Add dataset uploads to Hub (#255)

* Add dataset uploads to Hub

Co-authored-by: OpenAI Codex <codex@openai.com>

* Address dataset upload review items

Co-authored-by: OpenAI Codex <codex@openai.com>

* Show dataset upload progress

Co-authored-by: OpenAI Codex <codex@openai.com>

* Move dataset upload button to composer corner

Co-authored-by: OpenAI Codex <codex@openai.com>

* Fix dataset upload file handoff

Co-authored-by: OpenAI Codex <codex@openai.com>

* Show upload alerts below composer

Co-authored-by: OpenAI Codex <codex@openai.com>

* Improve dataset upload errors and chips

Co-authored-by: OpenAI Codex <codex@openai.com>

* Link dataset chips to repo

Co-authored-by: OpenAI Codex <codex@openai.com>

* Expose dataset uploads as configs

Co-authored-by: OpenAI Codex <codex@openai.com>

---------

Co-authored-by: OpenAI Codex <codex@openai.com>

backend/dataset_uploads.py

@@ -0,0 +1,305 @@
+"""Helpers for session-scoped dataset uploads to the Hugging Face Hub."""
+
+import asyncio
+import os
+import re
+import uuid
+from dataclasses import dataclass
+from urllib.parse import quote
+
+from fastapi import HTTPException, UploadFile
+from huggingface_hub import HfApi
+
+MAX_DATASET_UPLOAD_BYTES = 100 * 1024 * 1024
+ALLOWED_DATASET_EXTENSIONS = {"csv", "json", "jsonl"}
+_SAFE_FILENAME_RE = re.compile(r"[^A-Za-z0-9._-]+")
+_SAFE_NAMESPACE_RE = re.compile(r"^[A-Za-z0-9][A-Za-z0-9._-]{0,95}$")
+
+
+@dataclass(frozen=True)
+class DatasetUpload:
+    session_id: str
+    repo_id: str
+    repo_type: str
+    private: bool
+    upload_id: str
+    config_name: str
+    filename: str
+    original_filename: str
+    path_in_repo: str
+    size_bytes: int
+    format: str
+    hub_url: str
+    load_dataset_snippet: str
+
+    def response_payload(self) -> dict[str, str | int | bool]:
+        return {
+            "session_id": self.session_id,
+            "repo_id": self.repo_id,
+            "repo_type": self.repo_type,
+            "private": self.private,
+            "upload_id": self.upload_id,
+            "config_name": self.config_name,
+            "filename": self.filename,
+            "path_in_repo": self.path_in_repo,
+            "size_bytes": self.size_bytes,
+            "format": self.format,
+            "hub_url": self.hub_url,
+            "load_dataset_snippet": self.load_dataset_snippet,
+        }
+
+
+def sanitize_dataset_filename(filename: str | None) -> str:
+    """Return a Hub-safe basename while preserving the extension."""
+    raw = os.path.basename(filename or "").strip()
+    if not raw:
+        raw = "dataset.csv"
+
+    safe = _SAFE_FILENAME_RE.sub("-", raw).strip(".-_")
+    if not safe:
+        safe = "dataset.csv"
+
+    stem, ext = os.path.splitext(safe)
+    if not stem:
+        stem = "dataset"
+    if not ext:
+        ext = ".csv"
+
+    max_stem_len = 96 - len(ext)
+    stem = stem[:max_stem_len].strip(".-_") or "dataset"
+    return f"{stem}{ext.lower()}"
+
+
+def display_filename(filename: str | None, fallback: str) -> str:
+    raw = os.path.basename(filename or "").strip()
+    if not raw:
+        return fallback
+    cleaned = "".join(char for char in raw if ord(char) >= 32)
+    return cleaned[:160] or fallback
+
+
+def dataset_format_from_filename(filename: str) -> str:
+    ext = os.path.splitext(filename)[1].lower().lstrip(".")
+    if ext not in ALLOWED_DATASET_EXTENSIONS:
+        raise HTTPException(
+            status_code=400,
+            detail="Only .csv, .json, and .jsonl dataset files are supported.",
+        )
+    return ext
+
+
+def session_dataset_repo_id(hf_username: str | None, session_id: str) -> str:
+    namespace = (hf_username or "").strip()
+    if not namespace or not _SAFE_NAMESPACE_RE.fullmatch(namespace):
+        raise HTTPException(
+            status_code=400,
+            detail="Could not determine a valid Hugging Face namespace.",
+        )
+
+    safe_session_id = re.sub(r"[^A-Za-z0-9]+", "-", session_id).strip("-")
+    if not safe_session_id:
+        safe_session_id = uuid.uuid4().hex[:8]
+    return f"{namespace}/ml-intern-{safe_session_id[:8]}-datasets"
+
+
+async def upload_size_bytes(upload: UploadFile) -> int:
+    await asyncio.to_thread(upload.file.seek, 0, os.SEEK_END)
+    size = await asyncio.to_thread(upload.file.tell)
+    await asyncio.to_thread(upload.file.seek, 0)
+    return int(size)
+
+
+async def validate_dataset_upload(upload: UploadFile) -> tuple[str, str, int]:
+    dataset_format = dataset_format_from_filename(upload.filename or "")
+    safe_filename = sanitize_dataset_filename(upload.filename)
+    size = await upload_size_bytes(upload)
+    if size <= 0:
+        raise HTTPException(status_code=400, detail="Uploaded dataset file is empty.")
+    if size > MAX_DATASET_UPLOAD_BYTES:
+        raise HTTPException(
+            status_code=413,
+            detail="Dataset upload exceeds the 100 MB limit.",
+        )
+    return safe_filename, dataset_format, size
+
+
+def dataset_hub_url(repo_id: str, path_in_repo: str) -> str:
+    quoted_path = quote(path_in_repo, safe="/")
+    return f"https://huggingface.co/datasets/{repo_id}/blob/main/{quoted_path}"
+
+
+def dataset_config_name(upload_id: str) -> str:
+    safe_upload_id = re.sub(r"[^A-Za-z0-9]+", "_", upload_id).strip("_").lower()
+    if not safe_upload_id:
+        safe_upload_id = "dataset"
+    return f"upload_{safe_upload_id[:32]}"
+
+
+def dataset_config_name_from_path(path_in_repo: str) -> str:
+    parts = path_in_repo.split("/")
+    if len(parts) >= 3 and parts[0] == "uploads":
+        return dataset_config_name(parts[1])
+    stem = os.path.splitext(os.path.basename(path_in_repo))[0]
+    return dataset_config_name(stem)
+
+
+def is_dataset_upload_path(path_in_repo: str) -> bool:
+    parts = path_in_repo.split("/")
+    if len(parts) != 3 or parts[0] != "uploads" or not parts[1] or not parts[2]:
+        return False
+    extension = os.path.splitext(path_in_repo)[1].lower().lstrip(".")
+    return extension in ALLOWED_DATASET_EXTENSIONS
+
+
+def unique_dataset_upload_paths(paths: list[str]) -> list[str]:
+    seen = set()
+    upload_paths = []
+    for path in paths:
+        if not is_dataset_upload_path(path) or path in seen:
+            continue
+        seen.add(path)
+        upload_paths.append(path)
+    return upload_paths
+
+
+def load_dataset_snippet(repo_id: str, config_name: str) -> str:
+    return (
+        "from datasets import load_dataset\n\n"
+        f'dataset = load_dataset("{repo_id}", "{config_name}", '
+        'split="train", token=True)'
+    )
+
+
+def dataset_repo_card(repo_id: str, upload_paths: list[str]) -> bytes:
+    config_lines = []
+    unique_upload_paths = unique_dataset_upload_paths(upload_paths)
+    if unique_upload_paths:
+        config_lines.append("configs:")
+        for path in unique_upload_paths:
+            config_lines.extend(
+                [
+                    f"- config_name: {dataset_config_name_from_path(path)}",
+                    "  data_files:",
+                    "  - split: train",
+                    f'    path: "{path}"',
+                ]
+            )
+
+    configs = "\n".join(config_lines)
+    if configs:
+        configs = f"{configs}\n"
+
+    content = f"""---
+tags:
+- ml-intern
+- uploaded-dataset
+{configs}---
+
+# {repo_id}
+
+Private dataset files uploaded through ML Intern.
+
+Files are stored under `uploads/<upload_id>/` and are attached to the
+corresponding ML Intern session context by Hub reference, not by copying file
+contents into the chat.
+
+Each uploaded file is exposed as its own dataset config so files with different
+schemas can coexist in the same session repo.
+"""
+    return content.encode("utf-8")
+
+
+def dataset_context_note(upload: DatasetUpload) -> str:
+    return f"""[SYSTEM: The user uploaded a dataset file for this session.
+
+Use this Hugging Face Hub dataset reference when the task needs the uploaded data.
+Do not look for the uploaded file on local disk and do not ask the user to
+upload it again unless this Hub reference fails.
+
+- Repo ID: {upload.repo_id}
+- Repo type: dataset
+- Dataset config: {upload.config_name}
+- File in repo: {upload.path_in_repo}
+- Original filename: {upload.original_filename}
+- Stored filename: {upload.filename}
+- Format: {upload.format}
+- Size: {upload.size_bytes} bytes
+- Hub URL: {upload.hub_url}
+
+Load it with:
+```python
+{upload.load_dataset_snippet}
+```
+]"""
+
+
+async def push_dataset_upload_to_hub(
+    *,
+    upload: UploadFile,
+    session_id: str,
+    hf_username: str,
+    hf_token: str,
+) -> DatasetUpload:
+    safe_filename, dataset_format, size = await validate_dataset_upload(upload)
+    original_filename = display_filename(upload.filename, safe_filename)
+    upload_id = uuid.uuid4().hex[:12]
+    config_name = dataset_config_name(upload_id)
+    repo_id = session_dataset_repo_id(hf_username, session_id)
+    path_in_repo = f"uploads/{upload_id}/{safe_filename}"
+    hub_url = dataset_hub_url(repo_id, path_in_repo)
+    snippet = load_dataset_snippet(repo_id, config_name)
+    api = HfApi(token=hf_token)
+
+    await asyncio.to_thread(
+        api.create_repo,
+        repo_id=repo_id,
+        repo_type="dataset",
+        private=True,
+        exist_ok=True,
+    )
+    await asyncio.to_thread(
+        api.update_repo_settings,
+        repo_id=repo_id,
+        repo_type="dataset",
+        private=True,
+    )
+    repo_files = await asyncio.to_thread(
+        api.list_repo_files,
+        repo_id=repo_id,
+        repo_type="dataset",
+    )
+    upload_paths = unique_dataset_upload_paths([*repo_files, path_in_repo])
+    await asyncio.to_thread(upload.file.seek, 0)
+    file_bytes = await asyncio.to_thread(upload.file.read)
+    await asyncio.to_thread(
+        api.upload_file,
+        path_or_fileobj=file_bytes,
+        path_in_repo=path_in_repo,
+        repo_id=repo_id,
+        repo_type="dataset",
+        commit_message=f"Upload dataset file {safe_filename}",
+    )
+    await asyncio.to_thread(
+        api.upload_file,
+        path_or_fileobj=dataset_repo_card(repo_id, upload_paths),
+        path_in_repo="README.md",
+        repo_id=repo_id,
+        repo_type="dataset",
+        commit_message="Update ML Intern dataset upload configs",
+    )
+
+    return DatasetUpload(
+        session_id=session_id,
+        repo_id=repo_id,
+        repo_type="dataset",
+        private=True,
+        upload_id=upload_id,
+        config_name=config_name,
+        filename=safe_filename,
+        original_filename=original_filename,
+        path_in_repo=path_in_repo,
+        size_bytes=size,
+        format=dataset_format,
+        hub_url=hub_url,
+        load_dataset_snippet=snippet,
+    )

