From 45138f955d6d242dd0c92ecc45e5a45bfa6deea7 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 03:15:20 +0000
Subject: [PATCH 01/12] feat: expose subagent graphs as a native tool

---
 .github/workflows/playwright-mock.yml         |  10 +
 api/server/controllers/agents/openai.js       |   3 +-
 api/server/controllers/agents/responses.js    |   3 +-
 api/server/controllers/agents/v1.js           |   5 +-
 .../services/Endpoints/agents/initialize.js   |   6 +-
 .../Agents/Advanced/AgentSubagents.tsx        |  18 +-
 .../SidePanel/Agents/Advanced/Graphs.tsx      | 400 ++++++++++++++++++
 .../Agents/Advanced/OrchestrationHub.tsx      |   9 +-
 .../Agents/Advanced/__tests__/Graphs.spec.tsx |  65 +++
 .../Agents/Tools/ItemDialog/ItemDialog.tsx    |   6 +-
 .../ItemDialog/sections/BuiltinSection.tsx    |   7 +-
 .../Agents/Tools/ToolsMarketplaceDialog.tsx   |   7 +
 .../SidePanel/Agents/Tools/ToolsSection.tsx   |   7 +
 .../Tools/items/__tests__/catalog.spec.ts     |  12 +
 .../items/__tests__/orchestration.spec.ts     |  39 +-
 .../SidePanel/Agents/Tools/items/catalog.ts   |   9 +
 .../Agents/Tools/items/configurable.ts        |   1 +
 .../SidePanel/Agents/Tools/items/icons.ts     |   1 +
 .../SidePanel/Agents/Tools/items/mutations.ts |   4 +
 .../Agents/Tools/items/orchestration.ts       |   4 +
 .../SidePanel/Agents/Tools/items/selectors.ts |   3 +
 .../SidePanel/Agents/Tools/items/types.ts     |   1 +
 .../src/hooks/Agents/useCodeApprovalMode.ts   |  11 +-
 client/src/locales/en/translation.json        |  26 ++
 e2e/config/librechat.e2e.yaml                 |   1 +
 e2e/playwright.config.mock.ts                 |   6 +
 e2e/specs/mock/agent-graphs.spec.ts           | 148 +++++++
 librechat.example.yaml                        |   2 +-
 .../__tests__/run-summarization.test.ts       |  31 ++
 packages/api/src/agents/discovery.ts          |   8 +-
 packages/api/src/agents/files/session.ts      |  19 +-
 packages/api/src/agents/initialize.ts         |   2 +
 packages/api/src/agents/run.ts                |  10 +-
 packages/api/src/agents/validation.ts         | 159 +------
 packages/api/src/code/inheritance.ts          |  14 +-
 packages/api/src/schedules/requirements.ts    |  17 +-
 packages/data-provider/src/config.ts          |   2 +
 packages/data-provider/src/index.ts           |   2 +
 .../data-provider/src/subagentGraphs.spec.ts  |  84 ++++
 packages/data-provider/src/subagentGraphs.ts  | 199 +++++++++
 packages/data-provider/src/types/agents.ts    |   2 +
 41 files changed, 1160 insertions(+), 203 deletions(-)
 create mode 100644 client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
 create mode 100644 client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
 create mode 100644 e2e/specs/mock/agent-graphs.spec.ts
 create mode 100644 packages/data-provider/src/subagentGraphs.spec.ts
 create mode 100644 packages/data-provider/src/subagentGraphs.ts

diff --git a/.github/workflows/playwright-mock.yml b/.github/workflows/playwright-mock.yml
index 6f740ca27d0..ba597a01280 100644
--- a/.github/workflows/playwright-mock.yml
+++ b/.github/workflows/playwright-mock.yml
@@ -414,6 +414,16 @@ jobs:
           conversation-management.spec.ts --grep 'first-turn|final-title polling' --reporter=line
           --output=e2e/specs/.test-results/title-ownership
 
+      - name: Run graph subagent execution regression
+        if: ${{ !cancelled() && matrix.stream_store == 'memory' && startsWith(matrix.shard, '1/') }}
+        env:
+          CI: 'true'
+          E2E_GRAPH_SUBAGENTS: 'true'
+        run: >-
+          npx playwright test --config=e2e/playwright.config.mock.ts
+          agent-graphs.spec.ts --reporter=line
+          --output=e2e/specs/.test-results/graph-subagents
+
       - name: Upload title ownership diagnostics
         if: ${{ always() && matrix.stream_store == 'memory' && startsWith(matrix.shard, '1/') }}
         uses: actions/upload-artifact@v6
diff --git a/api/server/controllers/agents/openai.js b/api/server/controllers/agents/openai.js
index 817723c29db..dee7cdc5da7 100644
--- a/api/server/controllers/agents/openai.js
+++ b/api/server/controllers/agents/openai.js
@@ -5,6 +5,7 @@ const {
   createOpenAIToolCallStream: createAcceptedToolCallStream,
 } = require('@librechat/agents/openai');
 const {
+  hasSubagentCapability,
   EModelEndpoint,
   ResourceType,
   PermissionBits,
@@ -697,7 +698,7 @@ const executeOpenAIChatCompletion = async (envelope, { req, res }) => {
       let handoffAgentConfigs = new Map();
       let discoveredEdges = [];
       let discoveredMCPAuthMap;
-      const subagentsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.subagents);
+      const subagentsCapabilityEnabled = hasSubagentCapability([...enabledCapabilities]);
       const primaryHasGraphSubagents =
         subagentsCapabilityEnabled &&
         primaryConfig.subagents?.enabled === true &&
diff --git a/api/server/controllers/agents/responses.js b/api/server/controllers/agents/responses.js
index d0a4eeb495e..c03eae1cd55 100644
--- a/api/server/controllers/agents/responses.js
+++ b/api/server/controllers/agents/responses.js
@@ -3,6 +3,7 @@ const { v4: uuidv4 } = require('uuid');
 const { logger } = require('@librechat/data-schemas');
 const { Callback, formatAgentMessages } = require('@librechat/agents');
 const {
+  hasSubagentCapability,
   EModelEndpoint,
   ResourceType,
   PermissionBits,
@@ -950,7 +951,7 @@ const executeResponse = async (envelope, { req, res }) => {
       let handoffAgentConfigs = new Map();
       let discoveredEdges = [];
       let discoveredMCPAuthMap;
-      const subagentsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.subagents);
+      const subagentsCapabilityEnabled = hasSubagentCapability([...enabledCapabilities]);
       const primaryHasGraphSubagents =
         subagentsCapabilityEnabled &&
         primaryConfig.subagents?.enabled === true &&
diff --git a/api/server/controllers/agents/v1.js b/api/server/controllers/agents/v1.js
index 5aad55ad35a..7dbadac4fe9 100644
--- a/api/server/controllers/agents/v1.js
+++ b/api/server/controllers/agents/v1.js
@@ -54,6 +54,8 @@ const {
   instructionsContentForScan,
 } = require('@librechat/api');
 const {
+  resolveSubagents,
+  hasSubagentCapability,
   Time,
   Tools,
   SkillsScope,
@@ -476,7 +478,7 @@ const validateSubagentReferences = async (
 const isSubagentsCapabilityEnabled = (req) => {
   const capabilities = req.config?.endpoints?.[EModelEndpoint.agents]?.capabilities;
   if (!Array.isArray(capabilities)) return false;
-  return capabilities.includes(AgentCapabilities.subagents);
+  return hasSubagentCapability(capabilities);
 };
 
 const isCodeInterpreterCapabilityEnabled = (req) => {
@@ -491,6 +493,7 @@ const isCodeInterpreterCapabilityEnabled = (req) => {
  * @returns {Promise<{ status: number, body: { error: string, agent_ids: string[] } } | null>}
  */
 const getSubagentReferenceError = async (subagents, req, allowedMissingIds = new Set()) => {
+  subagents = resolveSubagents(subagents, req.config?.endpoints?.agents?.capabilities ?? []);
   if (
     !isSubagentsCapabilityEnabled(req) ||
     subagents?.enabled !== true ||
diff --git a/api/server/services/Endpoints/agents/initialize.js b/api/server/services/Endpoints/agents/initialize.js
index c9ef4f2d33d..dcd074bd57b 100644
--- a/api/server/services/Endpoints/agents/initialize.js
+++ b/api/server/services/Endpoints/agents/initialize.js
@@ -55,6 +55,8 @@ const {
   getMCPRequestContext,
 } = require('@librechat/api');
 const {
+  resolveSubagents,
+  hasSubagentCapability,
   ResourceType,
   EModelEndpoint,
   PermissionBits,
@@ -991,7 +993,7 @@ const initializeClientWithProvider = async ({
   const atSubagentThreadDepthLimit = !subagentThreadTaskStore.canCreateChildThread(
     requestConversation?.subagentThread?.depth ?? 0,
   );
-  const subagentsCapabilityEnabled = enabledCapabilities.has(AgentCapabilities.subagents);
+  const subagentsCapabilityEnabled = hasSubagentCapability([...enabledCapabilities]);
   const subagentsAvailableForRun = subagentsCapabilityEnabled && !atSubagentThreadDepthLimit;
   /** Track skipped ids locally so repeated failures short-circuit within
    *  the subagent loading loop. Seeded from the discovery helper's skip
@@ -1220,7 +1222,7 @@ const initializeClientWithProvider = async ({
         memory_scope: agent.memory_scope,
         memoryToolsRegistered:
           memoryAvailable === true && agent.tools?.includes(Tools.memory) === true,
-        subagents: agent.subagents,
+        subagents: resolveSubagents(agent.subagents, [...enabledCapabilities]),
         configId: getLazySubagentConfigId(agent),
         ...codeAvailability,
         statefulCodeEnvironment,
diff --git a/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx b/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx
index 84b00b39746..b23af7842b0 100644
--- a/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx
@@ -1,6 +1,7 @@
 import React, { useCallback, useMemo } from 'react';
 import { Switch } from '@librechat/client';
 import { Network, Users } from 'lucide-react';
+import { isSubagentGraphsEnabled } from 'librechat-data-provider';
 import type { ControllerRenderProps } from 'react-hook-form';
 import type { AgentForm } from '~/common';
 import { StaticAgentRow, AddAgentSelect, ListMeta, useSelectableAgents } from './AgentList';
@@ -28,7 +29,7 @@ const AgentSubagents: React.FC<AgentSubagentsProps> = ({
   const enabled = value.enabled === true;
   const allowSelf = value.allowSelf !== false;
   const agentIds = useMemo(() => value.agent_ids ?? [], [value.agent_ids]);
-  const graphCount = value.graphs?.length ?? 0;
+  const graphCount = isSubagentGraphsEnabled(value) ? (value.graphs?.length ?? 0) : 0;
 
   const { options, getAgent } = useSelectableAgents({ currentAgentId, exclude: agentIds });
 
@@ -43,12 +44,13 @@ const AgentSubagents: React.FC<AgentSubagentsProps> = ({
        */
       field.onChange({
         ...value,
+        ...(graphCount > 0 && { graphsEnabled: isSubagentGraphsEnabled(value) }),
         enabled: next,
         allowSelf: value.allowSelf ?? true,
         agent_ids: value.agent_ids ?? [],
       });
     },
-    [field, value],
+    [field, value, graphCount],
   );
 
   const setAllowSelf = useCallback(
@@ -106,8 +108,8 @@ const AgentSubagents: React.FC<AgentSubagentsProps> = ({
       beta
       info={
         <>
-          <p className="text-sm text-text-secondary">{localize('com_ui_agent_subagents_info')}</p>
-          <p className="text-sm text-text-secondary">{localize('com_ui_agent_subagents_info_2')}</p>
+          <p className="text-text-secondary text-sm">{localize('com_ui_agent_subagents_info')}</p>
+          <p className="text-text-secondary text-sm">{localize('com_ui_agent_subagents_info_2')}</p>
         </>
       }
       trailing={
@@ -126,7 +128,7 @@ const AgentSubagents: React.FC<AgentSubagentsProps> = ({
             checked={allowSelf}
             onCheckedChange={setAllowSelf}
             info={
-              <p className="text-sm text-text-secondary">
+              <p className="text-text-secondary text-sm">
                 {localize('com_ui_agent_subagents_allow_self_info')}
               </p>
             }
@@ -139,7 +141,7 @@ const AgentSubagents: React.FC<AgentSubagentsProps> = ({
               checked={value.shareFiles === true}
               onCheckedChange={setShareFiles}
               info={
-                <p className="text-sm text-text-secondary">
+                <p className="text-text-secondary text-sm">
                   {localize('com_ui_agent_subagents_share_files_info')}
                 </p>
               }
@@ -178,14 +180,14 @@ const AgentSubagents: React.FC<AgentSubagentsProps> = ({
             )}
 
             {agentIds.length >= maxSubagents && (
-              <p className="pt-1 text-center text-xs italic text-text-tertiary">
+              <p className="text-text-tertiary pt-1 text-center text-xs italic">
                 {localize('com_ui_agent_subagents_max', { 0: maxSubagents })}
               </p>
             )}
           </div>
 
           {nothingToSpawn && (
-            <p className="flex items-center gap-2 text-xs italic text-text-warning">
+            <p className="text-text-warning flex items-center gap-2 text-xs italic">
               <Users size={14} aria-hidden="true" />
               {localize('com_ui_agent_subagents_empty')}
             </p>
diff --git a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
new file mode 100644
index 00000000000..9daa6462c31
--- /dev/null
+++ b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
@@ -0,0 +1,400 @@
+import { useContext, useState } from 'react';
+import { Workflow, Plus, Pencil, X } from 'lucide-react';
+import { useFormContext, useWatch } from 'react-hook-form';
+import {
+  Button,
+  Input,
+  Label,
+  Textarea,
+  Checkbox,
+  Switch,
+  ControlCombobox,
+} from '@librechat/client';
+import {
+  graphSubagentSchema,
+  isSubagentGraphsEnabled,
+  MAX_SUBAGENTS,
+  MAX_GRAPH_SUBAGENT_MEMBERS,
+} from 'librechat-data-provider';
+import type { AgentSubagentGraph, AgentSubagentGraphEdge } from 'librechat-data-provider';
+import type { AgentForm, OptionWithIcon } from '~/common';
+import { AgentPickerPortalContext, AddAgentSelect, useSelectableAgents } from './AgentList';
+import OrchestrationPattern from './OrchestrationPattern';
+import { useAgentPanelContext } from '~/Providers';
+import { useLocalize } from '~/hooks';
+import { CountPill } from './ui';
+
+interface Draft {
+  index: number | null;
+  graph: AgentSubagentGraph;
+}
+const endpoints = (value: string | string[]): string[] => (Array.isArray(value) ? value : [value]);
+
+export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
+  const localize = useLocalize();
+  const { agentsConfig } = useAgentPanelContext();
+  const { control, getValues, setValue } = useFormContext<AgentForm>();
+  const subagents = useWatch({ control, name: 'subagents' });
+  const graphs = subagents?.graphs ?? [];
+  const enabled = isSubagentGraphsEnabled(subagents);
+  const maximum = agentsConfig?.maxSubagents ?? MAX_SUBAGENTS;
+  const { options, getAgent } = useSelectableAgents({ currentAgentId });
+  const portalElement = useContext(AgentPickerPortalContext) ?? undefined;
+  const [draft, setDraft] = useState<Draft | null>(null);
+  const [invalid, setInvalid] = useState(false);
+  const allOptions: OptionWithIcon[] = [
+    { value: '__current_agent__', label: localize('com_ui_agent_graphs_self') },
+    ...options,
+  ];
+  const nameOf = (id: string) =>
+    id === currentAgentId || id === ''
+      ? localize('com_ui_agent_graphs_self')
+      : (getAgent(id)?.name ?? id);
+  const write = (next: AgentSubagentGraph[], active = true) => {
+    const value = getValues('subagents');
+    setValue(
+      'subagents',
+      {
+        ...value,
+        enabled: value?.enabled ?? false,
+        allowSelf: value?.allowSelf ?? true,
+        agent_ids: value?.agent_ids ?? [],
+        graphsEnabled: active,
+        graphs: next,
+      },
+      { shouldDirty: true },
+    );
+  };
+  const update = (patch: Partial<AgentSubagentGraph>) => {
+    if (!draft) return;
+    setDraft({ ...draft, graph: { ...draft.graph, ...patch } });
+    setInvalid(false);
+  };
+  const addMember = (id: string) => {
+    if (
+      !draft ||
+      draft.graph.agent_ids.includes(id) ||
+      draft.graph.agent_ids.length >= MAX_GRAPH_SUBAGENT_MEMBERS
+    )
+      return;
+    update({
+      agent_ids: [...draft.graph.agent_ids, id],
+      ...(draft.graph.agent_ids.length === 0 ? { entry_agent_id: id, result_agent_id: id } : {}),
+    });
+  };
+  const save = () => {
+    if (!draft) return;
+    const parsed = graphSubagentSchema.safeParse(draft.graph);
+    const reserved = new Set([
+      'self',
+      ...(subagents?.agent_ids ?? []),
+      ...graphs.filter((_, index) => index !== draft.index).map((graph) => graph.type),
+    ]);
+    if (!parsed.success || reserved.has(draft.graph.type.trim())) {
+      setInvalid(true);
+      return;
+    }
+    const next = graphs.slice();
+    if (draft.index === null) {
+      if (graphs.length >= maximum) {
+        setInvalid(true);
+        return;
+      }
+      next.push(parsed.data);
+    } else next[draft.index] = parsed.data;
+    write(next);
+    setDraft(null);
+  };
+  const graph = draft?.graph;
+  const memberOptions = graph?.agent_ids.map((id) => ({ value: id, label: nameOf(id) })) ?? [];
+  const changeEdge = (index: number, patch: Partial<AgentSubagentGraphEdge>) => {
+    if (!graph) return;
+    update({ edges: graph.edges.map((edge, i) => (i === index ? { ...edge, ...patch } : edge)) });
+  };
+
+  return (
+    <OrchestrationPattern
+      icon={<Workflow className="h-4 w-4" aria-hidden="true" />}
+      title={localize('com_ui_agent_graphs')}
+      subtitle={localize('com_ui_agent_graphs_hint')}
+      beta
+      info={<p className="text-text-secondary text-sm">{localize('com_ui_agent_graphs_info')}</p>}
+      trailing={
+        <CountPill>
+          {graphs.length} / {maximum}
+        </CountPill>
+      }
+    >
+      {agentsConfig?.toolApproval?.enabled === true && (
+        <p role="note" className="text-text-warning text-sm">
+          {localize('com_ui_agent_graphs_approvals')}
+        </p>
+      )}
+      {graphs.length > 0 && (
+        <div className="flex items-center justify-between gap-3">
+          <Label htmlFor="subagent-graphs-enabled">{localize('com_ui_agent_graphs_enable')}</Label>
+          <Switch
+            id="subagent-graphs-enabled"
+            aria-label={localize('com_ui_agent_graphs_enable')}
+            checked={enabled}
+            onCheckedChange={(active) => write(graphs, active)}
+          />
+        </div>
+      )}
+      {draft === null && (
+        <>
+          {graphs.length === 0 && (
+            <p className="text-text-secondary text-sm">{localize('com_ui_agent_graphs_empty')}</p>
+          )}
+          <ul className="flex flex-col gap-2">
+            {graphs.map((team, index) => (
+              <li key={team.type} className="flex items-center gap-2">
+                <div className="min-w-0 flex-1">
+                  <p className="text-text-primary truncate text-sm font-medium">{team.name}</p>
+                  <p className="text-text-secondary text-xs">
+                    {team.agent_ids.map(nameOf).join(' → ')}
+                  </p>
+                </div>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon"
+                  aria-label={localize('com_ui_agent_graphs_edit', { 0: team.name })}
+                  onClick={() => {
+                    setDraft({ index, graph: { ...team } });
+                    setInvalid(false);
+                  }}
+                >
+                  <Pencil className="h-4 w-4" aria-hidden="true" />
+                </Button>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon"
+                  aria-label={localize('com_ui_agent_graphs_remove', { 0: team.name })}
+                  onClick={() =>
+                    write(
+                      graphs.filter((_, i) => i !== index),
+                      enabled,
+                    )
+                  }
+                >
+                  <X className="h-4 w-4" aria-hidden="true" />
+                </Button>
+              </li>
+            ))}
+          </ul>
+          <Button
+            type="button"
+            variant="outline"
+            disabled={graphs.length >= maximum}
+            onClick={() => {
+              setDraft({
+                index: null,
+                graph: {
+                  type: '',
+                  name: '',
+                  description: '',
+                  agent_ids: [],
+                  edges: [],
+                  entry_agent_id: '',
+                  result_agent_id: '',
+                },
+              });
+              setInvalid(false);
+            }}
+          >
+            <Plus className="h-4 w-4" aria-hidden="true" />
+            {localize('com_ui_agent_graphs_add')}
+          </Button>
+        </>
+      )}
+      {graph && (
+        <div className="flex flex-col gap-4">
+          <div>
+            <Label htmlFor="graph-name">{localize('com_ui_agent_graphs_name')}</Label>
+            <Input
+              id="graph-name"
+              value={graph.name}
+              onChange={(event) => update({ name: event.target.value })}
+            />
+          </div>
+          <div>
+            <Label htmlFor="graph-type">{localize('com_ui_agent_graphs_type')}</Label>
+            <Input
+              id="graph-type"
+              value={graph.type}
+              onChange={(event) => update({ type: event.target.value })}
+            />
+          </div>
+          <div>
+            <Label htmlFor="graph-description">{localize('com_ui_agent_graphs_description')}</Label>
+            <Textarea
+              id="graph-description"
+              value={graph.description}
+              onChange={(event) => update({ description: event.target.value })}
+            />
+          </div>
+          <section
+            aria-label={localize('com_ui_agent_graphs_members')}
+            className="flex flex-col gap-2"
+          >
+            <Label>{localize('com_ui_agent_graphs_members')}</Label>
+            {graph.agent_ids.map((id) => (
+              <div key={id} className="flex items-center justify-between gap-2">
+                <span className="text-sm">{nameOf(id)}</span>
+                <Button
+                  type="button"
+                  variant="ghost"
+                  size="icon"
+                  aria-label={localize('com_ui_agent_subagents_remove', { 0: nameOf(id) })}
+                  onClick={() =>
+                    update({
+                      agent_ids: graph.agent_ids.filter((member) => member !== id),
+                      edges: graph.edges.filter(
+                        (edge) => ![...endpoints(edge.from), ...endpoints(edge.to)].includes(id),
+                      ),
+                    })
+                  }
+                >
+                  <X className="h-4 w-4" aria-hidden="true" />
+                </Button>
+              </div>
+            ))}
+            {graph.agent_ids.length < MAX_GRAPH_SUBAGENT_MEMBERS && (
+              <AddAgentSelect
+                options={allOptions.filter(
+                  (option) =>
+                    !graph.agent_ids.includes(
+                      option.value === '__current_agent__'
+                        ? currentAgentId || ''
+                        : String(option.value),
+                    ),
+                )}
+                onSelect={(id) => addMember(id === '__current_agent__' ? currentAgentId || '' : id)}
+                placeholder={localize('com_ui_agent_graphs_add_member')}
+                ariaLabel={localize('com_ui_agent_graphs_add_member')}
+              />
+            )}
+          </section>
+          {(['entry_agent_id', 'result_agent_id'] as const).map((key) => (
+            <div key={key}>
+              <Label>
+                {localize(
+                  key === 'entry_agent_id'
+                    ? 'com_ui_agent_graphs_entry'
+                    : 'com_ui_agent_graphs_result',
+                )}
+              </Label>
+              <ControlCombobox
+                isCollapsed={false}
+                ariaLabel={localize(
+                  key === 'entry_agent_id'
+                    ? 'com_ui_agent_graphs_entry'
+                    : 'com_ui_agent_graphs_result',
+                )}
+                selectedValue={graph[key]}
+                displayValue={graph.agent_ids.includes(graph[key]) ? nameOf(graph[key]) : ''}
+                items={memberOptions}
+                setValue={(id) => update({ [key]: id })}
+                portalElement={portalElement}
+                searchPlaceholder={localize('com_ui_agent_var', { 0: localize('com_ui_search') })}
+              />
+            </div>
+          ))}
+          <section
+            aria-label={localize('com_ui_agent_graphs_edges')}
+            className="flex flex-col gap-3"
+          >
+            <Label>{localize('com_ui_agent_graphs_edges')}</Label>
+            {graph.edges.map((edge, index) => (
+              <div
+                key={index}
+                className="border-border-light flex flex-col gap-2 rounded-lg border p-3"
+              >
+                {(['from', 'to'] as const).map((key) => (
+                  <fieldset key={key} className="flex flex-col gap-1">
+                    <legend className="text-text-secondary text-sm">
+                      {localize(
+                        key === 'from' ? 'com_ui_agent_graphs_from' : 'com_ui_agent_graphs_to',
+                      )}
+                    </legend>
+                    {graph.agent_ids.map((id) => (
+                      <label key={id} className="flex items-center gap-2 text-sm">
+                        <Checkbox
+                          aria-label={nameOf(id)}
+                          checked={endpoints(edge[key]).includes(id)}
+                          onCheckedChange={(checked) => {
+                            const ids = endpoints(edge[key]).filter((value) => value !== id);
+                            if (checked) ids.push(id);
+                            changeEdge(index, { [key]: ids.length === 1 ? ids[0] : ids });
+                          }}
+                        />
+                        {nameOf(id)}
+                      </label>
+                    ))}
+                  </fieldset>
+                ))}
+                <Label htmlFor={`graph-edge-prompt-${index}`}>
+                  {localize('com_ui_agent_graphs_prompt')}
+                </Label>
+                <Textarea
+                  id={`graph-edge-prompt-${index}`}
+                  value={edge.prompt ?? ''}
+                  onChange={(event) =>
+                    changeEdge(index, {
+                      prompt: event.target.value || undefined,
+                      ...(!event.target.value && { excludeResults: undefined }),
+                    })
+                  }
+                />
+                {edge.prompt && (
+                  <label className="flex items-center gap-2 text-sm">
+                    <Checkbox
+                      aria-label={localize('com_ui_agent_graphs_exclude')}
+                      checked={edge.excludeResults === true}
+                      onCheckedChange={(checked) =>
+                        changeEdge(index, { excludeResults: checked === true ? true : undefined })
+                      }
+                    />
+                    {localize('com_ui_agent_graphs_exclude')}
+                  </label>
+                )}
+                <Button
+                  type="button"
+                  variant="outline"
+                  onClick={() => update({ edges: graph.edges.filter((_, i) => i !== index) })}
+                >
+                  {localize('com_ui_agent_graphs_remove_edge')}
+                </Button>
+              </div>
+            ))}
+            <Button
+              type="button"
+              variant="outline"
+              disabled={graph.agent_ids.length < 2}
+              onClick={() =>
+                update({ edges: [...graph.edges, { from: [], to: [], edgeType: 'direct' }] })
+              }
+            >
+              {localize('com_ui_agent_graphs_add_edge')}
+            </Button>
+          </section>
+          {invalid && (
+            <p role="alert" className="text-text-destructive text-sm">
+              {localize('com_ui_agent_graphs_invalid')}
+            </p>
+          )}
+          <div className="flex gap-2">
+            <Button type="button" onClick={save}>
+              {localize('com_ui_agent_graphs_save')}
+            </Button>
+            <Button type="button" variant="outline" onClick={() => setDraft(null)}>
+              {localize('com_ui_cancel')}
+            </Button>
+          </div>
+        </div>
+      )}
+    </OrchestrationPattern>
+  );
+}
diff --git a/client/src/components/SidePanel/Agents/Advanced/OrchestrationHub.tsx b/client/src/components/SidePanel/Agents/Advanced/OrchestrationHub.tsx
index c76db6b09ed..ca11e792f32 100644
--- a/client/src/components/SidePanel/Agents/Advanced/OrchestrationHub.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/OrchestrationHub.tsx
@@ -4,10 +4,11 @@ import type { AgentForm } from '~/common';
 import { useAgentPanelContext } from '~/Providers';
 import AgentSubagents from './AgentSubagents';
 import AgentHandoffs from './AgentHandoffs';
+import Graphs from './Graphs';
 
 interface OrchestrationHubProps {
   currentAgentId: string;
-  tool: 'subagents' | 'handoffs';
+  tool: 'subagents' | 'subagent_graphs' | 'handoffs';
 }
 
