agent_id_by_name = AsyncMock(return_value=1)
+sys.modules['services.agent_service'] = agent_service_mock
+sys.modules['backend.services.agent_service'] = agent_service_mock
+
+# Mock conversation_management_service module
+conv_mgmt_mock = MagicMock()
+conv_mgmt_mock.save_conversation_user = MagicMock()
+conv_mgmt_mock.get_conversation_list_service = MagicMock(return_value=[
+    {"conversation_id": "1", "title": "Test"}
+])
+conv_mgmt_mock.create_new_conversation = MagicMock(return_value={"conversation_id": 123})
+conv_mgmt_mock.update_conversation_title_service = MagicMock()
+sys.modules['services.conversation_management_service'] = conv_mgmt_mock
+sys.modules['backend.services.conversation_management_service'] = conv_mgmt_mock
+
+# Mock consts.model
+consts_model_mock = MagicMock()
+AgentRequest_mock = MagicMock()
+consts_model_mock.AgentRequest = AgentRequest_mock
+sys.modules['consts.model'] = consts_model_mock
+
+# Mock database.db_models
+db_models_mock = MagicMock()
+sys.modules['database.db_models'] = db_models_mock
+
+# Now import the module under test
+from backend.services import northbound_service as ns
 
-class AgentRequest:
-    def __init__(self, conversation_id: int, agent_id: int, query: str, history: Any, minio_files=None, is_debug: bool = False):
-        self.conversation_id = conversation_id
-        self.agent_id = agent_id
-        self.query = query
-        self.history = history
-        self.minio_files = minio_files
-        self.is_debug = is_debug
 
+class MockNorthboundContext:
+    """Mock NorthboundContext for testing."""
+    def __init__(self, request_id="req-123", tenant_id="tenant-1", user_id="user-1",
+                 authorization="Bearer test", token_id=0):
+        self.request_id = request_id
+        self.tenant_id = tenant_id
+        self.user_id = user_id
+        self.authorization = authorization
+        self.token_id = token_id
 
-consts_model_mod.AgentRequest = AgentRequest
-sys.modules['consts'] = consts_mod
-# Register stubs
-sys.modules['consts.model'] = consts_model_mod
-sys.modules['consts.exceptions'] = consts_exceptions_mod
 
-# database.* stubs
-database_mod = types.ModuleType('database')
-conversation_db_mod = types.ModuleType('database.conversation_db')
-partner_db_mod = types.ModuleType('database.partner_db')
+@pytest.fixture(autouse=True)
+def reset_test_isolation():
+    """Reset test isolation state before each test."""
+    # Clear idempotency state
+    ns._IDEMPOTENCY_RUNNING.clear()
+    # Reset mock call counts
+    token_db_mock.log_token_usage.reset_mock()
+    yield
+    # Cleanup after test
+    ns._IDEMPOTENCY_RUNNING.clear()
 
 
-def _default_get_conversation_messages(_: int):
-    return []
+class TestNorthboundContext:
+    """Tests for NorthboundContext dataclass."""
+
+    def test_northbound_context_default_token_id(self):
+        """Test that token_id defaults to 0."""
+        ctx = ns.NorthboundContext(
+            request_id="req-1",
+            tenant_id="tenant-1",
+            user_id="user-1",
+            authorization="Bearer test"
+        )
+        assert ctx.token_id == 0
+
+    def test_northbound_context_with_token_id(self):
+        """Test that token_id can be set."""
+        ctx = ns.NorthboundContext(
+            request_id="req-1",
+            tenant_id="tenant-1",
+            user_id="user-1",
+            authorization="Bearer test",
+            token_id=123
+        )
+        assert ctx.token_id == 123
+
+
+class TestBuildIdempotencyKey:
+    """Tests for _build_idempotency_key function."""
+
+    def test_build_idempotency_key_normal(self):
+        """Test normal case."""
+        key = ns._build_idempotency_key("tenant1", "123", "agent1", "query")
+        assert "tenant1" in key
+        assert "123" in key
+
+    def test_build_idempotency_key_with_none(self):
+        """Test with None values."""
+        key = ns._build_idempotency_key("tenant1", None, "query")
+        assert "tenant1" in key
+        # None values are converted to empty string
+        assert "None" not in key
+        # Should contain the empty string from None conversion
+        assert "tenant1::" in key or ":query" in key
+
+    def test_build_idempotency_key_long_string(self):
+        """Test with long string gets hashed."""
+        long_string = "a" * 100
+        key = ns._build_idempotency_key(long_string)
+        # Should be hashed (not the full string)
+        assert len(key) < 100
 
 
-conversation_db_mod.get_conversation_messages = MagicMock(side_effect=_default_get_conversation_messages)
-partner_db_mod.add_mapping_id = MagicMock()
-partner_db_mod.get_external_id_by_internal = MagicMock(return_value="ext-1")
-partner_db_mod.get_internal_id_by_external = MagicMock(return_value=1)
-sys.modules['database'] = database_mod
-sys.modules['database.conversation_db'] = conversation_db_mod
-sys.modules['database.partner_db'] = partner_db_mod
+@pytest.mark.asyncio
+class TestStartStreamingChat:
+    """Tests for start_streaming_chat function."""
+
+    async def test_start_streaming_chat_creates_conversation(self):
+        """Test that new conversation is created when conversation_id is None."""
+        ctx = MockNorthboundContext(token_id=1)
+
+        # Mock response
+        mock_response = MagicMock()
+        mock_response.headers = {}
+        agent_service_mock.run_agent_stream.return_value = mock_response
+
+        with patch.object(ns, 'check_and_consume_rate_limit', new_callable=AsyncMock):
+            with patch.object(ns, 'idempotency_start', new_callable=AsyncMock):
+                with patch.object(ns, 'get_conversation_history_internal', new_callable=AsyncMock) as mock_history:
+                    mock_history.return_value = {"data": {"history": []}}
+
+                    try:
+                        result = await ns.start_streaming_chat(
+                            ctx=ctx,
+                            conversation_id=None,
+                            agent_name="test_agent",
+                            query="test query"
+                        )
+                    except Exception:
+                        pass  # May fail due to other mocks
+
+                    # Verify create_new_conversation was called
+                    conv_mgmt_mock.create_new_conversation.assert_called()
+
+    async def test_start_streaming_chat_logs_token_usage(self):
+        """Test that token usage is logged when token_id > 0."""
+        ctx = MockNorthboundContext(token_id=1)
+
+        mock_response = MagicMock()
+        mock_response.headers = {}
+        agent_service_mock.run_agent_stream.return_value = mock_response
+
+        with patch.object(ns, 'check_and_consume_rate_limit', new_callable=AsyncMock):
+            with patch.object(ns, 'idempotency_start', new_callable=AsyncMock):
+                with patch.object(ns, 'idempotency_end', new_callable=AsyncMock):
+                    with patch.object(ns, 'get_conversation_history_internal', new_callable=AsyncMock) as mock_history:
+                        mock_history.return_value = {"data": {"history": []}}
+
+                        try:
+                            await ns.start_streaming_chat(
+                                ctx=ctx,
+                                conversation_id=123,
+                                agent_name="test_agent",
+                                query="test query",
+                                meta_data={"key": "value"}
+                            )
+                        except Exception:
+                            pass
+
+                        # Verify log_token_usage was called
+                        token_db_mock.log_token_usage.assert_called()
 
-# services.* stubs
-services_mod = types.ModuleType('services')
-conv_mgmt_mod = types.ModuleType('services.conversation_management_service')
-agent_service_mod = types.ModuleType('services.agent_service')
 
-conv_mgmt_mod.get_conversation_list_service = MagicMock(return_value=[{"conversation_id": 1}])
-conv_mgmt_mod.create_new_conversation = MagicMock(return_value={"conversation_id": 2})
-conv_mgmt_mod.update_conversation_title = MagicMock()
-conv_mgmt_mod.save_conversation_user = MagicMock()
+@pytest.mark.asyncio
+class TestStopChat:
+    """Tests for stop_chat function."""
 
-agent_service_mod.run_agent_stream = AsyncMock()
-agent_service_mod.stop_agent_tasks = MagicMock(return_value={"message": "success"})
-agent_service_mod.list_all_agent_info_impl = AsyncMock(return_value=[{"agent_id": 1, "name": "A"}])
-agent_service_mod.get_agent_id_by_name = AsyncMock(return_value=99)
+    async def test_stop_chat_success(self):
+        """Test successful stop chat."""
+        ctx = MockNorthboundContext(token_id=1)
+        agent_service_mock.stop_agent_tasks.return_value = {"message": "stopped"}
 
-sys.modules['services'] = services_mod
-sys.modules['services.conversation_management_service'] = conv_mgmt_mod
-sys.modules['services.agent_service'] = agent_service_mod
+        result = await ns.stop_chat(ctx=ctx, conversation_id=123)
 
+        assert result["message"] == "stopped"
+        assert result["data"] == 123
 
-# -----------------------------
-# Import module under test
-# -----------------------------
-from backend.services import northbound_service as ns
+    async def test_stop_chat_logs_token_usage(self):
+        """Test that token usage is logged."""
+        ctx = MockNorthboundContext(token_id=1)
 
+        await ns.stop_chat(ctx=ctx, conversation_id=123, meta_data={"test": "data"})
 
-# -----------------------------
-# Fixtures
-# -----------------------------
-@pytest.fixture(autouse=True)
-def reset_state():
-    ns._IDEMPOTENCY_RUNNING.clear()
-    ns._RATE_STATE.clear()
-    # reset partner and conversation mocks between tests
-    partner_db_mod.add_mapping_id.reset_mock()
-    partner_db_mod.get_external_id_by_internal.reset_mock(return_value=True)
-    partner_db_mod.get_external_id_by_internal.return_value = "ext-1"
-    partner_db_mod.get_internal_id_by_external.reset_mock(return_value=True)
-    partner_db_mod.get_internal_id_by_external.return_value = 1
-    conversation_db_mod.get_conversation_messages.reset_mock(side_effect=True)
-    conversation_db_mod.get_conversation_messages.side_effect = _default_get_conversation_messages
-    conv_mgmt_mod.get_conversation_list_service.reset_mock(return_value=True)
-    conv_mgmt_mod.get_conversation_list_service.return_value = [{"conversation_id": 1}]
-    conv_mgmt_mod.create_new_conversation.reset_mock(return_value=True)
-    conv_mgmt_mod.create_new_conversation.return_value = {"conversation_id": 2}
-    conv_mgmt_mod.update_conversation_title.reset_mock()
-    agent_service_mod.run_agent_stream.reset_mock()
-    agent_service_mod.run_agent_stream.return_value = None
-    agent_service_mod.stop_agent_tasks.reset_mock(return_value=True)
-    agent_service_mod.stop_agent_tasks.return_value = {"message": "success"}
-    agent_service_mod.list_all_agent_info_impl.reset_mock(return_value=True)
-    agent_service_mod.list_all_agent_info_impl.return_value = [{"agent_id": 1, "name": "A"}]
-    agent_service_mod.get_agent_id_by_name.reset_mock(return_value=True)
-    agent_service_mod.get_agent_id_by_name.return_value = 99
-
-
-@pytest.fixture
-def ctx() -> ns.NorthboundContext:
-    return ns.NorthboundContext(
-        request_id="req-1",
-        tenant_id="tenant-1",
-        user_id="user-1",
-        authorization="Bearer t"
-    )
-
-
-# -----------------------------
-# Unit tests
-# -----------------------------
-def test_build_idempotency_key_hashing():
-    long = "x" * 100
-    key = ns._build_idempotency_key("a", long, "b")
-    parts = key.split(":")
-    assert parts[0] == "a"
-    assert len(parts[1]) == 64  # sha256 hex
-    assert parts[2] == "b"
+        token_db_mock.log_token_usage.assert_called()
 
 
 @pytest.mark.asyncio
-async def test_to_external_and_internal_conversation_id_success():
-    ext = await ns.to_external_conversation_id(123)
-    assert ext == "ext-1"
-    internal = await ns.to_internal_conversation_id("ext-123")
-    assert internal == 1
+class TestListConversations:
+    """Tests for list_conversations function."""
 
+    async def test_list_conversations_success(self):
+        """Test successful conversation listing."""
+        ctx = MockNorthboundContext(token_id=0)  # No token_id, no metadata lookup
 
-@pytest.mark.asyncio
-async def test_to_external_conversation_id_not_found():
-    partner_db_mod.get_external_id_by_internal.return_value = None
-    with pytest.raises(Exception):
-        await ns.to_external_conversation_id(123)
-
+        result = await ns.list_conversations(ctx=ctx)
 
-@pytest.mark.asyncio
-async def test_get_agent_info_by_name_success():
-    agent_id = await ns.get_agent_info_by_name("helper", "tenant-1")
-    assert agent_id == 99
+        assert result["message"] == "success"
+        assert "data" in result
 
+    async def test_list_conversations_with_metadata(self):
+        """Test that metadata is added when token_id > 0."""
+        ctx = MockNorthboundContext(token_id=1)
+        token_db_mock.get_latest_usage_metadata.return_value = {"query": "test query"}
 
-@pytest.mark.asyncio
-async def test_get_agent_info_by_name_failure(monkeypatch):
-    async def raise_err(*_args, **_kwargs):
-        raise Exception("boom")
+        result = await ns.list_conversations(ctx=ctx)
 
-    monkeypatch.setattr(ns, "get_agent_id_by_name", raise_err)
-    with pytest.raises(Exception) as ei:
-        await ns.get_agent_info_by_name("helper", "tenant-1")
-    assert "Failed to get agent id" in str(ei.value)
+        # Should have called get_latest_usage_metadata
+        token_db_mock.get_latest_usage_metadata.assert_called()
 
 
 @pytest.mark.asyncio
-async def test_start_streaming_chat_existing_conversation(ctx, monkeypatch):
-    # Arrange existing conversation
-    partner_db_mod.get_internal_id_by_external.return_value = 123
-
-    async def _agen():
-        yield b"data: chunk1\n\n"
-    from fastapi.responses import StreamingResponse
-    resp_stream = StreamingResponse(_agen(), media_type="text/event-stream")
-    monkeypatch.setattr(ns, "run_agent_stream", AsyncMock(return_value=resp_stream))
-    conversation_db_mod.get_conversation_messages.side_effect = lambda _cid: [
-        {"message_role": "user", "message_content": "hi"}
-    ]
-
-    # Act
-    resp = await ns.start_streaming_chat(
-        ctx=ctx,
-        external_conversation_id="ext-123",
-        agent_name="helper",
-        query="hello",
-        idempotency_key="k1",
-    )
-
-    # Assert
-    assert resp is not None
-    assert resp.headers["X-Request-Id"] == "req-1"
-    assert resp.headers["conversation_id"] == "ext-123"
-    partner_db_mod.add_mapping_id.assert_not_called()
+class TestGetConversationHistory:
+    """Tests for get_conversation_history function."""
 
+    async def test_get_conversation_history_success(self):
+        """Test successful history retrieval."""
+        ctx = MockNorthboundContext(token_id=1)
+        conversation_db_mock.get_conversation_messages.return_value = [
+            {"message_role": "user", "message_content": "Hello"},
+            {"message_role": "assistant", "message_content": "Hi there"}
+        ]
 
-@pytest.mark.asyncio
-async def test_start_streaming_chat_creates_new_conversation(ctx, monkeypatch):
-    # Arrange missing conversation triggers creation
-    partner_db_mod.get_internal_id_by_external.return_value = None
-
-    async def _agen():
-        yield b"data: c\n\n"
-    from fastapi.responses import StreamingResponse
-    resp_stream = StreamingResponse(_agen(), media_type="text/event-stream")
-    monkeypatch.setattr(ns, "run_agent_stream", AsyncMock(return_value=resp_stream))
-
-    # Act
-    resp = await ns.start_streaming_chat(
-        ctx=ctx,
-        external_conversation_id="ext-new",
-        agent_name="helper",
-        query="hello",
-        idempotency_key="k2",
-    )
-
-    # Assert
-    assert resp is not None
-    partner_db_mod.add_mapping_id.assert_called_once()
-    args, kwargs = partner_db_mod.add_mapping_id.call_args
-    assert kwargs["internal_id"] == 2  # internal id from create_new_conversation
-    assert kwargs["external_id"] == "ext-new"
-    assert kwargs["tenant_id"] == ctx.tenant_id
-    assert kwargs["user_id"] == ctx.user_id
-
+        result = await ns.get_conversation_history(ctx=ctx, conversation_id=123)
 
-@pytest.mark.asyncio
-async def test_rate_limit_exceeded(monkeypatch):
-    monkeypatch.setattr(ns, "_RATE_LIMIT_PER_MINUTE", 1)
-    await ns.check_and_consume_rate_limit("tenant-x")
-    with pytest.raises(consts_exceptions_mod.LimitExceededError):
-        await ns.check_and_consume_rate_limit("tenant-x")
+        assert result["message"] == "success"
+        assert "data" in result
+        assert "history" in result["data"]
 
 
 @pytest.mark.asyncio
-async def test_idempotency_prevents_duplicates():
-    await ns.idempotency_start("dup-key")
-    with pytest.raises(consts_exceptions_mod.LimitExceededError):
-        await ns.idempotency_start("dup-key")
-    await ns.idempotency_end("dup-key")
+class TestGetConversationHistoryInternal:
+    """Tests for get_conversation_history_internal function."""
 