backend/models.py

@@ -1,7 +1,7 @@
 """Pydantic models for API requests and responses."""
 
 from enum import Enum
-from typing import Any
+from typing import Any, Literal
 
 from pydantic import BaseModel, Field
 
@@ -120,6 +120,23 @@ class SessionYoloRequest(BaseModel):
     cost_cap_usd: float | None = Field(default=None, ge=0)
 
 
+class DatasetUploadResponse(BaseModel):
+    """Response for a dataset file uploaded to the Hub."""
+
+    session_id: str
+    repo_id: str
+    repo_type: Literal["dataset"] = "dataset"
+    private: bool = True
+    upload_id: str
+    config_name: str
+    filename: str
+    path_in_repo: str
+    size_bytes: int
+    format: Literal["csv", "json", "jsonl"]
+    hub_url: str
+    load_dataset_snippet: str
+
+
 class HealthResponse(BaseModel):
     """Health check response."""
 

backend/routes/agent.py

@@ -21,10 +21,18 @@ from fastapi import (
 )
 from fastapi.exceptions import RequestValidationError
 from fastapi.responses import StreamingResponse
-from litellm import acompletion
+from huggingface_hub.errors import HfHubHTTPError
+from litellm import Message, acompletion
 from pydantic import ValidationError
+from starlette.datastructures import FormData, UploadFile
+from dataset_uploads import (
+    MAX_DATASET_UPLOAD_BYTES,
+    dataset_context_note,
+    push_dataset_upload_to_hub,
+)
 from models import (
     ApprovalRequest,
+    DatasetUploadResponse,
     HealthResponse,
     LLMHealthResponse,
     SessionInfo,
@@ -58,6 +66,7 @@ PREMIUM_MODEL_IDS = {
     DEFAULT_CLAUDE_MODEL_ID,
     "openai/gpt-5.5",
 }
+DATASET_UPLOAD_MULTIPART_SLACK_BYTES = 1024 * 1024
 
 
 def _claude_picker_model_id() -> str:
@@ -203,6 +212,63 @@ def _user_hf_token(user: dict[str, Any] | None) -> str | None:
     return user.get(INTERNAL_HF_TOKEN_KEY)
 
