diff --git a/apps/docs/app/api/og/route.tsx b/apps/docs/app/api/og/route.tsx
index ec58754d9b3..ee99eec89e9 100644
--- a/apps/docs/app/api/og/route.tsx
+++ b/apps/docs/app/api/og/route.tsx
@@ -5,16 +5,19 @@ import type { NextRequest } from 'next/server'
 export const runtime = 'edge'
 
 const TITLE_FONT_SIZE = {
-  large: 105,
-  medium: 91,
-  small: 81,
+  large: 110,
+  medium: 96,
+  small: 85,
 } as const
 /** Average glyph width as a fraction of font size, for this weight/family — used to pack words into lines. */
-const AVG_CHAR_WIDTH_EM = 0.46
+const LATIN_CHAR_WIDTH_EM = 0.42
+/** CJK glyphs (docs ships `ja`/`zh` locales) render near-square, roughly 2.4x a Latin glyph at this weight. */
+const CJK_CHAR_WIDTH_EM = 1
+const CJK_RANGE = /[\u3000-\u30ff\u3400-\u4dbf\u4e00-\u9fff\uf900-\ufaff\uff00-\uffef]/
 const TITLE_BOX_WIDTH = 1020
 const FONT_CACHE_REVALIDATE_SECONDS = 60 * 60 * 24 * 30
-/** Measured off the reference cover template (`apps/sim/public/library/best-zapier-alternatives/cover.jpg`). */
-const INK_COLOR = '#525252'
+/** Exact hex from a vector trace of the reference cover template, not an estimate off compressed JPEG pixels. */
+const INK_COLOR = '#515151'
 const OG_CONTAINER_STYLE = {
   height: '100%',
   width: '100%',
@@ -22,8 +25,8 @@ const OG_CONTAINER_STYLE = {
   flexDirection: 'column',
   justifyContent: 'space-between',
   padding: '26px',
-  background: '#c3c3c3',
-  fontFamily: 'Season',
+  background: '#c1c1c1',
+  fontFamily: 'Soehne',
 } satisfies CSSProperties
 const OG_HEADER_STYLE = {
   display: 'flex',
@@ -34,10 +37,12 @@ const OG_HEADER_STYLE = {
 const OG_TITLE_STYLE = {
   display: 'flex',
   flexDirection: 'column',
-  fontWeight: 600,
+  fontWeight: 500,
   color: INK_COLOR,
-  lineHeight: 1.15,
+  lineHeight: 1.1,
   width: `${TITLE_BOX_WIDTH}px`,
+  /** Compensates for Satori adding extra invisible leading below the last line instead of splitting it evenly. */
+  transform: 'translateY(14px)',
 } satisfies CSSProperties
 
 function getTitleFontSize(title: string): number {
@@ -53,6 +58,41 @@ function getTitleStyle(title: string): CSSProperties {
   }
 }
 
+/** Sums per-character em-widths rather than counting characters, so wide CJK glyphs (docs ships `ja`/`zh`) don't under-wrap. */
+function estimateWidthEm(text: string): number {
+  let width = 0
+  for (const char of text) {
+    width += CJK_RANGE.test(char) ? CJK_CHAR_WIDTH_EM : LATIN_CHAR_WIDTH_EM
+  }
+  return width
+}
+
+/**
+ * Splits a single word wider than `maxWidthEm` into character-level chunks
+ * that each fit. CJK titles (docs ships `ja`/`zh` locales) are often
+ * space-free, so a whole run can arrive as one "word" from `wrapTitleLines`'
+ * space-based split. Breaking mid-word is correct for CJK, where each glyph
+ * is independently readable; Latin words never reach this path since they
+ * stay under `maxWidthEm` in practice.
+ */
+function splitOversizedWord(word: string, maxWidthEm: number): string[] {
+  const chunks: string[] = []
+  let chunk = ''
+
+  for (const char of word) {
+    const candidate = chunk + char
+    if (estimateWidthEm(candidate) > maxWidthEm && chunk) {
+      chunks.push(chunk)
+      chunk = char
+    } else {
+      chunk = candidate
+    }
+  }
+  if (chunk) chunks.push(chunk)
+
+  return chunks
+}
+
 /**
  * Greedily packs words into lines that fit `TITLE_BOX_WIDTH` at `fontSize`,
  * then joins each line with U+00A0 instead of a plain space. Satori
@@ -63,14 +103,25 @@ function getTitleStyle(title: string): CSSProperties {
  * (which is also disabled here — lines are pre-split, not auto-wrapped).
  */
 function wrapTitleLines(title: string, fontSize: number): string[] {
-  const maxCharsPerLine = Math.floor(TITLE_BOX_WIDTH / (fontSize * AVG_CHAR_WIDTH_EM))
+  const maxWidthEm = TITLE_BOX_WIDTH / fontSize
   const words = title.split(' ')
   const lines: string[] = []
   let current = ''
 
   for (const word of words) {
+    if (estimateWidthEm(word) > maxWidthEm) {
+      if (current) {
+        lines.push(current)
+        current = ''
+      }
+      const chunks = splitOversizedWord(word, maxWidthEm)
+      lines.push(...chunks.slice(0, -1))
+      current = chunks[chunks.length - 1] ?? ''
+      continue
+    }
+
     const candidate = current ? `${current} ${word}` : word
-    if (candidate.length > maxCharsPerLine && current) {
+    if (estimateWidthEm(candidate) > maxWidthEm && current) {
       lines.push(current)
       current = word
     } else {
@@ -83,21 +134,16 @@ function wrapTitleLines(title: string, fontSize: number): string[] {
 }
 
 /**
- * Loads a static (600/semibold) TTF instance of the site's own Season Sans
- * font — the platform's real brand/body font, also used by the library/blog
- * cover template this OG image matches. Instantiated from the variable font
- * at `apps/docs/app/fonts/SeasonSansUprightsVF.woff2` (`fonttools
- * varLib.instancer wght=600`, then flavor-stripped to plain TTF) rather than
- * loading the variable WOFF2 directly: Satori (`next/og`'s renderer) can't
- * parse variable fonts without excessive memory use, and can't parse WOFF2
- * at all ("Unsupported OpenType signature wOF2") — it needs an uncompressed
- * TTF/OTF. Fetched over HTTP since the edge runtime has no filesystem access
- * — served from `/static/fonts/` (not `/fonts/`) so it isn't intercepted by
- * the site's i18n proxy (`proxy.ts`), whose matcher excludes `static` but
- * not `fonts`.
+ * Loads Söhne Kräftig (weight 500), the typeface used on the reference cover
+ * template this OG image matches. Converted to a plain TTF from the
+ * last-shipped `soehne-kraftig.woff2` since Satori (`next/og`'s renderer)
+ * can't parse WOFF2 or variable fonts. Fetched over HTTP since the edge
+ * runtime has no filesystem access — served from `/static/fonts/` (not
+ * `/fonts/`) so it isn't intercepted by the site's i18n proxy (`proxy.ts`),
+ * whose matcher excludes `static` but not `fonts`.
  */
-async function loadSeasonFont(baseUrl: string): Promise<ArrayBuffer> {
-  const response = await fetch(new URL('/static/fonts/SeasonSans-600-static.ttf', baseUrl), {
+async function loadTitleFont(baseUrl: string): Promise<ArrayBuffer> {
+  const response = await fetch(new URL('/static/fonts/Soehne-Kraftig.ttf', baseUrl), {
     next: { revalidate: FONT_CACHE_REVALIDATE_SECONDS },
   })
 
@@ -128,7 +174,7 @@ function SimWordmark() {
   )
 }
 
-/** Diagonal "open" arrow, top-right — matches the library/blog cover template. */
+/** Diagonal "open" arrow, top-right — square caps and a miter join to match the reference's sharp corners. */
 function CornerArrow() {
   return (
     <svg width='58' height='58' viewBox='0 0 24 24' fill='none'>
@@ -136,8 +182,8 @@ function CornerArrow() {
         d='M2 22 22 2M22 2H12M22 2V12'
         stroke={INK_COLOR}
         strokeWidth={3.6}
-        strokeLinecap='round'
-        strokeLinejoin='round'
+        strokeLinecap='square'
+        strokeLinejoin='miter'
       />
     </svg>
   )
@@ -153,7 +199,7 @@ export async function GET(request: NextRequest) {
   const { searchParams } = new URL(request.url)
   const title = searchParams.get('title') || 'Documentation'
 
-  const fontData = await loadSeasonFont(request.url)
+  const fontData = await loadTitleFont(request.url)
   const fontSize = getTitleFontSize(title)
   const titleLines = wrapTitleLines(title, fontSize)
 
@@ -175,10 +221,10 @@ export async function GET(request: NextRequest) {
       height: 675,
       fonts: [
         {
-          name: 'Season',
+          name: 'Soehne',
           data: fontData,
           style: 'normal',
-          weight: 600,
+          weight: 500,
         },
       ],
     }
diff --git a/apps/docs/app/llms.txt/route.ts b/apps/docs/app/llms.txt/route.ts
index f172dd07156..ca426a7e966 100644
--- a/apps/docs/app/llms.txt/route.ts
+++ b/apps/docs/app/llms.txt/route.ts
@@ -44,7 +44,7 @@ Sim is the open-source AI workspace where teams build, deploy, and manage AI age
 
 ## Documentation Overview
 
-This file provides an overview of our documentation. For full content of all pages, see ${baseUrl}/llms-full.txt
+This file provides an overview of our documentation. For full content of all pages, see [llms-full.txt](${baseUrl}/llms-full.txt).
 
 ## Main Sections
 
@@ -54,16 +54,16 @@ ${Object.entries(sections)
       .split('-')
       .map((word) => word.charAt(0).toUpperCase() + word.slice(1))
       .join(' ')
-    return `### ${sectionTitle}\n\n${items.map((item) => `- ${item.title}: ${item.url}${item.description ? `\n  ${item.description}` : ''}`).join('\n')}`
+    return `### ${sectionTitle}\n\n${items.map((item) => `- [${item.title}](${item.url})${item.description ? `\n  ${item.description}` : ''}`).join('\n')}`
   })
   .join('\n\n')}
 
 ## Additional Resources
 
-- Full documentation content: ${baseUrl}/llms-full.txt
+- [Full documentation content](${baseUrl}/llms-full.txt)
 - Individual page content: ${baseUrl}/llms.mdx/[page-path]
-- API documentation: ${baseUrl}/api-reference/
-- Tool integrations: ${baseUrl}/tools/
+- [API documentation](${baseUrl}/api-reference/)
+- [Tool integrations](${baseUrl}/tools/)
 
 ## Statistics
 
diff --git a/apps/docs/public/llms.txt b/apps/docs/public/llms.txt
deleted file mode 100644
index aad99e364ef..00000000000
--- a/apps/docs/public/llms.txt
+++ /dev/null
@@ -1,51 +0,0 @@
-# Sim Documentation
-
-Sim is the open-source AI workspace where teams build, deploy, and manage AI agents. Create agents visually with the workflow builder, conversationally through Mothership, or programmatically with the API — connected to 1,000+ integrations and every major LLM.
-
-## What is Sim?
-
-Sim provides a complete AI workspace including:
-- Mothership — natural language agent creation and workspace management
-- Visual workflow builder with drag-and-drop interface
-- 1,000+ built-in integrations (OpenAI, Anthropic, Slack, Gmail, GitHub, etc.)
-- Knowledge bases for retrieval-augmented generation
-- Built-in tables for structured data
-- Real-time team collaboration
-- Multiple deployment options (cloud-hosted or self-hosted)
-- Custom integrations via MCP protocol
-
-## Main Documentation Sections
-
-Here are the key areas covered in our documentation:
-
-/introduction - Getting started with Sim AI workspace
-/getting-started - Quick start guide for building your first agent
-/blocks - Understanding blocks (AI agents, APIs, functions)
-/tools - 1,000+ integrations and tools
-/webhooks - Webhook triggers and handling
-/mcp - Custom integrations via MCP protocol
-/deployment - Cloud-hosted vs self-hosted deployment
-/permissions - Team collaboration and workspace management
-/collaboration - Real-time editing and team features
-/workflows - Building agent logic with the visual builder
-
-## Technical Information
-
-- Framework: Fumadocs (Next.js-based documentation platform)
-- Content: MDX files with interactive examples
-- Languages: English (primary), Spanish, French, German, Japanese, Chinese
-- Search: AI-powered search and assistance available
-
-## Complete Documentation
-
-For the full documentation with all pages, examples, and interactive features, visit our documentation site. We also provide machine-readable versions at /llms.txt (full content) for AI systems.
-
-## Additional Resources
-
-- GitHub repository with agent examples
-- Discord community for support and discussions
-- 1,000+ built-in integrations with detailed guides
-- MCP protocol documentation for custom integrations
-- Self-hosting guides and Docker deployment
-
-For the complete documentation visit https://docs.sim.ai
diff --git a/apps/docs/public/static/fonts/SeasonSans-600-static.ttf b/apps/docs/public/static/fonts/SeasonSans-600-static.ttf
deleted file mode 100644
index 56dcc2b803b..00000000000
Binary files a/apps/docs/public/static/fonts/SeasonSans-600-static.ttf and /dev/null differ
diff --git a/apps/docs/public/static/fonts/Soehne-Kraftig.ttf b/apps/docs/public/static/fonts/Soehne-Kraftig.ttf
new file mode 100644
index 00000000000..8a92c26f779
Binary files /dev/null and b/apps/docs/public/static/fonts/Soehne-Kraftig.ttf differ
diff --git a/apps/sim/app/(landing)/components/content-index-page/content-index-page.tsx b/apps/sim/app/(landing)/components/content-index-page/content-index-page.tsx
index 3e304e9b5be..3ccc43d148f 100644
--- a/apps/sim/app/(landing)/components/content-index-page/content-index-page.tsx
+++ b/apps/sim/app/(landing)/components/content-index-page/content-index-page.tsx
@@ -96,6 +96,7 @@ export function ContentIndexPage({
                           sizes='(max-width: 768px) 100vw, (max-width: 1024px) 50vw, 33vw'
                           className='object-cover'
                           priority={index < 3}
+                          fetchPriority={index === 0 ? 'high' : undefined}
                           unoptimized
                         />
                       </div>
diff --git a/apps/sim/app/(landing)/components/content-post-page/content-post-page.tsx b/apps/sim/app/(landing)/components/content-post-page/content-post-page.tsx
index 358ec8a1416..2e8aa3c84b5 100644
--- a/apps/sim/app/(landing)/components/content-post-page/content-post-page.tsx
+++ b/apps/sim/app/(landing)/components/content-post-page/content-post-page.tsx
@@ -52,6 +52,7 @@ export function ContentPostPage({
                 className='h-auto w-full'
                 sizes='(max-width: 768px) 100vw, 450px'
                 priority
+                fetchPriority='high'
                 itemProp='image'
                 unoptimized
               />
diff --git a/apps/sim/app/(landing)/components/cta/cta.tsx b/apps/sim/app/(landing)/components/cta/cta.tsx
index 61fe0cb64e4..b82a6bcf7ef 100644
--- a/apps/sim/app/(landing)/components/cta/cta.tsx
+++ b/apps/sim/app/(landing)/components/cta/cta.tsx
@@ -1,4 +1,5 @@
 import { ChipLink } from '@sim/emcn'
+import { DEMO_HREF, SIGNUP_HREF } from '@/app/(landing)/constants'
 
 /**
  * Landing pre-footer CTA - the page's final conversion band. A tall, centered
@@ -28,10 +29,10 @@ export function Cta() {
         Build your first agent today.
       </h2>
       <div className='flex items-center gap-1'>
-        <ChipLink variant='primary' href='/signup'>
+        <ChipLink variant='primary' href={SIGNUP_HREF}>
           Get started
         </ChipLink>
-        <ChipLink href='/demo' className='border border-[var(--border-1)]'>
+        <ChipLink href={DEMO_HREF} className='border border-[var(--border-1)]'>
           Contact sales
         </ChipLink>
       </div>
diff --git a/apps/sim/app/(landing)/components/features/components/integrations-callout/integrations-callout.tsx b/apps/sim/app/(landing)/components/features/components/integrations-callout/integrations-callout.tsx
index 7974064feb3..4e7659ee107 100644
--- a/apps/sim/app/(landing)/components/features/components/integrations-callout/integrations-callout.tsx
+++ b/apps/sim/app/(landing)/components/features/components/integrations-callout/integrations-callout.tsx
@@ -17,6 +17,18 @@ import { CalloutFrame } from '@/app/(landing)/components/features/components/cal
  * the right AND bottom edges bleed past the media stage's clip - a zoomed-in
  * peek at part of the product rather than a complete miniature, scaling
  * proportionally with the aspect-locked stage. Decorative.
+ *
+ * `sizes` is derived directly from the section's grid math rather than
+ * approximated, then rounded up to the worst-case (peak render/viewport
+ * ratio) in each tier so the browser never under-fetches:
+ * `callout = 1.25 * (viewport - 2*gutter - 32px card padding - [40px gap +
+ * 386px fixed copy column, desktop only])`, gutter = `px-20`/`max-lg:px-8`/
+ * `max-sm:px-5` from `Features`'s grid, matching `FeatureCard`'s
+ * `max-lg:grid-cols-1` stack. Peak ratios (verified against a static
+ * reproduction of this exact layout rendered at each Tailwind breakpoint):
+ * ~113.3% at the `max-width: 1023px` stacked tier's own upper edge, ~108.6%
+ * at `1460px` (the container's cap, where render width stops growing with
+ * viewport - hence the final tier is a flat px value, not a vw fraction).
  */
 export function IntegrationsCallout() {
   return (
@@ -29,7 +41,7 @@ export function IntegrationsCallout() {
           src='/landing/feature-integrate-ui.png'
           alt=''
           fill
-          sizes='1050px'
+          sizes='(max-width: 1023px) 114vw, (max-width: 1460px) 109vw, 1053px'
           className='object-cover'
         />
       </CalloutFrame>
diff --git a/apps/sim/app/(landing)/components/hero-cta/hero-cta.tsx b/apps/sim/app/(landing)/components/hero-cta/hero-cta.tsx
index 93a4dee3d6e..ff392fd0b2a 100644
--- a/apps/sim/app/(landing)/components/hero-cta/hero-cta.tsx
+++ b/apps/sim/app/(landing)/components/hero-cta/hero-cta.tsx
@@ -1,4 +1,5 @@
 import { ChipLink, cn } from '@sim/emcn'
+import { DEMO_HREF, SIGNUP_HREF } from '@/app/(landing)/constants'
 
 /**
  * Hero-scale sizing shared by both CTAs - one step up from the navbar's 30px
@@ -24,11 +25,11 @@ const CTA_SIZE = 'h-[36px] px-[0.571em] text-[15px] [&>span]:[font-size:inherit]
 export function HeroCta() {
   return (
     <div className='flex items-center gap-2 max-sm:w-full max-sm:flex-col max-sm:items-stretch'>
-      <ChipLink variant='primary' href='/demo' className={CTA_SIZE}>
+      <ChipLink variant='primary' href={DEMO_HREF} className={CTA_SIZE}>
         Request a demo
       </ChipLink>
       <ChipLink
-        href='/signup'
+        href={SIGNUP_HREF}
         prefetch={false}
         className={cn(CTA_SIZE, 'border border-[var(--border-1)] max-sm:justify-center')}
       >
diff --git a/apps/sim/app/(landing)/components/hero/hero.tsx b/apps/sim/app/(landing)/components/hero/hero.tsx
index b80b7227340..ea259f8e01b 100644
--- a/apps/sim/app/(landing)/components/hero/hero.tsx
+++ b/apps/sim/app/(landing)/components/hero/hero.tsx
@@ -102,6 +102,7 @@ export function Hero() {
           alt=''
           fill
           priority
+          fetchPriority='high'
           quality={90}
           sizes='(max-width: 1460px) 100vw, 1300px'
           className='object-cover'
diff --git a/apps/sim/app/(landing)/components/navbar/components/mobile-nav/mobile-nav.tsx b/apps/sim/app/(landing)/components/navbar/components/mobile-nav/mobile-nav.tsx
index 59e31ad04a7..7be454b18ae 100644
--- a/apps/sim/app/(landing)/components/navbar/components/mobile-nav/mobile-nav.tsx
+++ b/apps/sim/app/(landing)/components/navbar/components/mobile-nav/mobile-nav.tsx
@@ -10,6 +10,7 @@ import {
   NAVBAR_GLASS_SURFACE,
   useNavbarFrost,
 } from '@/app/(landing)/components/navbar/components/navbar-shell'
+import { DEMO_HREF, SIGNUP_HREF } from '@/app/(landing)/constants'
 
 /**
  * Mobile navigation - the `< lg` counterpart to the desktop nav clusters.
@@ -70,7 +71,7 @@ export function MobileNav({ stars }: MobileNavProps) {
 
   return (
     <div className='ml-auto flex items-center gap-2 lg:hidden'>
-      <ChipLink variant='primary' href='/signup' prefetch={false}>
+      <ChipLink variant='primary' href={SIGNUP_HREF} prefetch={false}>
         Sign up
       </ChipLink>
       <button
@@ -166,7 +167,7 @@ export function MobileNav({ stars }: MobileNavProps) {
             </ChipLink>
             <ChipLink
               variant='primary'
-              href='/demo'
+              href={DEMO_HREF}
               fullWidth
               flush
               className='h-[40px] justify-center [&>span]:flex-none'
diff --git a/apps/sim/app/(landing)/components/navbar/navbar.tsx b/apps/sim/app/(landing)/components/navbar/navbar.tsx
index eeb48979949..ee7cbb30444 100644
--- a/apps/sim/app/(landing)/components/navbar/navbar.tsx
+++ b/apps/sim/app/(landing)/components/navbar/navbar.tsx
@@ -9,6 +9,7 @@ import {
   NavMenuChip,
   SimWordmark,
 } from '@/app/(landing)/components/navbar/components'
+import { DEMO_HREF, SIGNUP_HREF } from '@/app/(landing)/constants'
 
 /**
  * Landing navbar.
@@ -87,10 +88,10 @@ export function Navbar({ stars, logoOnly = false }: NavbarProps) {
               <ChipLink href='/login' prefetch={false}>
                 Log in
               </ChipLink>
-              <ChipLink variant='border' href='/demo'>
+              <ChipLink variant='border' href={DEMO_HREF}>
                 Contact sales
               </ChipLink>
-              <ChipLink variant='primary' href='/signup' prefetch={false}>
+              <ChipLink variant='primary' href={SIGNUP_HREF} prefetch={false}>
                 Sign up
               </ChipLink>
             </div>
diff --git a/apps/sim/app/(landing)/constants.ts b/apps/sim/app/(landing)/constants.ts
new file mode 100644
index 00000000000..c16abe98f78
--- /dev/null
+++ b/apps/sim/app/(landing)/constants.ts
@@ -0,0 +1,8 @@
+/**
+ * Shared landing-page CTA destinations. Every "Get started"/"Sign up" CTA
+ * across the marketing site funnels to signup; every "Talk to sales"/
+ * "Contact sales" CTA funnels to the demo-request form. Centralized here so
+ * no CTA can drift to the wrong destination independently.
+ */
+export const SIGNUP_HREF = '/signup'
+export const DEMO_HREF = '/demo'
diff --git a/apps/sim/app/(landing)/demo/components/demo-booking/demo-booking.tsx b/apps/sim/app/(landing)/demo/components/demo-booking/demo-booking.tsx
index 4b7a499704d..4597437ae31 100644
--- a/apps/sim/app/(landing)/demo/components/demo-booking/demo-booking.tsx
+++ b/apps/sim/app/(landing)/demo/components/demo-booking/demo-booking.tsx
@@ -3,10 +3,24 @@
 import { type CSSProperties, useEffect, useRef, useState } from 'react'
 import { chipBorderShadowRing, cn } from '@sim/emcn'
 import dynamic from 'next/dynamic'
+import { preconnect } from 'react-dom'
 import { DemoForm, type DemoLead } from '@/app/(landing)/demo/components/demo-form'
 
 const importScheduler = () => import('@/app/(landing)/demo/components/demo-scheduler')
 
+/**
+ * Warm the entire booking path while the visitor fills the form: preconnect to
+ * app.cal.com, then load the scheduler chunk, Cal.com's embed.js, and the
+ * booker iframe assets (via the embed's `preload` instruction). Fired on first
+ * form focus so nothing Cal.com-related competes with initial page load — the
+ * connection handshake overlaps the chunk import, and it all finishes long
+ * before the visitor submits.
+ */
+function preloadScheduler() {
+  preconnect('https://app.cal.com')
+  return importScheduler().then((m) => m.preloadCalEmbed())
+}
+
 /**
  * Lazy-loaded so the Cal.com embed never enters the initial landing bundle - it
  * loads only once a visitor reaches the booking step. `loading: () => null` (no
@@ -75,7 +89,7 @@ export function DemoBooking({ className }: DemoBookingProps) {
         <div
           className='w-full min-w-0 shrink-0'
           inert={showScheduler}
-          onFocusCapture={() => void importScheduler()}
+          onFocusCapture={() => void preloadScheduler()}
         >
           <div ref={formRef} className='p-6 max-sm:p-5'>
             <DemoForm onComplete={setLead} />
diff --git a/apps/sim/app/(landing)/demo/components/demo-scheduler/demo-scheduler.tsx b/apps/sim/app/(landing)/demo/components/demo-scheduler/demo-scheduler.tsx
index c86d0ea9fbf..c10cc3ea103 100644
--- a/apps/sim/app/(landing)/demo/components/demo-scheduler/demo-scheduler.tsx
+++ b/apps/sim/app/(landing)/demo/components/demo-scheduler/demo-scheduler.tsx
@@ -19,6 +19,30 @@ interface DemoSchedulerProps {
   lead: DemoLead
 }
 
+let calEmbedPreloaded = false
+
+/**
+ * Warm the Cal.com embed before the scheduler mounts. Loads `embed.js` and
+ * issues the embed's `preload` instruction, which fetches the booker in a
+ * hidden `?preload=true` iframe so its assets are already cached when the real
+ * embed renders on submit. Without this, nothing Cal.com-related starts
+ * downloading until the visitor presses Continue, which is why the calendar
+ * used to take several seconds to appear. Idempotent — repeat calls no-op
+ * while a warm-up is in flight or done, but a failed embed.js load resets the
+ * flag so a later focus can retry.
+ */
+export function preloadCalEmbed(): void {
+  if (calEmbedPreloaded) return
+  calEmbedPreloaded = true
+  getCalApi({ namespace: CAL_NAMESPACE })
+    .then((cal) => {
+      cal('preload', { calLink: CAL_LINK })
+    })
+    .catch(() => {
+      calEmbedPreloaded = false
+    })
+}
+
 /**
  * Step 2 of the booking card - the Cal.com scheduler, prefilled from the form's
  * {@link DemoLead}. Rendered inside the card chrome owned by {@link DemoBooking}
diff --git a/apps/sim/app/(landing)/demo/components/demo-scheduler/index.ts b/apps/sim/app/(landing)/demo/components/demo-scheduler/index.ts
index 72290c7861f..a280b21282f 100644
--- a/apps/sim/app/(landing)/demo/components/demo-scheduler/index.ts
+++ b/apps/sim/app/(landing)/demo/components/demo-scheduler/index.ts
@@ -1 +1 @@
-export { DemoScheduler } from './demo-scheduler'
+export { DemoScheduler, preloadCalEmbed } from './demo-scheduler'
diff --git a/apps/sim/app/(landing)/enterprise/enterprise.tsx b/apps/sim/app/(landing)/enterprise/enterprise.tsx
index 100ab549b0d..0396ddcacbc 100644
--- a/apps/sim/app/(landing)/enterprise/enterprise.tsx
+++ b/apps/sim/app/(landing)/enterprise/enterprise.tsx
@@ -9,6 +9,7 @@ import {
 } from '@/app/(landing)/components/solutions-page/components'
 import { SOLUTIONS_SPACING } from '@/app/(landing)/components/solutions-page/constants'
 import type { SolutionsPageConfig } from '@/app/(landing)/components/solutions-page/types'
+import { DEMO_HREF, SIGNUP_HREF } from '@/app/(landing)/constants'
 import { EnterpriseFeatureGrid } from '@/app/(landing)/enterprise/components/enterprise-feature-grid'
 import { EnterprisePlatformLoop } from '@/app/(landing)/enterprise/components/enterprise-platform-loop'
 import {
@@ -65,6 +66,7 @@ const ENTERPRISE_CONFIG: SolutionsPageConfig = {
         <Image
           fill
           priority
+          fetchPriority='high'
           alt=''
           className='object-cover object-center'
           sizes='(max-width: 1024px) 100vw, 1300px'
@@ -84,7 +86,7 @@ const ENTERPRISE_CONFIG: SolutionsPageConfig = {
       title: 'Build, Deploy, and Manage Enterprise AI Agents in One Workspace',
       subtitle:
         'Build enterprise AI agents, ship to production, and manage every version from one workspace.',
-      cta: { label: 'Start building', href: '/signup' },
+      cta: { label: 'Start building', href: SIGNUP_HREF },
       cards: [
         {
           title: 'Build visually or with code',
@@ -111,7 +113,7 @@ const ENTERPRISE_CONFIG: SolutionsPageConfig = {
       title: 'Governance and Security for Enterprise AI Agents',
       subtitle:
         'Security, approvals, and controls keep enterprise AI agents trusted in production.',
-      cta: { label: 'See security', href: '/demo' },
+      cta: { label: 'See security', href: DEMO_HREF },
       cards: [
         {
           title: 'Control who can do what',
@@ -138,7 +140,7 @@ const ENTERPRISE_CONFIG: SolutionsPageConfig = {
       id: 'deploy',
       title: 'Deploy Enterprise Workflow Agents with Confidence',
       subtitle: 'Stage, observe, and version workflow agents before they reach production.',
-      cta: { label: 'Explore deployment', href: '/signup' },
+      cta: { label: 'Explore deployment', href: SIGNUP_HREF },
       cards: [
         {
           title: 'Stage before you ship',
@@ -162,7 +164,7 @@ const ENTERPRISE_CONFIG: SolutionsPageConfig = {
       title: 'Built for Enterprise Teams',
       subtitle:
         'Built for the teams that own enterprise AI agents across IT, operations, and engineering.',
-      cta: { label: 'Talk to sales', href: '/demo' },
+      cta: { label: 'Talk to sales', href: DEMO_HREF },
       cards: [
         {
           title: 'IT and platform teams',
diff --git a/apps/sim/app/(landing)/pricing/components/pricing-plans/pricing-plans.tsx b/apps/sim/app/(landing)/pricing/components/pricing-plans/pricing-plans.tsx
index efaf271b15e..5fc794978ef 100644
--- a/apps/sim/app/(landing)/pricing/components/pricing-plans/pricing-plans.tsx
+++ b/apps/sim/app/(landing)/pricing/components/pricing-plans/pricing-plans.tsx
@@ -4,6 +4,7 @@ import type { ReactNode } from 'react'
 import { useQueryStates } from 'nuqs'
 import { getUpgradeCardCta, type PlanTier, type UpgradeCardId } from '@/lib/billing/client'
 import { ANNUAL_DISCOUNT_RATE, CREDIT_TIERS } from '@/lib/billing/constants'
+import { DEMO_HREF, SIGNUP_HREF } from '@/app/(landing)/constants'
 import {
   PricingCard,
   type PricingCardCta,
@@ -18,14 +19,12 @@ import {
 
 /**
  * A public visitor has no subscription, so each card's canonical label and
- * variant resolves against the `free` tier. On this page every CTA funnels to
- * sign-up regardless of plan.
+ * variant resolves against the `free` tier. On this page every self-serve CTA
+ * funnels to sign-up regardless of plan; the enterprise CTA routes to the
+ * demo-request form instead.
  */
 const VISITOR_TIER: PlanTier = 'free'
 
-/** Every CTA on the public pricing page funnels logged-out visitors to sign-up. */
-const SIGNUP_HREF = '/signup'
-
 /** This section's rows render on the public cards without their group header. */
 const HEADERLESS_SECTION_TITLE = 'Credits & pricing'
 
@@ -52,13 +51,27 @@ function sectionsForColumn(col: number): PricingCardSection[] {
   }))
 }
 
+/** The four card columns (Free, Pro, Max, Enterprise) transposed once at module load - the source data is static, so this never needs to be redone per render. */
+const SECTIONS_BY_COLUMN = [0, 1, 2, 3].map(sectionsForColumn)
+
+/** Round a dollar amount down to the annual-billing discounted price. */
+function annualPrice(dollars: number): number {
+  return Math.round(dollars * (1 - ANNUAL_DISCOUNT_RATE))
+}
+
 /**
- * Resolve a card's canonical label and variant from the free-tier matrix; the
- * CTA always funnels logged-out visitors to sign-up.
+ * Resolve a card's canonical label and variant from the free-tier matrix. A
+ * `sales` intent ("Talk to sales") routes to the demo-request form, matching
+ * every other "Contact sales" CTA on the landing site; every other intent
+ * funnels logged-out visitors to sign-up.
  */
 function resolveCta(card: UpgradeCardId): PricingCardCta {
   const cta = getUpgradeCardCta(VISITOR_TIER, card)
-  return { label: cta.label, variant: cta.variant, href: SIGNUP_HREF }
+  return {
+    label: cta.label,
+    variant: cta.variant,
+    href: cta.intent === 'sales' ? DEMO_HREF : SIGNUP_HREF,
+  }
 }
 
 const FREE_CTA: PricingCardCta = {
@@ -86,12 +99,8 @@ export function PricingPlans({ heading }: PricingPlansProps) {
   const setIsAnnual = (next: boolean) => setParams({ billing: next ? 'annual' : 'monthly' })
 
   const discountPct = Math.round(ANNUAL_DISCOUNT_RATE * 100)
-  const proPrice = isAnnual
-    ? Math.round(CREDIT_TIERS[0].dollars * (1 - ANNUAL_DISCOUNT_RATE))
-    : CREDIT_TIERS[0].dollars
-  const maxPrice = isAnnual
-    ? Math.round(CREDIT_TIERS[1].dollars * (1 - ANNUAL_DISCOUNT_RATE))
-    : CREDIT_TIERS[1].dollars
+  const proPrice = isAnnual ? annualPrice(CREDIT_TIERS[0].dollars) : CREDIT_TIERS[0].dollars
+  const maxPrice = isAnnual ? annualPrice(CREDIT_TIERS[1].dollars) : CREDIT_TIERS[1].dollars
   const priceSubtext = isAnnual
     ? 'per user/month, billed annually'
     : 'per user/month, billed monthly'
@@ -114,7 +123,7 @@ export function PricingPlans({ heading }: PricingPlansProps) {
           price='$0'
           priceSubtext='Free forever'
           cta={FREE_CTA}
-          sections={sectionsForColumn(0)}
+          sections={SECTIONS_BY_COLUMN[0]}
         />
         <PricingCard
           name='Pro'
@@ -122,7 +131,7 @@ export function PricingPlans({ heading }: PricingPlansProps) {
           discountLabel={discountLabel}
           priceSubtext={priceSubtext}
           cta={proCta}
-          sections={sectionsForColumn(1)}
+          sections={SECTIONS_BY_COLUMN[1]}
         />
         <PricingCard
           name='Max'
@@ -130,14 +139,14 @@ export function PricingPlans({ heading }: PricingPlansProps) {
           discountLabel={discountLabel}
           priceSubtext={priceSubtext}
           cta={maxCta}
-          sections={sectionsForColumn(2)}
+          sections={SECTIONS_BY_COLUMN[2]}
         />
         <PricingCard
           name='Enterprise'
           price='Custom'
           priceSubtext='Tailored to your team'
           cta={enterpriseCta}
-          sections={sectionsForColumn(3)}
+          sections={SECTIONS_BY_COLUMN[3]}
         />
       </div>
     </>
diff --git a/apps/sim/app/api/chat/[identifier]/otp/route.test.ts b/apps/sim/app/api/chat/[identifier]/otp/route.test.ts
index a860df8eb28..6d32eb61f6b 100644
--- a/apps/sim/app/api/chat/[identifier]/otp/route.test.ts
+++ b/apps/sim/app/api/chat/[identifier]/otp/route.test.ts
@@ -529,6 +529,43 @@ describe('Chat OTP API Route', () => {
     })
   })
 