+    async def test_get_conversation_history_internal_success(self):
+        """Test internal history retrieval without logging."""
+        ctx = MockNorthboundContext(token_id=0)
+        conversation_db_mock.get_conversation_messages.return_value = [
+            {"message_role": "user", "message_content": "Hello"}
+        ]
 
-@pytest.mark.asyncio
-async def test_stop_chat_success(ctx):
-    partner_db_mod.get_internal_id_by_external.return_value = 777
-    result = await ns.stop_chat(ctx, "ext-777")
-    assert result["message"] == "success"
-    assert result["data"] == "ext-777"
-    assert result["requestId"] == "req-1"
+        result = await ns.get_conversation_history_internal(ctx=ctx, conversation_id=123)
 
-    agent_service_mod.stop_agent_tasks.assert_called_once_with(777, "user-1")
+        assert result["message"] == "success"
+        assert len(result["data"]["history"]) == 1
+        assert result["data"]["history"][0]["role"] == "user"
 
+    async def test_get_conversation_history_internal_no_logging(self):
+        """Test that internal function does not log token usage."""
+        ctx = MockNorthboundContext(token_id=1)
+        conversation_db_mock.get_conversation_messages.return_value = []
 
-@pytest.mark.asyncio
-async def test_list_conversations_maps_ids(ctx):
-    # map 1->E1, 2->E2
-    conv_mgmt_mod.get_conversation_list_service.return_value = [
-        {"conversation_id": 1},
-        {"conversation_id": 2},
-    ]
-    partner_db_mod.get_external_id_by_internal.side_effect = ["E1", "E2"]
-    data = await ns.list_conversations(ctx)
-    assert data["message"] == "success"
-    ids = [c["conversation_id"] for c in data["data"]]
-    assert ids == ["E1", "E2"]
+        await ns.get_conversation_history_internal(ctx=ctx, conversation_id=123)
+
+        # Should NOT call log_token_usage
+        token_db_mock.log_token_usage.assert_not_called()
 
 
 @pytest.mark.asyncio
-async def test_get_conversation_history_trims_fields(ctx):
-    conversation_db_mod.get_conversation_messages.side_effect = lambda _cid: [
-        {"message_role": "user", "message_content": "u1", "extra": 1},
-        {"message_role": "assistant", "message_content": "a1", "extra": 2},
-    ]
-    out = await ns.get_conversation_history(ctx, "ext-1")
-    assert out["message"] == "success"
-    hist = out["data"]["history"]
-    assert hist == [
-        {"role": "user", "content": "u1"},
-        {"role": "assistant", "content": "a1"},
-    ]
+class TestGetAgentInfoList:
+    """Tests for get_agent_info_list function."""
 
+    async def test_get_agent_info_list_success(self):
+        """Test successful agent info list retrieval."""
+        ctx = MockNorthboundContext(token_id=1)
+        agent_service_mock.list_all_agent_info_impl.return_value = [
+            {"agent_id": 1, "name": "test_agent", "description": "Test"}
+        ]
 
-@pytest.mark.asyncio
-async def test_get_agent_info_list_strips_internal(ctx, monkeypatch):
-    async def fake_list(tenant_id: str):
-        return [{"agent_id": 5, "name": "N"}]
+        result = await ns.get_agent_info_list(ctx=ctx)
 
-    monkeypatch.setattr(ns, "list_all_agent_info_impl", AsyncMock(side_effect=fake_list))
-    out = await ns.get_agent_info_list(ctx)
-    assert out["message"] == "success"
-    assert "agent_id" not in out["data"][0]
+        assert result["message"] == "success"
+        assert len(result["data"]) == 1
+        # agent_id should be removed
+        assert "agent_id" not in result["data"][0]
 
 
 @pytest.mark.asyncio
-async def test_update_conversation_title_success_and_idempotency(ctx):
-    # success call
-    res = await ns.update_conversation_title(ctx, "ext-10", "Title", idempotency_key="title-key")
-    assert res["message"] == "success"
-    assert res["data"] == "ext-10"
-    # duplicate should raise until released
-    with pytest.raises(consts_exceptions_mod.LimitExceededError):
-        await ns.update_conversation_title(ctx, "ext-10", "Title", idempotency_key="title-key")
-    # cleanup manually to avoid bleed between tests
-    await ns.idempotency_end("title-key")
-
+class TestUpdateConversationTitle:
+    """Tests for update_conversation_title function."""
+
+    async def test_update_conversation_title_success(self):
+        """Test successful title update."""
+        ctx = MockNorthboundContext(token_id=1)
+
+        result = await ns.update_conversation_title(
+            ctx=ctx,
+            conversation_id=123,
+            title="New Title"
+        )
+
+        assert result["message"] == "success"
+        assert result["data"] == 123
+        assert "idempotency_key" in result
+
+    async def test_update_conversation_title_logs_token_usage(self):
+        """Test that token usage is logged."""
+        ctx = MockNorthboundContext(token_id=1)
+
+        await ns.update_conversation_title(
+            ctx=ctx,
+            conversation_id=123,
+            title="New Title",
+            meta_data={"source": "api"}
+        )
+
+        token_db_mock.log_token_usage.assert_called()
+
+    async def test_update_conversation_title_idempotency_key(self):
+        """Test that idempotency key is properly built."""
+        ctx = MockNorthboundContext(tenant_id="tenant-1", token_id=1)
+
+        result = await ns.update_conversation_title(
+            ctx=ctx,
+            conversation_id=123,
+            title="New Title",
+            idempotency_key="custom-key"
+        )
+
+        assert result["idempotency_key"] == "custom-key"
diff --git a/test/backend/services/test_prompt_service.py b/test/backend/services/test_prompt_service.py
index 01474d205..3b33f1a5e 100644
--- a/test/backend/services/test_prompt_service.py
+++ b/test/backend/services/test_prompt_service.py
@@ -728,31 +728,20 @@ def mock_llm_call_with_exception(model_id, content, sys_prompt, callback, tenant
         mock_tenant_id = "test_tenant"
         mock_language = "en"
 
-        # Execute - should handle exceptions gracefully
-        result_list = []
-        for result in generate_system_prompt(
-            mock_sub_agents,
-            mock_task_description,
-            mock_tools,
-            mock_tenant_id,
-            self.test_model_id,
-            mock_language
-        ):
-            result_list.append(result)
-
-        # Assert - should still return results for other prompt types
-        self.assertGreater(len(result_list), 0)
-
-        # Constraint should work fine
-        constraint_results = [
-            r for r in result_list if r["type"] == "constraint"]
-        self.assertGreater(len(constraint_results), 0)
-
-        # Verify that duty result exists but might be empty due to exception handling
-        duty_results = [r for r in result_list if r["type"] == "duty"]
-
-        # Should still have duty result entry with empty content
-        self.assertGreater(len(duty_results), 0)
+        # Execute - exception should be raised (this tests the error propagation behavior)
+        with self.assertRaises(Exception) as context:
+            for result in generate_system_prompt(
+                mock_sub_agents,
+                mock_task_description,
+                mock_tools,
+                mock_tenant_id,
+                self.test_model_id,
+                mock_language
+            ):
+                pass  # Consume the generator to trigger the exception
+
+        # Assert - exception message should be present
+        self.assertIn("LLM error", str(context.exception))
 
     @patch('backend.services.prompt_service.Template')
     def test_join_info_for_generate_system_prompt(self, mock_template):
@@ -844,4 +833,357 @@ def test_get_enabled_sub_agent_description_for_generate_prompt(
         self.assertEqual(result[0]["agent_id"], 10)
         self.assertEqual(result[1]["agent_id"], 20)
 
+    # ==================== Additional tests for higher coverage ====================
+
+    @patch('backend.services.prompt_service.generate_and_save_system_prompt_impl')
+    def test_gen_system_prompt_streamable_with_app_exception(self, mock_generate_impl):
+        """Test gen_system_prompt_streamable handles AppException and returns error through SSE"""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        # Setup - mock generate_and_save_system_prompt_impl to raise AppException
+        mock_generate_impl.side_effect = AppException(
+            ErrorCode.MODEL_NOT_FOUND,
+            "Model not found error"
+        )
+
+        # Execute - collect results from the generator
+        result_list = []
+        for result in gen_system_prompt_streamable(
+            agent_id=123,
+            model_id=self.test_model_id,
+            task_description="Test task",
+            user_id="user123",
+            tenant_id="tenant456",
+            language="zh"
+        ):
+            result_list.append(result)
+
+        # Assert - should yield error in SSE format
+        self.assertEqual(len(result_list), 1)
+        import json
+        parsed = json.loads(result_list[0].replace("data: ", "").replace("\n\n", ""))
+        self.assertFalse(parsed['success'])
+        self.assertEqual(parsed['error']['code'], str(ErrorCode.MODEL_NOT_FOUND.value))
+        self.assertEqual(parsed['error']['message'], "Model not found error")
+
+    @patch('backend.services.prompt_service.generate_and_save_system_prompt_impl')
+    def test_gen_system_prompt_streamable_with_generic_exception(self, mock_generate_impl):
+        """Test gen_system_prompt_streamable handles generic Exception and returns error through SSE"""
+        # Setup - mock generate_and_save_system_prompt_impl to raise generic Exception
+        mock_generate_impl.side_effect = Exception("Some random error")
+
+        # Execute - collect results from the generator
+        result_list = []
+        for result in gen_system_prompt_streamable(
+            agent_id=123,
+            model_id=self.test_model_id,
+            task_description="Test task",
+            user_id="user123",
+            tenant_id="tenant456",
+            language="zh"
+        ):
+            result_list.append(result)
+
+        # Assert - should yield error in SSE format with default error code
+        self.assertEqual(len(result_list), 1)
+        import json
+        parsed = json.loads(result_list[0].replace("data: ", "").replace("\n\n", ""))
+        self.assertFalse(parsed['success'])
+        # Should use default error code for non-AppException
+        self.assertIn('error', parsed)
+
+    @patch('backend.services.prompt_service.search_agent_info_by_agent_id')
+    @patch('backend.services.prompt_service.query_tools_by_ids')
+    @patch('backend.services.prompt_service.generate_system_prompt')
+    @patch('backend.services.prompt_service.query_all_agent_info_by_tenant_id')
+    def test_generate_and_save_system_prompt_impl_sub_agent_exception(
+        self,
+        mock_query_all_agents,
+        mock_generate_system_prompt,
+        mock_query_tools,
+        mock_search_agent_info,
+    ):
+        """Test generate_and_save_system_prompt_impl handles sub-agent info retrieval exception (lines 88-89)"""
+        # Setup
+        mock_query_tools.return_value = []
+        mock_query_all_agents.return_value = []
+
+        # Mock generate_system_prompt to yield data
+        def mock_gen(*args, **kwargs):
+            yield {"type": "duty", "content": "duty content", "is_complete": True}
+
+        mock_generate_system_prompt.side_effect = mock_gen
+
+        # Make search_agent_info_by_agent_id raise exception for one sub-agent
+        mock_search_agent_info.side_effect = [
+            {"agent_id": 10, "name": "agent1"},  # First sub-agent succeeds
+            Exception("Database error"),  # Second sub-agent fails
+        ]
+
+        # Execute - should handle exception gracefully and continue
+        result_gen = generate_and_save_system_prompt_impl(
+            agent_id=123,
+            model_id=self.test_model_id,
+            task_description="Test task",
+            user_id="user123",
+            tenant_id="tenant456",
+            language="zh",
+            tool_ids=[1],
+            sub_agent_ids=[10, 20]  # Two sub-agents
+        )
+        result = list(result_gen)
+
+        # Assert - should still return results (exception was logged but not raised)
+        self.assertGreater(len(result), 0)
+
+    @patch('backend.services.prompt_service._check_agent_display_name_duplicate')
+    @patch('backend.services.prompt_service._check_agent_name_duplicate')
+    @patch('backend.services.prompt_service.query_all_agent_info_by_tenant_id')
+    @patch('backend.services.prompt_service.generate_system_prompt')
+    @patch('backend.services.prompt_service.query_tools_by_ids')
+    @patch('backend.services.prompt_service.search_agent_info_by_agent_id')
+    def test_generate_and_save_system_prompt_impl_empty_content_raises_exception(
+        self,
+        mock_search_agent_info,
+        mock_query_tools,
+        mock_generate_system_prompt,
+        mock_query_all_agents,
+        mock_check_name_dup,
+        mock_check_display_dup,
+    ):
+        """Test generate_and_save_system_prompt_impl raises exception when no content is generated (line 223)"""
+        # Setup
+        mock_query_tools.return_value = []
+        mock_search_agent_info.return_value = {}
+        mock_query_all_agents.return_value = []
+        mock_check_name_dup.return_value = False
+        mock_check_display_dup.return_value = False
+
+        # Mock generate_system_prompt to yield empty content
+        def mock_gen(*args, **kwargs):
+            yield {"type": "duty", "content": "", "is_complete": True}
+            yield {"type": "constraint", "content": "", "is_complete": True}
+            yield {"type": "few_shots", "content": "", "is_complete": True}
+            yield {"type": "agent_var_name", "content": "", "is_complete": True}
+            yield {"type": "agent_display_name", "content": "", "is_complete": True}
+            yield {"type": "agent_description", "content": "", "is_complete": True}
+
+        mock_generate_system_prompt.side_effect = mock_gen
+
+        # Execute and Assert - should raise Exception when all content is empty
+        with self.assertRaises(Exception) as context:
+            list(generate_and_save_system_prompt_impl(
+                agent_id=123,
+                model_id=self.test_model_id,
+                task_description="Test task",
+                user_id="user123",
+                tenant_id="tenant456",
+                language="zh",
+                tool_ids=[1],
+                sub_agent_ids=[10],
+            ))
+
+        self.assertIn("Failed to generate prompt content", str(context.exception))
+
+    @patch('backend.services.prompt_service.call_llm_for_system_prompt')
+    @patch('backend.services.prompt_service.join_info_for_generate_system_prompt')
+    @patch('backend.services.prompt_service.get_prompt_generate_prompt_template')
+    def test_generate_system_prompt_error_before_streaming(
+        self,
+        mock_get_prompt_template,
+        mock_join_info,
+        mock_call_llm,
+    ):
+        """Test generate_system_prompt handles error that occurs before streaming (line 307-311)"""
+        # Setup
+        mock_prompt_config = {
+            "USER_PROMPT": "Test user prompt template",
+            "DUTY_SYSTEM_PROMPT": "Generate duty prompt",
+            "CONSTRAINT_SYSTEM_PROMPT": "Generate constraint prompt",
+            "FEW_SHOTS_SYSTEM_PROMPT": "Generate few shots prompt",
+            "AGENT_VARIABLE_NAME_SYSTEM_PROMPT": "Generate agent var name",
+            "AGENT_DISPLAY_NAME_SYSTEM_PROMPT": "Generate agent display name",
+            "AGENT_DESCRIPTION_SYSTEM_PROMPT": "Generate agent description"
+        }
+        mock_get_prompt_template.return_value = mock_prompt_config
+        mock_join_info.return_value = "Joined template content"
+
+        # Mock call_llm_for_system_prompt to raise exception immediately
+        def mock_llm_call_error(model_id, content, sys_prompt, callback, tenant_id):
+            if "duty" in sys_prompt.lower():
+                raise Exception("LLM connection error")
+            # Other prompts work normally
+            if callback:
+                callback(f"Content for {sys_prompt}")
+            return f"Content for {sys_prompt}"
+
+        mock_call_llm.side_effect = mock_llm_call_error
+
+        # Execute - should raise the exception during iteration
+        result_list = []
+        with self.assertRaises(Exception) as context:
+            for result in generate_system_prompt(
+                [{"name": "agent1"}],
+                "Test task",
+                [{"name": "tool1"}],
+                "tenant123",
+                self.test_model_id,
+                "zh"
+            ):
+                result_list.append(result)
+
+        self.assertIn("LLM connection error", str(context.exception))
+
+    @patch('backend.services.prompt_service.call_llm_for_system_prompt')
+    @patch('backend.services.prompt_service.join_info_for_generate_system_prompt')
+    @patch('backend.services.prompt_service.get_prompt_generate_prompt_template')
+    def test_generate_system_prompt_error_during_streaming(
+        self,
+        mock_get_prompt_template,
+        mock_join_info,
+        mock_call_llm,
+    ):
+        """Test generate_system_prompt handles error that occurs during streaming (line 330-331)"""
+        # Setup
+        mock_prompt_config = {
+            "USER_PROMPT": "Test user prompt template",
+            "DUTY_SYSTEM_PROMPT": "Generate duty prompt",
+            "CONSTRAINT_SYSTEM_PROMPT": "Generate constraint prompt",
+            "FEW_SHOTS_SYSTEM_PROMPT": "Generate few shots prompt",
+            "AGENT_VARIABLE_NAME_SYSTEM_PROMPT": "Generate agent var name",
+            "AGENT_DISPLAY_NAME_SYSTEM_PROMPT": "Generate agent display name",
+            "AGENT_DESCRIPTION_SYSTEM_PROMPT": "Generate agent description"
+        }
+        mock_get_prompt_template.return_value = mock_prompt_config
+        mock_join_info.return_value = "Joined template content"
+
+        # Track which call we're on
+        call_count = {"count": 0}
+
+        # Mock call_llm to succeed initially then fail after some streaming
+        def mock_llm_call_error_after_first(
+            model_id, content, sys_prompt, callback, tenant_id
+        ):
+            call_count["count"] += 1
+
+            # First few calls succeed
+            if call_count["count"] <= 3:
+                if callback:
+                    callback(f"Content for {sys_prompt}")
+                return f"Content for {sys_prompt}"
+            else:
+                # Later calls fail
+                raise Exception("LLM error during generation")
+
+        mock_call_llm.side_effect = mock_llm_call_error_after_first
+
+        # Execute - error should be raised during streaming
+        result_list = []
+        with self.assertRaises(Exception) as context:
+            for result in generate_system_prompt(
+                [{"name": "agent1"}],
+                "Test task",
+                [{"name": "tool1"}],
+                "tenant123",
+                self.test_model_id,
+                "zh"
+            ):
+                result_list.append(result)
+
+        # Should eventually raise an exception
+        self.assertIn("LLM error during generation", str(context.exception))
+
+    @patch('backend.services.prompt_service.query_tools_by_ids')
+    @patch('backend.services.prompt_service.get_enable_tool_id_by_agent_id')
+    def test_get_enabled_tool_description_for_generate_prompt_empty_tool_ids(
+        self,
+        mock_get_enable_tool_ids,
+        mock_query_tools,
+    ):
+        """Test get_enabled_tool_description_for_generate_prompt with empty tool IDs"""
+        from backend.services.prompt_service import get_enabled_tool_description_for_generate_prompt
+
+        # Setup - return empty list
+        mock_get_enable_tool_ids.return_value = []
+        mock_query_tools.return_value = []
+
+        result = get_enabled_tool_description_for_generate_prompt(
+            agent_id=123, tenant_id="tenant-x"
+        )
+
+        # Should return empty list
+        self.assertEqual(result, [])
+
+    @patch('backend.services.prompt_service.search_agent_info_by_agent_id')
+    @patch('backend.services.prompt_service.query_sub_agents_id_list')
+    def test_get_enabled_sub_agent_description_for_generate_prompt_empty(
+        self,
+        mock_query_sub_ids,
+        mock_search_agent,
+    ):
+        """Test get_enabled_sub_agent_description_for_generate_prompt with empty sub-agent IDs"""
+        from backend.services.prompt_service import get_enabled_sub_agent_description_for_generate_prompt
+
+        # Setup - return empty list
+        mock_query_sub_ids.return_value = []
+
+        result = get_enabled_sub_agent_description_for_generate_prompt(
+            agent_id=99, tenant_id="tenant-y"
+        )
+
+        # Should return empty list
+        self.assertEqual(result, [])
+        mock_search_agent.assert_not_called()
+
+    @patch('backend.services.prompt_service.Template')
+    def test_join_info_for_generate_system_prompt_english(self, mock_template):
+        """Test join_info_for_generate_system_prompt with English language"""
+        # Setup
+        mock_prompt_for_generate = {"USER_PROMPT": "Test User Prompt"}
+        mock_sub_agents = [
+            {"name": "agent1", "description": "Agent 1 desc"}
+        ]
+        mock_task_description = "Test task"
+        mock_tools = [
+            {"name": "tool1", "description": "Tool 1 desc",
+                "inputs": "input1", "output_type": "output1"}
+        ]
+
+        mock_template_instance = MagicMock()
+        mock_template.return_value = mock_template_instance
+        mock_template_instance.render.return_value = "Rendered content"
+
+        # Execute with English language
+        result = join_info_for_generate_system_prompt(
+            mock_prompt_for_generate, mock_sub_agents, mock_task_description, mock_tools,
+            language="en"
+        )
+
+        # Assert
+        self.assertEqual(result, "Rendered content")
+        # Check that English labels are used
+        call_args = mock_template_instance.render.call_args[0][0]
+        self.assertEqual(call_args["task_description"], mock_task_description)
+
+    @patch('backend.services.prompt_service.Template')
+    def test_join_info_for_generate_system_prompt_empty_tools_and_agents(self, mock_template):
+        """Test join_info_for_generate_system_prompt with empty tools and sub-agents"""
+        # Setup
+        mock_prompt_for_generate = {"USER_PROMPT": "Test User Prompt"}
+        mock_sub_agents = []
+        mock_task_description = "Test task"
+        mock_tools = []
+
+        mock_template_instance = MagicMock()
+        mock_template.return_value = mock_template_instance
+        mock_template_instance.render.return_value = "Rendered content"
+
+        # Execute
+        result = join_info_for_generate_system_prompt(
+            mock_prompt_for_generate, mock_sub_agents, mock_task_description, mock_tools
+        )
+
+        # Assert
+        self.assertEqual(result, "Rendered content")
 
