1540 commits

Author	SHA1	Message	Date
Danny Avila	8b1fcc0fc2	🌐 fix: Expose Gemini Models to Vertex AI Agents (#15234) ... * 🌐 fix: Expose Gemini Models to Vertex AI Agents * ♻️ refactor: Resolve Shared Vertex Model Catalogs * fix: Preserve Exact Vertex Model Catalogs * style: Format Agent Model Selection * test: Preserve Native FS in Stable Diffusion Spec	2026-08-27 06:50:23 -04:00
Danny Avila	44edcbe014	🧾 feat: Store Durable Event Actor Receipts (#15265) ... * 🧾 feat: Store durable event actor receipts * 📊 fix: Scope actor delivery metrics * 🧱 fix: Close durable receipt recovery gaps * fix: serialize actor action admission * fix: retire terminal batch members * fix: close actor terminal recovery races * fix: reclaim lanes after terminal receipts * fix: close actor receipt recovery gaps * fix: preserve ambiguous legacy handling * fix: recover legacy actor outcomes * fix: admit leased actor actions * fix: serialize actor admission recovery * fix: close actor recovery races * fix: token-fence actor admissions * fix: preserve mixed-version actor fences * fix: harden actor rollout and metrics * fix: gate durable actor receipt rollout * fix: enforce base actor receipt rollout * fix: align experimental actor rollout	2026-08-27 06:00:43 -04:00
Danny Avila	62a55213f0	🖇️ fix: Bind Model-Spec Authorization to the Loaded Agent (#15256)	2026-08-26 10:38:20 -04:00
Danny Avila	0c959deb99	🧢 fix: Cap Batched HITL Answers Before PII and Moderation (#15257)	2026-08-26 10:10:19 -04:00
Danny Avila	68fc46a055	🪢 feat: Resume Bound Event Actors from Checkpoint Forks (#15227) ... * feat: resume event actors from checkpoint forks * fix: fence event actor checkpoint uncertainty * fix: satisfy event actor type contracts * fix: make actor reconciliation recoverable * fix: preserve event actor lifecycle transitions * fix: fence event actor lifecycle outcomes * fix: enforce event actor lifecycle ownership * fix: retain event actor settlement proof * 🔒 fix: Retain Event Actor Receipts Through Repair and Bound Their Journal Repair and compensation deleted the reconciliation row they resolved, which was the only durable proof that the invocation had already applied an external action. A delayed duplicate owner could then reacquire the same invocation id and repeat that action. Both resolutions now retire their receipt to `settled` and record how it settled, so the same-id tombstone survives; `history_repaired` and `action_compensated` still force a cold rebuild. Compensation undoes the effect without re-authorizing the delivery, so a legitimate retry must arrive under a new invocation id. A retried repair converges on its own receipt. Bound the journal so a long-lived actor cannot grow its conversation document without limit: a new fence is admitted only when no active lifecycle row exists, so a capped push can evict nothing but the oldest settled receipts. Stop shipping the unbounded source payload on every bound-child continuation. It rode the delivery body regardless of the feature flag while the sibling `fire` body deliberately sends event identity alone, so a large webhook payload could push a previously working delivery past the chat route's body limit. The actor binds an invocation from identity and never builds the prompt from it. Blank the positional token map on warm continuations. It is derived from the full DB history, while a warm run executes on checkpoint-restored state, so its indices address different messages and the pruner never recounts them — misattributing cached counts to the wrong messages in both directions. Keep the replaced-claim exit on its cleanup path when preserving reconciliation fails: the committing CAS already left a blocking row, so the failed status upgrade costs provenance, not safety. * 🧪 test: Pin the Warm Continuation's Map/Summary Asymmetry Give the warm-continuation client test a populated token map and a real cross-run summary so its assertions bite: the positional map must arrive blank (checkpoint-restored state no longer matches DB-derived indices, and the pruner never recounts a populated entry) while `initialSummary` must pass through unchanged — it rides the system tail and summarizes pre-boundary turns that were excluded from the very history the committed checkpoint was built from, so blanking it would silently drop context no warm run can recover. * ⚖️ fix: Honor Compensation in Settlement and Age-Bound the Receipt Journal A compensated receipt still tombstones its invocation id, but its external effect was explicitly undone — the terminal handler nonetheless replayed every settled lifecycle's stored action as authoritative and settled the public outcome as applied, telling an action-aware source the operation stands and suppressing the new-invocation retry compensation requires. The handler now settles a compensated invocation as failed with an explicit compensation error, overriding even fresh applied run evidence from a replayed generation; verified and repaired receipts continue to replay applied. Receipt eviction is now primarily age-based: a stale same-id owner is bounded by time, not by how many newer invocations settle, so the previous count-only slice let a high-rate actor evict a tombstone while its delayed duplicate owner could still wake and repeat the action. Admission prunes only settled receipts older than a retention window that dwarfs every generation, job, and delivery-retry lifetime, and the count cap is demoted to a raised document-size backstop. * 🔀 fix: Serialize Compensation Against Settlement and Never Evict Live Receipts The terminal handler read its lifecycle snapshot, verified history, and then settled the public outcome — so a compensation resolving the same receipt during that window lost: the handler settled applied from its stale snapshot and no retry could ever change the replay-identity-locked outcome. The receipt's status CAS is now the serialization point: verification resolves the receipt BEFORE settling, whichever transition wins determines the public outcome, and a crash between resolve and settle converges through the retained receipt's replay. The verified-replay probe requires the receipt's own resolution, so a compensated receipt can never satisfy a verification retry. This inverts the settle-before-receipt ordering deliberately: that ordering guarded proof that resolution used to delete, and the receipt now retains its full action proof through resolution. The document-size cap is no longer an eviction quota. A receipt inside its retention window is never discarded: when the journal holds a full cap of unexpired receipts, new invocations are refused fail-closed until receipts age out, making duplicate protection and document integrity simultaneous invariants instead of a rate-dependent trade. * 🎓 fix: Keep Skill-Bearing Event Actors on the Legacy Path Skill primes are spliced into the message list directly ahead of the newest message, and a warm continuation forwards only that newest message — so a checkpoint-restored actor would keep serving the prime bodies baked in at its last cold start and never observe an edited or newly attached skill. Until the actor head carries a context fingerprint that forces a cold rebuild when the agent's skill context changes, agents with always-apply or manual skill primes stay on the legacy path, which re-primes fresh bodies every turn: correct on every event, just never warm. * 📜 fix: Gate Fork Mode on the Skills Capability, Not Just Request-Time Primes History-derived re-priming was a third path into the same staleness class: an actor that previously invoked a skill carries no request-time prime arrays, yet primeInvokedSkills re-resolves that skill's current body from history each turn and the warm slice drops the reconstruction — leaving the checkpoint's old body active after edits. The fork gate now keys on the priming hook itself (present exactly when the skills capability is enabled) alongside the request-time arrays, so every skill-body path routes to the legacy rebuild until #15235's context fingerprint restores warm continuation for skill-bearing actors. * 🧾 fix: Capture Applied-Action Proof at Tool Execution, Not After sendMessage The executor read applied-action evidence from the run-step collection the instant sendMessage