 /** Settings for one native collaboration tool, never the other tool's fields. */
@@ -15,6 +16,12 @@ export default function OrchestrationHub({ currentAgentId, tool }: Orchestration
   const { control } = useFormContext<AgentForm>();
   const { agentsConfig } = useAgentPanelContext();
 
+  if (tool === 'subagent_graphs') {
+    return agentsConfig?.capabilities.includes(AgentCapabilities.subagent_graphs) ? (
+      <Graphs currentAgentId={currentAgentId} />
+    ) : null;
+  }
+
   if (tool === 'subagents') {
     if (!agentsConfig?.capabilities.includes(AgentCapabilities.subagents)) {
       return null;
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
new file mode 100644
index 00000000000..1eb159ff392
--- /dev/null
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
@@ -0,0 +1,65 @@
+import { useForm, FormProvider } from 'react-hook-form';
+import { render, screen, fireEvent } from '@testing-library/react';
+import type { UseFormReturn } from 'react-hook-form';
+import type { AgentForm } from '~/common';
+import Graphs from '../Graphs';
+
+let mockGetValues: UseFormReturn<AgentForm>['getValues'];
+jest.mock('~/hooks', () => ({ useLocalize: () => (key: string) => key }));
+jest.mock('~/Providers', () => ({
+  useAgentPanelContext: () => ({ agentsConfig: { maxSubagents: 2 } }),
+  useAgentsMapContext: () => ({}),
+}));
+const team = {
+  type: 'review',
+  name: 'Review',
+  description: 'Review work',
+  agent_ids: ['parent'],
+  edges: [],
+  entry_agent_id: 'parent',
+  result_agent_id: 'parent',
+};
+function Harness() {
+  const methods = useForm<AgentForm>({
+    defaultValues: {
+      subagents: {
+        enabled: false,
+        graphsEnabled: true,
+        allowSelf: false,
+        agent_ids: ['child'],
+        graphs: [team],
+      },
+      edges: [{ from: 'parent', to: 'handoff', edgeType: 'handoff' }],
+    },
+  });
+  mockGetValues = methods.getValues;
+  return (
+    <FormProvider {...methods}>
+      <Graphs currentAgentId="parent" />
+    </FormProvider>
+  );
+}
+
+test('disabling graph teams retains definitions and leaves ordinary subagents and handoffs alone', () => {
+  render(<Harness />);
+  fireEvent.click(screen.getByRole('switch', { name: 'com_ui_agent_graphs_enable' }));
+  expect(mockGetValues('subagents')).toEqual({
+    enabled: false,
+    graphsEnabled: false,
+    allowSelf: false,
+    agent_ids: ['child'],
+    graphs: [team],
+  });
+  expect(mockGetValues('edges')).toEqual([{ from: 'parent', to: 'handoff', edgeType: 'handoff' }]);
+});
+
+test('cancelled graph edits never change the saved form and invalid graphs cannot be applied', () => {
+  render(<Harness />);
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_edit' }));
+  fireEvent.change(screen.getByLabelText('com_ui_agent_graphs_name'), { target: { value: '' } });
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_save' }));
+  expect(screen.getByRole('alert')).toBeVisible();
+  expect(mockGetValues('subagents.graphs')).toEqual([team]);
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_cancel' }));
+  expect(mockGetValues('subagents.graphs')).toEqual([team]);
+});
diff --git a/client/src/components/SidePanel/Agents/Tools/ItemDialog/ItemDialog.tsx b/client/src/components/SidePanel/Agents/Tools/ItemDialog/ItemDialog.tsx
index 4582f07babb..f2d8adc38d5 100644
--- a/client/src/components/SidePanel/Agents/Tools/ItemDialog/ItemDialog.tsx
+++ b/client/src/components/SidePanel/Agents/Tools/ItemDialog/ItemDialog.tsx
@@ -15,7 +15,8 @@ interface Props {
 export default function ItemDialog({ item, agentId, onClose }: Props) {
   const [portalElement, setPortalElement] = useState<HTMLDivElement | null>(null);
   const isOrchestration =
-    item?.kind === 'builtin' && (item.id === 'subagents' || item.id === 'handoffs');
+    item?.kind === 'builtin' &&
+    (item.id === 'subagents' || item.id === 'subagent_graphs' || item.id === 'handoffs');
   const isAction = item?.kind === 'action';
   return (
     <OGDialog open={item !== null} onOpenChange={(next) => !next && onClose()}>
@@ -24,7 +25,8 @@ export default function ItemDialog({ item, agentId, onClose }: Props) {
         className={cn(
           'w-11/12 gap-0 rounded-2xl p-0 md:max-h-[85dvh]',
           isOrchestration ? 'overflow-visible' : 'overflow-hidden',
-          isAction ? 'max-w-5xl' : 'max-w-[35rem]',
+          isAction && 'max-w-5xl',
+          !isAction && (item?.id === 'subagent_graphs' ? 'max-w-3xl' : 'max-w-[35rem]'),
         )}
         data-testid="item-dialog"
       >
diff --git a/client/src/components/SidePanel/Agents/Tools/ItemDialog/sections/BuiltinSection.tsx b/client/src/components/SidePanel/Agents/Tools/ItemDialog/sections/BuiltinSection.tsx
index d8f3d63ee05..c08467eb2dd 100644
--- a/client/src/components/SidePanel/Agents/Tools/ItemDialog/sections/BuiltinSection.tsx
+++ b/client/src/components/SidePanel/Agents/Tools/ItemDialog/sections/BuiltinSection.tsx
@@ -143,7 +143,7 @@ export default function BuiltinSection({
 
   let body: React.ReactNode = null;
 
-  if (builtinId === 'subagents' || builtinId === 'handoffs') {
+  if (builtinId === 'subagents' || builtinId === 'subagent_graphs' || builtinId === 'handoffs') {
     body = <OrchestrationHub currentAgentId={agentId} tool={builtinId} />;
   } else if (builtinId === 'execute_code') {
     body = (
@@ -176,7 +176,10 @@ export default function BuiltinSection({
   }
 
   const localizedDescription =
-    description && builtinId !== 'subagents' && builtinId !== 'handoffs'
+    description &&
+    builtinId !== 'subagents' &&
+    builtinId !== 'subagent_graphs' &&
+    builtinId !== 'handoffs'
       ? localize(description as TranslationKeys)
       : '';
 
diff --git a/client/src/components/SidePanel/Agents/Tools/ToolsMarketplaceDialog.tsx b/client/src/components/SidePanel/Agents/Tools/ToolsMarketplaceDialog.tsx
index b4d89e90434..664cbd13fd1 100644
--- a/client/src/components/SidePanel/Agents/Tools/ToolsMarketplaceDialog.tsx
+++ b/client/src/components/SidePanel/Agents/Tools/ToolsMarketplaceDialog.tsx
@@ -136,6 +136,13 @@ export default function ToolsMarketplaceDialog({
             shouldDirty: true,
           });
           break;
+        case 'graphs-remove':
+          setValue(
+            'subagents',
+            { ...getValues('subagents'), graphsEnabled: false },
+            { shouldDirty: true },
+          );
+          break;
         case 'handoffs-remove':
           setValue('edges', removeHandoffs(getValues('edges')), { shouldDirty: true });
           break;
diff --git a/client/src/components/SidePanel/Agents/Tools/ToolsSection.tsx b/client/src/components/SidePanel/Agents/Tools/ToolsSection.tsx
index 2d3c2cc44eb..58369ae4a25 100644
--- a/client/src/components/SidePanel/Agents/Tools/ToolsSection.tsx
+++ b/client/src/components/SidePanel/Agents/Tools/ToolsSection.tsx
@@ -133,6 +133,13 @@ export default function ToolsSection({ agentId }: Props) {
             shouldDirty: true,
           });
           break;
+        case 'graphs-remove':
+          setValue(
+            'subagents',
+            { ...getValues('subagents'), graphsEnabled: false },
+            { shouldDirty: true },
+          );
+          break;
         case 'handoffs-remove':
           setValue('edges', removeHandoffs(getValues('edges')), { shouldDirty: true });
           break;
diff --git a/client/src/components/SidePanel/Agents/Tools/items/__tests__/catalog.spec.ts b/client/src/components/SidePanel/Agents/Tools/items/__tests__/catalog.spec.ts
index a131a522415..b054301ac48 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/__tests__/catalog.spec.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/__tests__/catalog.spec.ts
@@ -319,3 +319,15 @@ describe('buildCatalog', () => {
     ]);
   });
 });
+
+test('offers graph teams only under their own capability', () => {
+  const items = buildCatalog({
+    ...emptyInputs,
+    agentsConfig: { capabilities: [AgentCapabilities.subagent_graphs] },
+  });
+  expect(items.some((item) => item.id === AgentCapabilities.subagent_graphs)).toBe(true);
+  expect(items.some((item) => item.id === AgentCapabilities.subagents)).toBe(false);
+  expect(
+    buildCatalog(emptyInputs).some((item) => item.id === AgentCapabilities.subagent_graphs),
+  ).toBe(false);
+});
diff --git a/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts b/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts
index 26dfbb1fc31..d7a16243f56 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts
@@ -93,9 +93,9 @@ test('subagent toggles preserve their complete settings and restore the retained
     ],
   };
   const disabled = setSubagentsEnabled(subagents, false);
-  expect(disabled).toEqual({ ...subagents, enabled: false });
+  expect(disabled).toEqual({ ...subagents, enabled: false, graphsEnabled: true });
   expect(subagents.enabled).toBe(true);
-  expect(setSubagentsEnabled(disabled, true)).toEqual(subagents);
+  expect(setSubagentsEnabled(disabled, true)).toEqual({ ...subagents, graphsEnabled: true });
   expect(setSubagentsEnabled(undefined, true)).toEqual({
     enabled: true,
     allowSelf: true,
@@ -126,3 +126,38 @@ test('handoff removal retains all direct edges and does not mutate stored input'
   expect(edges).toHaveLength(3);
   expect(removeHandoffs()).toEqual([]);
 });
+
+test('graph selection and removal use the graph flag independently of ordinary spawning', () => {
+  const graphItem: AgentItem = {
+    kind: 'builtin',
+    id: 'subagent_graphs',
+    name: '',
+    description: '',
+    iconKey: 'subagent_graphs',
+  };
+  const team = {
+    type: 'team',
+    name: 'Team',
+    description: 'Work',
+    agent_ids: ['child'],
+    entry_agent_id: 'child',
+    result_agent_id: 'child',
+    edges: [],
+  };
+  expect(
+    deriveSelectedItems(
+      { ...form, subagents: { enabled: false, graphsEnabled: true, graphs: [team] } },
+      [graphItem, subagentItem],
+      [],
+    ),
+  ).toEqual([graphItem]);
+  expect(
+    deriveSelectedItems(
+      { ...form, subagents: { enabled: true, graphsEnabled: false, graphs: [team] } },
+      [graphItem, subagentItem],
+      [],
+    ),
+  ).toEqual([subagentItem]);
+  expect(computeToggleAction(graphItem, { selected: true })).toEqual({ type: 'graphs-remove' });
+  expect(computeToggleAction(graphItem, { selected: false })).toEqual({ type: 'configure' });
+});
diff --git a/client/src/components/SidePanel/Agents/Tools/items/catalog.ts b/client/src/components/SidePanel/Agents/Tools/items/catalog.ts
index 0b2b62e5936..171488fd773 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/catalog.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/catalog.ts
@@ -139,6 +139,15 @@ export function buildCatalog(inputs: BuildCatalogInputs): AgentItem[] {
       description: 'com_ui_agent_subagents_subtitle',
     });
   }
+  if (enabled.has(AgentCapabilities.subagent_graphs)) {
+    items.push({
+      kind: 'builtin',
+      id: AgentCapabilities.subagent_graphs,
+      iconKey: 'subagent_graphs',
+      name: 'com_ui_agent_graphs',
+      description: 'com_ui_agent_graphs_hint',
+    });
+  }
   for (const def of BUILTIN_DEFINITIONS) {
     if (!enabled.has(def.id)) {
       continue;
diff --git a/client/src/components/SidePanel/Agents/Tools/items/configurable.ts b/client/src/components/SidePanel/Agents/Tools/items/configurable.ts
index 7e4662bc86d..8d4b5f4fcfe 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/configurable.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/configurable.ts
@@ -17,6 +17,7 @@ export function hasConfigurableSettings(item: AgentItem): boolean {
         item.id === 'context' ||
         item.id === 'memory' ||
         item.id === 'subagents' ||
+        item.id === 'subagent_graphs' ||
         item.id === 'handoffs' ||
         (item.id === 'web_search' && item.userProvidedAuth === true)
       );
diff --git a/client/src/components/SidePanel/Agents/Tools/items/icons.ts b/client/src/components/SidePanel/Agents/Tools/items/icons.ts
index 3ddd5461c54..13e167bc8fb 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/icons.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/icons.ts
@@ -24,6 +24,7 @@ export interface ItemIcon {
 }
 
 const BUILTIN_ICONS: Record<string, ItemIcon> = {
+  subagent_graphs: { Icon: Workflow, colorClass: 'bg-series-6/15 text-series-6' },
   subagents: {
     Icon: Network,
     colorClass: 'bg-series-2/15 text-series-2',
diff --git a/client/src/components/SidePanel/Agents/Tools/items/mutations.ts b/client/src/components/SidePanel/Agents/Tools/items/mutations.ts
index f7debe7dc4d..3a29f0cdac0 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/mutations.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/mutations.ts
@@ -5,6 +5,7 @@ export type TogglePatch =
   | { type: 'builtin'; field: AgentCapabilities; value: boolean | string }
   | { type: 'subagents'; enabled: boolean }
   | { type: 'handoffs-remove' }
+  | { type: 'graphs-remove' }
   | { type: 'configure' }
   | { type: 'tool-add'; id: string }
   | { type: 'tool-remove'; id: string }
@@ -16,6 +17,9 @@ export type TogglePatch =
   | { type: 'action-remove'; actionId: string };
 
 function builtinTogglePatch(id: string, selected: boolean): TogglePatch {
+  if (id === 'subagent_graphs') {
+    return selected ? { type: 'graphs-remove' } : { type: 'configure' };
+  }
   if (id === 'subagents') {
     return { type: 'subagents', enabled: !selected };
   }
diff --git a/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts b/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts
index 1849ab27b74..c3cca7dcb77 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts
@@ -1,3 +1,4 @@
+import { isSubagentGraphsEnabled } from 'librechat-data-provider';
 import type { AgentSubagentsConfig, GraphEdge } from 'librechat-data-provider';
 
 /** Match the SDK: untyped, unconditional one-to-many edges default to direct. */
@@ -16,6 +17,9 @@ export function setSubagentsEnabled(
 ): AgentSubagentsConfig {
   return {
     ...subagents,
+    ...((subagents?.graphs?.length ?? 0) > 0 && {
+      graphsEnabled: isSubagentGraphsEnabled(subagents),
+    }),
     enabled,
     allowSelf: subagents?.allowSelf ?? true,
     agent_ids: subagents?.agent_ids ?? [],
diff --git a/client/src/components/SidePanel/Agents/Tools/items/selectors.ts b/client/src/components/SidePanel/Agents/Tools/items/selectors.ts
index 2735f490c96..b6bcc685586 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/selectors.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/selectors.ts
@@ -1,5 +1,6 @@
 import {
   Constants,
+  isSubagentGraphsEnabled,
   splitMCPToolKey,
   normalizeServerName,
   buildServerNameAliases,
@@ -53,6 +54,8 @@ function isBuiltinSelected(item: AgentItem, form: FormSelection): boolean {
       return Boolean(form.artifacts);
     case 'context':
       return form.context_files.length > 0;
+    case 'subagent_graphs':
+      return isSubagentGraphsEnabled(form.subagents) && (form.subagents?.graphs?.length ?? 0) > 0;
     case 'subagents':
       return form.subagents?.enabled === true;
     case 'handoffs':
diff --git a/client/src/components/SidePanel/Agents/Tools/items/types.ts b/client/src/components/SidePanel/Agents/Tools/items/types.ts
index 43e0f1872cd..3badca33f63 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/types.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/types.ts
@@ -22,6 +22,7 @@ export type BuiltinId =
    * in `selectors.ts` / `mutations.ts`.
    */
   | 'ask_user_question'
+  | `${AgentCapabilities.subagent_graphs}`
   | `${AgentCapabilities.subagents}`
   | 'handoffs';
 
diff --git a/client/src/hooks/Agents/useCodeApprovalMode.ts b/client/src/hooks/Agents/useCodeApprovalMode.ts
index 336dba54dbd..b7ce4d987f9 100644
--- a/client/src/hooks/Agents/useCodeApprovalMode.ts
+++ b/client/src/hooks/Agents/useCodeApprovalMode.ts
@@ -2,6 +2,7 @@ import { useMemo } from 'react';
 import {
   EModelEndpoint,
   Tools,
+  resolveSubagents,
   isEphemeralAgentId,
   getAllowedCodeApprovalModes,
   CODE_APPROVAL_MODES,
@@ -232,7 +233,7 @@ export function collectReachableAgents(
       ...(Array.isArray(edge.from) ? edge.from : [edge.from]),
       ...(Array.isArray(edge.to) ? edge.to : [edge.to]),
     ]);
-    const subagents = agent.subagents?.enabled === true ? agent.subagents : undefined;
+    const subagents = resolveSubagents(agent.subagents);
     const graphIds = subagents?.graphs?.flatMap((graph) => graph.agent_ids);
     const ids = [
       ...(agent.agent_ids ?? []),
@@ -273,10 +274,12 @@ function toCodeWorkspaceRoutingAgent(
     allowSelection:
       getCodeEnvironmentChoiceIds(agent, environments, allowEnvironmentSelection) != null,
     subagentIds:
-      agent.subagents?.enabled === true
+      resolveSubagents(agent.subagents)?.enabled === true
         ? [
-            ...(agent.subagents.agent_ids ?? []),
-            ...(agent.subagents.graphs ?? []).flatMap((graph) => graph.agent_ids ?? []),
+            ...(resolveSubagents(agent.subagents)?.agent_ids ?? []),
+            ...(resolveSubagents(agent.subagents)?.graphs ?? []).flatMap(
+              (graph) => graph.agent_ids ?? [],
+            ),
           ].filter((id) => id.length > 0 && id !== agent.id)
         : undefined,
   };
diff --git a/client/src/locales/en/translation.json b/client/src/locales/en/translation.json
index 43ab38d6e69..48727aae1dd 100644
--- a/client/src/locales/en/translation.json
+++ b/client/src/locales/en/translation.json
@@ -1108,6 +1108,32 @@
   "com_ui_agent_handoff_prompt_key_placeholder": "Label the content passed (default: 'instructions')",
   "com_ui_agent_handoff_prompt_placeholder": "What to generate and pass to the handoff agent",
   "com_ui_agent_handoff_remove": "Remove handoff to {{0}}",
+  "com_ui_agent_graphs": "Subagent Graphs",
+  "com_ui_agent_graphs_approvals": "The agents SDK does not support tool approval inside graph teams. Disable tool approval for this deployment before executing a graph team.",
+  "com_ui_agent_graphs_hint": "Delegate a task to a team of agents in an isolated graph.",
+  "com_ui_agent_graphs_info": "The parent selects a saved team dynamically. Direct connections define execution order and parallel branches. All members must be reachable from one entry and converge on one result. Multiple sources on a connection wait for all branches.",
+  "com_ui_agent_graphs_self": "This agent",
+  "com_ui_agent_graphs_enable": "Enable graph teams",
+  "com_ui_agent_graphs_empty": "Add a team and define how its agents work together.",
+  "com_ui_agent_graphs_edit": "Edit {{0}}",
+  "com_ui_agent_graphs_remove": "Remove {{0}}",
+  "com_ui_agent_graphs_add": "Add graph team",
+  "com_ui_agent_graphs_name": "Team name",
+  "com_ui_agent_graphs_type": "Tool identifier",
+  "com_ui_agent_graphs_description": "When to use this team",
+  "com_ui_agent_graphs_members": "Team members",
+  "com_ui_agent_graphs_add_member": "Add team member",
+  "com_ui_agent_graphs_entry": "Entry agent",
+  "com_ui_agent_graphs_result": "Result agent",
+  "com_ui_agent_graphs_edges": "Connections",
+  "com_ui_agent_graphs_from": "Sources (wait for all)",
+  "com_ui_agent_graphs_to": "Destinations",
+  "com_ui_agent_graphs_prompt": "Transition instructions (optional)",
+  "com_ui_agent_graphs_exclude": "Replace prior results with these instructions",
+  "com_ui_agent_graphs_remove_edge": "Remove connection",
+  "com_ui_agent_graphs_add_edge": "Add connection",
+  "com_ui_agent_graphs_save": "Save graph team",
+  "com_ui_agent_graphs_invalid": "Check the team name, unique tool identifier, description, members, entry, result, and connections. Use an acyclic graph with one entry and one result. Merge parallel branches in one connection; instructions on branched graphs must target the result.",
   "com_ui_agent_handoffs": "Handoffs",
   "com_ui_agent_handoffs_subtitle": "Transfer the conversation to a specialist agent.",
   "com_ui_agent_id": "Agent ID",
diff --git a/e2e/config/librechat.e2e.yaml b/e2e/config/librechat.e2e.yaml
index be32ca709e9..653a48a83f0 100644
--- a/e2e/config/librechat.e2e.yaml
+++ b/e2e/config/librechat.e2e.yaml
@@ -132,6 +132,7 @@ endpoints:
       - web_search
       - artifacts
       - subagents
+      - subagent_graphs
       - actions
       - context
       - skills
diff --git a/e2e/playwright.config.mock.ts b/e2e/playwright.config.mock.ts
index a94fda2745d..db96d20dd9a 100644
--- a/e2e/playwright.config.mock.ts
+++ b/e2e/playwright.config.mock.ts
@@ -244,6 +244,12 @@ function writeRuntimeMockConfig() {
     process.env.E2E_MODEL_SPECS_ENFORCE === 'true'
       ? template.replace('\n  enforce: false\n', '\n  enforce: true\n')
       : template;
+  if (process.env.E2E_GRAPH_SUBAGENTS === 'true') {
+    config = config.replace(
+      '    toolApproval:\n      enabled: true',
+      '    toolApproval:\n      enabled: false',
+    );
+  }
   config = config.replace(
     '  agents:\n',
     `  agents:\n    managementApi: ${JSON.stringify({ auth: managementAuth })}\n`,
diff --git a/e2e/specs/mock/agent-graphs.spec.ts b/e2e/specs/mock/agent-graphs.spec.ts
new file mode 100644
index 00000000000..b153e1b1157
--- /dev/null
+++ b/e2e/specs/mock/agent-graphs.spec.ts
@@ -0,0 +1,148 @@
+import { expect, test } from '@playwright/test';
+import type { AgentDetail } from './agents.helpers';
+import { openAgentBuilder, cleanupAgent, uniqueAgentName } from './agents.helpers';
+import {
+  MOCK_ENDPOINTS,
+  getAccessToken,
+  requestJson,
+  fetchJson,
+  messagesView,
+  sendMessageAndWaitForCompletion,
+} from './helpers';
+
+test('authors and executes a graph team independently of ordinary subagents', async ({ page }) => {
+  test.setTimeout(90000);
+  await page.goto('/c/new');
+  const token = await getAccessToken(page);
+  const child = await requestJson<AgentDetail>(page, {
+    path: '/api/agents',
+    token,
+    method: 'POST',
+    body: {
+      name: uniqueAgentName('Graph reviewer'),
+      provider: MOCK_ENDPOINTS[0].label,
+      model: MOCK_ENDPOINTS[0].model,
+    },
+  });
+  let parent: AgentDetail | undefined;
+  try {
+    parent = await requestJson<AgentDetail>(page, {
+      path: '/api/agents',
+      token,
+      method: 'POST',
+      body: {
+        name: uniqueAgentName('Graph host'),
+        provider: MOCK_ENDPOINTS[0].label,
+        model: MOCK_ENDPOINTS[0].model,
+        subagents: { enabled: false, allowSelf: false, agent_ids: [] },
+      },
+    });
+    const form = await openAgentBuilder(page);
+    await form.getByRole('combobox', { name: 'Agent', exact: true }).click();
+    await page.getByRole('option', { name: parent.name, exact: true }).click();
+    await expect(form.getByLabel('Agent name')).toHaveValue(parent.name ?? '');
+    await form.getByRole('button', { name: 'Add tools', exact: true }).click();
+    const library = page.getByRole('dialog', { name: 'Tool Library', exact: true });
+    await library
+      .getByRole('listitem')
+      .filter({ hasText: 'Subagent Graphs' })
+      .getByRole('button', { name: 'Configure', exact: true })
+      .click();
+    const dialog = page.getByTestId('item-dialog');
+    await expect(
+      dialog.getByRole('region', { name: 'Subagent Graphs', exact: true }),
+    ).toBeVisible();
+    await dialog.getByRole('button', { name: 'Add graph team', exact: true }).click();
+    await dialog.getByLabel('Team name', { exact: true }).fill('Review team');
+    await dialog.getByLabel('Tool identifier', { exact: true }).fill('review_team');
+    await dialog
+      .getByLabel('When to use this team', { exact: true })
+      .fill('Review a task in an isolated team.');
+    await dialog.getByRole('combobox', { name: 'Add team member', exact: true }).click();
+    const search = page.locator('input[placeholder="Search agent"]:visible');
+    await search.fill(child.name ?? '');
+    await expect(search).toBeFocused();
+    await page.getByRole('option', { name: child.name, exact: true }).click();
+    await dialog.getByRole('button', { name: 'Save graph team', exact: true }).click();
+    await expect(dialog.getByText('Review team', { exact: true })).toBeVisible();
+    await dialog.getByRole('button', { name: 'Close', exact: true }).click();
+    await expect(dialog).toBeHidden();
+    await page
+      .getByRole('dialog', { name: 'Tool Library', exact: true, includeHidden: true })
+      .getByRole('button', { name: 'Close', exact: true })
+      .click();
+    const graphRow = form
+      .getByRole('listitem')
+      .filter({ has: page.getByText('Subagent Graphs', { exact: true }) });
+    await expect(graphRow).toBeVisible();
+    await expect(
+      form.getByRole('listitem').filter({ has: page.getByText('Subagents', { exact: true }) }),
+    ).toHaveCount(0);
+    await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'PATCH' &&
+          new URL(response.url()).pathname === `/api/agents/${parent?.id}` &&
+          response.ok(),
+      ),
+      form.getByRole('button', { name: 'Save', exact: true }).click(),
+    ]);
+    let saved = await fetchJson<AgentDetail>(page, `/api/agents/${parent.id}/expanded`, token);
+    expect(saved.subagents).toMatchObject({
+      enabled: false,
+      allowSelf: false,
+      graphsEnabled: true,
+      graphs: [
+        {
+          type: 'review_team',
+          agent_ids: [child.id],
+          entry_agent_id: child.id,
+          result_agent_id: child.id,
+          edges: [],
+        },
+      ],
+    });
+    if (process.env.E2E_GRAPH_SUBAGENTS === 'true') {
+      await form.getByRole('button', { name: 'Select Agent', exact: true }).click();
+      const label = `graph-${Date.now()}`;
+      const result = await sendMessageAndWaitForCompletion(
+        page,
+        `E2E_SUBAGENT_RESULT:review_team:${label}`,
+        { timeout: 30000 },
+      );
+      expect(result.ok()).toBeTruthy();
+      await expect(
+        messagesView(page)
+          .getByText(`E2E subagent streamed result ${label}`, { exact: true })
+          .last(),
+      ).toBeVisible({ timeout: 30000 });
+    }
+    const reopened = await openAgentBuilder(page);
+    await reopened.getByRole('combobox', { name: 'Agent', exact: true }).click();
+    await page.getByRole('option', { name: parent.name, exact: true }).click();
+    await expect(reopened.getByLabel('Agent name')).toHaveValue(parent.name ?? '');
+    await reopened
+      .getByRole('listitem')
+      .filter({ has: page.getByText('Subagent Graphs', { exact: true }) })
+      .getByRole('button', { name: 'Remove from agent', exact: true })
+      .click();
+    await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'PATCH' &&
+          new URL(response.url()).pathname === `/api/agents/${parent?.id}` &&
+          response.ok(),
+      ),
+      reopened.getByRole('button', { name: 'Save', exact: true }).click(),
+    ]);
+    saved = await fetchJson<AgentDetail>(page, `/api/agents/${parent.id}/expanded`, token);
+    expect(saved.subagents).toMatchObject({
+      enabled: false,
+      graphsEnabled: false,
+      graphs: [{ type: 'review_team' }],
+    });
+  } finally {
+    await cleanupAgent(page, parent?.id);
+    await cleanupAgent(page, child.id);
+  }
+});
diff --git a/librechat.example.yaml b/librechat.example.yaml
index 77759dd3949..e0c7cad02ac 100644
--- a/librechat.example.yaml
+++ b/librechat.example.yaml
@@ -792,7 +792,7 @@ endpoints:
   #   # (optional) Agent Capabilities available to all users. Omit the ones you wish to exclude. Defaults to list below.
   #   # web_search controls only LibreChat's external pipeline, not provider-native search.
   #   # Both require WEB_SEARCH.USE, seeded by interface.webSearch. See UPGRADING.md.
-  #   capabilities: ["deferred_tools", "execute_code", "file_search", "web_search", "artifacts", "subagents", "actions", "context", "skills", "memory", "ask_user_question", "tools", "ocr"]
+  #   capabilities: ["deferred_tools", "execute_code", "file_search", "web_search", "artifacts", "subagents", "subagent_graphs", "actions", "context", "skills", "memory", "ask_user_question", "tools", "ocr"]
   #   # The following capabilities are opt-in and must be added explicitly:
   #   # "programmatic_tools", "stateful_code_sessions", "run_in_background", "tool_intents"
   #   # "stateful_code_sessions" is highly experimental and may change substantially.
diff --git a/packages/api/src/agents/__tests__/run-summarization.test.ts b/packages/api/src/agents/__tests__/run-summarization.test.ts
index 6cc6a8c7f0c..f97ffa22134 100644
--- a/packages/api/src/agents/__tests__/run-summarization.test.ts
+++ b/packages/api/src/agents/__tests__/run-summarization.test.ts
@@ -3017,6 +3017,37 @@ describe('subagentConfigs', () => {
     expect(memberInput.toolDefinitions).toEqual([{ name: 'tool_search' }]);
   });
 
