diff --git a/web/.gitignore b/web/.gitignore
index 9de3dc83f9..1a81282c4c 100644
--- a/web/.gitignore
+++ b/web/.gitignore
@@ -64,3 +64,6 @@ public/fallback-*.js
 
 .vscode/settings.json
 .vscode/mcp.json
+
+# CodeGraph local index
+.codegraph/
diff --git a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
index 0af77116c7..145fc2b880 100644
--- a/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
+++ b/web/app/(commonLayout)/app/(appDetailLayout)/[appId]/layout-main.tsx
@@ -113,7 +113,7 @@ const AppDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
         : []),
       ...(appACLCapabilities.canAccessConfig
         ? [{
-            name: t('settings.accessConfig', { ns: 'common' }),
+            name: t('settings.appAccess', { ns: 'common' }),
             href: `/app/${appId}/access-config`,
             icon: RiUserSettingsLine,
             selectedIcon: RiUserSettingsFill,
diff --git a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
index 2466f5a1d8..15542362e8 100644
--- a/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
+++ b/web/app/(commonLayout)/datasets/(datasetDetailLayout)/[datasetId]/layout-main.tsx
@@ -105,7 +105,7 @@ const DatasetDetailLayout: FC<IAppDetailLayoutProps> = (props) => {
         visible: datasetACLCapabilities.canReadonly || datasetACLCapabilities.canEdit,
       },
       {
-        name: t('settings.accessConfig', { ns: 'common' }),
+        name: t('settings.knowledgeBaseAccess', { ns: 'common' }),
         href: `/datasets/${datasetId}/access-config`,
         icon: RiUserSettingsLine,
         selectedIcon: RiUserSettingsFill,
diff --git a/web/app/components/app-sidebar/index.tsx b/web/app/components/app-sidebar/index.tsx
index 6fe5fffe8c..b5cd0c2535 100644
--- a/web/app/components/app-sidebar/index.tsx
+++ b/web/app/components/app-sidebar/index.tsx
@@ -113,7 +113,7 @@ const AppDetailNav = ({
       ref={sidebarRef}
       className={cn(
         'flex shrink-0 flex-col border-r border-divider-burn bg-background-default-subtle transition-all',
-        expand ? 'w-[216px]' : 'w-14',
+        expand ? 'w-55' : 'w-14',
       )}
     >
       <div
diff --git a/web/app/components/app/access-config/__tests__/index.spec.tsx b/web/app/components/app/access-config/__tests__/index.spec.tsx
index 0c02c900d2..dad2eabd6e 100644
--- a/web/app/components/app/access-config/__tests__/index.spec.tsx
+++ b/web/app/components/app/access-config/__tests__/index.spec.tsx
@@ -52,7 +52,7 @@ describe('AppAccessConfigPage', () => {
     it('should render access config title and pass app id to the editor', () => {
       render(<AppAccessConfigPage appId="app-1" />)
 
-      expect(screen.getByRole('heading', { name: 'common.settings.accessConfig' })).toBeInTheDocument()
+      expect(screen.getByRole('heading', { name: 'common.settings.appAccessPermissions' })).toBeInTheDocument()
       expect(screen.getByTestId('access-rules-editor')).toHaveTextContent('app-1:false')
       expect(mockAccessRulesEditor.props?.rules).toEqual([])
     })
diff --git a/web/app/components/app/access-config/index.tsx b/web/app/components/app/access-config/index.tsx
index a4fdc75131..bee49b4ea6 100644
--- a/web/app/components/app/access-config/index.tsx
+++ b/web/app/components/app/access-config/index.tsx
@@ -29,7 +29,7 @@ const AppAccessConfigPage = ({ appId }: AppAccessConfigPageProps) => {
       slotClassNames={{ viewport: 'overscroll-contain' }}