resolved, but that collection is populated asynchronously — an applied invocation could classify as actionless (runSteps still empty while the tool result already streamed), discarding its fork and stranding the actor cold while the terminal handler later settled the same delivery as applied from the persisted evidence. Authoritative proof is now recorded in graph context the moment the expected tool executes: the request-owned recorder observes the tool-end chain (which ToolNode dispatches synchronously with both input and output) and applies the same fences as run-step evidence — exact tool name with the MCP-suffixed form, the declared argument subset against the execution input, an error-free result, and the background non-execution receipt exclusion. readAppliedAction consults the receipt first; run-step inspection remains the fallback for paths that bypass the tool-end chain. Regression coverage reproduces the observed ordering: the real executor commits the head from the receipt while run steps are empty, warm-continues the next event, and never re-executes the action; recorder fences and the receipt-first controller wiring are covered separately. * 🎯 fix: Supply Execution Arguments to the Tool End Callback The live Vertex + MCP canary exposed a contract mismatch the synthetic fixtures hid: the ON_TOOL_EXECUTE execution path invoked its tool end callback with output only, while the action recorder must verify the declared argument subset against the execution input. The receipt never qualified, every turn fell back to cold history rebuilds, and the tournament advanced with zero actor heads and zero retained checkpoints while looking successful. The execution handler owns both halves at the same moment, so the fix is at the source rather than a correlation store: ToolEndCallbackData gains the executed call's input and every callback site passes tc.args. A handler-level regression drives the real createToolExecuteHandler and asserts the callback receives both fields; recorder regressions pin the production shapes — an output-only tool end must starve an argument-fenced receipt rather than trust an unfenced match, and still qualifies a name-only expected action. * 🕵️ fix: Mark Background Deliveries So They Cannot Impersonate Applied Actions The background-claim callback reports the ORIGINAL tool's name for artifact attribution on the poll turn that harvests a completed task. A name-only expected action could therefore be impersonated by work some earlier turn dispatched: the recorder would attribute that delivery to the current invocation and commit a head whose state never contained the invocation's own action. The run-step evidence path never had this hole — it sees the poll tool's name — so the recorder must match its provenance discipline. Delivery callbacks now carry an explicit backgroundDelivery marker set at the one site that rewrites the name, and the recorder ignores marked deliveries outright. Regressions pin both halves of the contract: the delivery callback must carry the marker with the poll call's arguments, and a marked delivery can never qualify even a name-only expected action. * 🧿 fix: Version Invalidations, Keep Evidence Ahead of Output Policy, Gate Detachable Actions Three closeout-round findings, each converted into an invariant. Every legacy-path invalidation now advances a durable epoch — including for headless and already cold-marked actors, where the marker alone leaves no CAS-visible trace — and the actor-head CAS requires the epoch observed at preparation. A concurrently prepared fork whose history predates an intervening legacy turn can no longer commit past it; the commit reports an ordinary conflict and journals. Execution identity is now emitted before post-execution output policy: when a side-effecting tool succeeds but its returned content is withheld by the output filter, the callback delivers an outputFiltered receipt with blank content — the recorder accepts it as proof (rejecting model-detached calls it cannot distinguish through the blank shape), the artifact path never sees it, and an applied action is no longer reclassified actionless and re-executed on retry. Background-capable expected actions stay off the fork path: dispatch returns a launch handle every evidence fence correctly rejects, and the completion is provenance-marked as another turn's work, so a fork would settle actionless before the external effect lands with nothing to stop a retry from dispatching it again. The gate mirrors the MCP-suffix name matching of the evidence path. * 🚧 fix: Seal the Whole Legacy Turn Behind a Second Epoch Advance The epoch fenced only the legacy turn's start: a fork preparing after the begin invalidation but before the turn's message persistence observed the new epoch and cold marker, rebuilt from history that did not yet contain the turn, and committed cleanly because nothing advanced the epoch again — making the incomplete rebuild authoritative and clearing the marker. Every legacy event turn now seals its invalidation at terminal persistence with a second epoch advance, on the success, replaced-claim, and error exits alike. Sealing deliberately carries no quiescence requirement — it must succeed while a fork fence is active, because that is exactly the mid-turn race it defeats — and a fork that already committed against the begin epoch is healed the same way: the seal re-marks the head cold, so the next event rebuilds with complete history. Seal failure never diverts the turn's own exit; the begin bump still fences everything prepared before the turn. * 🔗 fix: Replace the Best-Effort Epoch Bump With a Durable Legacy-Turn Fence The second epoch advance could not make a legacy turn atomic, and three findings shared that root cause: two conditional updates left a headless gap a fork could create the head inside; the error exit sealed before saveErrorTurn made the error history durable; and any crash or failure between persistence and sealing left an incomplete fork authoritative, because the seal was best-effort and its failure was swallowed. A legacy turn now carries one durable fence. A token is written before execution by a single update-pipeline write — no two-write gap, and the cold marker is applied only where a head exists via $cond/$$REMOVE. While the token is present no fork may prepare (the adapter refuses) or commit (the CAS requires its absence), because the turn's messages are not yet durable. One atomic write clears the exact token and advances the epoch once history is persisted — after saveErrorTurn on the error exit — and success, replacement, and error exits all route through it. Failure is now fail-closed rather than silent: a failed seal leaves the token set, which keeps blocking forks and is logged as such, and a fence abandoned by a crashed turn is reclaimed only once stale, advancing the epoch and marking any head cold so the next event rebuilds from whatever history actually survived. * fix: serialize legacy event actor turns * fix: close legacy actor fence ownership gaps * fix: preserve legacy actor persistence fences	2026-08-26 08:39:00 -04:00
Danny Avila	f34a49007d	🔣 fix: Escape SPA Language Attribute (#15248)	2026-08-26 07:37:36 -04:00
Marco Beretta	0383030817	⚡ perf: Avoid Parallel Full and Paged Prompt Loading on Startup (#15031) ... Co-authored-by: Danny Avila <danny@librechat.ai>	2026-08-25 21:21:17 -04:00