+  it('advertises graph teams without enabling ordinary self-spawn or explicit agents', async () => {
+    const member = makeAgent({ id: 'graph_only_member' });
+    const definition = {
+      type: 'graph_only',
+      name: 'Graph only',
+      description: 'Delegate a team',
+      agent_ids: [member.id],
+      edges: [],
+      entry_agent_id: member.id,
+      result_agent_id: member.id,
+    };
+    const agents = await callAndCapture({
+      agents: [
+        makeAgent({
+          id: 'parent',
+          subagents: {
+            enabled: false,
+            graphsEnabled: true,
+            allowSelf: true,
+            agent_ids: ['unused'],
+            graphs: [definition],
+          },
+          subagentGraphConfigs: [{ definition, memberConfigs: [member] }],
+        }),
+      ],
+    });
+    expect(agents[0].subagentConfigs).toHaveLength(1);
+    const configs = agents[0].subagentConfigs as Array<Record<string, unknown>>;
+    expect(configs[0]).toMatchObject({ kind: 'graph', type: 'graph_only' });
+  });
+
   it('builds lazy graph inputs from initialized members instead of capability metadata', async () => {
     const childId = 'agent_lazy_capability_parent';
     const memberId = 'agent_lazy_capability_member';
diff --git a/packages/api/src/agents/discovery.ts b/packages/api/src/agents/discovery.ts
index 18b9cb4f775..30dafd1ce5e 100644
--- a/packages/api/src/agents/discovery.ts
+++ b/packages/api/src/agents/discovery.ts
@@ -1,6 +1,7 @@
 import { logger } from '@librechat/data-schemas';
 import {
   ResourceType,
+  resolveSubagents,
   PermissionBits,
   EModelEndpoint,
   MAX_SUBAGENT_GRAPH_NODES,
@@ -315,9 +316,10 @@ export async function resolveSubagentGraphs(
 
   for (const rootConfig of params.rootConfigs) {
     const resolvedGraphs: NonNullable<GraphSubagentHostConfig['subagentGraphConfigs']> = [];
-    for (const definition of rootConfig.subagents?.enabled === true
-      ? (rootConfig.subagents.graphs ?? [])
-      : []) {
+    for (const definition of resolveSubagents(
+      rootConfig.subagents,
+      params.req.config?.endpoints?.agents?.capabilities,
+    )?.graphs ?? []) {
       const memberIds = [...new Set(definition.agent_ids)];
       const newMemberIds = memberIds.filter(
         (memberId) => !configById.has(memberId) && !attemptedGraphMemberIds.has(memberId),
diff --git a/packages/api/src/agents/files/session.ts b/packages/api/src/agents/files/session.ts
index b3657b7ba03..4b2ae937631 100644
--- a/packages/api/src/agents/files/session.ts
+++ b/packages/api/src/agents/files/session.ts
@@ -1,5 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { HumanMessage } from '@librechat/agents/langchain';
+import { isSubagentGraphsEnabled, resolveSubagents } from 'librechat-data-provider';
 import type { Agent, RunFileProvenance, TFile, TAgentsEndpoint } from 'librechat-data-provider';
 import type { SubagentExecutionContext } from '@librechat/agents';
 import type { BaseMessage } from '@librechat/agents/langchain';
@@ -33,8 +34,8 @@ export function getAuthorizedRunFileSnapshot({
   files: readonly TFile[];
 }): readonly TFile[] | undefined {
   return policy?.enabled === true &&
-    agent.subagents?.enabled === true &&
-    agent.subagents.shareFiles === true
+    (agent.subagents?.enabled === true || isSubagentGraphsEnabled(agent.subagents)) &&
+    agent.subagents?.shareFiles === true
     ? files
     : undefined;
 }
@@ -173,10 +174,11 @@ export function createRunFileSession(deps: RunFileSessionDeps): RunFileSession {
     const allowed = new Set<string>();
     for (const id of agentIds) {
       const agent = deps.getAgent(id);
-      if (!agent?.subagents?.enabled) continue;
-      if (agent.subagents.allowSelf !== false) allowed.add(id);
-      for (const childId of agent.subagents.agent_ids ?? []) allowed.add(childId);
-      for (const graph of agent.subagents.graphs ?? []) {
+      const subagents = resolveSubagents(agent?.subagents);
+      if (!subagents?.enabled) continue;
+      if (subagents.allowSelf !== false) allowed.add(id);
+      for (const childId of subagents.agent_ids ?? []) allowed.add(childId);
+      for (const graph of subagents.graphs ?? []) {
         for (const member of graph.agent_ids) allowed.add(member);
       }
     }
@@ -190,10 +192,11 @@ export function createRunFileSession(deps: RunFileSessionDeps): RunFileSession {
     signal?: AbortSignal,
   ): boolean {
     const root = deps.getAgent(agentIds[0]);
+    const rootSubagents = resolveSubagents(root?.subagents);
     if (
       deps.policy?.enabled !== true ||
-      root?.subagents?.enabled !== true ||
-      root.subagents.shareFiles !== true
+      rootSubagents?.enabled !== true ||
+      rootSubagents.shareFiles !== true
     )
       return false;
     if (scope != null) {
diff --git a/packages/api/src/agents/initialize.ts b/packages/api/src/agents/initialize.ts
index 9d648632b44..36d8096aea6 100644
--- a/packages/api/src/agents/initialize.ts
+++ b/packages/api/src/agents/initialize.ts
@@ -2,6 +2,7 @@ import { Providers } from '@librechat/agents';
 import { logger } from '@librechat/data-schemas';
 import {
   Tools,
+  resolveSubagents,
   Constants,
   ErrorTypes,
   EModelEndpoint,
@@ -2794,6 +2795,7 @@ export async function initializeAgent(
 
   const initializedAgent: InitializedAgent = {
     ...agent,
+    subagents: resolveSubagents(agent.subagents, appConfig?.endpoints?.agents?.capabilities ?? []),
     azureOptions: options.azureOptions,
     resendFiles,
     imageDetail,
diff --git a/packages/api/src/agents/run.ts b/packages/api/src/agents/run.ts
index 054c3e39ce1..166b74b47c1 100644
--- a/packages/api/src/agents/run.ts
+++ b/packages/api/src/agents/run.ts
@@ -1,5 +1,6 @@
 import { randomUUID } from 'crypto';
 import { logger } from '@librechat/data-schemas';
+import { resolveSubagents } from 'librechat-data-provider';
 import { ensureHandler } from '@langchain/core/callbacks/manager';
 import { Run, Providers, Constants, HookRegistry } from '@librechat/agents';
 import {
@@ -1892,6 +1893,7 @@ function buildSubagentConfigs(
   detachedTasksEnabled = false,
   onResolvedAgent?: (agent: RunAgent) => void,
 ): SubagentConfigEntry[] {
+  agent = { ...agent, subagents: resolveSubagents(agent.subagents, agentsEConfig?.capabilities) };
   if (!agent.subagents?.enabled) {
     return [];
   }
@@ -2024,7 +2026,9 @@ function buildSubagentConfigs(
     );
   }
 
-  for (const { definition, memberConfigs } of agent.subagentGraphConfigs ?? []) {
+  for (const { definition, memberConfigs } of agent.subagents.graphsEnabled !== false
+    ? (agent.subagentGraphConfigs ?? [])
+    : []) {
     if (memberConfigs.length === 0) {
       continue;
     }
@@ -2298,6 +2302,10 @@ export async function createRun({
   RunConfig,
   'tokenCounter' | 'customHandlers' | 'indexTokenCountMap' | 'initialSessions'
 >): Promise<Run<IState>> {
+  agents = agents.map((agent) => ({
+    ...agent,
+    subagents: resolveSubagents(agent.subagents, appConfig?.endpoints?.agents?.capabilities),
+  }));
   const resolvedRunId = runId ?? randomUUID();
   const runFilesActive =
     runFiles?.activate(
diff --git a/packages/api/src/agents/validation.ts b/packages/api/src/agents/validation.ts
index cde6c1fb987..278e5eb0bdc 100644
--- a/packages/api/src/agents/validation.ts
+++ b/packages/api/src/agents/validation.ts
@@ -11,7 +11,7 @@ import {
   ViolationTypes,
   ErrorTypes,
   MAX_SUBAGENT_GRAPH_NODES,
-  MAX_GRAPH_SUBAGENT_MEMBERS,
+  graphSubagentSchema,
 } from 'librechat-data-provider';
 import type {
   Agent,
@@ -185,165 +185,10 @@ export const agentToolOptionsSchema: z.ZodOptional<
  * loading). The UI enforces the same cap, so legitimate payloads never hit
  * the bound.
  */
-const graphSubagentEdgeSchema = z
-  .object({
-    from: z.union([z.string(), z.array(z.string()).min(1)]),
-    to: z.union([z.string(), z.array(z.string()).min(1)]),
-    description: z.string().optional(),
-    edgeType: z.literal('direct'),
-    prompt: z.string().optional(),
-    excludeResults: z.boolean().optional(),
-  })
-  .strict();
-
-function validateGraphSubagentTopology(graph: {
-  type: string;
-  agent_ids: string[];
-  edges: Array<{
-    from: string | string[];
-    to: string | string[];
-    prompt?: string;
-    excludeResults?: boolean;
-  }>;
-  entry_agent_id: string;
-  result_agent_id: string;
-}): string | undefined {
-  const memberIds = new Set(graph.agent_ids);
-  if (memberIds.size !== graph.agent_ids.length) {
-    return `Graph subagent "${graph.type}" contains duplicate member IDs.`;
-  }
-  const reservedMemberIds = new Set([
-    '__start__',
-    '__end__',
-    'messages',
-    'agentMessages',
-    'subagentResult',
-  ]);
-  const invalidMemberId = graph.agent_ids.find(
-    (agentId) => reservedMemberIds.has(agentId) || agentId.includes('|') || agentId.includes(':'),
-  );
-  if (invalidMemberId) {
-    return `Graph subagent "${graph.type}" member "${invalidMemberId}" is reserved by the graph runtime.`;
-  }
-  if (!memberIds.has(graph.entry_agent_id) || !memberIds.has(graph.result_agent_id)) {
-    return `Graph subagent "${graph.type}" entry and result must reference configured members.`;
-  }
-  const adjacency = new Map(graph.agent_ids.map((agentId) => [agentId, new Set<string>()]));
-  const reverse = new Map(graph.agent_ids.map((agentId) => [agentId, new Set<string>()]));
-  const incomingGroups = new Map<string, string[][]>();
-  const directedEdges = new Set<string>();
-  for (const edge of graph.edges) {
-    const sources = Array.isArray(edge.from) ? edge.from : [edge.from];
-    const destinations = Array.isArray(edge.to) ? edge.to : [edge.to];
-    if (
-      new Set(sources).size !== sources.length ||
-      new Set(destinations).size !== destinations.length
-    ) {
-      return `Graph subagent "${graph.type}" edge endpoints must be unique.`;
-    }
-    if (edge.excludeResults === true && !edge.prompt) {
-      return `Graph subagent "${graph.type}" cannot exclude results without an edge prompt.`;
-    }
-    if (edge.prompt && destinations.length !== 1) {
-      return `Graph subagent "${graph.type}" prompted edges must have one destination.`;
-    }
-    for (const agentId of [...sources, ...destinations]) {
-      if (!memberIds.has(agentId)) {
-        return `Graph subagent "${graph.type}" references unknown member "${agentId}".`;
-      }
-    }
-    for (const destination of destinations) {
-      const groups = incomingGroups.get(destination) ?? [];
-      groups.push(sources);
-      incomingGroups.set(destination, groups);
-      for (const source of sources) {
-        if (source === destination) {
-          return `Graph subagent "${graph.type}" cannot contain self-edges.`;
-        }
-        const edgeKey = `${source}\0${destination}`;
-        if (directedEdges.has(edgeKey)) {
-          return `Graph subagent "${graph.type}" contains duplicate edges.`;
-        }
-        directedEdges.add(edgeKey);
-        adjacency.get(source)?.add(destination);
-        reverse.get(destination)?.add(source);
-      }
-    }
-  }
-  for (const [destination, groups] of incomingGroups) {
-    const sources = reverse.get(destination);
-    if (sources && sources.size > 1 && (groups.length !== 1 || groups[0].length !== sources.size)) {
-      return `Graph subagent "${graph.type}" fan-in to "${destination}" must use one array-valued source edge.`;
-    }
-  }
-  const roots = graph.agent_ids.filter((agentId) => reverse.get(agentId)?.size === 0);
-  const sinks = graph.agent_ids.filter((agentId) => adjacency.get(agentId)?.size === 0);
-  if (roots.length !== 1 || roots[0] !== graph.entry_agent_id) {
-    return `Graph subagent "${graph.type}" must use entry_agent_id as its only root.`;
-  }
-  if (sinks.length !== 1 || sinks[0] !== graph.result_agent_id) {
-    return `Graph subagent "${graph.type}" must use result_agent_id as its only sink.`;
-  }
-  const remainingIncoming = new Map(
-    graph.agent_ids.map((agentId) => [agentId, reverse.get(agentId)?.size ?? 0]),
-  );
-  const ready = roots.slice();
-  let visitedCount = 0;
-  while (ready.length > 0) {
-    const source = ready.pop();
-    if (source === undefined) {
-      continue;
-    }
-    visitedCount++;
-    for (const destination of adjacency.get(source) ?? []) {
-      const count = (remainingIncoming.get(destination) ?? 0) - 1;
-      remainingIncoming.set(destination, count);
-      if (count === 0) {
-        ready.push(destination);
-      }
-    }
-  }
-  if (visitedCount !== memberIds.size) {
-    return `Graph subagent "${graph.type}" must be acyclic and fully connected.`;
-  }
-  const isSimpleChain = graph.agent_ids.every(
-    (agentId) => (adjacency.get(agentId)?.size ?? 0) <= 1 && (reverse.get(agentId)?.size ?? 0) <= 1,
-  );
-  if (
-    !isSimpleChain &&
-    graph.edges.some(
-      (edge) =>
-        edge.prompt && (Array.isArray(edge.to) ? edge.to[0] : edge.to) !== graph.result_agent_id,
-    )
-  ) {
-    return `Graph subagent "${graph.type}" prompts in a branched graph must target result_agent_id.`;
-  }
-  return undefined;
-}
-
-const graphSubagentSchema = z
-  .object({
-    type: z.string().trim().min(1),
-    name: z.string().trim().min(1),
-    description: z.string().trim().min(1),
-    agent_ids: z.array(z.string()).min(1).max(MAX_GRAPH_SUBAGENT_MEMBERS),
-    edges: z.array(graphSubagentEdgeSchema),
-    entry_agent_id: z.string(),
-    result_agent_id: z.string(),
-  })
-  .superRefine((graph, ctx) => {
-    const error = validateGraphSubagentTopology(graph);
-    if (error) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: error,
-      });
-    }
-  });
-
 export const agentSubagentsSchema: z.ZodOptional<z.ZodType<AgentSubagentsConfig>> = z
   .object({
     enabled: z.boolean().optional(),
+    graphsEnabled: z.boolean().optional(),
     allowSelf: z.boolean().optional(),
     shareFiles: z.boolean().optional(),
     agent_ids: z.array(z.string()).optional(),
diff --git a/packages/api/src/code/inheritance.ts b/packages/api/src/code/inheritance.ts
index 5ebac6af53a..63ceeb16366 100644
--- a/packages/api/src/code/inheritance.ts
+++ b/packages/api/src/code/inheritance.ts
@@ -1,5 +1,6 @@
 import {
   Tools,
+  isSubagentGraphsEnabled,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_GRAPH_NODES,
   stripAgentIdSuffix,
@@ -13,7 +14,10 @@ import {
   resolveAgentCodeEnvironmentRouting,
 } from '~/agents/execution';
 
-type SpawnConfig = Pick<NonNullable<Agent['subagents']>, 'enabled' | 'agent_ids'> & {
+type SpawnConfig = Pick<
+  NonNullable<Agent['subagents']>,
+  'enabled' | 'graphsEnabled' | 'agent_ids'
+> & {
   graphs?: ReadonlyArray<
     Pick<NonNullable<NonNullable<Agent['subagents']>['graphs']>[number], 'agent_ids'>
   >;
@@ -41,12 +45,14 @@ export function getSpawnableSubagentIds(
   agent: Pick<SubagentCodeRoutingAgent, 'id' | 'subagents'>,
 ): string[] {
   const subagents = agent.subagents;
-  if (subagents?.enabled !== true) {
+  if (!subagents || (subagents.enabled !== true && !isSubagentGraphsEnabled(subagents))) {
     return [];
   }
   const ids = [
-    ...(Array.isArray(subagents.agent_ids) ? subagents.agent_ids : []),
-    ...(subagents.graphs ?? []).flatMap((graph) =>
+    ...(subagents.enabled === true && Array.isArray(subagents.agent_ids)
+      ? subagents.agent_ids
+      : []),
+    ...(isSubagentGraphsEnabled(subagents) ? (subagents.graphs ?? []) : []).flatMap((graph) =>
       Array.isArray(graph?.agent_ids) ? graph.agent_ids : [],
     ),
   ];
diff --git a/packages/api/src/schedules/requirements.ts b/packages/api/src/schedules/requirements.ts
index 9cc71570faa..824a4581701 100644
--- a/packages/api/src/schedules/requirements.ts
+++ b/packages/api/src/schedules/requirements.ts
@@ -1,5 +1,6 @@
 import {
-  AgentCapabilities,
+  resolveSubagents,
+  hasSubagentCapability,
   EModelEndpoint,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_GRAPH_NODES,
@@ -60,6 +61,8 @@ export async function resolveScheduledMCPRequirements(
   };
   let accessContext: AgentGraphAccessContext | undefined;
   let modelsConfig: TModelsConfig | undefined;
+  let configPromise: Promise<AppConfig | undefined> | undefined;
+  const getConfig = (): Promise<AppConfig | undefined> => (configPromise ??= loadAppConfig());
 
   const loadNodes = async (ids: string[]): Promise<void> => {
     const frontier = [...new Set(ids)].filter(
@@ -91,7 +94,11 @@ export async function resolveScheduledMCPRequirements(
     if (descendants.length > 0) {
       modelsConfig ??= await deps.getModelsConfig(user);
     }
-    for (const agent of loaded) {
+    const capabilities = loaded.some((agent) => agent.subagents != null)
+      ? ((await getConfig())?.endpoints?.agents?.capabilities ?? [])
+      : [];
+    for (const stored of loaded) {
+      const agent = { ...stored, subagents: resolveSubagents(stored.subagents, capabilities) };
       viewableById.set(agent.id, agent);
       const availableModels =
         agent.id === agentId
@@ -167,9 +174,9 @@ export async function resolveScheduledMCPRequirements(
   let subagentsAvailable: boolean | undefined;
   const canUseSubagents = async (): Promise<boolean> => {
     if (subagentsAvailable != null) return subagentsAvailable;
-    const config = await loadAppConfig();
-    subagentsAvailable = (config?.endpoints?.[EModelEndpoint.agents]?.capabilities ?? []).includes(
-      AgentCapabilities.subagents,
+    const config = await getConfig();
+    subagentsAvailable = hasSubagentCapability(
+      config?.endpoints?.[EModelEndpoint.agents]?.capabilities ?? [],
     );
     return subagentsAvailable;
   };
diff --git a/packages/data-provider/src/config.ts b/packages/data-provider/src/config.ts
index 9f71c79ba1a..6365af65838 100644
--- a/packages/data-provider/src/config.ts
+++ b/packages/data-provider/src/config.ts
@@ -704,6 +704,7 @@ export enum AgentCapabilities {
   web_search = 'web_search',
   artifacts = 'artifacts',
   subagents = 'subagents',
+  subagent_graphs = 'subagent_graphs',
   actions = 'actions',
   context = 'context',
   skills = 'skills',
@@ -883,6 +884,7 @@ export const defaultAgentCapabilities = [
   AgentCapabilities.web_search,
   AgentCapabilities.artifacts,
   AgentCapabilities.subagents,
+  AgentCapabilities.subagent_graphs,
   AgentCapabilities.actions,
   AgentCapabilities.context,
   AgentCapabilities.skills,
diff --git a/packages/data-provider/src/index.ts b/packages/data-provider/src/index.ts
index df59360348e..8b5d283f961 100644
--- a/packages/data-provider/src/index.ts
+++ b/packages/data-provider/src/index.ts
@@ -105,3 +105,5 @@ export * from './code/workspace';
 export * from './types/scheduleConsent';
 