 
+def _reject_oversize_dataset_upload(request: Request) -> None:
+    raw_content_length = request.headers.get("content-length")
+    if raw_content_length is None:
+        return
+    try:
+        content_length = int(raw_content_length)
+    except (TypeError, ValueError):
+        return
+    if content_length > MAX_DATASET_UPLOAD_BYTES + DATASET_UPLOAD_MULTIPART_SLACK_BYTES:
+        raise HTTPException(
+            status_code=413,
+            detail="Dataset upload exceeds the 100 MB limit.",
+        )
+
+
+def _dataset_upload_file_from_form(form: FormData) -> UploadFile:
+    uploaded_files = [
+        (key, value)
+        for key, value in form.multi_items()
+        if isinstance(value, UploadFile)
+    ]
+    if len(uploaded_files) != 1:
+        raise HTTPException(
+            status_code=400,
+            detail="Upload exactly one dataset file.",
+        )
+    field_name, upload = uploaded_files[0]
+    if field_name != "file":
+        raise HTTPException(
+            status_code=400,
+            detail="Missing 'file' upload field.",
+        )
+    return upload
+
+
+def _dataset_upload_hub_http_exception(error: HfHubHTTPError) -> HTTPException:
+    status_code = getattr(error.response, "status_code", None)
+    if status_code == 401:
+        detail = "Hugging Face rejected the token used for the dataset upload."
+        return HTTPException(status_code=401, detail=detail)
+    if status_code == 403:
+        detail = (
+            "Hugging Face denied permission to create or write to the dataset repo."
+        )
+        return HTTPException(status_code=403, detail=detail)
+    if status_code == 404:
+        detail = "Could not find the Hugging Face namespace or dataset repo."
+        return HTTPException(status_code=404, detail=detail)
+    if status_code == 429:
+        detail = "Hugging Face Hub rate limit reached while uploading the dataset."
+        return HTTPException(status_code=429, detail=detail)
+    return HTTPException(
+        status_code=502,
+        detail="Hugging Face Hub upload failed. Please try again.",
+    )
+
+
 async def _check_session_access(
     session_id: str,
     user: dict[str, Any],
@@ -542,6 +608,86 @@ async def set_session_notifications(
     }
 
 
+@router.post("/session/{session_id}/datasets", response_model=DatasetUploadResponse)
+async def upload_session_dataset(
+    session_id: str,
+    request: Request,
+    user: dict = Depends(get_current_user),
+) -> DatasetUploadResponse:
+    """Upload a CSV/JSON dataset file to a private Hub dataset for this session."""
+    file: UploadFile | None = None
+    try:
+        _reject_oversize_dataset_upload(request)
+        agent_session = await _check_session_access(session_id, user, request)
+        if not agent_session or not agent_session.is_active:
+            raise HTTPException(status_code=404, detail="Session not found")
+        if agent_session.is_processing:
+            raise HTTPException(
+                status_code=409,
+                detail="Cannot upload a dataset while the agent is processing.",
+            )
+        if agent_session.session.pending_approval:
+            raise HTTPException(
+                status_code=409,
+                detail="Approve or reject pending tools before uploading a dataset.",
+            )
+
+        hf_token = (
+            resolve_hf_request_token(request, include_env_fallback=False)
+            or _user_hf_token(user)
+            or resolve_hf_request_token(request)
+        )
+        if not hf_token:
+            raise HTTPException(
+                status_code=401,
+                detail="A Hugging Face token is required to upload datasets.",
+            )
+
+        form = await request.form(
+            max_files=1,
+            max_fields=1,
+            max_part_size=MAX_DATASET_UPLOAD_BYTES,
+        )
+        file = _dataset_upload_file_from_form(form)
+        hf_username = user.get("username") or agent_session.hf_username
+        uploaded = await push_dataset_upload_to_hub(
+            upload=file,
+            session_id=session_id,
+            hf_username=hf_username,
+            hf_token=hf_token,
+        )
+        agent_session.session.context_manager.add_message(
+            Message(role="user", content=dataset_context_note(uploaded))
+        )
+        await session_manager.persist_session_snapshot(agent_session)
+        logger.info(
+            "Uploaded dataset file %s to %s for session %s",
+            uploaded.filename,
+            uploaded.repo_id,
+            session_id,
+        )
+        return DatasetUploadResponse(**uploaded.response_payload())
+    except HTTPException:
+        raise
+    except HfHubHTTPError as e:
+        logger.warning(
+            "Hub rejected dataset upload for session %s: status=%s request_id=%s",
+            session_id,
+            getattr(e.response, "status_code", None),
+            getattr(e, "request_id", None),
+        )
+        raise _dataset_upload_hub_http_exception(e)
+    except Exception:
+        logger.exception("Dataset upload failed for session %s", session_id)
+        raise HTTPException(
+            status_code=502,
+            detail="Dataset upload failed. Please try again.",
+        )
+    finally:
+        if file is not None:
+            await file.close()
+
+
 @router.patch("/session/{session_id}/yolo")
 async def set_session_yolo(
     session_id: str,

frontend/src/components/Chat/ChatInput.tsx

@@ -11,12 +11,15 @@ import {
   ListItemIcon,
   ListItemText,
   Chip,
+  LinearProgress,
   Snackbar,
+  Tooltip,
 } from '@mui/material';
 import ArrowUpwardIcon from '@mui/icons-material/ArrowUpward';
 import ArrowDropDownIcon from '@mui/icons-material/ArrowDropDown';
 import StopIcon from '@mui/icons-material/Stop';
-import { apiFetch } from '@/utils/api';
+import AddIcon from '@mui/icons-material/Add';
+import { apiFetch, apiUpload } from '@/utils/api';
 import { useUserQuota } from '@/hooks/useUserQuota';
 import ClaudeCapDialog from '@/components/ClaudeCapDialog';
 import JobsUpgradeDialog from '@/components/JobsUpgradeDialog';
@@ -118,18 +121,49 @@ interface ChatInputProps {
   initialModelPath?: string | null;
   onSend: (text: string) => void;
   onStop?: () => void;
+  onDatasetUploaded?: () => Promise<boolean> | boolean;
   isProcessing?: boolean;
   disabled?: boolean;
   placeholder?: string;
 }
 
+interface DatasetUploadResponse {
+  session_id: string;
+  repo_id: string;
+  repo_type: 'dataset';
+  private: true;
+  upload_id: string;
+  config_name: string;
+  filename: string;
+  path_in_repo: string;
+  size_bytes: number;
+  format: 'csv' | 'json' | 'jsonl';
+  hub_url: string;
+  load_dataset_snippet: string;
+}
+
+const MAX_DATASET_UPLOAD_BYTES = 100 * 1024 * 1024;
+const DATASET_UPLOAD_ACCEPT = '.csv,.json,.jsonl';
+const DATASET_UPLOAD_EXTENSIONS = new Set(['csv', 'json', 'jsonl']);
+
 const isClaudeModel = (m: ModelOption) => isClaudePath(m.modelPath);
 const isPremiumModel = (m: ModelOption) => isPremiumPath(m.modelPath);
 const firstFreeModel = (options: ModelOption[]) => options.find(m => !isPremiumModel(m)) ?? options[0];
 