Marco Beretta	124e357cbf	✏️ feat: Edit Pasted Text and Clear It on New Chat (#15017) ... * fix: stop an unsent paste from following every new chat An explicit new chat now drops the unsaved-chat draft key before the composer resets. `newConversation` empties the composer, but the key outlives it and `useAutoSave` restores from that key on the way in, so a long paste that was never sent came back as an attachment on every later new chat. Per-conversation drafts are untouched. Clicking a pasted-text chip opens the text in an editor so it can be corrected before sending, and the chip's subtitle offers returning the paste to the composer. The text comes from the in-memory blob, falling back to the `text` field the file record already carries, so neither needs a new endpoint. `FileContainer` grows a `subtitleAction` prop for the second control. Supplying it swaps the chip's own button wrapper for a full-bleed one behind the content, since a button inside a button is invalid markup and browsers drop the inner one's events. * chore: sort imports to fix static checks * fix: address paste edit review findings - Keep the original paste attached until the replacement upload succeeds, so a rejected or failed save cannot destroy the only copy - Guard edits and queued replacements against conversation switches and new-chat resets, mirroring the long-paste lifecycle guards - Recover text for restored pastes by downloading the stored bytes, which Assistants and agent uploads persist without a text field - Delete uploaded attachments when an explicit new chat discards the draft that referenced them, instead of orphaning the records - Mark paste provenance explicitly (session registry plus files draft) instead of inferring it from a filename a deliberate upload can share - Keep the subtitle action revealed on devices without hover * fix: scope draft cleanup to its tab and delete restored pastes - Stamp unsaved-chat files drafts with the writing tab's session id and skip deletion when another tab owns the record, so a new chat in one tab cannot discard the uploads attached in another - Delete a restored paste's upload when an edit replaces it or returns it to the composer, which the attached flag otherwise preserved * fix: harden paste edit lifecycle guards - Re-check the originating composer and the file map before detaching an edited original on upload success, so navigation or a send during the request cannot remove or delete a file the old draft or sent message still references - Record the replacement upload's paste provenance in the session registry and the files draft, keeping Edit and Move back on the new chip - Bind move-inline to the unsaved-chat token as well, and abort the move when the chip is no longer attached to an unsent composer - Restrict new-chat draft cleanup to ids the composer still owns: library re-attaches and ids with unknowable ownership are spared, and uploads still in flight are deleted once their records reach the files cache, unless the file came back attached in the meantime * fix: match restored paste identities and recheck before opening the editor - Treat a chip as attached when any of its ids (map key, file id, temp id) matches the composer map, since draft restoration keys entries by their temporary upload id while the value carries the server-assigned one; the previous key-only check made Move back silently do nothing and left both chips attached after an edit - Recheck the originating composer and the attachment map after the text resolve before opening the editor, so a send during the download cannot stage a replacement upload into the emptied composer - Extend the provenance predicate to temp ids for the same restored shape * fix: spare re-attached sent pastes and discard stale editor resolves - Force-delete a restored paste only when the composer's own draft claims its id, so a paste that was already sent and re-attached from the library keeps its shared record through Edit and Move back - Sequence editor-open requests so a slow text resolve cannot overwrite the chip a later click selected * fix: carry deferred discards across resets and clear the pending draft - Merge newly deferred upload ids with the pending set instead of replacing it, so a second reset cannot orphan an earlier in-flight upload's eventual record - Match deferred ids against temp_file_id as well, since the files cache keys records by the server id while the discard tracked the request uuid - Clear the pane's pending draft key on an explicit new chat, or a running response's queued text and attachments come back with the next run * fix: mint a fresh tab id when sessionStorage was inherited Duplicated and opener-created tabs start with a copy of the original's sessionStorage, so a stored tab id only proves continuity when the document is a reload of the same tab. Every other entry into a document now mints a fresh id, keeping an inherited one from attributing another tab's live drafts to this composer. * fix: gate restored-paste deletion on draft tab ownership and unclip the chip focus ring - Stamp every files draft with the writing tab, not just unsaved-chat ones, and require the stamp to match before a restored paste's record is deleted, so another tab restoring the same draft is not destroyed - Draw the full-chip Edit control's focus indicator as an inset ring with the surface's radius, since the offset ring was clipped away by the surface's overflow-hidden * fix: resolve paste ownership before restoration and across draft migration - Treat a draft's own pastedTextIds as composer-owned at discard time, so a reload-then-new-chat click deletes or defers those uploads before the composer map has been rebuilt, instead of skipping them - Read both the pending and idle draft keys when claiming a restored paste for deletion, since a response finishing mid-edit migrates the record between them * fix: keep failed edits recoverable and retry failed draft deletions - Reopen the paste editor with the user's corrections when the replacement upload is rejected or fails, instead of leaving only the original's text to reopen - Retain deferred and immediate discard ids when the delete request fails, and retry them on the next files-cache update, so an offline or transient failure cannot orphan the uploads * fix: retry restored-paste deletions that fail A failed delete of a detached restored paste retains its payload in a session store, and the discard retry effect drains retained payloads alongside its own batch on every files-cache update, so an offline or transient failure cannot orphan the upload once its chip is gone * fix: queue failed edits and lock chips with actions in flight - Queue a failed edit behind whatever dialog is open instead of dropping its corrections, and reopen it when that dialog closes - Track an in-flight action per source paste and hide its Edit and Move back affordances until the replacement uploads or the move settles, so the same original cannot be acted on twice * fix: address PR review bot findings Codex: - Keep the tab id on back-forward restoration - Preserve the original tab owner when rewriting drafts - Skip clearing idle and pending drafts another tab still owns - Delete pending-draft uploads before clearing them - Return failedFileIds from DELETE /files and retry those records - Spare reattached files from retained deletion retries - Trigger retained-deletion retries when a delete is retained - Persist deferred discards across reload - Delete embedded owned uploads with a discarded draft - Ignore stale paste-editor failures before toasting - Abort a queued edit after the original is sent - Serialize Move back with a synchronous in-flight lock - Prune paste provenance ids that left the draft * fix: retain paste deletions the server reports as failed The delete route answers 200 with `failedFileIds` when a record's storage delete fails, so the detach path's `.catch()` never fired and the orphaned upload lost its only cleanup reference once the draft provenance was pruned. Inspect the resolved response and retain the deletion when it names the file. Extract the `failedFileIds` reader `useNewChat` already had into the file utils so both deletion paths read the response the same way, and give the paste editor coverage for the failed and accepted responses. Also add the missing `size` on a composer file literal that was failing the client type-check. * fix: release draft claims when their tab is gone and keep cleanup durable A tab stamped its id on a files draft and nothing ever took it off, so a draft saved in a tab the user then closed became unreachable for good: no other tab would restore it, write to it, or clean it up, and the closed tab's id can never be presented again. Tabs now report themselves in a small liveness registry and release the claim on pagehide, and a claim whose tab is no longer around is treated as free. Writers restamp a dead claim rather than preserving it. Ownership also only existed once something was attached, so a typed-but-unattached draft on a shared composer key read as nobody's and another tab's New Chat cleared it. Saving text to