diff --git a/test/backend/services/test_user_management_service.py b/test/backend/services/test_user_management_service.py
index 62e839bc9..ac5deba80 100644
--- a/test/backend/services/test_user_management_service.py
+++ b/test/backend/services/test_user_management_service.py
@@ -586,7 +586,7 @@ async def test_signup_user_with_admin_invite_code(self, mock_get_client, mock_us
             mock_insert_tenant.assert_called_once_with(user_id="user-123", tenant_id="tenant_id", user_role="ADMIN", user_email="admin@example.com")
             mock_use_invite.assert_called_once_with("ADMIN123", "user-123")
             mock_add_groups.assert_called_once_with("user-123", [1, 2, 3], "user-123")
-            mock_parse_response.assert_called_once_with(False, mock_response, "ADMIN")
+            mock_parse_response.assert_called_once_with(False, mock_response, "ADMIN", True)
             # Verify init_tool_list_for_tenant was called
             mock_init_tools.assert_called_once_with("tenant_id", "user-123")
 
@@ -637,7 +637,7 @@ async def test_signup_user_with_dev_invite_code(self, mock_get_client, mock_use_
             mock_insert_tenant.assert_called_once_with(user_id="user-456", tenant_id="tenant_id", user_role="DEV", user_email="dev@example.com")
             mock_use_invite.assert_called_once_with("DEV456", "user-456")
             mock_add_groups.assert_called_once_with("user-456", [4, 5], "user-456")
-            mock_parse_response.assert_called_once_with(False, mock_response, "DEV")
+            mock_parse_response.assert_called_once_with(False, mock_response, "DEV", True)
             # Verify init_tool_list_for_tenant was called
             mock_init_tools.assert_called_once_with("tenant_id", "user-456")
 
@@ -738,7 +738,7 @@ async def test_signup_user_with_admin_invite_role_assignment(self, mock_check_av
             # Verify ADMIN role was assigned and TTS/STT generation was called
             mock_insert_tenant.assert_called_with(user_id="user-123", tenant_id="tenant_id", user_role="ADMIN", user_email="admin@example.com")
             mock_generate_tts.assert_called_once_with("tenant_id", "user-123")
-            mock_parse.assert_called_with(False, mock_response, "ADMIN")
+            mock_parse.assert_called_with(False, mock_response, "ADMIN", True)
             # Verify init_tool_list_for_tenant was called
             mock_init_tools.assert_called_once_with("tenant_id", "user-123")
 
@@ -774,7 +774,7 @@ async def test_signup_user_with_dev_invite_role_assignment(self, mock_check_avai
 
             # Verify DEV role was assigned and TTS/STT generation was NOT called
             mock_insert_tenant.assert_called_with(user_id="user-123", tenant_id="tenant_id", user_role="DEV", user_email="dev@example.com")
-            mock_parse.assert_called_with(False, mock_response, "DEV")
+            mock_parse.assert_called_with(False, mock_response, "DEV", True)
             # Verify init_tool_list_for_tenant was called
             mock_init_tools.assert_called_once_with("tenant_id", "user-123")
 
@@ -789,6 +789,97 @@ async def test_signup_user_with_invite_code_validation_exception_conversion(self
 
         self.assertIn("Invalid invitation code: Database connection failed", str(context.exception))
 
+    @patch('backend.services.user_management_service.add_user_to_groups')
+    @patch('backend.services.user_management_service.parse_supabase_response')
+    @patch('backend.services.user_management_service.generate_tts_stt_4_admin')
+    @patch('backend.services.user_management_service.insert_user_tenant')
+    @patch('backend.services.user_management_service.get_invitation_by_code')
+    @patch('backend.services.user_management_service.check_invitation_available')
+    @patch('backend.services.user_management_service.use_invitation_code')
+    @patch('backend.services.user_management_service.get_supabase_client')
+    async def test_signup_user_with_auto_login_false(self, mock_get_client, mock_use_invite,
+                                                     mock_check_available, mock_get_invite_code,
+                                                     mock_insert_tenant, mock_generate_tts, mock_parse_response, mock_add_groups):
+        """Test user signup with auto_login=False (tenant admin creation scenario)"""
+        # Setup mocks
+        mock_client = MagicMock()
+        mock_user = MagicMock()
+        mock_user.id = "user-123"
+        mock_response = MagicMock()
+        mock_response.user = mock_user
+        mock_client.auth.sign_up.return_value = mock_response
+        mock_get_client.return_value = mock_client
+
+        # Mock invitation code validation
+        mock_check_available.return_value = True
+        mock_get_invite_code.return_value = {
+            "invitation_id": 1,
+            "code_type": "ADMIN_INVITE",
+            "group_ids": [],
+            "tenant_id": "tenant_id"
+        }
+        mock_use_invite.return_value = {"invitation_id": 1, "code_type": "ADMIN_INVITE", "group_ids": []}
+        mock_parse_response.return_value = {"user": "admin_data", "session": None}
+        mock_add_groups.return_value = []
+
+        # Call with auto_login=False
+        with patch('backend.services.user_management_service.init_tool_list_for_tenant', new_callable=AsyncMock) as mock_init_tools:
+            result = await signup_user_with_invitation(
+                "admin@example.com",
+                "password123",
+                invite_code="ADMIN123",
+                auto_login=False
+            )
+
+            # Verify parse_supabase_response was called with auto_login=False
+            mock_parse_response.assert_called_once_with(False, mock_response, "ADMIN", False)
+            # Verify init_tool_list_for_tenant was called
+            mock_init_tools.assert_called_once_with("tenant_id", "user-123")
+
+    @patch('backend.services.user_management_service.add_user_to_groups')
+    @patch('backend.services.user_management_service.parse_supabase_response')
+    @patch('backend.services.user_management_service.generate_tts_stt_4_admin')
+    @patch('backend.services.user_management_service.insert_user_tenant')
+    @patch('backend.services.user_management_service.get_invitation_by_code')
+    @patch('backend.services.user_management_service.check_invitation_available')
+    @patch('backend.services.user_management_service.use_invitation_code')
+    @patch('backend.services.user_management_service.get_supabase_client')
+    async def test_signup_user_with_auto_login_default(self, mock_get_client, mock_use_invite,
+                                                     mock_check_available, mock_get_invite_code,
+                                                     mock_insert_tenant, mock_generate_tts, mock_parse_response, mock_add_groups):
+        """Test user signup with default auto_login (True)"""
+        # Setup mocks
+        mock_client = MagicMock()
+        mock_user = MagicMock()
+        mock_user.id = "user-123"
+        mock_response = MagicMock()
+        mock_response.user = mock_user
+        mock_client.auth.sign_up.return_value = mock_response
+        mock_get_client.return_value = mock_client
+
+        # Mock invitation code validation
+        mock_check_available.return_value = True
+        mock_get_invite_code.return_value = {
+            "invitation_id": 1,
+            "code_type": "ADMIN_INVITE",
+            "group_ids": [],
+            "tenant_id": "tenant_id"
+        }
+        mock_use_invite.return_value = {"invitation_id": 1, "code_type": "ADMIN_INVITE", "group_ids": []}
+        mock_parse_response.return_value = {"user": "admin_data", "session": "session_data"}
+        mock_add_groups.return_value = []
+
+        # Call without auto_login parameter (should default to True)
+        with patch('backend.services.user_management_service.init_tool_list_for_tenant', new_callable=AsyncMock) as mock_init_tools:
+            result = await signup_user_with_invitation(
+                "admin@example.com",
+                "password123",
+                invite_code="ADMIN123"
+            )
+
+            # Verify parse_supabase_response was called with default auto_login=True
+            mock_parse_response.assert_called_once_with(False, mock_response, "ADMIN", True)
+
 
 class TestParseSupabaseResponse(unittest.IsolatedAsyncioTestCase):
     """Test parse_supabase_response"""
@@ -853,6 +944,93 @@ async def test_parse_response_without_session(self):
         }
         self.assertEqual(result, expected)
 
+    @patch('backend.services.user_management_service.get_jwt_expiry_seconds')
+    @patch('backend.services.user_management_service.calculate_expires_at')
+    async def test_parse_response_with_session_but_auto_login_false(self, mock_calc_expires, mock_get_expiry):
+        """Test parsing response with session but auto_login=False (tenant admin creation scenario)"""
+        mock_user = MagicMock()
+        mock_user.id = "user-123"
+        mock_user.email = "admin@example.com"
+
+        mock_session = MagicMock()
+        mock_session.access_token = "access-token"
+        mock_session.refresh_token = "refresh-token"
+
+        mock_response = MagicMock()
+        mock_response.user = mock_user
+        mock_response.session = mock_session
+
+        mock_calc_expires.return_value = "2024-01-01T00:00:00Z"
+        mock_get_expiry.return_value = 3600
+
+        # When auto_login=False, session should be None even if Supabase returns session
+        result = await parse_supabase_response(False, mock_response, "ADMIN", auto_login=False)
+
+        expected = {
+            "user": {
+                "id": "user-123",
+                "email": "admin@example.com",
+                "role": "ADMIN"
+            },
+            "session": None,  # Session should be suppressed when auto_login=False
+            "registration_type": "user"
+        }
+        self.assertEqual(result, expected)
+
+    @patch('backend.services.user_management_service.get_jwt_expiry_seconds')
+    @patch('backend.services.user_management_service.calculate_expires_at')
+    async def test_parse_response_with_session_and_auto_login_true(self, mock_calc_expires, mock_get_expiry):
+        """Test parsing response with session and auto_login=True (normal signup scenario)"""
+        mock_user = MagicMock()
+        mock_user.id = "user-123"
+        mock_user.email = "test@example.com"
+
+        mock_session = MagicMock()
+        mock_session.access_token = "access-token"
+        mock_session.refresh_token = "refresh-token"
+
+        mock_response = MagicMock()
+        mock_response.user = mock_user
+        mock_response.session = mock_session
+
+        mock_calc_expires.return_value = "2024-01-01T00:00:00Z"
+        mock_get_expiry.return_value = 3600
+
+        # When auto_login=True, session should be included
+        result = await parse_supabase_response(False, mock_response, "USER", auto_login=True)
+
+        expected = {
+            "user": {
+                "id": "user-123",
+                "email": "test@example.com",
+                "role": "USER"
+            },
+            "session": {
+                "access_token": "access-token",
+                "refresh_token": "refresh-token",
+                "expires_at": "2024-01-01T00:00:00Z",
+                "expires_in_seconds": 3600
+            },
+            "registration_type": "user"
+        }
+        self.assertEqual(result, expected)
+
+    async def test_parse_response_default_auto_login_true(self):
+        """Test that auto_login defaults to True when not specified"""
+        mock_user = MagicMock()
+        mock_user.id = "user-123"
+        mock_user.email = "test@example.com"
+
+        mock_response = MagicMock()
+        mock_response.user = mock_user
+        mock_response.session = None  # No session from Supabase
+
+        # Call without auto_login parameter (should default to True)
+        result = await parse_supabase_response(False, mock_response, "user")
+
+        # Session should be None because Supabase didn't return it
+        self.assertIsNone(result["session"])
+
 
 class TestGenerateTtsStt4Admin(unittest.IsolatedAsyncioTestCase):
     """Test generate_tts_stt_4_admin"""
@@ -1256,6 +1434,88 @@ def test_format_role_permissions_missing_fields(self):
         assert result["accessibleRoutes"] == []
 
 
+class TestCreateToken(unittest.IsolatedAsyncioTestCase):
+    """Tests for create_token function in user_management_service."""
+
+    @patch('backend.services.user_management_service.create_token_record')
+    @patch('backend.services.user_management_service.generate_access_key')
+    def test_create_token_success(self, mock_generate_access_key, mock_create_token_record):
+        """Test successful token creation."""
+        from backend.services import user_management_service as ums
+
+        mock_generate_access_key.return_value = "nexent-abc123"
+        mock_create_token_record.return_value = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": "user-123"
+        }
+
+        result = ums.create_token("user-123")
+
+        assert result["token_id"] == 1
+        assert result["access_key"] == "nexent-abc123"
+        assert result["user_id"] == "user-123"
+        mock_generate_access_key.assert_called_once()
+        mock_create_token_record.assert_called_once_with("nexent-abc123", "user-123")
+
+
+class TestListTokensByUser(unittest.IsolatedAsyncioTestCase):
+    """Tests for list_tokens_by_user function in user_management_service."""
+
+    @patch('backend.services.user_management_service.list_tokens_by_user_record')
+    def test_list_tokens_by_user_success(self, mock_list_tokens):
+        """Test successful token listing."""
+        from backend.services import user_management_service as ums
+
+        mock_list_tokens.return_value = [
+            {"token_id": 1, "access_key": "nexent-key1", "user_id": "user-123"},
+            {"token_id": 2, "access_key": "nexent-key2", "user_id": "user-123"}
+        ]
+
+        result = ums.list_tokens_by_user("user-123")
+
+        assert len(result) == 2
+        mock_list_tokens.assert_called_once_with("user-123")
+
+    @patch('backend.services.user_management_service.list_tokens_by_user_record')
+    def test_list_tokens_by_user_empty(self, mock_list_tokens):
+        """Test listing tokens when user has none."""
+        from backend.services import user_management_service as ums
+
+        mock_list_tokens.return_value = []
+
+        result = ums.list_tokens_by_user("user-no-tokens")
+
+        assert result == []
+
+
+class TestDeleteToken(unittest.IsolatedAsyncioTestCase):
+    """Tests for delete_token function in user_management_service."""
+
+    @patch('backend.services.user_management_service.delete_token_record')
+    def test_delete_token_success(self, mock_delete_token):
+        """Test successful token deletion."""
+        from backend.services import user_management_service as ums
+
+        mock_delete_token.return_value = True
+
+        result = ums.delete_token(1, "user-123")
+
+        assert result is True
+        mock_delete_token.assert_called_once_with(1, "user-123")
+
+    @patch('backend.services.user_management_service.delete_token_record')
+    def test_delete_token_not_found(self, mock_delete_token):
+        """Test deleting non-existent token."""
+        from backend.services import user_management_service as ums
+
+        mock_delete_token.return_value = False
+
+        result = ums.delete_token(999, "user-123")
+
+        assert result is False
+
+
 class TestIntegrationScenarios(unittest.IsolatedAsyncioTestCase):
     """Integration test scenarios"""
 
diff --git a/test/backend/test_cluster_summarization.py b/test/backend/test_cluster_summarization.py
index e6edd46b3..82af6d5ba 100644
--- a/test/backend/test_cluster_summarization.py
+++ b/test/backend/test_cluster_summarization.py
@@ -26,9 +26,19 @@
 consts_const_mock.POSTGRES_DB = "test_db"
 consts_const_mock.POSTGRES_PORT = 5432
 consts_const_mock.LANGUAGE = {"ZH": "zh", "EN": "en"}
+consts_const_mock.MESSAGE_ROLE = {"USER": "user", "ASSISTANT": "assistant", "SYSTEM": "system"}
+consts_const_mock.THINK_START_PATTERN = "<think>"
+consts_const_mock.THINK_END_PATTERN = "</think>"
 consts_mock.const = consts_const_mock
+# Mock consts.error_code and consts.exceptions
+consts_error_code_mock = MagicMock()
+consts_error_code_mock.ErrorCode = MagicMock()
+consts_exceptions_mock = MagicMock()
+consts_exceptions_mock.AppException = Exception
 sys.modules['consts'] = consts_mock
 sys.modules['consts.const'] = consts_const_mock
+sys.modules['consts.error_code'] = consts_error_code_mock
+sys.modules['consts.exceptions'] = consts_exceptions_mock
 