+  describe('PUT - Verify OTP (authType re-check)', () => {
+    beforeEach(() => {
+      mockGetStorageMethod.mockReturnValue('redis')
+      mockRedisGet.mockResolvedValue(`${mockOTP}:0`)
+    })
+
+    it('rejects verification when the chat has switched away from email auth', async () => {
+      mockDbSelect.mockImplementationOnce(() => ({
+        from: vi.fn().mockReturnValue({
+          where: vi.fn().mockReturnValue({
+            limit: vi.fn().mockResolvedValue([
+              {
+                id: mockChatId,
+                authType: 'password',
+                password: 'encrypted-password',
+              },
+            ]),
+          }),
+        }),
+      }))
+
+      const request = new NextRequest('http://localhost:3000/api/chat/test/otp', {
+        method: 'PUT',
+        body: JSON.stringify({ email: mockEmail, otp: mockOTP }),
+      })
+
+      await PUT(request, { params: Promise.resolve({ identifier: mockIdentifier }) })
+
+      expect(mockCreateErrorResponse).toHaveBeenCalledWith(
+        'This chat does not use email authentication',
+        400
+      )
+      expect(mockRedisGet).not.toHaveBeenCalled()
+      expect(mockSetChatAuthCookie).not.toHaveBeenCalled()
+    })
+  })
+
   describe('PUT - Verify OTP (Database path)', () => {
     beforeEach(() => {
       mockGetStorageMethod.mockReturnValue('database')
diff --git a/apps/sim/app/api/chat/[identifier]/otp/route.ts b/apps/sim/app/api/chat/[identifier]/otp/route.ts
index aeb1b69f450..248fcfa84ab 100644
--- a/apps/sim/app/api/chat/[identifier]/otp/route.ts
+++ b/apps/sim/app/api/chat/[identifier]/otp/route.ts
@@ -174,6 +174,10 @@ export const PUT = withRouteHandler(
 
       const deployment = deploymentResult[0]
 
+      if (deployment.authType !== 'email') {
+        return createErrorResponse('This chat does not use email authentication', 400)
+      }
+
       const storedValue = await getOTP('chat', deployment.id, email)
       if (!storedValue) {
         return createErrorResponse('No verification code found, request a new one', 400)
diff --git a/apps/sim/app/api/files/upload/route.test.ts b/apps/sim/app/api/files/upload/route.test.ts
index f6df57eb59d..aa810049034 100644
--- a/apps/sim/app/api/files/upload/route.test.ts
+++ b/apps/sim/app/api/files/upload/route.test.ts
@@ -24,6 +24,7 @@ const mocks = vi.hoisted(() => {
   const mockIsUsingCloudStorage = vi.fn()
   const mockUploadFile = vi.fn()
   const mockUploadExecutionFile = vi.fn()
+  const mockCheckStorageQuota = vi.fn()
 
   return {
     mockVerifyFileAccess,
@@ -35,6 +36,7 @@ const mocks = vi.hoisted(() => {
     mockIsUsingCloudStorage,
     mockUploadFile,
     mockUploadExecutionFile,
+    mockCheckStorageQuota,
   }
 })
 
@@ -108,6 +110,10 @@ vi.mock('@/lib/uploads/setup.server', () => ({
   UPLOAD_DIR_SERVER: '/tmp/test-uploads',
 }))
 
+vi.mock('@/lib/billing/storage', () => ({
+  checkStorageQuota: mocks.mockCheckStorageQuota,
+}))
+
 import { uploadWorkspaceFile } from '@/lib/uploads/contexts/workspace'
 import { POST } from '@/app/api/files/upload/route'
 
@@ -183,6 +189,12 @@ function setupFileApiMocks(
     key: 'test-key',
     path: '/test/path',
   })
+
+  mocks.mockCheckStorageQuota.mockResolvedValue({
+    allowed: true,
+    currentUsage: 0,
+    limit: Number.MAX_SAFE_INTEGER,
+  })
 }
 
 describe('File Upload API Route', () => {
@@ -640,6 +652,125 @@ describe('File Upload Security Tests', () => {
     })
   })
 
+  describe('Mothership Context Permission Gate', () => {
+    const postMothershipUpload = async (workspaceId: string | null = 'test-workspace-id') => {
+      const formData = new FormData()
+      const file = new File(['test content'], 'test.pdf', { type: 'application/pdf' })
+      formData.append('file', file)
+      formData.append('context', 'mothership')
+      if (workspaceId !== null) formData.append('workspaceId', workspaceId)
+
+      const req = new Request('http://localhost/api/files/upload', {
+        method: 'POST',
+        headers: { 'content-length': '1024' },
+        body: formData,
+      })
+
+      return POST(req as unknown as NextRequest)
+    }
+
+    beforeEach(() => {
+      setupFileApiMocks({
+        cloudEnabled: false,
+        storageProvider: 'local',
+      })
+    })
+
+    it('rejects mothership uploads without workspaceId', async () => {
+      const response = await postMothershipUpload(null)
+
+      expect(response.status).toBe(400)
+      const data = await response.json()
+      expect(data.message).toContain('workspaceId')
+      expect(storageServiceMockFns.mockUploadFile).not.toHaveBeenCalled()
+    })
+
+    it('rejects mothership uploads for a workspace the caller does not belong to', async () => {
+      permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue(null)
+
+      const response = await postMothershipUpload()
+
+      expect(response.status).toBe(403)
+      const data = await response.json()
+      expect(data.error).toBe('Write or Admin access required for mothership uploads')
+      expect(storageServiceMockFns.mockUploadFile).not.toHaveBeenCalled()
+    })
+
+    it('rejects mothership uploads for a read-only workspace member', async () => {
+      permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('read')
+
+      const response = await postMothershipUpload()
+
+      expect(response.status).toBe(403)
+      expect(storageServiceMockFns.mockUploadFile).not.toHaveBeenCalled()
+    })
+
+    it('rejects mothership uploads over the caller storage quota', async () => {
+      permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('write')
+      mocks.mockCheckStorageQuota.mockResolvedValue({
+        allowed: false,
+        currentUsage: 100,
+        limit: 100,
+        error: 'Storage limit exceeded. Used: 0.00GB, Limit: 0GB',
+      })
+
+      const response = await postMothershipUpload()
+
+      expect(response.status).toBe(413)
+      const data = await response.json()
+      expect(data.error).toContain('Storage limit exceeded')
+      expect(storageServiceMockFns.mockUploadFile).not.toHaveBeenCalled()
+    })
+
+    it('allows mothership uploads for a write-permission workspace member', async () => {
+      permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('write')
+
+      const response = await postMothershipUpload()
+
+      expect(response.status).toBe(200)
+      expect(permissionsMockFns.mockGetUserEntityPermissions).toHaveBeenCalledWith(
+        'test-user-id',
+        'workspace',
+        'test-workspace-id'
+      )
+      expect(storageServiceMockFns.mockUploadFile).toHaveBeenCalled()
+    })
+
+    it('allows mothership uploads for an admin-permission workspace member', async () => {
+      permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('admin')
+
+      const response = await postMothershipUpload()
+
+      expect(response.status).toBe(200)
+      expect(storageServiceMockFns.mockUploadFile).toHaveBeenCalled()
+    })
+
+    it('checks quota once against the combined size of a multi-file batch', async () => {
+      permissionsMockFns.mockGetUserEntityPermissions.mockResolvedValue('write')
+
+      const formData = new FormData()
+      const fileA = new File(['a'.repeat(10)], 'a.pdf', { type: 'application/pdf' })
+      const fileB = new File(['b'.repeat(20)], 'b.pdf', { type: 'application/pdf' })
+      formData.append('file', fileA)
+      formData.append('file', fileB)
+      formData.append('context', 'mothership')
+      formData.append('workspaceId', 'test-workspace-id')
+
+      const req = new Request('http://localhost/api/files/upload', {
+        method: 'POST',
+        headers: { 'content-length': '1024' },
+        body: formData,
+      })
+
+      const response = await POST(req as unknown as NextRequest)
+
+      expect(response.status).toBe(200)
+      expect(mocks.mockCheckStorageQuota).toHaveBeenCalledTimes(1)
+      expect(mocks.mockCheckStorageQuota).toHaveBeenCalledWith('test-user-id', 30)
+      expect(permissionsMockFns.mockGetUserEntityPermissions).toHaveBeenCalledTimes(1)
+    })
+  })
+
   describe('Authentication Requirements', () => {
     it('should reject uploads without authentication', async () => {
       authMockFns.mockGetSession.mockResolvedValue(null)
diff --git a/apps/sim/app/api/files/upload/route.ts b/apps/sim/app/api/files/upload/route.ts
index 64914af8970..ab934a64960 100644
--- a/apps/sim/app/api/files/upload/route.ts
+++ b/apps/sim/app/api/files/upload/route.ts
@@ -115,6 +115,36 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       executionUploadContext = { workspaceId, workflowId, executionId }
     }
 
+    // Mothership context requires the same workspace write/admin permission check, plus a
+    // storage quota check. Resolve both once per request (not per file) since workspaceId is
+    // invariant across all files in the upload and quota must account for the full batch size,
+    // not just one file.
+    let mothershipWorkspaceId: string | undefined
+    if (context === 'mothership') {
+      if (!workspaceId) {
+        throw new InvalidRequestError('Mothership context requires workspaceId parameter')
+      }
+
+      const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+      if (permission !== 'write' && permission !== 'admin') {
+        return NextResponse.json(
+          { error: 'Write or Admin access required for mothership uploads' },
+          { status: 403 }
+        )
+      }
+
+      const { checkStorageQuota } = await import('@/lib/billing/storage')
+      const quotaCheck = await checkStorageQuota(session.user.id, totalFileSize)
+      if (!quotaCheck.allowed) {
+        return NextResponse.json(
+          { error: quotaCheck.error || 'Storage limit exceeded' },
+          { status: 413 }
+        )
+      }
+
+      mothershipWorkspaceId = workspaceId
+    }
+
     const uploadResults = []
 
     for (const file of files) {
@@ -261,21 +291,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       }
 
       // Handle mothership context (chat-scoped uploads to workspace S3)
-      if (context === 'mothership') {
-        if (!workspaceId) {
-          throw new InvalidRequestError('Chat context requires workspaceId parameter')
-        }
-
+      if (context === 'mothership' && mothershipWorkspaceId) {
         logger.info(`Uploading mothership file: ${originalName}`)
 
-        const storageKey = generateWorkspaceFileKey(workspaceId, originalName)
+        const storageKey = generateWorkspaceFileKey(mothershipWorkspaceId, originalName)
 
         const metadata: Record<string, string> = {
           originalName: originalName,
           uploadedAt: new Date().toISOString(),
           purpose: 'mothership',
           userId: session.user.id,
-          workspaceId,
+          workspaceId: mothershipWorkspaceId,
         }
 
         const fileInfo = await storageService.uploadFile({
diff --git a/apps/sim/app/api/help/route.ts b/apps/sim/app/api/help/route.ts
index 6fe478fe4b4..3c10f68f4d4 100644
--- a/apps/sim/app/api/help/route.ts
+++ b/apps/sim/app/api/help/route.ts
@@ -5,12 +5,26 @@ import { helpFormBodySchema } from '@/lib/api/contracts/common'
 import { validationErrorResponse } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { generateRequestId } from '@/lib/core/utils/request'
+import {
+  isPayloadSizeLimitError,
+  MAX_MULTIPART_OVERHEAD_BYTES,
+  readFormDataWithLimit,
+} from '@/lib/core/utils/stream-limits'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 import { getFromEmailAddress, getHelpEmailAddress } from '@/lib/messaging/email/utils'
+import { MAX_WORKSPACE_FORMDATA_FILE_SIZE } from '@/lib/uploads/shared/types'
 
 const logger = createLogger('HelpAPI')
 
+/**
+ * The form can carry several image attachments with no server-side count
+ * cap, so this reuses the repo's largest existing per-request form-data
+ * bound (see files/upload route) rather than an arbitrary smaller limit
+ * that could reject a legitimate multi-image submission.
+ */
+const MAX_HELP_FORM_BYTES = MAX_WORKSPACE_FORMDATA_FILE_SIZE + MAX_MULTIPART_OVERHEAD_BYTES
+
 export const POST = withRouteHandler(async (req: NextRequest) => {
   const requestId = generateRequestId()
 
@@ -23,7 +37,10 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
 
     const email = session.user.email
 
-    const formData = await req.formData()
+    const formData = await readFormDataWithLimit(req, {
+      maxBytes: MAX_HELP_FORM_BYTES,
+      label: 'Help request form data',
+    })
 
     const subject = formData.get('subject') as string
     const message = formData.get('message') as string
@@ -128,6 +145,13 @@ ${message}
       { status: 200 }
     )
   } catch (error) {
+    if (isPayloadSizeLimitError(error)) {
+      logger.warn(`[${requestId}] Help request form data too large`, { message: error.message })
+      return NextResponse.json(
+        { error: `Request body exceeds the maximum allowed size of ${MAX_HELP_FORM_BYTES} bytes` },
+        { status: 413 }
+      )
+    }
     if (error instanceof Error && error.message.includes('not configured')) {
       logger.error(`[${requestId}] Email service configuration error`, error)
       return NextResponse.json(
diff --git a/apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/route.ts b/apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/route.ts
index 059abee2fb6..75d9df48173 100644
--- a/apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/route.ts
+++ b/apps/sim/app/api/knowledge/[id]/documents/[documentId]/chunks/route.ts
@@ -7,7 +7,7 @@ import {
   createChunkBodySchema,
   listKnowledgeChunksQuerySchema,
 } from '@/lib/api/contracts/knowledge'
-import { isZodError, parseRequest } from '@/lib/api/server'
+import { isZodError, parseJsonBody, parseRequest } from '@/lib/api/server'
 import { checkSessionOrInternalAuth } from '@/lib/auth/hybrid'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -103,9 +103,6 @@ export const POST = withRouteHandler(
     const { id: knowledgeBaseId, documentId } = await params
 
     try {
-      const body = await req.json()
-      const { workflowId, ...searchParams } = body
-
       const auth = await checkSessionOrInternalAuth(req, { requireWorkflowId: false })
       if (!auth.success || !auth.userId) {
         logger.warn(`[${requestId}] Authentication failed: ${auth.error || 'Unauthorized'}`)
@@ -113,7 +110,14 @@ export const POST = withRouteHandler(
       }
       const userId = auth.userId
 
+      const parsedBody = await parseJsonBody(req)
+      if (!parsedBody.success) return parsedBody.response
+      const { workflowId, ...searchParams } = parsedBody.data as Record<string, unknown>
+
       if (workflowId) {
+        if (typeof workflowId !== 'string') {
+          return NextResponse.json({ error: 'workflowId must be a string' }, { status: 400 })
+        }
         const authorization = await authorizeWorkflowByWorkspacePermission({
           workflowId,
           userId,
diff --git a/apps/sim/app/api/mothership/execute/route.ts b/apps/sim/app/api/mothership/execute/route.ts
index 37236aa160f..fa227d69351 100644
--- a/apps/sim/app/api/mothership/execute/route.ts
+++ b/apps/sim/app/api/mothership/execute/route.ts
@@ -8,6 +8,7 @@ import { checkInternalAuth } from '@/lib/auth/hybrid'
 import { buildIntegrationToolSchemas } from '@/lib/copilot/chat/payload'
 import { processContextsServer } from '@/lib/copilot/chat/process-contents'
 import { generateWorkspaceContext } from '@/lib/copilot/chat/workspace-context'
+import { computeWorkspaceEntitlements } from '@/lib/copilot/entitlements'
 import {
   MothershipStreamV1EventType,
   MothershipStreamV1TextChannel,
@@ -141,25 +142,32 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
     const lastUserMessage = messages.filter((m) => m.role === 'user').at(-1)?.content
     // double-cast-allowed: the contract validates contexts as open kind/label objects; processContextsServer narrows on `kind` at runtime
     const agentMentions = contexts as unknown as ChatContext[] | undefined
-    const [workspaceContext, integrationTools, userSkillTool, userPermission, agentContexts] =
-      await Promise.all([
-        generateWorkspaceContext(workspaceId, userId),
-        buildIntegrationToolSchemas(userId, messageId, undefined, workspaceId),
-        buildUserSkillTool(workspaceId),
-        getUserEntityPermissions(userId, 'workspace', workspaceId).catch(() => null),
-        processContextsServer(
-          agentMentions,
-          userId,
-          lastUserMessage,
-          workspaceId,
-          effectiveChatId
-        ).catch((error) => {
-          reqLogger.warn('Failed to resolve agent contexts for execution', {
-            error: toError(error).message,
-          })
-          return []
-        }),
-      ])
+    const [
+      workspaceContext,
+      integrationTools,
+      userSkillTool,
+      userPermission,
+      entitlements,
+      agentContexts,
+    ] = await Promise.all([
+      generateWorkspaceContext(workspaceId, userId),
+      buildIntegrationToolSchemas(userId, messageId, undefined, workspaceId),
+      buildUserSkillTool(workspaceId),
+      getUserEntityPermissions(userId, 'workspace', workspaceId).catch(() => null),
+      computeWorkspaceEntitlements(workspaceId, userId),
+      processContextsServer(
+        agentMentions,
+        userId,
+        lastUserMessage,
+        workspaceId,
+        effectiveChatId
+      ).catch((error) => {
+        reqLogger.warn('Failed to resolve agent contexts for execution', {
+          error: toError(error).message,
+        })
+        return []
+      }),
+    ])
     const requestPayload: Record<string, unknown> = {
       messages,
       responseFormat,
@@ -182,6 +190,7 @@ export const POST = withRouteHandler(async (req: NextRequest) => {
       ...(integrationTools.length > 0 ? { integrationTools } : {}),
       ...(userSkillTool ? { mothershipTools: [userSkillTool] } : {}),
       ...(userPermission ? { userPermission } : {}),
+      ...(entitlements.length > 0 ? { entitlements } : {}),
     }
 
     let allowExplicitAbort = true
diff --git a/apps/sim/app/api/speech/token/route.test.ts b/apps/sim/app/api/speech/token/route.test.ts
index 8c00a1c7787..a555948c9d9 100644
--- a/apps/sim/app/api/speech/token/route.test.ts
+++ b/apps/sim/app/api/speech/token/route.test.ts
@@ -138,4 +138,13 @@ describe('POST /api/speech/token — usage attribution', () => {
       workspaceId: 'ws-1',
     })
   })
+
+  it('rejects an oversized body before any auth/billing work runs', async () => {
+    const oversizedBody = { chatId: 'x'.repeat(64 * 1024) }
+    const res = await POST(createMockRequest('POST', oversizedBody))
+
+    expect(res.status).toBe(413)
+    expect(mockGetSession).not.toHaveBeenCalled()
+    expect(mockRecordUsage).not.toHaveBeenCalled()
+  })
 })
diff --git a/apps/sim/app/api/speech/token/route.ts b/apps/sim/app/api/speech/token/route.ts
index 3ccb721366f..47a63b741dc 100644
--- a/apps/sim/app/api/speech/token/route.ts
+++ b/apps/sim/app/api/speech/token/route.ts
@@ -6,6 +6,7 @@ import { getErrorMessage } from '@sim/utils/errors'
 import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { speechTokenBodySchema } from '@/lib/api/contracts/media/speech'
+import { parseOptionalJsonBody } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { checkActorUsageLimits } from '@/lib/billing/calculations/usage-monitor'
 import { recordUsage } from '@/lib/billing/core/usage-log'
@@ -34,6 +35,13 @@ const STT_TOKEN_RATE_LIMIT = {
   refillIntervalMs: 72 * 1000,
 } as const
 
+/**
+ * This body only ever carries an optional chatId/workspaceId string, so a
+ * tight cap keeps an unauthenticated caller from forcing a large in-memory
+ * allocation before the auth checks below run.
+ */
+const MAX_SPEECH_TOKEN_BODY_BYTES = 16 * 1024
+
 function hashVoiceToken(token: string): string {
   return createHash('sha256').update(token).digest('hex')
 }
@@ -87,8 +95,9 @@ async function validateChatAuth(
 
 export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
-    const rawBody = await request.json().catch(() => ({}))
-    const body = speechTokenBodySchema.safeParse(rawBody)
+    const parsedBody = await parseOptionalJsonBody(request, MAX_SPEECH_TOKEN_BODY_BYTES)
+    if (!parsedBody.success) return parsedBody.response
+    const body = speechTokenBodySchema.safeParse(parsedBody.data ?? {})
     const chatId =
       body.success && typeof body.data.chatId === 'string' ? body.data.chatId : undefined
 
diff --git a/apps/sim/app/llms-full.txt/route.ts b/apps/sim/app/llms-full.txt/route.ts
index b198f56aa6f..22718fdd2b1 100644
--- a/apps/sim/app/llms-full.txt/route.ts
+++ b/apps/sim/app/llms-full.txt/route.ts
@@ -9,7 +9,7 @@ export function GET() {
 
 ## Overview
 
-Sim is the AI workspace where teams create agents visually with the workflow builder, conversationally through Mothership, or programmatically with the API. Over 100,000 builders use Sim — from startups to Fortune 500 companies. Teams connect their tools and data, build agents that automate real work across systems, and manage them with full observability. SOC2 compliant.
+Sim is the AI workspace where teams create agents visually with the workflow builder, conversationally through Chat, or programmatically with the API. Over 100,000 builders use Sim — from startups to Fortune 500 companies. Teams connect their tools and data, build agents that automate real work across systems, and manage them with full observability. SOC2 compliant.
 
 ## Product Details
 
@@ -122,7 +122,7 @@ Built-in table creation and management:
 ## Technical Architecture
 
 ### Frontend
-- Next.js 15 with App Router
+- Next.js 16 with App Router
 - React Flow for the visual builder
 - Tailwind CSS for styling
 - Zustand for state management
@@ -150,26 +150,26 @@ Built-in table creation and management:
 
 ## Links
 
-- **Website**: ${baseUrl}
-- **Documentation**: https://docs.sim.ai
-- **API Reference**: https://docs.sim.ai/api
-- **GitHub**: https://github.com/simstudioai/sim
-- **Discord**: https://discord.gg/Hr4UWYEcTT
-- **X/Twitter**: https://x.com/simdotai
-- **LinkedIn**: https://linkedin.com/company/simstudioai
+- [Website](${baseUrl}): Product overview and primary entry point
+- [Documentation](https://docs.sim.ai): Product guides and technical reference
+- [API Reference](https://docs.sim.ai/api): API documentation
+- [GitHub](https://github.com/simstudioai/sim): Open-source codebase
+- [Discord](https://discord.gg/Hr4UWYEcTT): Community server
+- [X/Twitter](https://x.com/simdotai): Announcements and updates
+- [LinkedIn](https://linkedin.com/company/simstudioai): Company page
 
 ## Support
 
-- **Email**: help@sim.ai
-- **Security Issues**: security@sim.ai
-- **Documentation**: https://docs.sim.ai
-- **Community Discord**: https://discord.gg/Hr4UWYEcTT
+- [Documentation](https://docs.sim.ai): Self-serve guides and reference
+- [Community Discord](https://discord.gg/Hr4UWYEcTT): Community support
+- Email: help@sim.ai
+- Security issues: security@sim.ai
 
 ## Legal
 
-- **Terms of Service**: ${baseUrl}/terms
-- **Privacy Policy**: ${baseUrl}/privacy
-- **Security**: ${baseUrl}/.well-known/security.txt
+- [Terms of Service](${baseUrl}/terms): Legal terms
+- [Privacy Policy](${baseUrl}/privacy): Data handling practices
+- [Security](${baseUrl}/.well-known/security.txt): Vulnerability disclosure policy
 `
 
   return new Response(llmsFullContent, {
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/docx-preview.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/docx-preview.tsx
index 6f1e8f75df0..3ff4df51c2c 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/docx-preview.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/docx-preview.tsx
@@ -4,6 +4,7 @@ import { memo, useCallback, useEffect, useRef, useState } from 'react'
 import { cn } from '@sim/emcn'
 import { createLogger } from '@sim/logger'
 import { toError } from '@sim/utils/errors'
+import { sanitizeRenderedHyperlinks } from '@/lib/core/security/url-safety'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
 import { PREVIEW_LOADING_OVERLAY, PreviewError, resolvePreviewError } from './preview-shared'
 import { PreviewToolbar } from './preview-toolbar'
@@ -209,6 +210,7 @@ export const DocxPreview = memo(function DocxPreview({
           ignoreHeight: false,
         })
         if (!cancelled && containerRef.current) {
+          sanitizeRenderedHyperlinks(containerRef.current)
           applyPostRenderStyling()
           setHasRenderedPreview(true)
           setDocumentRenderVersion((version) => version + 1)
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.tsx
index e4ba8033261..d65fd1d928b 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/image-preview.tsx
@@ -1,12 +1,14 @@
 'use client'
 
-import { memo } from 'react'
+import { memo, useState } from 'react'
 import type { WorkspaceFileRecord } from '@/lib/uploads/contexts/workspace'
 import { useFileContentSource } from '@/hooks/use-file-content-source'
+import { PREVIEW_LOADING_OVERLAY } from './preview-shared'
 import { ZoomablePreview } from './zoomable-preview'
 
 export const ImagePreview = memo(function ImagePreview({ file }: { file: WorkspaceFileRecord }) {
   const source = useFileContentSource()
+  const [hasSettled, setHasSettled] = useState(false)
   // Version the URL on updatedAt: overwrites keep the same storage key, so an unversioned
   // URL would resolve to a previously cached copy instead of the rewritten bytes.
   const serveUrl = source.buildUrl(file.key, {
@@ -14,14 +16,19 @@ export const ImagePreview = memo(function ImagePreview({ file }: { file: Workspa
   })
 
   return (
-    <ZoomablePreview className='flex flex-1' contentClassName='h-full w-full'>
-      <img
-        src={serveUrl}
-        alt={file.name}
-        className='max-h-full max-w-full select-none rounded-md object-contain'
-        draggable={false}
-        loading='eager'
-      />
-    </ZoomablePreview>
+    <div className='relative flex min-h-0 flex-1 flex-col'>
+      <ZoomablePreview className='flex flex-1' contentClassName='h-full w-full'>
+        <img
+          src={serveUrl}
+          alt={file.name}
+          className='max-h-full max-w-full select-none rounded-md object-contain'
+          draggable={false}
+          loading='eager'
+          onLoad={() => setHasSettled(true)}
+          onError={() => setHasSettled(true)}
+        />
+      </ZoomablePreview>
+      {!hasSettled && PREVIEW_LOADING_OVERLAY}
+    </div>
   )
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-shared.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-shared.tsx
index 4796ae6bb1e..041a0225074 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-shared.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/preview-shared.tsx
@@ -2,6 +2,7 @@
 
 import { Component, type ErrorInfo, type ReactNode } from 'react'
 import { cn } from '@sim/emcn'
+import { Loader } from '@sim/emcn/icons'
 import { createLogger } from '@sim/logger'
 
 const logger = createLogger('FilePreview')
@@ -87,13 +88,20 @@ export function resolvePreviewError(
   return renderError
 }
 
+/** Canonical content-area loading spinner, matching the rest of the app. */
+const PREVIEW_LOADING_SPINNER = (
+  <Loader className='size-[20px] text-[var(--text-secondary)]' animate />
+)
+
 /**
- * Canonical blank loading overlay for previews that render into a
- * `--surface-1` canvas. Absolutely covers the canvas (with `z-10` so it
- * paints above in-flow render targets) until the preview is ready.
+ * Canonical loading overlay for previews that render into a `--surface-1`
+ * canvas. Absolutely covers the canvas (with `z-10` so it paints above
+ * in-flow render targets) with a centered spinner until the preview is ready.
  */
 export const PREVIEW_LOADING_OVERLAY = (
-  <div className='absolute inset-0 z-10 bg-[var(--surface-1)]' />
+  <div className='absolute inset-0 z-10 flex items-center justify-center bg-[var(--surface-1)]'>
+    {PREVIEW_LOADING_SPINNER}
+  </div>
 )
 
 interface PreviewLoadingFrameProps {
@@ -104,14 +112,21 @@ interface PreviewLoadingFrameProps {
 }
 
 /**
- * Canonical in-flow blank loading frame shown while a preview is fetching or
- * rendering. The `tone` must match the background of the loaded state it is
- * standing in for, so mount completion does not flash a different token.
+ * Canonical in-flow loading frame with a centered spinner, shown while a
+ * preview is fetching or rendering. The `tone` must match the background of
+ * the loaded state it is standing in for, so mount completion does not flash
+ * a different token.
  */
 export function PreviewLoadingFrame({ className, tone = 'bg' }: PreviewLoadingFrameProps) {
   return (
     <div
-      className={cn(tone === 'surface' ? 'bg-[var(--surface-1)]' : 'bg-[var(--bg)]', className)}
-    />
+      className={cn(
+        'flex items-center justify-center',
+        tone === 'surface' ? 'bg-[var(--surface-1)]' : 'bg-[var(--bg)]',
+        className
+      )}
+    >
+      {PREVIEW_LOADING_SPINNER}
+    </div>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/code-block.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/code-block.tsx
index c17577c917b..7db9b1481b9 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/code-block.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/code-block.tsx
@@ -15,6 +15,7 @@ import { NodeViewContent, NodeViewWrapper, ReactNodeViewRenderer } from '@tiptap
 import { Check, ChevronDown, Code, Copy, Eye, WrapText } from 'lucide-react'
 import { looksLikeMermaid, MermaidDiagram } from '../mermaid-diagram'
 import { detectLanguage } from './detect-language'
+import { useEditorEditable } from './use-editor-editable'
 
 const PLAIN = 'plain'
 const MERMAID = 'mermaid'
@@ -59,6 +60,7 @@ function CodeBlockView({ node, updateAttributes, editor, getPos }: ReactNodeView
   const [editingInline, setEditingInline] = useState(false)
   const [peekSource, setPeekSource] = useState(false)
   const { copied, copy } = useCopyToClipboard({ resetMs: 1500 })
+  const editable = useEditorEditable(editor)
 
   const explicitLanguage = node.attrs.language as string | null
   const text = node.textContent
@@ -68,7 +70,7 @@ function CodeBlockView({ node, updateAttributes, editor, getPos }: ReactNodeView
   // diagram on blur (the Linear/GitHub model). The Show source / Show diagram control drives this by
   // focusing into / blurring the block; read-only uses {@link peekSource} since there is no caret.
   useEffect(() => {
-    if (!isMermaid || !editor.isEditable) {
+    if (!isMermaid || !editable) {
       setEditingInline(false)
       return
     }
@@ -91,9 +93,9 @@ function CodeBlockView({ node, updateAttributes, editor, getPos }: ReactNodeView
       editor.off('focus', sync)
       editor.off('blur', sync)
     }
-  }, [editor, getPos, isMermaid])
+  }, [editor, getPos, isMermaid, editable])
 
-  const showSource = editor.isEditable ? editingInline : peekSource
+  const showSource = editable ? editingInline : peekSource
   const showDiagram = isMermaid && text.trim().length > 0 && !showSource
 
   // Skip language detection on the mermaid path — the picker/label never render there.
@@ -104,7 +106,7 @@ function CodeBlockView({ node, updateAttributes, editor, getPos }: ReactNodeView
     'Plain text'
 
   const toggleSource = () => {
-    if (!editor.isEditable) {
+    if (!editable) {
       setPeekSource((value) => !value)
       return
     }
@@ -144,7 +146,7 @@ function CodeBlockView({ node, updateAttributes, editor, getPos }: ReactNodeView
           </button>
         )}
         {!isMermaid &&
-          (editor.isEditable ? (
+          (editable ? (
             // Editable: a language picker. Read-only: a static label — selecting a language calls
             // updateAttributes, which would mutate a doc that must not change.
             <DropdownMenu onOpenChange={setMenuOpen}>
@@ -179,7 +181,7 @@ function CodeBlockView({ node, updateAttributes, editor, getPos }: ReactNodeView
               {label}
             </span>
           ))}
-        {!isMermaid && editor.isEditable && (
+        {!isMermaid && editable && (
           <button
             type='button'
             aria-label='Toggle line wrap'
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/highlight.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/highlight.ts
index 948b75127f6..e2efa679d44 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/highlight.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/highlight.ts
@@ -13,7 +13,7 @@ import { Plugin } from '@tiptap/pm/state'
  * (`=(?!=)`) but never `==`, so a highlight over text containing `=` (e.g. `==a=b==`) round-trips while
  * the closing `==` still terminates the run.
  */
-const HIGHLIGHT_BODY = String.raw`(?:[^=]|=(?!=))+?`
+const HIGHLIGHT_BODY = `(?:[^=]|=(?!=))+?`
 const HIGHLIGHT_TOKEN = new RegExp(String.raw`^==(?!\s)(${HIGHLIGHT_BODY})(?<!\s)==`)
 /** Input/paste rule form (anchored on a preceding boundary) so typing `==x==` toggles the mark. */
 const HIGHLIGHT_INPUT = new RegExp(String.raw`(?:^|\s)(==(?!\s)(${HIGHLIGHT_BODY})(?<!\s)==)$`)
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.test.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.test.ts
index d782141e81c..fff5f035a81 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.test.ts
@@ -14,8 +14,10 @@ import {
   extractImgSrcs,
   findHostedImageAttrs,
   hasHostedImageHtml,
+  htmlReferencesSrc,
   isInlineRouteSrc,
   shouldSkipFileUpload,
+  toSameOriginPath,
 } from './image-paste'
 
 // jsdom lacks `elementFromPoint`; the Placeholder extension's viewport tracking calls it on mount.
@@ -288,3 +290,97 @@ describe('findHostedImageAttrs', () => {
     expect(originalAlt).toBe('photo')
   })
 })
+
+describe('origin-aware src normalization (browser-native drag/copy enrichment uses ABSOLUTE urls)', () => {
+  const ORIGIN = 'https://www.staging.sim.ai'
+
+  it('toSameOriginPath: relative passes through; same-origin absolute → path+query; cross-origin → null', () => {
+    expect(toSameOriginPath('/api/files/view/wf_a', ORIGIN)).toBe('/api/files/view/wf_a')
+    expect(toSameOriginPath(`${ORIGIN}/api/workspaces/ws-1/files/inline?fileId=wf_a`, ORIGIN)).toBe(
+      '/api/workspaces/ws-1/files/inline?fileId=wf_a'
+    )
+    expect(toSameOriginPath('https://evil.example.com/api/files/view/wf_a', ORIGIN)).toBeNull()
+  })
+
+  it('isInlineRouteSrc accepts the same-origin ABSOLUTE inline route (the real dragged-img src on staging)', () => {
+    expect(isInlineRouteSrc(`${ORIGIN}/api/workspaces/ws-1/files/inline?fileId=wf_a`, ORIGIN)).toBe(
+      true
+    )
+    expect(
+      isInlineRouteSrc(
+        'https://evil.example.com/api/workspaces/ws-1/files/inline?fileId=wf_a',
+        ORIGIN
+      )
+    ).toBe(false)
+  })
+
+  it('hasHostedImageHtml matches absolute same-origin srcs and rejects cross-origin ones', () => {
+    const isHosted = (src: string) => extractEmbeddedFileRef(src) !== null
+    expect(hasHostedImageHtml(`<img src="${ORIGIN}/api/files/view/wf_a">`, isHosted, ORIGIN)).toBe(
+      true
+    )
+    expect(
+      hasHostedImageHtml(
+        `<img src="${ORIGIN}/api/workspaces/ws-1/files/inline?fileId=wf_a">`,
+        isHosted,
+        ORIGIN
+      )
+    ).toBe(true)
+    expect(
+      hasHostedImageHtml(
+        '<img src="https://evil.example.com/api/files/view/wf_a">',
+        isHosted,
+        ORIGIN
+      )
+    ).toBe(false)
+  })
+
+  it('findHostedImageAttrs matches when the clipboard html carries the absolute rendered url', () => {
+    const ws = createWorkspaceFileContentSource('ws-1')
+    const editor = new Editor({
+      extensions: createMarkdownEditorExtensions({ placeholder: '' }),
+      content: {
+        type: 'doc',
+        content: [{ type: 'image', attrs: { src: '/api/files/view/wf_abc', alt: 'photo' } }],
+      },
+    })
+    const absolute = `${ORIGIN}/api/workspaces/ws-1/files/inline?fileId=wf_abc`
+    const match = findHostedImageAttrs(editor.state.doc, [absolute], ws.resolveImageSrc, ORIGIN)
+    expect(match?.src).toBe('/api/files/view/wf_abc')
+  })
+})
+
+describe('htmlReferencesSrc (the "this drop is MY dragged image" check)', () => {
+  const ORIGIN = 'https://www.staging.sim.ai'
+  const RESOLVED = '/api/workspaces/ws-1/files/inline?fileId=wf_a'
+
+  it('true when the html img src is the absolute form of the resolved src', () => {
+    expect(htmlReferencesSrc(`<img src="${ORIGIN}${RESOLVED}">`, RESOLVED, ORIGIN)).toBe(true)
+  })
+
+  it('true for the relative form too (ProseMirror-serialized html)', () => {
+    expect(htmlReferencesSrc(`<img src="${RESOLVED}">`, RESOLVED, ORIGIN)).toBe(true)
+  })
+
+  // Identity must work for cross-origin srcs too: a doc's image may legitimately point at a CDN or
+  // badge URL, and dragging THAT node to reorder it must still match — under the previous
+  // same-origin-path comparison it fell into the duplicate-upload branch instead.
+  it('matches an external (cross-origin) image against its own exact absolute url', () => {
+    const EXTERNAL = 'https://cdn.example.com/badge.svg'
+    expect(htmlReferencesSrc(`<img src="${EXTERNAL}">`, EXTERNAL, ORIGIN)).toBe(true)
+    expect(
+      htmlReferencesSrc('<img src="https://cdn.example.com/other.svg">', EXTERNAL, ORIGIN)
+    ).toBe(false)
+  })
+
+  it('false for a different image, empty html, missing resolved src, or cross-origin', () => {
+    expect(htmlReferencesSrc(`<img src="${ORIGIN}/api/other?fileId=wf_b">`, RESOLVED, ORIGIN)).toBe(
+      false
+    )
+    expect(htmlReferencesSrc('', RESOLVED, ORIGIN)).toBe(false)
+    expect(htmlReferencesSrc(`<img src="${ORIGIN}${RESOLVED}">`, undefined, ORIGIN)).toBe(false)
+    expect(
+      htmlReferencesSrc(`<img src="https://evil.example.com${RESOLVED}">`, RESOLVED, ORIGIN)
+    ).toBe(false)
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.ts
index d3bc170f317..c3edc938661 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image-paste.ts
@@ -13,27 +13,63 @@ export function extractImageFiles(transfer: DataTransfer | null): File[] {
     .filter((file): file is File => file !== null)
 }
 