one of those keys now claims it the same way. Two more from the same review: - The delete route answers a partial failure as 200, so treating an id as still present unless the response reports it deleted kept a ghost row for a file another tab had already removed. Read it the other way around: only a reported failure keeps a record cached. - A retained deletion whose retry failed again moved no effect dependency, so it was never attempted a second time, and the payload only lived in memory. It is now persisted for the session and asks for a backed-off retry, plus one on regaining connectivity. * fix: keep bfcache claims, retain failed deletes, and move the delete contract to TS Four findings from the latest review round: - pagehide fires with persisted: true when a document enters the back-forward cache rather than closing. Releasing the tab's claim there let another tab take the draft and delete files the restorable document still had attached, so the claim is now only handed back on a real unload; a bfcached tab that is never restored still ages out through the liveness window. - useFileDeletion issued its batch and never looked at the outcome, so a fresh paste whose delete failed was orphaned with no retry. It now retains whatever the server did not delete, reading failedFileIds as well as the rejection. - A partial failure answers 200, so the unconditional success toast told the user a file was deleted while it was still on disk and back in their list. - The delete response contract lived in the legacy JS route. It moves to packages/api as buildDeleteFilesResponse, leaving the route a thin caller. The useFileDeletion spec's mutateAsync mock returned undefined; react-query always hands back a promise, so it now resolves like the real one. * fix: park bfcached tab claims and drop ownership left by an emptied draft A document in the back-forward cache has a frozen heartbeat, so the ordinary liveness window expired its claim after 150s even though it could still be restored with those attachments on screen, letting another tab take the draft and delete the files underneath it. Entering the cache now parks the tab as suspended, which holds the claim for 30 minutes: comfortably past the point a browser keeps a bfcache entry, and still bounded, since a claim that never expires is what stranded drafts under owners that no longer existed. Restoring the document beats normally again and clears the flag. The registry entry grew a shape for this and still reads records written as a bare timestamp. Clearing the text of a shared composer key also left the ownership-only record behind, locking the key to a tab with nothing in it: the next tab to type there could neither restore its own draft nor take the key back. That claim is now released when the text goes and nothing is attached. * fix: keep unlinks out of the delete retry and claim shared text before writing Four findings from the latest round: - Retaining a failed agent or assistant unlink sent it through the generic retry, which replays files alone. That drops the tool_resource context, so the route would take its ordinary delete branch and destroy a record the agent and other references still point at. A failed unlink orphans nothing, so those deletions are simply not queued. - A retry that resolved naming files in failedFileIds left both stores untouched, so nothing moved the effect that would try again. It now asks for another attempt on a reported failure, the same as on a rejection. - The reattachment guard read only the idle new-chat key. After a reload the composer map is empty until the autosave restore renders, so a file the user had reattached to the conversation they were viewing, or to the pending key, could be deleted underneath them. All three keys are checked now, including their paste provenance. - Text was written to a shared composer key before ownership was resolved, so a tab could overwrite another's saved text and still be refused the claim, leaving it unable to restore what it had just typed. The claim is taken first, and a claim with no attachment behind it follows whoever's text is actually stored; one backed by an attachment stays with its open owner. * fix: merge shared discard state and keep restored file-search pastes retrievable Four findings from the latest round: - Every mount of useNewChat (header, sidebar, mobile bar, shortcuts) kept its own snapshot of the pending-discard list and wrote it back over one shared session store, so an id recorded by one instance was dropped by the next write from another, orphaning the upload it pointed at. An update now only resolves the ids that instance knows about and carries the rest through. - Refusing an attachment-backed claim still let the text write land, destroying the owning tab's text for a tab that could not have restored it anyway. The claim now reports whether it succeeded and the write is dropped with it. - A restored paste has no tool_resource on its record, so an edit to one that had been uploaded for file search was re-uploaded as a plain context file and the vector-backed original detached, dropping it out of retrieval. embedded does survive on the record and is only set for a vectorized file, so it is what the destination falls back to. - The reattachment guard collected map keys and server ids but not temp_file_id, while the retry lookup resolves that alias: reattaching a file whose discard was pending under its temporary id would not have protected it. * fix: stop the draft owner refusing its own writes and guard shared pending keys Three findings, the first a regression from the previous commit: - The attachment-backed refusal was evaluated before the owner check, so the tab that owned the draft was refused its own key: once anything was attached, nothing typed after it was saved. Ownership is settled first now, and the refusal applies only to another live tab. - A long paste wrote its provenance and pending-paste record into the shared composer key without checking who owned it, and setFilesDraft preserves the existing owner rather than rejecting the write, so the paste was recorded into another tab's draft, which could then restore and delete the upload while this tab still showed the chip. Both write sites now check first. - Two concurrent runs share the default pending key, and the migration to the new conversation ran before the ownership check: the finishing run moved the other tab's text and attachments under its own conversation and left that tab nothing to carry over. Ownership of the source is verified before migrating, and this composer's own text is still saved either way. * fix: protect cross-tab reattachments and orphaned pastes on every discard path Five findings from the latest round: - The retry guard only read this pane's own draft keys, so a file a second tab had reattached to a conversation this pane never opened was deleted anyway. Drafts live in localStorage and are readable from every tab, so the guard now sweeps every persisted files draft rather than three known keys. - Clearing the composer removed the shared text record without checking who owned it, so an empty composer in one tab erased text another tab was still holding behind its attachments. The clear path takes the same guard as the write path, and both now share one ownership predicate. - When another tab owned the pending key, this tab's own queued attachments were cleared from the map and never written anywhere, because the autosave that would have persisted them had been refused that key for the whole run. They are now written under the conversation the run just became. - A draft write that storage refuses (private mode, quota) left a generated paste with no record to discard it by. New Chat now also collects the live marked pastes the composer is still showing, skipping re-attached ones. - With draft saving off, the reset path deleted files without awaiting or reading the response, so a failure orphaned the upload. It retains what the server did not delete, like every other deletion path. * fix: keep reloading tabs live and spare pastes an active run is using Three findings: - pagehide cannot tell a reload from a close, and the tab id survives a reload on purpose, so releasing the claim there handed this