-export default function ChatInput({ sessionId, initialModelPath, onSend, onStop, isProcessing = false, disabled = false, placeholder = 'Ask anything...' }: ChatInputProps) {
+const formatBytes = (bytes: number) => {
+  if (bytes < 1024) return `${bytes} B`;
+  if (bytes < 1024 * 1024) return `${(bytes / 1024).toFixed(1)} KB`;
+  return `${(bytes / (1024 * 1024)).toFixed(1)} MB`;
+};
+
+const datasetRepoUrl = (repoId: string) => (
+  `https://huggingface.co/datasets/${repoId.split('/').map(encodeURIComponent).join('/')}`
+);
+
+export default function ChatInput({ sessionId, initialModelPath, onSend, onStop, onDatasetUploaded, isProcessing = false, disabled = false, placeholder = 'Ask anything...' }: ChatInputProps) {
   const [input, setInput] = useState('');
   const inputRef = useRef<HTMLTextAreaElement>(null);
+  const fileInputRef = useRef<HTMLInputElement>(null);
   const [modelOptions, setModelOptions] = useState<ModelOption[]>(DEFAULT_MODEL_OPTIONS);
   const modelOptionsRef = useRef<ModelOption[]>(DEFAULT_MODEL_OPTIONS);
   const sessionIdRef = useRef<string | undefined>(sessionId);
@@ -150,6 +184,11 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
   const updateSessionModel = useSessionStore((s) => s.updateSessionModel);
   const [awaitingTopUp, setAwaitingTopUp] = useState(false);
   const [modelSwitchError, setModelSwitchError] = useState<string | null>(null);
+  const [datasetUploadError, setDatasetUploadError] = useState<string | null>(null);
+  const [datasetUploadSuccess, setDatasetUploadSuccess] = useState<string | null>(null);
+  const [uploadedDatasets, setUploadedDatasets] = useState<DatasetUploadResponse[]>([]);
+  const [isUploadingDataset, setIsUploadingDataset] = useState(false);
+  const [datasetUploadProgress, setDatasetUploadProgress] = useState<number | null>(null);
   const lastSentRef = useRef<string>('');
 
   useEffect(() => {
@@ -216,12 +255,75 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
   }, [disabled, isProcessing]);
 
   const handleSend = useCallback(() => {
-    if (input.trim() && !disabled) {
+    if (input.trim() && !disabled && !isUploadingDataset) {
       lastSentRef.current = input;
       onSend(input);
       setInput('');
     }
-  }, [input, disabled, onSend]);
+  }, [input, disabled, isUploadingDataset, onSend]);
+
+  const handleDatasetUploadClick = useCallback(() => {
+    fileInputRef.current?.click();
+  }, []);
+
+  const handleDatasetFileChange = useCallback(
+    async (event: React.ChangeEvent<HTMLInputElement>) => {
+      const file = event.target.files?.[0];
+      event.target.value = '';
+      if (!file) return;
+
+      if (!sessionId) {
+        setDatasetUploadError('Start a session before uploading a dataset.');
+        return;
+      }
+
+      const extension = file.name.split('.').pop()?.toLowerCase() || '';
+      if (!DATASET_UPLOAD_EXTENSIONS.has(extension)) {
+        setDatasetUploadError('Only CSV, JSON, and JSONL dataset files are supported.');
+        return;
+      }
+      if (file.size > MAX_DATASET_UPLOAD_BYTES) {
+        setDatasetUploadError(
+          `Dataset files must be 100 MB or smaller. ${file.name} is ${formatBytes(file.size)}.`
+        );
+        return;
+      }
+      if (file.size === 0) {
+        setDatasetUploadError('Uploaded dataset file is empty.');
+        return;
+      }
+
+      const formData = new FormData();
+      formData.append('file', file);
+      setIsUploadingDataset(true);
+      setDatasetUploadProgress(0);
+      setDatasetUploadError(null);
+      setDatasetUploadSuccess(null);
+      try {
+        const res = await apiUpload(`/api/session/${sessionId}/datasets`, formData, {
+          onProgress: ({ percent }) => {
+            setDatasetUploadProgress(percent !== null && percent < 100 ? percent : null);
+          },
+        });
+        if (!res.ok) {
+          setDatasetUploadError(await readApiErrorMessage(res, 'Dataset upload failed.'));
+          return;
+        }
+        const payload = await res.json() as DatasetUploadResponse;
+        setUploadedDatasets((previous) => [payload, ...previous]);
+        setDatasetUploadSuccess(`Uploaded ${payload.filename} to ${payload.repo_id}`);
+        await onDatasetUploaded?.();
+      } catch (error) {
+        setDatasetUploadError(
+          error instanceof Error ? error.message : 'Dataset upload failed.'
+        );
+      } finally {
+        setIsUploadingDataset(false);
+        setDatasetUploadProgress(null);
+      }
+    },
+    [sessionId, onDatasetUploaded],
+  );
 
   // When the chat transport reports a premium-model quota 429, restore the typed
   // text so the user doesn't lose their message.
@@ -231,6 +333,18 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
     }
   }, [claudeQuotaExhausted]);
 