 export * from './approval';
+
+export * from './subagentGraphs';
diff --git a/packages/data-provider/src/subagentGraphs.spec.ts b/packages/data-provider/src/subagentGraphs.spec.ts
new file mode 100644
index 00000000000..3ac9f49a594
--- /dev/null
+++ b/packages/data-provider/src/subagentGraphs.spec.ts
@@ -0,0 +1,84 @@
+import type { AgentSubagentGraph, AgentSubagentsConfig } from './types/agents';
+import { graphSubagentSchema, isSubagentGraphsEnabled, resolveSubagents } from './subagentGraphs';
+import { AgentCapabilities } from './config';
+
+const graph: AgentSubagentGraph = {
+  type: 'review',
+  name: 'Review team',
+  description: 'Review work',
+  agent_ids: ['entry', 'left', 'right', 'result'],
+  entry_agent_id: 'entry',
+  result_agent_id: 'result',
+  edges: [
+    { from: 'entry', to: ['left', 'right'], edgeType: 'direct' },
+    { from: ['left', 'right'], to: 'result', edgeType: 'direct' },
+  ],
+};
+
+test('accepts bounded parallel teams and rejects cycles and split fan-in', () => {
+  expect(graphSubagentSchema.safeParse(graph).success).toBe(true);
+  expect(
+    graphSubagentSchema.safeParse({
+      ...graph,
+      edges: [...graph.edges, { from: 'result', to: 'entry', edgeType: 'direct' }],
+    }).success,
+  ).toBe(false);
+  expect(
+    graphSubagentSchema.safeParse({
+      ...graph,
+      edges: [
+        graph.edges[0],
+        { from: 'left', to: 'result', edgeType: 'direct' },
+        { from: 'right', to: 'result', edgeType: 'direct' },
+      ],
+    }).success,
+  ).toBe(false);
+});
+
+test('graph capability can run a team without self-spawn or single-agent targets', () => {
+  const config: AgentSubagentsConfig = {
+    enabled: false,
+    graphsEnabled: true,
+    allowSelf: true,
+    agent_ids: ['child'],
+    graphs: [graph],
+  };
+  const resolved = resolveSubagents(config, [AgentCapabilities.subagent_graphs]);
+  expect(resolved).toMatchObject({
+    enabled: true,
+    allowSelf: false,
+    agent_ids: [],
+    graphsEnabled: true,
+    graphs: [graph],
+  });
+  expect(config.enabled).toBe(false);
+});
+
+test('the graph capability cannot enable ordinary subagents or bypass a disabled graph gate', () => {
+  expect(
+    resolveSubagents(
+      { enabled: true, graphsEnabled: true, graphs: [graph], agent_ids: ['child'] },
+      [AgentCapabilities.subagents],
+    ),
+  ).toMatchObject({ enabled: true, agent_ids: ['child'], graphsEnabled: false, graphs: [] });
+  expect(
+    resolveSubagents({ enabled: false, graphsEnabled: true, graphs: [graph] }, []),
+  ).toMatchObject({ enabled: false, graphsEnabled: false, graphs: [] });
+});
+
+test('legacy stored teams keep their old subagents capability until an explicit graph choice', () => {
+  const config = { enabled: true, graphs: [graph] };
+  expect(isSubagentGraphsEnabled(config)).toBe(true);
+  expect(resolveSubagents(config, [AgentCapabilities.subagents])?.graphs).toEqual([graph]);
+  expect(
+    resolveSubagents(resolveSubagents(config, [AgentCapabilities.subagents]), [
+      AgentCapabilities.subagents,
+    ])?.graphs,
+  ).toEqual([graph]);
+  expect(
+    resolveSubagents({ ...config, graphsEnabled: false }, [AgentCapabilities.subagents])?.graphs,
+  ).toEqual([]);
+  expect(
+    resolveSubagents({ ...config, graphsEnabled: true }, [AgentCapabilities.subagents])?.graphs,
+  ).toEqual([]);
+});
diff --git a/packages/data-provider/src/subagentGraphs.ts b/packages/data-provider/src/subagentGraphs.ts
new file mode 100644
index 00000000000..297ae2c367c
--- /dev/null
+++ b/packages/data-provider/src/subagentGraphs.ts
@@ -0,0 +1,199 @@
+import { z } from 'zod';
+import type { AgentSubagentGraph, AgentSubagentsConfig } from './types/agents';
+import { MAX_GRAPH_SUBAGENT_MEMBERS } from './limits';
+import { AgentCapabilities } from './config';
+
+const graphSubagentEdgeSchema = z
+  .object({
+    from: z.union([z.string(), z.array(z.string()).min(1)]),
+    to: z.union([z.string(), z.array(z.string()).min(1)]),
+    description: z.string().optional(),
+    edgeType: z.literal('direct'),
+    prompt: z.string().optional(),
+    excludeResults: z.boolean().optional(),
+  })
+  .strict();
+
+function validateGraphSubagentTopology(graph: {
+  type: string;
+  agent_ids: string[];
+  edges: Array<{
+    from: string | string[];
+    to: string | string[];
+    prompt?: string;
+    excludeResults?: boolean;
+  }>;
+  entry_agent_id: string;
+  result_agent_id: string;
+}): string | undefined {
+  const memberIds = new Set(graph.agent_ids);
+  if (memberIds.size !== graph.agent_ids.length) {
+    return `Graph subagent "${graph.type}" contains duplicate member IDs.`;
+  }
+  const reservedMemberIds = new Set([
+    '__start__',
+    '__end__',
+    'messages',
+    'agentMessages',
+    'subagentResult',
+  ]);
+  const invalidMemberId = graph.agent_ids.find(
+    (agentId) => reservedMemberIds.has(agentId) || agentId.includes('|') || agentId.includes(':'),
+  );
+  if (invalidMemberId) {
+    return `Graph subagent "${graph.type}" member "${invalidMemberId}" is reserved by the graph runtime.`;
+  }
+  if (!memberIds.has(graph.entry_agent_id) || !memberIds.has(graph.result_agent_id)) {
+    return `Graph subagent "${graph.type}" entry and result must reference configured members.`;
+  }
+  const adjacency = new Map(graph.agent_ids.map((agentId) => [agentId, new Set<string>()]));
+  const reverse = new Map(graph.agent_ids.map((agentId) => [agentId, new Set<string>()]));
+  const incomingGroups = new Map<string, string[][]>();
+  const directedEdges = new Set<string>();
+  for (const edge of graph.edges) {
+    const sources = Array.isArray(edge.from) ? edge.from : [edge.from];
+    const destinations = Array.isArray(edge.to) ? edge.to : [edge.to];
+    if (
+      new Set(sources).size !== sources.length ||
+      new Set(destinations).size !== destinations.length
+    ) {
+      return `Graph subagent "${graph.type}" edge endpoints must be unique.`;
+    }
+    if (edge.excludeResults === true && !edge.prompt) {
+      return `Graph subagent "${graph.type}" cannot exclude results without an edge prompt.`;
+    }
+    if (edge.prompt && destinations.length !== 1) {
+      return `Graph subagent "${graph.type}" prompted edges must have one destination.`;
+    }
+    for (const agentId of [...sources, ...destinations]) {
+      if (!memberIds.has(agentId)) {
+        return `Graph subagent "${graph.type}" references unknown member "${agentId}".`;
+      }
+    }
+    for (const destination of destinations) {
+      const groups = incomingGroups.get(destination) ?? [];
+      groups.push(sources);
+      incomingGroups.set(destination, groups);
+      for (const source of sources) {
+        if (source === destination) {
+          return `Graph subagent "${graph.type}" cannot contain self-edges.`;
+        }
+        const edgeKey = `${source}\0${destination}`;
+        if (directedEdges.has(edgeKey)) {
+          return `Graph subagent "${graph.type}" contains duplicate edges.`;
+        }
+        directedEdges.add(edgeKey);
+        adjacency.get(source)?.add(destination);
+        reverse.get(destination)?.add(source);
+      }
+    }
+  }
+  for (const [destination, groups] of Array.from(incomingGroups)) {
+    const sources = reverse.get(destination);
+    if (sources && sources.size > 1 && (groups.length !== 1 || groups[0].length !== sources.size)) {
+      return `Graph subagent "${graph.type}" fan-in to "${destination}" must use one array-valued source edge.`;
+    }
+  }
+  const roots = graph.agent_ids.filter((agentId) => reverse.get(agentId)?.size === 0);
+  const sinks = graph.agent_ids.filter((agentId) => adjacency.get(agentId)?.size === 0);
+  if (roots.length !== 1 || roots[0] !== graph.entry_agent_id) {
+    return `Graph subagent "${graph.type}" must use entry_agent_id as its only root.`;
+  }
+  if (sinks.length !== 1 || sinks[0] !== graph.result_agent_id) {
+    return `Graph subagent "${graph.type}" must use result_agent_id as its only sink.`;
+  }
+  const remainingIncoming = new Map(
+    graph.agent_ids.map((agentId) => [agentId, reverse.get(agentId)?.size ?? 0]),
+  );
+  const ready = roots.slice();
+  let visitedCount = 0;
+  while (ready.length > 0) {
+    const source = ready.pop();
+    if (source === undefined) {
+      continue;
+    }
+    visitedCount++;
+    for (const destination of Array.from(adjacency.get(source) ?? [])) {
+      const count = (remainingIncoming.get(destination) ?? 0) - 1;
+      remainingIncoming.set(destination, count);
+      if (count === 0) {
+        ready.push(destination);
+      }
+    }
+  }
+  if (visitedCount !== memberIds.size) {
+    return `Graph subagent "${graph.type}" must be acyclic and fully connected.`;
+  }
+  const isSimpleChain = graph.agent_ids.every(
+    (agentId) => (adjacency.get(agentId)?.size ?? 0) <= 1 && (reverse.get(agentId)?.size ?? 0) <= 1,
+  );
+  if (
+    !isSimpleChain &&
+    graph.edges.some(
+      (edge) =>
+        edge.prompt && (Array.isArray(edge.to) ? edge.to[0] : edge.to) !== graph.result_agent_id,
+    )
+  ) {
+    return `Graph subagent "${graph.type}" prompts in a branched graph must target result_agent_id.`;
+  }
+  return undefined;
+}
+
+export const graphSubagentSchema: z.ZodType<AgentSubagentGraph> = z
+  .object({
+    type: z.string().trim().min(1),
+    name: z.string().trim().min(1),
+    description: z.string().trim().min(1),
+    agent_ids: z.array(z.string()).min(1).max(MAX_GRAPH_SUBAGENT_MEMBERS),
+    edges: z.array(graphSubagentEdgeSchema),
+    entry_agent_id: z.string(),
+    result_agent_id: z.string(),
+  })
+  .superRefine((graph, ctx) => {
+    const error = validateGraphSubagentTopology(graph);
+    if (error) {
+      ctx.addIssue({
+        code: z.ZodIssueCode.custom,
+        message: error,
+      });
+    }
+  });
+
+/** Legacy teams followed the single-agent flag until a graph-specific choice was saved. */
+export function isSubagentGraphsEnabled(
+  config?: Pick<AgentSubagentsConfig, 'enabled' | 'graphsEnabled'> | null,
+): boolean {
+  return config?.graphsEnabled ?? config?.enabled === true;
+}
+
+/** Runtime projection only. Persisted settings and the two user choices remain untouched. */
+export function resolveSubagents(
+  config?: AgentSubagentsConfig,
+  capabilities?: readonly string[],
+): AgentSubagentsConfig | undefined {
+  if (!config) return undefined;
+  const singles =
+    config.enabled === true &&
+    (capabilities == null || capabilities.includes(AgentCapabilities.subagents));
+  const graphs =
+    isSubagentGraphsEnabled(config) &&
+    (capabilities == null ||
+      capabilities.includes(AgentCapabilities.subagent_graphs) ||
+      (config.graphsEnabled == null && capabilities.includes(AgentCapabilities.subagents)));
+  if (config.graphsEnabled == null && singles && graphs) return config;
+  return {
+    ...config,
+    enabled: singles || graphs,
+    allowSelf: singles && config.allowSelf !== false,
+    agent_ids: singles ? config.agent_ids : [],
+    graphsEnabled: graphs,
+    graphs: graphs ? config.graphs : [],
+  };
+}
+
+export function hasSubagentCapability(capabilities: readonly string[]): boolean {
+  return (
+    capabilities.includes(AgentCapabilities.subagents) ||
+    capabilities.includes(AgentCapabilities.subagent_graphs)
+  );
+}
diff --git a/packages/data-provider/src/types/agents.ts b/packages/data-provider/src/types/agents.ts
index 6b6ecf69c6a..630c6fd396d 100644
--- a/packages/data-provider/src/types/agents.ts
+++ b/packages/data-provider/src/types/agents.ts
@@ -993,6 +993,8 @@ export type AgentSubagentGraph = {
 
 export type AgentSubagentsConfig = {
   enabled?: boolean;
+  /** Enables saved graph teams independently. Omitted legacy records follow enabled. */
+  graphsEnabled?: boolean;
   /** When true (default), the agent may spawn itself in an isolated context. */
   allowSelf?: boolean;
   /** Share current-turn files with authorized descendants. Off unless explicitly enabled. */

From 874807d72cfe4fc7d150a04ac84b5c0c9863afaa Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 03:28:27 +0000
Subject: [PATCH 02/12] fix: preserve graph metadata and legacy capability
 choices

---
 .../Agents/Advanced/AgentSubagents.tsx        |  3 +-
 .../__tests__/AgentSubagents.spec.tsx         | 36 ++++++++++++++++++-
 .../items/__tests__/orchestration.spec.ts     | 34 ++++++++++++++++--
 .../Agents/Tools/items/orchestration.ts       |  4 ---
 .../__tests__/useCodeApprovalMode.test.ts     | 25 +++++++++++++
 packages/api/openapi/agents.openapi.json      |  6 ++++
 .../src/agents/__tests__/initialize.test.ts   | 12 +++++--
 .../data-schemas/src/methods/agent.spec.ts    |  7 ++--
 packages/data-schemas/src/methods/agent.ts    |  1 +
 9 files changed, 114 insertions(+), 14 deletions(-)

diff --git a/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx b/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx
index b23af7842b0..5dd95bd1cfd 100644
--- a/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/AgentSubagents.tsx
@@ -44,13 +44,12 @@ const AgentSubagents: React.FC<AgentSubagentsProps> = ({
        */
       field.onChange({
         ...value,
-        ...(graphCount > 0 && { graphsEnabled: isSubagentGraphsEnabled(value) }),
         enabled: next,
         allowSelf: value.allowSelf ?? true,
         agent_ids: value.agent_ids ?? [],
       });
     },
-    [field, value, graphCount],
+    [field, value],
   );
 
   const setAllowSelf = useCallback(
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/AgentSubagents.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/AgentSubagents.spec.tsx
index f64f41f39a9..98b9169f693 100644
--- a/client/src/components/SidePanel/Agents/Advanced/__tests__/AgentSubagents.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/AgentSubagents.spec.tsx
@@ -13,7 +13,23 @@ let mockGetValues: UseFormReturn<AgentForm>['getValues'] | undefined;
 const mockSubmit = jest.fn();
 
 jest.mock('@librechat/client', () => ({
-  Switch: () => null,
+  Switch: ({
+    checked,
+    onCheckedChange,
+    'aria-label': label,
+  }: {
+    checked: boolean;
+    onCheckedChange: (value: boolean) => void;
+    'aria-label': string;
+  }) => (
+    <button
+      type="button"
+      role="switch"
+      aria-label={label}
+      aria-checked={checked}
+      onClick={() => onCheckedChange(!checked)}
+    />
+  ),
 }));
 
 jest.mock('~/hooks', () => ({
@@ -176,4 +192,22 @@ describe('AgentSubagents', () => {
     fireEvent.click(sharing);
     expect(mockGetValues?.('subagents.shareFiles')).toBe(false);
   });
+  it('keeps legacy teams on their original capability through an enable-toggle round trip', () => {
+    const team = {
+      type: 'legacy',
+      name: 'Legacy',
+      description: 'Work',
+      agent_ids: ['child'],
+      entry_agent_id: 'child',
+      result_agent_id: 'child',
+      edges: [],
+    };
+    const initial = { enabled: true, allowSelf: false, agent_ids: [], graphs: [team] };
+    render(<Harness initialSubagents={initial} />);
+    const enable = screen.getByRole('switch', { name: 'com_ui_agent_subagents_enable' });
+    fireEvent.click(enable);
+    expect(mockGetValues?.('subagents')).toEqual({ ...initial, enabled: false });
+    fireEvent.click(enable);
+    expect(mockGetValues?.('subagents')).toEqual(initial);
+  });
 });
diff --git a/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts b/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts
index d7a16243f56..bdaf4d3cd66 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/__tests__/orchestration.spec.ts
@@ -1,3 +1,4 @@
+import { AgentCapabilities, resolveSubagents } from 'librechat-data-provider';
 import type { AgentSubagentsConfig, GraphEdge } from 'librechat-data-provider';
 import type { FormSelection } from '../selectors';
 import type { AgentItem } from '../types';
@@ -93,9 +94,9 @@ test('subagent toggles preserve their complete settings and restore the retained
     ],
   };
   const disabled = setSubagentsEnabled(subagents, false);
-  expect(disabled).toEqual({ ...subagents, enabled: false, graphsEnabled: true });
+  expect(disabled).toEqual({ ...subagents, enabled: false });
   expect(subagents.enabled).toBe(true);
-  expect(setSubagentsEnabled(disabled, true)).toEqual({ ...subagents, graphsEnabled: true });
+  expect(setSubagentsEnabled(disabled, true)).toEqual(subagents);
   expect(setSubagentsEnabled(undefined, true)).toEqual({
     enabled: true,
     allowSelf: true,
@@ -161,3 +162,32 @@ test('graph selection and removal use the graph flag independently of ordinary s
   expect(computeToggleAction(graphItem, { selected: true })).toEqual({ type: 'graphs-remove' });
   expect(computeToggleAction(graphItem, { selected: false })).toEqual({ type: 'configure' });
 });
+
+test('ordinary Subagents toggles do not migrate the capability gate of legacy teams', () => {
+  const team = {
+    type: 'legacy',
+    name: 'Legacy',
+    description: 'Work',
+    agent_ids: ['child'],
+    entry_agent_id: 'child',
+    result_agent_id: 'child',
+    edges: [],
+  };
+  const original = { enabled: true, allowSelf: false, agent_ids: [], graphs: [team] };
+  const disabled = setSubagentsEnabled(original, false);
+  const restored = setSubagentsEnabled(disabled, true);
+  expect(restored).toEqual(original);
+  expect(resolveSubagents(restored, [AgentCapabilities.subagents])?.graphs).toEqual([team]);
+  expect(restored.graphsEnabled).toBeUndefined();
+});
+
+test('ordinary Subagents toggles retain an explicit independent graph choice', () => {
+  const config = {
+    enabled: true,
+    allowSelf: false,
+    graphsEnabled: true,
+    agent_ids: [],
+    graphs: [],
+  };
+  expect(setSubagentsEnabled(config, false)).toEqual({ ...config, enabled: false });
+});
diff --git a/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts b/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts
index c3cca7dcb77..1849ab27b74 100644
--- a/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts
+++ b/client/src/components/SidePanel/Agents/Tools/items/orchestration.ts
@@ -1,4 +1,3 @@
-import { isSubagentGraphsEnabled } from 'librechat-data-provider';
 import type { AgentSubagentsConfig, GraphEdge } from 'librechat-data-provider';
 
 /** Match the SDK: untyped, unconditional one-to-many edges default to direct. */
@@ -17,9 +16,6 @@ export function setSubagentsEnabled(
 ): AgentSubagentsConfig {
   return {
     ...subagents,
-    ...((subagents?.graphs?.length ?? 0) > 0 && {
-      graphsEnabled: isSubagentGraphsEnabled(subagents),
-    }),
     enabled,
     allowSelf: subagents?.allowSelf ?? true,
     agent_ids: subagents?.agent_ids ?? [],
diff --git a/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts b/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts
index ee73eca9ccb..e86356ba518 100644
--- a/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts
+++ b/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts
@@ -304,6 +304,31 @@ describe('useCodeApprovalMode', () => {
     expect(result.current).toEqual({ available: false, modes: [], selected: 'ask' });
   });
 
+  test('graph-only teams remain reachable in public execution metadata', () => {
+    mockUseAgentToolPermissions.mockReturnValue({
+      agent: {
+        id: 'agent_1',
+        tools: [],
+        subagents: {
+          enabled: false,
+          graphsEnabled: true,
+          graphs: [{ agent_ids: ['graph-member'] }],
+        },
+      },
+    });
+    mockUseAgentsMapContext.mockReturnValue({
+      'graph-member': {
+        id: 'graph-member',
+        tools: ['execute_code'],
+        stateful_code_sessions: true,
+        code_environment_id: 'mac',
+      },
+    });
+    const { result } = renderHook(() => useCodeApprovalMode(conversation));
+    expect(result.current.available).toBe(true);
+    expect(result.current.modes).toEqual(['ask', 'acceptEdits']);
+  });
+
   test('includes attached subagents while preserving their mandatory asks', () => {
     const primary = {
       id: 'agent_1',
diff --git a/packages/api/openapi/agents.openapi.json b/packages/api/openapi/agents.openapi.json
index fb2b0e08e52..8d47df0f579 100644
--- a/packages/api/openapi/agents.openapi.json
+++ b/packages/api/openapi/agents.openapi.json
@@ -2294,6 +2294,9 @@
               "enabled": {
                 "type": "boolean"
               },
+              "graphsEnabled": {
+                "type": "boolean"
+              },
               "allowSelf": {
                 "type": "boolean"
               },
@@ -2754,6 +2757,9 @@
               "enabled": {
                 "type": "boolean"
               },
+              "graphsEnabled": {
+                "type": "boolean"
+              },
               "allowSelf": {
                 "type": "boolean"
               },
diff --git a/packages/api/src/agents/__tests__/initialize.test.ts b/packages/api/src/agents/__tests__/initialize.test.ts
index eb0042ebc87..f68b22f49d1 100644
--- a/packages/api/src/agents/__tests__/initialize.test.ts
+++ b/packages/api/src/agents/__tests__/initialize.test.ts
@@ -611,19 +611,25 @@ describe('initializeAgent: ChatProject context', () => {
     agent._id = 'mongo-graph-agent';
     agent.instructions = 'Graph Agent instructions.';
     agent.tools = [Tools.file_search];
-    req.config = projectRuntime().appConfig;
+    const runtime = projectRuntime();
+    runtime.appConfig.endpoints = {
+      ...runtime.appConfig.endpoints,
+      agents: { capabilities: [AgentCapabilities.file_search, AgentCapabilities.subagent_graphs] },
+    };
+    req.config = runtime.appConfig;
     req.chatProjectContext = projectContext;
     const getProjectFiles = jest.fn().mockResolvedValue([canonicalFile]);
     const projectDb = { ...db, getProjectFiles };
     const primaryConfig: GraphSubagentHostConfig = await initializeAgent(
       {
-        runtime: projectRuntime(),
+        runtime,
         agent: {
           ...agent,
           id: 'primary-agent',
           tools: [],
           subagents: {
-            enabled: true,
+            enabled: false,
+            graphsEnabled: true,
             graphs: [
               {
                 type: 'team',
diff --git a/packages/data-schemas/src/methods/agent.spec.ts b/packages/data-schemas/src/methods/agent.spec.ts
index 720562b32ec..8748c20bcfc 100644
--- a/packages/data-schemas/src/methods/agent.spec.ts
+++ b/packages/data-schemas/src/methods/agent.spec.ts
@@ -5507,7 +5507,8 @@ describe('Support Contact Field', () => {
         agent_ids: [agentA1.id],
         edges: [{ from: 'source', to: agentA1.id, prompt: 'Private routing prompt' }],
         subagents: {
-          enabled: true,
+          enabled: false,
+          graphsEnabled: true,
           agent_ids: [agentA1.id],
           graphs: [
             {
@@ -5529,6 +5530,7 @@ describe('Support Contact Field', () => {
       expect(defaultResult.data[0].tools).toBeUndefined();
       expect(defaultResult.data[0].code_workspace_id).toBeUndefined();
       expect(defaultResult.data[0].edges).toBeUndefined();
+      expect(defaultResult.data[0].subagents).toBeUndefined();
 
       const result = await getListAgentsByAccess({
         accessibleIds: [scopedAgent._id] as mongoose.Types.ObjectId[],
@@ -5544,7 +5546,8 @@ describe('Support Contact Field', () => {
         agent_ids: [agentA1.id],
         edges: [{ from: 'source', to: agentA1.id }],
         subagents: {
-          enabled: true,
+          enabled: false,
+          graphsEnabled: true,
           agent_ids: [agentA1.id],
           graphs: [{ agent_ids: [agentA1.id] }],
         },
diff --git a/packages/data-schemas/src/methods/agent.ts b/packages/data-schemas/src/methods/agent.ts
index 714f7c5339c..2637b83e7cf 100644
--- a/packages/data-schemas/src/methods/agent.ts
+++ b/packages/data-schemas/src/methods/agent.ts
@@ -2067,6 +2067,7 @@ export function createAgentMethods(
       projection['edges.from'] = 1;
       projection['edges.to'] = 1;
       projection['subagents.enabled'] = 1;
+      projection['subagents.graphsEnabled'] = 1;
       projection['subagents.agent_ids'] = 1;
       projection['subagents.graphs.agent_ids'] = 1;
     }

From 32a75ed0424e09722d6932ae38b28c32326c8d06 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 03:39:18 +0000
Subject: [PATCH 03/12] fix: apply subagent capabilities to composer graph
 traversal

---
 .../__tests__/useCodeApprovalMode.test.ts     |  73 +++++++++++-
 .../__tests__/useCodeWorkspace.test.tsx       | 108 +++++++++++++++++-
 .../src/hooks/Agents/useCodeApprovalMode.ts   |  42 ++++---
 client/src/hooks/Agents/useCodeWorkspace.ts   |  31 ++++-
 4 files changed, 227 insertions(+), 27 deletions(-)

diff --git a/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts b/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts
index e86356ba518..1b32d5532ca 100644
--- a/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts
+++ b/client/src/hooks/Agents/__tests__/useCodeApprovalMode.test.ts
@@ -1,8 +1,10 @@
 import { Provider } from 'jotai';
 import { renderHook } from '@testing-library/react';
 import { LocalStorageKeys } from 'librechat-data-provider';
-import type { TConversation } from 'librechat-data-provider';
-import useCodeApprovalMode from '../useCodeApprovalMode';
+import type { Agent, TConversation } from 'librechat-data-provider';
+import useCodeApprovalMode, {
+  resolveReachableCodeWorkspaceInheritance,
+} from '../useCodeApprovalMode';
 
 const mockUseGetAgentsConfig = jest.fn();
 const mockUseAgentToolPermissions = jest.fn();
@@ -39,6 +41,7 @@ describe('useCodeApprovalMode', () => {
     });
     mockUseGetAgentsConfig.mockReturnValue({
       agentsConfig: {
+        capabilities: ['subagents', 'subagent_graphs'],
         statefulCodeSessions: {
           approvalsEnabled: true,
           approvalModes: ['ask', 'acceptEdits'],
@@ -304,6 +307,72 @@ describe('useCodeApprovalMode', () => {
     expect(result.current).toEqual({ available: false, modes: [], selected: 'ask' });
   });
 
+  test('removing the graph capability removes graph-member approval requirements', () => {
+    mockUseAgentToolPermissions.mockReturnValue({
+      agent: {
+        id: 'agent_1',
+        tools: [],
+        subagents: {
+          enabled: false,
+          graphsEnabled: true,
+          graphs: [{ agent_ids: ['graph-member'] }],
+        },
+      },
+    });
+    mockUseAgentsMapContext.mockReturnValue({
+      'graph-member': {
+        id: 'graph-member',
+        tools: ['execute_code'],
+        stateful_code_sessions: true,
+        code_environment_id: 'mac',
+      },
+    });
+    const { result, rerender } = renderHook(() => useCodeApprovalMode(conversation));
+    expect(result.current.available).toBe(true);
+    mockUseGetAgentsConfig().agentsConfig.capabilities = ['subagents'];
+    rerender();
+    expect(result.current.available).toBe(false);
+    expect(result.current.modes).toEqual([]);
+  });
+
+  test.each([true, false])(
+    'workspace inheritance excludes a graph with capability enabled=%s',
+    (enabled) => {
+      const root = {
+        id: 'agent_1',
+        tools: ['execute_code'],
+        stateful_code_sessions: true,
+        code_environment_id: 'mac',
+        subagents: {
+          enabled: false,
+          graphsEnabled: true,
+          graphs: [{ agent_ids: ['graph-member'] }],
+        },
+      } as Agent;
+      const member = {
+        id: 'graph-member',
+        tools: ['execute_code'],
+        stateful_code_sessions: true,
+        code_environment_id: 'child-machine',
+        code_environment_ids: ['mac'],
+      } as Agent;
+      const inherited = resolveReachableCodeWorkspaceInheritance(
+        [root],
+        { 'graph-member': member },
+        [
+          { id: 'mac', name: 'Mac', type: 'attached' },
+          { id: 'child-machine', name: 'Child', type: 'attached' },
+        ],
+        true,
+        [{ environmentId: 'mac', workspaceId: 'project' }],
+        false,
+        enabled ? ['subagent_graphs'] : ['subagents'],
+      );
+      expect(inherited.has('graph-member')).toBe(enabled);
+      if (enabled) expect(inherited.get('graph-member')).toBe('mac');
+    },
+  );
+
   test('graph-only teams remain reachable in public execution metadata', () => {
     mockUseAgentToolPermissions.mockReturnValue({
       agent: {
diff --git a/client/src/hooks/Agents/__tests__/useCodeWorkspace.test.tsx b/client/src/hooks/Agents/__tests__/useCodeWorkspace.test.tsx
index 5c324ee3d23..605da841a06 100644
--- a/client/src/hooks/Agents/__tests__/useCodeWorkspace.test.tsx
+++ b/client/src/hooks/Agents/__tests__/useCodeWorkspace.test.tsx
@@ -106,6 +106,102 @@ describe('useCodeWorkspace', () => {
     },
   );
 