     >
       <div className="w-full px-16 py-8">
-        <h1 className="title-2xl-semi-bold text-text-primary">{t('settings.accessConfig', { ns: 'common' })}</h1>
+        <h1 className="title-2xl-semi-bold text-text-primary">{t('settings.appAccessPermissions', { ns: 'common' })}</h1>
         <div className="mt-6">
           <AccessRulesEditor resourceId={appId} rules={appAccessRules} canManage={appACLCapabilities.canAccessConfig} />
         </div>
diff --git a/web/app/components/apps/app-card.tsx b/web/app/components/apps/app-card.tsx
index b43284ff17..d6cbd90095 100644
--- a/web/app/components/apps/app-card.tsx
+++ b/web/app/components/apps/app-card.tsx
@@ -191,7 +191,7 @@ const AppCardOperationsMenu: React.FC<AppCardOperationsMenuProps> = ({
       )}
       {appACLCapabilities.canAccessConfig && (
         <DropdownMenuItem className="gap-2 px-3" onClick={handleOpenAccessConfig}>
-          <span className="text-sm leading-5 text-text-secondary">{t('settings.accessConfig', { ns: 'common' })}</span>
+          <span className="text-sm leading-5 text-text-secondary">{t('settings.appAccess', { ns: 'common' })}</span>
         </DropdownMenuItem>
       )}
       {appACLCapabilities.canDelete && (
diff --git a/web/app/components/datasets/access-config/__tests__/index.spec.tsx b/web/app/components/datasets/access-config/__tests__/index.spec.tsx
index 39a20b243f..40eb79cf8d 100644
--- a/web/app/components/datasets/access-config/__tests__/index.spec.tsx
+++ b/web/app/components/datasets/access-config/__tests__/index.spec.tsx
@@ -52,7 +52,7 @@ describe('DatasetAccessConfigPage', () => {
     it('should render access config title and pass dataset id to the editor', () => {
       render(<DatasetAccessConfigPage datasetId="dataset-1" />)
 
-      expect(screen.getByRole('heading', { name: 'common.settings.accessConfig' })).toBeInTheDocument()
+      expect(screen.getByRole('heading', { name: 'common.settings.knowledgeBaseAccessPermissions' })).toBeInTheDocument()
       expect(screen.getByTestId('access-rules-editor')).toHaveTextContent('dataset-1:false')
       expect(mockAccessRulesEditor.props?.rules).toEqual([])
     })
diff --git a/web/app/components/datasets/access-config/index.tsx b/web/app/components/datasets/access-config/index.tsx
index 74f241dd66..3e3b898bc3 100644
--- a/web/app/components/datasets/access-config/index.tsx
+++ b/web/app/components/datasets/access-config/index.tsx
@@ -29,7 +29,7 @@ const DatasetAccessConfigPage = ({ datasetId }: DatasetAccessConfigPageProps) =>
       slotClassNames={{ viewport: 'overscroll-contain' }}
     >
       <div className="px-12 py-8">
-        <h1 className="title-2xl-semi-bold text-text-primary">{t('settings.accessConfig', { ns: 'common' })}</h1>
+        <h1 className="title-2xl-semi-bold text-text-primary">{t('settings.knowledgeBaseAccessPermissions', { ns: 'common' })}</h1>
         <div className="mt-6">
           <AccessRulesEditor resourceId={datasetId} rules={datasetAccessRules} canManage={datasetACLCapabilities.canAccessConfig} />
         </div>
diff --git a/web/app/components/datasets/list/dataset-card/operations.tsx b/web/app/components/datasets/list/dataset-card/operations.tsx
index 5fe193433a..be1420db41 100644
--- a/web/app/components/datasets/list/dataset-card/operations.tsx
+++ b/web/app/components/datasets/list/dataset-card/operations.tsx
@@ -67,7 +67,7 @@ const Operations = ({