-// `src` may be double-quoted, single-quoted, or (validly) unquoted per the HTML spec — the browser's
-// own clipboard serialization always quotes it, but other producers of `text/html` are not obligated
-// to.
+/**
+ * Matches `<img>` `src` attribute values: double-quoted, single-quoted, or (validly) unquoted per
+ * the HTML spec — the browser's own clipboard serialization always quotes it, but other producers
+ * of `text/html` are not obligated to.
+ */
 const IMG_SRC_RE = /<img\b[^>]*\bsrc\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/gi
+
+/** Query params under which the inline route addresses a workspace file. */
 const INLINE_ROUTE_QUERY_KEYS = new Set(['key', 'fileId'])
 
+/**
+ * The page's own origin — clipboard/dataTransfer srcs on any other origin are never ours.
+ * Deliberately `window.location.origin`, NOT `getBaseUrl()`: the browser serializes a dragged/copied
+ * `<img>`'s URL against the origin the page is ACTUALLY being viewed on, which can legitimately
+ * differ from the configured `NEXT_PUBLIC_APP_URL` (localhost dev against a shared env, preview
+ * deploys, apex-vs-www) — comparing against the configured URL would silently fail on any such
+ * origin, which is the exact bug class this normalization exists to fix.
+ */
+function runtimeOrigin(): string {
+  return typeof window === 'undefined' ? '' : window.location.origin
+}
+
+/**
+ * Normalizes a clipboard/dataTransfer img `src` to an origin-relative `pathname?query`, or `null`
+ * when it belongs to a different origin. The browser's NATIVE drag/copy enrichment (dragging or
+ * "Copy Image" on a rendered `<img>`) serializes the ABSOLUTE resolved URL —
+ * `https://host/api/workspaces/…/inline?…` — while everything the app compares against (persisted
+ * refs, `resolveImageSrc` output) is origin-relative, so both must be brought into the same space
+ * before comparing. A cross-origin src must never be treated as ours.
+ */
+export function toSameOriginPath(src: string, origin = runtimeOrigin()): string | null {
+  try {
+    const base = origin || 'http://placeholder'
+    const parsed = new URL(src, base)
+    if (parsed.origin !== base) return null
+    return parsed.pathname + parsed.search
+  } catch {
+    return null
+  }
+}
+
 /**
  * True for the *display-layer* inline route `resolveImageSrc` (see `use-file-content-source.tsx`)
  * rewrites an embed to — workspace-scoped `/api/workspaces/{workspaceId}/files/inline?key=…`/`?fileId=…`
  * or public-share-scoped `/api/files/public/{token}/inline?key=…`/`?fileId=…`. This is the shape
  * actually rendered into `<img src>`, and so what a same-page copy's `text/html` clipboard payload
- * actually contains — NOT the raw stored reference `extractEmbeddedFileRef` (in
- * `@/lib/uploads/utils/embedded-image-ref`) recognizes, which only matches the persisted `src` before
- * that rewrite. Checked separately from (rather than folded into) `extractEmbeddedFileRef` since that
- * helper is shared with server-side authorization/export code operating on persisted content, where
- * this display-only shape should never legitimately appear.
+ * actually contains (absolute — see {@link toSameOriginPath}) — NOT the raw stored reference
+ * `extractEmbeddedFileRef` (in `@/lib/uploads/utils/embedded-image-ref`) recognizes, which only
+ * matches the persisted `src` before that rewrite. Checked separately from (rather than folded into)
+ * `extractEmbeddedFileRef` since that helper is shared with server-side authorization/export code
+ * operating on persisted content, where this display-only shape should never legitimately appear.
  */
-export function isInlineRouteSrc(src: string): boolean {
+export function isInlineRouteSrc(src: string, origin = runtimeOrigin()): boolean {
+  const path = toSameOriginPath(src, origin)
+  if (path === null) return false
   try {
-    const parsed = new URL(src, 'http://placeholder')
-    if (parsed.origin !== 'http://placeholder') return false
+    const parsed = new URL(path, 'http://placeholder')
     if (!parsed.pathname.endsWith('/inline')) return false
     for (const key of parsed.searchParams.keys()) {
       if (INLINE_ROUTE_QUERY_KEYS.has(key)) return true
@@ -62,9 +98,53 @@ export function extractImgSrcs(html: string): string[] {
  * select it) makes the browser put BOTH `text/html` (the real serialized node, with its real hosted
  * `src`) AND a synthesized image `File` onto the clipboard — the same "drag a web image out" behavior
  * that {@link extractImageFiles} alone can't tell apart from a genuinely new external image paste.
+ * Srcs are normalized origin-relative first ({@link toSameOriginPath}): ProseMirror's own clipboard
+ * serialization writes the persisted relative src, but the BROWSER's native enrichment writes the
+ * absolute resolved URL.
  */
-export function hasHostedImageHtml(html: string, isHostedRef: (src: string) => boolean): boolean {
-  return extractImgSrcs(html).some((src) => isHostedRef(src) || isInlineRouteSrc(src))
+export function hasHostedImageHtml(
+  html: string,
+  isHostedRef: (src: string) => boolean,
+  origin = runtimeOrigin()
+): boolean {
+  return extractImgSrcs(html).some((src) => {
+    const path = toSameOriginPath(src, origin)
+    return path !== null && (isHostedRef(path) || isInlineRouteSrc(path, origin))
+  })
+}
+
+/** Resolves `src` to a full absolute URL against `origin`, or `null` when unparseable. */
+function toAbsoluteUrl(src: string, origin: string): string | null {
+  try {
+    return new URL(src, origin || 'http://placeholder').href
+  } catch {
+    return null
+  }
+}
+
+/**
+ * True when `html` contains an `<img>` whose src resolves to the same ABSOLUTE URL as
+ * `resolvedSrc` (a `resolveImageSrc` output for a node already in this document). This is the
+ * "that drop is MY dragged image" check for internal drag-reorder: TipTap's node-view dragstart
+ * bypasses ProseMirror's serialization entirely (no PM `text/html`, no `view.dragging`) but
+ * NodeSelects the dragged image, and the browser's native enrichment carries the absolute rendered
+ * URL of exactly that node.
+ *
+ * Deliberately compares full absolute URLs rather than same-origin paths ({@link toSameOriginPath}):
+ * identity is the question here, not hosted-by-us membership — a doc's image may legitimately have a
+ * cross-origin `src` (a README badge, a CDN image), and dragging THAT node to reorder it must match
+ * too, or it falls into the duplicate-upload path. Relative and absolute spellings of the same URL
+ * still compare equal because both sides resolve against the page origin.
+ */
+export function htmlReferencesSrc(
+  html: string,
+  resolvedSrc: string | undefined,
+  origin = runtimeOrigin()
+): boolean {
+  if (!html || !resolvedSrc) return false
+  const target = toAbsoluteUrl(resolvedSrc, origin)
+  if (target === null) return false
+  return extractImgSrcs(html).some((src) => toAbsoluteUrl(src, origin) === target)
 }
 
 /**
@@ -108,20 +188,26 @@ interface DescendantsDoc {
  * the clipboard/dataTransfer `html`, whose `src` is `resolveImageSrc`'s rewritten *display* URL, not the
  * real persisted one. Inserting a node built from that display URL would bake it into the document,
  * which public share/export/referenced-by-doc tracking don't recognize (they only match the persisted
- * shape) — this lookup avoids ever constructing such a node in the first place.
+ * shape) — this lookup avoids ever constructing such a node in the first place. Both sides of the
+ * comparison are normalized origin-relative ({@link toSameOriginPath}): the clipboard html may carry
+ * the browser's absolute URLs.
  */
 export function findHostedImageAttrs(
   doc: DescendantsDoc,
   targetSrcs: string[],
-  resolveImageSrc: (src: string | undefined) => string | undefined
+  resolveImageSrc: (src: string | undefined) => string | undefined,
+  origin = runtimeOrigin()
 ): Record<string, unknown> | null {
-  const targets = new Set(targetSrcs)
+  const targets = new Set(
+    targetSrcs.map((src) => toSameOriginPath(src, origin)).filter((p): p is string => p !== null)
+  )
   let found: Record<string, unknown> | null = null
   doc.descendants((node) => {
     if (found) return false
     if (node.type.name === 'image') {
       const resolved = resolveImageSrc(node.attrs.src as string | undefined)
-      if (resolved && targets.has(resolved)) {
+      const resolvedPath = resolved ? toSameOriginPath(resolved, origin) : null
+      if (resolvedPath && targets.has(resolvedPath)) {
         found = { ...node.attrs }
         return false
       }
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image.tsx
index 0e4f1dbb69b..fa198e8658e 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/image.tsx
@@ -2,10 +2,12 @@ import { useEffect, useRef, useState } from 'react'
 import { cn } from '@sim/emcn'
 import type { JSONContent } from '@tiptap/core'
 import { Image } from '@tiptap/extension-image'
+import { NodeSelection, Plugin } from '@tiptap/pm/state'
 import type { ReactNodeViewProps } from '@tiptap/react'
 import { NodeViewWrapper, ReactNodeViewRenderer } from '@tiptap/react'
 import { useFileContentSource } from '@/hooks/use-file-content-source'
 import { normalizeLinkHref } from './markdown-fidelity'
+import { useEditorEditable } from './use-editor-editable'
 
 const MIN_WIDTH = 64
 
@@ -168,7 +170,12 @@ function ResizableImageView({ node, updateAttributes, selected, editor }: ReactN
   const source = useFileContentSource()
   const imageRef = useRef<HTMLImageElement>(null)
   const dragAbortRef = useRef<AbortController | null>(null)
+  const dragWidthRef = useRef<number | null>(null)
   const [dragging, setDragging] = useState(false)
+  /** Live width during a resize drag; kept out of the doc so the whole resize is one undo step. */
+  const [dragWidth, setDragWidth] = useState<number | null>(null)
+  /** Whether the current src failed to load; reset on src change so a retried/edited src can load. */
+  const [failed, setFailed] = useState(false)
   const attrs = node.attrs as {
     src?: string
     alt?: string
@@ -178,6 +185,7 @@ function ResizableImageView({ node, updateAttributes, selected, editor }: ReactN
   }
 
   useEffect(() => () => dragAbortRef.current?.abort(), [])
+  useEffect(() => setFailed(false), [attrs.src])
 
   const startResize = (event: React.PointerEvent) => {
     event.preventDefault()
@@ -195,23 +203,34 @@ function ResizableImageView({ node, updateAttributes, selected, editor }: ReactN
       'pointermove',
       (move) => {
         const next = Math.max(MIN_WIDTH, Math.round(startWidth + (move.clientX - startX)))
-        updateAttributes({ width: String(next) })
-      },
-      { signal }
-    )
-    window.addEventListener(
-      'pointerup',
-      () => {
-        setDragging(false)
-        controller.abort()
+        dragWidthRef.current = next
+        setDragWidth(next)
       },
       { signal }
     )
+    const finish = () => {
+      const finalWidth = dragWidthRef.current
+      setDragging(false)
+      setDragWidth(null)
+      dragWidthRef.current = null
+      controller.abort()
+      if (finalWidth !== null) updateAttributes({ width: String(finalWidth) })
+    }
+    window.addEventListener('pointerup', finish, { signal })
+    window.addEventListener('pointercancel', finish, { signal })
   }
 
-  const widthStyle = attrs.width
-    ? { width: /^\d+$/.test(attrs.width) ? `${attrs.width}px` : attrs.width }
+  const committedWidth = attrs.width
+    ? /^\d+$/.test(attrs.width)
+      ? `${attrs.width}px`
+      : attrs.width
     : undefined
+  const widthStyle =
+    dragWidth !== null
+      ? { width: `${dragWidth}px` }
+      : committedWidth
+        ? { width: committedWidth }
+        : undefined
 
   // Sanitize the linked-image target before rendering the anchor — a parsed markdown href is
   // untrusted and could be `javascript:`/`data:`; an unsafe value drops the link (image only).
@@ -219,7 +238,7 @@ function ResizableImageView({ node, updateAttributes, selected, editor }: ReactN
 
   // Read-only: no drag-to-reorder and no resize handle — both call updateAttributes / dispatch a move,
   // mutating a doc that must not change. The image still renders (and follows its link on click).
-  const editable = editor.isEditable
+  const editable = useEditorEditable(editor)
 
   const image = (
     <img
@@ -233,9 +252,13 @@ function ResizableImageView({ node, updateAttributes, selected, editor }: ReactN
       draggable={editable}
       data-drag-handle={editable ? '' : undefined}
       style={widthStyle}
+      onError={() => setFailed(true)}
+      onLoad={() => setFailed(false)}
       className={cn(
         'block max-w-full rounded-lg border border-[var(--border)]',
-        editable && 'cursor-grab'
+        editable && 'cursor-grab',
+        failed &&
+          'min-h-[72px] min-w-[140px] bg-[var(--surface-5)] p-3 text-[var(--text-muted)] text-caption'
       )}
     />
   )
@@ -275,4 +298,28 @@ export const ResizableImage = MarkdownImage.extend({
   addNodeView() {
     return ReactNodeViewRenderer(ResizableImageView)
   },
+  /**
+   * Guarantee a plain click on the image forms a node selection. The image body is also a native drag
+   * source (grab-anywhere reorder), and while prosemirror-view ≥1.32.4 no longer implicitly selects on
+   * drag, the reverse — a click reliably selecting — is not guaranteed for an atom whose body competes
+   * with the drag gesture (see the ProseMirror "Draggable and NodeViews" discussion and TipTap #4526).
+   * Selecting here makes it deterministic while leaving drag-to-reorder intact. Read-only clicks and
+   * modified clicks (Cmd/Ctrl to follow a linked badge, Shift/Alt to extend) fall through to the editor's
+   * `handleClick` / default behavior.
+   */
+  addProseMirrorPlugins() {
+    const nodeName = this.name
+    return [
+      new Plugin({
+        props: {
+          handleClickOn(view, _pos, node, nodePos, event) {
+            if (!view.editable || node.type.name !== nodeName) return false
+            if (event.metaKey || event.ctrlKey || event.shiftKey || event.altKey) return false
+            view.dispatch(view.state.tr.setSelection(NodeSelection.create(view.state.doc, nodePos)))
+            return true
+          },
+        },
+      }),
+    ]
+  },
 })
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.test.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.test.ts
index 862414f9fd6..b9392de02c8 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.test.ts
@@ -7,6 +7,7 @@
  * keymap's `isSuggestionMenuOpen` guard reads flips on when a menu opens.
  */
 import { Editor } from '@tiptap/core'
+import { GapCursor } from '@tiptap/pm/gapcursor'
 import { AllSelection, NodeSelection } from '@tiptap/pm/state'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 import { createMarkdownEditorExtensions } from './editor-extensions'
@@ -195,6 +196,103 @@ describe('empty wrapped-block Backspace', () => {
       editor.destroy()
     }
   )
+
+  it('leaves a gap cursor — never a NodeSelection — when the removed bullet was followed by an image at doc start', () => {
+    // Regression: `Selection.near` after the delete silently NodeSelected the following image, so a
+    // second Backspace while "clearing the bullet" deleted the image (and typing would have replaced
+    // it). The selection left behind must never make the next keystroke destructive.
+    const editor = editorWith({
+      type: 'doc',
+      content: [
+        { type: 'bulletList', content: [{ type: 'listItem', content: [{ type: 'paragraph' }] }] },
+        { type: 'image', attrs: { src: '/api/files/view/wf_img', alt: 'photo' } },
+      ],
+    })
+    editor.commands.setTextSelection(3)
+    pressBackspace(editor)
+
+    expect(blockShape(editor)).toEqual(['image', 'paragraph'])
+    expect(editor.state.selection).not.toBeInstanceOf(NodeSelection)
+
+    pressBackspace(editor)
+    expect(blockShape(editor)).toEqual(['image', 'paragraph'])
+    editor.destroy()
+  })
+
+  it('does not crash on Backspace from a gap cursor (top-level selection, depth 0)', () => {
+    // Regression: `$from.before($from.depth)` with a gap cursor's depth of 0 threw
+    // "RangeError: There is no position before the top-level node" — reachable whenever a gap
+    // cursor sits between two leaves (the `data-gap-between-leaves` state) and Backspace is pressed.
+    const editor = editorWith('<hr><hr>')
+    const gapPos = editor.state.doc.firstChild ? editor.state.doc.firstChild.nodeSize : 1
+    editor.view.dispatch(
+      editor.state.tr.setSelection(new GapCursor(editor.state.doc.resolve(gapPos)))
+    )
+    expect(editor.state.selection).toBeInstanceOf(GapCursor)
+
+    expect(() => pressBackspace(editor)).not.toThrow()
+    // TipTap appends a trailing paragraph after the final leaf; the dividers must both survive.
+    expect(blockShape(editor)).toEqual(['horizontalRule', 'horizontalRule', 'paragraph'])
+    editor.destroy()
+  })
+
+  it('never NodeSelects a leaf BEFORE the removed bullet either (findFrom textOnly skips atoms)', () => {
+    // `Selection.findFrom($gap, -1, true)` cannot return a NodeSelection: with textOnly,
+    // prosemirror-state's findSelectionIn skips atoms entirely (`!text && isSelectable`). With an
+    // image directly before the emptied bullet and no textblock behind it, the backward search
+    // returns null and the gap-cursor branch takes over — the image is never silently selected.
+    const editor = editorWith({
+      type: 'doc',
+      content: [
+        { type: 'image', attrs: { src: '/api/files/view/wf_img', alt: 'photo' } },
+        { type: 'bulletList', content: [{ type: 'listItem', content: [{ type: 'paragraph' }] }] },
+      ],
+    })
+    editor.commands.setTextSelection(4)
+    expect(editor.state.selection.$from.parent.type.name).toBe('paragraph')
+    pressBackspace(editor)
+
+    expect(blockShape(editor)).toEqual(['image', 'paragraph'])
+    expect(editor.state.selection).not.toBeInstanceOf(NodeSelection)
+
+    pressBackspace(editor)
+    expect(blockShape(editor)).toEqual(['image', 'paragraph'])
+    editor.destroy()
+  })
+
+  it('does not crash on Backspace from a gap cursor at the very start of the doc', () => {
+    // Depth-0 + offset-0 is the worst case: our old code threw before(0), and TipTap's blockquote
+    // handler crashes on $from.node(-1) if the key falls through — so it must be consumed.
+    const editor = editorWith({
+      type: 'doc',
+      content: [{ type: 'image', attrs: { src: '/api/files/view/wf_img', alt: 'photo' } }],
+    })
+    editor.view.dispatch(editor.state.tr.setSelection(new GapCursor(editor.state.doc.resolve(0))))
+    expect(editor.state.selection).toBeInstanceOf(GapCursor)
+
+    expect(() => pressBackspace(editor)).not.toThrow()
+    expect(blockShape(editor)).toEqual(['image', 'paragraph'])
+    editor.destroy()
+  })
+
+  it('still prefers the previous textblock caret when one exists (image after the bullet untouched)', () => {
+    const editor = editorWith({
+      type: 'doc',
+      content: [
+        { type: 'paragraph', content: [{ type: 'text', text: 'hello' }] },
+        { type: 'bulletList', content: [{ type: 'listItem', content: [{ type: 'paragraph' }] }] },
+        { type: 'image', attrs: { src: '/api/files/view/wf_img', alt: 'photo' } },
+      ],
+    })
+    editor.commands.setTextSelection(10)
+    pressBackspace(editor)
+
+    expect(blockShape(editor)).toEqual(['paragraph', 'image', 'paragraph'])
+    expect(editor.state.selection.empty).toBe(true)
+    expect(editor.state.selection).not.toBeInstanceOf(NodeSelection)
+    expect(editor.state.selection.$from.parent.textContent).toBe('hello')
+    editor.destroy()
+  })
 })
 
 describe('empty list-item Enter', () => {
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.ts
index 3034fd66fe6..0d5bc22801c 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/keymap.ts
@@ -35,6 +35,14 @@ function isInsideWrapper($from: ResolvedPos): boolean {
  * container and strand an empty paragraph (a visible gap, and markdown that re-parses to a different
  * document). Walking up while `childCount === 1` deletes the whole now-empty wrapper (the emptied list
  * item, not just its paragraph) so no orphan `<li>` or empty continuation line is left behind.
+ *
+ * The selection left behind must be a CARET, never a NodeSelection: `Selection.near` can silently
+ * land a NodeSelection on an adjacent leaf (deleting the sole bullet at the top of a doc whose next
+ * block is an image selected that image), turning the user's next keystroke destructive — a second
+ * Backspace while "clearing the bullet" deleted the image, and typing would have replaced it. So:
+ * end of the previous textblock first; else a gap cursor at the deletion point when the neighbour is
+ * a leaf (typing there inserts a new block where the emptied one was, instead of replacing the leaf);
+ * else the next textblock.
  */
 function removeEmptyWrappedBlock(editor: Editor, $from: ResolvedPos): boolean {
   let depth = $from.depth
@@ -44,13 +52,31 @@ function removeEmptyWrappedBlock(editor: Editor, $from: ResolvedPos): boolean {
   return editor.commands.command(({ tr, dispatch }) => {
     if (dispatch) {
       tr.delete(start, end)
-      tr.setSelection(Selection.near(tr.doc.resolve(start), -1))
+      const $gap = tr.doc.resolve(start)
+      tr.setSelection(
+        Selection.findFrom($gap, -1, true) ??
+          (isLeafGap($gap) ? new GapCursor($gap) : null) ??
+          Selection.findFrom($gap, 1, true) ??
+          Selection.near($gap, -1)
+      )
       dispatch(tr.scrollIntoView())
     }
     return true
   })
 }
 
+/**
+ * True when `$pos` is a block boundary a gap cursor is valid at in this schema: the following node is
+ * a selectable leaf (divider/image) and there is nothing before it, or another leaf — i.e. no textblock
+ * on either side for a normal caret to land in.
+ */
+function isLeafGap($pos: ResolvedPos): boolean {
+  const after = $pos.nodeAfter
+  if (!after || !SELECTABLE_LEAVES.has(after.type.name)) return false
+  const before = $pos.nodeBefore
+  return !before || SELECTABLE_LEAVES.has(before.type.name)
+}
+
 /**
  * True while a `/` or `@` suggestion menu is open. Arrow keys must reach that menu's own handler, so
  * the leaf-selection shortcuts below yield rather than stealing the key to select an adjacent divider.
@@ -146,6 +172,11 @@ export const RichMarkdownKeymap = Extension.create({
         const { selection, doc } = editor.state
         if (!selection.empty || selection.$from.parentOffset !== 0) return false
         const { $from } = selection
+        // A gap cursor at the start of the doc resolves at the top level (`depth === 0`, offset 0):
+        // `$from.before(0)` below throws, and falling through instead is no better — TipTap's
+        // blockquote Backspace handler crashes on the same resolution (`$from.node(-1)` is
+        // undefined). There is nothing before the gap for Backspace to act on, so consume the key.
+        if ($from.depth === 0) return true
         if ($from.parent.type.name === 'heading') {
           return editor.commands.setParagraph()
         }
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-fidelity.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-fidelity.ts
index e8d76cbf209..f416482d491 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-fidelity.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-fidelity.ts
@@ -8,6 +8,33 @@ const BOM = '\uFEFF'
 const FRONTMATTER_REGEX = /^---\r?\n(?:[\s\S]*?\r?\n)?---[ \t]*(?:\r?\n)*/
 const ESCAPED_CALLOUT_REGEX = /^(\s*>(?:\s*>)*\s*)\\\[!([A-Za-z]+)\\\]/gm
 
+/**
+ * Alternates a code region (fenced block or inline span \u2014 never rewritten) with an inline link whose
+ * destination has no title and isn't angle-bracketed. The code branch is listed first so a link inside
+ * code is consumed as code and left untouched. The destination stops at `)` / whitespace, so a link
+ * carrying a title (`[x](url "t")`) never matches and is preserved verbatim.
+ */
+const CODE_OR_PLAIN_LINK_REGEX =
+  /(```[\s\S]*?```|~~~[\s\S]*?~~~|`[^`\n]+`)|\[([^\]]+)]\(([^)\s<>]+)\)/g
+const HTTP_URL_REGEX = /^https?:\/\/\S+$/i
+
+/**
+ * Collapses an autolinked destination back to its bare form: our normalizing serializer rewrites a bare
+ * URL or `<url>` autolink to `[url](url)` and a bare email to `[a@b.com](mailto:a@b.com)`, which churns
+ * every README's links into explicit-link syntax on the first save. When the visible text already equals
+ * the destination (a plain `http(s)` URL, or an email behind `mailto:`), GFM re-autolinks the bare form,
+ * so emitting it round-trips identically with a far quieter diff. Links inside code and titled links are
+ * left untouched (see {@link CODE_OR_PLAIN_LINK_REGEX}).
+ */
+function collapseAutolinkedUrls(markdown: string): string {
+  return markdown.replace(CODE_OR_PLAIN_LINK_REGEX, (match, code, text, href) => {
+    if (code) return code
+    if (text === href && HTTP_URL_REGEX.test(href)) return href
+    if (href === `mailto:${text}`) return text
+    return match
+  })
+}
+
 export interface SplitMarkdown {
   /** Out-of-band leading prefix (a BOM and/or the frontmatter block), byte-exact, or `''`. */
   frontmatter: string
@@ -87,5 +114,8 @@ export function normalizeLinkHref(href: string): string {
  * begins with whitespace.
  */
 export function postProcessSerializedMarkdown(markdown: string): string {
-  return markdown.replace(ESCAPED_CALLOUT_REGEX, '$1[!$2]').replace(/\n+$/, '\n')
+  return collapseAutolinkedUrls(markdown.replace(ESCAPED_CALLOUT_REGEX, '$1[!$2]')).replace(
+    /\n+$/,
+    '\n'
+  )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
index b428f01a4da..ade11c88e36 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.test.ts
@@ -255,3 +255,63 @@ describe('markdown paste', () => {
     expect(transformHtml(editor, '<script>x<script>y</script>')).toBe('')
   })
 })
+
+describe('linkify a selection on URL paste', () => {
+  function linkify(
+    pasted: string,
+    from = 1,
+    to = 10
+  ): { handled: boolean; href?: string; text: string } {
+    editor = mount()
+    editor.commands.setContent('select me here', { contentType: 'markdown' })
+    editor.commands.setTextSelection({ from, to })
+    const handled = paste(editor, pasted)
+    return {
+      handled,
+      href: JSON.stringify(editor.getJSON()).match(/"href":"([^"]+)"/)?.[1],
+      text: editor.getText(),
+    }
+  }
+
+  it('wraps a non-empty text selection in a link when a URL is pasted (keeping the text)', () => {
+    const r = linkify('https://sim.ai')
+    expect(r.handled).toBe(true)
+    expect(r.href).toBe('https://sim.ai')
+    expect(r.text).toBe('select me here')
+  })
+
+  it('prepends https:// to a bare www host and mailto: to a bare email', () => {
+    expect(linkify('www.sim.ai').href).toBe('https://www.sim.ai')
+    expect(linkify('a@b.com').href).toBe('mailto:a@b.com')
+  })
+
+  it('does not linkify a collapsed caret (empty selection)', () => {
+    const r = linkify('https://sim.ai', 5, 5)
+    expect(r.handled).toBe(false)
+  })
+
+  it('does not linkify a multi-word paste over a selection', () => {
+    expect(linkify('not a url just words').handled).toBe(false)
+  })
+
+  it('does not linkify an unsafe javascript: url', () => {
+    const r = linkify('javascript:alert(1)')
+    expect(r.handled).toBe(false)
+    expect(r.href).toBeUndefined()
+  })
+
+  it('links a real mailto: but not a crafted mailto: payload', () => {
+    expect(linkify('mailto:a@b.com').href).toBe('mailto:a@b.com')
+    const crafted = linkify('mailto:javascript:alert(1)')
+    expect(crafted.handled).toBe(false)
+    expect(crafted.href).toBeUndefined()
+  })
+
+  it('does not linkify a selection spanning multiple blocks', () => {
+    editor = mount()
+    editor.commands.setContent('alpha\n\nbeta', { contentType: 'markdown' })
+    editor.commands.setTextSelection({ from: 3, to: 9 })
+    expect(paste(editor, 'https://sim.ai')).toBe(false)
+    expect(JSON.stringify(editor.getJSON())).not.toContain('"type":"link"')
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
index fc138df8354..74a567f2bed 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/markdown-paste.ts
@@ -1,7 +1,30 @@
 import { Extension } from '@tiptap/core'
 import { Plugin } from '@tiptap/pm/state'
+import { normalizeLinkHref } from './markdown-fidelity'
 import { parseMarkdownToDoc } from './markdown-parse'
 
+/**
+ * A single link the paste can wrap a selection in: an http(s) URL, a `mailto:` to a real address, a bare
+ * `www.` host, or a bare email. `mailto:` requires an actual `user@host.tld` payload so a crafted value
+ * like `mailto:javascript:…` (no `@`) never matches and falls through to a normal paste.
+ */
+const HTTP_URL = /^https?:\/\/\S+$/i
+const EMAIL = /^[^\s@]+@[^\s@]+\.[^\s@]+$/
+const MAILTO_URL = /^mailto:[^\s@]+@[^\s@]+\.[^\s@]+$/i
+const BARE_WWW = /^www\.\S+\.\S+$/i
+
+/**
+ * If pasted text is a single link, return the href to wrap a selection in — `www.` gets `https://`, a
+ * bare email gets `mailto:`. Returns null for anything else (a multi-word or non-URL paste falls through
+ * to normal insertion). The caller still runs the result through `normalizeLinkHref` for scheme safety.
+ */
+function pastedLinkHref(text: string): string | null {
+  if (HTTP_URL.test(text) || MAILTO_URL.test(text)) return text
+  if (BARE_WWW.test(text)) return `https://${text}`
+  if (EMAIL.test(text)) return `mailto:${text}`
+  return null
+}
+
 /**
  * Structural markdown — strong signals the plain text is genuinely markdown (a link, image, badge,
  * list, heading, blockquote, fenced block, or GFM table). Our parser round-trips these more faithfully
@@ -143,11 +166,21 @@ export const MarkdownPaste = Extension.create({
       new Plugin({
         props: {
           transformPastedHTML: (html) => stripNonContentHtml(html),
-          handlePaste: (_view, event) => {
+          handlePaste: (view, event) => {
             if (!editor.isEditable) return false
             if (editor.isActive('codeBlock') || editor.isActive('code')) return false
             const text = event.clipboardData?.getData('text/plain')
             if (!text) return false
+            const { selection } = view.state
+            if (
+              !selection.empty &&
+              selection.$from.sameParent(selection.$to) &&
+              selection.$from.parent.inlineContent
+            ) {
+              const href = pastedLinkHref(text.trim())
+              const safeHref = href ? normalizeLinkHref(href) : ''
+              if (safeHref) return editor.commands.setLink({ href: safeHref })
+            }
             const language = parseVscodeLanguage(event.clipboardData?.getData('vscode-editor-data'))
             if (language) {
               return editor.commands.insertContent({
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-chip.test.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-chip.test.tsx
new file mode 100644
index 00000000000..e91226d8757
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-chip.test.tsx
@@ -0,0 +1,81 @@
+/**
+ * @vitest-environment jsdom
+ *
+ * The chip label must never carry its own explicit text color — see the comment on `CHIP_CLASS` in
+ * `mention-chip.tsx`. An element's own explicit `color` always wins over an inherited one regardless
+ * of ancestor specificity, so hardcoding a color here would silently override any ambient color a
+ * mention's container legitimately sets (a link's blue, an `h6` heading's dimmer `--text-secondary`) —
+ * the same bug class already fixed for `strong`/`em`/`code` in `rich-markdown-editor.css`.
+ */
+import { act } from 'react'
+import type { Editor } from '@tiptap/react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, describe, expect, it, vi } from 'vitest'
+
+vi.mock('next/navigation', () => ({
+  useRouter: () => ({ push: vi.fn() }),
+  useParams: () => ({}),
+}))
+
+// Override the global `getAllBlocks: () => ({})` stub — `getIconColorMap` iterates it as an array.
+vi.mock('@/blocks/registry', () => ({
+  getAllBlocks: () => [],
+}))
+
+const { MentionChipView } = await import('./mention-chip')
+
+function fakeNode(attrs: Record<string, unknown>) {
+  return { attrs } as unknown as Parameters<typeof MentionChipView>[0]['node']
+}
+
+function fakeEditor(): Editor {
+  return { storage: { mention: { navigable: false } } } as unknown as Editor
+}
+
+let container: HTMLDivElement | null = null
+let root: Root | null = null
+
+afterEach(() => {
+  if (root) act(() => root?.unmount())
+  container?.remove()
+  container = null
+  root = null
+})
+
+describe('MentionChipView', () => {
+  it('renders its wrapper with no explicit text-color utility class', async () => {
+    ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+    container = document.createElement('div')
+    document.body.appendChild(container)
+    root = createRoot(container)
+
+    await act(async () => {
+      root?.render(
+        MentionChipView({
+          node: fakeNode({ kind: 'file', id: 'f1', label: 'notes.md' }),
+          editor: fakeEditor(),
+        } as Parameters<typeof MentionChipView>[0])
+      )
+    })
+
+    const chip = container.querySelector('.mention-chip') as HTMLElement
+    expect(chip).not.toBeNull()
+
+    // Any `text-*` utility targeting the wrapper itself — bare, or Tailwind's self-targeting
+    // `[&]:text-*` arbitrary variant (as opposed to a descendant variant like `[&>svg]:text-*`,
+    // which the icon rule below legitimately uses) — would regress this fix, not just the specific
+    // old `text-[var(--text-primary)]` class. Rather than enumerate every Tailwind color-naming
+    // scheme (arbitrary value, shade-suffixed, semantic theme tokens like `text-primary`/
+    // `text-muted-foreground`, keywords), flag ANY such token: none is legitimate on this wrapper
+    // today, so this can only ever be a color utility slipping back in. A genuinely new, non-color
+    // `text-*` need (e.g. a font-size utility) should fail this test and force an explicit update,
+    // not be silently allowed through.
+    const ownTextUtilities = chip.className
+      .split(/\s+/)
+      .filter((cls) => cls.startsWith('text-') || cls.startsWith('[&]:text-'))
+    expect(ownTextUtilities).toEqual([])
+
+    // The icon's own monochrome fallback is unrelated and must be untouched by this fix.
+    expect(chip.className).toContain('[&>svg]:text-[var(--text-icon)]')
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-chip.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-chip.tsx
index d64d5e4958e..b851c2a86fa 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-chip.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-chip.tsx
@@ -15,9 +15,16 @@ import { simLinkPath } from './sim-link'
  * color, and a 12px icon. Integration icons keep their brand color via
  * {@link getBareIconStyle} (see {@link MentionChipView}); other kinds stay
  * monochrome through the `--text-icon` fallback below.
+ *
+ * No explicit label color — an element's own explicit `color` always wins over an inherited one
+ * regardless of ancestor specificity, so hardcoding `--text-primary` here (redundant with the prose
+ * default anyway) would silently override any ambient color a ancestor legitimately sets — a link's
+ * blue, or `h6`'s dimmer `--text-secondary` — since a mention is inline content and can appear inside
+ * either. Omitting it lets the label inherit correctly in both cases, same fix as `strong`/`em`/`code`
+ * in rich-markdown-editor.css.
  */
 const CHIP_CLASS =
-  'mention-chip mx-px inline-flex items-center gap-1 align-middle text-[var(--text-primary)] leading-[1.5] [&>svg]:size-[12px] [&>svg]:shrink-0 [&>svg]:text-[var(--text-icon)]'
+  'mention-chip mx-px inline-flex items-center gap-1 align-middle leading-[1.5] [&>svg]:size-[12px] [&>svg]:shrink-0 [&>svg]:text-[var(--text-icon)]'
 