tab's own draft to another one while the document was still bootstrapping. A closing tab is left to the ordinary liveness window instead, which is what the window is for. Entering the back-forward cache is still marked, since that heartbeat freezes. - The text-ownership guard only covered the shared composer keys, but a conversation key is reachable from every tab viewing that chat and is stamped the same way, so one tab could overwrite text another was holding behind its attachments. The guard now applies to any key; the ownership stub is still only created for the shared keys, which tabs otherwise share freely. - Submitting empties the file map but leaves the draft's paste provenance until the final SSE event, so New Chat during a streaming response treated the empty composer as still owning what the message had just sent and deleted files the message, and the run reading them, still referenced. The provenance promotion is skipped while a run is in flight. * fix: give each tab its own presence record and publish live attachments Four findings: - Tab presence lived in one shared localStorage map, so two tabs beating at the same time read the same snapshot and wrote back rival copies; the loser disappeared until its next beat, long enough for another tab to treat its live draft as abandoned. Each tab now writes only its own key, and expired records are swept while reading. - With draft saving off nothing is written to a draft at all, so a file reattached in another tab was invisible to a retry running here and could be deleted underneath it. A tab now publishes what its composers are holding into its own presence record, and cleanup unions that with the drafted ids. - The record written when another tab owns the pending key kept only attachment ids, so a restored chip stopped being recognised as a paste and lost editing and cleanup. Provenance is rebuilt from the session registry. The unsent paste text cannot come along: this tab was refused that key all run, so it was never stored anywhere to carry. - New Chat with draft saving off skipped every embedded record, leaving an unsent file-search paste with its metadata, storage and vectors intact. A paste this composer owns is now included with its real embedded value, while other embedded files are still left alone. * fix: elect one cleanup worker, scope the queue to its account, guard edit writes Three findings: - Every mounted useNewChat (header, sidebar, mobile bar, shortcuts) entered the cleanup effect against one shared store, so a single retry issued the same DELETE several times and toasted about each. A pass is now claimed before it runs; an instance that is turned away asks for a later one rather than dropping the work. - The retained queue outlived a sign-out, so the next account retried the first one's payloads, was refused by the ownership check, and rescheduled forever. Logging out clears the queue and cancels the pending retry. - The paste path checks draft ownership before recording provenance, but the edit path did not, so a replacement could be written into a record another open tab owns, which that tab could then delete while this one still showed the chip. It takes the same check. * fix: match paste identities everywhere and stop migrations clobbering a foreign draft Five findings: - The presence record published only composer map keys, but a restored upload is keyed by its temporary id while the value carries the server one, and a retained deletion in another tab names whichever it recorded. All three identities are published now, matching the local guard. - Migrating a finished run checked that the pending record was ours but not the destination, so a conversation draft another tab owned with attachments on screen was overwritten and restamped. Both ends are checked, and the non-owner fallback no longer writes over a foreign destination either. - The live-paste fallback matched the registry against file_id alone, so a completed paste, marked under its client upload id, read as somebody else's file and its upload survived New Chat. It matches every identity now. - An upload still in flight has no filepath or source, so no discard path can build a payload and the reset drops the chip anyway. Its id is deferred so the record is deleted when it arrives, with draft saving on or off. - An edited paste that had been staged into the code sandbox was re-uploaded as a plain context file, since only the file-search case was reconstructed. metadata.codeEnvRef is durable and now routes it back to execute_code. * fix: silence background cleanup and keep cross-tab protection past a send Four findings: - The reset path matched the paste registry on file_id alone, the same alias gap already fixed in New Chat, so a completed embedded paste read as somebody else's file and survived with its vectors. It matches every identity now. - The background cleanup pass used the ordinary delete mutation, so a storage failure that kept failing announced itself on every retry, and success arrived minutes after the action behind it. The mutation takes a silent option and the retry pass uses it; direct user actions still report. - Each hook instance loaded the pending-discard list once and was never told when another instance wrote it, so work deferred by an instance that then unmounted stalled. Writes now notify every mounted instance, which re-read and apply only a real change. - Cross-tab protection sampled only what a composer was holding right then, and sending clears both the map and the draft, so a file reattached in another tab and then sent could be deleted between retries. A tab now remembers what it recently held for ten minutes, which is long enough for the other tab's next pass to see it and cancel that deletion for good. * fix: honour draft ownership in every clear and track what a message consumed Five findings: - The ownership contract was only applied at the new call sites; the SSE final event, the steering handoff and the debounced text clear still erased records through clearAllDrafts and clearDraft. The check moved inside those helpers, so every path that clears a draft respects it. - Only the explicit logout cleared the retained queue, leaving a silent refresh that returns nothing and a failed user query to carry it into the next account. It clears wherever the session is lost instead, in the one place all three paths pass through. - Using isSubmitting to decide whether a paste was consumed was wrong for a stopped or errored turn: those clear the flag without clearing the draft, so New Chat afterwards deleted files the turn already referenced. Submission now records the ids it took, and those are excluded by name. - The presence sweep only ran from deletion cleanup, so a profile that never had a failed delete accumulated a record per tab until the origin quota ran out and draft writes began failing silently. The heartbeat sweeps. - When a run finished into a conversation another tab owned, this tab's own queued text and attachments were dropped for want of a writable destination. They stay on the key it does own and are restored from there. * fix: mint a tab id when the browser has no randomUUID crypto.randomUUID is absent on insecure origins and in older webviews, and the throw left the tab with an empty identity: every draft was then written without an owner and every ownership guard read another tab's record as its own, reinstating exactly the loss this layer exists to prevent. Falls back to getRandomValues, then to a local mint. The id only has to tell tabs apart. * fix: address PR review bot findings Clear the retained deletion queue on every direct authentication exit, not just the debounced context update: an empty or rejected silent refresh, a failed user query, and the external-IdP logout all leave the page without passing through setUserContext, so the queue survived into whoever signed in next and retried under credentials the ownership check rejects forever. Settle the edit lock when a replacement upload is aborted. Removing the replacement chip mid-upload consumes the lifecycle through onAbort, which the paste editor never handled, so the source paste kept its Edit and Move-back actions hidden for the rest of the session and the typed correction was lost. Keep