       {showAccessConfig && (
         <DropdownMenuItem onClick={handleAccessConfig}>
           <span aria-hidden className="mr-1 i-ri-user-settings-line size-4 text-text-tertiary" />
-          {t('settings.accessConfig', { ns: 'common' })}
+          {t('settings.knowledgeBaseAccess', { ns: 'common' })}
         </DropdownMenuItem>
       )}
       {showDelete && (
diff --git a/web/app/components/header/account-setting/index.tsx b/web/app/components/header/account-setting/index.tsx
index 5414567d30..4f2aef8eba 100644
--- a/web/app/components/header/account-setting/index.tsx
+++ b/web/app/components/header/account-setting/index.tsx
@@ -90,7 +90,7 @@ export default function AccountSetting({
         },
         {
           key: ACCOUNT_SETTING_TAB.ACCESS_RULES,
-          name: t('settings.accessRules', { ns: 'common' }),
+          name: t('settings.resourceAccess', { ns: 'common' }),
           icon: <span className={cn('i-ri-shield-user-line', iconClassName)} />,
           activeIcon: <span className={cn('i-ri-shield-user-fill', iconClassName)} />,
         },
diff --git a/web/i18n/en-US/common.json b/web/i18n/en-US/common.json
index a02df3d9c5..0adfcbfc63 100644
--- a/web/i18n/en-US/common.json
+++ b/web/i18n/en-US/common.json
@@ -635,8 +635,11 @@
   "provider.saveFailed": "Save api key failed",
   "provider.validatedError": "Validation failed: ",
   "provider.validating": "Validating key...",
-  "settings.accessConfig": "Access Config",
-  "settings.accessRules": "Access Rules",
+  "settings.appAccess": "App Access",
+  "settings.appAccessPermissions": "App Access Permissions",
+  "settings.knowledgeBaseAccess": "Knowledge base access",
+  "settings.knowledgeBaseAccessPermissions": "Knowledge Base Access Permissions",
+  "settings.resourceAccess": "Resource Access",
   "settings.account": "My account",
   "settings.accountGroup": "GENERAL",
   "settings.apiBasedExtension": "API Extension",
diff --git a/web/i18n/ja-JP/common.json b/web/i18n/ja-JP/common.json
index 16574214ba..383e0eca91 100644
--- a/web/i18n/ja-JP/common.json
+++ b/web/i18n/ja-JP/common.json
@@ -635,8 +635,11 @@
   "provider.saveFailed": "API キーの保存に失敗しました",
   "provider.validatedError": "検証に失敗しました：",
   "provider.validating": "キーの検証中...",
-  "settings.accessConfig": "アクセス設定",
-  "settings.accessRules": "アクセスルール",
+  "settings.appAccess": "アプリアクセス",
+  "settings.appAccessPermissions": "アプリアクセス権限",
+  "settings.knowledgeBaseAccess": "ナレッジベースアクセス",
+  "settings.knowledgeBaseAccessPermissions": "ナレッジベースアクセス権限",
+  "settings.resourceAccess": "リソースアクセス",
   "settings.account": "マイアカウント",
   "settings.accountGroup": "アカウント",
   "settings.apiBasedExtension": "API 拡張",
diff --git a/web/i18n/zh-Hans/common.json b/web/i18n/zh-Hans/common.json
index 7216471938..12d52a4bb9 100644
--- a/web/i18n/zh-Hans/common.json
+++ b/web/i18n/zh-Hans/common.json
@@ -635,8 +635,11 @@
   "provider.saveFailed": "API 密钥保存失败",
   "provider.validatedError": "校验失败：",
   "provider.validating": "验证密钥中...",
-  "settings.accessConfig": "访问配置",
-  "settings.accessRules": "访问规则",
+  "settings.appAccess": "应用访问",
+  "settings.appAccessPermissions": "应用访问权限",
+  "settings.knowledgeBaseAccess": "知识库访问",
+  "settings.knowledgeBaseAccessPermissions": "知识库访问权限",
+  "settings.resourceAccess": "资源访问",
   "settings.account": "我的账户",
   "settings.accountGroup": "通用",
   "settings.apiBasedExtension": "API 扩展",