 /**
  * Live chip: an entity icon + label matching the chat input's mention rendering. Where the host opted
@@ -25,7 +32,7 @@ const CHIP_CLASS =
  * inert so a click can't navigate away from an unsaved edit. This view pulls the block registry (for
  * integration brand icons), so it's kept out of the headless {@link MarkdownMention} module.
  */
-function MentionChipView({ node, editor }: ReactNodeViewProps) {
+export function MentionChipView({ node, editor }: ReactNodeViewProps) {
   const router = useRouter()
   const params = useParams()
   const { kind, id, label } = node.attrs as MentionAttrs
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/rich-markdown-editor.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/rich-markdown-editor.tsx
index 5057c835af9..9107dbd795d 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/rich-markdown-editor.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/rich-markdown-editor.tsx
@@ -3,6 +3,9 @@
 import { memo, useEffect, useRef, useState } from 'react'
 import { cn, toast } from '@sim/emcn'
 import type { JSONContent } from '@tiptap/core'
+import { Fragment, Slice } from '@tiptap/pm/model'
+import { NodeSelection } from '@tiptap/pm/state'
+import { dropPoint } from '@tiptap/pm/transform'
 import type { Editor } from '@tiptap/react'
 import { EditorContent, useEditor } from '@tiptap/react'
 import { useRouter } from 'next/navigation'
@@ -19,6 +22,7 @@ import {
   extractImageFiles,
   extractImgSrcs,
   findHostedImageAttrs,
+  htmlReferencesSrc,
   shouldSkipFileUpload,
 } from './image-paste'
 import {
@@ -216,6 +220,8 @@ export function LoadedRichMarkdownEditor({
   const uploadFile = useUploadWorkspaceFile()
   const editorInstanceRef = useRef<Editor | null>(null)
   const source = useFileContentSource()
+  const resolveImageSrcRef = useRef(source.resolveImageSrc)
+  resolveImageSrcRef.current = source.resolveImageSrc
 
   /**
    * The `/Image` slash command opens this hidden picker; `pendingImagePosRef` holds the caret position
@@ -367,22 +373,58 @@ export function LoadedRichMarkdownEditor({
        * the browser doesn't navigate away from the editor; internal text drags carry no files and fall
        * through to the default behavior.
        *
-       * Dragging an existing image node to reorder it is also an internal drag, but the browser's
-       * native drag-and-drop synthesizes an image `File` into `event.dataTransfer` for a dragged `<img>`
-       * (the same mechanism that lets a user drag a web image out to their desktop) — indistinguishable
-       * from a real external drop by `dataTransfer` files/items alone. When the accompanying `text/html`
-       * shows it's a same-page drag of an already-hosted image, bail out and let ProseMirror's own
-       * default move logic run — it relocates the actual existing node object (`dragging.node`), never
-       * re-parsing html, so (unlike the paste case above) there's no display-vs-persisted src risk here.
-       * Checked from `html`, not `view.dragging`, so a stale `dragging` flag (ProseMirror clears it up
-       * to ~50ms late via `dragend` when a prior internal drag was dropped outside this view) can never
-       * suppress the plain-file swallow guard below for an unrelated drop that happens to land in that
-       * window — this only reacts to what THIS specific drop's `html` actually contains.
+       * Drag-REORDER of an image node is the deceptive case. TipTap's node-view dragstart bypasses
+       * ProseMirror's own drag serialization entirely — no PM `text/html`, no `view.dragging` — but it
+       * DOES NodeSelect the dragged image; what the drop carries instead is the browser's native
+       * enrichment for a dragged `<img>`: an image `File` plus `text/html` whose src is the ABSOLUTE
+       * rendered URL of that exact node. So when the drop's html points at the currently-selected image
+       * node ({@link htmlReferencesSrc}), this drop IS that node being moved, and the move must be
+       * performed here: uploading would duplicate it (the original never moves), and falling through to
+       * ProseMirror is no better — with `view.dragging` unset its default drop PARSES the html into a
+       * copy (persisting the display-layer src, which share/export tracking don't recognize) and never
+       * deletes the original. The gate accepts at most one file (not exactly one): some drag transports
+       * (e.g. CDP-driven input) carry the html alone, and a genuinely external drop can never reference
+       * the currently-selected node's own resolved src.
+       *
+       * The move itself is the same shape as ProseMirror's own: compute the drop point on the
+       * pre-delete doc, delete the source, map the insert position through that delete. A null
+       * `dropPoint` (no valid insertion point) is a handled no-op — the node stays put, still
+       * selected — never a raw-position fallback, which `tr.insert` could throw on (PM's own null
+       * fallback is only safe because it uses the forgiving `replaceRangeWith`).
+       *
+       * PM-serialized drags (a text selection spanning an image, dragged from a textblock) still reach
+       * the `shouldSkipFileUpload` bail below: PM set `view.dragging` for those itself, so its default
+       * move logic is correct there.
        */
       handleDrop: (view, event) => {
         if (!view.editable) return false
         const images = extractImageFiles(event.dataTransfer)
         const html = event.dataTransfer?.getData('text/html') ?? ''
+        const { selection } = view.state
+        if (
+          images.length <= 1 &&
+          selection instanceof NodeSelection &&
+          selection.node.type.name === 'image' &&
+          htmlReferencesSrc(html, resolveImageSrcRef.current(selection.node.attrs.src))
+        ) {
+          event.preventDefault()
+          const coords = view.posAtCoords({ left: event.clientX, top: event.clientY })
+          if (!coords) return true
+          const node = selection.node
+          const tr = view.state.tr
+          const insertPos = dropPoint(
+            view.state.doc,
+            coords.pos,
+            new Slice(Fragment.from(node), 0, 0)
+          )
+          if (insertPos === null) return true
+          tr.delete(selection.from, selection.to)
+          const mapped = tr.mapping.map(insertPos)
+          tr.insert(mapped, node)
+          tr.setSelection(NodeSelection.create(tr.doc, mapped))
+          view.dispatch(tr.scrollIntoView())
+          return true
+        }
         if (shouldSkipFileUpload(images, html, (src) => extractEmbeddedFileRef(src) !== null)) {
           return false
         }
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/round-trip.test.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/round-trip.test.ts
index eb6aa03a71a..c8745e5e861 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/round-trip.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/round-trip.test.ts
@@ -501,3 +501,37 @@ describe('highlight ==mark==', () => {
     expect(markPresent('a == b == c')).toBe(false)
   })
 })
+
+describe('autolink / bare-URL preservation', () => {
+  it('keeps a bare URL bare instead of rewriting it to [url](url)', () => {
+    expect(roundTrip('visit https://sim.ai today').trim()).toBe('visit https://sim.ai today')
+    expect(roundTrip('both https://a.com and https://b.com').trim()).toBe(
+      'both https://a.com and https://b.com'
+    )
+  })
+
+  it('collapses an angle autolink and a bare email to their bare form', () => {
+    expect(roundTrip('see <https://sim.ai> here').trim()).toBe('see https://sim.ai here')
+    expect(roundTrip('mail <a@b.com> now').trim()).toBe('mail a@b.com now')
+  })
+
+  it('preserves explicit and titled links (only bare autolinks collapse)', () => {
+    expect(roundTrip('[Sim](https://sim.ai)').trim()).toBe('[Sim](https://sim.ai)')
+    expect(roundTrip('[https://a.com](https://b.com)').trim()).toBe(
+      '[https://a.com](https://b.com)'
+    )
+    expect(roundTrip('[text](https://x.com "t")').trim()).toBe('[text](https://x.com "t")')
+  })
+
+  it('never collapses a URL that only appears inside code', () => {
+    expect(roundTrip('```\nvisit https://sim.ai\n```').trim()).toBe(
+      '```\nvisit https://sim.ai\n```'
+    )
+    expect(roundTrip('inline `https://sim.ai` code').trim()).toBe('inline `https://sim.ai` code')
+  })
+
+  it('round-trips a bare URL idempotently', () => {
+    const once = roundTrip('go to https://sim.ai now')
+    expect(roundTrip(once)).toBe(once)
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/use-editor-editable.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/use-editor-editable.ts
new file mode 100644
index 00000000000..eec3adc2fa5
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/use-editor-editable.ts
@@ -0,0 +1,27 @@
+import { useEffect, useState } from 'react'
+import type { Editor } from '@tiptap/react'
+
+/**
+ * Reactively tracks `editor.isEditable` for React node views.
+ *
+ * The editor runs with `shouldRerenderOnTransaction: false`, and `editor.setEditable()` updates the
+ * option + re-applies view state but does NOT change any node-view prop — so a node view that reads
+ * `editor.isEditable` once at render keeps a stale value after the editability toggles (e.g. an agent
+ * stream settling into the doc). That leaves images showing no drag/resize/selection affordances and
+ * code blocks stuck on their read-only label until the node happens to re-render. Subscribing to the
+ * editor's `transaction`/`update` events re-reads the flag so the node view stays in sync.
+ */
+export function useEditorEditable(editor: Editor): boolean {
+  const [editable, setEditable] = useState(editor.isEditable)
+  useEffect(() => {
+    const sync = () => setEditable(editor.isEditable)
+    sync()
+    editor.on('transaction', sync)
+    editor.on('update', sync)
+    return () => {
+      editor.off('transaction', sync)
+      editor.off('update', sync)
+    }
+  }, [editor])
+  return editable
+}
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-editable-file-content.test.tsx b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-editable-file-content.test.tsx
new file mode 100644
index 00000000000..58c5447df66
--- /dev/null
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-editable-file-content.test.tsx
@@ -0,0 +1,167 @@
+/**
+ * @vitest-environment jsdom
+ *
+ * The post-stream reconcile must poll the content query until a fetch shows the server content
+ * advanced past the pre-stream baseline — its exit is data-driven, and without the poll a single
+ * refetch racing the agent's write (or an invalidation that never reaches this surface) wedged the
+ * editor read-only until a window refocus or full reload. These drive the real
+ * `useEditableFileContent` engine through stream → settle → advance and assert the
+ * `refetchInterval` handed to the content query flips on and off with the `reconciling` phase.
+ */
+import { act } from 'react'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { queryState } = vi.hoisted(() => ({
+  queryState: {
+    fetched: undefined as string | undefined,
+    lastOptions: undefined as
+      | { refetchInterval?: number | false | (() => number | false) }
+      | undefined,
+  },
+}))
+
+vi.mock('@/hooks/queries/workspace-files', () => ({
+  useWorkspaceFileContent: (
+    _workspaceId: string,
+    _fileId: string,
+    _key: string,
+    _raw?: boolean,
+    options?: { refetchInterval?: number | false | (() => number | false) }
+  ) => {
+    queryState.lastOptions = options
+    return { data: queryState.fetched, isLoading: queryState.fetched === undefined, error: null }
+  },
+  useUpdateWorkspaceFileContent: () => ({ mutateAsync: vi.fn(async () => ({ success: true })) }),
+}))
+
+vi.mock('idb-keyval', () => ({
+  get: vi.fn(async () => undefined),
+  set: vi.fn(async () => {}),
+  del: vi.fn(async () => {}),
+}))
+
+import {
+  RECONCILING_REFETCH_INTERVAL_MS,
+  RECONCILING_REFETCH_SLOW_INTERVAL_MS,
+  RECONCILING_REFETCH_WINDOW_MS,
+  useEditableFileContent,
+} from './use-editable-file-content'
+
+const FILE = {
+  id: 'f1',
+  key: 'workspace/ws-1/123-abc-doc.md',
+  name: 'doc.md',
+  type: 'text/markdown',
+  folderId: null,
+} as any
+
+interface ProbeProps {
+  streamingContent?: string
+  isAgentEditing?: boolean
+}
+
+let container: HTMLDivElement | null = null
+let root: Root | null = null
+let latest: ReturnType<typeof useEditableFileContent> | null = null
+
+function Probe(props: ProbeProps) {
+  latest = useEditableFileContent({
+    file: FILE,
+    workspaceId: 'ws-1',
+    canEdit: true,
+    streamingContent: props.streamingContent,
+    isAgentEditing: props.isAgentEditing,
+  })
+  return null
+}
+
+function render(props: ProbeProps) {
+  act(() => {
+    root?.render(<Probe {...props} />)
+  })
+}
+
+/** The interval value react-query would currently be using (resolving the function form). */
+function currentInterval(): number | false {
+  const raw = queryState.lastOptions?.refetchInterval
+  return typeof raw === 'function' ? raw() : (raw ?? false)
+}
+
+beforeEach(() => {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  queryState.fetched = undefined
+  queryState.lastOptions = undefined
+  container = document.createElement('div')
+  document.body.appendChild(container)
+  root = createRoot(container)
+})
+
+afterEach(() => {
+  if (root) act(() => root?.unmount())
+  container?.remove()
+  container = null
+  root = null
+  latest = null
+  vi.useRealTimers()
+})
+
+describe('reconcile refetch polling', () => {
+  it('polls only while reconciling, and stops the moment the fetched content advances', () => {
+    const BASELINE = '# Doc\n\nstart\n'
+    const STREAMED = '# Doc\n\nstart\n\n![img](/api/files/view/wf_x)\n'
+
+    // Mount mid-stream (fetch not resolved yet): no polling.
+    render({ streamingContent: '', isAgentEditing: true })
+    expect(currentInterval()).toBe(false)
+
+    // Baseline fetch resolves during the stream; chunks arrive: still no polling.
+    queryState.fetched = BASELINE
+    render({ streamingContent: '# Doc\n\nstart\n\n![img](', isAgentEditing: true })
+    render({ streamingContent: STREAMED, isAgentEditing: true })
+    expect(currentInterval()).toBe(false)
+    expect(latest?.isStreamInteractionLocked).toBe(true)
+
+    // Stream settles but the cached fetch still shows the pre-stream baseline: reconciling → poll.
+    render({ streamingContent: undefined, isAgentEditing: false })
+    expect(latest?.isStreamInteractionLocked).toBe(true)
+    expect(currentInterval()).toBe(RECONCILING_REFETCH_INTERVAL_MS)
+
+    // A poll returns the advanced server content: finalize, unlock, polling off.
+    queryState.fetched = STREAMED
+    render({ streamingContent: undefined, isAgentEditing: false })
+    expect(latest?.isStreamInteractionLocked).toBe(false)
+    expect(latest?.content).toBe(STREAMED)
+    expect(currentInterval()).toBe(false)
+  })
+
+  it('degrades to the slow cadence after the fast window — never stops outright while reconciling', () => {
+    vi.useFakeTimers()
+    vi.setSystemTime(1_000_000)
+    const BASELINE = '# Doc\n\nstart\n'
+
+    render({ streamingContent: '', isAgentEditing: true })
+    queryState.fetched = BASELINE
+    render({ streamingContent: `${BASELINE}\nmore`, isAgentEditing: true })
+    render({ streamingContent: undefined, isAgentEditing: false })
+    expect(currentInterval()).toBe(RECONCILING_REFETCH_INTERVAL_MS)
+
+    vi.setSystemTime(1_000_000 + RECONCILING_REFETCH_WINDOW_MS - 1)
+    expect(currentInterval()).toBe(RECONCILING_REFETCH_INTERVAL_MS)
+
+    // A write landing late (slow job, replica catch-up) must still be picked up automatically —
+    // the poll degrades in rate but the editor can never end up with no recovery path at all.
+    vi.setSystemTime(1_000_000 + RECONCILING_REFETCH_WINDOW_MS)
+    expect(currentInterval()).toBe(RECONCILING_REFETCH_SLOW_INTERVAL_MS)
+  })
+
+  it('never polls during plain at-rest editing (no stream involved)', () => {
+    queryState.fetched = '# Plain\n\ndoc\n'
+    render({})
+    expect(latest?.isStreamInteractionLocked).toBe(false)
+    expect(currentInterval()).toBe(false)
+    act(() => latest?.setDraftContent('# Plain\n\ndoc edited\n'))
+    render({})
+    expect(currentInterval()).toBe(false)
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-editable-file-content.ts b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-editable-file-content.ts
index f466249e74f..cb6defd8d95 100644
--- a/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-editable-file-content.ts
+++ b/apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/use-editable-file-content.ts
@@ -28,6 +28,25 @@ const GENERATED_SOURCE_FILE_TYPES = new Set([
   'text/x-python-xlsx',
 ])
 
+/**
+ * Poll cadence for the content query while the post-stream reconcile waits for a fetch showing the
+ * server content advanced past the pre-stream baseline. Only active during `reconciling` — a short
+ * window ending the moment a fetch advances — so the cost is a few small GETs after an agent edit.
+ */
+export const RECONCILING_REFETCH_INTERVAL_MS = 1500
+
+/**
+ * How long the reconcile polls at the fast cadence after a stream settles. A write that hasn't
+ * landed within this window has almost certainly failed or is badly delayed, so polling degrades
+ * to {@link RECONCILING_REFETCH_SLOW_INTERVAL_MS} — never stopping outright, so the editor can't
+ * end up locked read-only with no automatic recovery (react-query pauses interval refetches in
+ * background tabs by default, so a wedged doc left open does not poll unattended).
+ */
+export const RECONCILING_REFETCH_WINDOW_MS = 45_000
+
+/** Slow-poll cadence once the fast window has elapsed without the server content advancing. */
+export const RECONCILING_REFETCH_SLOW_INTERVAL_MS = 15_000
+
 interface UseEditableFileContentOptions {
   file: WorkspaceFileRecord
   workspaceId: string
@@ -99,6 +118,7 @@ function useFileContentState(options: SyncTextEditorContentStateOptions) {
     savedContent: state.savedContent,
     isInitialized: state.phase !== 'uninitialized',
     isStreamInteractionLocked: state.phase === 'streaming' || state.phase === 'reconciling',
+    isReconciling: state.phase === 'reconciling',
     setDraftContent,
     markSavedContent,
   }
@@ -127,6 +147,25 @@ export function useEditableFileContent({
   onDirtyChangeRef.current = onDirtyChange
   onSaveStatusChangeRef.current = onSaveStatusChange
 
+  /**
+   * Mirrors the reducer's `reconciling` phase (assigned below the reducer hook; read here through a
+   * stable function that react-query re-evaluates after every fetch and options pass, so polling
+   * starts and stops with the phase, no extra re-render required). While reconciling — the stream
+   * ended but no fetch has shown the server content advancing past the pre-stream baseline yet —
+   * the content query polls. The reconcile's exit is data-driven and this is its only retry: a
+   * single refetch that races the agent's write (or an invalidation that never reaches this
+   * surface) would otherwise leave the editor read-only until a window refocus or a full reload.
+   */
+  const isReconcilingRef = useRef(false)
+  const reconcilingSinceRef = useRef(0)
+  const reconcileRefetchInterval = useCallback(() => {
+    if (!isReconcilingRef.current) return false
+    if (Date.now() - reconcilingSinceRef.current >= RECONCILING_REFETCH_WINDOW_MS) {
+      return RECONCILING_REFETCH_SLOW_INTERVAL_MS
+    }
+    return RECONCILING_REFETCH_INTERVAL_MS
+  }, [])
+
   const {
     data: fetchedContent,
     isLoading,
@@ -135,7 +174,8 @@ export function useEditableFileContent({
     workspaceId,
     file.id,
     file.key,
-    GENERATED_SOURCE_FILE_TYPES.has(file.type)
+    GENERATED_SOURCE_FILE_TYPES.has(file.type),
+    { refetchInterval: reconcileRefetchInterval }
   )
 
   /**
@@ -165,6 +205,7 @@ export function useEditableFileContent({
     savedContent,
     isInitialized,
     isStreamInteractionLocked: isStreamPhaseLocked,
+    isReconciling,
     setDraftContent,
     markSavedContent,
   } = useFileContentState({
@@ -172,6 +213,8 @@ export function useEditableFileContent({
     fetchedContent: baselineContent,
     streamingContent,
   })
+  if (isReconciling && !isReconcilingRef.current) reconcilingSinceRef.current = Date.now()
+  isReconcilingRef.current = isReconciling
 
   const isStreamInteractionLocked = isStreamPhaseLocked || Boolean(isAgentEditing)
 
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.tsx
index ce8d57b6dcd..0314907eefe 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/agent-group.tsx
@@ -1,7 +1,8 @@
 'use client'
 
 import { useEffect, useLayoutEffect, useRef, useState } from 'react'
-import { ChevronDown, cn, Expandable, ExpandableContent, PillsRing } from '@sim/emcn'
+import { ChevronDown, cn, Expandable, ExpandableContent } from '@sim/emcn'
+import { ShimmerText } from '@/components/ui'
 import type { ToolCallData } from '../../../../types'
 import { getAgentIcon, isToolDone } from '../../utils'
 import { ToolCallItem } from './tool-call-item'
@@ -63,11 +64,7 @@ export function AgentGroup({
   const AgentIcon = getAgentIcon(agentName)
   const hasItems = items.length > 0
   const resolved = isAgentGroupResolved(items)
-  // Pure projection of the run's own state: a subagent header spins while it is
-  // delegating with no resolved work yet. A terminal turn closes the lane (its
-  // subagent block is stamped ended), which clears `isDelegating`, so no
-  // transport gating is needed to stop an aborted-before-first-tool spinner.
-  const showDelegatingSpinner = isDelegating && !resolved
+  const isWorking = (isDelegating && !resolved) || (isStreaming && isLaneOpen)
 
   // Expand while the turn is live and any of: the lane is open (the subagent is
   // actively running), this is the current/latest section, or there is unresolved
@@ -89,19 +86,19 @@ export function AgentGroup({
         <button
           type='button'
           onClick={() => setManualExpanded(!expanded)}
-          className='flex cursor-pointer items-center gap-2'
+          className='group/agent flex cursor-pointer items-center gap-2'
         >
           <div className='flex size-[16px] flex-shrink-0 items-center justify-center'>
-            {showDelegatingSpinner ? (
-              <PillsRing className='size-[15px] text-[var(--text-icon)]' animate />
-            ) : (
-              <AgentIcon className='size-[16px] text-[var(--text-icon)]' />
-            )}
+            <AgentIcon className='size-[16px] text-[var(--text-icon)]' />
           </div>
-          <span className='text-[var(--text-body)] text-sm'>{agentLabel}</span>
+          {isWorking ? (
+            <ShimmerText className='text-sm'>{agentLabel}</ShimmerText>
+          ) : (
+            <span className='text-[var(--text-body)] text-sm'>{agentLabel}</span>
+          )}
           <ChevronDown
             className={cn(
-              'h-[7px] w-[9px] text-[var(--text-icon)] transition-transform duration-150',
+              'h-[7px] w-[9px] text-[var(--text-icon)] opacity-0 transition-[transform,opacity] duration-150 group-hover/agent:opacity-100 group-focus-visible/agent:opacity-100',
               !expanded && '-rotate-90'
             )}
           />
@@ -109,13 +106,13 @@ export function AgentGroup({
       ) : (
         <div className='flex items-center gap-2'>
           <div className='flex size-[16px] flex-shrink-0 items-center justify-center'>
-            {showDelegatingSpinner ? (
-              <PillsRing className='size-[15px] text-[var(--text-icon)]' animate />
-            ) : (
-              <AgentIcon className='size-[16px] text-[var(--text-icon)]' />
-            )}
+            <AgentIcon className='size-[16px] text-[var(--text-icon)]' />
           </div>
-          <span className='text-[var(--text-body)] text-sm'>{agentLabel}</span>
+          {isWorking ? (
+            <ShimmerText className='text-sm'>{agentLabel}</ShimmerText>
+          ) : (
+            <span className='text-[var(--text-body)] text-sm'>{agentLabel}</span>
+          )}
         </div>
       )}
       {hasItems && (
diff --git a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
index c671fc3a593..59d9bf69dd7 100644
--- a/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/home/components/message-content/components/agent-group/tool-call-item.tsx
@@ -1,5 +1,5 @@
 import { useMemo } from 'react'
-import { PillsRing } from '@sim/emcn'
+import { ShimmerText } from '@/components/ui'
 import { WorkspaceFile } from '@/lib/copilot/generated/tool-catalog-v1'
 import type { ToolCallStatus } from '../../../../types'
 import { getToolIcon, resolveToolDisplayState } from '../../utils'
@@ -57,10 +57,29 @@ function Hyphen({ className }: { className?: string }) {
   )
 }
 
+function CircleOutline({ className }: { className?: string }) {
+  return (
+    <svg
+      width='16'
+      height='16'
+      viewBox='0 0 16 16'
+      fill='none'
+      xmlns='http://www.w3.org/2000/svg'
+      className={className}
+    >
+      <circle cx='8' cy='8' r='6.5' stroke='currentColor' strokeWidth='1.25' />
+    </svg>
+  )
+}
+
 function StatusIcon({ status, toolName }: { status: ToolCallStatus; toolName: string }) {
   const display = resolveToolDisplayState(status)
   if (display === 'spinner') {
-    return <PillsRing className='size-[15px] text-[var(--text-tertiary)]' animate />
+    const Icon = getToolIcon(toolName)
+    if (Icon) {
+      return <Icon className='size-[15px] text-[var(--text-tertiary)]' />
+    }
+    return <CircleOutline className='size-[15px] text-[var(--text-tertiary)]' />
   }
   if (display === 'cancelled') {
     return <CircleStop className='size-[15px] text-[var(--text-tertiary)]' />
@@ -112,14 +131,21 @@ export function ToolCallItem({ toolName, displayTitle, status, streamingArgs }:
     return `${verb} ${unescaped}`
   }, [toolName, streamingArgs])
 
+  const isExecuting = resolveToolDisplayState(status) === 'spinner'
+  const title = liveWorkspaceFileTitle || displayTitle
+
   return (
     <div className='flex items-center gap-[8px] pl-[24px]'>
       <div className='flex size-[16px] flex-shrink-0 items-center justify-center'>
         <StatusIcon status={status} toolName={toolName} />
       </div>
-      <span className='text-[13px] text-[var(--text-secondary)]'>
-        {liveWorkspaceFileTitle || displayTitle}
-      </span>
+      {isExecuting ? (
+        <ShimmerText className='text-[13px] [--shimmer-rest:var(--text-secondary)]'>
+          {title}
+        </ShimmerText>
+      ) : (
+        <span className='text-[13px] text-[var(--text-secondary)]'>{title}</span>
+      )}
     </div>
   )
 }
diff --git a/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx b/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx
index 41740182975..a2031ab5948 100644
--- a/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/settings/components/byok/byok.tsx
@@ -34,6 +34,7 @@ import {
   SerperIcon,
   TogetherIcon,
   WizaIcon,
+  xAIIcon,
   ZeroBounceIcon,
 } from '@/components/icons'
 import { MAX_BYOK_KEYS_PER_PROVIDER } from '@/lib/api/contracts/byok-keys'
@@ -76,6 +77,13 @@ const PROVIDERS: (BYOKManagerProvider & { id: BYOKProviderId })[] = [
     description: 'LLM calls and Knowledge Base OCR',
     placeholder: 'Enter your API key',
   },
+  {
+    id: 'xai',
+    name: 'xAI',
+    icon: xAIIcon,
+    description: 'LLM calls',
+    placeholder: 'xai-...',
+  },
   {
     id: 'fireworks',
     name: 'Fireworks',
@@ -287,6 +295,7 @@ const PROVIDER_SECTIONS: BYOKProviderSection[] = [
       'anthropic',
       'google',
       'mistral',
+      'xai',
       'fireworks',
       'together',
       'baseten',
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox.tsx
index e52684555d9..6768c2e0e87 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-combobox/selector-combobox.tsx
@@ -28,6 +28,8 @@ interface SelectorComboboxProps {
   onOptionChange?: (value: string) => void
   allowSearch?: boolean
   missingOptionLabel?: string
+  /** When true, store an array of ids and render removable chips (e.g. channel filter). */
+  multiSelect?: boolean
 }
 
 export function SelectorCombobox({
@@ -43,17 +45,24 @@ export function SelectorCombobox({
   onOptionChange,
   allowSearch = true,
   missingOptionLabel,
+  multiSelect = false,
 }: SelectorComboboxProps) {
   const activeSearchTarget = useActiveSearchTarget()
-  const [storeValueRaw, setStoreValue] = useSubBlockValue<string | null | undefined>(
+  const [storeValueRaw, setStoreValue] = useSubBlockValue<string | string[] | null | undefined>(
     blockId,
     subBlock.id
   )
-  const storeValue = storeValueRaw ?? undefined
-  const previewedValue = previewValue ?? undefined
-  const activeValue: string | undefined = isPreview ? previewedValue : storeValue
+  const storeValue = typeof storeValueRaw === 'string' ? storeValueRaw : undefined
+  const previewedValue = typeof previewValue === 'string' ? previewValue : undefined
+  // Single-select active value; undefined in multi mode so detail/label hooks no-op.
+  const activeValue: string | undefined = multiSelect
+    ? undefined
+    : isPreview
+      ? previewedValue
+      : storeValue
   const [searchTerm, setSearchTerm] = useState('')
   const [isEditing, setIsEditing] = useState(false)
+  const [multiInput, setMultiInput] = useState('')
   const {
     data: options = [],
     isLoading,
@@ -127,6 +136,30 @@ export function SelectorCombobox({
     [setStoreValue, onOptionChange, readOnly, disabled]
   )
 
+  const selectedValues = useMemo<string[]>(() => {
+    if (!multiSelect) return []
+    const source = isPreview ? previewValue : storeValueRaw
+    if (Array.isArray(source)) return source.map(String)
+    if (typeof source === 'string' && source.length > 0) {
+      return source
+        .split(',')
+        .map((v) => v.trim())
+        .filter(Boolean)
+    }
+    return []
+  }, [multiSelect, isPreview, previewValue, storeValueRaw])
+
+  const handleMultiChange = useCallback(
+    (values: string[]) => {
+      if (readOnly || disabled) return
+      setStoreValue(values)
+      // Reset the search box so the next channel is picked from the full list.
+      setMultiInput('')
+      setSearchTerm('')
+    },
+    [setStoreValue, readOnly, disabled]
+  )
+
   const showClearButton = Boolean(activeValue) && !disabled && !readOnly
   const displayValue = allowSearch ? inputValue : selectedLabel
   const workflowSearchHighlight = getWorkflowSearchLabelHighlight({
@@ -137,6 +170,54 @@ export function SelectorCombobox({
     label: displayValue,
   })
 
+  if (multiSelect) {
+    return (
+      <div className='w-full'>
+        <EditableCombobox
+          options={comboboxOptions}
+          value={multiInput}
+          multiSelect
+          multiSelectValues={selectedValues}
+          onMultiSelectChange={handleMultiChange}
+          onChange={(newValue) => {
+            setMultiInput(newValue)
+            if (allowSearch) setSearchTerm(newValue)
+          }}
+          placeholder={placeholder || subBlock.placeholder || 'Select channels'}
+          disabled={disabled || readOnly}
+          editable={allowSearch}
+          filterOptions={allowSearch}
+          isLoading={isLoading}
+          error={error instanceof Error ? error.message : null}
+        />
+        {selectedValues.length > 0 && (
+          <div className='mt-2 space-y-2'>
+            {selectedValues.map((id) => (
+              <div
+                key={id}
+                className='flex items-center justify-between gap-2 rounded-sm border border-[var(--border-1)] bg-[var(--surface-4)] px-2.5 py-[5px]'
+              >
+                <span className='block min-w-0 flex-1 truncate text-[var(--text-tertiary)] text-sm'>
+                  {optionMap.get(id)?.label ?? id}
+                </span>
+                <Button
+                  type='button'
+                  variant='ghost'
+                  className='h-auto shrink-0 p-0'
+                  disabled={disabled || readOnly}
+                  aria-label={`Remove ${optionMap.get(id)?.label ?? id}`}
+                  onClick={() => handleMultiChange(selectedValues.filter((v) => v !== id))}
+                >
+                  <X className='size-[14px] text-[var(--text-icon)]' />
+                </Button>
+              </div>
+            ))}
+          </div>
+        )}
+      </div>
+    )
+  }
+
   return (
     <div className='w-full'>
       <SubBlockInputController
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-input/selector-input.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-input/selector-input.tsx
index 864a65caf68..332ca77b014 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-input/selector-input.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/selector-input/selector-input.tsx
@@ -96,6 +96,7 @@ export function SelectorInput({
       previewValue={previewValue ?? null}
       placeholder={subBlock.placeholder || 'Select resource'}
       allowSearch={allowSearch}
+      multiSelect={subBlock.multiSelect}
       onOptionChange={(value) => {
         if (!isPreview) {
           collaborativeSetSubblockValue(blockId, subBlock.id, value)
diff --git a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx
index 4ab924e8f3d..4f9da917a1e 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx
@@ -95,6 +95,7 @@ import { useCanvasModeStore } from '@/stores/canvas-mode'
 import { useChatStore } from '@/stores/chat/store'
 import { defaultWorkflowExecutionState, useExecutionStore } from '@/stores/execution'
 import { useSearchModalStore } from '@/stores/modals/search/store'
+import type { PendingConnect } from '@/stores/modals/search/types'
 import { usePanelEditorStore } from '@/stores/panel'
 import { useUndoRedoStore } from '@/stores/undo-redo'
 import { useVariablesModalStore } from '@/stores/variables/modal'
@@ -209,6 +210,7 @@ interface AddBlockFromToolbarDetail {
   type?: unknown
   enableTriggerMode?: unknown
   presetOperation?: unknown
+  pendingConnect?: PendingConnect
 }
 
 /**
@@ -1779,9 +1781,55 @@ const WorkflowContent = React.memo(
      * @param position - Drop position in ReactFlow coordinates.
      */
     const handleToolbarDrop = useCallback(
-      (data: { type: string; enableTriggerMode?: boolean }, position: { x: number; y: number }) => {
+      (
+        data: {
+          type: string
+          enableTriggerMode?: boolean
+          presetOperation?: string
+          forcedSource?: { nodeId: string; handleId: string }
+        },
+        position: { x: number; y: number }
+      ) => {
         if (!data.type || data.type === 'connectionBlock') return
 
+        const operationConfig = data.presetOperation
+          ? { operation: data.presetOperation }
+          : undefined
+
+        const { forcedSource } = data
+
+        /**
+         * Edge for the new block. With a `forcedSource` (a drag-release from a
+         * handle), wire from that exact handle — but only when it stays within the
+         * resolved container context, matching onConnect's boundary rules; a
+         * cross-boundary source yields no edge. Otherwise fall back to normal
+         * proximity auto-connect.
+         */
+        const resolveEdge = (
+          targetId: string,
+          targetParentId: string | null,
+          fallback: () => Edge | undefined
+        ): Edge | undefined => {
+          if (!forcedSource) return fallback()
+
+          const isContainerStartHandle =
+            forcedSource.handleId === 'loop-start-source' ||
+            forcedSource.handleId === 'parallel-start-source'
+          if (isContainerStartHandle) {
+            // A container-start handle may only wire to a child of that container.
+            return forcedSource.nodeId === targetParentId
+              ? createEdgeObject(forcedSource.nodeId, targetId, forcedSource.handleId)
+              : undefined
+          }
+
+          const sourceBlock = blocks[forcedSource.nodeId]
+          if (!sourceBlock) return undefined
+          const sourceParentId = sourceBlock.data?.parentId ?? null
+          return sourceParentId === targetParentId
+            ? createEdgeObject(forcedSource.nodeId, targetId, forcedSource.handleId)
+            : undefined
+        }
+
         try {
           const containerInfo = isPointInLoopNode(position)
 
@@ -1811,11 +1859,13 @@ const WorkflowContent = React.memo(
                 .filter((b) => b.data?.parentId === containerInfo.loopId)
                 .map((b) => ({ id: b.id, type: b.type, position: b.position }))
 
-              const autoConnectEdge = tryCreateAutoConnectEdge(relativePosition, id, {
-                targetParentId: containerInfo.loopId,
-                existingChildBlocks,
-                containerId: containerInfo.loopId,
-              })
+              const autoConnectEdge = resolveEdge(id, containerInfo.loopId, () =>
+                tryCreateAutoConnectEdge(relativePosition, id, {
+                  targetParentId: containerInfo.loopId,
+                  existingChildBlocks,
+                  containerId: containerInfo.loopId,
+                })
+              )
 
               addBlock(
                 id,
@@ -1836,9 +1886,11 @@ const WorkflowContent = React.memo(
 
               resizeLoopNodesWrapper()
             } else {
-              const autoConnectEdge = tryCreateAutoConnectEdge(position, id, {
-                targetParentId: null,
-              })
+              const autoConnectEdge = resolveEdge(id, null, () =>
+                tryCreateAutoConnectEdge(position, id, {
+                  targetParentId: null,
+                })
+              )
 
               addBlock(
                 id,
@@ -1903,11 +1955,13 @@ const WorkflowContent = React.memo(
               .filter((b) => b.data?.parentId === containerInfo.loopId)
               .map((b) => ({ id: b.id, type: b.type, position: b.position }))
 