 # Add backend to path before patching backend modules
 current_dir = os.path.dirname(os.path.abspath(__file__))
diff --git a/test/backend/test_document_vector_integration.py b/test/backend/test_document_vector_integration.py
index 8e05abe86..4fb094618 100644
--- a/test/backend/test_document_vector_integration.py
+++ b/test/backend/test_document_vector_integration.py
@@ -26,9 +26,20 @@
 consts_const_mock.NEXENT_POSTGRES_PASSWORD = "test_password"
 consts_const_mock.POSTGRES_DB = "test_db"
 consts_const_mock.POSTGRES_PORT = 5432
+consts_const_mock.LANGUAGE = {"ZH": "zh", "EN": "en"}
+consts_const_mock.MESSAGE_ROLE = {"USER": "user", "ASSISTANT": "assistant", "SYSTEM": "system"}
+consts_const_mock.THINK_START_PATTERN = "<think>"
+consts_const_mock.THINK_END_PATTERN = "</think>"
 consts_mock.const = consts_const_mock
+# Mock consts.error_code and consts.exceptions
+consts_error_code_mock = MagicMock()
+consts_error_code_mock.ErrorCode = MagicMock()
+consts_exceptions_mock = MagicMock()
+consts_exceptions_mock.AppException = Exception
 sys.modules['consts'] = consts_mock
 sys.modules['consts.const'] = consts_const_mock
+sys.modules['consts.error_code'] = consts_error_code_mock
+sys.modules['consts.exceptions'] = consts_exceptions_mock
 
 # Add backend to path before patching backend modules
 current_dir = os.path.dirname(os.path.abspath(__file__))
diff --git a/test/backend/test_document_vector_utils.py b/test/backend/test_document_vector_utils.py
index 9df14475d..9bce2af29 100644
--- a/test/backend/test_document_vector_utils.py
+++ b/test/backend/test_document_vector_utils.py
@@ -26,9 +26,19 @@
 consts_const_mock.POSTGRES_DB = "test_db"
 consts_const_mock.POSTGRES_PORT = 5432
 consts_const_mock.LANGUAGE = {"ZH": "zh", "EN": "en"}
+consts_const_mock.MESSAGE_ROLE = {"USER": "user", "ASSISTANT": "assistant", "SYSTEM": "system"}
+consts_const_mock.THINK_START_PATTERN = "<think>"
+consts_const_mock.THINK_END_PATTERN = "</think>"
 consts_mock.const = consts_const_mock
+# Mock consts.error_code and consts.exceptions
+consts_error_code_mock = MagicMock()
+consts_error_code_mock.ErrorCode = MagicMock()
+consts_exceptions_mock = MagicMock()
+consts_exceptions_mock.AppException = Exception
 sys.modules['consts'] = consts_mock
 sys.modules['consts.const'] = consts_const_mock
+sys.modules['consts.error_code'] = consts_error_code_mock
+sys.modules['consts.exceptions'] = consts_exceptions_mock
 
 # Add backend to path before patching backend modules
 current_dir = os.path.dirname(os.path.abspath(__file__))
diff --git a/test/backend/test_document_vector_utils_coverage.py b/test/backend/test_document_vector_utils_coverage.py
index fc0c69311..23a6923c8 100644
--- a/test/backend/test_document_vector_utils_coverage.py
+++ b/test/backend/test_document_vector_utils_coverage.py
@@ -24,10 +24,20 @@
 consts_const_mock.POSTGRES_USER = "test_user"
 consts_const_mock.NEXENT_POSTGRES_PASSWORD = "test_password"
 consts_const_mock.POSTGRES_DB = "test_db"
-consts_const_mock.POSTGRES_PORT = 5432
+consts_const_mock.LANGUAGE = {"ZH": "zh", "EN": "en"}
+consts_const_mock.MESSAGE_ROLE = {"USER": "user", "ASSISTANT": "assistant", "SYSTEM": "system"}
+consts_const_mock.THINK_START_PATTERN = "<think>"
+consts_const_mock.THINK_END_PATTERN = "</think>"
 consts_mock.const = consts_const_mock
+# Mock consts.error_code and consts.exceptions
+consts_error_code_mock = MagicMock()
+consts_error_code_mock.ErrorCode = MagicMock()
+consts_exceptions_mock = MagicMock()
+consts_exceptions_mock.AppException = Exception
 sys.modules['consts'] = consts_mock
 sys.modules['consts.const'] = consts_const_mock
+sys.modules['consts.error_code'] = consts_error_code_mock
+sys.modules['consts.exceptions'] = consts_exceptions_mock
 
 # Add backend to path before patching backend modules
 current_dir = os.path.dirname(os.path.abspath(__file__))
diff --git a/test/backend/test_summary_formatting.py b/test/backend/test_summary_formatting.py
index 22f8dec36..be9d6a20d 100644
--- a/test/backend/test_summary_formatting.py
+++ b/test/backend/test_summary_formatting.py
@@ -22,9 +22,20 @@
 consts_const_mock.NEXENT_POSTGRES_PASSWORD = "test_password"
 consts_const_mock.POSTGRES_DB = "test_db"
 consts_const_mock.POSTGRES_PORT = 5432
+consts_const_mock.LANGUAGE = {"ZH": "zh", "EN": "en"}
+consts_const_mock.MESSAGE_ROLE = {"USER": "user", "ASSISTANT": "assistant", "SYSTEM": "system"}
+consts_const_mock.THINK_START_PATTERN = "<think>"
+consts_const_mock.THINK_END_PATTERN = "</think>"
 consts_mock.const = consts_const_mock
+# Mock consts.error_code and consts.exceptions
+consts_error_code_mock = MagicMock()
+consts_error_code_mock.ErrorCode = MagicMock()
+consts_exceptions_mock = MagicMock()
+consts_exceptions_mock.AppException = Exception
 sys.modules['consts'] = consts_mock
 sys.modules['consts.const'] = consts_const_mock
+sys.modules['consts.error_code'] = consts_error_code_mock
+sys.modules['consts.exceptions'] = consts_exceptions_mock
 
 # Add backend to path before patching backend modules
 sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..', 'backend'))
diff --git a/test/backend/utils/test_auth_utils.py b/test/backend/utils/test_auth_utils.py
index d47dd2056..713656b14 100644
--- a/test/backend/utils/test_auth_utils.py
+++ b/test/backend/utils/test_auth_utils.py
@@ -2,10 +2,17 @@
 import time
 import sys
 import os
+from pathlib import Path
 from unittest.mock import MagicMock, patch
 import types
 import pytest
 
+# Ensure repository root and sdk/ are importable before any patch() that resolves modules.
+# Pytest rootdir is set to test/, so we must extend sys.path explicitly here.
+_REPO_ROOT = Path(__file__).resolve().parents[3]
+sys.path.insert(0, str(_REPO_ROOT))
+sys.path.insert(0, str(_REPO_ROOT / "sdk"))
+
 # Patch environment variables before any imports that might use them
 # Environment variables are now configured in conftest.py
 
@@ -15,6 +22,44 @@
 # during import time of database.client when auth_utils is imported.
 # ---------------------------------------------------------------------------
 
+# Stub `nexent.storage.*` modules early so unittest.mock.patch does not import the real
+# SDK package (which may pull optional heavy dependencies during __init__).
+_nexent_mod = types.ModuleType("nexent")
+_nexent_storage_mod = types.ModuleType("nexent.storage")
+_nexent_storage_factory_mod = types.ModuleType("nexent.storage.storage_client_factory")
+_nexent_minio_config_mod = types.ModuleType("nexent.storage.minio_config")
+
+_nexent_storage_factory_mod.create_storage_client_from_config = lambda *args, **kwargs: None
+
+class _MinIOStorageConfig:
+    def validate(self):
+        return None
+
+_nexent_minio_config_mod.MinIOStorageConfig = _MinIOStorageConfig
+
+_nexent_mod.storage = _nexent_storage_mod
+_nexent_storage_mod.storage_client_factory = _nexent_storage_factory_mod
+_nexent_storage_mod.minio_config = _nexent_minio_config_mod
+
+sys.modules["nexent"] = _nexent_mod
+sys.modules["nexent.storage"] = _nexent_storage_mod
+sys.modules["nexent.storage.storage_client_factory"] = _nexent_storage_factory_mod
+sys.modules["nexent.storage.minio_config"] = _nexent_minio_config_mod
+
+# Stub `backend.database.client` early so patch() can resolve the target even when
+# backend/ and backend/database/ are namespace packages (no __init__.py).
+_backend_mod = sys.modules.get("backend") or types.ModuleType("backend")
+_backend_database_mod = types.ModuleType("backend.database")
+_backend_database_client_mod = types.ModuleType("backend.database.client")
+_backend_database_client_mod.MinioClient = MagicMock()
+
+_backend_mod.database = _backend_database_mod
+_backend_database_mod.client = _backend_database_client_mod
+
+sys.modules["backend"] = _backend_mod
+sys.modules["backend.database"] = _backend_database_mod
+sys.modules["backend.database.client"] = _backend_database_client_mod
+
 # Patch storage factory and MinIO config validation to avoid errors during initialization
 # These patches must be started before any imports that use MinioClient
 storage_client_mock = MagicMock()
@@ -48,6 +93,10 @@
 sys.modules['database.user_tenant_db'] = MagicMock(
     get_user_tenant_by_user_id=MagicMock(return_value=None))
 
+# Stub database.token_db to avoid real DB interactions (used by auth_utils)
+sys.modules['database.token_db'] = MagicMock(
+    get_token_by_access_key=MagicMock(return_value=None))
+
 # Pre-mock nexent core dependency pulled by consts.model
 sys.modules['consts'] = MagicMock()
 
@@ -382,3 +431,200 @@ def test_get_current_user_id_exception(monkeypatch):
 
     with pytest.raises(UnauthorizedError, match="Invalid or expired authentication token"):
         au.get_current_user_id("Bearer invalid_token")
+
+
+# ---------------------------------------------------------------------------
+# Bearer Token (API Key) Authentication Tests
+# ---------------------------------------------------------------------------
+
+class TestValidateBearerToken:
+    """Tests for validate_bearer_token function."""
+
+    def test_validate_bearer_token_success(self, monkeypatch):
+        """Test successful Bearer token validation."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": "user123",
+            "delete_flag": "N"
+        }
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+
+        is_valid, token_info = au.validate_bearer_token("Bearer nexent-abc123")
+
+        assert is_valid is True
+        assert token_info is not None
+        assert token_info["user_id"] == "user123"
+
+    def test_validate_bearer_token_without_bearer_prefix(self, monkeypatch):
+        """Test Bearer token validation without 'Bearer ' prefix."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": "user123",
+            "delete_flag": "N"
+        }
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+
+        is_valid, token_info = au.validate_bearer_token("nexent-abc123")
+
+        assert is_valid is True
+        assert token_info is not None
+
+    def test_validate_bearer_token_empty_authorization(self):
+        """Test Bearer token validation with empty authorization header."""
+        is_valid, token_info = au.validate_bearer_token(None)
+
+        assert is_valid is False
+        assert token_info is None
+
+    def test_validate_bearer_token_empty_string(self):
+        """Test Bearer token validation with empty string."""
+        is_valid, token_info = au.validate_bearer_token("")
+
+        assert is_valid is False
+        assert token_info is None
+
+    def test_validate_bearer_token_empty_token(self):
+        """Test Bearer token validation with 'Bearer ' only."""
+        is_valid, token_info = au.validate_bearer_token("Bearer ")
+
+        assert is_valid is False
+        assert token_info is None
+
+    def test_validate_bearer_token_invalid_token(self, monkeypatch):
+        """Test Bearer token validation with non-existent token."""
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: None)
+
+        is_valid, token_info = au.validate_bearer_token("Bearer nexent-nonexistent")
+
+        assert is_valid is False
+        assert token_info is None
+
+    def test_validate_bearer_token_deleted(self, monkeypatch):
+        """Test Bearer token validation with deleted token."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-deleted",
+            "user_id": "user123",
+            "delete_flag": "Y"
+        }
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+
+        is_valid, token_info = au.validate_bearer_token("Bearer nexent-deleted")
+
+        assert is_valid is False
+        assert token_info is None
+
+    def test_validate_bearer_token_exception(self, monkeypatch):
+        """Test Bearer token validation with exception."""
+        def mock_get_token_raises(key):
+            raise Exception("Database error")
+
+        monkeypatch.setattr(au, "get_token_by_access_key", mock_get_token_raises)
+
+        is_valid, token_info = au.validate_bearer_token("Bearer nexent-error")
+
+        assert is_valid is False
+        assert token_info is None
+
+
+class TestGetUserAndTenantByAccessKey:
+    """Tests for get_user_and_tenant_by_access_key function."""
+
+    def test_get_user_and_tenant_success(self, monkeypatch):
+        """Test successful user and tenant retrieval."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": "user123",
+            "delete_flag": "N"
+        }
+        mock_user_tenant = {"tenant_id": "tenant456"}
+
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+        monkeypatch.setattr(au, "get_user_tenant_by_user_id", lambda uid: mock_user_tenant)
+
+        result = au.get_user_and_tenant_by_access_key("nexent-abc123")
+
+        assert result["user_id"] == "user123"
+        assert result["tenant_id"] == "tenant456"
+        assert result["token_id"] == 1
+
+    def test_get_user_and_tenant_default_tenant(self, monkeypatch):
+        """Test that DEFAULT_TENANT_ID is used when no tenant mapping exists."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": "user123",
+            "delete_flag": "N"
+        }
+
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+        monkeypatch.setattr(au, "get_user_tenant_by_user_id", lambda uid: None)
+
+        result = au.get_user_and_tenant_by_access_key("nexent-abc123")
+
+        assert result["user_id"] == "user123"
+        assert result["tenant_id"] == au.DEFAULT_TENANT_ID
+        assert result["token_id"] == 1
+
+    def test_get_user_and_tenant_empty_tenant_id(self, monkeypatch):
+        """Test that DEFAULT_TENANT_ID is used when tenant_id is empty."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": "user123",
+            "delete_flag": "N"
+        }
+        mock_user_tenant = {"tenant_id": ""}
+
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+        monkeypatch.setattr(au, "get_user_tenant_by_user_id", lambda uid: mock_user_tenant)
+
+        result = au.get_user_and_tenant_by_access_key("nexent-abc123")
+
+        assert result["tenant_id"] == au.DEFAULT_TENANT_ID
+
+    def test_get_user_and_tenant_empty_access_key(self):
+        """Test with empty access key."""
+        with pytest.raises(UnauthorizedError, match="Invalid access key"):
+            au.get_user_and_tenant_by_access_key("")
+
+    def test_get_user_and_tenant_none_access_key(self):
+        """Test with None access key."""
+        with pytest.raises(UnauthorizedError, match="Invalid access key"):
+            au.get_user_and_tenant_by_access_key(None)
+
+    def test_get_user_and_tenant_token_not_found(self, monkeypatch):
+        """Test when token is not found."""
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: None)
+
+        with pytest.raises(UnauthorizedError, match="Invalid or inactive access key"):
+            au.get_user_and_tenant_by_access_key("nexent-nonexistent")
+
+    def test_get_user_and_tenant_deleted_token(self, monkeypatch):
+        """Test when token is deleted."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-deleted",
+            "user_id": "user123",
+            "delete_flag": "Y"
+        }
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+
+        with pytest.raises(UnauthorizedError, match="Invalid or inactive access key"):
+            au.get_user_and_tenant_by_access_key("nexent-deleted")
+
+    def test_get_user_and_tenant_no_user_id(self, monkeypatch):
+        """Test when token has no user_id."""
+        mock_token_info = {
+            "token_id": 1,
+            "access_key": "nexent-abc123",
+            "user_id": None,
+            "delete_flag": "N"
+        }
+        monkeypatch.setattr(au, "get_token_by_access_key", lambda key: mock_token_info)
+
+        with pytest.raises(UnauthorizedError, match="No user associated with this access key"):
+            au.get_user_and_tenant_by_access_key("nexent-abc123")
diff --git a/test/backend/utils/test_file_management_utils.py b/test/backend/utils/test_file_management_utils.py
index 02553db8f..a7696a682 100644
--- a/test/backend/utils/test_file_management_utils.py
+++ b/test/backend/utils/test_file_management_utils.py
@@ -704,3 +704,98 @@ async def _fake_convert(*a, **k):
     # total_chunks should remain from task state (12) since redis_total is None
     assert out["/p9"]["total_chunks"] == 12
 
