From eddb31853ef53c7441bb69010b6ebd964a55d389 Mon Sep 17 00:00:00 2001
From: Dustin Healy <54083382+dustinhealy@users.noreply.github.com>
Date: Sun, 7 Jun 2026 21:27:29 -0700
Subject: [PATCH] =?UTF-8?q?=F0=9F=A9=B9=20fix:=20PII=20filter=20UX=20gaps?=
 =?UTF-8?q?=20surfaced=20by=20Copilot=20review?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The pendingEvents replay path in useResumableSSE was dispatching
pii_matches events through contentHandler instead of piiMatchesHandler,
so a warn-mode toast would silently fail when the subscriber connected
after the event was buffered. Added the missing branch alongside the
existing live-stream check.

The starterPatterns comment in librechat.example.yaml claimed an
omitted field enables all five starter ids, but the default actually
selects only the low-false-positive set (sk_prefix, bearer_header,
api_key_header). The query-param patterns (api_key_query, key_query)
require explicit opt-in. Rewrote the comment to match the resolver
in selectStarterPatterns.
---
 client/src/hooks/SSE/useResumableSSE.ts |  2 ++
 librechat.example.yaml                  | 10 ++++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/client/src/hooks/SSE/useResumableSSE.ts b/client/src/hooks/SSE/useResumableSSE.ts
index 0815f2c281..c1bfe8700e 100644
--- a/client/src/hooks/SSE/useResumableSSE.ts
+++ b/client/src/hooks/SSE/useResumableSSE.ts
@@ -702,6 +702,8 @@ export default function useResumableSSE(
                   titleHandler(pendingEvent);
                 } else if (pendingEvent.event != null) {
                   stepHandler(pendingEvent, resumeSubmission);
+                } else if (pendingEvent.type === 'pii_matches') {
+                  piiMatchesHandler(pendingEvent);
                 } else if (pendingEvent.type != null) {
                   contentHandler({ data: pendingEvent, submission: resumeSubmission });
                 }
diff --git a/librechat.example.yaml b/librechat.example.yaml
index 4825a3bf93..6f8a318ccc 100644
--- a/librechat.example.yaml
+++ b/librechat.example.yaml
@@ -786,10 +786,12 @@ endpoints:
 #   onMatch: warn
 #
 #   # Starter patterns ported from danny-avila/LibreChat#13561's winston log
-#   # redaction. Omit the field to enable all 5; pass an empty list to enable
-#   # none and rely entirely on customPatterns.
-#   # Available ids: sk_prefix, bearer_header, api_key_header, api_key_query, key_query
-#   starterPatterns: [sk_prefix, bearer_header, api_key_header, api_key_query, key_query]
+#   # redaction. Omit the field to enable the low-false-positive default set
+#   # (sk_prefix, bearer_header, api_key_header). Pass an explicit list to
+#   # subset the default set or to opt in to the higher-false-positive query
+#   # patterns (api_key_query, key_query); pass an empty list to disable
+#   # starters entirely and rely on customPatterns alone.
+#   starterPatterns: [sk_prefix, bearer_header, api_key_header]
 #
 #   # Operator-defined regex additions. Each entry needs a stable id (used in
 #   # logs and the SSE payload), a human-readable label (shown to users in the