+  it('drops graph-only workspace requirements when the graph capability is removed', () => {
+    const config = mockAgentsConfig().agentsConfig;
+    config.capabilities = [...config.capabilities, 'subagent_graphs'];
+    config.statefulCodeSessions.environments.push({
+      id: 'graph-vm',
+      name: 'Graph VM',
+      type: 'attached',
+    });
+    mockAgentPermissions().agent.subagents = {
+      enabled: false,
+      graphsEnabled: true,
+      graphs: [{ agent_ids: ['graph-member'] }],
+    };
+    mockAgentsMap.mockReturnValue({
+      'graph-member': {
+        id: 'graph-member',
+        stateful_code_sessions: true,
+        tools: [Tools.execute_code],
+        code_environment_id: 'graph-vm',
+      },
+    });
+    mockStatus.mockImplementation((ids: string[]) =>
+      ids.map((id) => ({
+        data: {
+          environmentId: id,
+          status: id === 'graph-vm' ? 'offline' : 'ready',
+          workspaces: [{ id: 'project-a' }],
+        },
+      })),
+    );
+    const selection = [{ environmentId: 'personal-vm', workspaceId: 'project-a' }];
+    const { result, rerender } = renderHook(() => useCodeWorkspace(conversation(selection)));
+    expect(result.current.canSubmit).toBe(false);
+    expect(result.current.environments.map(({ environment }) => environment.id)).toEqual(
+      expect.arrayContaining(['personal-vm', 'graph-vm']),
+    );
+    config.capabilities = config.capabilities.filter(
+      (capability: string) => capability !== 'subagent_graphs',
+    );
+    rerender();
+    expect(result.current.environments.map(({ environment }) => environment.id)).toEqual([
+      'personal-vm',
+    ]);
+    expect(result.current.canSubmit).toBe(true);
+    expect(result.current.resolveSubmission(selection)?.codeWorkspaces).toEqual(selection);
+  });
+
+  it('ignores missing disabled graph members without blocking ordinary chat', () => {
+    mockAgentPermissions().agent.subagents = {
+      enabled: false,
+      graphsEnabled: true,
+      graphs: [{ agent_ids: ['unavailable-member'] }],
+    };
+    const selection = [{ environmentId: 'personal-vm', workspaceId: 'project-a' }];
+    const { result } = renderHook(() => useCodeWorkspace(conversation(selection)));
+    expect(result.current.canSubmit).toBe(true);
+    expect(result.current.resolveSubmission(selection)?.codeWorkspaces).toEqual(selection);
+  });
+
+  it('keeps legacy graph workspace requirements under the original subagents capability', () => {
+    mockAgentsConfig().agentsConfig.statefulCodeSessions.environments.push({
+      id: 'graph-vm',
+      name: 'Graph VM',
+      type: 'attached',
+    });
+    mockAgentPermissions().agent.subagents = {
+      enabled: true,
+      allowSelf: false,
+      graphs: [{ agent_ids: ['legacy-member'] }],
+    };
+    mockAgentsMap.mockReturnValue({
+      'legacy-member': {
+        id: 'legacy-member',
+        stateful_code_sessions: true,
+        tools: [Tools.execute_code],
+        code_environment_id: 'graph-vm',
+      },
+    });
+    mockStatus.mockImplementation((ids: string[]) =>
+      ids.map((id) => ({
+        data: {
+          environmentId: id,
+          status: id === 'graph-vm' ? 'offline' : 'ready',
+          workspaces: [{ id: 'project-a' }],
+        },
+      })),
+    );
+    const { result } = renderHook(() =>
+      useCodeWorkspace(conversation([{ environmentId: 'personal-vm', workspaceId: 'project-a' }])),
+    );
+    expect(result.current.canSubmit).toBe(false);
+    expect(result.current.environments.map(({ environment }) => environment.id)).toContain(
+      'graph-vm',
+    );
+  });
+
   describe('per-chat machines', () => {
     function enableChoices() {
       const config = mockAgentsConfig().agentsConfig;
@@ -759,7 +855,7 @@ describe('useCodeWorkspace', () => {
     mockAgentsMap.mockReturnValue({});
     mockAgentsConfig.mockReturnValue({
       agentsConfig: {
-        capabilities: ['execute_code', 'stateful_code_sessions'],
+        capabilities: ['execute_code', 'stateful_code_sessions', 'subagents'],
         statefulCodeSessions: {
           environments: [
             {
@@ -964,7 +1060,7 @@ describe('useCodeWorkspace', () => {
     }));
     mockAgentsConfig.mockReturnValue({
       agentsConfig: {
-        capabilities: ['execute_code', 'stateful_code_sessions'],
+        capabilities: ['execute_code', 'stateful_code_sessions', 'subagents'],
         statefulCodeSessions: {
           environments: [
             { id: 'primary-vm', name: 'Primary VM', type: 'attached' },
@@ -1026,7 +1122,7 @@ describe('useCodeWorkspace', () => {
     }));
     mockAgentsConfig.mockReturnValue({
       agentsConfig: {
-        capabilities: ['execute_code', 'stateful_code_sessions'],
+        capabilities: ['execute_code', 'stateful_code_sessions', 'subagents'],
         statefulCodeSessions: {
           environments: [
             { id: 'primary-vm', type: 'attached' },
@@ -1970,7 +2066,7 @@ describe('useCodeWorkspace', () => {
     );
     mockAgentsConfig.mockReturnValue({
       agentsConfig: {
-        capabilities: ['execute_code', 'stateful_code_sessions'],
+        capabilities: ['execute_code', 'stateful_code_sessions', 'subagents'],
         statefulCodeSessions: {
           environments: [
             { id: 'personal-vm', type: 'attached' },
@@ -2025,7 +2121,7 @@ describe('useCodeWorkspace', () => {
   it('blocks sending when the agent-selected environment is not accessible', () => {
     mockAgentsConfig.mockReturnValue({
       agentsConfig: {
-        capabilities: ['execute_code', 'stateful_code_sessions'],
+        capabilities: ['execute_code', 'stateful_code_sessions', 'subagents'],
         statefulCodeSessions: { environments: [] },
       },
     });
@@ -2113,7 +2209,7 @@ describe('useCodeWorkspace', () => {
     });
     mockAgentsConfig.mockReturnValue({
       agentsConfig: {
-        capabilities: ['execute_code', 'stateful_code_sessions'],
+        capabilities: ['execute_code', 'stateful_code_sessions', 'subagents'],
         statefulCodeSessions: {
           environments: [
             { id: 'personal-vm', type: 'attached', baseURL: 'https://one.example.com' },
diff --git a/client/src/hooks/Agents/useCodeApprovalMode.ts b/client/src/hooks/Agents/useCodeApprovalMode.ts
index b7ce4d987f9..9caf48dfeed 100644
--- a/client/src/hooks/Agents/useCodeApprovalMode.ts
+++ b/client/src/hooks/Agents/useCodeApprovalMode.ts
@@ -42,11 +42,20 @@ export default function useCodeApprovalMode(
   const environments = statefulCodeSessions?.environments;
   const reachable = useMemo(
     () =>
-      collectReachableAgents([primaryAgent, addedAgent], agentsMap, [
-        conversation?.agent_id,
-        addedConversation?.agent_id,
-      ]),
-    [addedAgent, agentsMap, primaryAgent, conversation?.agent_id, addedConversation?.agent_id],
+      collectReachableAgents(
+        [primaryAgent, addedAgent],
+        agentsMap,
+        [conversation?.agent_id, addedConversation?.agent_id],
+        agentsConfig?.capabilities,
+      ),
+    [
+      addedAgent,
+      agentsMap,
+      primaryAgent,
+      conversation?.agent_id,
+      addedConversation?.agent_id,
+      agentsConfig?.capabilities,
+    ],
   );
   /** Approval modes intersect every machine an agent could run on, including a subagent's own
    *  default it may no longer use once it follows its parent: offering fewer modes is safe. */
@@ -217,6 +226,7 @@ export function collectReachableAgents(
   roots: Array<Agent | undefined>,
   agentsMap: TAgentsMap | undefined,
   expectedRootIds: Array<string | undefined | null>,
+  capabilities?: readonly string[],
 ): { agents: Agent[]; complete: boolean } {
   const pending = roots.filter((agent): agent is Agent => agent != null);
   const visited = new Set<string>();
@@ -233,7 +243,7 @@ export function collectReachableAgents(
       ...(Array.isArray(edge.from) ? edge.from : [edge.from]),
       ...(Array.isArray(edge.to) ? edge.to : [edge.to]),
     ]);
-    const subagents = resolveSubagents(agent.subagents);
+    const subagents = resolveSubagents(agent.subagents, capabilities);
     const graphIds = subagents?.graphs?.flatMap((graph) => graph.agent_ids);
     const ids = [
       ...(agent.agent_ids ?? []),
@@ -263,7 +273,9 @@ function toCodeWorkspaceRoutingAgent(
   agent: Agent,
   environments: TPublicCodeEnvironment[] | undefined,
   allowEnvironmentSelection: boolean | undefined,
+  capabilities?: readonly string[],
 ): CodeWorkspaceRoutingAgent {
+  const subagents = resolveSubagents(agent.subagents, capabilities);
   return {
     id: agent.id,
     routesCode:
@@ -274,12 +286,10 @@ function toCodeWorkspaceRoutingAgent(
     allowSelection:
       getCodeEnvironmentChoiceIds(agent, environments, allowEnvironmentSelection) != null,
     subagentIds:
-      resolveSubagents(agent.subagents)?.enabled === true
+      subagents?.enabled === true
         ? [
-            ...(resolveSubagents(agent.subagents)?.agent_ids ?? []),
-            ...(resolveSubagents(agent.subagents)?.graphs ?? []).flatMap(
-              (graph) => graph.agent_ids ?? [],
-            ),
+            ...(subagents.agent_ids ?? []),
+            ...(subagents.graphs ?? []).flatMap((graph) => graph.agent_ids ?? []),
           ].filter((id) => id.length > 0 && id !== agent.id)
         : undefined,
   };
@@ -299,6 +309,7 @@ export function resolveReachableCodeWorkspaceInheritance(
   selections: CodeWorkspaceSelection[] | undefined,
   /** The chat has not decided yet, so the submission will also select each root's machine. */
   draft = false,
+  capabilities?: readonly string[],
 ): Map<string, string> {
   if (!draft && !selections?.length) return new Map();
   const lookup = (id: string): Agent | undefined =>
@@ -311,7 +322,7 @@ export function resolveReachableCodeWorkspaceInheritance(
     if (agents.has(agent.id)) continue;
     agents.set(
       agent.id,
-      toCodeWorkspaceRoutingAgent(agent, environments, allowEnvironmentSelection),
+      toCodeWorkspaceRoutingAgent(agent, environments, allowEnvironmentSelection, capabilities),
     );
     rootIds.push(agent.id);
     for (const id of getLinkedAgentIds(agent)) {
@@ -324,7 +335,12 @@ export function resolveReachableCodeWorkspaceInheritance(
     const id = pending.shift() as string;
     const agent = agents.has(id) ? undefined : lookup(id);
     if (agent == null) continue;
-    const node = toCodeWorkspaceRoutingAgent(agent, environments, allowEnvironmentSelection);
+    const node = toCodeWorkspaceRoutingAgent(
+      agent,
+      environments,
+      allowEnvironmentSelection,
+      capabilities,
+    );
     agents.set(id, node);
     pending.push(...(node.subagentIds ?? []));
   }
diff --git a/client/src/hooks/Agents/useCodeWorkspace.ts b/client/src/hooks/Agents/useCodeWorkspace.ts
index f6f8d2f45e7..1234ecf80cb 100644
--- a/client/src/hooks/Agents/useCodeWorkspace.ts
+++ b/client/src/hooks/Agents/useCodeWorkspace.ts
@@ -212,11 +212,20 @@ export default function useCodeWorkspace(
     | undefined;
   const reachable = useMemo(
     () =>
-      collectReachableAgents([primaryAgent, addedAgent], agentsMap, [
-        conversation?.agent_id,
-        addedConversation?.agent_id,
-      ]),
-    [addedAgent, agentsMap, primaryAgent, conversation?.agent_id, addedConversation?.agent_id],
+      collectReachableAgents(
+        [primaryAgent, addedAgent],
+        agentsMap,
+        [conversation?.agent_id, addedConversation?.agent_id],
+        agentsConfig?.capabilities,
+      ),
+    [
+      addedAgent,
+      agentsMap,
+      primaryAgent,
+      conversation?.agent_id,
+      addedConversation?.agent_id,
+      agentsConfig?.capabilities,
+    ],
   );
   const storedSelections = conversation?.codeWorkspaces;
   const isNewChat =
@@ -251,6 +260,7 @@ export default function useCodeWorkspace(
           statefulCodeSessions?.allowEnvironmentSelection,
           conversation?.codeWorkspaces,
           undecided,
+          agentsConfig?.capabilities,
         )
       : new Map<string, string>();
     /** A decision may still select the machine an inheriting subagent ran on before it followed
@@ -316,7 +326,12 @@ export default function useCodeWorkspace(
       [addedAgent, addedConversation?.agent_id],
     ] as const) {
       if (!rootAgent || !rootAgentId) continue;
-      const rootReachable = collectReachableAgents([rootAgent], agentsMap, [rootAgentId]);
+      const rootReachable = collectReachableAgents(
+        [rootAgent],
+        agentsMap,
+        [rootAgentId],
+        agentsConfig?.capabilities,
+      );
       for (const agent of rootReachable.agents) {
         if (agent.stateful_code_sessions !== true || !agent.tools?.includes(Tools.execute_code)) {
           continue;
@@ -350,6 +365,7 @@ export default function useCodeWorkspace(
     conversation?.codeWorkspaces,
     primaryAgent,
     reachable.agents,
+    agentsConfig?.capabilities,
     statefulCodeSessions?.environments,
     statefulCodeSessions?.allowEnvironmentSelection,
     supportsWorkspaceInheritance,
@@ -547,6 +563,8 @@ export default function useCodeWorkspace(
               statefulCodeSessions.environments,
               true,
               resolved,
+              false,
+              agentsConfig?.capabilities,
             )
           : undefined;
       if (
@@ -581,6 +599,7 @@ export default function useCodeWorkspace(
       required,
       selectionMetadataComplete,
       reachable.agents,
+      agentsConfig?.capabilities,
       statefulCodeSessions,
       supportsWorkspaceInheritance,
     ],

From 9fb56bf9e65567de907200e5083b569dbc1c51c8 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 03:51:31 +0000
Subject: [PATCH 04/12] fix: unify graph capability gating across stored
 routing nodes

---
 .../services/Endpoints/agents/initialize.js   |   1 +
 packages/api/src/code/inheritance.spec.ts     | 145 +++++++++++++++++-
 packages/api/src/code/inheritance.ts          |  28 ++--
 .../data-provider/src/subagentGraphs.spec.ts  |  61 ++++++++
 packages/data-provider/src/subagentGraphs.ts  |  30 ++--
 5 files changed, 244 insertions(+), 21 deletions(-)

diff --git a/api/server/services/Endpoints/agents/initialize.js b/api/server/services/Endpoints/agents/initialize.js
index dcd074bd57b..6205b60053e 100644
--- a/api/server/services/Endpoints/agents/initialize.js
+++ b/api/server/services/Endpoints/agents/initialize.js
@@ -1567,6 +1567,7 @@ const initializeClientWithProvider = async ({
           request: runtimeRequestBody,
         }),
         roots: rootSubagentConfigs.filter((config) => config?.id),
+        capabilities: [...enabledCapabilities],
         loadSubagent: (agentId) => resolveLazyMetadata(() => loadViewableSubagent(agentId)),
         environments: statefulCodeSessionsConfig?.environments,
         allowEnvironmentSelection: statefulCodeSessionsConfig?.allowEnvironmentSelection,
diff --git a/packages/api/src/code/inheritance.spec.ts b/packages/api/src/code/inheritance.spec.ts
index 08b35163c4c..a027f65f697 100644
--- a/packages/api/src/code/inheritance.spec.ts
+++ b/packages/api/src/code/inheritance.spec.ts
@@ -1,12 +1,12 @@
 import mongoose from 'mongoose';
-import { Tools } from 'librechat-data-provider';
 import { MongoMemoryServer } from 'mongodb-memory-server';
+import { Tools, AgentCapabilities } from 'librechat-data-provider';
 import { agentSchema, createMethods } from '@librechat/data-schemas';
 import type { CodeWorkspaceSelection } from 'librechat-data-provider';
 import type { IAgent } from '@librechat/data-schemas';
 import type { CodeWorkspaceInheritanceRoot, SubagentCodeRoutingAgent } from './inheritance';
 import type { CodeEnvironmentConfig } from '~/agents/execution';
-import { resolveSubagentCodeWorkspaceInheritance } from './inheritance';
+import { getSpawnableSubagentIds, resolveSubagentCodeWorkspaceInheritance } from './inheritance';
 import { resolveCodeExecutionContext } from '~/agents/execution';
 
 const SKYNET = 'code-yuwoQAAPhY1WMaDD6oIk';
@@ -306,6 +306,147 @@ describe('resolveSubagentCodeWorkspaceInheritance', () => {
     );
   });
 
+  it('projects loaded descendants before a disabled graph can create conflicting parent routes', async () => {
+    const middleId = 'agent_fixed_planner';
+    const childMachine = 'code-child-machine';
+    const lia = await seed(LIA, { subagents: { enabled: true, agent_ids: [middleId, REVIEWER] } });
+    await seed(middleId, {
+      code_environment_id: SKYNET,
+      code_environment_ids: [],
+      subagents: {
+        enabled: false,
+        graphsEnabled: true,
+        graphs: [
+          {
+            type: 'disabled-team',
+            name: 'Disabled',
+            description: 'Work',
+            agent_ids: [REVIEWER],
+            edges: [],
+            entry_agent_id: REVIEWER,
+            result_agent_id: REVIEWER,
+          },
+        ],
+      },
+    });
+    const reviewer = await seed(REVIEWER, {
+      code_environment_id: childMachine,
+      code_environment_ids: [SKYNET, LIA_RAG],
+    });
+    const configured = [...environments, { ...environments[0], id: childMachine }];
+    const selection = [{ environmentId: LIA_RAG, workspaceId: 'agents', agentIds: [LIA] }];
+    const storedMiddle = await methods.getAgentWithVersionCount({ id: middleId });
+    const inheritance = await resolveSubagentCodeWorkspaceInheritance({
+      selections: selection,
+      roots: [root(lia)],
+      loadSubagent,
+      environments: configured,
+      allowEnvironmentSelection: true,
+      codeExecutionAvailable: true,
+      capabilities: [AgentCapabilities.subagents],
+    });
+    expect(inheritance.get(REVIEWER)).toBe(LIA_RAG);
+    expect(inheritance.has(middleId)).toBe(false);
+    expect(loadSubagent).toHaveBeenCalledTimes(2);
+    expect((await methods.getAgentWithVersionCount({ id: middleId }))?.subagents).toEqual(
+      storedMiddle?.subagents,
+    );
+    expect(
+      resolveCodeExecutionContext({
+        statefulSessions: true,
+        environmentId: reviewer.code_environment_id,
+        environmentIds: reviewer.code_environment_ids,
+        environments: configured,
+        allowEnvironmentSelection: true,
+        workspaceSelections: selection,
+        inheritedEnvironments: inheritance,
+        userId: 'user-1',
+        agentId: REVIEWER,
+        conversationId: 'chat-1',
+      }).environmentId,
+    ).toBe(LIA_RAG);
+  });
+
+  it.each([false, true])(
+    'applies the graph capability to stored-only descendants, enabled=%s',
+    async (graphCapability) => {
+      const leaf = 'agent_graph_only_leaf';
+      const lia = await seed(LIA, { subagents: { enabled: true, agent_ids: [REVIEWER] } });
+      await seed(REVIEWER, {
+        subagents: {
+          enabled: false,
+          graphsEnabled: true,
+          agent_ids: ['disabled-single'],
+          graphs: [
+            {
+              type: 'nested-team',
+              name: 'Nested',
+              description: 'Work',
+              agent_ids: [leaf],
+              edges: [],
+              entry_agent_id: leaf,
+              result_agent_id: leaf,
+            },
+          ],
+        },
+      });
+      await seed(leaf);
+      const inheritance = await resolveSubagentCodeWorkspaceInheritance({
+        selections: incident,
+        roots: [root(lia)],
+        loadSubagent,
+        environments,
+        allowEnvironmentSelection: true,
+        codeExecutionAvailable: true,
+        capabilities: graphCapability
+          ? [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs]
+          : [AgentCapabilities.subagents],
+      });
+      expect(inheritance.get(REVIEWER)).toBe(LIA_RAG);
+      expect(inheritance.has(leaf)).toBe(graphCapability);
+      expect(loadSubagent).not.toHaveBeenCalledWith('disabled-single');
+      expect(loadSubagent.mock.calls.map(([id]) => id)).toEqual(
+        graphCapability ? [REVIEWER, leaf] : [REVIEWER],
+      );
+    },
+  );
+
+  it('does not load ordinary or legacy targets under the graph capability alone', async () => {
+    const lia = await seed(LIA, {
+      subagents: {
+        enabled: true,
+        agent_ids: [REVIEWER],
+        graphs: [
+          {
+            type: 'legacy-team',
+            name: 'Legacy',
+            description: 'Work',
+            agent_ids: [REVIEWER],
+            edges: [],
+            entry_agent_id: REVIEWER,
+            result_agent_id: REVIEWER,
+          },
+        ],
+      },
+    });
+    const inheritance = await resolveSubagentCodeWorkspaceInheritance({
+      selections: incident,
+      roots: [root(lia)],
+      loadSubagent,
+      environments,
+      allowEnvironmentSelection: true,
+      codeExecutionAvailable: true,
+      capabilities: [AgentCapabilities.subagent_graphs],
+    });
+    expect(inheritance.size).toBe(0);
+    expect(loadSubagent).not.toHaveBeenCalled();
+    expect(
+      getSpawnableSubagentIds({ ...lia, subagents: { ...lia.subagents, graphsEnabled: true } }, [
+        AgentCapabilities.subagent_graphs,
+      ]),
+    ).toEqual([REVIEWER]);
+  });
+
   it('counts only admitted subagents toward the node limit', async () => {
     const verifier = 'agent_finding_verifier';
     const stale = Array.from({ length: 49 }, (_, index) => `agent_deleted_${index}`);
diff --git a/packages/api/src/code/inheritance.ts b/packages/api/src/code/inheritance.ts
index 63ceeb16366..059dd064fe9 100644
--- a/packages/api/src/code/inheritance.ts
+++ b/packages/api/src/code/inheritance.ts
@@ -1,6 +1,7 @@
 import {
   Tools,
   isSubagentGraphsEnabled,
+  isSubagentsEnabled,
   MAX_SUBAGENT_DEPTH,
   MAX_SUBAGENT_GRAPH_NODES,
   stripAgentIdSuffix,
@@ -43,16 +44,17 @@ export type CodeWorkspaceInheritanceRoot = Pick<SubagentCodeRoutingAgent, 'id' |
  *  Self-spawns already share their parent's route. */
 export function getSpawnableSubagentIds(
   agent: Pick<SubagentCodeRoutingAgent, 'id' | 'subagents'>,
+  capabilities?: readonly string[],
 ): string[] {
   const subagents = agent.subagents;
-  if (!subagents || (subagents.enabled !== true && !isSubagentGraphsEnabled(subagents))) {
+  const singles = isSubagentsEnabled(subagents, capabilities);
+  const graphs = isSubagentGraphsEnabled(subagents, capabilities);
+  if (!subagents || (!singles && !graphs)) {
     return [];
   }
   const ids = [
-    ...(subagents.enabled === true && Array.isArray(subagents.agent_ids)
-      ? subagents.agent_ids
-      : []),
-    ...(isSubagentGraphsEnabled(subagents) ? (subagents.graphs ?? []) : []).flatMap((graph) =>
+    ...(singles && Array.isArray(subagents.agent_ids) ? subagents.agent_ids : []),
+    ...(graphs ? (subagents.graphs ?? []) : []).flatMap((graph) =>
       Array.isArray(graph?.agent_ids) ? graph.agent_ids : [],
     ),
   ];
@@ -64,13 +66,16 @@ export function getSpawnableSubagentIds(
 }
 
 /** Keyed by saved ID: a parallel root's runtime ID (`id____1`) must still mark that agent a root. */
-function toRootRoutingAgent(root: CodeWorkspaceInheritanceRoot): CodeWorkspaceRoutingAgent {
+function toRootRoutingAgent(
+  root: CodeWorkspaceInheritanceRoot,
+  capabilities?: readonly string[],
+): CodeWorkspaceRoutingAgent {
   const context = root.codeExecutionContext;
   return {
     id: stripAgentIdSuffix(root.id),
     routesCode: root.statefulCodeSessions === true,
     allowSelection: false,
-    subagentIds: getSpawnableSubagentIds(root),
+    subagentIds: getSpawnableSubagentIds(root, capabilities),
     resolvedEnvironmentId:
       context?.environmentType === 'attached' ? (context.environmentId ?? null) : null,
   };
@@ -80,6 +85,7 @@ function toSubagentRoutingAgent(
   agent: SubagentCodeRoutingAgent,
   environments: readonly CodeEnvironmentConfig[] | undefined,
   allowEnvironmentSelection: boolean | undefined,
+  capabilities?: readonly string[],
 ): CodeWorkspaceRoutingAgent {
   const { defaultEnvironment, allowSelection } = resolveAgentCodeEnvironmentRouting({
     environmentId: agent.code_environment_id,
@@ -94,7 +100,7 @@ function toSubagentRoutingAgent(
     environmentId: agent.code_environment_id ?? defaultEnvironment?.id,
     environmentIds: agent.code_environment_ids,
     allowSelection,
-    subagentIds: getSpawnableSubagentIds(agent),
+    subagentIds: getSpawnableSubagentIds(agent, capabilities),
   };
 }
 
@@ -114,6 +120,7 @@ export async function resolveSubagentCodeWorkspaceInheritance({
   environments,
   allowEnvironmentSelection,
   codeExecutionAvailable,
+  capabilities,
 }: {
   selections: unknown;
   roots: readonly CodeWorkspaceInheritanceRoot[];
@@ -122,13 +129,15 @@ export async function resolveSubagentCodeWorkspaceInheritance({
   allowEnvironmentSelection?: boolean;
   /** The run may use stateful code at all: capability, role grant and deployment switches. */
   codeExecutionAvailable: boolean;
+  /** Applies the same spawn gates to initialized roots and loaded persisted descendants. */
+  capabilities?: readonly string[];
 }): Promise<Map<string, string>> {
   if (!codeExecutionAvailable || !isCodeWorkspaceSelections(selections) || !selections.length) {
     return new Map();
   }
   const agents = new Map<string, CodeWorkspaceRoutingAgent>();
   for (const root of roots) {
-    const node = toRootRoutingAgent(root);
+    const node = toRootRoutingAgent(root, capabilities);
     if (!agents.has(node.id)) agents.set(node.id, node);
   }
   const rootIds = [...agents.keys()];
@@ -156,6 +165,7 @@ export async function resolveSubagentCodeWorkspaceInheritance({
           { ...agent, id: batch[index] },
           environments,
           allowEnvironmentSelection,
+          capabilities,
         );
         agents.set(node.id, node);
         frontier.push(...(node.subagentIds ?? []));
diff --git a/packages/data-provider/src/subagentGraphs.spec.ts b/packages/data-provider/src/subagentGraphs.spec.ts
index 3ac9f49a594..5712508c9d5 100644
--- a/packages/data-provider/src/subagentGraphs.spec.ts
+++ b/packages/data-provider/src/subagentGraphs.spec.ts
@@ -82,3 +82,64 @@ test('legacy stored teams keep their old subagents capability until an explicit
     resolveSubagents({ ...config, graphsEnabled: true }, [AgentCapabilities.subagents])?.graphs,
   ).toEqual([]);
 });
+
+const capabilityChoices = [
+  { name: 'ordinary', value: [AgentCapabilities.subagents] },
+  { name: 'graphs', value: [AgentCapabilities.subagent_graphs] },
+  { name: 'both', value: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs] },
+  { name: 'neither', value: [] },
+  { name: 'unresolved', value: undefined },
+];
+const matrix = capabilityChoices.flatMap(({ name, value }) =>
+  [undefined, false, true].flatMap((enabled) =>
+    [undefined, false, true].map((graphsEnabled) => ({
+      name,
+      capabilities: value,
+      enabled,
+      graphsEnabled,
+    })),
+  ),
+);
+
+test.each(matrix)(
+  'preserves spawn authorization for $name capabilities, singles=$enabled, graphs=$graphsEnabled',
+  ({ capabilities, enabled, graphsEnabled }) => {
+    const config: AgentSubagentsConfig = {
+      enabled,
+      graphsEnabled,
+      allowSelf: true,
+      agent_ids: ['child'],
+      graphs: [graph],
+    };
+    const original = JSON.stringify(config);
+    const singles =
+      enabled === true &&
+      (capabilities == null || capabilities.includes(AgentCapabilities.subagents));
+    const requiredCapability =
+      graphsEnabled == null ? AgentCapabilities.subagents : AgentCapabilities.subagent_graphs;
+    const teams =
+      (graphsEnabled ?? enabled === true) &&
+      (capabilities == null || capabilities.includes(requiredCapability));
+    const resolved = resolveSubagents(config, capabilities);
+    expect(isSubagentGraphsEnabled(config, capabilities)).toBe(teams);
+    expect(resolved?.enabled).toBe(singles || teams);
+    expect(resolved?.allowSelf !== false && resolved?.enabled === true).toBe(singles);
+    expect(resolved?.agent_ids).toEqual(singles ? ['child'] : []);
+    expect(resolved?.graphs).toEqual(teams ? [graph] : []);
+    expect(resolveSubagents(resolved, capabilities)).toEqual(resolved);
+    expect(JSON.stringify(config)).toBe(original);
+  },
+);
+
+test('a new graph capability never authorizes untouched legacy teams', () => {
+  const legacy = { enabled: true, graphs: [graph] };
+  expect(resolveSubagents(legacy, [AgentCapabilities.subagent_graphs])).toMatchObject({
+    enabled: false,
+    graphs: [],
+    agent_ids: [],
+    allowSelf: false,
+  });
+  expect(
+    resolveSubagents({ ...legacy, graphsEnabled: true }, [AgentCapabilities.subagent_graphs]),
+  ).toMatchObject({ enabled: true, graphs: [graph], agent_ids: [], allowSelf: false });
+});
diff --git a/packages/data-provider/src/subagentGraphs.ts b/packages/data-provider/src/subagentGraphs.ts
index 297ae2c367c..7431a4b7843 100644
--- a/packages/data-provider/src/subagentGraphs.ts
+++ b/packages/data-provider/src/subagentGraphs.ts
@@ -159,11 +159,27 @@ export const graphSubagentSchema: z.ZodType<AgentSubagentGraph> = z
     }
   });
 