+  useEffect(() => {
+    if (!datasetUploadError) return;
+    const timeout = window.setTimeout(() => setDatasetUploadError(null), 7000);
+    return () => window.clearTimeout(timeout);
+  }, [datasetUploadError]);
+
+  useEffect(() => {
+    if (!datasetUploadSuccess) return;
+    const timeout = window.setTimeout(() => setDatasetUploadSuccess(null), 5000);
+    return () => window.clearTimeout(timeout);
+  }, [datasetUploadSuccess]);
+
   // Refresh the quota display whenever the session changes (user might
   // have started another tab that spent quota).
   useEffect(() => {
@@ -382,9 +496,12 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
         <Box
           className="composer"
           sx={{
-            display: 'flex',
-            gap: '10px',
-            alignItems: 'flex-start',
+            display: 'grid',
+            gridTemplateColumns: 'auto 1fr auto',
+            gridTemplateRows: 'auto auto',
+            columnGap: '10px',
+            rowGap: '4px',
+            alignItems: 'end',
             bgcolor: 'var(--composer-bg)',
             borderRadius: 'var(--radius-md)',
             p: '12px',
@@ -420,7 +537,7 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
                 }
             }}
             sx={{
-                flex: 1,
+                gridColumn: '1 / -1',
                 '& .MuiInputBase-root': {
                     p: 0,
                     backgroundColor: 'transparent',
@@ -431,11 +548,46 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
                 }
             }}
           />
+          <input
+            ref={fileInputRef}
+            type="file"
+            accept={DATASET_UPLOAD_ACCEPT}
+            onChange={handleDatasetFileChange}
+            style={{ display: 'none' }}
+          />
+          <Box sx={{ gridColumn: '1', gridRow: '2', display: 'flex' }}>
+            <Tooltip title="Upload dataset">
+              <span>
+                <IconButton
+                  onClick={handleDatasetUploadClick}
+                  disabled={disabled || isProcessing || isUploadingDataset || !sessionId}
+                  sx={{
+                    p: 1,
+                    borderRadius: '50%',
+                    color: uploadedDatasets.length ? 'var(--accent-yellow)' : 'var(--muted-text)',
+                    transition: 'all 0.2s',
+                    '&:hover': {
+                      color: 'var(--accent-yellow)',
+                      bgcolor: 'var(--hover-bg)',
+                    },
+                    '&.Mui-disabled': {
+                      opacity: 0.3,
+                    },
+                  }}
+                  aria-label="Upload dataset"
+                >
+                  <AddIcon fontSize="small" />
+                </IconButton>
+              </span>
+            </Tooltip>
+          </Box>
           {isProcessing ? (
             <IconButton
               onClick={onStop}
               sx={{
-                mt: 1,
+                gridColumn: '3',
+                gridRow: '2',
+                justifySelf: 'end',
                 p: 1.5,
                 borderRadius: '10px',
                 color: 'var(--muted-text)',
@@ -455,9 +607,11 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
           ) : (
             <IconButton
               onClick={handleSend}
-              disabled={disabled || !input.trim()}
+              disabled={disabled || isUploadingDataset || !input.trim()}
               sx={{
-                mt: 1,
+                gridColumn: '3',
+                gridRow: '2',
+                justifySelf: 'end',
                 p: 1,
                 borderRadius: '10px',
                 color: 'var(--muted-text)',
@@ -475,6 +629,65 @@ export default function ChatInput({ sessionId, initialModelPath, onSend, onStop,
             </IconButton>
           )}
         </Box>
+        {isUploadingDataset && (
+          <Box sx={{ mt: 1, px: 0.5 }}>
+            <LinearProgress
+              variant={datasetUploadProgress === null ? 'indeterminate' : 'determinate'}
+              value={datasetUploadProgress ?? 0}
+              aria-label="Dataset upload progress"
+              sx={{
+                height: 4,
+                borderRadius: 999,
+                bgcolor: 'rgba(255,255,255,0.08)',
+                '& .MuiLinearProgress-bar': {
+                  borderRadius: 999,
+                  bgcolor: 'var(--accent-yellow)',
+                },
+              }}
+            />
+          </Box>
+        )}
+        {(datasetUploadError || datasetUploadSuccess) && (
+          <Box sx={{ display: 'flex', justifyContent: 'center', mt: 1 }}>
+            <Alert
+              severity={datasetUploadError ? 'error' : 'success'}
+              variant="filled"
+              onClose={() => {
+                setDatasetUploadError(null);
+                setDatasetUploadSuccess(null);
+              }}
+              sx={{ fontSize: '0.8rem', maxWidth: 520, width: '100%' }}
+            >
+              {datasetUploadError ?? datasetUploadSuccess}
+            </Alert>
+          </Box>
+        )}
+        {uploadedDatasets.length > 0 && (
+          <Box sx={{ display: 'flex', flexWrap: 'wrap', gap: 0.75, justifyContent: 'center', mt: 1 }}>
+            {uploadedDatasets.map((dataset) => (
+              <Chip
+                key={dataset.upload_id}
+                size="small"
+                label={`Dataset: ${dataset.filename}`}
+                component="a"
+                href={datasetRepoUrl(dataset.repo_id)}
+                target="_blank"
+                rel="noreferrer"
+                clickable
+                sx={{
+                  maxWidth: '100%',
+                  bgcolor: 'rgba(255,255,255,0.08)',
+                  color: 'var(--text)',
+                  border: '1px solid var(--divider)',
+                  '& .MuiChip-label': {
+                    overflow: 'hidden',
+                    textOverflow: 'ellipsis',
+                  },
+                }}
+              />
+            ))}
+          </Box>
+        )}
 
         {/* Powered By Badge */}
         <Box

frontend/src/components/SessionChat.tsx

@@ -27,7 +27,16 @@ export default function SessionChat({ sessionId, isActive, onSessionDead }: Sess
   const sessionMeta = sessions.find((s) => s.id === sessionId);
   const isExpired = sessionMeta?.expired === true;
 
-  const { messages, sendMessage, stop, status, undoLastTurn, editAndRegenerate, approveTools } = useAgentChat({
+  const {
+    messages,
+    sendMessage,
+    stop,
+    status,
+    undoLastTurn,
+    editAndRegenerate,
+    approveTools,
+    refreshMessages,
+  } = useAgentChat({
     sessionId,
     isActive,
     onReady: () => logger.log(`Session ${sessionId} ready`),
@@ -116,6 +125,7 @@ export default function SessionChat({ sessionId, isActive, onSessionDead }: Sess
           initialModelPath={sessionMeta?.model}
           onSend={handleSendMessage}
           onStop={handleStop}
+          onDatasetUploaded={refreshMessages}
           isProcessing={busy}
           disabled={!isConnected || activityStatus.type === 'waiting-approval'}
           placeholder={

frontend/src/hooks/useAgentChat.ts

@@ -804,6 +804,48 @@ export function useAgentChat({ sessionId, isActive, onReady, onError, onSessionD
     }
   }, [sessionId, chat]);
 
+  const refreshMessages = useCallback(async () => {
+    try {
+      const [msgsRes, infoRes] = await Promise.all([
+        apiFetch(`/api/session/${sessionId}/messages`),
+        apiFetch(`/api/session/${sessionId}`),
+      ]);
+      if (!msgsRes.ok) return false;
+
+      const data = await msgsRes.json();
+      if (!Array.isArray(data) || data.length === 0) return false;
+      saveBackendMessages(sessionId, data);
+
+      let pendingIds: Set<string> | undefined;
+      if (infoRes.ok) {
+        const info = await infoRes.json();
+        if (info.pending_approval && Array.isArray(info.pending_approval)) {
+          pendingIds = new Set(
+            info.pending_approval.map((t: { tool_call_id: string }) => t.tool_call_id)
+          );
+          if (pendingIds.size > 0) setNeedsAttention(sessionId, true);
+        }
+        if (info.auto_approval) {
+          updateSessionYolo(sessionId, info.auto_approval);
+        }
+      }
+
+      const uiMsgs = llmMessagesToUIMessages(
+        data,
+        pendingIds,
+        chatActionsRef.current.messages,
+      );
+      const setMsgs = chatActionsRef.current.setMessages;
+      if (setMsgs && uiMsgs.length > 0) {
+        setMsgs(uiMsgs);
+        saveMessages(sessionId, uiMsgs);
+      }
+      return true;
+    } catch {
+      return false;
+    }
+  }, [sessionId, setNeedsAttention, updateSessionYolo]);
+
   return {
     messages: chat.messages,
     sendMessage: chat.sendMessage,
@@ -812,5 +854,6 @@ export function useAgentChat({ sessionId, isActive, onReady, onError, onSessionD
     undoLastTurn,
     editAndRegenerate,
     approveTools,
+    refreshMessages,
   };
 }

frontend/src/utils/api.ts

@@ -7,15 +7,36 @@
 
 import { triggerLogin } from '@/hooks/useAuth';
 