the temporary-file cleanup payload for whatever the server reports as failed. The delete route answers a partial storage failure with a 200 carrying failedFileIds, and the cleanup mutation cleared FILES_TO_DELETE wholesale on any success, dropping the only automatic retry those orphans had. Persist both paste registries per tab. They lived in module-level sets, so a reload kept the files draft but forgot the paste had been consumed, and New Chat then classified an already-sent paste as unsent and deleted a file the persisted message still references. Withdraw discarded ids from tab presence. A removed, moved, or discarded chip kept its recent entry for the whole window, and the retry sweep read that as evidence the file had been reattached: it cancelled its own cleanup and left the failed upload orphaned on the server. Presence records whose heartbeat cannot be read are skipped rather than rewritten, since giving one a fresh seenAt would revive a dead tab's claims over every id it still held. * fix: address second round of PR review bot findings Stop a settled deletion from undoing the logout clear. A DELETE that was already in flight when the session ended settles afterwards, and its handler is the last reference to that payload, so it wrote the departing account's records straight back into session storage. Clearing now latches retention shut and only a newly established session reopens it, which also covers the paste editor's own retention and the discard paths, not just this one writer. Reinsert a failed paste when nothing durable holds it. A composer the user has typed into is deliberately left alone while a recovery record exists, because that record restores at an anchored offset later. When the shared draft key belongs to another live tab the guard skips the record entirely, so the upload callback held the only copy and refusing dropped the text outright. It now goes back in at the offset its anchors resolve to, which is where a restore from a record would have put it. * fix: address third round of PR review bot findings Withdraw attachment presence from this tab only. The sweep cleared the withdrawn ids out of every tab's recent map, which is the one record a second tab has left once it has reattached a file and sent it: its composer and its draft are both empty by then, so erasing that entry handed the next retry a file it read as abandoned and let it delete the upload out of the message now referencing it. The withdrawing tab always published what it withdraws, so its own record is all it needs to touch. Guard the direct New Chat deletion against other tabs. The retry effect consults every other tab's drafts and published presence before deleting, but the discard that runs on New Chat went straight to the request, so it raced past that guard and could delete a file another tab still had attached or had already sent. It now consults the same two sources, excluding its own draft keys and its own presence record, which hold exactly what the discard is throwing away. Fix the import order in Presentation.tsx, which CI static checks flagged. * fix: address fourth round of PR review bot findings Read this tab's presence before sweeping stale keys. Timers pause while the machine sleeps, so a live tab can beat again with its own record already past the liveness window; the sweep reaped it and the write that followed published an empty presence, and nothing republished it because the file map had not changed. Another tab's retry then saw no claim on chips this one still had on screen. Keep submitted-use evidence when a later chip is withdrawn. The same file can be sent on one message and reattached afterwards, and once the composer and draft have cleared, its recent entry is the only cross-tab record that a message still references it. Withdrawing a chip no longer erases an entry for an id a submission already consumed; it ages out on the ordinary window. Clear composer drafts when the account changes. A files draft carries the whole text of a paste held as a file, and the browser tab keeps its identity across an in-app account switch, so the ordinary draft restore could hand the next account the previous one's writing. Both draft families are now dropped on the sign-in and sign-out paths, ahead of the skipFirst exception. Spare a submitted paste from the edit path's explicit deletion. Editing or moving a reattached library file that an earlier message sent deleted the server record underneath that message, because the draft-ownership check succeeded and nothing consulted the submitted marker. Validate an edited paste as a replacement rather than an extra file. The original is deliberately still attached while the replacement uploads, so the shared validation counted both and rejected the edit at the file-count or total-size limit; with a limit of one, a lone paste could never be edited. Preserve failed rows after a table deletion. The table's own cache update removed every requested file without consulting failedFileIds, undoing the partial-aware update and hiding a file whose storage delete had failed. Document the two deliberate dependency omissions in AuthContext, which CI now lints at zero warnings because the file is part of this change. * fix: address fifth round of PR review bot findings Clear composer drafts on the way out of a session, not only on the way in. Clearing them from the login mutation missed social sign-in entirely: OAuth, OpenID and SAML leave through direct links and come back through the silent refresh, so a different account could arrive in the same tab with the previous account's drafts and tab identity intact and have its paste text restored. The draft clearing is now paired with the retained-deletion clearing in one helper used by every authentication exit, so neither can be wired into a path the other was missed from. Rebuild paste provenance when restoring a queued upload. A paste queued during a run has its pending draft taken by takeComposerDraft, so choosing Edit message restored the upload into an empty composer with nothing recording that it was a generated paste. Filtering existing provenance could not recover that, and an unmarked restored chip is treated as a shared attachment: removing it would not delete it and New Chat skipped it, orphaning the unsent upload. The session registry still knows, so it is consulted. Drop paste provenance when a rejected upload is removed. Validation can reject a paste before it reaches composer state, and the failure path removes it with removeFile, but the id stayed in pastedTextIds. That left a record hasDraftAttachments reads as a real attachment claim with no chip behind it, and with the file map unchanged nothing pruned it, so it locked every other tab out of the shared composer key. * fix: address sixth round of PR review bot findings Centralise the foreign-claim guard. Every path that deletes an upload has to ask whether another tab or pane still claims the file, and the guard was being assembled by hand at each site, which is exactly why it was missing from three of them. collectForeignAttachmentClaims now builds that set once, and the New Chat discard, the no-draft reset fallback in useNewConvo, and the paste editor's explicit deletion all consult it. A record another tab claims is skipped rather than retained, since it was never this pane's to delete. Scope presence withdrawal to the pane that owns it. One tab holds several composers and the presence record is flat, so the hook that won the global deletion pass swept every pane's entry while knowing only its own file map, erasing the evidence of a chip a sibling pane still had on screen. Withdrawal now takes the pane index, and an id another pane still lists keeps its recent entry too. Guard destructive draft clearing against text-only claims. claimComposerDraftTab stamps a key that holds nothing but text, and the write guard ignores a claim with no attachment behind it, so a tab finishing a run that began as an unsaved chat cleared the shared new-chat key and took another tab's half-written message with it. Clearing now honours any live foreign stamp, while text writes keep their deliberate last-writer-wins behaviour. Mark queued override files as submitted. A during-run queued message drains