-/** Legacy teams followed the single-agent flag until a graph-specific choice was saved. */
+/** Legacy teams retain the ordinary subagents gate until a graph-specific choice is saved. */
 export function isSubagentGraphsEnabled(
   config?: Pick<AgentSubagentsConfig, 'enabled' | 'graphsEnabled'> | null,
+  capabilities?: readonly string[],
 ): boolean {
-  return config?.graphsEnabled ?? config?.enabled === true;
+  const capability =
+    config?.graphsEnabled == null ? AgentCapabilities.subagents : AgentCapabilities.subagent_graphs;
+  return (
+    (config?.graphsEnabled ?? config?.enabled === true) &&
+    (capabilities == null || capabilities.includes(capability))
+  );
+}
+
+export function isSubagentsEnabled(
+  config?: Pick<AgentSubagentsConfig, 'enabled'> | null,
+  capabilities?: readonly string[],
+): boolean {
+  return (
+    config?.enabled === true &&
+    (capabilities == null || capabilities.includes(AgentCapabilities.subagents))
+  );
 }
 
 /** Runtime projection only. Persisted settings and the two user choices remain untouched. */
@@ -172,14 +188,8 @@ export function resolveSubagents(
   capabilities?: readonly string[],
 ): AgentSubagentsConfig | undefined {
   if (!config) return undefined;
-  const singles =
-    config.enabled === true &&
-    (capabilities == null || capabilities.includes(AgentCapabilities.subagents));
-  const graphs =
-    isSubagentGraphsEnabled(config) &&
-    (capabilities == null ||
-      capabilities.includes(AgentCapabilities.subagent_graphs) ||
-      (config.graphsEnabled == null && capabilities.includes(AgentCapabilities.subagents)));
+  const singles = isSubagentsEnabled(config, capabilities);
+  const graphs = isSubagentGraphsEnabled(config, capabilities);
   if (config.graphsEnabled == null && singles && graphs) return config;
   return {
     ...config,

From 8fb855826dc3adf8f7fe7e08cd6e7f54ac9cb32f Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 04:02:13 +0000
Subject: [PATCH 05/12] fix: preserve disabled graph teams when saving edits

---
 .../SidePanel/Agents/Advanced/Graphs.tsx      |  4 +-
 .../Agents/Advanced/__tests__/Graphs.spec.tsx | 72 ++++++++++++++++---
 e2e/specs/mock/agent-graphs.spec.ts           | 45 ++++++++++++
 3 files changed, 111 insertions(+), 10 deletions(-)

diff --git a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
index 9daa6462c31..15b49090150 100644
--- a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
@@ -50,7 +50,7 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
     id === currentAgentId || id === ''
       ? localize('com_ui_agent_graphs_self')
       : (getAgent(id)?.name ?? id);
-  const write = (next: AgentSubagentGraph[], active = true) => {
+  const write = (next: AgentSubagentGraph[], active: boolean) => {
     const value = getValues('subagents');
     setValue(
       'subagents',
@@ -102,7 +102,7 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
       }
       next.push(parsed.data);
     } else next[draft.index] = parsed.data;
-    write(next);
+    write(next, draft.index === null ? true : enabled);
     setDraft(null);
   };
   const graph = draft?.graph;
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
index 1eb159ff392..80bdb979111 100644
--- a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
@@ -1,5 +1,6 @@
 import { useForm, FormProvider } from 'react-hook-form';
 import { render, screen, fireEvent } from '@testing-library/react';
+import type { AgentSubagentsConfig } from 'librechat-data-provider';
 import type { UseFormReturn } from 'react-hook-form';
 import type { AgentForm } from '~/common';
 import Graphs from '../Graphs';
@@ -19,16 +20,17 @@ const team = {
   entry_agent_id: 'parent',
   result_agent_id: 'parent',
 };
-function Harness() {
+const initialSubagents: AgentSubagentsConfig = {
+  enabled: false,
+  graphsEnabled: true,
+  allowSelf: false,
+  agent_ids: ['child'],
+  graphs: [team],
+};
+function Harness({ subagents = initialSubagents }: { subagents?: AgentSubagentsConfig }) {
   const methods = useForm<AgentForm>({
     defaultValues: {
-      subagents: {
-        enabled: false,
-        graphsEnabled: true,
-        allowSelf: false,
-        agent_ids: ['child'],
-        graphs: [team],
-      },
+      subagents,
       edges: [{ from: 'parent', to: 'handoff', edgeType: 'handoff' }],
     },
   });
@@ -63,3 +65,57 @@ test('cancelled graph edits never change the saved form and invalid graphs canno
   fireEvent.click(screen.getByRole('button', { name: 'com_ui_cancel' }));
   expect(mockGetValues('subagents.graphs')).toEqual([team]);
 });
+
+test.each([false, true])(
+  'editing one saved team preserves graph enablement=%s and every other team',
+  (graphsEnabled) => {
+    const otherTeam = { ...team, type: 'other_review', name: 'Other Review' };
+    const subagents = {
+      ...initialSubagents,
+      enabled: true,
+      shareFiles: true,
+      graphsEnabled,
+      graphs: [team, otherTeam],
+    };
+    render(<Harness subagents={subagents} />);
+    fireEvent.click(screen.getAllByRole('button', { name: 'com_ui_agent_graphs_edit' })[0]);
+    fireEvent.change(screen.getByLabelText('com_ui_agent_graphs_name'), {
+      target: { value: 'Renamed Review' },
+    });
+    fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_save' }));
+    expect(mockGetValues('subagents')).toEqual({
+      ...subagents,
+      graphs: [{ ...team, name: 'Renamed Review' }, otherTeam],
+    });
+    expect(screen.getByRole('switch', { name: 'com_ui_agent_graphs_enable' })).toHaveAttribute(
+      'aria-checked',
+      String(graphsEnabled),
+    );
+    expect(mockGetValues('edges')).toEqual([
+      { from: 'parent', to: 'handoff', edgeType: 'handoff' },
+    ]);
+  },
+);
+
+test('a disable choice made while editing is retained when the draft is applied', () => {
+  render(<Harness />);
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_edit' }));
+  fireEvent.change(screen.getByLabelText('com_ui_agent_graphs_description'), {
+    target: { value: 'Updated review work' },
+  });
+  fireEvent.click(screen.getByRole('switch', { name: 'com_ui_agent_graphs_enable' }));
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_save' }));
+  expect(mockGetValues('subagents')).toEqual({
+    ...initialSubagents,
+    graphsEnabled: false,
+    graphs: [{ ...team, description: 'Updated review work' }],
+  });
+});
+
+test('removing one disabled team does not activate any remaining definitions', () => {
+  const otherTeam = { ...team, type: 'other_review', name: 'Other Review' };
+  const subagents = { ...initialSubagents, graphsEnabled: false, graphs: [team, otherTeam] };
+  render(<Harness subagents={subagents} />);
+  fireEvent.click(screen.getAllByRole('button', { name: 'com_ui_agent_graphs_remove' })[0]);
+  expect(mockGetValues('subagents')).toEqual({ ...subagents, graphs: [otherTeam] });
+});
diff --git a/e2e/specs/mock/agent-graphs.spec.ts b/e2e/specs/mock/agent-graphs.spec.ts
index b153e1b1157..6a718748e04 100644
--- a/e2e/specs/mock/agent-graphs.spec.ts
+++ b/e2e/specs/mock/agent-graphs.spec.ts
@@ -141,6 +141,51 @@ test('authors and executes a graph team independently of ordinary subagents', as
       graphsEnabled: false,
       graphs: [{ type: 'review_team' }],
     });
+
+    await reopened.getByRole('button', { name: 'Add tools', exact: true }).click();
+    const editLibrary = page.getByRole('dialog', { name: 'Tool Library', exact: true });
+    await editLibrary
+      .getByRole('listitem')
+      .filter({ hasText: 'Subagent Graphs' })
+      .getByRole('button', { name: 'Configure', exact: true })
+      .click();
+    await expect(
+      dialog.getByRole('switch', { name: 'Enable graph teams', exact: true }),
+    ).not.toBeChecked();
+    await dialog.getByRole('button', { name: 'Edit Review team', exact: true }).click();
+    await dialog.getByLabel('Team name', { exact: true }).fill('Renamed disabled team');
+    await dialog.getByRole('button', { name: 'Save graph team', exact: true }).click();
+    await expect(
+      dialog.getByRole('switch', { name: 'Enable graph teams', exact: true }),
+    ).not.toBeChecked();
+    await dialog.getByRole('button', { name: 'Close', exact: true }).click();
+    await expect(dialog).toBeHidden();
+    await page
+      .getByRole('dialog', { name: 'Tool Library', exact: true, includeHidden: true })
+      .getByRole('button', { name: 'Close', exact: true })
+      .click();
+    await Promise.all([
+      page.waitForResponse(
+        (response) =>
+          response.request().method() === 'PATCH' &&
+          new URL(response.url()).pathname === `/api/agents/${parent?.id}` &&
+          response.ok(),
+      ),
+      reopened.getByRole('button', { name: 'Save', exact: true }).click(),
+    ]);
+    const edited = await fetchJson<AgentDetail>(page, `/api/agents/${parent.id}/expanded`, token);
+    expect(edited.subagents).toEqual({
+      ...saved.subagents,
+      graphs: saved.subagents?.graphs?.map((graph) => ({
+        ...graph,
+        name: 'Renamed disabled team',
+      })),
+    });
+    await expect(
+      reopened
+        .getByRole('listitem')
+        .filter({ has: page.getByText('Subagent Graphs', { exact: true }) }),
+    ).toHaveCount(0);
   } finally {
     await cleanupAgent(page, parent?.id);
     await cleanupAgent(page, child.id);

From 7abc1672a00e99aff5db9d8622bfc2c43ff380e9 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 04:13:19 +0000
Subject: [PATCH 06/12] fix: gate graph file sharing by deployment capabilities

---
 .../services/Endpoints/agents/initialize.js   |   1 +
 packages/api/src/agents/files/host.spec.ts    | 112 +++++++-
 packages/api/src/agents/files/host.ts         |   1 +
 packages/api/src/agents/files/session.spec.ts | 266 +++++++++++++++++-
 packages/api/src/agents/files/session.ts      |  15 +-
 5 files changed, 376 insertions(+), 19 deletions(-)

diff --git a/api/server/services/Endpoints/agents/initialize.js b/api/server/services/Endpoints/agents/initialize.js
index 6205b60053e..04819d4d43d 100644
--- a/api/server/services/Endpoints/agents/initialize.js
+++ b/api/server/services/Endpoints/agents/initialize.js
@@ -1369,6 +1369,7 @@ const initializeClientWithProvider = async ({
           requestFiles,
           authorizedRunFiles: getAuthorizedRunFileSnapshot({
             policy: appConfig.endpoints?.agents?.fileSharing,
+            capabilities: [...enabledCapabilities],
             agent: primaryConfig,
             files: primaryConfig.currentRequestAttachments,
           }),
diff --git a/packages/api/src/agents/files/host.spec.ts b/packages/api/src/agents/files/host.spec.ts
index 46c1d631af8..d4ca578c68a 100644
--- a/packages/api/src/agents/files/host.spec.ts
+++ b/packages/api/src/agents/files/host.spec.ts
@@ -6,7 +6,7 @@ import {
   FileSources,
   configSchema,
 } from 'librechat-data-provider';
-import type { Agent, CodeEnvRef, TFile } from 'librechat-data-provider';
+import type { Agent, AgentSubagentsConfig, CodeEnvRef, TFile } from 'librechat-data-provider';
 import type { SubagentExecutionContext } from '@librechat/agents';
 import type { ProvisionCallbackDeps } from '~/files/provision/callback';
 import type { RunFileSessionDeps } from './session';
@@ -68,15 +68,29 @@ function deferred<T>() {
   return { promise, resolve, reject };
 }
 
-function harness(options: { inputs?: TFile[]; setup?: TFile[] } = {}) {
+function harness(
+  options: {
+    inputs?: TFile[];
+    setup?: TFile[];
+    capabilities?: string[];
+    parentSubagents?: AgentSubagentsConfig;
+    maxFiles?: number;
+  } = {},
+) {
   const input = options.inputs ?? [file('input')];
   const setup = options.setup ?? [file('worker-setup', { context: FileContext.agents })];
   const parsed = configSchema.parse({
     version: '1.3.9',
     endpoints: {
       agents: {
-        capabilities: [AgentCapabilities.context],
-        fileSharing: { enabled: true },
+        capabilities: options.capabilities ?? [
+          AgentCapabilities.context,
+          AgentCapabilities.subagents,
+        ],
+        fileSharing: {
+          enabled: true,
+          ...(options.maxFiles != null && { maxFiles: options.maxFiles }),
+        },
       },
     },
   });
@@ -98,7 +112,10 @@ function harness(options: { inputs?: TFile[]; setup?: TFile[] } = {}) {
               file_search: { file_ids: setup.map((entry) => entry.file_id) },
             }
           : undefined,
-      subagents: { enabled: true, shareFiles: true, allowSelf: false, agent_ids: ['worker'] },
+      subagents:
+        id === 'parent' && options.parentSubagents != null
+          ? options.parentSubagents
+          : { enabled: true, shareFiles: true, allowSelf: false, agent_ids: ['worker'] },
     }) as Agent;
   const contexts = new Map<string, RunFileToolContext>(
     ['parent', 'worker'].map((id) => [
@@ -887,3 +904,88 @@ describe('run file execution host', () => {
     expect(h.loadFiles).not.toHaveBeenCalled();
   });
 });
+
+it('the production host applies request capabilities before touching retained graph-sharing inputs', async () => {
+  const parentSubagents = {
+    enabled: false,
+    graphsEnabled: true,
+    shareFiles: true,
+    allowSelf: false,
+    graphs: [
+      {
+        type: 'team',
+        name: 'Team',
+        description: 'Work',
+        agent_ids: ['worker'],
+        edges: [],
+        entry_agent_id: 'worker',
+        result_agent_id: 'worker',
+      },
+    ],
+  };
+  const {
+    host,
+    deps,
+    contexts,
+    input,
+    loadFiles,
+    filterFiles,
+    listPublications,
+    provisionToCodeEnv,
+    publish,
+    encodeMessages,
+  } = harness({
+    inputs: [file('first'), file('second')],
+    maxFiles: 1,
+    capabilities: [AgentCapabilities.context, AgentCapabilities.subagents],
+    parentSubagents,
+  });
+  try {
+    expect(deps.capabilities).toEqual([AgentCapabilities.context, AgentCapabilities.subagents]);
+    expect(host.session.isActive()).toBe(false);
+    expect(contexts.get('parent')?.agent?.subagents).toEqual(parentSubagents);
+    expect(input).toHaveLength(2);
+    for (const callback of [
+      loadFiles,
+      filterFiles,
+      listPublications,
+      provisionToCodeEnv,
+      publish,
+      encodeMessages,
+    ])
+      expect(callback).not.toHaveBeenCalled();
+  } finally {
+    await host.session.close();
+  }
+});
+
+it('the production host enables graph-only sharing only with the graph capability', async () => {
+  const parentSubagents = {
+    enabled: false,
+    graphsEnabled: true,
+    shareFiles: true,
+    allowSelf: false,
+    graphs: [
+      {
+        type: 'team',
+        name: 'Team',
+        description: 'Work',
+        agent_ids: ['worker'],
+        edges: [],
+        entry_agent_id: 'worker',
+        result_agent_id: 'worker',
+      },
+    ],
+  };
+  const { host, prepare, contexts } = harness({
+    capabilities: [AgentCapabilities.context, AgentCapabilities.subagent_graphs],
+    parentSubagents,
+  });
+  try {
+    expect(host.session.isActive()).toBe(true);
+    await expect(prepare()).resolves.toHaveProperty('agentSessions.worker');
+    expect(contexts.get('parent')?.agent?.subagents).toEqual(parentSubagents);
+  } finally {
+    await host.session.close();
+  }
+});
diff --git a/packages/api/src/agents/files/host.ts b/packages/api/src/agents/files/host.ts
index b1b140e254b..6d807cb13e1 100644
--- a/packages/api/src/agents/files/host.ts
+++ b/packages/api/src/agents/files/host.ts
@@ -159,6 +159,7 @@ export function createRunFileHost<TContext extends RunFileToolContext>({
   }
   const session = createRunFileSession({
     policy: req.config?.endpoints?.agents?.fileSharing,
+    capabilities: req.config?.endpoints?.agents?.capabilities ?? [],
     userId: user.id,
     tenantId: user.tenantId,
     createdAt,
diff --git a/packages/api/src/agents/files/session.spec.ts b/packages/api/src/agents/files/session.spec.ts
index 9a01735a096..f44c8bc64e9 100644
--- a/packages/api/src/agents/files/session.spec.ts
+++ b/packages/api/src/agents/files/session.spec.ts
@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
-import { FileContext, FileSources } from 'librechat-data-provider';
+import { AgentCapabilities, FileContext, FileSources } from 'librechat-data-provider';
+import type { AgentSubagentsConfig, TFile } from 'librechat-data-provider';
 import type { SubagentExecutionContext } from '@librechat/agents';
-import type { TFile } from 'librechat-data-provider';
 import type { RunArtifactDescriptor } from '~/files/code/publication';
 import type { RunFileSessionDeps } from './session';
 import type { ServerRequest } from '~/types';
@@ -16,6 +16,12 @@ function setup(
     signal?: AbortSignal;
     ttlMs?: number;
     inputs?: TFile[];
+    capabilities?: readonly string[];
+    subagents?: AgentSubagentsConfig;
+    agents?: Record<string, AgentSubagentsConfig>;
+    maxFiles?: number;
+    allowSiblingSharing?: boolean;
+    deferActivation?: boolean;
     validateMessages?: RunFileSessionDeps['validateMessages'];
     encodeMessages?: RunFileSessionDeps['encodeMessages'];
   } = {},
@@ -48,20 +54,23 @@ function setup(
   const read = jest.fn(async () => saved);
   const prepared = jest.fn(async () => undefined);
   const emit = jest.fn(async () => undefined);
+  const getInputs = jest.fn(() => options.inputs ?? []);
   const session = createRunFileSession({
+    capabilities: options.capabilities ?? [AgentCapabilities.subagents],
     userId: 'user',
     createdAt: Date.now(),
     policy: {
       enabled: true,
-      allowSiblingSharing: false,
-      maxFiles: 20,
+      allowSiblingSharing: options.allowSiblingSharing ?? false,
+      maxFiles: options.maxFiles ?? 20,
       maxPrivateBytes: 268_435_456,
       ttlMs: options.ttlMs ?? 60_000,
     },
     snapshots,
-    getInputs: () => options.inputs ?? [],
+    getInputs,
     inputFileIds: new Set(options.inputs?.map((file) => file.file_id)),
     getAgent: (id) => {
+      if (options.agents?.[id]) return { id, subagents: options.agents[id] };
       if (id === 'writer') {
         return { id, subagents: { enabled: true, allowSelf: false, agent_ids: ['reader'] } };
       }
@@ -69,7 +78,7 @@ function setup(
         id,
         subagents:
           id === 'parent'
-            ? {
+            ? (options.subagents ?? {
                 enabled: subagentsEnabled,
                 allowSelf: false,
                 shareFiles: true,
@@ -84,7 +93,7 @@ function setup(
                     edges: [{ from: 'reader', to: 'writer', edgeType: 'direct' }],
                   },
                 ],
-              }
+              })
             : undefined,
       };
     },
@@ -142,9 +151,10 @@ function setup(
     signal: new AbortController().signal,
     resumed: false,
   };
-  session.activate('run', 'conversation', ['parent'], options.signal);
+  if (!options.deferActivation) session.activate('run', 'conversation', ['parent'], options.signal);
   return {
     session,
+    getInputs,
     saved,
     context,
     preparation,
@@ -303,6 +313,7 @@ it('keeps a retained sharing preference inactive while the master subagent setti
   expect(read).not.toHaveBeenCalled();
   expect(
     getAuthorizedRunFileSnapshot({
+      capabilities: [AgentCapabilities.subagents],
       policy: {
         enabled: true,
         allowSiblingSharing: false,
@@ -631,3 +642,242 @@ it('restores published references without advertising stale private outputs on r
   await session.close();
   await expect(session.list('parent')).rejects.toThrow('expired');
 });
+
+const fileCapabilityMatrix = [
+  { name: 'ordinary', value: [AgentCapabilities.subagents] },
+  { name: 'graphs', value: [AgentCapabilities.subagent_graphs] },
+  { name: 'both', value: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs] },
+  { name: 'neither', value: [] },
+].flatMap(({ name, value }) =>
+  [false, true].flatMap((enabled) =>
+    [undefined, false, true].map((graphsEnabled) => ({
+      name,
+      capabilities: value,
+      enabled,
+      graphsEnabled,
+    })),
+  ),
+);
+
+it.each(fileCapabilityMatrix)(
+  'gates snapshots and activation with $name capabilities, ordinary=$enabled, graphs=$graphsEnabled',
+  async ({ capabilities, enabled, graphsEnabled }) => {
+    const subagents = {
+      enabled,
+      graphsEnabled,
+      allowSelf: false,
+      shareFiles: true,
+      agent_ids: ['writer'],
+      graphs: [
+        {
+          type: 'team',
+          name: 'Team',
+          description: 'Work',
+          agent_ids: ['reader'],
+          entry_agent_id: 'reader',
+          result_agent_id: 'reader',
+          edges: [],
+        },
+      ],
+    };
+    const expected =
+      (enabled && capabilities.includes(AgentCapabilities.subagents)) ||
+      ((graphsEnabled ?? enabled) &&
+        capabilities.includes(
+          graphsEnabled == null ? AgentCapabilities.subagents : AgentCapabilities.subagent_graphs,
+        ));
+    const { session, getInputs, prepared, read } = setup(enabled, { capabilities, subagents });
+    try {
+      expect(session.isActive()).toBe(expected);
+      expect(getInputs).toHaveBeenCalledTimes(expected ? 1 : 0);
+      expect(read).not.toHaveBeenCalled();
+      expect(prepared).not.toHaveBeenCalled();
+      expect(
+        getAuthorizedRunFileSnapshot({
+          capabilities,
+          agent: { subagents },
+          files: [],
+          policy: {
+            enabled: true,
+            allowSiblingSharing: false,
+            maxFiles: 1,
+            maxPrivateBytes: 100,
+            ttlMs: 60000,
+          },
+        }),
+      ).toEqual(expected ? [] : undefined);
+    } finally {
+      await session.close();
+    }
+  },
+);
+
+it('disabled graph-only sharing cannot impose manifest limits on ordinary attachments', async () => {
+  const inputs: TFile[] = ['first', 'second'].map((file_id) => ({
+    file_id,
+    filename: `${file_id}.txt`,
+    type: 'text/plain',
+    bytes: 1,
+    user: 'user',
+    embedded: false,
+    filepath: `/files/${file_id}`,
+    object: 'file',
+    usage: 0,
+    source: FileSources.local,
+  }));
+  const subagents = { enabled: false, graphsEnabled: true, shareFiles: true, allowSelf: false };
+  const disabled = setup(false, {
+    capabilities: [AgentCapabilities.subagents],
+    subagents,
+    inputs,
+    maxFiles: 1,
+    deferActivation: true,
+  });
+  const enabled = setup(false, {
+    capabilities: [AgentCapabilities.subagent_graphs],
+    subagents,
+    inputs,
+    maxFiles: 1,
+    deferActivation: true,
+  });
+  try {
+    expect(disabled.session.activate('run', 'conversation', ['parent'])).toBe(false);
+    expect(disabled.getInputs).not.toHaveBeenCalled();
+    expect(disabled.read).not.toHaveBeenCalled();
+    expect(disabled.prepared).not.toHaveBeenCalled();
+    expect(() => enabled.session.activate('run', 'conversation', ['parent'])).toThrow(
+      'configured file limit',
+    );
+  } finally {
+    await disabled.session.close();
+    await enabled.session.close();
+  }
+});
+
+it.each([false, true])(
+  'nested stored graph recipients follow their own capability, enabled=%s',
+  async (graphsAllowed) => {
+    const capabilities = graphsAllowed
+      ? [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs]
+      : [AgentCapabilities.subagents];
+    const { session, context, preparation, prepared } = setup(true, {
+      capabilities,
+      subagents: { enabled: true, allowSelf: false, shareFiles: true, agent_ids: ['writer'] },
+      agents: {
+        writer: {
+          enabled: false,
+          graphsEnabled: true,
+          allowSelf: false,
+          agent_ids: ['forbidden-single'],
+          graphs: [
+            {
+              type: 'nested',
+              name: 'Nested',
+              description: 'Work',
+              agent_ids: ['reader'],
+              entry_agent_id: 'reader',
+              result_agent_id: 'reader',
+              edges: [],
+            },
+          ],
+        },
+      },
+    });
+    try {
+      await session.prepare({ ...preparation, memberAgentIds: ['writer'] });
+      const nested: SubagentExecutionContext = {
+        ...context,
+        depth: 2,
+        ancestry: [
+          ...context.ancestry,
+          {
+            subagentRunId: 'nested-team',
+            subagentType: 'nested',
+            subagentKind: 'graph',
+            subagentAgentId: 'reader',
+            parentRunId: 'child-team',
+            parentAgentId: 'writer',
+            parentToolCallId: 'nested-spawn',
+          },
+        ],
+      };
+      const invocation = {
+        ...preparation,
+        executionContext: nested,
+        memberAgentIds: ['reader'],
+        resumed: true,
+      };
+      if (graphsAllowed)
+        await expect(session.prepare(invocation)).resolves.toMatchObject({
+          messages: [],
+          agentSessions: { reader: expect.anything() },
+        });
+      else {
+        await expect(session.prepare(invocation)).rejects.toThrow('not authorized this child');
+        expect(prepared).toHaveBeenCalledTimes(1);
+      }
+      await expect(
+        session.prepare({
+          ...invocation,
+          executionContext: {
+            ...nested,
+            ancestry: [
+              ...context.ancestry,
+              {
+                ...nested.ancestry[1],
+                subagentRunId: 'forbidden',
+                subagentAgentId: 'forbidden-single',
+              },
+            ],
+          },
+          memberAgentIds: ['forbidden-single'],
+        }),
+      ).rejects.toThrow('not authorized this child');
+    } finally {
+      await session.close();
+    }
+  },
+);
+
+it('disabled graph targets are not granted publication recipient authority', async () => {
+  const { session, context, preparation, saved, snapshots } = setup(true, {
+    capabilities: [AgentCapabilities.subagents],
+    allowSiblingSharing: true,
+    subagents: {
+      enabled: true,
+      allowSelf: false,
+      shareFiles: true,
+      agent_ids: ['writer'],
+      graphsEnabled: true,
+      graphs: [
+        {
+          type: 'team',
+          name: 'Team',
+          description: 'Work',
+          agent_ids: ['disabled-member'],
+          entry_agent_id: 'disabled-member',
+          result_agent_id: 'disabled-member',
+          edges: [],
+        },
+      ],
+    },
+  });
+  try {
+    await session.prepare({ ...preparation, memberAgentIds: ['writer'] });
+    await session.capture('writer', context, 'code-call', {
+      session_id: 'writer-session',
+      files: [{ id: 'output', name: 'results.csv' }],
+    });
+    const artifact = (await session.list('writer', context)).artifacts[0];
+    await expect(
+      session.publish('writer', context, artifact.artifact_id, ['disabled-member']),
+    ).rejects.toThrow('does not authorize');
+    expect(saved).toHaveLength(0);
+    expect(snapshots.discard).not.toHaveBeenCalled();
+    await expect(session.publish('writer', context, artifact.artifact_id)).resolves.toHaveProperty(
+      'file_id',
+    );
+  } finally {
+    await session.close();
+  }
+});
diff --git a/packages/api/src/agents/files/session.ts b/packages/api/src/agents/files/session.ts
index 4b2ae937631..4afd6f16b1a 100644
--- a/packages/api/src/agents/files/session.ts
+++ b/packages/api/src/agents/files/session.ts
@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { HumanMessage } from '@librechat/agents/langchain';
-import { isSubagentGraphsEnabled, resolveSubagents } from 'librechat-data-provider';
+import { resolveSubagents } from 'librechat-data-provider';
 import type { Agent, RunFileProvenance, TFile, TAgentsEndpoint } from 'librechat-data-provider';
 import type { SubagentExecutionContext } from '@librechat/agents';
 import type { BaseMessage } from '@librechat/agents/langchain';
@@ -26,16 +26,17 @@ export interface SharedRunArtifact {
 
 export function getAuthorizedRunFileSnapshot({
   policy,
+  capabilities,
   agent,
   files,
 }: {
   policy?: TAgentsEndpoint['fileSharing'];
+  capabilities: readonly string[];
   agent: Pick<Agent, 'subagents'>;
   files: readonly TFile[];
 }): readonly TFile[] | undefined {
-  return policy?.enabled === true &&
-    (agent.subagents?.enabled === true || isSubagentGraphsEnabled(agent.subagents)) &&
-    agent.subagents?.shareFiles === true
+  const subagents = resolveSubagents(agent.subagents, capabilities);
+  return policy?.enabled === true && subagents?.enabled === true && subagents.shareFiles === true
     ? files
     : undefined;
 }
@@ -49,6 +50,8 @@ export interface RunFilePreparation {
 
 export interface RunFileSessionDeps {
   policy?: TAgentsEndpoint['fileSharing'];
+  /** Request-scoped deployment gates, applied to stored root and descendant settings. */
+  capabilities: readonly string[];
   userId: string;
   tenantId?: string;
   createdAt: number;
@@ -174,7 +177,7 @@ export function createRunFileSession(deps: RunFileSessionDeps): RunFileSession {
     const allowed = new Set<string>();
     for (const id of agentIds) {
       const agent = deps.getAgent(id);
-      const subagents = resolveSubagents(agent?.subagents);
+      const subagents = resolveSubagents(agent?.subagents, deps.capabilities);
       if (!subagents?.enabled) continue;
       if (subagents.allowSelf !== false) allowed.add(id);
       for (const childId of subagents.agent_ids ?? []) allowed.add(childId);
@@ -192,7 +195,7 @@ export function createRunFileSession(deps: RunFileSessionDeps): RunFileSession {
     signal?: AbortSignal,
   ): boolean {
     const root = deps.getAgent(agentIds[0]);
-    const rootSubagents = resolveSubagents(root?.subagents);
+    const rootSubagents = resolveSubagents(root?.subagents, deps.capabilities);
     if (
       deps.policy?.enabled !== true ||
       rootSubagents?.enabled !== true ||