+export interface ApiUploadProgress {
+  loaded: number;
+  total: number | null;
+  percent: number | null;
+}
+
+async function handleUnauthorized(response: Response): Promise<void> {
+  if (response.status !== 401) return;
+  try {
+    const authStatus = await fetch('/auth/status', { credentials: 'include' });
+    const data = await authStatus.json();
+    if (data.auth_enabled) {
+      triggerLogin();
+      throw new Error('Authentication required — redirecting to login.');
+    }
+  } catch (e) {
+    if (e instanceof Error && e.message.includes('redirecting')) throw e;
+  }
+}
+
 /** Wrapper around fetch with credentials and common headers. */
 export async function apiFetch(
   path: string,
   options: RequestInit = {}
 ): Promise<Response> {
-  const headers: Record<string, string> = {
-    'Content-Type': 'application/json',
-    ...(options.headers as Record<string, string>),
-  };
+  const headers = new Headers(options.headers);
+  const isFormData = options.body instanceof FormData;
+  if (!isFormData && !headers.has('Content-Type')) {
+    headers.set('Content-Type', 'application/json');
+  }
 
   const response = await fetch(path, {
     ...options,
@@ -23,19 +44,50 @@ export async function apiFetch(
     credentials: 'include', // Send cookies with every request
   });
 
-  // Handle 401 — redirect to login
-  if (response.status === 401) {
-    try {
-      const authStatus = await fetch('/auth/status', { credentials: 'include' });
-      const data = await authStatus.json();
-      if (data.auth_enabled) {
-        triggerLogin();
-        throw new Error('Authentication required — redirecting to login.');
-      }
-    } catch (e) {
-      if (e instanceof Error && e.message.includes('redirecting')) throw e;
-    }
-  }
+  await handleUnauthorized(response);
 
   return response;
-}
+}
+
+function headersFromXhr(rawHeaders: string): Headers {
+  const headers = new Headers();
+  rawHeaders.trim().split(/[\r\n]+/).forEach((line) => {
+    const separator = line.indexOf(':');
+    if (separator <= 0) return;
+    headers.append(
+      line.slice(0, separator).trim(),
+      line.slice(separator + 1).trim(),
+    );
+  });
+  return headers;
+}
+
+export async function apiUpload(
+  path: string,
+  formData: FormData,
+  options: { onProgress?: (progress: ApiUploadProgress) => void } = {},
+): Promise<Response> {
+  return new Promise<Response>((resolve, reject) => {
+    const xhr = new XMLHttpRequest();
+    xhr.open('POST', path);
+    xhr.withCredentials = true;
+    xhr.upload.onprogress = (event) => {
+      const total = event.lengthComputable ? event.total : null;
+      const percent = total
+        ? Math.min(100, Math.round((event.loaded / total) * 100))
+        : null;
+      options.onProgress?.({ loaded: event.loaded, total, percent });
+    };
+    xhr.onerror = () => reject(new Error('Network error while uploading.'));
+    xhr.onabort = () => reject(new Error('Dataset upload was canceled.'));
+    xhr.onload = () => {
+      const response = new Response(xhr.responseText, {
+        status: xhr.status,
+        statusText: xhr.statusText,
+        headers: headersFromXhr(xhr.getAllResponseHeaders()),
+      });
+      handleUnauthorized(response).then(() => resolve(response)).catch(reject);
+    };
+    xhr.send(formData);
+  });
+}

pyproject.toml

@@ -28,6 +28,7 @@ dependencies = [
     "websockets>=13.0",
     "apscheduler>=3.10,<4",
     "pymongo>=4.17.0",
+    "python-multipart>=0.0.20",
 ]
 
 [project.optional-dependencies]