through overrideFiles into the reuseFiles branch and skipped the marker loop entirely, so reattaching that paste later left isPasteSubmitted false and New Chat or an edit could delete a file the queued message still referenced. * fix: address seventh round of PR review bot findings Treat publishing an attachment as proof of liveness. The publisher carried the old seenAt over, so a tab whose timers had been paused past the liveness window published a chip and stayed expired until its next interval tick, long enough for another tab's cleanup to sweep the record and delete the file under the chip that had just appeared. Count a sibling pane as a claim. The foreign-claim helper excluded this tab entirely, so the pane doing the discarding could not see the other composer in the same tab and deleted a file it still had on screen. Live claims are now gathered per pane: only the discarding pane's own entry is left out, along with this tab's recent map, which is flat and cannot say which pane an id came from. Keep a tab identity when session storage is unusable. It can be blocked or full while localStorage still works, and returning an empty id left the document unattributed, which every ownership and liveness guard reads as no owner, so tabs could destructively clear each other's attachment-backed drafts. An id that lives only for this document still tells the open tabs apart. Scope attachment withdrawal in the deletion hook to the originating pane, and thread the composer index through ChatForm, FileFormChat and FileRow to supply it. Removing a file from one side-by-side composer withdrew the id for every pane, and with drafts off the sibling never republished its claim. Check foreign claims before deleting a live edit source. The guard only covered the restored path, because detach returns early for an in-memory upload before reaching it, so editing a live paste another tab had reattached from the library deleted the file underneath that tab's chip. Keep autosaving to the pending key while the destination is not writable. The preserved queued work was written under the pending key but the destination was still recorded as the active conversation, so later edits autosaved against a foreign key and a reload mounted straight onto the destination, losing the work that had just been preserved. * fix: address eighth round of PR review bot findings Make submitted-use evidence durable and readable across tabs. The tab that retries a retained deletion is rarely the tab that sent the message, and this evidence lived in the sending tab's session storage, which left published tab presence as the only cross-tab record. That ages out on a fixed ten-minute window, so a retry resuming after a longer freeze classified a sent file as abandoned and deleted it out of its message. It is timestamped in localStorage now, with a horizon wide enough to outlast any plausible freeze and a hard cap so a long-lived profile cannot grow it without bound. Paste provenance stays in session storage, since which chips offer the paste affordances really is per-tab. Tie a blocked pending draft to its intended destination. Keeping the pending key active while a live tab owned the destination left the pending state with no memory of where it was heading, so any later navigation looked like the awaited transition and carried the queued text and attachments into an unrelated conversation. Defer an in-flight paste on direct conversation resets. Callers that reach newConversation without going through New Chat left an upload with no filepath yet unrecorded, so once the request landed nothing remained to delete the server file. * fix: restore the composer clear after send CI e2e caught this: after sending a message with an attachment the chip stayed in the composer, so the sent message and the composer both showed it. Two causes, both from keying composer storage off state that lags a render. `currentConversationId ?? conversationId` is the previous conversation during every transition, so the file-cache restore ran against the outgoing key and put the just-sent attachment straight back into the map that the submit had cleared. The active key is now the conversation unless the switch effect has deliberately parked storage on the pending key. Separately, treating any first mount as the awaited pending transition ran the pending migration on every direct load of a conversation. That is narrowed to a pending record this tab owns which actually holds something, which is what a reload with real queued work looks like. Verified against the two failing specs locally, then the whole mock chat spec: 8 passed. * fix: address ninth round of PR review bot findings Stop expiring submitted-use evidence on a timer. The work it has to outlast is a retained deletion, and those carry no expiry of their own, so any interval chosen could be outlived by a suspended tab still holding cleanup work, which is the same bug with a longer fuse. The ledger is bounded by count instead, evicting oldest first only when it would otherwise grow without limit. Consult that ledger before retrying a deletion. The retry pass built its protection set from drafts and published presence only, both per-tab and time-bounded, so a file sent from a tab that has since been suspended had nothing left to speak for it. The record is resolved before judging, because the discard is often keyed by the temporary upload id while the pane that sent it marked only the server id. Refresh liveness when withdrawing presence, matching the publication side. A retained-deletion pass resuming after paused timers withdrew its own entry and then swept the record as stale, taking sibling panes' claims with it. Keep queued attachments when neither draft key is writable. With another tab owning the pending key and a second owning the destination, the effect cleared the live map and could persist it nowhere, so unsent attachments vanished the moment the run got its conversation id. Remove the replacement provenance when an edited paste is not accepted. The edit path records the replacement id before routing the upload, and a rejected upload left a provenance-only draft that reads as a live attachment claim with no chip behind it. Verified with the mock chat e2e spec after rebuilding the frontend: 8 passed.	2026-08-25 20:06:59 -04:00
Danny Avila	1489623fa3	🎬 test: Record-Once/Replay-Forever Model Fixtures for Mock E2E (#15210) ... * 🎬 test: Record-Once/Replay-Forever Model Fixtures for Mock E2E The mock e2e lane's only credential-free model is a hand-authored script: `fake-model.js` decides responses from ~60 `E2E_*` prompt markers. That covers scripted shapes well, but no scenario replays a *real* recorded provider conversation through the assembled chain, so real streaming shapes — provider chunk cadence, reasoning deltas, usage metadata — are only ever approximated. This adds a record-once/replay-forever tier alongside the marker routing. Record (`E2E_MODEL_FIXTURES=record`, needs a provider key): the run hook appends a LangChain callback handler to every agent context's `clientOptions.callbacks` instead of overriding the model, so the REAL provider streams while each invocation's `AIMessageChunk`s serialize to `e2e/fixtures/model-replay/<name>.jsonl` — text deltas, tool_call_chunks, reasoning kwargs, and genuine usage metadata. Only the latest human text is recorded for binding; system prompts and tool schemas never enter the fixture. Replay (default, keyless): `fake-model.js` consults `tryBindReplay` ahead of marker routing, binding a conversation whose prompt matches the next unconsumed invocation. The replaying model is not hand-assigned — it is registered as SDK provider `librechat-e2e-replay` via `registerProvider` and constructed through the SDK's own `initializeModel`, so registry lookup, constructor clientOptions, and real `bindTools` all run the way a live provider's would. Recorded chunks therefore stream through the same createRun → graph → SSE → persistence chain. Consumption is enforced rather than assumed: every invocation re-checks its prompt against the recording, an invocation past the end of the script throws, and a per-fixture ledger lets the spec assert at teardown that every recorded invocation and chunk was