From 53f0f9e65ade2a130f12b355afe611ae5086ee81 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 04:24:50 +0000
Subject: [PATCH 07/12] fix: preserve graph choices in management API responses

---
 packages/api/openapi/agents.openapi.json   |  6 +++
 packages/api/src/agents/creates.spec.ts    | 39 ++++++++++++++
 packages/api/src/agents/management.spec.ts | 59 ++++++++++++++++++++++
 packages/api/src/agents/management.ts      |  2 +
 packages/api/src/agents/reads.spec.ts      | 49 ++++++++++++++++++
 packages/api/src/agents/updates.spec.ts    | 39 ++++++++++++++
 6 files changed, 194 insertions(+)

diff --git a/packages/api/openapi/agents.openapi.json b/packages/api/openapi/agents.openapi.json
index 8d47df0f579..47b20bceebf 100644
--- a/packages/api/openapi/agents.openapi.json
+++ b/packages/api/openapi/agents.openapi.json
@@ -3244,9 +3244,15 @@
               "enabled": {
                 "type": "boolean"
               },
+              "graphsEnabled": {
+                "type": "boolean"
+              },
               "allowSelf": {
                 "type": "boolean"
               },
+              "shareFiles": {
+                "type": "boolean"
+              },
               "agent_ids": {
                 "type": "array",
                 "items": {
diff --git a/packages/api/src/agents/creates.spec.ts b/packages/api/src/agents/creates.spec.ts
index 32f6316b37a..79dfe3bc350 100644
--- a/packages/api/src/agents/creates.spec.ts
+++ b/packages/api/src/agents/creates.spec.ts
@@ -184,3 +184,42 @@ describe('Agent Management create handler', () => {
     });
   });
 });
+
+it.each([false, true])(
+  'creation projects a saved independent graph flag without returning 500: %s',
+  async (graphsEnabled) => {
+    const subagents = {
+      enabled: false,
+      graphsEnabled,
+      allowSelf: false,
+      shareFiles: true,
+      agent_ids: [],
+      graphs: [
+        {
+          type: 'review',
+          name: 'Review',
+          description: 'Review work',
+          agent_ids: ['member'],
+          edges: [],
+          entry_agent_id: 'member',
+          result_agent_id: 'member',
+        },
+      ],
+    };
+    const deps = makeDeps({
+      createAgent: jest.fn(async (_req: Request, res: Response) =>
+        res.status(201).json({ ...createdAgent, subagents }),
+      ),
+    });
+    const request = makeRequest({ body: { ...validBody, subagents } });
+    const response = makeResponse();
+    await createAgentManagementCreateHandler(deps)(request, response);
+    expect(deps.createAgent).toHaveBeenCalledTimes(1);
+    expect(request.body.subagents).toEqual(subagents);
+    expect(response.status).toHaveBeenCalledWith(201);
+    expect(response.status).not.toHaveBeenCalledWith(500);
+    expect(response.json).toHaveBeenCalledWith(
+      expect.objectContaining({ id: createdAgent.id, subagents }),
+    );
+  },
+);
diff --git a/packages/api/src/agents/management.spec.ts b/packages/api/src/agents/management.spec.ts
index bb6535b9826..f0e03750756 100644
--- a/packages/api/src/agents/management.spec.ts
+++ b/packages/api/src/agents/management.spec.ts
@@ -338,3 +338,62 @@ describe('Agent Management contract', () => {
     });
   });
 });
+
+describe('graph team management contract parity', () => {
+  const team = {
+    type: 'review',
+    name: 'Review',
+    description: 'Review work',
+    agent_ids: ['member'],
+    edges: [],
+    entry_agent_id: 'member',
+    result_agent_id: 'member',
+  };
+  const cases = [undefined, false, true].flatMap((graphsEnabled) =>
+    [false, true].flatMap((enabled) =>
+      [false, true].map((shareFiles) => ({ graphsEnabled, enabled, shareFiles })),
+    ),
+  );
+  it.each(cases)(
+    'preserves saved graph choices through every public schema: %j',
+    ({ graphsEnabled, enabled, shareFiles }) => {
+      const subagents = {
+        enabled,
+        ...(graphsEnabled != null && { graphsEnabled }),
+        allowSelf: false,
+        shareFiles,
+        agent_ids: [],
+        graphs: [team],
+      };
+      const created = agentManagementCreateSchema.parse({
+        provider: 'openAI',
+        model: 'gpt-5',
+        subagents,
+      });
+      const updated = agentManagementUpdateSchema.parse({ subagents });
+      expect(created.subagents).toEqual(subagents);
+      expect(updated.subagents).toEqual(subagents);
+      const saved = { ...persistedAgent, subagents };
+      const response = projectAgentManagementResponse(saved);
+      expect(response.subagents).toEqual(subagents);
+      expect(agentManagementResponseSchema.parse(response).subagents).toEqual(subagents);
+      const list = projectAgentManagementListResponse({
+        data: [saved],
+        has_more: false,
+        after: null,
+      });
+      expect(agentManagementListResponseSchema.parse(list).data[0].subagents).toEqual(subagents);
+      expect(response).not.toHaveProperty('credentials');
+      expect(response).not.toHaveProperty('author');
+      expect(response).not.toHaveProperty('tenantId');
+    },
+  );
+
+  it('keeps strict output rejection for unknown nested fields', () => {
+    const source = {
+      ...persistedAgent,
+      subagents: { enabled: false, graphsEnabled: false, internalRuntime: 'private' },
+    };
+    expect(() => projectAgentManagementResponse(source)).toThrow(z.ZodError);
+  });
+});
diff --git a/packages/api/src/agents/management.ts b/packages/api/src/agents/management.ts
index d7275ca8099..61c9dbe3dc8 100644
--- a/packages/api/src/agents/management.ts
+++ b/packages/api/src/agents/management.ts
@@ -175,7 +175,9 @@ const agentManagementGraphResponseSchema: z.ZodType<AgentSubagentGraph> = z
 const agentManagementSubagentsResponseSchema: z.ZodType<AgentSubagentsConfig | undefined> = z
   .object({
     enabled: z.boolean().optional(),
+    graphsEnabled: z.boolean().optional(),
     allowSelf: z.boolean().optional(),
+    shareFiles: z.boolean().optional(),
     agent_ids: z.array(z.string()).optional(),
     graphs: z.array(agentManagementGraphResponseSchema).optional(),
   })
diff --git a/packages/api/src/agents/reads.spec.ts b/packages/api/src/agents/reads.spec.ts
index cc6e6d4fe7e..a25f1920b3c 100644
--- a/packages/api/src/agents/reads.spec.ts
+++ b/packages/api/src/agents/reads.spec.ts
@@ -320,3 +320,52 @@ describe('Agent Management read handlers', () => {
     expect(deps.findAccessibleResources).not.toHaveBeenCalled();
   });
 });
+
+it.each([false, true])(
+  'GET and list project graph-enabled=%s saved agents without response validation failures',
+  async (graphsEnabled) => {
+    const subagents = {
+      enabled: false,
+      graphsEnabled,
+      shareFiles: true,
+      allowSelf: false,
+      agent_ids: [],
+      graphs: [
+        {
+          type: 'review',
+          name: 'Review',
+          description: 'Review work',
+          agent_ids: ['member'],
+          edges: [],
+          entry_agent_id: 'member',
+          result_agent_id: 'member',
+        },
+      ],
+    };
+    const saved = { ...agent, subagents };
+    const deps = makeDeps({
+      getAgentWithVersionCount: jest.fn().mockResolvedValue(saved),
+      getAgentManagementListByAccess: jest
+        .fn()
+        .mockResolvedValue({ data: [saved], has_more: false, after: null }),
+    });
+    const handlers = createAgentManagementReadHandlers(deps);
+    const getResponse = makeResponse();
+    await handlers.get(makeRequest({ params: { id: agent.id } }), getResponse);
+    expect(getResponse.status).toHaveBeenCalledWith(200);
+    expect(getResponse.status).not.toHaveBeenCalledWith(500);
+    expect(getResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({ id: agent.id, subagents }),
+    );
+    const listResponse = makeResponse();
+    await handlers.list(makeRequest(), listResponse);
+    expect(listResponse.status).toHaveBeenCalledWith(200);
+    expect(listResponse.status).not.toHaveBeenCalledWith(500);
+    expect(listResponse.json).toHaveBeenCalledWith(
+      expect.objectContaining({
+        object: 'list',
+        data: [expect.objectContaining({ id: agent.id, subagents })],
+      }),
+    );
+  },
+);
diff --git a/packages/api/src/agents/updates.spec.ts b/packages/api/src/agents/updates.spec.ts
index f7815c008c8..f5fd7221c82 100644
--- a/packages/api/src/agents/updates.spec.ts
+++ b/packages/api/src/agents/updates.spec.ts
@@ -230,3 +230,42 @@ describe('Agent Management update handler', () => {
     });
   });
 });
+
+it.each([false, true])(
+  'updates project the saved graph enablement choice after commit: %s',
+  async (graphsEnabled) => {
+    const subagents = {
+      enabled: false,
+      graphsEnabled,
+      shareFiles: true,
+      allowSelf: false,
+      agent_ids: [],
+      graphs: [
+        {
+          type: 'review',
+          name: 'Review',
+          description: 'Review work',
+          agent_ids: ['member'],
+          edges: [],
+          entry_agent_id: 'member',
+          result_agent_id: 'member',
+        },
+      ],
+    };
+    const deps = makeDeps({
+      updateAgent: jest.fn(async (_req: Request, res: Response) =>
+        res.json({ ...updatedAgent, subagents }),
+      ),
+    });
+    const request = makeRequest({ body: { subagents } });
+    const response = makeResponse();
+    await createAgentManagementUpdateHandler(deps)(request, response);
+    expect(deps.updateAgent).toHaveBeenCalledTimes(1);
+    expect(request.body.subagents).toEqual(subagents);
+    expect(response.status).toHaveBeenCalledWith(200);
+    expect(response.status).not.toHaveBeenCalledWith(500);
+    expect(response.json).toHaveBeenCalledWith(
+      expect.objectContaining({ id: existingAgent.id, subagents }),
+    );
+  },
+);

From 9958b459abdb3d94d9e20b71f8c4deefcb5a2527 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 19:43:33 +0000
Subject: [PATCH 08/12] fix: Preserve Graph Capability Choices and Validate
 Draft Limits

---
 .../SidePanel/Agents/Advanced/Graphs.tsx      |  46 ++++++-
 .../Agents/Advanced/__tests__/Graphs.spec.tsx | 122 +++++++++++++++++-
 packages/api/src/agents/validation.ts         |   7 +-
 packages/data-provider/src/config.ts          |   1 -
 .../data-provider/src/subagentGraphs.spec.ts  |  23 +++-
 packages/data-provider/src/subagentGraphs.ts  |   9 ++
 6 files changed, 191 insertions(+), 17 deletions(-)

diff --git a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
index 15b49090150..d72b6fd789b 100644
--- a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
@@ -12,6 +12,10 @@ import {
 } from '@librechat/client';
 import {
   graphSubagentSchema,
+  getSubagentGraphMemberCount,
+  MAX_SUBAGENT_GRAPH_NODES,
+  AgentCapabilities,
+  Tools,
   isSubagentGraphsEnabled,
   MAX_SUBAGENTS,
   MAX_GRAPH_SUBAGENT_MEMBERS,
@@ -36,7 +40,7 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
   const { control, getValues, setValue } = useFormContext<AgentForm>();
   const subagents = useWatch({ control, name: 'subagents' });
   const graphs = subagents?.graphs ?? [];
-  const enabled = isSubagentGraphsEnabled(subagents);
+  const enabled = isSubagentGraphsEnabled(subagents, agentsConfig?.capabilities);
   const maximum = agentsConfig?.maxSubagents ?? MAX_SUBAGENTS;
   const { options, getAgent } = useSelectableAgents({ currentAgentId });
   const portalElement = useContext(AgentPickerPortalContext) ?? undefined;
@@ -50,7 +54,33 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
     id === currentAgentId || id === ''
       ? localize('com_ui_agent_graphs_self')
       : (getAgent(id)?.name ?? id);
-  const write = (next: AgentSubagentGraph[], active: boolean) => {
+  const [codeEnabled, statefulSessions, codeEnvironmentId] = useWatch({
+    control,
+    name: ['execute_code', 'stateful_code_sessions', 'code_environment_id'],
+  });
+  const environments = agentsConfig?.statefulCodeSessions?.environments;
+  const attachedEnvironment = (id?: string) =>
+    (id
+      ? environments?.find((environment) => environment.id === id)
+      : environments?.find((environment) => environment.default === true)
+    )?.type === 'attached';
+  const attachedCode =
+    agentsConfig?.capabilities.includes(AgentCapabilities.stateful_code_sessions) &&
+    ((codeEnabled && statefulSessions && attachedEnvironment(codeEnvironmentId)) ||
+      graphs.some((team) =>
+        team.agent_ids.some((id) => {
+          const member = getAgent(id);
+          return (
+            member?.stateful_code_sessions === true &&
+            member.tools?.includes(Tools.execute_code) &&
+            attachedEnvironment(member.code_environment_id)
+          );
+        }),
+      ));
+  const approvalEnabled =
+    agentsConfig?.toolApproval?.enabled === true ||
+    (agentsConfig?.toolApproval?.enabled !== false && attachedCode);
+  const write = (next: AgentSubagentGraph[], active?: boolean) => {
     const value = getValues('subagents');
     setValue(
       'subagents',
@@ -59,7 +89,7 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
         enabled: value?.enabled ?? false,
         allowSelf: value?.allowSelf ?? true,
         agent_ids: value?.agent_ids ?? [],
-        graphsEnabled: active,
+        ...(active === undefined ? {} : { graphsEnabled: active }),
         graphs: next,
       },
       { shouldDirty: true },
@@ -102,7 +132,11 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
       }
       next.push(parsed.data);
     } else next[draft.index] = parsed.data;
-    write(next, draft.index === null ? true : enabled);
+    if (getSubagentGraphMemberCount({ ...subagents, graphs: next }) > MAX_SUBAGENT_GRAPH_NODES) {
+      setInvalid(true);
+      return;
+    }
+    write(next, draft.index === null ? true : undefined);
     setDraft(null);
   };
   const graph = draft?.graph;
@@ -125,7 +159,7 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
         </CountPill>
       }
     >
-      {agentsConfig?.toolApproval?.enabled === true && (
+      {approvalEnabled && (
         <p role="note" className="text-text-warning text-sm">
           {localize('com_ui_agent_graphs_approvals')}
         </p>
@@ -175,7 +209,7 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
                   onClick={() =>
                     write(
                       graphs.filter((_, i) => i !== index),
-                      enabled,
+                      undefined,
                     )
                   }
                 >
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
index 80bdb979111..c6ca4474398 100644
--- a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
@@ -1,14 +1,19 @@
 import { useForm, FormProvider } from 'react-hook-form';
+import { AgentCapabilities } from 'librechat-data-provider';
 import { render, screen, fireEvent } from '@testing-library/react';
-import type { AgentSubagentsConfig } from 'librechat-data-provider';
+import type { AgentSubagentsConfig, TAgentsEndpoint } from 'librechat-data-provider';
 import type { UseFormReturn } from 'react-hook-form';
 import type { AgentForm } from '~/common';
 import Graphs from '../Graphs';
 
+let mockAgentsConfig: Partial<TAgentsEndpoint> = {
+  maxSubagents: 2,
+  capabilities: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs],
+};
 let mockGetValues: UseFormReturn<AgentForm>['getValues'];
 jest.mock('~/hooks', () => ({ useLocalize: () => (key: string) => key }));
 jest.mock('~/Providers', () => ({
-  useAgentPanelContext: () => ({ agentsConfig: { maxSubagents: 2 } }),
+  useAgentPanelContext: () => ({ agentsConfig: mockAgentsConfig }),
   useAgentsMapContext: () => ({}),
 }));
 const team = {
@@ -27,9 +32,16 @@ const initialSubagents: AgentSubagentsConfig = {
   agent_ids: ['child'],
   graphs: [team],
 };
-function Harness({ subagents = initialSubagents }: { subagents?: AgentSubagentsConfig }) {
+function Harness({
+  subagents = initialSubagents,
+  defaults = {},
+}: {
+  subagents?: AgentSubagentsConfig;
+  defaults?: Partial<AgentForm>;
+}) {
   const methods = useForm<AgentForm>({
     defaultValues: {
+      ...defaults,
       subagents,
       edges: [{ from: 'parent', to: 'handoff', edgeType: 'handoff' }],
     },
@@ -119,3 +131,107 @@ test('removing one disabled team does not activate any remaining definitions', (
   fireEvent.click(screen.getAllByRole('button', { name: 'com_ui_agent_graphs_remove' })[0]);
   expect(mockGetValues('subagents')).toEqual({ ...subagents, graphs: [otherTeam] });
 });
+
+beforeEach(() => {
+  mockAgentsConfig = {
+    maxSubagents: 2,
+    capabilities: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs],
+  };
+});
+
+test.each([
+  { capabilities: [AgentCapabilities.subagent_graphs] },
+  { capabilities: [AgentCapabilities.subagents] },
+  { capabilities: [] },
+])('legacy edits retain the stored capability choice: %j', ({ capabilities }) => {
+  mockAgentsConfig.capabilities = capabilities;
+  const subagents = { enabled: true, allowSelf: false, graphs: [team] };
+  render(<Harness subagents={subagents} />);
+  expect(screen.getByRole('switch')).toHaveAttribute(
+    'aria-checked',
+    String(capabilities.includes(AgentCapabilities.subagents)),
+  );
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_edit' }));
+  fireEvent.change(screen.getByLabelText('com_ui_agent_graphs_name'), {
+    target: { value: 'Renamed' },
+  });
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_save' }));
+  expect(mockGetValues('subagents.graphsEnabled')).toBeUndefined();
+});
+
+const chain = (type: string, start: number, count: number) => {
+  const agent_ids = Array.from({ length: count }, (_, index) => `member-${start + index}`);
+  return {
+    type,
+    name: type,
+    description: 'Work',
+    agent_ids,
+    entry_agent_id: agent_ids[0],
+    result_agent_id: agent_ids[count - 1],
+    edges: agent_ids
+      .slice(1)
+      .map((id, index) => ({ from: agent_ids[index], to: id, edgeType: 'direct' as const })),
+  };
+};
+test.each([49, 50])('validates unique graph members including ordinary targets at %s', (count) => {
+  const first = chain('first', 0, 25);
+  const second = chain('second', 25, count - 25);
+  const subagents = { ...initialSubagents, agent_ids: ['ordinary'], graphs: [first, second] };
+  render(<Harness subagents={subagents} />);
+  fireEvent.click(screen.getAllByRole('button', { name: 'com_ui_agent_graphs_edit' })[1]);
+  fireEvent.change(screen.getByLabelText('com_ui_agent_graphs_name'), {
+    target: { value: 'Changed second' },
+  });
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_save' }));
+  if (count === 50) {
+    expect(screen.getByRole('alert')).toBeVisible();
+    expect(mockGetValues('subagents')).toEqual(subagents);
+  } else expect(mockGetValues('subagents.graphs.1.name')).toBe('Changed second');
+});
+
+test.each([undefined, false, true])(
+  'attached code warning respects effective endpoint enabled=%s',
+  (enabled) => {
+    mockAgentsConfig = {
+      ...mockAgentsConfig,
+      capabilities: [
+        ...(mockAgentsConfig.capabilities ?? []),
+        AgentCapabilities.stateful_code_sessions,
+      ],
+      toolApproval: enabled == null ? undefined : { enabled },
+      statefulCodeSessions: {
+        environments: [{ id: 'attached', type: 'attached', name: 'Machine', default: true }],
+      },
+    };
+    render(<Harness defaults={{ execute_code: true, stateful_code_sessions: true }} />);
+    expect(screen.queryByRole('note') != null).toBe(enabled !== false);
+  },
+);
+
+test('removing a legacy team never promotes remaining definitions to the new capability', () => {
+  mockAgentsConfig.capabilities = [AgentCapabilities.subagent_graphs];
+  const other = { ...team, type: 'other' };
+  const subagents = { enabled: true, graphs: [team, other] };
+  render(<Harness subagents={subagents} />);
+  fireEvent.click(screen.getAllByRole('button', { name: 'com_ui_agent_graphs_remove' })[0]);
+  expect(mockGetValues('subagents.graphsEnabled')).toBeUndefined();
+  expect(mockGetValues('subagents.graphs')).toEqual([other]);
+});
+
+test('managed code does not show an implicit attached approval warning', () => {
+  mockAgentsConfig = {
+    ...mockAgentsConfig,
+    capabilities: [
+      ...(mockAgentsConfig.capabilities ?? []),
+      AgentCapabilities.stateful_code_sessions,
+    ],
+    statefulCodeSessions: {
+      environments: [
+        { id: 'managed', type: 'managed', name: 'Managed', default: true },
+        { id: 'attached', type: 'attached', name: 'Machine' },
+      ],
+    },
+  };
+  render(<Harness defaults={{ execute_code: true, stateful_code_sessions: true }} />);
+  expect(screen.queryByRole('note')).toBeNull();
+});
diff --git a/packages/api/src/agents/validation.ts b/packages/api/src/agents/validation.ts
index 278e5eb0bdc..3d70ecfa608 100644
--- a/packages/api/src/agents/validation.ts
+++ b/packages/api/src/agents/validation.ts
@@ -12,6 +12,7 @@ import {
   ErrorTypes,
   MAX_SUBAGENT_GRAPH_NODES,
   graphSubagentSchema,
+  getSubagentGraphMemberCount,
 } from 'librechat-data-provider';
 import type {
   Agent,
@@ -211,7 +212,6 @@ export const agentSubagentsSchema: z.ZodOptional<z.ZodType<AgentSubagentsConfig>
       });
     }
     const reservedTypes = new Set(subagents.agent_ids ?? []);
-    const configuredAgentIds = new Set(subagents.agent_ids ?? []);
     if (subagents.allowSelf !== false) {
       reservedTypes.add('self');
     }
@@ -228,11 +228,8 @@ export const agentSubagentsSchema: z.ZodOptional<z.ZodType<AgentSubagentsConfig>
         });
       }
       reservedTypes.add(graph.type);
-      for (const agentId of graph.agent_ids) {
-        configuredAgentIds.add(agentId);
-      }
     }
-    if (configuredAgentIds.size > MAX_SUBAGENT_GRAPH_NODES) {
+    if (getSubagentGraphMemberCount(subagents) > MAX_SUBAGENT_GRAPH_NODES) {
       ctx.addIssue({
         code: z.ZodIssueCode.custom,
         message: `Subagent configuration exceeds the maximum of ${MAX_SUBAGENT_GRAPH_NODES} unique agents`,
diff --git a/packages/data-provider/src/config.ts b/packages/data-provider/src/config.ts
index a7b453a91ea..08a80be3ede 100644
--- a/packages/data-provider/src/config.ts
+++ b/packages/data-provider/src/config.ts
@@ -885,7 +885,6 @@ export const defaultAgentCapabilities = [
   AgentCapabilities.web_search,
   AgentCapabilities.artifacts,
   AgentCapabilities.subagents,
-  AgentCapabilities.subagent_graphs,
   AgentCapabilities.actions,
   AgentCapabilities.context,
   AgentCapabilities.skills,
diff --git a/packages/data-provider/src/subagentGraphs.spec.ts b/packages/data-provider/src/subagentGraphs.spec.ts
index 5712508c9d5..f1d83d2bf9c 100644
--- a/packages/data-provider/src/subagentGraphs.spec.ts
+++ b/packages/data-provider/src/subagentGraphs.spec.ts
@@ -1,6 +1,11 @@
 import type { AgentSubagentGraph, AgentSubagentsConfig } from './types/agents';
-import { graphSubagentSchema, isSubagentGraphsEnabled, resolveSubagents } from './subagentGraphs';
-import { AgentCapabilities } from './config';
+import {
+  getSubagentGraphMemberCount,
+  graphSubagentSchema,
+  isSubagentGraphsEnabled,
+  resolveSubagents,
+} from './subagentGraphs';
+import { AgentCapabilities, defaultAgentCapabilities } from './config';
 
 const graph: AgentSubagentGraph = {
   type: 'review',
@@ -143,3 +148,17 @@ test('a new graph capability never authorizes untouched legacy teams', () => {
     resolveSubagents({ ...legacy, graphsEnabled: true }, [AgentCapabilities.subagent_graphs]),
   ).toMatchObject({ enabled: true, graphs: [graph], agent_ids: [], allowSelf: false });
 });
+
+test('graph teams remain an explicit deployment capability', () => {
+  expect(defaultAgentCapabilities).not.toContain(AgentCapabilities.subagent_graphs);
+  expect(defaultAgentCapabilities).toContain(AgentCapabilities.subagents);
+});
+
+test('counts unique stored targets across ordinary and graph definitions', () => {
+  expect(
+    getSubagentGraphMemberCount({
+      agent_ids: ['entry', 'ordinary'],
+      graphs: [graph, { ...graph, type: 'second' }],
+    }),
+  ).toBe(5);
+});
diff --git a/packages/data-provider/src/subagentGraphs.ts b/packages/data-provider/src/subagentGraphs.ts
index 7431a4b7843..164c590c551 100644
--- a/packages/data-provider/src/subagentGraphs.ts
+++ b/packages/data-provider/src/subagentGraphs.ts
@@ -159,6 +159,15 @@ export const graphSubagentSchema: z.ZodType<AgentSubagentGraph> = z
     }
   });
 
+/** Unique stored targets across ordinary subagents and every graph team. */
+export function getSubagentGraphMemberCount(config: AgentSubagentsConfig): number {
+  const members = new Set(config.agent_ids ?? []);
+  for (const graph of config.graphs ?? []) {
+    for (const id of graph.agent_ids) members.add(id);
+  }
+  return members.size;
+}
+
 /** Legacy teams retain the ordinary subagents gate until a graph-specific choice is saved. */
 export function isSubagentGraphsEnabled(
   config?: Pick<AgentSubagentsConfig, 'enabled' | 'graphsEnabled'> | null,

From 2b87550c7a524aa32e8c30ccaaa4945de69ba6a9 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 19:51:45 +0000
Subject: [PATCH 09/12] fix: Handle Nullable Graph Code Environments