-            const autoConnectEdge = tryCreateAutoConnectEdge(relativePosition, id, {
-              targetParentId: containerInfo.loopId,
-              existingChildBlocks,
-              containerId: containerInfo.loopId,
-            })
+            const autoConnectEdge = resolveEdge(id, containerInfo.loopId, () =>
+              tryCreateAutoConnectEdge(relativePosition, id, {
+                targetParentId: containerInfo.loopId,
+                existingChildBlocks,
+                containerId: containerInfo.loopId,
+              })
+            )
 
             // Add block with parent info AND autoConnectEdge (atomic operation)
             addBlock(
@@ -1921,7 +1975,9 @@ const WorkflowContent = React.memo(
               },
               containerInfo.loopId,
               'parent',
-              autoConnectEdge
+              autoConnectEdge,
+              undefined,
+              operationConfig
             )
 
             // Resize the container node to fit the new block
@@ -1931,9 +1987,11 @@ const WorkflowContent = React.memo(
             // Centralized trigger constraints
             if (checkTriggerConstraints(data.type)) return
 
-            const autoConnectEdge = tryCreateAutoConnectEdge(position, id, {
-              targetParentId: null,
-            })
+            const autoConnectEdge = resolveEdge(id, null, () =>
+              tryCreateAutoConnectEdge(position, id, {
+                targetParentId: null,
+              })
+            )
 
             // Regular canvas drop with auto-connect edge
             // Use enableTriggerMode from drag data if present (when dragging from Triggers tab)
@@ -1947,7 +2005,8 @@ const WorkflowContent = React.memo(
               undefined,
               undefined,
               autoConnectEdge,
-              enableTriggerMode
+              enableTriggerMode,
+              operationConfig
             )
           }
         } catch (err) {
@@ -1961,6 +2020,7 @@ const WorkflowContent = React.memo(
         addBlock,
         tryCreateAutoConnectEdge,
         checkTriggerConstraints,
+        createEdgeObject,
       ]
     )
 
@@ -1972,11 +2032,30 @@ const WorkflowContent = React.memo(
           return
         }
 
-        const { type, enableTriggerMode, presetOperation } = event.detail
+        const { type, enableTriggerMode, presetOperation, pendingConnect } = event.detail
 
         if (typeof type !== 'string' || !type) return
         if (type === 'connectionBlock') return
 
+        // Complete an edge drag-release: only a genuine palette selection carries
+        // `pendingConnect` (other add-block dispatchers — toolbar, sidebar, command
+        // list — don't), so its presence is the signal. Delegating to
+        // handleToolbarDrop with the drag source gives container-aware placement AND
+        // an edge from the released handle that respects container boundaries.
+        if (pendingConnect) {
+          // screenToFlowPosition subtracts the pane rect internally — pass raw client coords.
+          handleToolbarDrop(
+            {
+              type,
+              enableTriggerMode: enableTriggerMode === true,
+              presetOperation: typeof presetOperation === 'string' ? presetOperation : undefined,
+              forcedSource: pendingConnect.source,
+            },
+            screenToFlowPosition({ x: pendingConnect.screenX, y: pendingConnect.screenY })
+          )
+          return
+        }
+
         const basePosition = getViewportCenter()
 
         if (type === 'loop' || type === 'parallel') {
@@ -2054,6 +2133,8 @@ const WorkflowContent = React.memo(
       effectivePermissions.canEdit,
       checkTriggerConstraints,
       tryCreateAutoConnectEdge,
+      screenToFlowPosition,
+      handleToolbarDrop,
     ])
 
     /**
@@ -3132,6 +3213,17 @@ const WorkflowContent = React.memo(
             target: targetNode.id,
             targetHandle: 'target',
           })
+        } else if (!targetNode) {
+          // Released on empty canvas: open the command palette with the drag origin
+          // + drop point, so the chosen block lands here wired from this handle.
+          useSearchModalStore.getState().open({
+            sections: ['blocks', 'tools', 'toolOperations'],
+            pendingConnect: {
+              source: { nodeId: source.nodeId, handleId: source.handleId },
+              screenX: clientPos.clientX,
+              screenY: clientPos.clientY,
+            },
+          })
         }
 
         connectionSourceRef.current = null
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
index 1c5b4fd32bc..beac3a100cb 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/search-modal.tsx
@@ -40,6 +40,7 @@ import { useSearchModalStore } from '@/stores/modals/search/store'
 import type {
   SearchBlockItem,
   SearchDocItem,
+  SearchSection,
   SearchToolOperationItem,
 } from '@/stores/modals/search/types'
 import {
@@ -69,7 +70,7 @@ import type {
   WorkflowItem,
   WorkspaceItem,
 } from './utils'
-import { filterAndSort } from './utils'
+import { filterAndCap, filterAndSort } from './utils'
 
 const logger = createLogger('SearchModal')
 
@@ -118,6 +119,9 @@ export function SearchModal({
     (state) => state.data
   )
 
+  const sections = useSearchModalStore((state) => state.sections)
+  const showSection = (key: SearchSection) => !sections || sections.includes(key)
+
   const openHelpModal = useCallback(() => {
     window.dispatchEvent(new CustomEvent('open-help-modal'))
   }, [])
@@ -347,6 +351,7 @@ export function SearchModal({
           detail: {
             type: block.type,
             enableTriggerMode,
+            pendingConnect: useSearchModalStore.getState().pendingConnect,
           },
         })
       )
@@ -364,7 +369,11 @@ export function SearchModal({
     (op: SearchToolOperationItem) => {
       window.dispatchEvent(
         new CustomEvent('add-block-from-toolbar', {
-          detail: { type: op.blockType, presetOperation: op.operationId },
+          detail: {
+            type: op.blockType,
+            presetOperation: op.operationId,
+            pendingConnect: useSearchModalStore.getState().pendingConnect,
+          },
         })
       )
       captureEvent(posthogRef.current, 'search_result_selected', {
@@ -566,60 +575,69 @@ export function SearchModal({
   }, [actions, isOnWorkflowPage, isOnIntegrationsPage, deferredSearch])
 
   /**
-   * Ranking matches against clean, human-meaningful text only (names, types,
-   * aliases, folder paths) — never the structural `<type>-<id>`/uuid tokens used
-   * for cmdk row identity. Those tokens carry letters (e.g. "block", "tool") that
-   * would otherwise let short fuzzy queries scatter-match unrelated items.
+   * Blocks and tools rank by name first, with `searchValue` (type + option
+   * labels) as a lower-tier fallback, so an exact name match wins while a block
+   * stays findable by an option label.
    */
   const filteredBlocks = useMemo(() => {
     if (!isOnWorkflowPage) return []
-    return filterAndSort(blocks, (b) => b.searchValue ?? b.name, deferredSearch)
+    return filterAndCap(
+      blocks,
+      (b) => b.name,
+      deferredSearch,
+      (b) => b.searchValue
+    )
   }, [isOnWorkflowPage, blocks, deferredSearch])
 
   const filteredTools = useMemo(() => {
     if (!isOnWorkflowPage) return []
-    return filterAndSort(tools, (t) => t.searchValue ?? t.name, deferredSearch)
+    return filterAndCap(
+      tools,
+      (t) => t.name,
+      deferredSearch,
+      (t) => t.searchValue
+    )
   }, [isOnWorkflowPage, tools, deferredSearch])
 
   const filteredTriggers = useMemo(() => {
     if (!isOnWorkflowPage) return []
-    return filterAndSort(triggers, (t) => `${t.name} ${t.id}`, deferredSearch)
+    return filterAndCap(triggers, (t) => `${t.name} ${t.id}`, deferredSearch)
   }, [isOnWorkflowPage, triggers, deferredSearch])
 
   const filteredToolOps = useMemo(() => {
     if (!isOnWorkflowPage) return []
-    return filterAndSort(toolOperations, (op) => op.searchValue, deferredSearch)
+    return filterAndCap(toolOperations, (op) => op.searchValue, deferredSearch)
   }, [isOnWorkflowPage, toolOperations, deferredSearch])
 
   const filteredDocs = useMemo(() => {
     if (!isOnWorkflowPage) return []
-    return filterAndSort(docs, (d) => `${d.name} docs documentation`, deferredSearch)
+    return filterAndCap(docs, (d) => `${d.name} docs documentation`, deferredSearch)
   }, [isOnWorkflowPage, docs, deferredSearch])
 
   const filteredTables = useMemo(
-    () => filterAndSort(tables, (t) => t.name, deferredSearch),
+    () => filterAndCap(tables, (t) => t.name, deferredSearch),
     [tables, deferredSearch]
   )
   const filteredFiles = useMemo(
-    () => filterAndSort(files, (f) => `${f.name} ${f.folderPath?.join(' ') ?? ''}`, deferredSearch),
+    () => filterAndCap(files, (f) => `${f.name} ${f.folderPath?.join(' ') ?? ''}`, deferredSearch),
     [files, deferredSearch]
   )
   const filteredKnowledgeBases = useMemo(
-    () => filterAndSort(knowledgeBases, (kb) => kb.name, deferredSearch),
+    () => filterAndCap(knowledgeBases, (kb) => kb.name, deferredSearch),
     [knowledgeBases, deferredSearch]
   )
 
   const filteredWorkflows = useMemo(
     () =>
-      filterAndSort(workflows, (w) => `${w.name} ${w.folderPath?.join(' ') ?? ''}`, deferredSearch),
+      filterAndCap(workflows, (w) => `${w.name} ${w.folderPath?.join(' ') ?? ''}`, deferredSearch),
     [workflows, deferredSearch]
   )
   const filteredChats = useMemo(
-    () => filterAndSort(chats, (t) => t.name, deferredSearch),
+    () => filterAndCap(chats, (t) => t.name, deferredSearch),
     [chats, deferredSearch]
   )
   const filteredWorkspaces = useMemo(
-    () => filterAndSort(workspaces, (w) => w.name, deferredSearch),
+    () => filterAndCap(workspaces, (w) => w.name, deferredSearch),
     [workspaces, deferredSearch]
   )
   const filteredPages = useMemo(
@@ -630,13 +648,13 @@ export function SearchModal({
   /** Connected accounts: visible on the integrations page even with empty input. */
   const filteredConnectedAccounts = useMemo(() => {
     if (!isOnIntegrationsPage) return []
-    return filterAndSort(connectedAccounts, (a) => a.name, deferredSearch)
+    return filterAndCap(connectedAccounts, (a) => a.name, deferredSearch)
   }, [isOnIntegrationsPage, connectedAccounts, deferredSearch])
 
   /** Catalog integrations: only shown once the user has typed something. */
   const filteredIntegrations = useMemo(() => {
-    if (!isOnIntegrationsPage || !deferredSearch) return []
-    return filterAndSort(integrations, (i) => i.name, deferredSearch)
+    if (!isOnIntegrationsPage || !deferredSearch.trim()) return []
+    return filterAndCap(integrations, (i) => i.name, deferredSearch)
   }, [isOnIntegrationsPage, deferredSearch, integrations])
 
   if (!mounted) return null
@@ -690,77 +708,107 @@ export function SearchModal({
                 No results found.
               </Command.Empty>
 
-              <ActionsGroup
-                items={filteredActions}
-                onSelect={handleActionSelect}
-                query={deferredSearch}
-              />
-              <ConnectedAccountsGroup
-                items={filteredConnectedAccounts}
-                onSelect={handleConnectedAccountSelect}
-                query={deferredSearch}
-              />
-              <IntegrationsGroup
-                items={filteredIntegrations}
-                onSelect={handleIntegrationSelect}
-                query={deferredSearch}
-              />
-              <BlocksGroup
-                items={filteredBlocks}
-                onSelect={handleBlockSelectAsBlock}
-                query={deferredSearch}
-              />
-              <ToolsGroup
-                items={filteredTools}
-                onSelect={handleBlockSelectAsTool}
-                query={deferredSearch}
-              />
-              <TriggersGroup
-                items={filteredTriggers}
-                onSelect={handleBlockSelectAsTrigger}
-                query={deferredSearch}
-              />
-              <ChatsGroup
-                items={filteredChats}
-                onSelect={handleChatSelect}
-                query={deferredSearch}
-              />
-              <WorkflowsGroup
-                items={filteredWorkflows}
-                onSelect={handleWorkflowSelect}
-                query={deferredSearch}
-              />
-              <TablesGroup
-                items={filteredTables}
-                onSelect={handleTableSelect}
-                query={deferredSearch}
-              />
-              <FilesGroup
-                items={filteredFiles}
-                onSelect={handleFileSelect}
-                query={deferredSearch}
-              />
-              <KnowledgeBasesGroup
-                items={filteredKnowledgeBases}
-                onSelect={handleKbSelect}
-                query={deferredSearch}
-              />
-              <ToolOpsGroup
-                items={filteredToolOps}
-                onSelect={handleToolOperationSelect}
-                query={deferredSearch}
-              />
-              <WorkspacesGroup
-                items={filteredWorkspaces}
-                onSelect={handleWorkspaceSelect}
-                query={deferredSearch}
-              />
-              <DocsGroup items={filteredDocs} onSelect={handleDocSelect} query={deferredSearch} />
-              <PagesGroup
-                items={filteredPages}
-                onSelect={handlePageSelect}
-                query={deferredSearch}
-              />
+              {showSection('actions') && (
+                <ActionsGroup
+                  items={filteredActions}
+                  onSelect={handleActionSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('connectedAccounts') && (
+                <ConnectedAccountsGroup
+                  items={filteredConnectedAccounts}
+                  onSelect={handleConnectedAccountSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('integrations') && (
+                <IntegrationsGroup
+                  items={filteredIntegrations}
+                  onSelect={handleIntegrationSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('blocks') && (
+                <BlocksGroup
+                  items={filteredBlocks}
+                  onSelect={handleBlockSelectAsBlock}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('tools') && (
+                <ToolsGroup
+                  items={filteredTools}
+                  onSelect={handleBlockSelectAsTool}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('triggers') && (
+                <TriggersGroup
+                  items={filteredTriggers}
+                  onSelect={handleBlockSelectAsTrigger}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('chats') && (
+                <ChatsGroup
+                  items={filteredChats}
+                  onSelect={handleChatSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('workflows') && (
+                <WorkflowsGroup
+                  items={filteredWorkflows}
+                  onSelect={handleWorkflowSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('tables') && (
+                <TablesGroup
+                  items={filteredTables}
+                  onSelect={handleTableSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('files') && (
+                <FilesGroup
+                  items={filteredFiles}
+                  onSelect={handleFileSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('knowledgeBases') && (
+                <KnowledgeBasesGroup
+                  items={filteredKnowledgeBases}
+                  onSelect={handleKbSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('toolOperations') && (
+                <ToolOpsGroup
+                  items={filteredToolOps}
+                  onSelect={handleToolOperationSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('workspaces') && (
+                <WorkspacesGroup
+                  items={filteredWorkspaces}
+                  onSelect={handleWorkspaceSelect}
+                  query={deferredSearch}
+                />
+              )}
+              {showSection('docs') && (
+                <DocsGroup items={filteredDocs} onSelect={handleDocSelect} query={deferredSearch} />
+              )}
+              {showSection('pages') && (
+                <PagesGroup
+                  items={filteredPages}
+                  onSelect={handlePageSelect}
+                  query={deferredSearch}
+                />
+              )}
             </Command.List>
           </Command>
         </div>
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.test.ts b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.test.ts
index eb9175abd28..a82b79fd5f9 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.test.ts
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.test.ts
@@ -2,7 +2,7 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { filterAndSort, fuzzyMatch } from './utils'
+import { filterAndCap, filterAndSort, fuzzyMatch, MAX_RESULTS_PER_GROUP } from './utils'
 
 /**
  * The matcher that shipped before fuzzy matching was introduced. Re-implemented
@@ -241,3 +241,77 @@ describe('fuzzyMatch — positions for highlighting', () => {
     expect(result.matched).toBe(true)
   })
 })
+
+describe('filterAndSort — name ranked above secondary text', () => {
+  interface Item {
+    name: string
+    searchValue: string
+  }
+  const toName = (i: Item) => i.name
+  const toExtra = (i: Item) => i.searchValue
+
+  it('ranks an exact name match above a substring buried in another item’s option text', () => {
+    const items: Item[] = [
+      // Matches "agent" only inside a long secondary string (its model catalog).
+      { name: 'Pi Coding Agent', searchValue: `Pi Coding Agent pi ${'model-x '.repeat(60)}` },
+      // Exact name match, but an even longer secondary string.
+      { name: 'Agent', searchValue: `Agent agent ${'claude-sonnet gpt-4o '.repeat(60)}` },
+    ]
+    const sorted = filterAndSort(items, toName, 'agent', toExtra)
+    expect(sorted[0].name).toBe('Agent')
+  })
+
+  it('keeps every name match above every secondary-only match', () => {
+    const items: Item[] = [
+      { name: 'Zeta', searchValue: 'Zeta agent agent agent' }, // strong secondary hit, no name hit
+      { name: 'Agent', searchValue: 'Agent agent' }, // name hit
+    ]
+    const sorted = filterAndSort(items, toName, 'agent', toExtra)
+    expect(sorted[0].name).toBe('Agent')
+  })
+
+  it('still surfaces an item matched only by its secondary text', () => {
+    const items: Item[] = [{ name: 'Agent', searchValue: 'Agent agent claude-sonnet gpt-4o' }]
+    expect(filterAndSort(items, toName, 'gpt-4o', toExtra)).toHaveLength(1)
+  })
+
+  it('is byte-identical to single-field ranking when no secondary accessor is given', () => {
+    const items = ['Slack message', 'Send message to Slack']
+    expect(filterAndSort(items, (s) => s, 'slack')).toEqual(
+      filterAndSort(items, (s) => s, 'slack', undefined)
+    )
+  })
+})
+
+describe('filterAndCap', () => {
+  const id = (s: string) => s
+
+  it('caps an active search to MAX_RESULTS_PER_GROUP', () => {
+    const items = Array.from({ length: MAX_RESULTS_PER_GROUP + 25 }, (_, i) => `item ${i}`)
+    expect(filterAndCap(items, id, 'item')).toHaveLength(MAX_RESULTS_PER_GROUP)
+  })
+
+  it('never caps the empty (browse) state, even above the cap', () => {
+    const items = Array.from({ length: MAX_RESULTS_PER_GROUP + 25 }, (_, i) => `item ${i}`)
+    const result = filterAndCap(items, id, '')
+    expect(result).toHaveLength(items.length)
+    expect(result).toBe(items)
+  })
+
+  it('treats whitespace-only input as browse: unfiltered and uncapped', () => {
+    const items = Array.from({ length: MAX_RESULTS_PER_GROUP + 25 }, (_, i) => `item ${i}`)
+    const result = filterAndCap(items, id, '   ')
+    expect(result).toBe(items)
+  })
+
+  it('returns every match untrimmed when under the cap', () => {
+    const items = ['Slack', 'Slate', 'Slalom']
+    expect(filterAndCap(items, id, 'sl')).toHaveLength(3)
+  })
+
+  it('caps to the top-ranked matches, preserving filterAndSort order', () => {
+    const items = Array.from({ length: MAX_RESULTS_PER_GROUP + 5 }, (_, i) => `item ${i}`)
+    const capped = filterAndCap(items, id, 'item')
+    expect(capped).toEqual(filterAndSort(items, id, 'item').slice(0, MAX_RESULTS_PER_GROUP))
+  })
+})
diff --git a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts
index 7970294e93f..a9f3fe9dbbe 100644
--- a/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts
+++ b/apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/utils.ts
@@ -243,17 +243,65 @@ export function fuzzyMatch(text: string, query: string): FuzzyResult {
   return tokenFallback(lowerText, lowerQuery)
 }
 
+/** Rank offset that lifts every name match above any secondary-text match. */
+const NAME_MATCH_TIER = 1_000_000
+
 /**
- * Filters items whose value fuzzy-matches the search, ordered by descending
- * score. Returns the input untouched when the search is empty.
+ * Ranks an item by its name first, falling back to secondary text (ids, aliases,
+ * option labels) only when the name doesn't match — a name match always wins, so
+ * an exact name hit isn't diluted by a long secondary string ("Agent" beats
+ * "Pi Coding Agent" for the query "agent").
  */
-export function filterAndSort<T>(items: T[], toValue: (item: T) => string, search: string): T[] {
-  if (!search) return items
+function scoreItem(name: string, extra: string | undefined, search: string): FuzzyResult {
+  const byName = fuzzyMatch(name, search)
+  if (!extra) return byName
+  if (byName.matched) {
+    return { matched: true, score: byName.score + NAME_MATCH_TIER, positions: byName.positions }
+  }
+  const byExtra = fuzzyMatch(extra, search)
+  return byExtra.matched ? byExtra : NO_MATCH
+}
+
+/**
+ * Filters and ranks items by fuzzy match, highest score first; returns the input
+ * unchanged when the search is empty or whitespace-only. Pass `toExtra` to rank
+ * the name first and fall back to secondary text.
+ */
+export function filterAndSort<T>(
+  items: T[],
+  toValue: (item: T) => string,
+  search: string,
+  toExtra?: (item: T) => string | undefined
+): T[] {
+  const query = search.trim()
+  if (!query) return items
   const scored: Array<{ item: T; score: number }> = []
   for (const item of items) {
-    const { matched, score } = fuzzyMatch(toValue(item), search)
+    const { matched, score } = scoreItem(toValue(item), toExtra?.(item), query)
     if (matched) scored.push({ item, score })
   }
   scored.sort((a, b) => b.score - a.score)
   return scored.map((entry) => entry.item)
 }
+
+/**
+ * Max rows rendered per group while searching. Re-rendering an unbounded,
+ * reshuffling match set every keystroke is what stalls typing; results are
+ * score-sorted, so the cap only drops the low-relevance tail.
+ */
+export const MAX_RESULTS_PER_GROUP = 50
+
+/**
+ * {@link filterAndSort} bounded to {@link MAX_RESULTS_PER_GROUP} while searching,
+ * so the per-keystroke render can't block typing. The empty browse state is
+ * returned in full.
+ */
+export function filterAndCap<T>(
+  items: T[],
+  toValue: (item: T) => string,
+  search: string,
+  toExtra?: (item: T) => string | undefined
+): T[] {
+  const results = filterAndSort(items, toValue, search, toExtra)
+  return search.trim() ? results.slice(0, MAX_RESULTS_PER_GROUP) : results
+}
diff --git a/apps/sim/blocks/blocks/brex.ts b/apps/sim/blocks/blocks/brex.ts
index 086617b2615..b7d8da6fa61 100644
--- a/apps/sim/blocks/blocks/brex.ts
+++ b/apps/sim/blocks/blocks/brex.ts
@@ -1044,7 +1044,10 @@ export const BrexBlock: BlockConfig<BrexResponse> = {
     routingNumber: { type: 'string', description: 'Bank routing number of the cash account' },
     primary: { type: 'boolean', description: 'Whether the cash account is primary' },
     accountId: { type: 'string', description: 'Account ID of the budget or spend limit' },
-    description: { type: 'string', description: 'Description of the budget or spend limit' },
+    description: {
+      type: 'string',
+      description: 'Description of the budget, spend limit, or transfer',
+    },
     parentBudgetId: { type: 'string', description: 'Parent budget ID' },
     ownerUserIds: { type: 'json', description: 'Owner user IDs of the budget or spend limit' },
     memberUserIds: { type: 'json', description: 'Member user IDs of the spend limit' },
@@ -1052,7 +1055,7 @@ export const BrexBlock: BlockConfig<BrexResponse> = {
     spendType: { type: 'string', description: 'Spend type of the spend limit' },
     startDate: { type: 'string', description: 'Start date of the budget or spend limit' },
     endDate: { type: 'string', description: 'End date of the budget or spend limit' },
-    amount: { type: 'json', description: 'Amount of the budget' },
+    amount: { type: 'json', description: 'Amount of the budget or transfer' },
     spendBudgetStatus: { type: 'string', description: 'Status of the budget' },
     limitType: { type: 'string', description: 'Limit type of the budget' },
     currentPeriodBalance: {
diff --git a/apps/sim/components/ui/index.ts b/apps/sim/components/ui/index.ts
index 4ee1b9a7f0c..40ccab62097 100644
--- a/apps/sim/components/ui/index.ts
+++ b/apps/sim/components/ui/index.ts
@@ -14,4 +14,5 @@ export {
   SelectTrigger,
   SelectValue,
 } from './select'
+export { ShimmerText } from './shimmer-text'
 export { ThinkingLoader, type ThinkingLoaderVariant } from './thinking-loader'
diff --git a/apps/sim/components/ui/shimmer-text.module.css b/apps/sim/components/ui/shimmer-text.module.css
new file mode 100644
index 00000000000..c4db09a974e
--- /dev/null
+++ b/apps/sim/components/ui/shimmer-text.module.css
@@ -0,0 +1,44 @@
+/**
+ * Claude-style text shimmer: the text paints from a gradient with a light band
+ * that sweeps across the glyphs via background-clip. This is the single source
+ * of truth for the treatment — the ThinkingLoader label composes it. Under
+ * reduced motion the sweep is replaced by a gentle opacity pulse in solid ink:
+ * the shimmer conveys essential in-progress state, so it needs a vestibular-safe
+ * fallback rather than none. Consumers whose resting text is not body ink set
+ * `--shimmer-rest` to their resting color.
+ */
+.shimmer {
+  background-image: linear-gradient(90deg, #4a4a4a 40%, #b0b0b0 50%, #4a4a4a 60%);
+  background-size: 200% 100%;
+  -webkit-background-clip: text;
+  background-clip: text;
+  color: transparent;
+  animation: shimmer-sweep 2.2s linear infinite;
+}
+
+:global(.dark) .shimmer {
+  background-image: linear-gradient(90deg, #b9b9b9 40%, #f8f8f8 50%, #b9b9b9 60%);
+}
+
+@keyframes shimmer-sweep {
+  to {
+    background-position: 200% 0;
+  }
+}
+
+@media (prefers-reduced-motion: reduce) {
+  .shimmer,
+  :global(.dark) .shimmer {
+    background-image: none;
+    -webkit-background-clip: initial;
+    background-clip: initial;
+    color: var(--shimmer-rest, var(--text-body));
+    animation: shimmer-pulse 2.2s ease-in-out infinite;
+  }
+}
+
+@keyframes shimmer-pulse {
+  50% {
+    opacity: 0.55;
+  }
+}
diff --git a/apps/sim/components/ui/shimmer-text.tsx b/apps/sim/components/ui/shimmer-text.tsx
new file mode 100644
index 00000000000..6e3f7fea8f6
--- /dev/null
+++ b/apps/sim/components/ui/shimmer-text.tsx
@@ -0,0 +1,17 @@
+import { cn } from '@sim/emcn'
+import styles from '@/components/ui/shimmer-text.module.css'
+
+interface ShimmerTextProps {
+  children: React.ReactNode
+  className?: string
+}
+
+/**
+ * Sweeping-highlight shimmer over a text phrase — the same treatment as the
+ * ThinkingLoader's "Thinking…" label, reusable on any active/streaming row.
+ * Size and weight come from the consumer's className; the gradient replaces
+ * the text color, so color classes are ignored while shimmering.
+ */
+export function ShimmerText({ children, className }: ShimmerTextProps) {
+  return <span className={cn(styles.shimmer, className)}>{children}</span>
+}
diff --git a/apps/sim/components/ui/thinking-loader.module.css b/apps/sim/components/ui/thinking-loader.module.css
index 83a8451d5f0..0e914eae3cb 100644
--- a/apps/sim/components/ui/thinking-loader.module.css
+++ b/apps/sim/components/ui/thinking-loader.module.css
@@ -92,23 +92,14 @@
   white-space: nowrap;
 }
 
-/* Claude-style shimmer: the text paints from a gradient with a light band
-   that sweeps across the glyphs via background-clip. */
+/* The sweeping-band treatment itself (gradient, timing, dark mode, reduced
+   motion) is owned by the shared shimmer-text module; this class only adds the
+   loader-scaled font sizing. Canonical normal weight per emcn rules: body text
+   is 400, never medium. */
 .label {
+  composes: shimmer from "./shimmer-text.module.css";
   font-size: var(--tl-label-size, 14px);
-  /* Canonical normal weight (per emcn rules: body text is 400, never medium).
-     Reads light and clean under the shimmer gradient on light surfaces. */
   font-weight: 400;
-  background-image: linear-gradient(90deg, #4a4a4a 40%, #b0b0b0 50%, #4a4a4a 60%);
-  background-size: 200% 100%;
-  -webkit-background-clip: text;
-  background-clip: text;
-  color: transparent;
-  animation: label-shimmer 2.2s linear infinite;
-}
-
-:global(.dark) .label {
-  background-image: linear-gradient(90deg, #b9b9b9 40%, #f8f8f8 50%, #b9b9b9 60%);
 }
 
 /* Static label (shimmer off): the phrase in solid body ink, no gradient sweep. */
@@ -118,12 +109,6 @@
   color: var(--text-body);
 }
 
-@keyframes label-shimmer {
-  to {
-    background-position: 200% 0;
-  }
-}
-
 /* Phrase crossfade — the incoming phrase rises and fades in while the outgoing
    one rises and fades out (stacked over it), so phrases rotate smoothly. */
 .labelStack {
@@ -366,7 +351,6 @@
 
 @media (prefers-reduced-motion: reduce) {
   .frame *,
-  .label,
   .labelIn {
     animation: none;
   }
diff --git a/apps/sim/content/blog/mothership/index.mdx b/apps/sim/content/blog/mothership/index.mdx
index cc7d8f28eb8..8f9b0181972 100644
--- a/apps/sim/content/blog/mothership/index.mdx
+++ b/apps/sim/content/blog/mothership/index.mdx
@@ -8,7 +8,7 @@ authors:
   - emir
 readingTime: 10
 tags: [Release, Mothership, Tables, Knowledge Base, Connectors, RAG, Sim]
-ogImage: /blog/mothership/cover.png
+ogImage: /blog/mothership/cover.jpg
 ogAlt: 'Introducing Mothership airship illustration'
 about: ['AI Agents', 'Workflow Automation', 'Developer Tools']
 timeRequired: PT10M
diff --git a/apps/sim/executor/handlers/pi/keys.test.ts b/apps/sim/executor/handlers/pi/keys.test.ts
index 17b407cc0ad..17c45a6d6ef 100644
--- a/apps/sim/executor/handlers/pi/keys.test.ts
+++ b/apps/sim/executor/handlers/pi/keys.test.ts
@@ -134,6 +134,21 @@ describe('resolvePiModelKey', () => {
     expect(mockGetApiKeyWithBYOK).not.toHaveBeenCalled()
   })
 
+  it('cloud mode falls back to a stored workspace key for xAI', async () => {
+    mockGetProviderFromModel.mockReturnValue('xai')
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'xai-workspace-key', isBYOK: true })
+
+    const result = await resolvePiModelKey({
+      model: 'grok-4.5',
+      mode: 'cloud',
+      workspaceId: 'ws-1',
+    })
+
+    expect(result).toEqual({ providerId: 'xai', apiKey: 'xai-workspace-key', isBYOK: true })
+    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'xai')
+    expect(mockGetApiKeyWithBYOK).not.toHaveBeenCalled()
+  })
+
   it('cloud mode rejects when no user key is available (never a hosted key)', async () => {
     mockGetProviderFromModel.mockReturnValue('anthropic')
     mockGetBYOKKey.mockResolvedValue(null)
diff --git a/apps/sim/executor/handlers/pi/keys.ts b/apps/sim/executor/handlers/pi/keys.ts
index 9d85eb8a4ee..cc28d6de4b4 100644
--- a/apps/sim/executor/handlers/pi/keys.ts
+++ b/apps/sim/executor/handlers/pi/keys.ts
@@ -33,7 +33,13 @@ interface ResolvePiModelKeyParams {
 }
 
 /** Providers whose key Sim can store as a workspace BYOK key (read back for cloud). */
-const WORKSPACE_BYOK_PROVIDERS = new Set<string>(['anthropic', 'openai', 'google', 'mistral'])
+const WORKSPACE_BYOK_PROVIDERS = new Set<string>([
+  'anthropic',
+  'openai',
+  'google',
+  'mistral',
+  'xai',
+])
 
 /** Resolves the provider and a usable API key for the selected model. */
 export async function resolvePiModelKey(params: ResolvePiModelKeyParams): Promise<PiKeyResolution> {
diff --git a/apps/sim/hooks/queries/workspace-files.test.tsx b/apps/sim/hooks/queries/workspace-files.test.tsx
new file mode 100644
index 00000000000..db51e9fc452
--- /dev/null
+++ b/apps/sim/hooks/queries/workspace-files.test.tsx
@@ -0,0 +1,104 @@
+/**
+ * @vitest-environment jsdom
+ *
+ * `useWorkspaceFileContent` against REAL react-query (no module mocks): the `refetchInterval`
+ * option must reach the query — the editor's post-stream reconcile depends on it to poll until the
+ * server content advances (see `use-editable-file-content.ts`), and both its consumers' test
+ * setups replace this module, so without this file the passthrough itself would be exercised by
+ * nothing but the type-checker.
+ */
+import { act, type ReactNode } from 'react'
+import { sleep } from '@sim/utils/helpers'
+import { QueryClient, QueryClientProvider } from '@tanstack/react-query'
+import { createRoot, type Root } from 'react-dom/client'
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { useWorkspaceFileContent } from '@/hooks/queries/workspace-files'
+
+let fetchCount = 0
+
+beforeEach(() => {
+  ;(globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean }).IS_REACT_ACT_ENVIRONMENT = true
+  fetchCount = 0
+  vi.stubGlobal(
+    'fetch',
+    vi.fn(async () => {
+      fetchCount += 1
+      return new Response('# content', { status: 200 })
+    })
+  )
+})
+
+afterEach(() => {
+  vi.unstubAllGlobals()
+})
+
+function renderContentHook(options?: {
+  refetchInterval?: number | false | (() => number | false)
+}): { unmount: () => void } {
+  const queryClient = new QueryClient({ defaultOptions: { queries: { retry: false } } })
+  const container = document.createElement('div')
+  const root: Root = createRoot(container)
+
+  function Probe() {
+    useWorkspaceFileContent('ws-1', 'file-1', 'workspace/ws-1/123-abc-doc.md', false, options)
+    return null
+  }
+
+  function Wrapper({ children }: { children: ReactNode }) {
+    return <QueryClientProvider client={queryClient}>{children}</QueryClientProvider>
+  }
+
+  act(() => {
+    root.render(
+      <Wrapper>
+        <Probe />
+      </Wrapper>
+    )
+  })
+  return {
+    unmount: () => {
+      act(() => root.unmount())
+      queryClient.clear()
+    },
+  }
+}
+
+describe('useWorkspaceFileContent refetchInterval passthrough', () => {
+  it('fetches once and does not poll by default', async () => {
+    const { unmount } = renderContentHook()
+    await act(async () => {
+      await sleep(150)
+    })
+    expect(fetchCount).toBe(1)
+    unmount()
+  })
+
+  it('polls when a numeric refetchInterval is passed', async () => {
+    const { unmount } = renderContentHook({ refetchInterval: 30 })
+    await act(async () => {
+      await sleep(200)
+    })
+    expect(fetchCount).toBeGreaterThanOrEqual(3)
+    unmount()
+  })
+
+  it('function form is re-evaluated so flipping its condition stops the polling', async () => {
+    let polling = true
+    const { unmount } = renderContentHook({ refetchInterval: () => (polling ? 30 : false) })
+    await act(async () => {
+      await sleep(200)
+    })
+    expect(fetchCount).toBeGreaterThanOrEqual(3)
+
+    polling = false
+    await act(async () => {
+      await sleep(100)
+    })
+    const settled = fetchCount
+    await act(async () => {
+      await sleep(150)
+    })
+    expect(fetchCount).toBe(settled)
+    unmount()
+  })
+})
diff --git a/apps/sim/hooks/queries/workspace-files.ts b/apps/sim/hooks/queries/workspace-files.ts
index edd65bb3984..b58da2b15ab 100644
--- a/apps/sim/hooks/queries/workspace-files.ts
+++ b/apps/sim/hooks/queries/workspace-files.ts
@@ -137,12 +137,20 @@ async function fetchWorkspaceFileContent(url: string, signal?: AbortSignal): Pro
  * Hook to fetch workspace file content as text.
  * `key` (the storage object key) is forwarded into the query key factory so that a new
  * storage key (e.g. after a file is re-uploaded) correctly busts the cache.
+ *
+ * `refetchInterval` lets a caller poll while waiting for the server content to advance — the
+ * editor's post-stream reconcile (see `use-editable-file-content.ts`) exits only when a fetch
+ * returns content that moved past its baseline, and would otherwise wedge read-only forever if
+ * its single refetch raced the agent's write. The function form is re-evaluated by react-query
+ * after every fetch and options pass, so a condition read through a ref stops the polling as soon
+ * as it flips — no re-render required.
  */
 export function useWorkspaceFileContent(
   workspaceId: string,
   fileId: string,
   key: string,
-  raw?: boolean
+  raw?: boolean,
+  options?: { refetchInterval?: number | false | (() => number | false) }
 ) {
   const source = useFileContentSource()
   return useQuery({
@@ -152,6 +160,7 @@ export function useWorkspaceFileContent(
     enabled: !!workspaceId && !!fileId && !!key,
     staleTime: WORKSPACE_FILE_CONTENT_STALE_TIME,
     refetchOnWindowFocus: 'always',
+    refetchInterval: options?.refetchInterval ?? false,
   })
 }
 
diff --git a/apps/sim/lib/api-key/byok.ts b/apps/sim/lib/api-key/byok.ts
index 4a4f26b3271..6e45fe2cad8 100644
--- a/apps/sim/lib/api-key/byok.ts
+++ b/apps/sim/lib/api-key/byok.ts
@@ -205,13 +205,14 @@ export async function getApiKeyWithBYOK(
   const isGeminiModel = provider === 'google'
   const isMistralModel = provider === 'mistral'
   const isZaiModel = provider === 'zai'
+  const isXaiModel = provider === 'xai'
 
   const byokProviderId = isGeminiModel ? 'google' : (provider as BYOKProviderId)
 
   if (
     isHosted &&
     workspaceId &&
-    (isOpenAIModel || isClaudeModel || isGeminiModel || isMistralModel || isZaiModel)
+    (isOpenAIModel || isClaudeModel || isGeminiModel || isMistralModel || isZaiModel || isXaiModel)
   ) {
     const hostedModels = getHostedModels()
     const isModelHosted = hostedModels.some((m) => m.toLowerCase() === model.toLowerCase())
diff --git a/apps/sim/lib/api/contracts/byok-keys.ts b/apps/sim/lib/api/contracts/byok-keys.ts
index 10a1d589123..0c2be6492bf 100644
--- a/apps/sim/lib/api/contracts/byok-keys.ts
+++ b/apps/sim/lib/api/contracts/byok-keys.ts
@@ -7,6 +7,7 @@ export const byokProviderIdSchema = z.enum([
   'google',
   'mistral',
   'zai',
+  'xai',
   'fireworks',
   'together',
   'baseten',
diff --git a/apps/sim/lib/api/contracts/custom-blocks.ts b/apps/sim/lib/api/contracts/custom-blocks.ts
index 01adbbddfc0..e7629109324 100644
--- a/apps/sim/lib/api/contracts/custom-blocks.ts
+++ b/apps/sim/lib/api/contracts/custom-blocks.ts
@@ -63,13 +63,27 @@ export const listCustomBlocksQuerySchema = z.object({
   workspaceId: workspaceIdSchema,
 })
 