+
+class TestConvertOfficeToPdf:
+    """Test cases for convert_office_to_pdf function"""
+
+    @pytest.mark.asyncio
+    async def test_convert_office_to_pdf_success(self, fmu, monkeypatch):
+        """Test successful Office to PDF conversion"""
+        import subprocess
+        
+        mock_result = types.SimpleNamespace(returncode=0, stderr="", stdout="")
+        
+        monkeypatch.setattr(fmu.os.path, "exists", lambda p: True)
+        monkeypatch.setattr(fmu.os.path, "basename", lambda p: "document.docx")
+        monkeypatch.setattr(fmu.subprocess, "run", lambda *a, **k: mock_result)
+        
+        result = await fmu.convert_office_to_pdf('/tmp/document.docx', '/tmp/output')
+        
+        assert result == '/tmp/output/document.pdf'
+
+    @pytest.mark.asyncio
+    async def test_convert_office_to_pdf_input_not_found(self, fmu, monkeypatch):
+        """Test conversion failure when input file does not exist"""
+        monkeypatch.setattr(fmu.os.path, "exists", lambda p: False)
+        
+        with pytest.raises(FileNotFoundError) as exc_info:
+            await fmu.convert_office_to_pdf('/tmp/nonexistent.docx', '/tmp/output')
+        
+        assert "Input file not found" in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    async def test_convert_office_to_pdf_libreoffice_error(self, fmu, monkeypatch):
+        """Test conversion failure when LibreOffice returns error"""
+        mock_result = types.SimpleNamespace(returncode=1, stderr="Error: LibreOffice crashed", stdout="")
+        
+        monkeypatch.setattr(fmu.os.path, "exists", lambda p: True)
+        monkeypatch.setattr(fmu.subprocess, "run", lambda *a, **k: mock_result)
+        
+        with pytest.raises(RuntimeError) as exc_info:
+            await fmu.convert_office_to_pdf('/tmp/document.docx', '/tmp/output')
+        
+        assert "Office to PDF conversion failed" in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    async def test_convert_office_to_pdf_timeout(self, fmu, monkeypatch):
+        """Test conversion failure due to timeout"""
+        import subprocess
+        
+        monkeypatch.setattr(fmu.os.path, "exists", lambda p: True)
+        
+        def raise_timeout(*a, **k):
+            raise subprocess.TimeoutExpired(cmd='libreoffice', timeout=30)
+        
+        monkeypatch.setattr(fmu.subprocess, "run", raise_timeout)
+        
+        with pytest.raises(TimeoutError) as exc_info:
+            await fmu.convert_office_to_pdf('/tmp/document.docx', '/tmp/output', timeout=30)
+        
+        assert "timeout" in str(exc_info.value).lower()
+
+    @pytest.mark.asyncio
+    async def test_convert_office_to_pdf_libreoffice_not_installed(self, fmu, monkeypatch):
+        """Test conversion failure when LibreOffice is not installed"""
+        monkeypatch.setattr(fmu.os.path, "exists", lambda p: True)
+        
+        def raise_file_not_found(*a, **k):
+            raise FileNotFoundError("[Errno 2] No such file or directory: 'libreoffice'")
+        
+        monkeypatch.setattr(fmu.subprocess, "run", raise_file_not_found)
+        
+        with pytest.raises(FileNotFoundError) as exc_info:
+            await fmu.convert_office_to_pdf('/tmp/document.docx', '/tmp/output')
+        
+        assert "LibreOffice is not installed" in str(exc_info.value)
+        assert "not available in PATH" in str(exc_info.value)
+
+    @pytest.mark.asyncio
+    async def test_convert_office_to_pdf_output_not_found(self, fmu, monkeypatch):
+        """Test conversion failure when output PDF is not generated"""
+        mock_result = types.SimpleNamespace(returncode=0, stderr="", stdout="")
+        
+        def exists_side_effect(path):
+            # Input file exists, output PDF does not
+            if 'document.docx' in path:
+                return True
+            return False
+        
+        monkeypatch.setattr(fmu.os.path, "exists", exists_side_effect)
+        monkeypatch.setattr(fmu.os.path, "basename", lambda p: "document.docx")
+        monkeypatch.setattr(fmu.subprocess, "run", lambda *a, **k: mock_result)
+        
+        with pytest.raises(RuntimeError) as exc_info:
+            await fmu.convert_office_to_pdf('/tmp/document.docx', '/tmp/output')
+        
+        assert "Converted PDF not found" in str(exc_info.value)
+
diff --git a/test/backend/utils/test_llm_utils.py b/test/backend/utils/test_llm_utils.py
index b34a58b71..2c43ea01c 100644
--- a/test/backend/utils/test_llm_utils.py
+++ b/test/backend/utils/test_llm_utils.py
@@ -139,6 +139,9 @@ def test_call_llm_for_system_prompt_success(self, mocker: MockFixture):
         )
 
     def test_call_llm_for_system_prompt_exception(self, mocker: MockFixture):
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
         mock_get_model_by_id = mocker.patch('backend.utils.llm_utils.get_model_by_model_id')
         mock_get_model_name = mocker.patch('backend.utils.llm_utils.get_model_name_from_config')
         mock_openai = mocker.patch('backend.utils.llm_utils.OpenAIModel')
@@ -155,14 +158,15 @@ def test_call_llm_for_system_prompt_exception(self, mocker: MockFixture):
         mock_llm_instance.client.chat.completions.create.side_effect = Exception("LLM error")
         mock_llm_instance._prepare_completion_kwargs.return_value = {}
 
-        with pytest.raises(Exception) as exc_info:
+        with pytest.raises(AppException) as exc_info:
             call_llm_for_system_prompt(
                 1,
                 "user prompt",
                 "system prompt",
             )
 
-        assert "LLM error" in str(exc_info.value)
+        # Verify AppException is raised with correct error code for unmapped errors
+        assert exc_info.value.error_code == ErrorCode.MODEL_PROMPT_GENERATION_FAILED
 
 
 class TestProcessThinkingTokens:
@@ -813,3 +817,289 @@ def test_call_llm_for_system_prompt_exception_logging(self, mocker: MockFixture)
         mock_logger.error.assert_called_once()
         call_args = mock_logger.error.call_args[0][0]
         assert "Failed to generate prompt" in call_args
+
+
+class TestCallLLMForSystemPromptErrorHandling:
+    """Tests for error handling in call_llm_for_system_prompt function."""
+
+    def _create_mock_llm_setup(self, mocker: MockFixture):
+        """Helper to setup common mocks for LLM error tests."""
+        mock_get_model_by_id = mocker.patch('backend.utils.llm_utils.get_model_by_model_id')
+        mock_get_model_name = mocker.patch('backend.utils.llm_utils.get_model_name_from_config')
+        mock_openai = mocker.patch('backend.utils.llm_utils.OpenAIModel')
+
+        mock_get_model_by_id.return_value = {"base_url": "http://example.com", "api_key": "fake-key"}
+        mock_get_model_name.return_value = "gpt-4"
+
+        mock_llm_instance = mock_openai.return_value
+        mock_llm_instance._prepare_completion_kwargs.return_value = {}
+
+        return mock_llm_instance
+
+    def test_error_401_api_key_invalid(self, mocker: MockFixture):
+        """Test error handling for 401 status code - API key invalid."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 401: Invalid API key"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_API_KEY_INVALID
+
+    def test_error_unauthorized_lowercase(self, mocker: MockFixture):
+        """Test error handling for 'unauthorized' in error message."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Unauthorized access to the resource"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_API_KEY_INVALID
+
+    def test_error_api_key_in_message(self, mocker: MockFixture):
+        """Test error handling for 'api key' in error message."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Invalid API key provided"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_API_KEY_INVALID
+
+    def test_error_403_forbidden(self, mocker: MockFixture):
+        """Test error handling for 403 status code - no permission."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 403: Access forbidden"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_API_KEY_NO_PERMISSION
+
+    def test_error_forbidden_lowercase(self, mocker: MockFixture):
+        """Test error handling for 'forbidden' in error message."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Request forbidden by the server"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_API_KEY_NO_PERMISSION
+
+    def test_error_404_not_found(self, mocker: MockFixture):
+        """Test error handling for 404 status code - model not found."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 404: Model not found"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_NOT_FOUND
+
+    def test_error_not_found_lowercase(self, mocker: MockFixture):
+        """Test error handling for 'not found' in error message."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "The requested model was not found"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_NOT_FOUND
+
+    def test_error_429_rate_limit(self, mocker: MockFixture):
+        """Test error handling for 429 status code - rate limit exceeded."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 429: Rate limit exceeded"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_RATE_LIMIT_EXCEEDED
+
+    def test_error_rate_limit_lowercase(self, mocker: MockFixture):
+        """Test error handling for 'rate limit' in error message."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Too many requests, rate limit reached"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_RATE_LIMIT_EXCEEDED
+
+    def test_error_500_service_unavailable(self, mocker: MockFixture):
+        """Test error handling for 500 status code - service unavailable."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 500: Internal server error"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_SERVICE_UNAVAILABLE
+
+    def test_error_502_service_unavailable(self, mocker: MockFixture):
+        """Test error handling for 502 status code - bad gateway."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 502: Bad gateway"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_SERVICE_UNAVAILABLE
+
+    def test_error_503_service_unavailable(self, mocker: MockFixture):
+        """Test error handling for 503 status code - service unavailable."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 503: Service temporarily unavailable"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_SERVICE_UNAVAILABLE
+
+    def test_error_504_service_unavailable(self, mocker: MockFixture):
+        """Test error handling for 504 status code - gateway timeout."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Error 504: Gateway timeout"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_SERVICE_UNAVAILABLE
+
+    def test_error_connection_error(self, mocker: MockFixture):
+        """Test error handling for connection error."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Connection error: Unable to reach the server"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_CONNECTION_ERROR
+
+    def test_error_timeout(self, mocker: MockFixture):
+        """Test error handling for timeout error."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Request timeout occurred"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_CONNECTION_ERROR
+
+    def test_error_connection_refused(self, mocker: MockFixture):
+        """Test error handling for connection refused error."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Connection refused by the server"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_CONNECTION_ERROR
+
+    def test_error_generic_unmapped_error(self, mocker: MockFixture):
+        """Test error handling for generic unmapped errors."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception(
+            "Some unexpected error occurred"
+        )
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_PROMPT_GENERATION_FAILED
+
+    def test_error_empty_message(self, mocker: MockFixture):
+        """Test error handling for exception with empty message."""
+        from consts.error_code import ErrorCode
+        from consts.exceptions import AppException
+
+        mock_llm_instance = self._create_mock_llm_setup(mocker)
+        mock_llm_instance.client.chat.completions.create.side_effect = Exception()
+
+        with pytest.raises(AppException) as exc_info:
+            call_llm_for_system_prompt(1, "user prompt", "system prompt")
+
+        assert exc_info.value.error_code == ErrorCode.MODEL_PROMPT_GENERATION_FAILED
\ No newline at end of file
diff --git a/test/sdk/core/agents/test_nexent_agent.py b/test/sdk/core/agents/test_nexent_agent.py
index 1d50c5aa3..b24c12ad7 100644
--- a/test/sdk/core/agents/test_nexent_agent.py
+++ b/test/sdk/core/agents/test_nexent_agent.py
@@ -111,12 +111,14 @@ class _MockProcessType:
     FINAL_ANSWER = "final_answer"
     ERROR = "error"
 
+
 MessageObserver = _MockMessageObserver
 ProcessType = _MockProcessType
 
 
 mock_nexent_core_utils_module = types.ModuleType("nexent.core.utils")
-mock_nexent_core_utils_observer_module = types.ModuleType("nexent.core.utils.observer")
+mock_nexent_core_utils_observer_module = types.ModuleType(
+    "nexent.core.utils.observer")
 mock_nexent_core_utils_observer_module.MessageObserver = _MockMessageObserver
 mock_nexent_core_utils_observer_module.ProcessType = _MockProcessType
 
@@ -133,17 +135,20 @@ class _MockProcessType:
 
 mock_sdk_module.__path__ = [str(SDK_SOURCE_ROOT)]
 mock_sdk_nexent_module.__path__ = [str(SDK_SOURCE_ROOT / "nexent")]
-mock_sdk_nexent_core_module.__path__ = [str(SDK_SOURCE_ROOT / "nexent" / "core")]
+mock_sdk_nexent_core_module.__path__ = [
+    str(SDK_SOURCE_ROOT / "nexent" / "core")]
 mock_sdk_nexent_core_agents_module.__path__ = [
     str(SDK_SOURCE_ROOT / "nexent" / "core" / "agents")
 ]
-mock_sdk_nexent_core_utils_module.__path__ = [str(SDK_SOURCE_ROOT / "nexent" / "core" / "utils")]
+mock_sdk_nexent_core_utils_module.__path__ = [
+    str(SDK_SOURCE_ROOT / "nexent" / "core" / "utils")]
 mock_sdk_nexent_core_utils_observer_module.__path__ = []
 
 mock_prompt_template_utils_module = types.ModuleType(
     "nexent.core.utils.prompt_template_utils"
 )
-mock_prompt_template_utils_module.get_prompt_template = MagicMock(return_value="")
+mock_prompt_template_utils_module.get_prompt_template = MagicMock(
+    return_value="")
 
 mock_tools_common_message_module = types.ModuleType(
     "nexent.core.utils.tools_common_message"
@@ -199,7 +204,8 @@ class _MockToolSign:
 mock_nexent_storage_module.MinIOStorageClient = MagicMock()
 mock_nexent_module.storage = mock_nexent_storage_module
 mock_nexent_multi_modal_module = types.ModuleType("nexent.multi_modal")
-mock_nexent_load_save_module = types.ModuleType("nexent.multi_modal.load_save_object")
+mock_nexent_load_save_module = types.ModuleType(
+    "nexent.multi_modal.load_save_object")
 mock_nexent_load_save_module.LoadSaveObjectManager = MagicMock()
 mock_nexent_module.multi_modal = mock_nexent_multi_modal_module
 module_mocks = {
@@ -679,7 +685,7 @@ def test_create_local_tool_analyze_text_file_tool(nexent_agent_instance):
         metadata={
             "llm_model": "llm_model_obj",
             "storage_client": "storage_client_obj",
-        "data_process_service_url": "https://example.com",
+            "data_process_service_url": "https://example.com",
         },
     )
 
@@ -785,14 +791,16 @@ def test_create_local_tool_knowledge_base_search_tool_with_conflicting_params(ne
         output_type="string",
         params={
             "top_k": 10,
-            "index_names": ["conflicting_index"],  # This should be filtered out
+            # This should be filtered out
+            "index_names": ["conflicting_index"],
             "vdb_core": "conflicting_vdb",  # This should be filtered out
             "embedding_model": "conflicting_model",  # This should be filtered out
             "observer": "conflicting_observer",  # This should be filtered out
         },
         source="local",
         metadata={
-            "index_names": ["index1", "index2"],  # These should be used instead
+            # These should be used instead
+            "index_names": ["index1", "index2"],
             "vdb_core": mock_vdb_core,
             "embedding_model": mock_embedding_model,
         },
@@ -814,13 +822,15 @@ def test_create_local_tool_knowledge_base_search_tool_with_conflicting_params(ne
     # Only non-excluded params should be passed to __init__ due to smolagents wrapper restrictions
     mock_kb_tool_class.assert_called_once_with(
         top_k=10,  # From filtered_params (not in conflict list)
-        index_names=["conflicting_index"],  # Not excluded by current implementation
+        # Not excluded by current implementation
+        index_names=["conflicting_index"],
     )
     # Verify excluded parameters were set directly as attributes after instantiation
     assert result == mock_kb_tool_instance
     assert mock_kb_tool_instance.observer == nexent_agent_instance.observer
     assert mock_kb_tool_instance.vdb_core == mock_vdb_core  # From metadata, not params
-    assert mock_kb_tool_instance.embedding_model == mock_embedding_model  # From metadata, not params
+    # From metadata, not params
+    assert mock_kb_tool_instance.embedding_model == mock_embedding_model
 
 
 def test_create_local_tool_knowledge_base_search_tool_with_none_defaults(nexent_agent_instance):
@@ -863,6 +873,7 @@ def test_create_local_tool_knowledge_base_search_tool_with_none_defaults(nexent_
     assert mock_kb_tool_instance.embedding_model is None
     assert result == mock_kb_tool_instance
 
+
 def test_create_local_tool_analyze_text_file_tool(nexent_agent_instance):
     """Test AnalyzeTextFileTool creation injects observer and metadata."""
     mock_analyze_tool_class = MagicMock()
@@ -1345,6 +1356,215 @@ def test_agent_run_with_observer_with_reset_false(nexent_agent_instance, mock_co
     mock_core_agent.run.assert_called_once_with(
         "test query", stream=True, reset=False)
 