---
 .../SidePanel/Agents/Advanced/Graphs.tsx      |  2 +-
 .../Agents/Advanced/__tests__/Graphs.spec.tsx | 30 +++++++++++++++++--
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
index d72b6fd789b..2025be29de1 100644
--- a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
@@ -59,7 +59,7 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
     name: ['execute_code', 'stateful_code_sessions', 'code_environment_id'],
   });
   const environments = agentsConfig?.statefulCodeSessions?.environments;
-  const attachedEnvironment = (id?: string) =>
+  const attachedEnvironment = (id?: string | null) =>
     (id
       ? environments?.find((environment) => environment.id === id)
       : environments?.find((environment) => environment.default === true)
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
index c6ca4474398..89ca96483d2 100644
--- a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
@@ -200,7 +200,17 @@ test.each([undefined, false, true])(
       ],
       toolApproval: enabled == null ? undefined : { enabled },
       statefulCodeSessions: {
-        environments: [{ id: 'attached', type: 'attached', name: 'Machine', default: true }],
+        allowedEnvironments: ['user', 'agent-user', 'conversation'],
+        environments: [
+          {
+            id: 'attached',
+            type: 'attached',
+            name: 'Machine',
+            owner: 'principal',
+            baseURL: 'https://example.invalid',
+            default: true,
+          },
+        ],
       },
     };
     render(<Harness defaults={{ execute_code: true, stateful_code_sessions: true }} />);
@@ -226,9 +236,23 @@ test('managed code does not show an implicit attached approval warning', () => {
       AgentCapabilities.stateful_code_sessions,
     ],
     statefulCodeSessions: {
+      allowedEnvironments: ['user', 'agent-user', 'conversation'],
       environments: [
-        { id: 'managed', type: 'managed', name: 'Managed', default: true },
-        { id: 'attached', type: 'attached', name: 'Machine' },
+        {
+          id: 'managed',
+          type: 'managed',
+          name: 'Managed',
+          owner: 'deployment',
+          baseURL: 'https://example.invalid',
+          default: true,
+        },
+        {
+          id: 'attached',
+          type: 'attached',
+          name: 'Machine',
+          owner: 'principal',
+          baseURL: 'https://example.invalid',
+        },
       ],
     },
   };

From 9622248d461f80f7e5fd01ddbcf14cb33402aabe Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 20:10:40 +0000
Subject: [PATCH 10/12] fix: Warn for Attached Orchestration Descendants

---
 .../SidePanel/Agents/Advanced/Graphs.tsx      |  89 ++++++---
 .../Agents/Advanced/__tests__/Graphs.spec.tsx | 170 +++++++++++++++++-
 2 files changed, 230 insertions(+), 29 deletions(-)

diff --git a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
index 2025be29de1..85052b33119 100644
--- a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
@@ -1,4 +1,4 @@
-import { useContext, useState } from 'react';
+import { useContext, useState, useMemo } from 'react';
 import { Workflow, Plus, Pencil, X } from 'lucide-react';
 import { useFormContext, useWatch } from 'react-hook-form';
 import {
@@ -15,16 +15,21 @@ import {
   getSubagentGraphMemberCount,
   MAX_SUBAGENT_GRAPH_NODES,
   AgentCapabilities,
+  EModelEndpoint,
   Tools,
   isSubagentGraphsEnabled,
   MAX_SUBAGENTS,
   MAX_GRAPH_SUBAGENT_MEMBERS,
 } from 'librechat-data-provider';
-import type { AgentSubagentGraph, AgentSubagentGraphEdge } from 'librechat-data-provider';
+import type { AgentSubagentGraph, AgentSubagentGraphEdge, Agent } from 'librechat-data-provider';
 import type { AgentForm, OptionWithIcon } from '~/common';
+import {
+  collectReachableAgents,
+  findExecutionEnvironment,
+} from '~/hooks/Agents/useCodeApprovalMode';
 import { AgentPickerPortalContext, AddAgentSelect, useSelectableAgents } from './AgentList';
+import { useAgentPanelContext, useAgentsMapContext } from '~/Providers';
 import OrchestrationPattern from './OrchestrationPattern';
-import { useAgentPanelContext } from '~/Providers';
 import { useLocalize } from '~/hooks';
 import { CountPill } from './ui';
 
@@ -37,6 +42,7 @@ const endpoints = (value: string | string[]): string[] => (Array.isArray(value)
 export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
   const localize = useLocalize();
   const { agentsConfig } = useAgentPanelContext();
+  const agentsMap = useAgentsMapContext();
   const { control, getValues, setValue } = useFormContext<AgentForm>();
   const subagents = useWatch({ control, name: 'subagents' });
   const graphs = subagents?.graphs ?? [];
@@ -54,29 +60,64 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
     id === currentAgentId || id === ''
       ? localize('com_ui_agent_graphs_self')
       : (getAgent(id)?.name ?? id);
-  const [codeEnabled, statefulSessions, codeEnvironmentId] = useWatch({
-    control,
-    name: ['execute_code', 'stateful_code_sessions', 'code_environment_id'],
-  });
-  const environments = agentsConfig?.statefulCodeSessions?.environments;
-  const attachedEnvironment = (id?: string | null) =>
-    (id
-      ? environments?.find((environment) => environment.id === id)
-      : environments?.find((environment) => environment.default === true)
-    )?.type === 'attached';
+  const [codeEnabled, statefulSessions, codeEnvironmentId, codeEnvironmentIds, agentIds, edges] =
+    useWatch({
+      control,
+      name: [
+        'execute_code',
+        'stateful_code_sessions',
+        'code_environment_id',
+        'code_environment_ids',
+        'agent_ids',
+        'edges',
+      ],
+    });
+  const reachable = useMemo(() => {
+    const currentAgent: Agent = {
+      id: currentAgentId,
+      name: null,
+      description: null,
+      avatar: null,
+      created_at: 0,
+      provider: EModelEndpoint.openAI,
+      model: null,
+      model_parameters: getValues('model_parameters'),
+      tools: codeEnabled ? [Tools.execute_code] : [],
+      stateful_code_sessions: statefulSessions,
+      code_environment_id: codeEnvironmentId,
+      code_environment_ids: codeEnvironmentIds,
+      agent_ids: agentIds,
+      edges,
+      subagents,
+    };
+    return collectReachableAgents(
+      [currentAgent],
+      agentsMap,
+      [currentAgentId],
+      agentsConfig?.capabilities,
+    );
+  }, [
+    currentAgentId,
+    codeEnabled,
+    statefulSessions,
+    codeEnvironmentId,
+    codeEnvironmentIds,
+    agentIds,
+    edges,
+    subagents,
+    agentsMap,
+    agentsConfig?.capabilities,
+    getValues,
+  ]);
   const attachedCode =
     agentsConfig?.capabilities.includes(AgentCapabilities.stateful_code_sessions) &&
-    ((codeEnabled && statefulSessions && attachedEnvironment(codeEnvironmentId)) ||
-      graphs.some((team) =>
-        team.agent_ids.some((id) => {
-          const member = getAgent(id);
-          return (
-            member?.stateful_code_sessions === true &&
-            member.tools?.includes(Tools.execute_code) &&
-            attachedEnvironment(member.code_environment_id)
-          );
-        }),
-      ));
+    reachable.agents.some(
+      (agent) =>
+        agent.stateful_code_sessions === true &&
+        agent.tools?.includes(Tools.execute_code) &&
+        findExecutionEnvironment(agent, agentsConfig?.statefulCodeSessions?.environments)?.type ===
+          'attached',
+    );
   const approvalEnabled =
     agentsConfig?.toolApproval?.enabled === true ||
     (agentsConfig?.toolApproval?.enabled !== false && attachedCode);
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
index 89ca96483d2..98e6825b56a 100644
--- a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
@@ -1,7 +1,12 @@
 import { useForm, FormProvider } from 'react-hook-form';
-import { AgentCapabilities } from 'librechat-data-provider';
-import { render, screen, fireEvent } from '@testing-library/react';
-import type { AgentSubagentsConfig, TAgentsEndpoint } from 'librechat-data-provider';
+import { render, screen, fireEvent, act } from '@testing-library/react';
+import { EModelEndpoint, AgentCapabilities, Tools } from 'librechat-data-provider';
+import type {
+  AgentSubagentsConfig,
+  TAgentsEndpoint,
+  TAgentsMap,
+  Agent,
+} from 'librechat-data-provider';
 import type { UseFormReturn } from 'react-hook-form';
 import type { AgentForm } from '~/common';
 import Graphs from '../Graphs';
@@ -10,11 +15,13 @@ let mockAgentsConfig: Partial<TAgentsEndpoint> = {
   maxSubagents: 2,
   capabilities: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs],
 };
+let mockAgentsMap: TAgentsMap = {};
+let mockSetValue: UseFormReturn<AgentForm>['setValue'];
 let mockGetValues: UseFormReturn<AgentForm>['getValues'];
 jest.mock('~/hooks', () => ({ useLocalize: () => (key: string) => key }));
 jest.mock('~/Providers', () => ({
   useAgentPanelContext: () => ({ agentsConfig: mockAgentsConfig }),
-  useAgentsMapContext: () => ({}),
+  useAgentsMapContext: () => mockAgentsMap,
 }));
 const team = {
   type: 'review',
@@ -43,10 +50,11 @@ function Harness({
     defaultValues: {
       ...defaults,
       subagents,
-      edges: [{ from: 'parent', to: 'handoff', edgeType: 'handoff' }],
+      edges: defaults.edges ?? [{ from: 'parent', to: 'handoff', edgeType: 'handoff' }],
     },
   });
   mockGetValues = methods.getValues;
+  mockSetValue = methods.setValue;
   return (
     <FormProvider {...methods}>
       <Graphs currentAgentId="parent" />
@@ -133,6 +141,7 @@ test('removing one disabled team does not activate any remaining definitions', (
 });
 
 beforeEach(() => {
+  mockAgentsMap = {};
   mockAgentsConfig = {
     maxSubagents: 2,
     capabilities: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs],
@@ -259,3 +268,154 @@ test('managed code does not show an implicit attached approval warning', () => {
   render(<Harness defaults={{ execute_code: true, stateful_code_sessions: true }} />);
   expect(screen.queryByRole('note')).toBeNull();
 });
+
+const reachableAgent = (id: string, fields: Partial<Agent> = {}): Agent => ({
+  id,
+  name: id,
+  description: null,
+  created_at: 0,
+  avatar: null,
+  provider: EModelEndpoint.openAI,
+  model: null,
+  model_parameters: {
+    temperature: null,
+    maxContextTokens: null,
+    max_context_tokens: null,
+    max_output_tokens: null,
+    top_p: null,
+    frequency_penalty: null,
+    presence_penalty: null,
+  },
+  ...fields,
+});
+const useAttachedWarnings = (enabled?: boolean) => {
+  mockAgentsConfig = {
+    ...mockAgentsConfig,
+    capabilities: [
+      ...(mockAgentsConfig.capabilities ?? []),
+      AgentCapabilities.stateful_code_sessions,
+    ],
+    toolApproval: enabled == null ? undefined : { enabled },
+    statefulCodeSessions: {
+      allowedEnvironments: ['user', 'agent-user', 'conversation'],
+      environments: [
+        {
+          id: 'attached',
+          type: 'attached',
+          name: 'Machine',
+          owner: 'principal',
+          baseURL: 'https://example.invalid',
+          default: true,
+        },
+      ],
+    },
+  };
+  mockAgentsMap.attached = reachableAgent('attached', {
+    tools: [Tools.execute_code],
+    stateful_code_sessions: true,
+  });
+};
+
+test.each(['ordinary', 'handoff', 'ordinary-handoff', 'handoff-ordinary'])(
+  'warns for attached descendants reached through %s',
+  (path) => {
+    useAttachedWarnings();
+    const nested = path.includes('-');
+    const target = nested ? 'intermediate' : 'attached';
+    const rootHandoff = path.startsWith('handoff');
+    if (nested)
+      mockAgentsMap.intermediate = reachableAgent(
+        'intermediate',
+        path.endsWith('handoff')
+          ? { edges: [{ from: 'intermediate', to: 'attached', edgeType: 'handoff' }] }
+          : { subagents: { enabled: true, agent_ids: ['attached'] } },
+      );
+    render(
+      <Harness
+        subagents={{ ...initialSubagents, enabled: !rootHandoff, agent_ids: [target] }}
+        defaults={{
+          edges: rootHandoff ? [{ from: 'parent', to: target, edgeType: 'handoff' }] : [],
+        }}
+      />,
+    );
+    expect(screen.getByRole('note')).toHaveTextContent('com_ui_agent_graphs_approvals');
+  },
+);
+
+test.each(['disabled', 'capability-off', 'endpoint-off', 'unrelated'])(
+  'does not warn for an unavailable ordinary path: %s',
+  (reason) => {
+    useAttachedWarnings(reason === 'endpoint-off' ? false : undefined);
+    if (reason === 'capability-off')
+      mockAgentsConfig.capabilities = mockAgentsConfig.capabilities?.filter(
+        (capability) => capability !== AgentCapabilities.subagents,
+      );
+    render(
+      <Harness
+        subagents={{
+          ...initialSubagents,
+          enabled: reason !== 'disabled',
+          agent_ids: [reason === 'unrelated' ? 'other' : 'attached'],
+        }}
+        defaults={{ edges: [] }}
+      />,
+    );
+    expect(screen.queryByRole('note')).toBeNull();
+  },
+);
+
+test('draft handoff edits update the warning and cycles do not recurse forever', () => {
+  useAttachedWarnings();
+  mockAgentsMap.attached = {
+    ...reachableAgent('attached'),
+    ...mockAgentsMap.attached,
+    edges: [{ from: 'attached', to: 'parent', edgeType: 'handoff' }],
+  };
+  render(<Harness defaults={{ edges: [] }} />);
+  expect(screen.queryByRole('note')).toBeNull();
+  fireEvent.click(screen.getByRole('button', { name: 'com_ui_agent_graphs_edit' }));
+  act(() => mockSetValue('edges', [{ from: 'parent', to: 'attached', edgeType: 'handoff' }]));
+  expect(screen.getByRole('note')).toBeVisible();
+  act(() => mockSetValue('edges', []));
+  expect(screen.queryByRole('note')).toBeNull();
+});
+
+test.each([false, true])(
+  'only capability-projected graph members contribute to the warning, enabled=%s',
+  (graphsEnabled) => {
+    useAttachedWarnings();
+    const attachedTeam = {
+      ...team,
+      agent_ids: ['attached'],
+      entry_agent_id: 'attached',
+      result_agent_id: 'attached',
+    };
+    render(
+      <Harness
+        subagents={{ ...initialSubagents, graphsEnabled, graphs: [attachedTeam] }}
+        defaults={{ edges: [] }}
+      />,
+    );
+    expect(screen.queryByRole('note') != null).toBe(graphsEnabled);
+  },
+);
+
+test('saved but capability-disabled graph members do not enable the warning', () => {
+  useAttachedWarnings();
+  mockAgentsConfig.capabilities = mockAgentsConfig.capabilities?.filter(
+    (capability) => capability !== AgentCapabilities.subagent_graphs,
+  );
+  const attachedTeam = {
+    ...team,
+    agent_ids: ['attached'],
+    entry_agent_id: 'attached',
+    result_agent_id: 'attached',
+  };
+  render(
+    <Harness
+      subagents={{ ...initialSubagents, graphs: [attachedTeam] }}
+      defaults={{ edges: [] }}
+    />,
+  );
+  expect(screen.queryByRole('note')).toBeNull();
+});

From d875aca412edd1849b056c9d73efafdfb743ade7 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 20:22:00 +0000
Subject: [PATCH 11/12] fix: Gate Implicit Graph Warnings on Code Capability

---
 .../SidePanel/Agents/Advanced/Graphs.tsx      |  3 +-
 .../Agents/Advanced/__tests__/Graphs.spec.tsx | 40 ++++++++++++++++++-
 2 files changed, 40 insertions(+), 3 deletions(-)

diff --git a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
index 85052b33119..f7f5bd9f740 100644
--- a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
@@ -110,7 +110,8 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
     getValues,
   ]);
   const attachedCode =
-    agentsConfig?.capabilities.includes(AgentCapabilities.stateful_code_sessions) &&
+    agentsConfig?.capabilities.includes(AgentCapabilities.execute_code) &&
+    agentsConfig.capabilities.includes(AgentCapabilities.stateful_code_sessions) &&
     reachable.agents.some(
       (agent) =>
         agent.stateful_code_sessions === true &&
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
index 98e6825b56a..7d13be84876 100644
--- a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
@@ -13,7 +13,11 @@ import Graphs from '../Graphs';
 
 let mockAgentsConfig: Partial<TAgentsEndpoint> = {
   maxSubagents: 2,
-  capabilities: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs],
+  capabilities: [
+    AgentCapabilities.subagents,
+    AgentCapabilities.subagent_graphs,
+    AgentCapabilities.execute_code,
+  ],
 };
 let mockAgentsMap: TAgentsMap = {};
 let mockSetValue: UseFormReturn<AgentForm>['setValue'];
@@ -144,7 +148,11 @@ beforeEach(() => {
   mockAgentsMap = {};
   mockAgentsConfig = {
     maxSubagents: 2,
-    capabilities: [AgentCapabilities.subagents, AgentCapabilities.subagent_graphs],
+    capabilities: [
+      AgentCapabilities.subagents,
+      AgentCapabilities.subagent_graphs,
+      AgentCapabilities.execute_code,
+    ],
   };
 });
 
@@ -419,3 +427,31 @@ test('saved but capability-disabled graph members do not enable the warning', ()
   );
   expect(screen.queryByRole('note')).toBeNull();
 });
+
+test.each(
+  ['parent', 'descendant'].flatMap((source) =>
+    [false, true].flatMap((executeCode) =>
+      [undefined, false, true].map((endpointEnabled) => ({ source, executeCode, endpointEnabled })),
+    ),
+  ),
+)('gates implicit approval on executable code: %j', ({ source, executeCode, endpointEnabled }) => {
+  useAttachedWarnings(endpointEnabled);
+  if (!executeCode) {
+    mockAgentsConfig.capabilities = mockAgentsConfig.capabilities?.filter(
+      (capability) => capability !== AgentCapabilities.execute_code,
+    );
+  }
+  render(
+    <Harness
+      subagents={{ ...initialSubagents, enabled: source === 'descendant', agent_ids: ['attached'] }}
+      defaults={{
+        edges: [],
+        execute_code: source === 'parent',
+        stateful_code_sessions: source === 'parent',
+      }}
+    />,
+  );
+  expect(screen.queryByRole('note') != null).toBe(
+    endpointEnabled === true || (endpointEnabled !== false && executeCode),
+  );
+});

From e63ec7e512fcfb9694824a7511fd7b36eb7876a7 Mon Sep 17 00:00:00 2001
From: Lia <lia@librechat.ai>
Date: Mon, 5 Oct 2026 20:36:27 +0000
Subject: [PATCH 12/12] fix: Use Public Approval Metadata for Graph Warnings

---
 .../SidePanel/Agents/Advanced/Graphs.tsx      | 15 +++--
 .../Agents/Advanced/__tests__/Graphs.spec.tsx | 38 ++++++++----
 .../src/endpoints/config/endpoints.spec.ts    | 60 ++++++++++++++++++-
 3 files changed, 96 insertions(+), 17 deletions(-)

diff --git a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
index f7f5bd9f740..d9b3328b521 100644
--- a/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/Graphs.tsx
@@ -21,7 +21,12 @@ import {
   MAX_SUBAGENTS,
   MAX_GRAPH_SUBAGENT_MEMBERS,
 } from 'librechat-data-provider';
-import type { AgentSubagentGraph, AgentSubagentGraphEdge, Agent } from 'librechat-data-provider';
+import type {
+  AgentSubagentGraph,
+  AgentSubagentGraphEdge,
+  TConfig,
+  Agent,
+} from 'librechat-data-provider';
 import type { AgentForm, OptionWithIcon } from '~/common';
 import {
   collectReachableAgents,
@@ -109,6 +114,9 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
     agentsConfig?.capabilities,
     getValues,
   ]);
+  const statefulCodeSessions = agentsConfig?.statefulCodeSessions as
+    | TConfig['statefulCodeSessions']
+    | undefined;
   const attachedCode =
     agentsConfig?.capabilities.includes(AgentCapabilities.execute_code) &&
     agentsConfig.capabilities.includes(AgentCapabilities.stateful_code_sessions) &&
@@ -116,12 +124,11 @@ export default function Graphs({ currentAgentId }: { currentAgentId: string }) {
       (agent) =>
         agent.stateful_code_sessions === true &&
         agent.tools?.includes(Tools.execute_code) &&
-        findExecutionEnvironment(agent, agentsConfig?.statefulCodeSessions?.environments)?.type ===
-          'attached',
+        findExecutionEnvironment(agent, statefulCodeSessions?.environments)?.type === 'attached',
     );
   const approvalEnabled =
     agentsConfig?.toolApproval?.enabled === true ||
-    (agentsConfig?.toolApproval?.enabled !== false && attachedCode);
+    (statefulCodeSessions?.approvalsEnabled === true && attachedCode);
   const write = (next: AgentSubagentGraph[], active?: boolean) => {
     const value = getValues('subagents');
     setValue(
diff --git a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
index 7d13be84876..c6ac19894b2 100644
--- a/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
+++ b/client/src/components/SidePanel/Agents/Advanced/__tests__/Graphs.spec.tsx
@@ -4,6 +4,7 @@ import { EModelEndpoint, AgentCapabilities, Tools } from 'librechat-data-provide
 import type {
   AgentSubagentsConfig,
   TAgentsEndpoint,
+  TConfig,
   TAgentsMap,
   Agent,
 } from 'librechat-data-provider';
@@ -11,7 +12,8 @@ import type { UseFormReturn } from 'react-hook-form';
 import type { AgentForm } from '~/common';
 import Graphs from '../Graphs';
 
-let mockAgentsConfig: Partial<TAgentsEndpoint> = {
+let mockAgentsConfig: Partial<Omit<TAgentsEndpoint, 'statefulCodeSessions'>> &
+  Pick<TConfig, 'statefulCodeSessions'> = {
   maxSubagents: 2,
   capabilities: [
     AgentCapabilities.subagents,
@@ -215,16 +217,15 @@ test.each([undefined, false, true])(
         ...(mockAgentsConfig.capabilities ?? []),
         AgentCapabilities.stateful_code_sessions,
       ],
-      toolApproval: enabled == null ? undefined : { enabled },
+      toolApproval: { enabled: enabled === true },
       statefulCodeSessions: {
         allowedEnvironments: ['user', 'agent-user', 'conversation'],
+        approvalsEnabled: enabled !== false,
         environments: [
           {
             id: 'attached',
             type: 'attached',
             name: 'Machine',
-            owner: 'principal',
-            baseURL: 'https://example.invalid',
             default: true,
           },
         ],
@@ -259,16 +260,12 @@ test('managed code does not show an implicit attached approval warning', () => {
           id: 'managed',
           type: 'managed',
           name: 'Managed',
-          owner: 'deployment',
-          baseURL: 'https://example.invalid',
           default: true,
         },
         {
           id: 'attached',
           type: 'attached',
           name: 'Machine',
-          owner: 'principal',
-          baseURL: 'https://example.invalid',
         },
       ],
     },
@@ -303,16 +300,15 @@ const useAttachedWarnings = (enabled?: boolean) => {
       ...(mockAgentsConfig.capabilities ?? []),
       AgentCapabilities.stateful_code_sessions,
     ],
-    toolApproval: enabled == null ? undefined : { enabled },
+    toolApproval: { enabled: enabled === true },
     statefulCodeSessions: {
       allowedEnvironments: ['user', 'agent-user', 'conversation'],
+      approvalsEnabled: enabled !== false,
       environments: [
         {
           id: 'attached',
           type: 'attached',
           name: 'Machine',
-          owner: 'principal',
-          baseURL: 'https://example.invalid',
           default: true,
         },
       ],
@@ -455,3 +451,23 @@ test.each(
     endpointEnabled === true || (endpointEnabled !== false && executeCode),
   );
 });
+
+test.each([undefined, false])(
+  'missing or disabled public attached approval metadata never implies authorization: %s',
+  (approvalsEnabled) => {
+    useAttachedWarnings();
+    mockAgentsConfig.statefulCodeSessions = {
+      ...mockAgentsConfig.statefulCodeSessions!,
+      approvalsEnabled,
+    };
+    render(<Harness defaults={{ execute_code: true, stateful_code_sessions: true }} />);
+    expect(screen.queryByRole('note')).toBeNull();
+  },
+);
+
+test('explicit public endpoint approval enablement warns without attached metadata', () => {
+  mockAgentsConfig.toolApproval = { enabled: true };
+  mockAgentsConfig.capabilities = [AgentCapabilities.subagent_graphs];
+  render(<Harness defaults={{ edges: [] }} />);
+  expect(screen.getByRole('note')).toHaveTextContent('com_ui_agent_graphs_approvals');
+});
diff --git a/packages/api/src/endpoints/config/endpoints.spec.ts b/packages/api/src/endpoints/config/endpoints.spec.ts
index 112823cbaf3..97eefdf713d 100644
--- a/packages/api/src/endpoints/config/endpoints.spec.ts
+++ b/packages/api/src/endpoints/config/endpoints.spec.ts
@@ -6,12 +6,11 @@ import {
   PrincipalType,
   defaultAgentCapabilities,
 } from 'librechat-data-provider';
-
 import type { AppConfig, IConfig } from '@librechat/data-schemas';
 import type { AppConfigServiceDeps } from '~/app/service';
 import type { EndpointsConfigDeps } from './endpoints';
 import type { ServerRequest } from '~/types';
-
+import { resolveToolApprovalPolicy } from '~/agents/hitl/policy';
 import { createEndpointsConfigService } from './endpoints';
 import { createAppConfigService } from '~/app/service';
 
@@ -266,6 +265,63 @@ describe('createEndpointsConfigService', () => {
       });
     });
 
+    it.each([undefined, false, true])(
+      'public approval metadata preserves attached runtime wiring with endpoint enabled=%s',
+      async (enabled) => {
+        const toolApproval = enabled == null ? undefined : { enabled };
+        const deps = createMockDeps({
+          loadDefaultEndpointsConfig: jest.fn().mockResolvedValue({
+            [EModelEndpoint.agents]: { userProvide: false, order: 0 },
+          }),
+          getAppConfig: jest.fn().mockResolvedValue(
+            appConfig({
+              endpoints: {
+                [EModelEndpoint.agents]: {
+                  toolApproval,
+                  capabilities: [
+                    AgentCapabilities.execute_code,
+                    AgentCapabilities.stateful_code_sessions,
+                  ],
+                  statefulCodeSessions: {
+                    allowedEnvironments: ['user'],
+                    environments: [
+                      {
+                        id: 'attached',
+                        name: 'Machine',
+                        type: 'attached',
+                        default: true,
+                        owner: 'principal',
+                        baseURL: 'https://internal-code.example.com',
+                      },
+                    ],
+                  },
+                },
+              },
+            }),
+          ),
+        });
+        const result = await createEndpointsConfigService(deps).getEndpointsConfig(fakeReq());
+        const wire: typeof result = JSON.parse(JSON.stringify(result));
+        expect(wire?.[EModelEndpoint.agents]).toMatchObject({
+          toolApproval: { enabled: enabled === true },
+          statefulCodeSessions: {
+            approvalsEnabled: enabled !== false,
+            environments: [{ id: 'attached', type: 'attached', default: true }],
+          },
+        });
+        expect(
+          wire?.[EModelEndpoint.agents]?.statefulCodeSessions?.environments?.[0],
+        ).not.toHaveProperty('baseURL');
+        expect(
+          wire?.[EModelEndpoint.agents]?.statefulCodeSessions?.environments?.[0],
+        ).not.toHaveProperty('owner');
+        expect(result?.[EModelEndpoint.agents]?.statefulCodeSessions?.approvalsEnabled).toBe(
+          resolveToolApprovalPolicy({ endpoint: toolApproval, attachedCodeEnvironment: true })
+            ?.enabled,
+        );
+      },
+    );
+
     it('does not expose a pairing-only control plane as an execution environment', async () => {
       const deps = createMockDeps({
         loadDefaultEndpointsConfig: jest.fn().mockResolvedValue({