+/**
+ * Icon URLs are rendered as org-wide `<img>` sources, so only https URLs and
+ * internal file-serve paths (what the icon upload UI stores) are accepted —
+ * never data:/blob:/other schemes an admin could smuggle into shared metadata.
+ * Shared with the copilot deploy_custom_block handler's pass-through branch.
+ */
+export function isAllowedCustomBlockIconUrl(value: string): boolean {
+  return value.startsWith('https://') || value.startsWith('/api/files/serve/')
+}
+
+const iconUrlSchema = z.string().min(1).max(2048).refine(isAllowedCustomBlockIconUrl, {
+  message: 'iconUrl must be an https URL or an internal /api/files/serve/ path',
+})
+
 export const publishCustomBlockBodySchema = z.object({
   workspaceId: workspaceIdSchema,
   workflowId: workflowIdSchema,
   name: z.string().min(1, 'Name is required').max(60, 'Name must be 60 characters or fewer'),
   description: z.string().max(280, 'Description must be 280 characters or fewer').default(''),
-  /** Uploaded icon image URL; omit for the default icon. */
-  iconUrl: z.string().min(1).max(2048).optional(),
+  /** Uploaded icon image URL (https or internal serve path); omit for the default icon. */
+  iconUrl: iconUrlSchema.optional(),
   /** Per-input placeholder hints keyed by Start field id; the field set itself is always derived from the deployment. */
   inputs: z.array(inputPlaceholderSchema).max(50).optional(),
   /** Curated outputs; omit/empty to expose the child's whole result. */
@@ -87,8 +101,8 @@ export const updateCustomBlockBodySchema = z
     name: z.string().min(1).max(60).optional(),
     description: z.string().max(280).optional(),
     enabled: z.boolean().optional(),
-    /** A URL sets/replaces the icon; `null` clears it (default icon). */
-    iconUrl: z.string().min(1).max(2048).nullable().optional(),
+    /** A URL (https or internal serve path) sets/replaces the icon; `null` clears it (default icon). */
+    iconUrl: iconUrlSchema.nullable().optional(),
     inputs: z.array(inputPlaceholderSchema).max(50).optional(),
     exposedOutputs: z.array(exposedOutputSchema).max(50).optional(),
   })
diff --git a/apps/sim/lib/api/contracts/mcp.ts b/apps/sim/lib/api/contracts/mcp.ts
index 1c0159e9ec2..b41cff74d95 100644
--- a/apps/sim/lib/api/contracts/mcp.ts
+++ b/apps/sim/lib/api/contracts/mcp.ts
@@ -38,9 +38,14 @@ export const mcpTransportSchema = z.enum(['streamable-http'])
 
 export const mcpAuthTypeSchema = z.enum(['none', 'headers', 'oauth'])
 
+const consecutiveFailuresSchema = z.preprocess(
+  (value) => (typeof value === 'number' ? value : undefined),
+  z.number().default(0)
+)
+
 export const mcpServerStatusConfigSchema = z
   .object({
-    consecutiveFailures: z.number().default(0),
+    consecutiveFailures: consecutiveFailuresSchema,
     lastSuccessfulDiscovery: z.string().nullable().default(null),
   })
   .passthrough()
diff --git a/apps/sim/lib/copilot/chat/payload.test.ts b/apps/sim/lib/copilot/chat/payload.test.ts
index 88d6abbf689..06e3a288e0a 100644
--- a/apps/sim/lib/copilot/chat/payload.test.ts
+++ b/apps/sim/lib/copilot/chat/payload.test.ts
@@ -237,4 +237,34 @@ describe('buildCopilotRequestPayload', () => {
       })
     )
   })
+
+  it('passes entitlements through and omits the field when empty', async () => {
+    const withEntitlements = await buildCopilotRequestPayload(
+      {
+        message: 'publish as a block',
+        userId: 'user-1',
+        userMessageId: 'msg-1',
+        mode: 'agent',
+        model: 'claude-opus-4-8',
+        workspaceId: 'ws-1',
+        entitlements: ['custom-blocks'],
+      },
+      { selectedModel: 'claude-opus-4-8' }
+    )
+    expect(withEntitlements).toEqual(expect.objectContaining({ entitlements: ['custom-blocks'] }))
+
+    const withoutEntitlements = await buildCopilotRequestPayload(
+      {
+        message: 'publish as a block',
+        userId: 'user-1',
+        userMessageId: 'msg-1',
+        mode: 'agent',
+        model: 'claude-opus-4-8',
+        workspaceId: 'ws-1',
+        entitlements: [],
+      },
+      { selectedModel: 'claude-opus-4-8' }
+    )
+    expect(withoutEntitlements).not.toHaveProperty('entitlements')
+  })
 })
diff --git a/apps/sim/lib/copilot/chat/payload.ts b/apps/sim/lib/copilot/chat/payload.ts
index 97943990f09..9bea8cddc10 100644
--- a/apps/sim/lib/copilot/chat/payload.ts
+++ b/apps/sim/lib/copilot/chat/payload.ts
@@ -41,6 +41,8 @@ interface BuildPayloadParams {
   workspaceContext?: string
   vfs?: VfsSnapshotV1
   userPermission?: string
+  /** Plan/flag-gated org capabilities (e.g. "custom-blocks") the mothership gates tools/prompts on. */
+  entitlements?: string[]
   userTimezone?: string
   userMetadata?: {
     name?: string
@@ -387,6 +389,7 @@ export async function buildCopilotRequestPayload(
     ...(params.workspaceContext ? { workspaceContext: params.workspaceContext } : {}),
     ...(params.vfs ? { vfs: params.vfs } : {}),
     ...(params.userPermission ? { userPermission: params.userPermission } : {}),
+    ...(params.entitlements?.length ? { entitlements: params.entitlements } : {}),
     ...(params.userTimezone ? { userTimezone: params.userTimezone } : {}),
     ...(params.userMetadata &&
     (params.userMetadata.name || params.userMetadata.email || params.userMetadata.timezone)
diff --git a/apps/sim/lib/copilot/chat/post.ts b/apps/sim/lib/copilot/chat/post.ts
index ca5943ae3b7..99345d240e6 100644
--- a/apps/sim/lib/copilot/chat/post.ts
+++ b/apps/sim/lib/copilot/chat/post.ts
@@ -25,6 +25,7 @@ import { finalizeAssistantTurn } from '@/lib/copilot/chat/terminal-state'
 import { generateWorkspaceSnapshot } from '@/lib/copilot/chat/workspace-context'
 import { chatPubSub } from '@/lib/copilot/chat-status'
 import { COPILOT_REQUEST_MODES } from '@/lib/copilot/constants'
+import { computeWorkspaceEntitlements } from '@/lib/copilot/entitlements'
 import {
   CopilotChatFinalizeOutcome,
   CopilotChatPersistOutcome,
@@ -175,6 +176,7 @@ type UnifiedChatBranch =
         contexts: Array<{ type: string; content: string; tag?: string; path?: string }>
         fileAttachments?: UnifiedChatRequest['fileAttachments']
         userPermission?: string
+        entitlements?: string[]
         userTimezone?: string
         userMetadata?: { name?: string; email?: string; timezone?: string }
         workflowId: string
@@ -212,6 +214,7 @@ type UnifiedChatBranch =
         contexts: Array<{ type: string; content: string; tag?: string; path?: string }>
         fileAttachments?: UnifiedChatRequest['fileAttachments']
         userPermission?: string
+        entitlements?: string[]
         userTimezone?: string
         userMetadata?: { name?: string; email?: string; timezone?: string }
         workspaceContext?: string
@@ -624,6 +627,7 @@ async function resolveBranch(params: {
             workspaceContext: payloadParams.workspaceContext,
             vfs: payloadParams.vfs,
             userPermission: payloadParams.userPermission,
+            entitlements: payloadParams.entitlements,
             userTimezone: payloadParams.userTimezone,
             userMetadata: payloadParams.userMetadata,
           },
@@ -679,6 +683,7 @@ async function resolveBranch(params: {
           workspaceContext: payloadParams.workspaceContext,
           vfs: payloadParams.vfs,
           userPermission: payloadParams.userPermission,
+          entitlements: payloadParams.entitlements,
           userTimezone: payloadParams.userTimezone,
           userMetadata: payloadParams.userMetadata,
           includeMothershipTools: true,
@@ -899,6 +904,9 @@ export async function handleUnifiedChatPost(req: NextRequest) {
                 }
               )
             : Promise.resolve(null)
+      const entitlementsPromise = workspaceId
+        ? computeWorkspaceEntitlements(workspaceId, authenticatedUserId)
+        : Promise.resolve([])
       // Wrap the pre-LLM prep work in spans so the trace waterfall shows
       // where time is going between "request received" and "llm.stream
       // opens". Previously these ran bare under the root and inflated the
@@ -953,10 +961,11 @@ export async function handleUnifiedChatPost(req: NextRequest) {
         activeOtelRoot.context
       )
 
-      const [agentContexts, userPermission, workspaceSnapshot, , executionContext] =
+      const [agentContexts, userPermission, entitlements, workspaceSnapshot, , executionContext] =
         await Promise.all([
           agentContextsPromise,
           userPermissionPromise,
+          entitlementsPromise,
           workspaceContextPromise,
           persistUserMessagePromise,
           executionContextPromise,
@@ -991,6 +1000,7 @@ export async function handleUnifiedChatPost(req: NextRequest) {
                 contexts: agentContexts,
                 fileAttachments: body.fileAttachments,
                 userPermission: userPermission ?? undefined,
+                entitlements,
                 userTimezone: body.userTimezone,
                 userMetadata,
                 workflowId: branch.workflowId,
@@ -1012,6 +1022,7 @@ export async function handleUnifiedChatPost(req: NextRequest) {
                 contexts: agentContexts,
                 fileAttachments: body.fileAttachments,
                 userPermission: userPermission ?? undefined,
+                entitlements,
                 userTimezone: body.userTimezone,
                 userMetadata,
                 workspaceContext,
diff --git a/apps/sim/lib/copilot/entitlements.ts b/apps/sim/lib/copilot/entitlements.ts
new file mode 100644
index 00000000000..8ef560cacea
--- /dev/null
+++ b/apps/sim/lib/copilot/entitlements.ts
@@ -0,0 +1,72 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { LRUCache } from 'lru-cache'
+import { isCustomBlocksEligible } from '@/lib/workflows/custom-blocks/operations'
+
+const logger = createLogger('CopilotEntitlements')
+
+/**
+ * Cross-repo contract: the mothership (Go) matches these exact strings against
+ * its `core.Entitlement*` constants to gate agent surfaces.
+ */
+export const CUSTOM_BLOCKS_ENTITLEMENT = 'custom-blocks'
+
+/**
+ * Workspace entitlements — plan/flag-gated org capabilities sent to the
+ * mothership as the chat payload's `entitlements` array. The Go side hides the
+ * matching tools, skills, and prompt sections when an entitlement is absent, so
+ * a non-entitled org's agents never hear of the feature.
+ *
+ * Adding an entitlement:
+ * 1. Add the kebab-case name and a fail-closed evaluator here. Every payload
+ *    site (interactive chat, headless execute, inbox) picks it up automatically.
+ * 2. Go repo: add the matching `Entitlement*` constant in `internal/core` and
+ *    gate surfaces declaratively — `RequiredEntitlement` on tool definitions,
+ *    `entitlement:` frontmatter on skills, a conditional section in
+ *    `BuildAgentEnvelope`, or a variant swap in `Capabilities`.
+ * 3. Keep enforcement in sim: the Go gating is advertisement-only (the payload
+ *    is forgeable), so the sim-side tool handler must re-check the same
+ *    predicate at execution time.
+ */
+const ENTITLEMENT_EVALUATORS: Record<
+  string,
+  (workspaceId: string, userId?: string) => Promise<boolean>
+> = {
+  [CUSTOM_BLOCKS_ENTITLEMENT]: isCustomBlocksEligible,
+}
+
+const entitlementsCache = new LRUCache<string, Promise<string[]>>({
+  max: 500,
+  ttl: 5_000,
+})
+
+/**
+ * The entitlements to send to the mothership for a request in this workspace.
+ * Each evaluator fails closed (an error means the entitlement is absent).
+ * Cached briefly so the several per-message callers collapse to one evaluation.
+ */
+export function computeWorkspaceEntitlements(
+  workspaceId: string,
+  userId?: string
+): Promise<string[]> {
+  const cacheKey = `${workspaceId}:${userId ?? ''}`
+  const cached = entitlementsCache.get(cacheKey)
+  if (cached) return cached
+
+  const promise = Promise.all(
+    Object.entries(ENTITLEMENT_EVALUATORS).map(async ([name, evaluate]) => {
+      try {
+        return (await evaluate(workspaceId, userId)) ? name : null
+      } catch (error) {
+        logger.warn('Entitlement evaluation failed; treating as absent', {
+          entitlement: name,
+          workspaceId,
+          error: getErrorMessage(error),
+        })
+        return null
+      }
+    })
+  ).then((names) => names.filter((name): name is string => name !== null))
+  entitlementsCache.set(cacheKey, promise)
+  return promise
+}
diff --git a/apps/sim/lib/copilot/generated/tool-catalog-v1.ts b/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
index 4a4c24a1594..cce8011cd3e 100644
--- a/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
+++ b/apps/sim/lib/copilot/generated/tool-catalog-v1.ts
@@ -23,6 +23,7 @@ export interface ToolCatalogEntry {
     | 'deploy'
     | 'deploy_api'
     | 'deploy_chat'
+    | 'deploy_custom_block'
     | 'deploy_mcp'
     | 'diff_workflows'
     | 'download_to_workspace_file'
@@ -121,6 +122,7 @@ export interface ToolCatalogEntry {
     | 'deploy'
     | 'deploy_api'
     | 'deploy_chat'
+    | 'deploy_custom_block'
     | 'deploy_mcp'
     | 'diff_workflows'
     | 'download_to_workspace_file'
@@ -536,7 +538,7 @@ export const Deploy: ToolCatalogEntry = {
     properties: {
       request: {
         description:
-          'Detailed deployment instructions. Include deployment type (api/chat/mcp) and ALL user-specified options: identifier, title, description, authType, password, allowedEmails, welcomeMessage, outputConfigs (block outputs to display).',
+          'Detailed deployment instructions. Include the deployment type and ALL user-specified options: identifier, title, description, authType, password, allowedEmails, welcomeMessage, outputConfigs (block outputs to display).',
         type: 'string',
       },
     },
@@ -772,6 +774,119 @@ export const DeployChat: ToolCatalogEntry = {
   requiredPermission: 'admin',
 }
 
+export const DeployCustomBlock: ToolCatalogEntry = {
+  id: 'deploy_custom_block',
+  name: 'deploy_custom_block',
+  route: 'sim',
+  mode: 'async',
+  parameters: {
+    type: 'object',
+    properties: {
+      action: {
+        type: 'string',
+        description: 'Whether to publish (deploy) or unpublish (undeploy) the custom block',
+        enum: ['deploy', 'undeploy'],
+        default: 'deploy',
+      },
+      description: {
+        type: 'string',
+        description: 'Short description shown in the block picker, max 280 characters',
+      },
+      exposedOutputs: {
+        type: 'array',
+        description:
+          "Outputs the block exposes, each mapping a child block output path to a friendly name (use get_block_outputs for valid paths). Omit to expose the terminal block's whole result",
+        items: {
+          type: 'object',
+          properties: {
+            blockId: { type: 'string', description: 'Block UUID inside the workflow' },
+            name: { type: 'string', description: 'Friendly output name shown on the block' },
+            path: {
+              type: 'string',
+              description:
+                "Dot-path into that block's output (from get_block_outputs relativeOutputs)",
+            },
+          },
+          required: ['blockId', 'path', 'name'],
+        },
+      },
+      iconUrl: {
+        type: 'string',
+        description:
+          'Optional icon image for the block: a workspace file VFS path (e.g. "files/icon.png", copied into public icon storage at publish) or an external image URL. Omit to use the organization\'s default icon',
+      },
+      inputs: {
+        type: 'array',
+        description:
+          "Optional per-input placeholder overrides. Input names and types are derived from the workflow's input trigger and cannot be changed here",
+        items: {
+          type: 'object',
+          properties: {
+            id: { type: 'string', description: 'Stable id of the input trigger field' },
+            placeholder: {
+              type: 'string',
+              description: "Placeholder text shown in the block's input field",
+            },
+          },
+          required: ['id'],
+        },
+      },
+      name: {
+        type: 'string',
+        description:
+          'Display name for the block, max 60 characters. When republishing an existing block, pass the current name to keep it or a new name to rename.',
+      },
+      workflowId: { type: 'string', description: 'Workflow ID (defaults to active workflow)' },
+    },
+    required: ['name'],
+  },
+  resultSchema: {
+    type: 'object',
+    properties: {
+      action: {
+        type: 'string',
+        description: 'Action performed by the tool, such as "deploy" or "undeploy".',
+      },
+      blockId: { type: 'string', description: 'Custom block record ID.' },
+      blockType: {
+        type: 'string',
+        description: 'Stable block type slug (custom_block_*) used in workflow state.',
+      },
+      deploymentConfig: {
+        type: 'object',
+        description:
+          "Structured deployment configuration keyed by surface name. Includes the block's type, name, description, icon, derived input fields, and exposed outputs.",
+      },
+      deploymentStatus: {
+        type: 'object',
+        description:
+          'Structured per-surface deployment status keyed by surface name, including customBlock and the underlying api surface when applicable.',
+      },
+      deploymentType: {
+        type: 'string',
+        description:
+          'Deployment surface this result describes. For deploy_custom_block this is always "custom_block".',
+      },
+      isDeployed: {
+        type: 'boolean',
+        description: 'Whether the custom block is published after this tool call.',
+      },
+      name: { type: 'string', description: 'Display name of the custom block.' },
+      removed: {
+        type: 'boolean',
+        description: 'Whether the custom block was unpublished during an undeploy action.',
+      },
+      updated: {
+        type: 'boolean',
+        description: 'Whether an existing custom block was updated instead of created.',
+      },
+      workflowId: { type: 'string', description: 'Workflow ID the custom block is bound to.' },
+    },
+    required: ['deploymentType', 'deploymentStatus'],
+  },
+  requiredPermission: 'admin',
+}
+
 export const DeployMcp: ToolCatalogEntry = {
   id: 'deploy_mcp',
   name: 'deploy_mcp',
@@ -4581,6 +4696,7 @@ export const TOOL_CATALOG: Record<string, ToolCatalogEntry> = {
   [Deploy.id]: Deploy,
   [DeployApi.id]: DeployApi,
   [DeployChat.id]: DeployChat,
+  [DeployCustomBlock.id]: DeployCustomBlock,
   [DeployMcp.id]: DeployMcp,
   [DiffWorkflows.id]: DiffWorkflows,
   [DownloadToWorkspaceFile.id]: DownloadToWorkspaceFile,
diff --git a/apps/sim/lib/copilot/generated/tool-schemas-v1.ts b/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
index dcaea0db6ea..bdb97241d30 100644
--- a/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
+++ b/apps/sim/lib/copilot/generated/tool-schemas-v1.ts
@@ -10,7 +10,7 @@ export interface ToolRuntimeSchemaEntry {
 }
 