+
+def test_agent_run_with_observer_removes_think_prefix_chinese_colon(nexent_agent_instance, mock_core_agent):
+    """Test agent_run_with_observer removes '思考：' prefix content until two newlines."""
+    # Setup
+    nexent_agent_instance.agent = mock_core_agent
+    mock_core_agent.stop_event.is_set.return_value = False
+
+    # Mock step logs
+    mock_action_step = MagicMock(spec=ActionStep)
+    mock_action_step.duration = 1.0
+    mock_action_step.error = None
+
+    # Test with Chinese colon "思考：" followed by content and two newlines
+    final_answer_with_think = (
+        "思考：用户需要一份营养早餐的搭配建议。作为健康饮食搭配助手，我需要基于营养学知识，提供一份科学、均衡、易于准备的早餐方案。由于没有可用工具，我将直接给出建议，包括食物种类、分量和营养说明。\n\n"
+        "一份营养均衡的早餐应包含碳水化合物、蛋白质、健康脂肪、维生素和矿物质。以下是我的推荐："
+    )
+    mock_core_agent.run.return_value = [mock_action_step]
+    mock_core_agent.run.return_value[-1].output = final_answer_with_think
+
+    # Execute
+    nexent_agent_instance.agent_run_with_observer("test query")
+
+    # Verify the "思考：" prefix content was removed
+    expected_final_answer = (
+        "一份营养均衡的早餐应包含碳水化合物、蛋白质、健康脂肪、维生素和矿物质。以下是我的推荐："
+    )
+    mock_core_agent.observer.add_message.assert_any_call(
+        "test_agent", ProcessType.FINAL_ANSWER, expected_final_answer
+    )
+
+
+def test_agent_run_with_observer_removes_think_prefix_english_colon(nexent_agent_instance, mock_core_agent):
+    """Test agent_run_with_observer removes '思考:' prefix content until two newlines."""
+    # Setup
+    nexent_agent_instance.agent = mock_core_agent
+    mock_core_agent.stop_event.is_set.return_value = False
+
+    # Mock step logs
+    mock_action_step = MagicMock(spec=ActionStep)
+    mock_action_step.duration = 1.0
+    mock_action_step.error = None
+
+    # Test with English colon "思考:" followed by content and two newlines
+    final_answer_with_think = (
+        "思考:This is a thinking process about the user's question.\n\n"
+        "Here is the actual answer to the question."
+    )
+    mock_core_agent.run.return_value = [mock_action_step]
+    mock_core_agent.run.return_value[-1].output = final_answer_with_think
+
+    # Execute
+    nexent_agent_instance.agent_run_with_observer("test query")
+
+    # Verify the "思考:" prefix content was removed
+    expected_final_answer = "Here is the actual answer to the question."
+    mock_core_agent.observer.add_message.assert_any_call(
+        "test_agent", ProcessType.FINAL_ANSWER, expected_final_answer
+    )
+
+
+def test_agent_run_with_observer_preserves_think_prefix_without_two_newlines(nexent_agent_instance, mock_core_agent):
+    """Test agent_run_with_observer preserves '思考：' content when not followed by two newlines."""
+    # Setup
+    nexent_agent_instance.agent = mock_core_agent
+    mock_core_agent.stop_event.is_set.return_value = False
+
+    # Mock step logs
+    mock_action_step = MagicMock(spec=ActionStep)
+    mock_action_step.duration = 1.0
+    mock_action_step.error = None
+
+    # Test with "思考：" but only one newline (should not be removed)
+    final_answer_with_think = (
+        "思考：This is thinking content.\n"
+        "Here is the actual answer."
+    )
+    mock_core_agent.run.return_value = [mock_action_step]
+    mock_core_agent.run.return_value[-1].output = final_answer_with_think
+
+    # Execute
+    nexent_agent_instance.agent_run_with_observer("test query")
+
+    # Verify the content was preserved (not removed because no \n\n)
+    expected_final_answer = (
+        "思考：This is thinking content.\n"
+        "Here is the actual answer."
+    )
+    mock_core_agent.observer.add_message.assert_any_call(
+        "test_agent", ProcessType.FINAL_ANSWER, expected_final_answer
+    )
+
+
+def test_agent_run_with_observer_removes_both_think_tag_and_think_prefix(nexent_agent_instance, mock_core_agent):
+    """Test agent_run_with_observer removes both THINK_TAG_PATTERN and THINK_PREFIX_PATTERN."""
+    # Setup
+    nexent_agent_instance.agent = mock_core_agent
+    mock_core_agent.stop_event.is_set.return_value = False
+
+    # Mock step logs
+    mock_action_step = MagicMock(spec=ActionStep)
+    mock_action_step.duration = 1.0
+    mock_action_step.error = None
+
+    # Test with both <think> tags and "思考：" prefix
+    final_answer_with_both = (
+        "<think>Some reasoning content</think>"
+        "思考：用户需要一份营养早餐的搭配建议。\n\n"
+        "一份营养均衡的早餐应包含碳水化合物、蛋白质、健康脂肪、维生素和矿物质。"
+    )
+    mock_core_agent.run.return_value = [mock_action_step]
+    mock_core_agent.run.return_value[-1].output = final_answer_with_both
+
+    # Execute
+    nexent_agent_instance.agent_run_with_observer("test query")
+
+    # Verify both patterns were removed
+    expected_final_answer = "一份营养均衡的早餐应包含碳水化合物、蛋白质、健康脂肪、维生素和矿物质。"
+    mock_core_agent.observer.add_message.assert_any_call(
+        "test_agent", ProcessType.FINAL_ANSWER, expected_final_answer
+    )
+
+
+def test_agent_run_with_observer_think_prefix_in_middle(nexent_agent_instance, mock_core_agent):
+    """Test agent_run_with_observer removes '思考：' even when it appears in the middle of text."""
+    # Setup
+    nexent_agent_instance.agent = mock_core_agent
+    mock_core_agent.stop_event.is_set.return_value = False
+
+    # Mock step logs
+    mock_action_step = MagicMock(spec=ActionStep)
+    mock_action_step.duration = 1.0
+    mock_action_step.error = None
+
+    # Test with "思考：" in the middle of the text
+    final_answer_with_think = (
+        "Some initial content. "
+        "思考：This is thinking content in the middle.\n\n"
+        "Here is the rest of the answer."
+    )
+    mock_core_agent.run.return_value = [mock_action_step]
+    mock_core_agent.run.return_value[-1].output = final_answer_with_think
+
+    # Execute
+    nexent_agent_instance.agent_run_with_observer("test query")
+
+    # Verify the "思考：" content was removed
+    expected_final_answer = "Some initial content. Here is the rest of the answer."
+    mock_core_agent.observer.add_message.assert_any_call(
+        "test_agent", ProcessType.FINAL_ANSWER, expected_final_answer
+    )
+
+
+def test_agent_run_with_observer_no_think_prefix(nexent_agent_instance, mock_core_agent):
+    """Test agent_run_with_observer handles content without '思考：' prefix normally."""
+    # Setup
+    nexent_agent_instance.agent = mock_core_agent
+    mock_core_agent.stop_event.is_set.return_value = False
+
+    # Mock step logs
+    mock_action_step = MagicMock(spec=ActionStep)
+    mock_action_step.duration = 1.0
+    mock_action_step.error = None
+
+    # Test with normal content without "思考：" prefix
+    final_answer_normal = "This is a normal final answer without any thinking prefix."
+    mock_core_agent.run.return_value = [mock_action_step]
+    mock_core_agent.run.return_value[-1].output = final_answer_normal
+
+    # Execute
+    nexent_agent_instance.agent_run_with_observer("test query")
+
+    # Verify the content was preserved as-is
+    mock_core_agent.observer.add_message.assert_any_call(
+        "test_agent", ProcessType.FINAL_ANSWER, final_answer_normal
+    )
+
+
+def test_agent_run_with_observer_think_prefix_with_agent_text(nexent_agent_instance, mock_core_agent):
+    """Test agent_run_with_observer removes '思考：' prefix when final answer is AgentText."""
+    # Setup
+    nexent_agent_instance.agent = mock_core_agent
+    mock_core_agent.stop_event.is_set.return_value = False
+
+    # Mock step logs
+    mock_action_step = MagicMock(spec=ActionStep)
+    mock_action_step.duration = 1.0
+    mock_action_step.error = None
+
+    # Test with AgentText containing "思考：" prefix
+    final_answer_with_think = (
+        "思考：用户需要一份营养早餐的搭配建议。\n\n"
+        "一份营养均衡的早餐应包含碳水化合物、蛋白质、健康脂肪、维生素和矿物质。"
+    )
+    mock_final_answer = _AgentText(final_answer_with_think)
+
+    mock_core_agent.run.return_value = [mock_action_step]
+    mock_core_agent.run.return_value[-1].output = mock_final_answer
+
+    # Execute
+    nexent_agent_instance.agent_run_with_observer("test query")
+
+    # Verify the "思考：" prefix content was removed
+    expected_final_answer = "一份营养均衡的早餐应包含碳水化合物、蛋白质、健康脂肪、维生素和矿物质。"
+    mock_core_agent.observer.add_message.assert_any_call(
+        "test_agent", ProcessType.FINAL_ANSWER, expected_final_answer
+    )
+
+
 def test_create_local_tool_datamate_search_tool_success(nexent_agent_instance):
     """Test successful creation of DataMateSearchTool with metadata."""
     mock_datamate_tool_class = MagicMock()
@@ -1385,7 +1605,6 @@ def test_create_local_tool_datamate_search_tool_success(nexent_agent_instance):
     assert mock_datamate_tool_instance.observer == nexent_agent_instance.observer
 
 
-
 def test_create_local_tool_datamate_search_tool_with_none_defaults(nexent_agent_instance):
     """Test DataMateSearchTool creation with None defaults when metadata is missing."""
     mock_datamate_tool_class = MagicMock()
diff --git a/test/sdk/core/tools/test_exa_search_tool.py b/test/sdk/core/tools/test_exa_search_tool.py
index ad5b15339..846fcb84b 100644
--- a/test/sdk/core/tools/test_exa_search_tool.py
+++ b/test/sdk/core/tools/test_exa_search_tool.py
@@ -5,28 +5,16 @@
 from datetime import datetime
 
 # Create all necessary mocks
-mock_tavily_client = MagicMock()
-mock_tavily = MagicMock()
-mock_tavily.TavilyClient = mock_tavily_client
-
 mock_exa = MagicMock()
 mock_exa_client = MagicMock()
 mock_exa.Exa = mock_exa_client
 
-mock_linkup = MagicMock()
-mock_linkup_client = MagicMock()
-mock_linkup.LinkupClient = mock_linkup_client
-mock_linkup.LinkupSearchImageResult = MagicMock()
-mock_linkup.LinkupSearchTextResult = MagicMock()
-
 mock_aiohttp = MagicMock()
 mock_aiohttp.ClientSession = MagicMock()
 
 # Use module-level mocks
 module_mocks = {
-    'tavily': mock_tavily,
     'exa_py': mock_exa,
-    'linkup': mock_linkup,
     'aiohttp': mock_aiohttp
 }
 