tests/unit/test_dataset_uploads.py

@@ -0,0 +1,465 @@
+import io
+import sys
+from pathlib import Path
+from types import SimpleNamespace
+
+import httpx
+import pytest
+from fastapi import HTTPException, UploadFile
+from huggingface_hub.errors import HfHubHTTPError
+from starlette.datastructures import FormData
+
+_BACKEND_DIR = Path(__file__).resolve().parent.parent.parent / "backend"
+if str(_BACKEND_DIR) not in sys.path:
+    sys.path.insert(0, str(_BACKEND_DIR))
+
+import dataset_uploads  # noqa: E402
+from routes import agent  # noqa: E402
+
+
+def _upload(filename: str, content: bytes = b"a,b\n1,2\n") -> UploadFile:
+    return UploadFile(filename=filename, file=io.BytesIO(content))
+
+
+def _track_close(upload: UploadFile):
+    state = {"closed": False}
+    original_close = upload.close
+
+    async def close():
+        state["closed"] = True
+        await original_close()
+
+    upload.close = close
+    return state
+
+
+def _request(
+    upload: UploadFile | None = None,
+    headers: dict[str, str] | None = None,
+):
+    state = {"form_called": False}
+
+    class FakeRequest:
+        def __init__(self):
+            self.headers = headers or {}
+            self.cookies = {}
+
+        async def form(self, **_kwargs):
+            state["form_called"] = True
+            if upload is None:
+                raise AssertionError("request.form() should not be called")
+            return FormData([("file", upload)])
+
+    return FakeRequest(), state
+
+
+def test_sanitize_dataset_filename_strips_paths_and_unsafe_chars():
+    assert (
+        dataset_uploads.sanitize_dataset_filename("../../bad file (final).CSV")
+        == "bad-file-final.csv"
+    )
+    assert dataset_uploads.sanitize_dataset_filename("") == "dataset.csv"
+
+
+def test_dataset_format_rejects_unsupported_extension():
+    with pytest.raises(HTTPException) as exc_info:
+        dataset_uploads.dataset_format_from_filename("notes.txt")
+
+    assert exc_info.value.status_code == 400
+
+    with pytest.raises(HTTPException):
+        dataset_uploads.dataset_format_from_filename("notes")
+
+
+def test_dataset_repo_card_exposes_each_upload_as_config():
+    card = dataset_uploads.dataset_repo_card(
+        "alice/ml-intern-s1-datasets",
+        [
+            "README.md",
+            "uploads/oldabc/rows.jsonl",
+            "uploads/oldabc/rows.jsonl",
+            "uploads/newdef/table.csv",
+        ],
+    ).decode("utf-8")
+
+    assert "configs:" in card
+    assert "- config_name: upload_oldabc" in card
+    assert '    path: "uploads/oldabc/rows.jsonl"' in card
+    assert "- config_name: upload_newdef" in card
+    assert '    path: "uploads/newdef/table.csv"' in card
+    assert card.count("- config_name: upload_oldabc") == 1
+
+
+@pytest.mark.asyncio
+async def test_validate_dataset_upload_rejects_size_over_limit(monkeypatch):
+    monkeypatch.setattr(dataset_uploads, "MAX_DATASET_UPLOAD_BYTES", 3)
+    upload = _upload("rows.csv", b"abcd")
+    try:
+        with pytest.raises(HTTPException) as exc_info:
+            await dataset_uploads.validate_dataset_upload(upload)
+    finally:
+        await upload.close()
+
+    assert exc_info.value.status_code == 413
+
+
+@pytest.mark.asyncio
+async def test_push_dataset_upload_creates_private_repo_and_uploads_file(monkeypatch):
+    instances = []
+
+    class FakeApi:
+        def __init__(self, token):
+            self.token = token
+            self.create_calls = []
+            self.settings_calls = []
+            self.list_calls = []
+            self.upload_calls = []
+            instances.append(self)
+
+        def create_repo(self, **kwargs):
+            self.create_calls.append(kwargs)
+
+        def update_repo_settings(self, **kwargs):
+            self.settings_calls.append(kwargs)
+
+        def list_repo_files(self, **kwargs):
+            self.list_calls.append(kwargs)
+            return [
+                "README.md",
+                "uploads/oldupload/old.jsonl",
+                "uploads/notes.txt",
+            ]
+
+        def upload_file(self, **kwargs):
+            if kwargs["path_in_repo"] != "README.md":
+                assert kwargs["path_or_fileobj"] == b"a,b\n1,2\n"
+            self.upload_calls.append(kwargs)
+
+    monkeypatch.setattr(dataset_uploads, "HfApi", FakeApi)
+    monkeypatch.setattr(
+        dataset_uploads.uuid,
+        "uuid4",
+        lambda: SimpleNamespace(hex="feedfacecafebeef"),
+    )
+
+    upload = _upload("../Data Set.CSV")
+    try:
+        result = await dataset_uploads.push_dataset_upload_to_hub(
+            upload=upload,
+            session_id="12345678-90ab-cdef-1234-567890abcdef",
+            hf_username="alice",
+            hf_token="hf-token",
+        )
+    finally:
+        await upload.close()
+
+    api = instances[0]
+    assert api.token == "hf-token"
+    assert api.create_calls == [
+        {
+            "repo_id": "alice/ml-intern-12345678-datasets",
+            "repo_type": "dataset",
+            "private": True,
+            "exist_ok": True,
+        }
+    ]
+    assert api.settings_calls == [
+        {
+            "repo_id": "alice/ml-intern-12345678-datasets",
+            "repo_type": "dataset",
+            "private": True,
+        }
+    ]
+    assert api.list_calls == [
+        {
+            "repo_id": "alice/ml-intern-12345678-datasets",
+            "repo_type": "dataset",
+        }
+    ]
+    assert [call["path_in_repo"] for call in api.upload_calls] == [
+        "uploads/feedfacecafe/Data-Set.csv",
+        "README.md",
+    ]
+    readme = api.upload_calls[1]["path_or_fileobj"].decode("utf-8")
+    assert "- config_name: upload_oldupload" in readme
+    assert '    path: "uploads/oldupload/old.jsonl"' in readme
+    assert "- config_name: upload_feedfacecafe" in readme
+    assert '    path: "uploads/feedfacecafe/Data-Set.csv"' in readme
+    assert result.repo_id == "alice/ml-intern-12345678-datasets"
+    assert result.config_name == "upload_feedfacecafe"
+    assert result.format == "csv"
+    assert result.load_dataset_snippet == (
+        "from datasets import load_dataset\n\n"
+        'dataset = load_dataset("alice/ml-intern-12345678-datasets", '
+        '"upload_feedfacecafe", split="train", token=True)'
+    )
+
+
+@pytest.mark.asyncio
+async def test_upload_route_requires_hf_token_without_parsing_upload(monkeypatch):
+    monkeypatch.delenv("HF_TOKEN", raising=False)
+    upload = _upload("rows.csv")
+    close_state = _track_close(upload)
+    request, request_state = _request(upload)
+
+    async def fake_check_session_access(*_args, **_kwargs):
+        return SimpleNamespace(
+            is_active=True,
+            is_processing=False,
+            session=SimpleNamespace(pending_approval=None),
+            hf_username="alice",
+        )
+
+    monkeypatch.setattr(agent, "_check_session_access", fake_check_session_access)
+
+    try:
+        with pytest.raises(HTTPException) as exc_info:
+            await agent.upload_session_dataset(
+                "s1",
+                request,
+                {"user_id": "u1", "username": "alice"},
+            )
+
+        assert exc_info.value.status_code == 401
+        assert request_state["form_called"] is False
+        assert close_state["closed"] is False
+    finally:
+        await upload.close()
+
+
+@pytest.mark.asyncio
+async def test_upload_route_rejects_content_length_before_parsing(monkeypatch):
+    upload = _upload("rows.csv")
+    close_state = _track_close(upload)
+    request, request_state = _request(
+        upload,
+        headers={
+            "content-length": str(
+                dataset_uploads.MAX_DATASET_UPLOAD_BYTES
+                + agent.DATASET_UPLOAD_MULTIPART_SLACK_BYTES
+                + 1
+            )
+        },
+    )
+
+    async def fake_check_session_access(*_args, **_kwargs):
+        raise AssertionError("session access should not run for oversized uploads")
+
+    monkeypatch.setattr(agent, "_check_session_access", fake_check_session_access)
+
+    try:
+        with pytest.raises(HTTPException) as exc_info:
+            await agent.upload_session_dataset(
+                "s1",
+                request,
+                {
+                    "user_id": "u1",
+                    "username": "alice",
+                    agent.INTERNAL_HF_TOKEN_KEY: "hf-token",
+                },
+            )
+
+        assert exc_info.value.status_code == 413
+        assert request_state["form_called"] is False
+        assert close_state["closed"] is False
+    finally:
+        await upload.close()
+
+
+@pytest.mark.asyncio
+async def test_upload_route_rejects_busy_session_without_parsing_upload(monkeypatch):
+    upload = _upload("rows.csv")
+    close_state = _track_close(upload)
+    request, request_state = _request(upload)
+
+    async def fake_check_session_access(*_args, **_kwargs):
+        return SimpleNamespace(
+            is_active=True,
+            is_processing=True,
+            session=SimpleNamespace(pending_approval=None),
+            hf_username="alice",
+        )
+
+    monkeypatch.setattr(agent, "_check_session_access", fake_check_session_access)
+
+    with pytest.raises(HTTPException) as exc_info:
+        await agent.upload_session_dataset(
+            "s1",
+            request,
+            {
+                "user_id": "u1",
+                "username": "alice",
+                agent.INTERNAL_HF_TOKEN_KEY: "hf-token",
+            },
+        )
+
+    assert exc_info.value.status_code == 409
+    assert request_state["form_called"] is False
+    assert close_state["closed"] is False
+    await upload.close()
+
+
+@pytest.mark.asyncio
+async def test_upload_route_appends_context_note_and_persists(monkeypatch):
+    upload = _upload("rows.jsonl", b'{"text":"hi"}\n')
+    close_state = _track_close(upload)
+    request, request_state = _request(upload)
+    messages = []
+    persisted = []
+    agent_session = SimpleNamespace(
+        is_active=True,
+        is_processing=False,
+        session=SimpleNamespace(
+            pending_approval=None,
+            context_manager=SimpleNamespace(add_message=messages.append),
+        ),
+        hf_username="alice",
+    )
+    uploaded = dataset_uploads.DatasetUpload(
+        session_id="s1",
+        repo_id="alice/ml-intern-s1-datasets",
+        repo_type="dataset",
+        private=True,
+        upload_id="abc123",
+        config_name="upload_abc123",
+        filename="rows.jsonl",
+        original_filename="rows.jsonl",
+        path_in_repo="uploads/abc123/rows.jsonl",
+        size_bytes=14,
+        format="jsonl",
+        hub_url="https://huggingface.co/datasets/alice/ml-intern-s1-datasets/blob/main/uploads/abc123/rows.jsonl",
+        load_dataset_snippet='dataset = load_dataset("json")',
+    )
+
+    async def fake_check_session_access(*_args, **_kwargs):
+        return agent_session
+
+    async def fake_push_dataset_upload_to_hub(**kwargs):
+        assert kwargs["upload"] is upload
+        assert kwargs["hf_token"] == "hf-token"
+        return uploaded
+
+    async def fake_persist_session_snapshot(value):
+        persisted.append(value)
+
+    monkeypatch.setattr(agent, "_check_session_access", fake_check_session_access)
+    monkeypatch.setattr(
+        agent, "push_dataset_upload_to_hub", fake_push_dataset_upload_to_hub
+    )
+    monkeypatch.setattr(
+        agent.session_manager,
+        "persist_session_snapshot",
+        fake_persist_session_snapshot,
+    )
+
+    response = await agent.upload_session_dataset(
+        "s1",
+        request,
+        {
+            "user_id": "u1",
+            "username": "alice",
+            agent.INTERNAL_HF_TOKEN_KEY: "hf-token",
+        },
+    )
+
+    assert response.repo_id == uploaded.repo_id
+    assert response.config_name == uploaded.config_name
+    assert response.path_in_repo == uploaded.path_in_repo
+    assert len(messages) == 1
+    assert messages[0].role == "user"
+    assert messages[0].content.startswith("[SYSTEM:")
+    assert uploaded.config_name in messages[0].content
+    assert uploaded.path_in_repo in messages[0].content
+    assert persisted == [agent_session]
+    assert request_state["form_called"] is True
+    assert close_state["closed"] is True
+
+
+@pytest.mark.asyncio
+async def test_upload_route_closes_upload_when_hub_upload_fails(monkeypatch):
+    upload = _upload("rows.csv")
+    close_state = _track_close(upload)
+    request, request_state = _request(upload)
+
+    async def fake_check_session_access(*_args, **_kwargs):
+        return SimpleNamespace(
+            is_active=True,
+            is_processing=False,
+            session=SimpleNamespace(pending_approval=None),
+            hf_username="alice",
+        )
+
+    async def fake_push_dataset_upload_to_hub(**_kwargs):
+        raise RuntimeError("hub unavailable")
+
+    monkeypatch.setattr(agent, "_check_session_access", fake_check_session_access)
+    monkeypatch.setattr(
+        agent, "push_dataset_upload_to_hub", fake_push_dataset_upload_to_hub
+    )
+
+    with pytest.raises(HTTPException) as exc_info:
+        await agent.upload_session_dataset(
+            "s1",
+            request,
+            {
+                "user_id": "u1",
+                "username": "alice",
+                agent.INTERNAL_HF_TOKEN_KEY: "hf-token",
+            },
+        )
+
+    assert exc_info.value.status_code == 502
+    assert exc_info.value.detail == "Dataset upload failed. Please try again."
+    assert request_state["form_called"] is True
+    assert close_state["closed"] is True
+
+
+@pytest.mark.asyncio
+async def test_upload_route_maps_hub_permission_error_safely(monkeypatch):
+    upload = _upload("rows.csv")
+    close_state = _track_close(upload)
+    request, request_state = _request(upload)
+
+    async def fake_check_session_access(*_args, **_kwargs):
+        return SimpleNamespace(
+            is_active=True,
+            is_processing=False,
+            session=SimpleNamespace(pending_approval=None),
+            hf_username="alice",
+        )
+
+    async def fake_push_dataset_upload_to_hub(**_kwargs):
+        response = httpx.Response(
+            403,
+            request=httpx.Request("POST", "https://huggingface.co/api/datasets"),
+            headers={"x-request-id": "req-123"},
+        )
+        raise HfHubHTTPError(
+            "403 Forbidden: token hf_secret cannot write",
+            response=response,
+            server_message="token hf_secret cannot write",
+        )
+
+    monkeypatch.setattr(agent, "_check_session_access", fake_check_session_access)
+    monkeypatch.setattr(
+        agent, "push_dataset_upload_to_hub", fake_push_dataset_upload_to_hub
+    )
+
+    with pytest.raises(HTTPException) as exc_info:
+        await agent.upload_session_dataset(
+            "s1",
+            request,
+            {
+                "user_id": "u1",
+                "username": "alice",
+                agent.INTERNAL_HF_TOKEN_KEY: "hf-token",
+            },
+        )
+
+    assert exc_info.value.status_code == 403
+    assert exc_info.value.detail == (
+        "Hugging Face denied permission to create or write to the dataset repo."
+    )
+    assert "hf_secret" not in exc_info.value.detail
+    assert request_state["form_called"] is True
+    assert close_state["closed"] is True

uv.lock

@@ -1788,6 +1788,7 @@ dependencies = [
     { name = "pydantic" },
     { name = "pymongo" },
     { name = "python-dotenv" },
+    { name = "python-multipart" },
     { name = "requests" },
     { name = "rich" },
     { name = "thefuzz" },
@@ -1840,6 +1841,7 @@ requires-dist = [
     { name = "pytest", marker = "extra == 'dev'", specifier = ">=9.0.2" },
     { name = "pytest-asyncio", marker = "extra == 'dev'", specifier = ">=1.2.0" },
     { name = "python-dotenv", specifier = ">=1.2.1" },
+    { name = "python-multipart", specifier = ">=0.0.20" },
     { name = "requests", specifier = ">=2.33.0" },
     { name = "rich", specifier = ">=13.0.0" },
     { name = "ruff", marker = "extra == 'dev'", specifier = ">=0.15.12" },