 export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
-  agent: {
+  ['agent']: {
     parameters: {
       properties: {
         request: {
@@ -23,7 +23,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  auth: {
+  ['auth']: {
     parameters: {
       properties: {
         request: {
@@ -36,7 +36,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  check_deployment_status: {
+  ['check_deployment_status']: {
     parameters: {
       type: 'object',
       properties: {
@@ -48,7 +48,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  complete_scheduled_task: {
+  ['complete_scheduled_task']: {
     parameters: {
       type: 'object',
       properties: {
@@ -61,7 +61,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  crawl_website: {
+  ['crawl_website']: {
     parameters: {
       type: 'object',
       properties: {
@@ -96,7 +96,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  create_file: {
+  ['create_file']: {
     parameters: {
       type: 'object',
       properties: {
@@ -162,7 +162,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['success', 'message'],
     },
   },
-  create_file_folder: {
+  ['create_file_folder']: {
     parameters: {
       type: 'object',
       properties: {
@@ -180,7 +180,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  create_workflow: {
+  ['create_workflow']: {
     parameters: {
       type: 'object',
       properties: {
@@ -205,7 +205,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  create_workspace_mcp_server: {
+  ['create_workspace_mcp_server']: {
     parameters: {
       type: 'object',
       properties: {
@@ -238,7 +238,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  delete_file: {
+  ['delete_file']: {
     parameters: {
       type: 'object',
       properties: {
@@ -268,7 +268,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['success', 'message'],
     },
   },
-  delete_file_folder: {
+  ['delete_file_folder']: {
     parameters: {
       type: 'object',
       properties: {
@@ -284,7 +284,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  delete_workflow: {
+  ['delete_workflow']: {
     parameters: {
       type: 'object',
       properties: {
@@ -300,7 +300,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  delete_workspace_mcp_server: {
+  ['delete_workspace_mcp_server']: {
     parameters: {
       type: 'object',
       properties: {
@@ -313,12 +313,12 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  deploy: {
+  ['deploy']: {
     parameters: {
       properties: {
         request: {
           description:
-            'Detailed deployment instructions. Include deployment type (api/chat/mcp) and ALL user-specified options: identifier, title, description, authType, password, allowedEmails, welcomeMessage, outputConfigs (block outputs to display).',
+            'Detailed deployment instructions. Include the deployment type and ALL user-specified options: identifier, title, description, authType, password, allowedEmails, welcomeMessage, outputConfigs (block outputs to display).',
           type: 'string',
         },
       },
@@ -327,7 +327,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  deploy_api: {
+  ['deploy_api']: {
     parameters: {
       type: 'object',
       properties: {
@@ -411,7 +411,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       ],
     },
   },
-  deploy_chat: {
+  ['deploy_chat']: {
     parameters: {
       type: 'object',
       properties: {
@@ -570,7 +570,135 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       ],
     },
   },
-  deploy_mcp: {
+  ['deploy_custom_block']: {
+    parameters: {
+      type: 'object',
+      properties: {
+        action: {
+          type: 'string',
+          description: 'Whether to publish (deploy) or unpublish (undeploy) the custom block',
+          enum: ['deploy', 'undeploy'],
+          default: 'deploy',
+        },
+        description: {
+          type: 'string',
+          description: 'Short description shown in the block picker, max 280 characters',
+        },
+        exposedOutputs: {
+          type: 'array',
+          description:
+            "Outputs the block exposes, each mapping a child block output path to a friendly name (use get_block_outputs for valid paths). Omit to expose the terminal block's whole result",
+          items: {
+            type: 'object',
+            properties: {
+              blockId: {
+                type: 'string',
+                description: 'Block UUID inside the workflow',
+              },
+              name: {
+                type: 'string',
+                description: 'Friendly output name shown on the block',
+              },
+              path: {
+                type: 'string',
+                description:
+                  "Dot-path into that block's output (from get_block_outputs relativeOutputs)",
+              },
+            },
+            required: ['blockId', 'path', 'name'],
+          },
+        },
+        iconUrl: {
+          type: 'string',
+          description:
+            'Optional icon image for the block: a workspace file VFS path (e.g. "files/icon.png", copied into public icon storage at publish) or an external image URL. Omit to use the organization\'s default icon',
+        },
+        inputs: {
+          type: 'array',
+          description:
+            "Optional per-input placeholder overrides. Input names and types are derived from the workflow's input trigger and cannot be changed here",
+          items: {
+            type: 'object',
+            properties: {
+              id: {
+                type: 'string',
+                description: 'Stable id of the input trigger field',
+              },
+              placeholder: {
+                type: 'string',
+                description: "Placeholder text shown in the block's input field",
+              },
+            },
+            required: ['id'],
+          },
+        },
+        name: {
+          type: 'string',
+          description:
+            'Display name for the block, max 60 characters. When republishing an existing block, pass the current name to keep it or a new name to rename.',
+        },
+        workflowId: {
+          type: 'string',
+          description: 'Workflow ID (defaults to active workflow)',
+        },
+      },
+      required: ['name'],
+    },
+    resultSchema: {
+      type: 'object',
+      properties: {
+        action: {
+          type: 'string',
+          description: 'Action performed by the tool, such as "deploy" or "undeploy".',
+        },
+        blockId: {
+          type: 'string',
+          description: 'Custom block record ID.',
+        },
+        blockType: {
+          type: 'string',
+          description: 'Stable block type slug (custom_block_*) used in workflow state.',
+        },
+        deploymentConfig: {
+          type: 'object',
+          description:
+            "Structured deployment configuration keyed by surface name. Includes the block's type, name, description, icon, derived input fields, and exposed outputs.",
+        },
+        deploymentStatus: {
+          type: 'object',
+          description:
+            'Structured per-surface deployment status keyed by surface name, including customBlock and the underlying api surface when applicable.',
+        },
+        deploymentType: {
+          type: 'string',
+          description:
+            'Deployment surface this result describes. For deploy_custom_block this is always "custom_block".',
+        },
+        isDeployed: {
+          type: 'boolean',
+          description: 'Whether the custom block is published after this tool call.',
+        },
+        name: {
+          type: 'string',
+          description: 'Display name of the custom block.',
+        },
+        removed: {
+          type: 'boolean',
+          description: 'Whether the custom block was unpublished during an undeploy action.',
+        },
+        updated: {
+          type: 'boolean',
+          description: 'Whether an existing custom block was updated instead of created.',
+        },
+        workflowId: {
+          type: 'string',
+          description: 'Workflow ID the custom block is bound to.',
+        },
+      },
+      required: ['deploymentType', 'deploymentStatus'],
+    },
+  },
+  ['deploy_mcp']: {
     parameters: {
       type: 'object',
       properties: {
@@ -686,7 +814,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['deploymentType', 'deploymentStatus'],
     },
   },
-  diff_workflows: {
+  ['diff_workflows']: {
     parameters: {
       type: 'object',
       properties: {
@@ -710,7 +838,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  download_to_workspace_file: {
+  ['download_to_workspace_file']: {
     parameters: {
       type: 'object',
       properties: {
@@ -759,7 +887,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  edit_content: {
+  ['edit_content']: {
     parameters: {
       type: 'object',
       properties: {
@@ -791,7 +919,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['success', 'message'],
     },
   },
-  edit_workflow: {
+  ['edit_workflow']: {
     parameters: {
       type: 'object',
       properties: {
@@ -830,7 +958,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  enrichment_run: {
+  ['enrichment_run']: {
     parameters: {
       type: 'object',
       properties: {
@@ -874,7 +1002,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['matched', 'result'],
     },
   },
-  ffmpeg: {
+  ['ffmpeg']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1055,7 +1183,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  file: {
+  ['file']: {
     parameters: {
       properties: {
         prompt: {
@@ -1068,7 +1196,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  function_execute: {
+  ['function_execute']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1206,7 +1334,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  generate_api_key: {
+  ['generate_api_key']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1224,7 +1352,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  generate_audio: {
+  ['generate_audio']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1376,7 +1504,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  generate_image: {
+  ['generate_image']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1504,7 +1632,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  generate_video: {
+  ['generate_video']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1671,7 +1799,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_block_outputs: {
+  ['get_block_outputs']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1692,7 +1820,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_block_upstream_references: {
+  ['get_block_upstream_references']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1714,7 +1842,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_deployed_workflow_state: {
+  ['get_deployed_workflow_state']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1727,7 +1855,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_deployment_log: {
+  ['get_deployment_log']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1740,7 +1868,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_page_contents: {
+  ['get_page_contents']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1768,14 +1896,14 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_platform_actions: {
+  ['get_platform_actions']: {
     parameters: {
       type: 'object',
       properties: {},
     },
     resultSchema: undefined,
   },
-  get_scheduled_task_logs: {
+  ['get_scheduled_task_logs']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1800,7 +1928,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_workflow_data: {
+  ['get_workflow_data']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1819,7 +1947,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  get_workflow_run_options: {
+  ['get_workflow_run_options']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1832,7 +1960,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  glob: {
+  ['glob']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1851,7 +1979,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  grep: {
+  ['grep']: {
     parameters: {
       type: 'object',
       properties: {
@@ -1899,7 +2027,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  knowledge: {
+  ['knowledge']: {
     parameters: {
       properties: {
         request: {
@@ -1912,7 +2040,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  knowledge_base: {
+  ['knowledge_base']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2105,7 +2233,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['success', 'message'],
     },
   },
-  list_file_folders: {
+  ['list_file_folders']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2117,7 +2245,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  list_integration_tools: {
+  ['list_integration_tools']: {
     parameters: {
       properties: {
         integration: {
@@ -2131,14 +2259,14 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  list_user_workspaces: {
+  ['list_user_workspaces']: {
     parameters: {
       type: 'object',
       properties: {},
     },
     resultSchema: undefined,
   },
-  list_workspace_mcp_servers: {
+  ['list_workspace_mcp_servers']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2151,7 +2279,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  load_deployment: {
+  ['load_deployment']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2170,7 +2298,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  load_integration_tool: {
+  ['load_integration_tool']: {
     parameters: {
       properties: {
         tool_ids: {
@@ -2187,7 +2315,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  manage_credential: {
+  ['manage_credential']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2216,7 +2344,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  manage_custom_tool: {
+  ['manage_custom_tool']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2296,7 +2424,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  manage_folder: {
+  ['manage_folder']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2335,7 +2463,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  manage_mcp_tool: {
+  ['manage_mcp_tool']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2387,7 +2515,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  manage_scheduled_task: {
+  ['manage_scheduled_task']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2462,7 +2590,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  manage_skill: {
+  ['manage_skill']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2495,7 +2623,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  materialize_file: {
+  ['materialize_file']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2519,7 +2647,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  media: {
+  ['media']: {
     parameters: {
       properties: {
         prompt: {
@@ -2532,7 +2660,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  move_file: {
+  ['move_file']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2553,7 +2681,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  move_file_folder: {
+  ['move_file_folder']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2571,7 +2699,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  move_workflow: {
+  ['move_workflow']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2591,7 +2719,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  oauth_get_auth_link: {
+  ['oauth_get_auth_link']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2605,7 +2733,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  oauth_request_access: {
+  ['oauth_request_access']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2619,7 +2747,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  open_resource: {
+  ['open_resource']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2653,7 +2781,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  promote_to_live: {
+  ['promote_to_live']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2672,7 +2800,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  query_logs: {
+  ['query_logs']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2783,7 +2911,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  read: {
+  ['read']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2810,7 +2938,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  redeploy: {
+  ['redeploy']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2889,7 +3017,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       ],
     },
   },
-  rename_file: {
+  ['rename_file']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2925,7 +3053,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['success', 'message'],
     },
   },
-  rename_file_folder: {
+  ['rename_file_folder']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2942,7 +3070,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  rename_workflow: {
+  ['rename_workflow']: {
     parameters: {
       type: 'object',
       properties: {
@@ -2959,7 +3087,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  research: {
+  ['research']: {
     parameters: {
       properties: {
         topic: {
@@ -2972,7 +3100,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  respond: {
+  ['respond']: {
     parameters: {
       additionalProperties: true,
       properties: {
@@ -2995,7 +3123,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  restore_resource: {
+  ['restore_resource']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3013,7 +3141,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  run: {
+  ['run']: {
     parameters: {
       properties: {
         context: {
@@ -3030,7 +3158,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  run_block: {
+  ['run_block']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3062,7 +3190,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  run_from_block: {
+  ['run_from_block']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3094,7 +3222,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  run_workflow: {
+  ['run_workflow']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3132,7 +3260,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  run_workflow_until_block: {
+  ['run_workflow_until_block']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3175,7 +3303,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  scheduled_task: {
+  ['scheduled_task']: {
     parameters: {
       properties: {
         request: {
@@ -3188,7 +3316,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  scrape_page: {
+  ['scrape_page']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3209,7 +3337,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  search_documentation: {
+  ['search_documentation']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3226,7 +3354,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  search_library_docs: {
+  ['search_library_docs']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3247,7 +3375,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  search_online: {
+  ['search_online']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3287,7 +3415,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  search_patterns: {
+  ['search_patterns']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3309,7 +3437,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  set_block_enabled: {
+  ['set_block_enabled']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3331,7 +3459,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  set_environment_variables: {
+  ['set_environment_variables']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3365,7 +3493,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  set_global_workflow_variables: {
+  ['set_global_workflow_variables']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3406,7 +3534,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  superagent: {
+  ['superagent']: {
     parameters: {
       properties: {
         task: {
@@ -3420,7 +3548,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  table: {
+  ['table']: {
     parameters: {
       properties: {
         request: {
@@ -3433,7 +3561,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  update_deployment_version: {
+  ['update_deployment_version']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3462,7 +3590,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  update_scheduled_task_history: {
+  ['update_scheduled_task_history']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3480,7 +3608,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  update_workspace_mcp_server: {
+  ['update_workspace_mcp_server']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3505,7 +3633,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  user_memory: {
+  ['user_memory']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3554,7 +3682,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  user_table: {
+  ['user_table']: {
     parameters: {
       type: 'object',
       properties: {
@@ -3917,7 +4045,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
       required: ['success', 'message'],
     },
   },
-  workflow: {
+  ['workflow']: {
     parameters: {
       properties: {
         prompt: {
@@ -3930,7 +4058,7 @@ export const TOOL_RUNTIME_SCHEMAS: Record<string, ToolRuntimeSchemaEntry> = {
     },
     resultSchema: undefined,
   },
-  workspace_file: {
+  ['workspace_file']: {
     parameters: {
       type: 'object',
       properties: {
diff --git a/apps/sim/lib/copilot/tool-executor/register-handlers.ts b/apps/sim/lib/copilot/tool-executor/register-handlers.ts
index b39027e3526..999dea91b28 100644
--- a/apps/sim/lib/copilot/tool-executor/register-handlers.ts
+++ b/apps/sim/lib/copilot/tool-executor/register-handlers.ts
@@ -8,6 +8,7 @@ import {
   DeleteWorkspaceMcpServer,
   DeployApi,
   DeployChat,
+  DeployCustomBlock,
   DeployMcp,
   DiffWorkflows,
   FunctionExecute,
@@ -53,6 +54,7 @@ import {
 } from '@/lib/copilot/generated/tool-catalog-v1'
 import { createServerToolHandler } from '@/lib/copilot/tools/registry/server-tool-adapter'
 import { getRegisteredServerToolNames } from '@/lib/copilot/tools/server/router'
+import { executeDeployCustomBlock } from '../tools/handlers/deployment/custom-block'
 import {
   executeDeployApi,
   executeDeployChat,
@@ -156,6 +158,7 @@ function buildHandlerMap(): Record<string, ToolHandler> {
     [DeployApi.id]: h(executeDeployApi),
     [DeployChat.id]: h(executeDeployChat),
     [DeployMcp.id]: h(executeDeployMcp),
+    [DeployCustomBlock.id]: h(executeDeployCustomBlock),
     [Redeploy.id]: h(executeRedeploy),
     [CheckDeploymentStatus.id]: h(executeCheckDeploymentStatus),
     [ListWorkspaceMcpServers.id]: h(executeListWorkspaceMcpServers),
diff --git a/apps/sim/lib/copilot/tools/handlers/deployment/custom-block.test.ts b/apps/sim/lib/copilot/tools/handlers/deployment/custom-block.test.ts
new file mode 100644
index 00000000000..480d33a801e
--- /dev/null
+++ b/apps/sim/lib/copilot/tools/handlers/deployment/custom-block.test.ts
@@ -0,0 +1,437 @@
+/**
+ * @vitest-environment node
+ */
+
+import { auditMock } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+import type { ExecutionContext } from '@/lib/copilot/request/types'
+
+const {
+  ensureWorkflowAccessMock,
+  getWorkspaceWithOwnerMock,
+  isFeatureEnabledMock,
+  isOrganizationOnEnterprisePlanMock,
+  publishCustomBlockMock,
+  updateCustomBlockMock,
+  deleteCustomBlockMock,
+  getCustomBlockWithInputsByWorkflowIdMock,
+  listWorkspaceFilesMock,
+  fetchWorkspaceFileBufferMock,
+  uploadFileMock,
+} = vi.hoisted(() => ({
+  ensureWorkflowAccessMock: vi.fn(),
+  getWorkspaceWithOwnerMock: vi.fn(),
+  isFeatureEnabledMock: vi.fn(),
+  isOrganizationOnEnterprisePlanMock: vi.fn(),
+  publishCustomBlockMock: vi.fn(),
+  updateCustomBlockMock: vi.fn(),
+  deleteCustomBlockMock: vi.fn(),
+  getCustomBlockWithInputsByWorkflowIdMock: vi.fn(),
+  listWorkspaceFilesMock: vi.fn(),
+  fetchWorkspaceFileBufferMock: vi.fn(),
+  uploadFileMock: vi.fn(),
+}))
+
+vi.mock('@sim/audit', () => auditMock)
+
+vi.mock('../access', () => ({
+  ensureWorkflowAccess: ensureWorkflowAccessMock,
+  ensureWorkspaceAccess: vi.fn(),
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getWorkspaceWithOwner: getWorkspaceWithOwnerMock,
+}))
+
+vi.mock('@/lib/core/config/feature-flags', () => ({
+  isFeatureEnabled: isFeatureEnabledMock,
+}))
+
+vi.mock('@/lib/billing', () => ({
+  isOrganizationOnEnterprisePlan: isOrganizationOnEnterprisePlanMock,
+}))
+
+vi.mock('@/lib/uploads/contexts/workspace/workspace-file-manager', () => ({
+  listWorkspaceFiles: listWorkspaceFilesMock,
+  fetchWorkspaceFileBuffer: fetchWorkspaceFileBufferMock,
+}))
+
+vi.mock('@/lib/uploads/core/storage-service', () => ({
+  uploadFile: uploadFileMock,
+}))
+
+vi.mock('@/lib/uploads/utils/file-utils', () => ({
+  isImageFileType: (type: string) => type.startsWith('image/'),
+}))
+
+vi.mock('@/lib/workflows/custom-blocks/operations', () => {
+  class CustomBlockValidationError extends Error {}
+  return {
+    CustomBlockValidationError,
+    publishCustomBlock: publishCustomBlockMock,
+    updateCustomBlock: updateCustomBlockMock,
+    deleteCustomBlock: deleteCustomBlockMock,
+    getCustomBlockWithInputsByWorkflowId: getCustomBlockWithInputsByWorkflowIdMock,
+  }
+})
+
+import { executeDeployCustomBlock } from './custom-block'
+
+const context = { userId: 'user-1', workflowId: 'wf-1' } as ExecutionContext
+
+const publishedBlock = {
+  id: 'cb-1',
+  organizationId: 'org-1',
+  workflowId: 'wf-1',
+  workflowName: 'Test Workflow',
+  workspaceId: 'ws-1',
+  workspaceName: 'Workspace',
+  type: 'custom_block_abc123',
+  name: 'Enrich Lead',
+  description: 'Enrich a lead by email',
+  iconUrl: null,
+  enabled: true,
+  inputFields: [{ id: 'f1', name: 'email', type: 'string' }],
+  exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'summary' }],
+}
+
+describe('executeDeployCustomBlock', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    ensureWorkflowAccessMock.mockResolvedValue({
+      workflow: { id: 'wf-1', workspaceId: 'ws-1', name: 'Test Workflow', isDeployed: true },
+    })
+    getWorkspaceWithOwnerMock.mockResolvedValue({ id: 'ws-1', organizationId: 'org-1' })
+    isFeatureEnabledMock.mockResolvedValue(true)
+    isOrganizationOnEnterprisePlanMock.mockResolvedValue(true)
+    getCustomBlockWithInputsByWorkflowIdMock.mockResolvedValue(null)
+  })
+
+  it('publishes a new custom block', async () => {
+    publishCustomBlockMock.mockResolvedValue(publishedBlock)
+
+    const result = await executeDeployCustomBlock(
+      {
+        name: 'Enrich Lead',
+        description: 'Enrich a lead by email',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'summary' }],
+      },
+      context
+    )
+
+    expect(ensureWorkflowAccessMock).toHaveBeenCalledWith('wf-1', 'user-1', 'admin')
+    expect(publishCustomBlockMock).toHaveBeenCalledWith({
+      organizationId: 'org-1',
+      workspaceId: 'ws-1',
+      workflowId: 'wf-1',
+      userId: 'user-1',
+      name: 'Enrich Lead',
+      description: 'Enrich a lead by email',
+      iconUrl: undefined,
+      inputs: undefined,
+      exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'summary' }],
+    })
+    expect(result.success).toBe(true)
+    expect(result.output).toMatchObject({
+      workflowId: 'wf-1',
+      blockType: 'custom_block_abc123',
+      isDeployed: true,
+      updated: false,
+      deploymentType: 'custom_block',
+      deploymentStatus: { customBlock: { isDeployed: true, name: 'Enrich Lead' } },
+    })
+  })
+
+  it('returns a clean admin-permission error when workflow access is denied', async () => {
+    ensureWorkflowAccessMock.mockRejectedValue(new Error('Unauthorized workflow access'))
+
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead' }, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('admin permission')
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('surfaces workflow-not-found from access resolution', async () => {
+    ensureWorkflowAccessMock.mockRejectedValue(new Error('Workflow wf-1 not found'))
+
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead' }, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('not found')
+  })
+
+  it('requires a name on first publish', async () => {
+    const result = await executeDeployCustomBlock({}, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('name is required')
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('requires the workflow to be deployed on first publish', async () => {
+    ensureWorkflowAccessMock.mockResolvedValue({
+      workflow: { id: 'wf-1', workspaceId: 'ws-1', name: 'Test Workflow', isDeployed: false },
+    })
+
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead' }, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('deploy_api')
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('updates an existing block in place', async () => {
+    getCustomBlockWithInputsByWorkflowIdMock
+      .mockResolvedValueOnce(publishedBlock)
+      .mockResolvedValueOnce({ ...publishedBlock, name: 'Enrich Lead v2' })
+
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead v2' }, context)
+
+    expect(updateCustomBlockMock).toHaveBeenCalledWith('cb-1', {
+      name: 'Enrich Lead v2',
+      description: undefined,
+      iconUrl: undefined,
+      inputs: undefined,
+      exposedOutputs: undefined,
+    })
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+    expect(result.success).toBe(true)
+    expect(result.output).toMatchObject({ updated: true, name: 'Enrich Lead v2' })
+  })
+
+  it('unpublishes the block on undeploy', async () => {
+    getCustomBlockWithInputsByWorkflowIdMock.mockResolvedValue(publishedBlock)
+
+    const result = await executeDeployCustomBlock({ action: 'undeploy' }, context)
+
+    expect(deleteCustomBlockMock).toHaveBeenCalledWith('cb-1')
+    expect(result.success).toBe(true)
+    expect(result.output).toMatchObject({
+      isDeployed: false,
+      removed: true,
+      action: 'undeploy',
+      blockType: 'custom_block_abc123',
+    })
+  })
+
+  it('updates an existing block without requiring the enterprise plan', async () => {
+    isOrganizationOnEnterprisePlanMock.mockResolvedValue(false)
+    getCustomBlockWithInputsByWorkflowIdMock
+      .mockResolvedValueOnce(publishedBlock)
+      .mockResolvedValueOnce(publishedBlock)
+
+    const result = await executeDeployCustomBlock({ description: 'refreshed copy' }, context)
+
+    expect(result.success).toBe(true)
+    expect(updateCustomBlockMock).toHaveBeenCalled()
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('undeploys without requiring the enterprise plan', async () => {
+    isOrganizationOnEnterprisePlanMock.mockResolvedValue(false)
+    getCustomBlockWithInputsByWorkflowIdMock.mockResolvedValue(publishedBlock)
+
+    const result = await executeDeployCustomBlock({ action: 'undeploy' }, context)
+
+    expect(result.success).toBe(true)
+    expect(deleteCustomBlockMock).toHaveBeenCalledWith('cb-1')
+  })
+
+  it('does not clear the stored name when a republish sends whitespace', async () => {
+    getCustomBlockWithInputsByWorkflowIdMock
+      .mockResolvedValueOnce(publishedBlock)
+      .mockResolvedValueOnce(publishedBlock)
+
+    const result = await executeDeployCustomBlock({ name: '   ' }, context)
+
+    expect(updateCustomBlockMock).toHaveBeenCalledWith(
+      'cb-1',
+      expect.objectContaining({ name: undefined })
+    )
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects oversized exposedOutputs and inputs arrays', async () => {
+    const outputs = Array.from({ length: 51 }, (_, i) => ({
+      blockId: `b${i}`,
+      path: 'content',
+      name: `out${i}`,
+    }))
+    const tooManyOutputs = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', exposedOutputs: outputs },
+      context
+    )
+    expect(tooManyOutputs.success).toBe(false)
+    expect(tooManyOutputs.error).toContain('50')
+
+    const inputs = Array.from({ length: 51 }, (_, i) => ({ id: `f${i}` }))
+    const tooManyInputs = await executeDeployCustomBlock({ name: 'Enrich Lead', inputs }, context)
+    expect(tooManyInputs.success).toBe(false)
+    expect(tooManyInputs.error).toContain('50')
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects oversized per-item fields', async () => {
+    const longPlaceholder = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', inputs: [{ id: 'f1', placeholder: 'x'.repeat(201) }] },
+      context
+    )
+    expect(longPlaceholder.success).toBe(false)
+    expect(longPlaceholder.error).toContain('200')
+
+    const longOutputName = await executeDeployCustomBlock(
+      {
+        name: 'Enrich Lead',
+        exposedOutputs: [{ blockId: 'b1', path: 'content', name: 'x'.repeat(61) }],
+      },
+      context
+    )
+    expect(longOutputName.success).toBe(false)
+    expect(longOutputName.error).toContain('60')
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects exposedOutputs entries missing required fields', async () => {
+    const result = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', exposedOutputs: [{ blockId: 'b1', path: '', name: 'out' }] },
+      context
+    )
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('blockId, path, and name')
+  })
+
+  it('fails undeploy when the workflow is not published as a block', async () => {
+    const result = await executeDeployCustomBlock({ action: 'undeploy' }, context)
+
+    expect(result.success).toBe(false)
+    expect(deleteCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('fails when the feature flag is off', async () => {
+    isFeatureEnabledMock.mockResolvedValue(false)
+
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead' }, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('not enabled')
+  })
+
+  it('fails when the org is not on the enterprise plan', async () => {
+    isOrganizationOnEnterprisePlanMock.mockResolvedValue(false)
+
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead' }, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('enterprise')
+  })
+
+  it('ingests a workspace-file icon into public icon storage', async () => {
+    listWorkspaceFilesMock.mockResolvedValue([
+      {
+        name: 'icon.png',
+        folderPath: null,
+        type: 'image/png',
+        size: 1024,
+        key: 'workspace/ws-1/123-abc-icon.png',
+      },
+    ])
+    fetchWorkspaceFileBufferMock.mockResolvedValue(Buffer.from('png-bytes'))
+    uploadFileMock.mockResolvedValue({ path: '/api/files/serve/s3/workspace-logos%2Ficon.png' })
+    publishCustomBlockMock.mockResolvedValue(publishedBlock)
+
+    const result = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', iconUrl: 'files/icon.png' },
+      context
+    )
+
+    expect(uploadFileMock).toHaveBeenCalledWith(
+      expect.objectContaining({
+        context: 'workspace-logos',
+        contentType: 'image/png',
+        customKey: expect.stringMatching(/^workspace-logos\/\d+-[A-Za-z0-9_-]+-icon\.png$/),
+        preserveKey: true,
+        metadata: { workspaceId: 'ws-1', userId: 'user-1', originalName: 'icon.png' },
+      })
+    )
+    expect(publishCustomBlockMock).toHaveBeenCalledWith(
+      expect.objectContaining({ iconUrl: '/api/files/serve/s3/workspace-logos%2Ficon.png' })
+    )
+    expect(result.success).toBe(true)
+  })
+
+  it('passes an external icon URL through without ingestion', async () => {
+    publishCustomBlockMock.mockResolvedValue(publishedBlock)
+
+    const result = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', iconUrl: 'https://example.com/icon.png' },
+      context
+    )
+
+    expect(uploadFileMock).not.toHaveBeenCalled()
+    expect(publishCustomBlockMock).toHaveBeenCalledWith(
+      expect.objectContaining({ iconUrl: 'https://example.com/icon.png' })
+    )
+    expect(result.success).toBe(true)
+  })
+
+  it('fails when the icon workspace file does not exist', async () => {
+    listWorkspaceFilesMock.mockResolvedValue([])
+
+    const result = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', iconUrl: 'files/missing.png' },
+      context
+    )
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('not found')
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+  })
+
+  it('rejects non-https icon URL schemes on pass-through', async () => {
+    const dataUri = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', iconUrl: 'data:image/svg+xml;base64,PHN2Zy8+' },
+      context
+    )
+    expect(dataUri.success).toBe(false)
+    expect(dataUri.error).toContain('https')
+
+    const plainHttp = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', iconUrl: 'http://example.com/icon.png' },
+      context
+    )
+    expect(plainHttp.success).toBe(false)
+    expect(publishCustomBlockMock).not.toHaveBeenCalled()
+
+    publishCustomBlockMock.mockResolvedValue(publishedBlock)
+    const servePath = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', iconUrl: '/api/files/serve/workspace-logos%2Ficon.png' },
+      context
+    )
+    expect(servePath.success).toBe(true)
+  })
+
+  it('fails when the icon workspace file is not an image', async () => {
+    listWorkspaceFilesMock.mockResolvedValue([
+      { name: 'notes.pdf', folderPath: null, type: 'application/pdf', size: 1024, key: 'k' },
+    ])
+
+    const result = await executeDeployCustomBlock(
+      { name: 'Enrich Lead', iconUrl: 'files/notes.pdf' },
+      context
+    )
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('image')
+    expect(uploadFileMock).not.toHaveBeenCalled()
+  })
+
+  it('fails when the workspace has no organization', async () => {
+    getWorkspaceWithOwnerMock.mockResolvedValue({ id: 'ws-1', organizationId: null })
+
+    const result = await executeDeployCustomBlock({ name: 'Enrich Lead' }, context)
+
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('organization')
+  })
+})
diff --git a/apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts b/apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts
new file mode 100644
index 00000000000..36268f6216f
--- /dev/null
+++ b/apps/sim/lib/copilot/tools/handlers/deployment/custom-block.ts
@@ -0,0 +1,289 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { toError } from '@sim/utils/errors'
+import { generateShortId } from '@sim/utils/id'
+import { isAllowedCustomBlockIconUrl } from '@/lib/api/contracts/custom-blocks'
+import { isOrganizationOnEnterprisePlan } from '@/lib/billing'
+import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
+import { canonicalizeVfsPath, canonicalWorkspaceFilePath } from '@/lib/copilot/vfs/path-utils'
+import { isFeatureEnabled } from '@/lib/core/config/feature-flags'
+import {
+  fetchWorkspaceFileBuffer,
+  listWorkspaceFiles,
+} from '@/lib/uploads/contexts/workspace/workspace-file-manager'
+import { uploadFile } from '@/lib/uploads/core/storage-service'
+import { isImageFileType } from '@/lib/uploads/utils/file-utils'
+import {
+  CustomBlockValidationError,
+  type CustomBlockWithInputs,
+  deleteCustomBlock,
+  getCustomBlockWithInputsByWorkflowId,
+  publishCustomBlock,
+  updateCustomBlock,
+} from '@/lib/workflows/custom-blocks/operations'
+import { getWorkspaceWithOwner } from '@/lib/workspaces/permissions/utils'
+import { ensureWorkflowAccess } from '../access'
+import type { DeployCustomBlockParams } from '../param-types'
+
+const MAX_ICON_BYTES = 5 * 1024 * 1024
+const MAX_INPUT_ENTRIES = 50
+const MAX_OUTPUT_ENTRIES = 50
+
+/**
+ * Resolve the agent-supplied icon reference to a publicly servable URL. A VFS
+ * workspace-file path (`files/...`) is ingested: the file is copied into the
+ * world-readable `workspace-logos` storage context (the same context the icon
+ * upload UI writes to), because a raw workspace-file URL is membership-gated
+ * and the block's icon must render for org members in other workspaces. Any
+ * other non-empty value (an external or already-public URL) passes through.
+ */
+async function resolveIconUrl(
+  raw: string | undefined,
+  userId: string,
+  workspaceId: string
+): Promise<string | undefined> {
+  const value = raw?.trim()
+  if (!value) return undefined
+  if (!value.startsWith('files/')) {
+    if (!isAllowedCustomBlockIconUrl(value)) {
+      throw new CustomBlockValidationError(
+        'iconUrl must be an https URL, an internal /api/files/serve/ path, or a workspace file path (files/...)'
+      )
+    }
+    return value
+  }
+
+  const canonical = canonicalizeVfsPath(value)
+  const files = await listWorkspaceFiles(workspaceId, { hydrateFolderPaths: true })
+  const record = files.find(
+    (f) => canonicalWorkspaceFilePath({ folderPath: f.folderPath, name: f.name }) === canonical
+  )
+  if (!record) {
+    throw new CustomBlockValidationError(`Icon file not found in this workspace: ${value}`)
+  }
+  if (!isImageFileType(record.type)) {
+    throw new CustomBlockValidationError(
+      'Icon file must be an image (PNG, JPEG, GIF, WebP, or SVG)'
+    )
+  }
+  if (record.size > MAX_ICON_BYTES) {
+    throw new CustomBlockValidationError('Icon file must be 5MB or smaller')
+  }
+
+  const buffer = await fetchWorkspaceFileBuffer(record)
+  const safeFileName = record.name.replace(/[^a-zA-Z0-9.-]/g, '_')
+  const uploaded = await uploadFile({
+    file: buffer,
+    fileName: record.name,
+    contentType: record.type,
+    context: 'workspace-logos',
+    customKey: `workspace-logos/${Date.now()}-${generateShortId()}-${safeFileName}`,
+    preserveKey: true,
+    metadata: { workspaceId, userId, originalName: record.name },
+  })
+  return uploaded.path
+}
+
+function customBlockOutput(block: CustomBlockWithInputs, action: 'deploy' | 'undeploy') {
+  const isDeployed = action === 'deploy'
+  return {
+    workflowId: block.workflowId,
+    blockId: block.id,
+    blockType: block.type,
+    name: block.name,
+    action,
+    isDeployed,
+    removed: !isDeployed,
+    deploymentType: 'custom_block',
+    deploymentStatus: {
+      customBlock: {
+        isDeployed,
+        blockType: block.type,
+        name: block.name,
+        enabled: block.enabled,
+      },
+    },
+    deploymentConfig: {
+      customBlock: {
+        blockType: block.type,
+        name: block.name,
+        description: block.description,
+        iconUrl: block.iconUrl,
+        inputFields: block.inputFields,
+        exposedOutputs: block.exposedOutputs,
+        organizationId: block.organizationId,
+      },
+    },
+  }
+}
+
+export async function executeDeployCustomBlock(
+  params: DeployCustomBlockParams,
+  context: ExecutionContext
+): Promise<ToolCallResult> {
+  try {
+    const workflowId = params.workflowId || context.workflowId
+    if (!workflowId) {
+      return { success: false, error: 'workflowId is required' }
+    }
+    const action = params.action === 'undeploy' ? 'undeploy' : 'deploy'
+
+    let workflowRecord: Awaited<ReturnType<typeof ensureWorkflowAccess>>['workflow']
+    try {
+      workflowRecord = (await ensureWorkflowAccess(workflowId, context.userId, 'admin')).workflow
+    } catch (error) {
+      const message = toError(error).message
+      if (message.includes('not found')) {
+        return { success: false, error: message }
+      }
+      return {
+        success: false,
+        error: "Managing a custom block requires admin permission on the workflow's workspace",
+      }
+    }
+    const workspaceId = workflowRecord.workspaceId
+    if (!workspaceId) {
+      return { success: false, error: 'Workflow must belong to a workspace' }
+    }
+
+    const ws = await getWorkspaceWithOwner(workspaceId)
+    const organizationId = ws?.organizationId
+    if (!organizationId) {
+      return {
+        success: false,
+        error: 'Publishing a block requires the workspace to belong to an organization',
+      }
+    }
+    if (
+      !(await isFeatureEnabled('deploy-as-block', {
+        userId: context.userId,
+        orgId: organizationId,
+      }))
+    ) {
+      return { success: false, error: 'Custom blocks are not enabled for this organization' }
+    }
+
+    const existing = await getCustomBlockWithInputsByWorkflowId(workflowId)
+
+    if (action === 'undeploy') {
+      if (!existing) {
+        return { success: false, error: 'This workflow is not published as a custom block' }
+      }
+      await deleteCustomBlock(existing.id)
+      recordAudit({
+        workspaceId,
+        actorId: context.userId,
+        action: AuditAction.CUSTOM_BLOCK_DELETED,
+        resourceType: AuditResourceType.CUSTOM_BLOCK,
+        resourceId: existing.id,
+        resourceName: existing.name,
+        description: `Unpublished custom block "${existing.name}"`,
+        metadata: { organizationId, type: existing.type, workflowId, source: 'copilot' },
+      })
+      return { success: true, output: customBlockOutput(existing, 'undeploy') }
+    }
+
+    const name = params.name?.trim()
+    const description = params.description?.trim()
+    if (name && name.length > 60) {
+      return { success: false, error: 'name must be 60 characters or fewer' }
+    }
+    if (description && description.length > 280) {
+      return { success: false, error: 'description must be 280 characters or fewer' }
+    }
+    if (params.inputs && params.inputs.length > MAX_INPUT_ENTRIES) {
+      return { success: false, error: `inputs must be ${MAX_INPUT_ENTRIES} entries or fewer` }
+    }
+    if (params.inputs?.some((entry) => !entry?.id?.trim())) {
+      return { success: false, error: 'each inputs entry requires the trigger field id' }
+    }
+    if (params.inputs?.some((entry) => (entry.placeholder?.length ?? 0) > 200)) {
+      return { success: false, error: 'input placeholders must be 200 characters or fewer' }
+    }
+    if (params.exposedOutputs && params.exposedOutputs.length > MAX_OUTPUT_ENTRIES) {
+      return {
+        success: false,
+        error: `exposedOutputs must be ${MAX_OUTPUT_ENTRIES} entries or fewer`,
+      }
+    }
+    if (
+      params.exposedOutputs?.some(
+        (entry) => !entry?.blockId?.trim() || !entry?.path?.trim() || !entry?.name?.trim()
+      )
+    ) {
+      return {
+        success: false,
+        error: 'each exposedOutputs entry requires blockId, path, and name',
+      }
+    }
+    if (params.exposedOutputs?.some((entry) => entry.name.length > 60)) {
+      return { success: false, error: 'exposed output names must be 60 characters or fewer' }
+    }
+    const iconUrl = await resolveIconUrl(params.iconUrl, context.userId, workspaceId)
+
+    if (existing) {
+      await updateCustomBlock(existing.id, {
+        name: name || undefined,
+        description,
+        iconUrl,
+        inputs: params.inputs,
+        exposedOutputs: params.exposedOutputs,
+      })
+      const updated = await getCustomBlockWithInputsByWorkflowId(workflowId)
+      if (!updated) {
+        return { success: false, error: 'Custom block not found after update' }
+      }
+      recordAudit({
+        workspaceId,
+        actorId: context.userId,
+        action: AuditAction.CUSTOM_BLOCK_UPDATED,
+        resourceType: AuditResourceType.CUSTOM_BLOCK,
+        resourceId: updated.id,
+        resourceName: updated.name,
+        description: `Updated custom block "${updated.name}"`,
+        metadata: { organizationId, type: updated.type, workflowId, source: 'copilot' },
+      })
+      return { success: true, output: { ...customBlockOutput(updated, 'deploy'), updated: true } }
+    }
+
+    if (!(await isOrganizationOnEnterprisePlan(organizationId))) {
+      return { success: false, error: 'Custom blocks require an enterprise plan' }
+    }
+    if (!name) {
+      return { success: false, error: 'name is required when publishing a new custom block' }
+    }
+    if (!workflowRecord.isDeployed) {
+      return {
+        success: false,
+        error:
+          'Workflow must be deployed before publishing as a custom block. Use deploy_api first.',
+      }
+    }
+    const block = await publishCustomBlock({
+      organizationId,
+      workspaceId,
+      workflowId,
+      userId: context.userId,
+      name,
+      description: description ?? '',
+      iconUrl,
+      inputs: params.inputs,
+      exposedOutputs: params.exposedOutputs,
+    })
+    recordAudit({
+      workspaceId,
+      actorId: context.userId,
+      action: AuditAction.CUSTOM_BLOCK_PUBLISHED,
+      resourceType: AuditResourceType.CUSTOM_BLOCK,
+      resourceId: block.id,
+      resourceName: block.name,
+      description: `Published custom block "${block.name}"`,
+      metadata: { organizationId, type: block.type, workflowId, source: 'copilot' },
+    })
+    return { success: true, output: { ...customBlockOutput(block, 'deploy'), updated: false } }
+  } catch (error) {
+    if (error instanceof CustomBlockValidationError) {
+      return { success: false, error: error.message }
+    }
+    return { success: false, error: toError(error).message }
+  }
+}
diff --git a/apps/sim/lib/copilot/tools/handlers/param-types.ts b/apps/sim/lib/copilot/tools/handlers/param-types.ts
index da437b4993a..19eae663ba8 100644
--- a/apps/sim/lib/copilot/tools/handlers/param-types.ts
+++ b/apps/sim/lib/copilot/tools/handlers/param-types.ts
@@ -173,6 +173,24 @@ export interface DeployMcpParams {
   parameterDescriptions?: Array<{ name: string; description: string }>
 }
 
+export interface DeployCustomBlockParams {
+  workflowId?: string
+  action?: 'deploy' | 'undeploy'
+  /** Block display name (max 60 chars). Required on first publish. */
+  name?: string
+  /** Block-picker description (max 280 chars). */
+  description?: string
+  /** Icon image URL; omit for the organization's default icon. */
+  iconUrl?: string
+  /**
+   * Per-input placeholder overrides keyed by the input trigger field's stable id.
+   * The field set itself is always derived from the workflow's deployment.
+   */
+  inputs?: Array<{ id: string; placeholder?: string }>
+  /** Curated outputs; omit to expose the terminal block's whole result. */
+  exposedOutputs?: Array<{ blockId: string; path: string; name: string }>
+}
+
 export interface CheckDeploymentStatusParams {
   workflowId?: string
 }
diff --git a/apps/sim/lib/core/config/api-keys.ts b/apps/sim/lib/core/config/api-keys.ts
index 1a1f04218cd..b435da46f22 100644
--- a/apps/sim/lib/core/config/api-keys.ts
+++ b/apps/sim/lib/core/config/api-keys.ts
@@ -12,7 +12,8 @@ export function getRotatingApiKey(provider: string): string {
     provider !== 'anthropic' &&
     provider !== 'gemini' &&
     provider !== 'cohere' &&
-    provider !== 'zai'
+    provider !== 'zai' &&
+    provider !== 'xai'
   ) {
     throw new Error(`No rotation implemented for provider: ${provider}`)
   }
@@ -39,6 +40,10 @@ export function getRotatingApiKey(provider: string): string {
     if (env.ZAI_API_KEY_1) keys.push(env.ZAI_API_KEY_1)
     if (env.ZAI_API_KEY_2) keys.push(env.ZAI_API_KEY_2)
     if (env.ZAI_API_KEY_3) keys.push(env.ZAI_API_KEY_3)
+  } else if (provider === 'xai') {
+    if (env.XAI_API_KEY_1) keys.push(env.XAI_API_KEY_1)
+    if (env.XAI_API_KEY_2) keys.push(env.XAI_API_KEY_2)
+    if (env.XAI_API_KEY_3) keys.push(env.XAI_API_KEY_3)
   }
 
   if (keys.length === 0) {
diff --git a/apps/sim/lib/core/config/env.ts b/apps/sim/lib/core/config/env.ts
index 717a6f5eb2b..a7e56751caf 100644
--- a/apps/sim/lib/core/config/env.ts
+++ b/apps/sim/lib/core/config/env.ts
@@ -147,6 +147,9 @@ export const env = createEnv({
     ZAI_API_KEY_1:                         z.string().min(1).optional(),           // Primary Z.ai API key for load balancing
     ZAI_API_KEY_2:                         z.string().min(1).optional(),           // Additional Z.ai API key for load balancing
     ZAI_API_KEY_3:                         z.string().min(1).optional(),           // Additional Z.ai API key for load balancing
+    XAI_API_KEY_1:                         z.string().min(1).optional(),           // Primary xAI API key for load balancing
+    XAI_API_KEY_2:                         z.string().min(1).optional(),           // Additional xAI API key for load balancing
+    XAI_API_KEY_3:                         z.string().min(1).optional(),           // Additional xAI API key for load balancing
     OLLAMA_URL:                            z.string().url().optional(),            // Ollama local LLM server URL
     VLLM_BASE_URL:                         z.string().url().optional(),            // vLLM self-hosted base URL (OpenAI-compatible)
     VLLM_API_KEY:                          z.string().optional(),                  // Optional bearer token for vLLM
diff --git a/apps/sim/lib/core/security/url-safety.test.ts b/apps/sim/lib/core/security/url-safety.test.ts
new file mode 100644
index 00000000000..122dc22b8ec
--- /dev/null
+++ b/apps/sim/lib/core/security/url-safety.test.ts
@@ -0,0 +1,61 @@
+/**
+ * @vitest-environment jsdom
+ */
+import { describe, expect, it } from 'vitest'
+import { isAllowedExternalUrl, sanitizeRenderedHyperlinks } from '@/lib/core/security/url-safety'
+
+describe('isAllowedExternalUrl', () => {
+  it('allows http, https, and mailto URLs', () => {
+    expect(isAllowedExternalUrl('https://example.com/deck')).toBe(true)
+    expect(isAllowedExternalUrl('http://example.com/deck')).toBe(true)
+    expect(isAllowedExternalUrl('mailto:support@example.com')).toBe(true)
+  })
+
+  it('rejects scriptable, data, and relative URLs', () => {
+    expect(isAllowedExternalUrl('javascript:alert(1)')).toBe(false)
+    expect(isAllowedExternalUrl('data:text/html,<script>alert(1)</script>')).toBe(false)
+    expect(isAllowedExternalUrl('/workspace/files')).toBe(false)
+  })
+})
+
+describe('sanitizeRenderedHyperlinks', () => {
+  function containerWithAnchor(href: string): HTMLDivElement {
+    const container = document.createElement('div')
+    const anchor = document.createElement('a')
+    anchor.setAttribute('href', href)
+    anchor.textContent = 'link'
+    container.appendChild(anchor)
+    return container
+  }
+
+  it('strips javascript: hrefs from a docx-preview hyperlink rendering', () => {
+    const container = containerWithAnchor(
+      "javascript:document.body.setAttribute('data-xss-fired','1')"
+    )
+    sanitizeRenderedHyperlinks(container)
+    const anchor = container.querySelector('a')
+    expect(anchor?.hasAttribute('href')).toBe(false)
+  })
+
+  it('strips data: and vbscript: hrefs', () => {
+    for (const href of ['data:text/html,<script>alert(1)</script>', 'vbscript:msgbox(1)']) {
+      const container = containerWithAnchor(href)
+      sanitizeRenderedHyperlinks(container)
+      expect(container.querySelector('a')?.hasAttribute('href')).toBe(false)
+    }
+  })
+
+  it('preserves same-document bookmark anchors', () => {
+    const container = containerWithAnchor('#section-2')
+    sanitizeRenderedHyperlinks(container)
+    expect(container.querySelector('a')?.getAttribute('href')).toBe('#section-2')
+  })
+
+  it('keeps allowed external links and adds rel=noopener noreferrer', () => {
+    const container = containerWithAnchor('https://example.com/report')
+    sanitizeRenderedHyperlinks(container)
+    const anchor = container.querySelector('a')
+    expect(anchor?.getAttribute('href')).toBe('https://example.com/report')
+    expect(anchor?.getAttribute('rel')).toBe('noopener noreferrer')
+  })
+})
diff --git a/apps/sim/lib/core/security/url-safety.ts b/apps/sim/lib/core/security/url-safety.ts
new file mode 100644
index 00000000000..694ad516310
--- /dev/null
+++ b/apps/sim/lib/core/security/url-safety.ts
@@ -0,0 +1,37 @@
+/**
+ * URL safety utilities for external hyperlinks/media in untrusted document content
+ * (PPTX, DOCX, and other previews rendered into the app origin).
+ */
+
+const ALLOWED_PROTOCOLS = new Set(['http:', 'https:', 'mailto:'])
+
+/**
+ * Returns true only for absolute URLs with an allowed protocol.
+ */
+export function isAllowedExternalUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url)
+    return ALLOWED_PROTOCOLS.has(parsed.protocol.toLowerCase())
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Neutralizes anchors rendered from untrusted document content (e.g. docx-preview,
+ * which copies an external-relationship `Target` straight into `href` with no scheme
+ * check). Same-document fragment links (`#bookmark`) are left intact; anything else
+ * that isn't http/https/mailto has its `href` stripped so the anchor can't navigate.
+ * Surviving external links get `rel="noopener noreferrer"` to block tabnabbing.
+ */
+export function sanitizeRenderedHyperlinks(root: ParentNode): void {
+  for (const anchor of root.querySelectorAll('a[href]')) {
+    const href = anchor.getAttribute('href') ?? ''
+    if (href.startsWith('#')) continue
+    if (isAllowedExternalUrl(href)) {
+      anchor.setAttribute('rel', 'noopener noreferrer')
+      continue
+    }
+    anchor.removeAttribute('href')
+  }
+}
diff --git a/apps/sim/lib/core/utils.test.ts b/apps/sim/lib/core/utils.test.ts
index a9e2b1662f9..7ccb5dc75cf 100644
--- a/apps/sim/lib/core/utils.test.ts
+++ b/apps/sim/lib/core/utils.test.ts
@@ -43,6 +43,9 @@ vi.mock('@/lib/core/config/env', () =>
     GEMINI_API_KEY_1: 'test-gemini-key-1',
     GEMINI_API_KEY_2: 'test-gemini-key-2',
     GEMINI_API_KEY_3: 'test-gemini-key-3',
+    XAI_API_KEY_1: 'test-xai-key-1',
+    XAI_API_KEY_2: 'test-xai-key-2',
+    XAI_API_KEY_3: 'test-xai-key-3',
   })
 )
 
@@ -327,6 +330,11 @@ describe('getRotatingApiKey', () => {
     expect(result).toMatch(/^test-gemini-key-[1-3]$/)
   })
 
+  it.concurrent('should return xAI API key based on current minute', () => {
+    const result = getRotatingApiKey('xai')
+    expect(result).toMatch(/^test-xai-key-[1-3]$/)
+  })
+
   it.concurrent('should throw error for unsupported provider', () => {
     expect(() => getRotatingApiKey('unsupported')).toThrow('No rotation implemented for provider')
   })
diff --git a/apps/sim/lib/mcp/service.ts b/apps/sim/lib/mcp/service.ts
index 12c30e7c8c3..7e97d3fc2de 100644
--- a/apps/sim/lib/mcp/service.ts
+++ b/apps/sim/lib/mcp/service.ts
@@ -328,11 +328,14 @@ class McpService {
         )
         .limit(1)
 