diff --git a/test/sdk/core/tools/test_idata_search_tool.py b/test/sdk/core/tools/test_idata_search_tool.py
new file mode 100644
index 000000000..b568676ed
--- /dev/null
+++ b/test/sdk/core/tools/test_idata_search_tool.py
@@ -0,0 +1,1107 @@
+import json
+from datetime import datetime
+from unittest.mock import ANY, MagicMock, patch
+
+import httpx
+import pytest
+from pytest_mock import MockFixture
+
+from sdk.nexent.core.tools.idata_search_tool import IdataSearchTool
+from sdk.nexent.core.utils.observer import MessageObserver, ProcessType
+
+
+@pytest.fixture
+def mock_observer() -> MessageObserver:
+    """Create a mock observer for testing"""
+    observer = MagicMock(spec=MessageObserver)
+    observer.lang = "en"
+    return observer
+
+
+@pytest.fixture
+def idata_tool(mock_observer: MessageObserver) -> IdataSearchTool:
+    """Create IdataSearchTool instance for testing"""
+    with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+        mock_client = MagicMock()
+        mock_manager.get_sync_client.return_value = mock_client
+        tool = IdataSearchTool(
+            server_url="https://api.idata.example.com",
+            api_key="test_api_key",
+            user_id="test_user_id",
+            knowledge_space_id="test_knowledge_space_id",
+            dataset_ids='["kb1", "kb2"]',
+            rerank_model_id="test_rerank_model_id",
+            top_k=5,
+            similarity_threshold=0.5,
+            keyword_similarity_weight=0.1,
+            vector_similarity_weight=0.3,
+            observer=mock_observer,
+        )
+        # Store the mock client for tests to use
+        tool._mock_http_client = mock_client
+        return tool
+
+
+def _build_search_response(chunks=None, retrieval_data_count=1):
+    """Helper function to build mock search response"""
+    if chunks is None:
+        chunks = [
+            {
+                "documentId": "doc1",
+                "documentName": "document1.txt",
+                "content": "test content 1",
+                "datasetId": "kb1",
+                "createTime": 1609459200000,  # 2021-01-01 00:00:00 in milliseconds
+                "reRankScore": 0.9,
+                "vsScore": 0.8,
+                "esScore": 0.7,
+                "title": "Test Document 1"
+            },
+            {
+                "documentId": "doc2",
+                "documentName": "document2.txt",
+                "content": "test content 2",
+                "datasetId": "kb2",
+                "createTime": 1609545600000,  # 2021-01-02 00:00:00 in milliseconds
+                "reRankScore": 0.85,
+                "vsScore": 0.75,
+                "esScore": 0.65,
+                "title": "Test Document 2"
+            }
+        ]
+
+    retrieval_data = []
+    for i in range(retrieval_data_count):
+        retrieval_data.append({"chunks": chunks})
+
+    return {
+        "code": "1",
+        "msg": "success",
+        "data": {
+            "retrievalData": retrieval_data
+        }
+    }
+
+
+class TestIdataSearchToolInit:
+    """Test IdataSearchTool initialization"""
+
+    def test_init_success(self, mock_observer: MessageObserver):
+        """Test successful initialization with all parameters"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1", "kb2"]',
+                rerank_model_id="test_rerank_model_id",
+                top_k=10,
+                similarity_threshold=0.6,
+                keyword_similarity_weight=0.15,
+                vector_similarity_weight=0.35,
+                observer=mock_observer,
+            )
+
+            assert tool.server_url == "https://api.idata.example.com"
+            assert tool.api_key == "test_api_key"
+            assert tool.user_id == "test_user_id"
+            assert tool.knowledge_space_id == "test_knowledge_space_id"
+            assert tool.dataset_ids == ["kb1", "kb2"]
+            assert tool.rerank_model_id == "test_rerank_model_id"
+            assert tool.top_k == 10
+            assert tool.similarity_threshold == 0.6
+            assert tool.keyword_similarity_weight == 0.15
+            assert tool.vector_similarity_weight == 0.35
+            assert tool.observer == mock_observer
+            assert tool.record_ops == 1
+            assert tool.running_prompt_zh == "iData知识库检索中..."
+            assert tool.running_prompt_en == "Searching iData knowledge base..."
+
+    def test_init_server_url_trailing_slash(self, mock_observer: MessageObserver):
+        """Test that trailing slash is stripped from server_url"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com/",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+
+            assert tool.server_url == "https://api.idata.example.com"
+
+    def test_init_default_values(self, mock_observer: MessageObserver):
+        """Test initialization with default values"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            # Pass default values explicitly to test they are accepted
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                top_k=10,  # Explicitly pass default value
+                similarity_threshold=-10.0,  # Explicitly pass default value
+                keyword_similarity_weight=0.10,  # Explicitly pass default value
+                vector_similarity_weight=0.3,  # Explicitly pass default value
+                observer=mock_observer,
+            )
+
+            assert tool.top_k == 10  # Default value
+            assert tool.similarity_threshold == -10.0  # Default value
+            assert tool.keyword_similarity_weight == 0.10  # Default value
+            assert tool.vector_similarity_weight == 0.3  # Default value
+
+    @pytest.mark.parametrize("server_url,expected_error", [
+        ("", "server_url is required and must be a non-empty string"),
+        (None, "server_url is required and must be a non-empty string"),
+    ])
+    def test_init_invalid_server_url(self, server_url, expected_error, mock_observer: MessageObserver):
+        """Test initialization with invalid server_url"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url=server_url,
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+        assert expected_error in str(excinfo.value)
+
+    @pytest.mark.parametrize("api_key,expected_error", [
+        ("", "api_key is required and must be a non-empty string"),
+        (None, "api_key is required and must be a non-empty string"),
+    ])
+    def test_init_invalid_api_key(self, api_key, expected_error, mock_observer: MessageObserver):
+        """Test initialization with invalid api_key"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key=api_key,
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+        assert expected_error in str(excinfo.value)
+
+    @pytest.mark.parametrize("user_id,expected_error", [
+        ("", "user_id is required and must be a non-empty string"),
+        (None, "user_id is required and must be a non-empty string"),
+    ])
+    def test_init_invalid_user_id(self, user_id, expected_error, mock_observer: MessageObserver):
+        """Test initialization with invalid user_id"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id=user_id,
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+        assert expected_error in str(excinfo.value)
+
+    @pytest.mark.parametrize("knowledge_space_id,expected_error", [
+        ("", "knowledge_space_id is required and must be a non-empty string"),
+        (None, "knowledge_space_id is required and must be a non-empty string"),
+    ])
+    def test_init_invalid_knowledge_space_id(self, knowledge_space_id, expected_error, mock_observer: MessageObserver):
+        """Test initialization with invalid knowledge_space_id"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id=knowledge_space_id,
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+        assert expected_error in str(excinfo.value)
+
+    @pytest.mark.parametrize("rerank_model_id,expected_error", [
+        ("", "rerank_model_id is required and must be a non-empty string"),
+        (None, "rerank_model_id is required and must be a non-empty string"),
+    ])
+    def test_init_invalid_rerank_model_id(self, rerank_model_id, expected_error, mock_observer: MessageObserver):
+        """Test initialization with invalid rerank_model_id"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id=rerank_model_id,
+                observer=mock_observer,
+            )
+        assert expected_error in str(excinfo.value)
+
+    @pytest.mark.parametrize("dataset_ids,expected_error", [
+        ([], "dataset_ids is required and must be a non-empty JSON string array or list"),
+        ("", "dataset_ids is required and must be a non-empty JSON string array or list"),
+        (None, "dataset_ids is required and must be a non-empty JSON string array or list"),
+        ("[]", "dataset_ids must be a non-empty array of strings"),
+    ])
+    def test_init_invalid_dataset_ids(self, dataset_ids, expected_error, mock_observer: MessageObserver):
+        """Test initialization with invalid dataset_ids"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids=dataset_ids,
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+        assert expected_error in str(excinfo.value)
+
+    def test_init_dataset_ids_as_list(self, mock_observer: MessageObserver):
+        """Test dataset_ids can be passed as a Python list"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids=["kb1", "kb2", "kb3"],
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+
+            assert tool.dataset_ids == ["kb1", "kb2", "kb3"]
+
+    def test_init_dataset_ids_as_list_with_numeric_ids(self, mock_observer: MessageObserver):
+        """Test dataset_ids list with numeric IDs are converted to strings"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids=[123, 456, 789],
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+
+            assert tool.dataset_ids == ["123", "456", "789"]
+            assert all(isinstance(id, str) for id in tool.dataset_ids)
+
+    @pytest.mark.parametrize("invalid_json,expected_error_contains", [
+        ("invalid_json", "dataset_ids must be a valid JSON string array or list"),
+        ("{key: value}", "dataset_ids must be a valid JSON string array or list"),
+        ("123", "dataset_ids must be a non-empty array of strings"),
+    ])
+    def test_init_invalid_json_format(self, invalid_json, expected_error_contains, mock_observer: MessageObserver):
+        """Test dataset_ids with invalid JSON format"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids=invalid_json,
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+        assert expected_error_contains in str(excinfo.value)
+
+    def test_init_dataset_ids_malformed_json(self, mock_observer: MessageObserver):
+        """Test dataset_ids with malformed JSON array"""
+        with pytest.raises(ValueError) as excinfo:
+            IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1", "kb2"',  # Missing closing bracket
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+        assert "dataset_ids must be a valid JSON string array or list" in str(excinfo.value)
+
+
+class TestBuildDownloadUrl:
+    """Test _build_download_url method"""
+
+    def test_build_download_url_success(self, idata_tool: IdataSearchTool):
+        """Test successful download URL building"""
+        url = idata_tool._build_download_url("doc1", "kb1")
+
+        expected_url = (
+            "https://api.idata.example.com/apiaccess/modelmate/north/machine/v1/documents/download?"
+            "userId=test_user_id&knowledgeBaseId=kb1&documentId=doc1"
+        )
+        assert url == expected_url
+
+    def test_build_download_url_empty_document_id(self, idata_tool: IdataSearchTool):
+        """Test download URL building with empty document_id"""
+        url = idata_tool._build_download_url("", "kb1")
+        assert url == ""
+
+    def test_build_download_url_empty_dataset_id_uses_first(self, idata_tool: IdataSearchTool):
+        """Test download URL building with empty dataset_id uses first from dataset_ids"""
+        url = idata_tool._build_download_url("doc1", "")
+
+        expected_url = (
+            "https://api.idata.example.com/apiaccess/modelmate/north/machine/v1/documents/download?"
+            "userId=test_user_id&knowledgeBaseId=kb1&documentId=doc1"
+        )
+        assert url == expected_url
+
+    def test_build_download_url_both_empty(self, idata_tool: IdataSearchTool):
+        """Test download URL building with both document_id and dataset_id empty"""
+        url = idata_tool._build_download_url("", "")
+        assert url == ""
+
+    def test_build_download_url_no_dataset_ids(self, mock_observer: MessageObserver):
+        """Test download URL building when dataset_ids is empty"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+            # Manually set dataset_ids to empty to test edge case
+            tool.dataset_ids = []
+
+            url = tool._build_download_url("doc1", "")
+            assert url == ""
+
+
+class TestSearchIdataKnowledgeBase:
+    """Test _search_idata_knowledge_base method"""
+
+    def test_search_idata_knowledge_base_success(self, idata_tool: IdataSearchTool):
+        """Test successful search"""
+        mock_response = MagicMock()
+        mock_response.json.return_value = _build_search_response()
+        mock_response.raise_for_status = MagicMock()
+        idata_tool._mock_http_client.post.return_value = mock_response
+
+        payload = {
+            "userId": "test_user_id",
+            "knowledgeBaseFilter": [{"knowledgeBaseId": "kb1", "metas": []}],
+            "question": "test query",
+            "rankTopN": 5,
+            "rerankModelId": "test_rerank_model_id",
+            "similarityThreshold": 0.5,
+            "keywordSimilarityWeight": 0.1,
+            "vectorSimilarityWeight": 0.3
+        }
+
+        result = idata_tool._search_idata_knowledge_base(payload)
+
+        assert result["code"] == "1"
+        assert "data" in result
+        assert "retrievalData" in result["data"]
+
+        idata_tool._mock_http_client.post.assert_called_once_with(
+            "https://api.idata.example.com/apiaccess/modelmate/north/machine/v1/retrievals",
+            headers={
+                "Content-Type": "application/json",
+                "Authorization": "Bearer test_api_key"
+            },
+            json=payload
+        )
+
+    def test_search_idata_knowledge_base_request_error(self, idata_tool: IdataSearchTool):
+        """Test search with RequestError"""
+        idata_tool._mock_http_client.post.side_effect = httpx.RequestError(
+            "Connection error", request=MagicMock()
+        )
+
+        payload = {"userId": "test_user_id", "question": "test query"}
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool._search_idata_knowledge_base(payload)
+
+        assert "iData API request failed" in str(excinfo.value)
+
+    def test_search_idata_knowledge_base_http_status_error(self, idata_tool: IdataSearchTool):
+        """Test search with HTTPStatusError"""
+        idata_tool._mock_http_client.post.side_effect = httpx.HTTPStatusError(
+            "HTTP error", request=MagicMock(), response=MagicMock()
+        )
+
+        payload = {"userId": "test_user_id", "question": "test query"}
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool._search_idata_knowledge_base(payload)
+
+        assert "iData API HTTP error" in str(excinfo.value)
+
+    def test_search_idata_knowledge_base_json_decode_error(self, idata_tool: IdataSearchTool):
+        """Test search with JSONDecodeError"""
+        mock_response = MagicMock()
+        mock_response.raise_for_status = MagicMock()
+        mock_response.json.side_effect = json.JSONDecodeError("Invalid JSON", "", 0)
+        idata_tool._mock_http_client.post.return_value = mock_response
+
+        payload = {"userId": "test_user_id", "question": "test query"}
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool._search_idata_knowledge_base(payload)
+
+        assert "Failed to parse iData API response" in str(excinfo.value)
+
+    def test_search_idata_knowledge_base_invalid_code(self, idata_tool: IdataSearchTool):
+        """Test search with invalid response code"""
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "0",
+            "msg": "Error message"
+        }
+        mock_response.raise_for_status = MagicMock()
+        idata_tool._mock_http_client.post.return_value = mock_response
+
+        payload = {"userId": "test_user_id", "question": "test query"}
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool._search_idata_knowledge_base(payload)
+
+        assert "iData API error: Error message" in str(excinfo.value)
+
+    def test_search_idata_knowledge_base_missing_data_key(self, idata_tool: IdataSearchTool):
+        """Test search with missing 'data' key in response"""
+        mock_response = MagicMock()
+        mock_response.json.return_value = {"code": "1", "msg": "success"}
+        mock_response.raise_for_status = MagicMock()
+        idata_tool._mock_http_client.post.return_value = mock_response
+
+        payload = {"userId": "test_user_id", "question": "test query"}
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool._search_idata_knowledge_base(payload)
+
+        assert "Unexpected iData API response format: missing 'data' key" in str(excinfo.value)
+
+    def test_search_idata_knowledge_base_missing_retrieval_data_key(self, idata_tool: IdataSearchTool):
+        """Test search with missing 'retrievalData' key in response"""
+        mock_response = MagicMock()
+        mock_response.json.return_value = {
+            "code": "1",
+            "data": {}
+        }
+        mock_response.raise_for_status = MagicMock()
+        idata_tool._mock_http_client.post.return_value = mock_response
+
+        payload = {"userId": "test_user_id", "question": "test query"}
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool._search_idata_knowledge_base(payload)
+
+        assert "Unexpected iData API response format: missing 'retrievalData' key" in str(excinfo.value)
+
+
+class TestForward:
+    """Test forward method"""
+
+    def _setup_success_flow(self, tool: IdataSearchTool, chunks=None):
+        """Helper to set up successful search flow"""
+        search_response = _build_search_response(chunks=chunks)
+        mock_response = MagicMock()
+        mock_response.json.return_value = search_response
+        mock_response.raise_for_status = MagicMock()
+        tool._mock_http_client.post.return_value = mock_response
+
+    def test_forward_success_with_observer_en(self, idata_tool: IdataSearchTool):
+        """Test successful forward with English observer"""
+        self._setup_success_flow(idata_tool)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        assert len(results) == 2
+        assert results[0]["title"] == "Test Document 1"
+        assert results[0]["text"] == "test content 1"
+        assert results[1]["title"] == "Test Document 2"
+        assert results[1]["text"] == "test content 2"
+
+        # Verify observer messages
+        idata_tool.observer.add_message.assert_any_call(
+            "", ProcessType.TOOL, idata_tool.running_prompt_en
+        )
+        idata_tool.observer.add_message.assert_any_call(
+            "", ProcessType.CARD, json.dumps([{"icon": "search", "text": "test query"}], ensure_ascii=False)
+        )
+        idata_tool.observer.add_message.assert_any_call(
+            "", ProcessType.SEARCH_CONTENT, ANY
+        )
+
+        assert idata_tool.record_ops == 3  # 1 + len(results)
+
+    def test_forward_success_with_observer_zh(self, idata_tool: IdataSearchTool):
+        """Test successful forward with Chinese observer"""
+        idata_tool.observer.lang = "zh"
+        self._setup_success_flow(idata_tool)
+
+        idata_tool.forward("测试查询")
+
+        idata_tool.observer.add_message.assert_any_call(
+            "", ProcessType.TOOL, idata_tool.running_prompt_zh
+        )
+
+    def test_forward_no_observer(self, mock_observer: MessageObserver):
+        """Test forward without observer"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=None,
+            )
+            tool._mock_http_client = mock_client
+
+            search_response = _build_search_response(chunks=[{
+                "documentId": "doc1",
+                "documentName": "doc1.txt",
+                "content": "content",
+                "datasetId": "kb1",
+                "createTime": 1609459200000,
+                "reRankScore": 0.9,
+                "vsScore": 0.8,
+                "esScore": 0.7,
+                "title": "Doc 1"
+            }])
+
+            mock_response = MagicMock()
+            mock_response.json.return_value = search_response
+            mock_response.raise_for_status = MagicMock()
+            tool._mock_http_client.post.return_value = mock_response
+
+            result_json = tool.forward("query")
+            results = json.loads(result_json)
+            assert len(results) == 1
+
+    def test_forward_no_retrieval_data(self, idata_tool: IdataSearchTool):
+        """Test forward with no retrieval data"""
+        search_response = {
+            "code": "1",
+            "data": {
+                "retrievalData": []
+            }
+        }
+        mock_response = MagicMock()
+        mock_response.json.return_value = search_response
+        mock_response.raise_for_status = MagicMock()
+        idata_tool._mock_http_client.post.return_value = mock_response
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool.forward("test query")
+
+        assert "No results found!" in str(excinfo.value)
+
+    def test_forward_no_chunks(self, idata_tool: IdataSearchTool):
+        """Test forward with no chunks in retrieval data"""
+        search_response = {
+            "code": "1",
+            "data": {
+                "retrievalData": [{"chunks": []}]
+            }
+        }
+        mock_response = MagicMock()
+        mock_response.json.return_value = search_response
+        mock_response.raise_for_status = MagicMock()
+        idata_tool._mock_http_client.post.return_value = mock_response
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool.forward("test query")
+
+        assert "No chunks found in search results!" in str(excinfo.value)
+
+    def test_forward_multiple_chunks(self, idata_tool: IdataSearchTool):
+        """Test forward with multiple chunks"""
+        chunks = [
+            {
+                "documentId": f"doc{i}",
+                "documentName": f"document{i}.txt",
+                "content": f"content {i}",
+                "datasetId": f"kb{i % 2 + 1}",
+                "createTime": 1609459200000 + i * 86400000,
+                "reRankScore": 0.9 - i * 0.1,
+                "vsScore": 0.8 - i * 0.1,
+                "esScore": 0.7 - i * 0.1,
+                "title": f"Document {i}"
+            }
+            for i in range(5)
+        ]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        assert len(results) == 5
+        assert idata_tool.record_ops == 6  # 1 + 5
+
+    def test_forward_chunk_without_title_uses_document_name(self, idata_tool: IdataSearchTool):
+        """Test forward when chunk has no title, uses documentName"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 1609459200000,
+            "reRankScore": 0.9,
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            # No title field
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        assert results[0]["title"] == "document1.txt"
+
+    def test_forward_chunk_with_empty_title_uses_document_name(self, idata_tool: IdataSearchTool):
+        """Test forward when chunk has empty title, uses documentName"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 1609459200000,
+            "reRankScore": 0.9,
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            "title": "",  # Empty title
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        assert results[0]["title"] == "document1.txt"
+
+    def test_forward_chunk_with_zero_create_time(self, idata_tool: IdataSearchTool):
+        """Test forward with zero create_time"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 0,  # Zero timestamp
+            "reRankScore": 0.9,
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            "title": "Doc 1"
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        # Verify result structure (to_model_dict only returns title, text, index)
+        assert results[0]["title"] == "Doc 1"
+        assert results[0]["text"] == "content"
+        assert "index" in results[0]
+
+        # Verify published_date is empty in the detailed search content sent to observer
+        call_args_list = idata_tool.observer.add_message.call_args_list
+        search_content_call = None
+        for call in call_args_list:
+            if len(call[0]) >= 3 and call[0][1] == ProcessType.SEARCH_CONTENT:
+                search_content_call = call
+                break
+
+        if search_content_call:
+            search_content_data = json.loads(search_content_call[0][2])
+            assert search_content_data[0]["published_date"] == ""
+
+    def test_forward_chunk_with_invalid_create_time(self, idata_tool: IdataSearchTool):
+        """Test forward with invalid create_time that causes exception"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": "invalid",  # Invalid timestamp
+            "reRankScore": 0.9,
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            "title": "Doc 1"
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        # Verify result structure (to_model_dict only returns title, text, index)
+        assert results[0]["title"] == "Doc 1"
+        assert results[0]["text"] == "content"
+
+        # Verify published_date is empty in the detailed search content sent to observer
+        call_args_list = idata_tool.observer.add_message.call_args_list
+        search_content_call = None
+        for call in call_args_list:
+            if len(call[0]) >= 3 and call[0][1] == ProcessType.SEARCH_CONTENT:
+                search_content_call = call
+                break
+
+        if search_content_call:
+            search_content_data = json.loads(search_content_call[0][2])
+            # Should handle exception gracefully and set empty published_date
+            assert search_content_data[0]["published_date"] == ""
+
+    def test_forward_chunk_with_missing_scores(self, idata_tool: IdataSearchTool):
+        """Test forward with missing score fields"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 1609459200000,
+            # Missing score fields
+            "title": "Doc 1"
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        # Verify result structure (to_model_dict only returns title, text, index)
+        assert results[0]["title"] == "Doc 1"
+        assert results[0]["text"] == "content"
+
+        # Verify scores in the detailed search content sent to observer
+        call_args_list = idata_tool.observer.add_message.call_args_list
+        search_content_call = None
+        for call in call_args_list:
+            if len(call[0]) >= 3 and call[0][1] == ProcessType.SEARCH_CONTENT:
+                search_content_call = call
+                break
+
+        if search_content_call:
+            search_content_data = json.loads(search_content_call[0][2])
+            assert search_content_data[0]["score"] is None
+            assert search_content_data[0]["score_details"]["reRankScore"] == 0
+            assert search_content_data[0]["score_details"]["vsScore"] == 0
+            assert search_content_data[0]["score_details"]["esScore"] == 0
+
+    def test_forward_search_api_error(self, idata_tool: IdataSearchTool):
+        """Test forward when search API raises error"""
+        idata_tool._mock_http_client.post.side_effect = httpx.RequestError(
+            "API error", request=MagicMock()
+        )
+
+        with pytest.raises(Exception) as excinfo:
+            idata_tool.forward("test query")
+
+        assert "Error searching iData knowledge base" in str(excinfo.value)
+        assert "iData API request failed" in str(excinfo.value)
+
+    def test_forward_payload_construction(self, idata_tool: IdataSearchTool):
+        """Test that forward constructs correct payload"""
+        self._setup_success_flow(idata_tool)
+
+        idata_tool.forward("test question")
+
+        # Verify the payload was constructed correctly
+        call_args = idata_tool._mock_http_client.post.call_args
+        payload = call_args[1]["json"]
+
+        assert payload["userId"] == "test_user_id"
+        assert payload["question"] == "test question"
+        assert payload["rankTopN"] == 5
+        assert payload["rerankModelId"] == "test_rerank_model_id"
+        assert payload["similarityThreshold"] == 0.5
+        assert payload["keywordSimilarityWeight"] == 0.1
+        assert payload["vectorSimilarityWeight"] == 0.3
+        assert len(payload["knowledgeBaseFilter"]) == 2
+        assert payload["knowledgeBaseFilter"][0]["knowledgeBaseId"] == "kb1"
+        assert payload["knowledgeBaseFilter"][1]["knowledgeBaseId"] == "kb2"
+
+    def test_forward_custom_parameters(self, mock_observer: MessageObserver):
+        """Test forward with custom parameters"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                top_k=20,
+                similarity_threshold=0.8,
+                keyword_similarity_weight=0.2,
+                vector_similarity_weight=0.4,
+                observer=mock_observer,
+            )
+            tool._mock_http_client = mock_client
+
+            search_response = _build_search_response()
+            mock_response = MagicMock()
+            mock_response.json.return_value = search_response
+            mock_response.raise_for_status = MagicMock()
+            tool._mock_http_client.post.return_value = mock_response
+
+            tool.forward("test question")
+
+            call_args = tool._mock_http_client.post.call_args
+            payload = call_args[1]["json"]
+
+            assert payload["rankTopN"] == 20
+            assert payload["similarityThreshold"] == 0.8
+            assert payload["keywordSimilarityWeight"] == 0.2
+            assert payload["vectorSimilarityWeight"] == 0.4
+
+    def test_forward_result_format(self, idata_tool: IdataSearchTool):
+        """Test that forward returns correctly formatted results"""
+        self._setup_success_flow(idata_tool)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        assert len(results) == 2
+
+        # Verify first result structure (to_model_dict only returns title, text, index)
+        result1 = results[0]
+        assert "title" in result1
+        assert "text" in result1
+        assert "index" in result1
+        assert result1["title"] == "Test Document 1"
+        assert result1["text"] == "test content 1"
+        assert result1["index"].startswith("h")  # Should start with tool_sign "h"
+
+        # Verify detailed fields in the search content sent to observer
+        call_args_list = idata_tool.observer.add_message.call_args_list
+        search_content_call = None
+        for call in call_args_list:
+            if len(call[0]) >= 3 and call[0][1] == ProcessType.SEARCH_CONTENT:
+                search_content_call = call
+                break
+
+        if search_content_call:
+            search_content_data = json.loads(search_content_call[0][2])
+            detail_result = search_content_data[0]
+            assert "source_type" in detail_result
+            assert "url" in detail_result
+            assert "filename" in detail_result
+            assert "published_date" in detail_result
+            assert "score" in detail_result
+            assert "score_details" in detail_result
+            assert "search_type" in detail_result
+            assert "tool_sign" in detail_result
+
+            assert detail_result["source_type"] == "idata"
+            assert detail_result["search_type"] == "idata_search"
+            assert detail_result["tool_sign"] == "h"  # IDATA_SEARCH value
+
+    def test_forward_chunk_with_zero_re_rank_score(self, idata_tool: IdataSearchTool):
+        """Test forward with zero re_rank_score (falsy value)"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 1609459200000,
+            "reRankScore": 0,  # Zero (falsy)
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            "title": "Doc 1"
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        # Verify result structure (to_model_dict only returns title, text, index)
+        assert results[0]["title"] == "Doc 1"
+        assert results[0]["text"] == "content"
+
+        # Verify zero re_rank_score results in None score in the detailed search content sent to observer
+        call_args_list = idata_tool.observer.add_message.call_args_list
+        search_content_call = None
+        for call in call_args_list:
+            if len(call[0]) >= 3 and call[0][1] == ProcessType.SEARCH_CONTENT:
+                search_content_call = call
+                break
+
+        if search_content_call:
+            search_content_data = json.loads(search_content_call[0][2])
+            # Zero re_rank_score should result in None score
+            assert search_content_data[0]["score"] is None
+
+    def test_forward_chunk_with_none_title(self, idata_tool: IdataSearchTool):
+        """Test forward when chunk has None title"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 1609459200000,
+            "reRankScore": 0.9,
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            "title": None,  # None title
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        # None title should fallback to document_name
+        assert results[0]["title"] == "document1.txt"
+
+    def test_forward_chunk_with_falsy_title_uses_document_name(self, idata_tool: IdataSearchTool):
+        """Test forward when title is falsy (empty string), uses document_name"""
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 1609459200000,
+            "reRankScore": 0.9,
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            "title": "",  # Empty string (falsy)
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        # Empty title should fallback to document_name due to "title or document_name" logic
+        assert results[0]["title"] == "document1.txt"
+
+    def test_forward_chunk_with_missing_chunk_fields(self, idata_tool: IdataSearchTool):
+        """Test forward with minimal chunk data (missing optional fields)"""
+        chunks = [{
+            "documentId": "doc1",
+            "content": "content",
+            # Missing most fields
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        assert len(results) == 1
+        assert results[0]["text"] == "content"
+        assert results[0]["title"] == ""  # Empty document_name
+
+        # Verify detailed fields in the search content sent to observer
+        call_args_list = idata_tool.observer.add_message.call_args_list
+        search_content_call = None
+        for call in call_args_list:
+            if len(call[0]) >= 3 and call[0][1] == ProcessType.SEARCH_CONTENT:
+                search_content_call = call
+                break
+
+        if search_content_call:
+            search_content_data = json.loads(search_content_call[0][2])
+            detail_result = search_content_data[0]
+            assert detail_result["filename"] == ""
+            assert detail_result["score"] is None  # Missing reRankScore
+
+    def test_forward_handles_exception_in_datetime_conversion(self, idata_tool: IdataSearchTool):
+        """Test forward handles exception during datetime conversion gracefully"""
+        # Use a createTime value that will cause an exception when converting
+        # Using a very large timestamp that exceeds the valid range for datetime.fromtimestamp
+        # This will cause an OSError or ValueError on most systems
+        chunks = [{
+            "documentId": "doc1",
+            "documentName": "document1.txt",
+            "content": "content",
+            "datasetId": "kb1",
+            "createTime": 999999999999999999,  # Extremely large timestamp that will cause conversion error
+            "reRankScore": 0.9,
+            "vsScore": 0.8,
+            "esScore": 0.7,
+            "title": "Doc 1"
+        }]
+        self._setup_success_flow(idata_tool, chunks=chunks)
+
+        result_json = idata_tool.forward("test query")
+        results = json.loads(result_json)
+
+        # Verify result structure (to_model_dict only returns title, text, index)
+        assert results[0]["title"] == "Doc 1"
+        assert results[0]["text"] == "content"
+
+        # Verify published_date is empty in the detailed search content sent to observer
+        # The exception during datetime conversion should be caught and result in empty published_date
+        call_args_list = idata_tool.observer.add_message.call_args_list
+        search_content_call = None
+        for call in call_args_list:
+            if len(call[0]) >= 3 and call[0][1] == ProcessType.SEARCH_CONTENT:
+                search_content_call = call
+                break
+
+        if search_content_call:
+            search_content_data = json.loads(search_content_call[0][2])
+            # Should handle exception and set empty published_date
+            assert search_content_data[0]["published_date"] == ""
+
+    def test_forward_with_single_dataset_id(self, mock_observer: MessageObserver):
+        """Test forward with single dataset_id"""
+        with patch("sdk.nexent.core.tools.idata_search_tool.http_client_manager") as mock_manager:
+            mock_client = MagicMock()
+            mock_manager.get_sync_client.return_value = mock_client
+
+            tool = IdataSearchTool(
+                server_url="https://api.idata.example.com",
+                api_key="test_api_key",
+                user_id="test_user_id",
+                knowledge_space_id="test_knowledge_space_id",
+                dataset_ids='["kb1"]',
+                rerank_model_id="test_rerank_model_id",
+                observer=mock_observer,
+            )
+            tool._mock_http_client = mock_client
+
+            search_response = _build_search_response()
+            mock_response = MagicMock()
+            mock_response.json.return_value = search_response
+            mock_response.raise_for_status = MagicMock()
+            tool._mock_http_client.post.return_value = mock_response
+
+            tool.forward("test question")
+
+            # Verify payload has single knowledge base filter
+            call_args = tool._mock_http_client.post.call_args
+            payload = call_args[1]["json"]
+            assert len(payload["knowledgeBaseFilter"]) == 1
+            assert payload["knowledgeBaseFilter"][0]["knowledgeBaseId"] == "kb1"
diff --git a/test/sdk/core/tools/test_tavily_search_tool.py b/test/sdk/core/tools/test_tavily_search_tool.py
new file mode 100644
index 000000000..6d157b10e
--- /dev/null
+++ b/test/sdk/core/tools/test_tavily_search_tool.py
@@ -0,0 +1,250 @@
+import pytest
+from unittest.mock import MagicMock, patch
+import json
+import os
+from datetime import datetime
+
+# Create all necessary mocks
+mock_tavily_client = MagicMock()
+mock_tavily = MagicMock()
+mock_tavily.TavilyClient = mock_tavily_client
+
+mock_aiohttp = MagicMock()
+mock_aiohttp.ClientSession = MagicMock()
+
+# Use module-level mocks
+module_mocks = {
+    'tavily': mock_tavily,
+    'aiohttp': mock_aiohttp
+}
+
+# Apply mocks
+with patch.dict('sys.modules', module_mocks):
+    # Import all required modules
+    from sdk.nexent.core.utils.observer import MessageObserver, ProcessType
+    # Import target module
+    from sdk.nexent.core.tools.tavily_search_tool import TavilySearchTool
+
+
+@pytest.fixture
+def mock_observer():
+    observer = MagicMock(spec=MessageObserver)
+    observer.lang = "en"
+    return observer
+
+
+@pytest.fixture
+def tavily_search_tool(mock_observer):
+    # Reset all mock objects
+    mock_tavily_client.reset_mock()
+
+    tavily_api_key = "test_api_key"
+    with patch('tavily.TavilyClient', return_value=mock_tavily_client):
+        tool = TavilySearchTool(
+            tavily_api_key=tavily_api_key,
+            observer=mock_observer,
+            max_results=3,
+            image_filter=True
+        )
+
+        # Directly set a mock object for tool.tavily
+        tool.tavily = mock_tavily_client
+
+    # Set environment variables
+    os.environ["DATA_PROCESS_SERVICE"] = "http://test-service"
+    tool.data_process_service = "http://test-service"
+
+    return tool
+
+
+def create_mock_tavily_search_result(count=3):
+    """Helper method to create mock Tavily search results"""
+    results = []
+    for i in range(count):
+        result = {
+            "title": f"Test Title {i}",
+            "url": f"https://example.com/{i}",
+            "content": f"This is test content {i}",
+            "published_date": datetime.now().isoformat(),
+            "score": 0.9 - i * 0.1
+        }
+        results.append(result)
+
+    mock_response = {
+        "results": results,
+        "images": [f"https://example.com/image{i}.jpg" for i in range(count)]
+    }
+    return mock_response
+
+
+def test_forward_with_results(tavily_search_tool, mock_observer):
+    """Test forward method with search results"""
+    # Configure mock
+    mock_results = create_mock_tavily_search_result(3)
+    mock_tavily_client.search.return_value = mock_results
+
+    # Mock _filter_images method to prevent creating unawaited coroutines
+    with patch.object(tavily_search_tool, '_filter_images'):
+        # Call method
+        result = tavily_search_tool.forward("test query")
+
+    # Print actual JSON structure to help with understanding
+    search_results = json.loads(result)
+    print(f"\nActual search result structure: {json.dumps(search_results[0], indent=2)}")
+
+    # Assertions
+    mock_tavily_client.search.assert_called_once_with(
+        query="test query",
+        max_results=3,
+        include_images=True
+    )
+
+    # Check observer messages
+    mock_observer.add_message.assert_any_call("", ProcessType.TOOL, "Searching the web...")
+    mock_observer.add_message.assert_any_call("", ProcessType.CARD,
+                                              json.dumps([{"icon": "search", "text": "test query"}],
+                                                         ensure_ascii=False))
+
+    # Verify search results were processed
+    assert len(search_results) == 3
+
+    # Check that the returned JSON structure contains expected fields
+    first_result = search_results[0]
+    assert "title" in first_result
+    assert first_result["title"] == "Test Title 0"
+
+    # Check all keys to understand the actual structure
+    keys = first_result.keys()
+    print(f"\nAvailable keys in result: {keys}")
+
+    # Check if text field exists
+    assert "text" in first_result
+    assert first_result["text"].startswith("This is test content")
+
+    # If there's a cite_index field, verify it as well
+    if "cite_index" in first_result:
+        assert isinstance(first_result["cite_index"], int)
+
+
+def test_forward_no_results(tavily_search_tool):
+    """Test forward method with no search results"""
+    # Configure empty results mock
+    mock_response = {
+        "results": [],
+        "images": []
+    }
+    mock_tavily_client.search.return_value = mock_response
+
+    # Call method and check for exception
+    with pytest.raises(Exception) as excinfo:
+        tavily_search_tool.forward("test query")
+
+    assert 'No results found' in str(excinfo.value)
+
+
+def test_forward_without_observer(tavily_search_tool):
+    """Test forward method without an observer"""
+    # Mock _filter_images method to prevent creating unawaited coroutines
+    with patch.object(tavily_search_tool, '_filter_images'), \
+        patch.object(TavilySearchTool, 'forward', wraps=tavily_search_tool.forward) as wrapped_forward:
+        # Directly set observer to None
+        # Note: This is not recommended in production code, only for testing
+        wrapped_forward.__defaults__ = (None,)
+
+        # Configure mock and call method
+        mock_results = create_mock_tavily_search_result(2)
+        mock_tavily_client.search.return_value = mock_results
+
+        # Call method with parameters directly
+        result = wrapped_forward("test query")
+
+    # Verify results were processed
+    search_results = json.loads(result)
+    assert len(search_results) == 2
+
+    # Verify Tavily search was called
+    mock_tavily_client.search.assert_called_with(
+        query="test query",
+        max_results=3,
+        include_images=True
+    )
+
+
+def test_chinese_language_observer(tavily_search_tool, mock_observer):
+    """Test Chinese language observer"""
+    # Set observer language to Chinese
+    mock_observer.lang = "zh"
+
+    # Mock _filter_images method to prevent creating unawaited coroutines
+    with patch.object(tavily_search_tool, '_filter_images'):
+        # Configure mock
+        mock_results = create_mock_tavily_search_result(1)
+        mock_tavily_client.search.return_value = mock_results
+
+        # Call method
+        tavily_search_tool.forward("测试查询")
+
+    # Check Chinese running prompt
+    mock_observer.add_message.assert_any_call("", ProcessType.TOOL, "网络搜索中...")
+
+
+def test_filter_images_success(tavily_search_tool, mock_observer):
+    """Test successful image filtering"""
+    # Set up test data
+    images_list = ["https://example.com/image1.jpg", "https://example.com/image2.jpg"]
+
+    # Mock _filter_images method
+    with patch.object(tavily_search_tool, '_filter_images') as mock_filter:
+        # Configure mock
+        mock_results = create_mock_tavily_search_result(1)
+        mock_tavily_client.search.return_value = mock_results
+
+        # Call forward method, which indirectly calls _filter_images
+        tavily_search_tool.forward("test query")
+
+        # Verify _filter_images was called with correct parameters
+        mock_filter.assert_called_once()
+        # Extract the first argument of the call
+        called_images = mock_filter.call_args[0][0]
+        assert isinstance(called_images, list)
+
+
+def test_filter_images_api_error(tavily_search_tool, mock_observer):
+    """Test image filtering API error handling"""
+    # Set up test data
+    images_list = ["https://example.com/image1.jpg"]
+
+    # Send message directly to observer, simulating _filter_images behavior
+    tavily_search_tool._filter_images = lambda img_list, query: mock_observer.add_message(
+        "", ProcessType.PICTURE_WEB, json.dumps({"images_url": img_list}, ensure_ascii=False)
+    )
+
+    # Configure mock
+    mock_results = create_mock_tavily_search_result(1)
+    mock_tavily_client.search.return_value = mock_results
+
+    # Call method
+    tavily_search_tool.forward("test query")
+
+    # Verify observer was called with unfiltered images
+    mock_observer.add_message.assert_any_call("", ProcessType.PICTURE_WEB,
+                                              json.dumps({"images_url": ["https://example.com/image0.jpg"]},
+                                                         ensure_ascii=False))
+
+
+def test_image_filter_disabled(tavily_search_tool, mock_observer):
+    """Test behavior when image filtering is disabled"""
+    # Disable image filtering
+    tavily_search_tool.image_filter = False
+
+    # Configure mock
+    mock_results = create_mock_tavily_search_result(1)
+    mock_tavily_client.search.return_value = mock_results
+
+    # Call method
+    tavily_search_tool.forward("test query")
+
+    # Verify images were sent to observer without filtering
+    expected_images = ["https://example.com/image0.jpg"]
+    mock_observer.add_message.assert_any_call("", ProcessType.PICTURE_WEB,
+                                              json.dumps({"images_url": expected_images}, ensure_ascii=False))
diff --git a/test/sdk/storage/test_minio.py b/test/sdk/storage/test_minio.py
index e9ad2972d..75ea1a3dd 100644
--- a/test/sdk/storage/test_minio.py
+++ b/test/sdk/storage/test_minio.py
@@ -883,3 +883,92 @@ def test_exists_without_bucket(self, mock_boto3):
 
         assert exists is False
 
+
+class TestMinIOStorageClientCopyFile:
+    """Test cases for copy_file method"""
+
+    @patch('nexent.storage.minio.boto3')
+    def test_copy_file_success(self, mock_boto3):
+        """Test successful file copy within the same bucket"""
+        mock_client = MagicMock()
+        mock_boto3.client.return_value = mock_client
+        mock_client.head_bucket.return_value = None
+
+        client = MinIOStorageClient(
+            endpoint="http://localhost:9000",
+            access_key="minioadmin",
+            secret_key="minioadmin",
+            default_bucket="test-bucket"
+        )
+
+        success, result = client.copy_file('src.txt', 'dst.txt', 'test-bucket')
+
+        assert success is True
+        assert result == 'dst.txt'
+        mock_client.copy_object.assert_called_once_with(
+            Bucket='test-bucket',
+            Key='dst.txt',
+            CopySource={'Bucket': 'test-bucket', 'Key': 'src.txt'}
+        )
+
+    @patch('nexent.storage.minio.boto3')
+    def test_copy_file_uses_default_bucket(self, mock_boto3):
+        """Test copy_file falls back to default bucket when bucket is not specified"""
+        mock_client = MagicMock()
+        mock_boto3.client.return_value = mock_client
+        mock_client.head_bucket.return_value = None
+
+        client = MinIOStorageClient(
+            endpoint="http://localhost:9000",
+            access_key="minioadmin",
+            secret_key="minioadmin",
+            default_bucket="test-bucket"
+        )
+
+        success, result = client.copy_file('src.txt', 'dst.txt')
+
+        assert success is True
+        assert result == 'dst.txt'
+        mock_client.copy_object.assert_called_once_with(
+            Bucket='test-bucket',
+            Key='dst.txt',
+            CopySource={'Bucket': 'test-bucket', 'Key': 'src.txt'}
+        )
+
+    @patch('nexent.storage.minio.boto3')
+    def test_copy_file_without_bucket(self, mock_boto3):
+        """Test copy_file fails when no bucket is configured"""
+        mock_client = MagicMock()
+        mock_boto3.client.return_value = mock_client
+
+        client = MinIOStorageClient(
+            endpoint="http://localhost:9000",
+            access_key="minioadmin",
+            secret_key="minioadmin"
+        )
+
+        success, result = client.copy_file('src.txt', 'dst.txt')
+
+        assert success is False
+        assert result == "Bucket name is required"
+        mock_client.copy_object.assert_not_called()
+
+    @patch('nexent.storage.minio.boto3')
+    def test_copy_file_exception(self, mock_boto3):
+        """Test copy_file returns failure on unexpected exception"""
+        mock_client = MagicMock()
+        mock_boto3.client.return_value = mock_client
+        mock_client.head_bucket.return_value = None
+        mock_client.copy_object.side_effect = Exception("copy failed")
+
+        client = MinIOStorageClient(
+            endpoint="http://localhost:9000",
+            access_key="minioadmin",
+            secret_key="minioadmin",
+            default_bucket="test-bucket"
+        )
+
+        success, result = client.copy_file('src.txt', 'dst.txt')
+
+        assert success is False
+        assert "copy failed" in result