-      const currentConfig: McpServerStatusConfig =
-        (currentServer?.statusConfig as McpServerStatusConfig | null) ?? {
-          consecutiveFailures: 0,
-          lastSuccessfulDiscovery: null,
-        }
+      const storedConfig = currentServer?.statusConfig as Partial<McpServerStatusConfig> | null
+      const currentConfig: McpServerStatusConfig = {
+        consecutiveFailures:
+          typeof storedConfig?.consecutiveFailures === 'number'
+            ? storedConfig.consecutiveFailures
+            : 0,
+        lastSuccessfulDiscovery: storedConfig?.lastSuccessfulDiscovery ?? null,
+      }
 
       const now = new Date()
 
diff --git a/apps/sim/lib/mothership/inbox/executor.ts b/apps/sim/lib/mothership/inbox/executor.ts
index 86ac2312b2d..903018024d6 100644
--- a/apps/sim/lib/mothership/inbox/executor.ts
+++ b/apps/sim/lib/mothership/inbox/executor.ts
@@ -13,6 +13,7 @@ import {
 } from '@/lib/copilot/chat/persisted-message'
 import { generateWorkspaceContext } from '@/lib/copilot/chat/workspace-context'
 import { chatPubSub } from '@/lib/copilot/chat-status'
+import { computeWorkspaceEntitlements } from '@/lib/copilot/entitlements'
 import { runHeadlessCopilotLifecycle } from '@/lib/copilot/request/lifecycle/headless'
 import { requestChatTitle } from '@/lib/copilot/request/lifecycle/start'
 import type { OrchestratorResult } from '@/lib/copilot/request/types'
@@ -208,14 +209,21 @@ export async function executeInboxTask(taskId: string): Promise<void> {
       return { attachments, ...downloaded }
     }
 
-    const [attachmentResult, workspaceContext, integrationTools, userSkillTool, userPermission] =
-      await Promise.all([
-        fetchAttachments(),
-        generateWorkspaceContext(ws.id, userId),
-        buildIntegrationToolSchemas(userId, undefined, undefined, ws.id),
-        buildUserSkillTool(ws.id),
-        getUserEntityPermissions(userId, 'workspace', ws.id).catch(() => null),
-      ])
+    const [
+      attachmentResult,
+      workspaceContext,
+      integrationTools,
+      userSkillTool,
+      userPermission,
+      entitlements,
+    ] = await Promise.all([
+      fetchAttachments(),
+      generateWorkspaceContext(ws.id, userId),
+      buildIntegrationToolSchemas(userId, undefined, undefined, ws.id),
+      buildUserSkillTool(ws.id),
+      getUserEntityPermissions(userId, 'workspace', ws.id).catch(() => null),
+      computeWorkspaceEntitlements(ws.id, userId),
+    ])
     const { attachments, fileAttachments, storedAttachments } = attachmentResult
 
     const truncatedTask = {
@@ -237,6 +245,7 @@ export async function executeInboxTask(taskId: string): Promise<void> {
       ...(integrationTools.length > 0 ? { integrationTools } : {}),
       ...(userSkillTool ? { mothershipTools: [userSkillTool] } : {}),
       ...(userPermission ? { userPermission } : {}),
+      ...(entitlements.length > 0 ? { entitlements } : {}),
       ...(fileAttachments.length > 0 ? { fileAttachments } : {}),
     }
 
diff --git a/apps/sim/lib/pptx-renderer/core/viewer.ts b/apps/sim/lib/pptx-renderer/core/viewer.ts
index efdb5ac5e02..3434a8ba225 100644
--- a/apps/sim/lib/pptx-renderer/core/viewer.ts
+++ b/apps/sim/lib/pptx-renderer/core/viewer.ts
@@ -1,11 +1,11 @@
 import { getErrorMessage } from '@sim/utils/errors'
 import type { ECharts } from 'echarts'
+import { isAllowedExternalUrl } from '@/lib/core/security/url-safety'
 import { buildPresentation, type PresentationData } from '../model/presentation'
 import type { ZipParseLimits } from '../parser/zip-parser'
 import { parseZip } from '../parser/zip-parser'
 import type { SlideHandle } from '../renderer/slide-renderer'
 import { renderSlide as renderSlideInternal } from '../renderer/slide-renderer'
-import { isAllowedExternalUrl } from '../utils/url-safety'
 
 export type { SlideHandle } from '../renderer/slide-renderer'
 
diff --git a/apps/sim/lib/pptx-renderer/renderer/shape-renderer.ts b/apps/sim/lib/pptx-renderer/renderer/shape-renderer.ts
index 58ed7f9c70d..db73643b419 100644
--- a/apps/sim/lib/pptx-renderer/renderer/shape-renderer.ts
+++ b/apps/sim/lib/pptx-renderer/renderer/shape-renderer.ts
@@ -15,6 +15,7 @@ function hasVisibleText(textBody: TextBody): boolean {
   return false
 }
 
+import { isAllowedExternalUrl } from '@/lib/core/security/url-safety'
 import { emuToPx } from '../parser/units'
 import type { SafeXmlNode } from '../parser/xml-parser'
 import { renderCustomGeometry } from '../shapes/custom-geometry'
@@ -26,7 +27,6 @@ import {
 } from '../shapes/presets'
 import { applyTint, hexToRgb, rgbToHex } from '../utils/color'
 import { getOrCreateBlobUrl, resolveMediaPath } from '../utils/media'
-import { isAllowedExternalUrl } from '../utils/url-safety'
 import {
   resolveColor,
   resolveColorToCss,
diff --git a/apps/sim/lib/pptx-renderer/renderer/text-renderer.ts b/apps/sim/lib/pptx-renderer/renderer/text-renderer.ts
index e66a802bfcd..42679dcf9e3 100644
--- a/apps/sim/lib/pptx-renderer/renderer/text-renderer.ts
+++ b/apps/sim/lib/pptx-renderer/renderer/text-renderer.ts
@@ -4,11 +4,11 @@
  */
 
 import { hexToRgb, toCssColor } from '@/lib/colors'
+import { isAllowedExternalUrl } from '@/lib/core/security/url-safety'
 import type { PlaceholderInfo } from '../model/nodes/base-node'
 import type { TextBody } from '../model/nodes/shape-node'
 import { angleToDeg, emuToPx, pctToDecimal } from '../parser/units'
 import { SafeXmlNode } from '../parser/xml-parser'
-import { isAllowedExternalUrl } from '../utils/url-safety'
 import type { RenderContext } from './render-context'
 import { resolveColor, resolveColorToCss } from './style-resolver'
 
diff --git a/apps/sim/lib/pptx-renderer/utils/url-safety.test.ts b/apps/sim/lib/pptx-renderer/utils/url-safety.test.ts
deleted file mode 100644
index 793ae18ea5b..00000000000
--- a/apps/sim/lib/pptx-renderer/utils/url-safety.test.ts
+++ /dev/null
@@ -1,16 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { isAllowedExternalUrl } from '@/lib/pptx-renderer/utils/url-safety'
-
-describe('isAllowedExternalUrl', () => {
-  it('allows http, https, and mailto URLs', () => {
-    expect(isAllowedExternalUrl('https://example.com/deck')).toBe(true)
-    expect(isAllowedExternalUrl('http://example.com/deck')).toBe(true)
-    expect(isAllowedExternalUrl('mailto:support@example.com')).toBe(true)
-  })
-
-  it('rejects scriptable, data, and relative URLs', () => {
-    expect(isAllowedExternalUrl('javascript:alert(1)')).toBe(false)
-    expect(isAllowedExternalUrl('data:text/html,<script>alert(1)</script>')).toBe(false)
-    expect(isAllowedExternalUrl('/workspace/files')).toBe(false)
-  })
-})
diff --git a/apps/sim/lib/pptx-renderer/utils/url-safety.ts b/apps/sim/lib/pptx-renderer/utils/url-safety.ts
deleted file mode 100644
index c3e8f42b2de..00000000000
--- a/apps/sim/lib/pptx-renderer/utils/url-safety.ts
+++ /dev/null
@@ -1,17 +0,0 @@
-/**
- * URL safety utilities for external hyperlinks/media in untrusted PPTX content.
- */
-
-const ALLOWED_PROTOCOLS = new Set(['http:', 'https:', 'mailto:'])
-
-/**
- * Returns true only for absolute URLs with an allowed protocol.
- */
-export function isAllowedExternalUrl(url: string): boolean {
-  try {
-    const parsed = new URL(url)
-    return ALLOWED_PROTOCOLS.has(parsed.protocol.toLowerCase())
-  } catch {
-    return false
-  }
-}
diff --git a/apps/sim/lib/workflows/custom-blocks/operations.ts b/apps/sim/lib/workflows/custom-blocks/operations.ts
index 23e602b83d1..643867dd611 100644
--- a/apps/sim/lib/workflows/custom-blocks/operations.ts
+++ b/apps/sim/lib/workflows/custom-blocks/operations.ts
@@ -25,15 +25,36 @@ const logger = createLogger('CustomBlocksOperations')
  * enterprise plan). Applying it in every org-scoped resolver keeps execution, the
  * copilot VFS, and workspace context from surfacing blocks the API withholds (e.g.
  * after an org drops off the enterprise plan). Returns `null` when ineligible.
+ *
+ * Pass `userId` when the caller acts for a specific user so per-user flag
+ * targeting matches the REST routes; workspace-scoped resolvers (VFS, context,
+ * executor overlay) omit it and evaluate at org level.
  */
-async function eligibleOrgForWorkspace(workspaceId: string): Promise<string | null> {
+async function eligibleOrgForWorkspace(
+  workspaceId: string,
+  userId?: string
+): Promise<string | null> {
   const ws = await getWorkspaceWithOwner(workspaceId, { includeArchived: true })
   if (!ws?.organizationId) return null
-  if (!(await isFeatureEnabled('deploy-as-block', { orgId: ws.organizationId }))) return null
+  if (!(await isFeatureEnabled('deploy-as-block', { userId, orgId: ws.organizationId }))) {
+    return null
+  }
   if (!(await isOrganizationOnEnterprisePlan(ws.organizationId))) return null
   return ws.organizationId
 }
 
+/**
+ * Whether the workspace's org may use custom blocks (`deploy-as-block` flag +
+ * enterprise plan). Feeds the 'custom-blocks' entitlement in
+ * `@/lib/copilot/entitlements` and matches the REST route gates.
+ */
+export async function isCustomBlocksEligible(
+  workspaceId: string,
+  userId?: string
+): Promise<boolean> {
+  return (await eligibleOrgForWorkspace(workspaceId, userId)) !== null
+}
+
 /** A persisted custom block plus its live-derived Start input fields. */
 export interface CustomBlockWithInputs {
   id: string
@@ -170,6 +191,37 @@ export async function listCustomBlockSummariesForWorkspace(
     .where(and(eq(customBlock.organizationId, organizationId), eq(customBlock.enabled, true)))
 }
 
+/**
+ * Hydrate a joined custom-block row into the wire shape. Field set derived live
+ * from the deployed Start; stored placeholders merged in. Derive even for a
+ * disabled block — the source workflow's deployment is independent of the block's
+ * enabled flag, and the edit form needs the real fields so a save doesn't
+ * overwrite the block's stored placeholders.
+ */
+async function hydrateCustomBlockRow(joined: {
+  block: typeof customBlock.$inferSelect
+  workflowName: string
+  workspaceId: string | null
+  workspaceName: string | null
+}): Promise<CustomBlockWithInputs> {
+  const { block: row, workflowName, workspaceId, workspaceName } = joined
+  return {
+    id: row.id,
+    organizationId: row.organizationId,
+    workflowId: row.workflowId,
+    workflowName,
+    workspaceId,
+    workspaceName,
+    type: row.type,
+    name: row.name,
+    description: row.description,
+    iconUrl: row.iconUrl,
+    enabled: row.enabled,
+    inputFields: applyInputPlaceholders(row.inputs, await deriveInputFields(row.workflowId)),
+    exposedOutputs: row.outputs ?? [],
+  }
+}
+
 /** The org's custom blocks with live-derived input fields (client overlay + list API). */
 export async function listCustomBlocksWithInputs(
   organizationId: string
@@ -186,27 +238,30 @@ export async function listCustomBlocksWithInputs(
     .leftJoin(workspace, eq(workspace.id, workflow.workspaceId))
     .where(eq(customBlock.organizationId, organizationId))
 
-  return Promise.all(
-    rows.map(async ({ block: row, workflowName, workspaceId, workspaceName }) => ({
-      id: row.id,
-      organizationId: row.organizationId,
-      workflowId: row.workflowId,
-      workflowName,
-      workspaceId,
-      workspaceName,
-      type: row.type,
-      name: row.name,
-      description: row.description,
-      iconUrl: row.iconUrl,
-      enabled: row.enabled,
-      // Field set derived live from the deployed Start; stored placeholders merged
-      // in. Derive even for a disabled block — the source workflow's deployment is
-      // independent of the block's enabled flag, and the edit form needs the real
-      // fields so a save doesn't overwrite the block's stored placeholders.
-      inputFields: applyInputPlaceholders(row.inputs, await deriveInputFields(row.workflowId)),
-      exposedOutputs: row.outputs ?? [],
-    }))
-  )
+  return Promise.all(rows.map(hydrateCustomBlockRow))
+}
+
+/**
+ * The custom block bound to a workflow (with live-derived input fields), or `null`
+ * when the workflow isn't published as a block. One block per workflow is enforced
+ * at publish time. Used by the copilot deploy_custom_block tool.
+ */
+export async function getCustomBlockWithInputsByWorkflowId(
+  workflowId: string
+): Promise<CustomBlockWithInputs | null> {
+  const [row] = await db
+    .select({
+      block: customBlock,
+      workflowName: workflow.name,
+      workspaceId: workflow.workspaceId,
+      workspaceName: workspace.name,
+    })
+    .from(customBlock)
+    .innerJoin(workflow, eq(workflow.id, customBlock.workflowId))
+    .leftJoin(workspace, eq(workspace.id, workflow.workspaceId))
+    .where(eq(customBlock.workflowId, workflowId))
+    .limit(1)
+  return row ? hydrateCustomBlockRow(row) : null
 }
 
 /** Fetch a single custom block row by id. */
diff --git a/apps/sim/next.config.ts b/apps/sim/next.config.ts
index c11bcd6cc2c..845241d3cd6 100644
--- a/apps/sim/next.config.ts
+++ b/apps/sim/next.config.ts
@@ -29,6 +29,10 @@ const minimalRegistryAlias: Record<string, string> = useMinimalRegistry
 const nextConfig: NextConfig = {
   devIndicators: false,
   poweredByHeader: false,
+  // Safe here since this repo's source is already fully public on GitHub -
+  // no additional exposure versus Next's default (disabled to avoid leaking
+  // source on the client).
+  productionBrowserSourceMaps: true,
   turbopack: {
     root: path.join(import.meta.dirname, '../..'),
     resolveAlias: minimalRegistryAlias,
@@ -188,7 +192,11 @@ const nextConfig: NextConfig = {
   async headers() {
     return [
       {
-        source: '/((?!api/).*\\.(?:svg|jpg|jpeg|png|gif|ico|webp|avif|woff|woff2|ttf|eot))',
+        // `/public`-served assets keep their path across deploys (no content
+        // hash), so a shorter TTL + revalidation window bounds how long a
+        // changed asset can serve stale.
+        source:
+          '/((?!api/|_next/static/).*\\.(?:svg|jpg|jpeg|png|gif|ico|webp|avif|woff|woff2|ttf|eot))',
         headers: [
           {
             key: 'Cache-Control',
@@ -245,14 +253,29 @@ const nextConfig: NextConfig = {
           },
         ],
       },
-      // Block access to sourcemap files (defense in depth)
+      // Block access to sourcemap files (defense in depth). The trailing
+      // `$` this rule previously ended with is not a regex anchor in Next's
+      // `source` matcher (path-to-regexp syntax, not raw regex) - it matched
+      // a literal `$` character, so this rule never actually fired against
+      // real `.map` URLs. Next already anchors the compiled pattern at both
+      // ends, so no trailing anchor is needed here.
+      //
+      // Also bounds `.map` files to a short, revalidated TTL rather than
+      // Next's built-in 1yr immutable default for `_next/static/*` - maps
+      // are content-hashed like their JS, so this isn't about staleness,
+      // it's so a future decision to stop shipping `productionBrowserSourceMaps`
+      // isn't undermined by browsers/edges holding old maps for a year.
       {
-        source: '/(.*)\\.map$',
+        source: '/(.*)\\.map',
         headers: [
           {
             key: 'x-robots-tag',
             value: 'noindex',
           },
+          {
+            key: 'Cache-Control',
+            value: 'public, max-age=86400, stale-while-revalidate=604800',
+          },
         ],
       },
       // Chat pages - allow iframe embedding from any origin
diff --git a/apps/sim/providers/models.test.ts b/apps/sim/providers/models.test.ts
index 0c01133649c..14dcee48590 100644
--- a/apps/sim/providers/models.test.ts
+++ b/apps/sim/providers/models.test.ts
@@ -218,3 +218,17 @@ describe('zai provider definition', () => {
     expect(getHostedModels()).toContain('glm-4.6')
   })
 })
+
+describe('xai provider definition', () => {
+  const xai = PROVIDER_DEFINITIONS.xai
+
+  it('is registered with grok-4.5 as the default model', () => {
+    expect(xai).toBeDefined()
+    expect(xai.id).toBe('xai')
+    expect(xai.defaultModel).toBe('grok-4.5')
+  })
+
+  it('is included in getHostedModels since Sim provides the xAI key server-side', () => {
+    expect(getHostedModels()).toContain('grok-4.5')
+  })
+})
diff --git a/apps/sim/providers/models.ts b/apps/sim/providers/models.ts
index e5021a4c721..bc5aa24cbe7 100644
--- a/apps/sim/providers/models.ts
+++ b/apps/sim/providers/models.ts
@@ -3921,6 +3921,7 @@ export function getHostedModels(): string[] {
     ...getProviderModels('anthropic'),
     ...getProviderModels('google'),
     ...getProviderModels('zai'),
+    ...getProviderModels('xai'),
   ]
 }
 
diff --git a/apps/sim/providers/utils.test.ts b/apps/sim/providers/utils.test.ts
index 1e9c877a976..1697c12f80d 100644
--- a/apps/sim/providers/utils.test.ts
+++ b/apps/sim/providers/utils.test.ts
@@ -865,7 +865,7 @@ describe('Cost Calculation', () => {
 })
 
 describe('getHostedModels', () => {
-  it.concurrent('should return OpenAI, Anthropic, and Google models as hosted', () => {
+  it.concurrent('should return OpenAI, Anthropic, Google, and xAI models as hosted', () => {
     const hostedModels = getHostedModels()
 
     expect(hostedModels).toContain('gpt-4o')
@@ -877,8 +877,9 @@ describe('getHostedModels', () => {
     expect(hostedModels).toContain('gemini-2.5-pro')
     expect(hostedModels).toContain('gemini-2.5-flash')
 
+    expect(hostedModels).toContain('grok-4.5')
+
     expect(hostedModels).not.toContain('deepseek-v3')
-    expect(hostedModels).not.toContain('grok-4-latest')
   })
 
   it.concurrent('should return an array of strings', () => {
@@ -902,11 +903,12 @@ describe('shouldBillModelUsage', () => {
 
     expect(shouldBillModelUsage('gemini-2.5-pro')).toBe(true)
     expect(shouldBillModelUsage('gemini-2.5-flash')).toBe(true)
+
+    expect(shouldBillModelUsage('grok-4.5')).toBe(true)
   })
 
   it.concurrent('should return false for non-hosted models', () => {
     expect(shouldBillModelUsage('deepseek-v3')).toBe(false)
-    expect(shouldBillModelUsage('grok-4-latest')).toBe(false)
 
     expect(shouldBillModelUsage('unknown-model')).toBe(false)
   })
diff --git a/apps/sim/providers/utils.ts b/apps/sim/providers/utils.ts
index 3b8bdd10c6a..8ca3017354a 100644
--- a/apps/sim/providers/utils.ts
+++ b/apps/sim/providers/utils.ts
@@ -903,8 +903,9 @@ export function getApiKey(provider: string, model: string, userProvidedKey?: str
   const isClaudeModel = provider === 'anthropic'
   const isGeminiModel = provider === 'google'
   const isZaiModel = provider === 'zai'
+  const isXaiModel = provider === 'xai'
 
-  if (isHosted && (isOpenAIModel || isClaudeModel || isGeminiModel || isZaiModel)) {
+  if (isHosted && (isOpenAIModel || isClaudeModel || isGeminiModel || isZaiModel || isXaiModel)) {
     const hostedModels = getHostedModels()
     const isModelHosted = hostedModels.some((m) => m.toLowerCase() === model.toLowerCase())
 
diff --git a/apps/sim/public/blog/mothership/cover.jpg b/apps/sim/public/blog/mothership/cover.jpg
index cc26d327547..598ade580b9 100644
Binary files a/apps/sim/public/blog/mothership/cover.jpg and b/apps/sim/public/blog/mothership/cover.jpg differ
diff --git a/apps/sim/public/blog/mothership/cover.png b/apps/sim/public/blog/mothership/cover.png
deleted file mode 100644
index e4410a5cb69..00000000000
Binary files a/apps/sim/public/blog/mothership/cover.png and /dev/null differ
diff --git a/apps/sim/public/llms.txt b/apps/sim/public/llms.txt
deleted file mode 100644
index 723c554eec0..00000000000
--- a/apps/sim/public/llms.txt
+++ /dev/null
@@ -1,59 +0,0 @@
-# Sim
-
-Sim is the open-source AI workspace where teams build, deploy, and manage AI agents. Create agents visually with the workflow builder, conversationally through Chat, or programmatically with the API — connected to 1,000+ integrations and every major LLM.
-
-## Key Facts
-
-- Website: https://sim.ai
-- GitHub: https://github.com/simstudioai/sim
-- Documentation: https://docs.sim.ai
-- License: Apache 2.0
-- Category: AI workspace, AI agent builder, developer tools
-- Trusted by: 100,000+ builders, from startups to Fortune 500
-
-## What Sim Does
-
-Sim is a unified AI workspace with these core modules:
-
-- **Mothership** — AI command center. Build and manage everything in natural language.
-- **Workflows** — Visual builder. Connect blocks, models, and integrations into agent logic.
-- **Knowledge Base** — Upload docs, sync sources, build vector databases for agent memory.
-- **Tables** — Built-in database. Store, query, and wire structured data into agent runs.
-- **Files** — Upload, create, and share documents across your team and agents.
-- **Logs** — Full execution tracing. Inputs, outputs, cost, and duration for every run.
-
-## Capabilities
-
-- 1,000+ integrations (Slack, Gmail, GitHub, Notion, Jira, Salesforce, HubSpot, and more)
-- Every major LLM: OpenAI, Anthropic, Google Gemini, xAI Grok, Mistral, Groq, Cerebras
-- Real-time team collaboration with multiplayer editing
-- Enterprise governance: RBAC, staging/production environments, deployment versioning, audit logs
-- Self-hosting via Docker, bring-your-own-key (BYOK) for all model providers
-- API, CLI, and SDK access (TypeScript, Python)
-- MCP (Model Context Protocol) server creation and connection
-- SOC2 compliant
-
-## Key Pages
-
-- AI Models Directory: https://sim.ai/models
-- Integrations: https://sim.ai/integrations
-- Pricing: https://sim.ai/#pricing
-- Partners: https://sim.ai/partners
-
-## Blog
-
-The Sim blog covers announcements, technical deep-dives, and guides for building AI agents.
-
-- Blog: https://sim.ai/blog
-- RSS: https://sim.ai/blog/rss.xml
-
-## Documentation
-
-- Getting Started: https://docs.sim.ai/getting-started
-- Blocks: https://docs.sim.ai/workflows
-- Tools & Integrations: https://docs.sim.ai/integrations
-- Webhooks: https://docs.sim.ai/workflows/triggers/webhook
-- MCP Protocol: https://docs.sim.ai/agents/mcp
-- Self-Hosting: https://docs.sim.ai/platform/self-hosting
-- API Reference: https://docs.sim.ai/api-reference/getting-started
-- SDKs: https://docs.sim.ai/api-reference
diff --git a/apps/sim/public/logo/426-240/reverse/small.png b/apps/sim/public/logo/426-240/reverse/small.png
index 196dd6389e9..3e0f96d5b91 100644
Binary files a/apps/sim/public/logo/426-240/reverse/small.png and b/apps/sim/public/logo/426-240/reverse/small.png differ
diff --git a/apps/sim/stores/modals/search/store.ts b/apps/sim/stores/modals/search/store.ts
index 10808b860b0..65a84b2d627 100644
--- a/apps/sim/stores/modals/search/store.ts
+++ b/apps/sim/stores/modals/search/store.ts
@@ -67,18 +67,24 @@ export const useSearchModalStore = create<SearchModalState>()(
   devtools(
     (set, _) => ({
       isOpen: false,
+      sections: null,
+      pendingConnect: null,
       data: initialData,
 
       setOpen: (open: boolean) => {
-        set({ isOpen: open })
+        set({ isOpen: open, sections: null, pendingConnect: null })
       },
 
-      open: () => {
-        set({ isOpen: true })
+      open: (options) => {
+        set({
+          isOpen: true,
+          sections: options?.sections ?? null,
+          pendingConnect: options?.pendingConnect ?? null,
+        })
       },
 
       close: () => {
-        set({ isOpen: false })
+        set({ isOpen: false, sections: null, pendingConnect: null })
       },
 
       initializeData: (filterBlocks) => {
diff --git a/apps/sim/stores/modals/search/types.ts b/apps/sim/stores/modals/search/types.ts
index b276f23627a..b8315e8156e 100644
--- a/apps/sim/stores/modals/search/types.ts
+++ b/apps/sim/stores/modals/search/types.ts
@@ -49,6 +49,44 @@ export interface SearchData {
   isInitialized: boolean
 }
 
+/**
+ * Every result group the search modal can render, in render order. Used to
+ * restrict the palette to a subset of sections when opened for a specific
+ * intent (e.g. a drag-release that should only offer canvas-insertable items).
+ */
+export const SEARCH_SECTIONS = [
+  'actions',
+  'connectedAccounts',
+  'integrations',
+  'blocks',
+  'tools',
+  'triggers',
+  'chats',
+  'workflows',
+  'tables',
+  'files',
+  'knowledgeBases',
+  'toolOperations',
+  'workspaces',
+  'docs',
+  'pages',
+] as const
+
+/** A single search-modal result group. */
+export type SearchSection = (typeof SEARCH_SECTIONS)[number]
+
+/**
+ * Context handed to the palette when it is opened to complete an edge
+ * drag-release: the dragged source handle and the release point. A selection
+ * stamps it onto its event so the canvas places the block at the drop point and
+ * wires it from that handle.
+ */
+export interface PendingConnect {
+  source: { nodeId: string; handleId: string }
+  screenX: number
+  screenY: number
+}
+
 /**
  * Global state for the universal search modal.
  *
@@ -60,18 +98,33 @@ export interface SearchModalState {
   /** Whether the search modal is currently open. */
   isOpen: boolean
 
+  /**
+   * When set, the palette renders only these sections; `null` shows all of them.
+   */
+  sections: SearchSection[] | null
+
+  /**
+   * Pending edge drag-release the palette was opened to complete. A selection
+   * stamps it onto its event; other add-block dispatchers carry none, so only a
+   * genuine palette pick completes the connection. `null` for ordinary opens.
+   */
+  pendingConnect: PendingConnect | null
+
   /** Pre-computed search data. */
   data: SearchData
 
   /**
-   * Explicitly set the open state of the modal.
+   * Explicitly set the open state of the modal. Always resets to the full
+   * palette (no section restriction, no pending connect).
    */
   setOpen: (open: boolean) => void
 
   /**
-   * Convenience method to open the modal.
+   * Convenience method to open the modal. Pass `sections` to restrict the
+   * palette to a subset of result groups, and `pendingConnect` to complete an
+   * edge drag-release with the selection.
    */
-  open: () => void
+  open: (options?: { sections?: SearchSection[]; pendingConnect?: PendingConnect }) => void
 
   /**
    * Convenience method to close the modal.
diff --git a/apps/sim/tools/brex/get_company.ts b/apps/sim/tools/brex/get_company.ts
index 700e339a089..5e222e387c1 100644
--- a/apps/sim/tools/brex/get_company.ts
+++ b/apps/sim/tools/brex/get_company.ts
@@ -31,7 +31,7 @@ export const brexGetCompanyTool: ToolConfig<BrexApiKeyParams, BrexGetCompanyResp
         id: data.id ?? '',
         legalName: data.legal_name ?? '',
         mailingAddress: data.mailing_address ?? null,
-        accountType: data.accountType ?? null,
+        accountType: data.account_type ?? null,
       },
     }
   },
diff --git a/apps/sim/tools/types.ts b/apps/sim/tools/types.ts
index fca1e60a443..542e5e9a620 100644
--- a/apps/sim/tools/types.ts
+++ b/apps/sim/tools/types.ts
@@ -8,6 +8,7 @@ export type BYOKProviderId =
   | 'google'
   | 'mistral'
   | 'zai'
+  | 'xai'
   | 'fireworks'
   | 'together'
   | 'baseten'
diff --git a/packages/emcn/src/components/wizard/wizard.tsx b/packages/emcn/src/components/wizard/wizard.tsx
index ff533c64e3b..88417d6b7cb 100644
--- a/packages/emcn/src/components/wizard/wizard.tsx
+++ b/packages/emcn/src/components/wizard/wizard.tsx
@@ -1,23 +1,21 @@
 'use client'
 
 import * as React from 'react'
-import { Button } from '../button/button'
+import { cn } from '../../lib/cn'
 import {
-  Modal,
-  ModalBody,
-  ModalContent,
-  ModalDescription,
-  ModalFooter,
-  ModalHeader,
-  type ModalSize,
-} from '../modal/modal'
+  ChipModal,
+  ChipModalBody,
+  ChipModalFooter,
+  ChipModalHeader,
+} from '../chip-modal/chip-modal'
+import { ModalDescription, type ModalSize } from '../modal/modal'
 
 /**
  * A multi-step modal wizard primitive.
  *
  * @remarks
- * Wraps the emcn Modal with a shared Back / Next / Done footer and declarative
- * `Wizard.Step` children. Step state is controlled
+ * Wraps the emcn ChipModal with a shared Back / Next / Done footer and
+ * declarative `Wizard.Step` children. Step state is controlled
  * from the outside so the consumer can hydrate from persisted state, reset
  * on close, or jump around imperatively.
  *
@@ -160,42 +158,39 @@ const WizardRoot: React.FC<WizardProps> = ({
   if (total === 0) return null
 
   return (
-    <Modal open={open} onOpenChange={onOpenChange}>
-      <ModalContent size={size} className={height}>
-        <ModalHeader>
-          {title ? (
-            <span className='flex items-center gap-2'>
-              {Icon ? <Icon className='size-[18px]' /> : null}
-              {title}
-            </span>
-          ) : (
-            activeStep?.props.title
-          )}
-        </ModalHeader>
-
-        <ModalBody>
-          <ModalDescription className='sr-only'>
-            {description ?? 'Multi-step wizard'}
-          </ModalDescription>
-          {activeStep}
-        </ModalBody>
-
-        <ModalFooter>
-          <Button variant='default' onClick={handleBack} disabled={clamped === 0}>
-            {backLabel}
-          </Button>
-          {isLast ? (
-            <Button variant='primary' onClick={handleDone}>
-              {doneLabel}
-            </Button>
-          ) : (
-            <Button variant='primary' onClick={handleNext} disabled={!canAdvance}>
-              {nextLabel}
-            </Button>
-          )}
-        </ModalFooter>
-      </ModalContent>
-    </Modal>
+    <ChipModal
+      open={open}
+      onOpenChange={onOpenChange}
+      size={size}
+      srTitle={title ?? activeStep?.props.title ?? description ?? 'Multi-step wizard'}
+      // A fixed `height` sizes the whole dialog (matching the legacy Modal). The
+      // scoped `[&>div]` variants stretch ChipModal's inner content column so the
+      // body fills the fixed height instead of leaving a gap; only applied when a
+      // height is set, so other ChipModal consumers are untouched.
+      className={height ? cn(height, '[&>div]:min-h-0 [&>div]:flex-1') : undefined}
+    >
+      <ChipModalHeader icon={title ? (Icon ?? null) : null} onClose={() => onOpenChange(false)}>
+        {title ?? activeStep?.props.title}
+      </ChipModalHeader>
+
+      <ChipModalBody>
+        <ModalDescription className='sr-only'>
+          {description ?? 'Multi-step wizard'}
+        </ModalDescription>
+        {activeStep}
+      </ChipModalBody>
+
+      <ChipModalFooter
+        onCancel={() => onOpenChange(false)}
+        hideCancel
+        primaryAdjacentAction={{ label: backLabel, onClick: handleBack, disabled: clamped === 0 }}
+        primaryAction={
+          isLast
+            ? { label: doneLabel, onClick: handleDone }
+            : { label: nextLabel, onClick: handleNext, disabled: !canAdvance }
+        }
+      />
+    </ChipModal>
   )
 }
 
diff --git a/packages/workflow-renderer/src/lib/overflow-span.tsx b/packages/workflow-renderer/src/lib/overflow-span.tsx
new file mode 100644
index 00000000000..65437f0d8a5
--- /dev/null
+++ b/packages/workflow-renderer/src/lib/overflow-span.tsx
@@ -0,0 +1,25 @@
+import { FloatingTooltip, isTextClipped, useFloatingTooltip } from '@sim/emcn'
+
+interface OverflowSpanProps {
+  value: string
+  className: string
+}
+
+/**
+ * Truncated span that reveals its full value in a floating tooltip when — and
+ * only when — the text is actually clipped. Never use a native `title`
+ * attribute here: on the canvas it pops the browser's raw, unstyled tooltip
+ * with the full untruncated value (including raw code/JSON) over the graph.
+ */
+export function OverflowSpan({ value, className }: OverflowSpanProps) {
+  const { state, handlers } = useFloatingTooltip(isTextClipped)
+
+  return (
+    <>
+      <span className={className} {...handlers}>
+        {value}
+      </span>
+      <FloatingTooltip label={value} state={state} />
+    </>
+  )
+}
diff --git a/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx b/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx
index 01930cdcac1..7be0b0bb7b6 100644
--- a/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx
+++ b/packages/workflow-renderer/src/workflow-block/sub-block-row-view.tsx
@@ -1,4 +1,5 @@
 import { cn } from '@sim/emcn'
+import { OverflowSpan } from '../lib/overflow-span'
 
 /**
  * Props for the pure subblock summary row. The container resolves the value —
@@ -22,22 +23,18 @@ export interface SubBlockRowViewProps {
 export function SubBlockRowView({ title, displayValue, isMonospace }: SubBlockRowViewProps) {
   return (
     <div className='flex items-center gap-2'>
-      <span
+      <OverflowSpan
+        value={title}
         className='min-w-0 truncate text-[var(--text-tertiary)] text-sm capitalize'
-        title={title}
-      >
-        {title}
-      </span>
+      />
       {displayValue !== undefined && (
-        <span
+        <OverflowSpan
+          value={displayValue}
           className={cn(
             'flex-1 truncate text-right text-[var(--text-primary)] text-sm',
             isMonospace && 'font-mono'
           )}
-          title={displayValue}
-        >
-          {displayValue}
-        </span>
+        />
       )}
     </div>
   )
diff --git a/packages/workflow-renderer/src/workflow-block/workflow-block-view.tsx b/packages/workflow-renderer/src/workflow-block/workflow-block-view.tsx
index 3b7dbb36cec..cf43c63796d 100644
--- a/packages/workflow-renderer/src/workflow-block/workflow-block-view.tsx
+++ b/packages/workflow-renderer/src/workflow-block/workflow-block-view.tsx
@@ -2,6 +2,7 @@ import type { ComponentType, ReactNode, Ref } from 'react'
 import { Badge, cn, handleKeyboardActivation, Tooltip } from '@sim/emcn'
 import { Handle, Position } from 'reactflow'
 import { HANDLE_POSITIONS } from '../dimensions'
+import { OverflowSpan } from '../lib/overflow-span'
 import { tileIconColorClass } from '../lib/tile-icon-color'
 import type { BlockRunStatus } from '../types'
 import { SubBlockRowView } from './sub-block-row-view'
@@ -212,15 +213,13 @@ export function WorkflowBlockView({
                 )}
               />
             </div>
-            <span
+            <OverflowSpan
+              value={name}
               className={cn(
                 'truncate font-medium text-md',
                 !isEnabled && runPathStatus !== 'success' && 'text-[var(--text-muted)]'
               )}
-              title={name}
-            >
-              {name}
-            </span>
+            />
           </div>
           <div className='relative z-10 flex flex-shrink-0 items-center gap-1'>
             {isWorkflowSelector &&