drained. Streaming incrementality is asserted from that ledger, not by sampling transient DOM, which is a race by construction. The credential-free profile is unchanged when not recording: the record provider and its selector entry are template markers that stay comments, and no existing spec's routing is touched (a fixture only binds on an exact prompt match; everything else falls through). Verified: record vs the real DeepSeek API 1 passed (15.2s); keyless replay 1 passed twice (11.4s, 12.7s) with the ledger fully drained (2/2 invocations, 10/10 chunks, no overruns or mismatches); app-load, completion, and chat 10 passed unchanged. * fix(e2e): rebind a replay fixture from the top for a new conversation The replay cursor is process-global while the web server outlives a Playwright retry, so a fully consumed fixture left the retry unable to bind its first prompt: it fell through to marker routing and failed deterministically, burning every configured CI retry. A partially consumed attempt failed the same way. Binding now restarts the fixture when the incoming prompt matches its first recorded invocation, resetting the ledger with the cursor so the new attempt is judged on its own consumption instead of accumulating the previous one's counts. Continuing an in-progress binding still outranks restarting, so a fixture whose opening prompt repeats later in the script advances rather than rewinding. The over-consumption guard is untouched — it fires inside the stream when the cursor passes the end, not at bind time. * fix(e2e): close three replay-lane gaps found in review Restart the recorder on a retry. Its state is process-global like the replay cursor, so a failed attempt that had already recorded invocations left the counter advanced: the retry appended 2/3 after 0/1, or kept the previous attempt's `error` line, and the fixture was unusable for replay. Recording now truncates and restarts when the opening prompt reappears, mirroring the replay side's rule and its caveat. Retain a consumed binding for the conversation that drove it. An extra user turn past the final recorded invocation found no next invocation and fell through to ordinary fake-model routing, so it was answered with a mock reply: the over-consumption guard never ran and the already-drained ledger still passed. Such a conversation is now recognized by its human turns opening with the fixture's recorded prompts, and stays bound so the stream raises the overrun. Continuing an in-progress binding still outranks restarting, which outranks retaining a consumed one, so a retry's fresh conversation rewinds rather than being read as an extra turn. Validate the fixture the recording actually wrote. Record mode honors `E2E_MODEL_FIXTURE_NAME`, but the spec always inspected the committed `deepseek-two-turn`; another name wrote elsewhere while the assertions read the pre-existing file, and because the prompts are fixed the stale answers could match and green a run that verified nothing it produced. * fix(e2e): make replay binding correct for tool and subagent fixtures Round two's retry and consumed-binding fixes both assumed one model invocation per user turn. A turn that calls a tool breaks that: the model is invoked again after the tool result under the same latest human message. Identify a retry by the conversation boundary, not the prompt. The recorder ran per invocation and truncated whenever the opening prompt reappeared, so a tool round trip looked like a retry and discarded the recorded tool-call invocation. Restart detection now sits in `installRecorder`, which runs once per `createRun`: a turn whose history holds no prior human message begins a conversation. Compare consumed bindings against user turns, not invocations. Several recorded invocations can share one prompt, so a one-to-one comparison could not recognize the originating conversation — invocations `[A, A, B]` against history `[A, B, C]` failed on both length and elements, and the extra turn fell through to the fake model with the drained ledger still passing. Fixtures now carry their collapsed turn sequence. Override the subagent model too. `graph.overrideModel` is not inherited by child executors, so a fixture recording a subagent call — record mode captures child invocations already — would leave the child on its configured provider: an underrun, and a real provider request in a lane that must stay keyless. Reject ambiguous prompt matches. Binding order followed filesystem enumeration, so a second fixture sharing a prompt could silently redirect a scenario to the wrong chunks and ledger; the spec's choice never reaches the server-side loop, so ambiguity fails instead of picking a winner. Fixture identity is the file name for the same reason — a recorded `meta.name` is descriptive, and trusting it let a copied fixture collapse onto another's registry key and ledger. Prove the recording is fresh. The spec removes the selected fixture before driving, so a run whose hook never installed the recorder fails instead of greening against a stale artifact whose answers still match these deterministic prompts. * fix(e2e): rewind a replay fixture at the conversation boundary Consecutive invocations can share a prompt — a tool call produces exactly that — so an attempt stopping mid-turn left the cursor on an invocation whose text still equalled the opening prompt. Matching the cursor first meant a retry's fresh conversation resumed after the tool call instead of rewinding, consuming the post-tool invocation and silently replaying a different script than was recorded. A conversation boundary now outranks an in-progress cursor: a fresh conversation whose prompt opens the fixture rewinds even when the cursor would have matched. Continuing still outranks restarting within a conversation, so a turn that calls a tool advances to its post-tool invocation rather than rewinding on its own repeated prompt. * fix(e2e): refuse cross-conversation binding and prove content streaming A fresh conversation could steal a partly consumed fixture's later turn. Only a conversation opening with the fixture's first prompt was treated as a boundary, so after `[A, B]` had consumed `A`, an unrelated new conversation whose first message was `B` matched the cursor, received the recorded second-turn response, and advanced the shared cursor without ever having driven `A`. A conversation start may now only rewind a partly consumed fixture, never continue it; continuation within a conversation is unaffected. The incrementality assertion counted empty frames. Providers emit empty initialization and usage-metadata chunks around the content deltas, so a total chunk count above one was satisfied by a single delta: the previous fixture's closing turn had four chunks and one content-bearing delta carrying the whole answer, and both modes stayed green without proving incremental assistant-content streaming at all. Fixtures now track content-bearing chunks separately, the closing prompt asks for prose rather than a number, and both modes require several content deltas on that turn. Re-recorded: the closing turn now carries 28 content deltas. * fix(e2e): scope record mode to the fixture spec `E2E_MODEL_FIXTURES=record` replaces the fake-model hook globally, so an unfiltered entry point such as `npm run e2e:mock` sent every spec under specs/mock to the paid real-provider endpoint, while each fresh conversation truncated and rewrote the one selected fixture — leaving an artifact from whichever scenario happened to run last. Record mode now matches only the fixture spec: an unfiltered recording run lists one test instead of 203. Replay mode is untouched and still collects the full suite. * 🪪 fix: Bind Replay Fixtures by Conversation, Not Prompt Text Prompt text was standing in for conversation identity, and three review rounds found the same class of defect underneath it: a tool call repeats a prompt across invocations, a retry repeats it across attempts, and a resumed run has neither prompt nor history because `createRun` is rebuilt with no messages while state comes from the checkpoint. Each fix in that space created the next gap. Thread the identity instead. `createRun` accepts a `conversationId` and passes it to the run hook, which the agents controller supplies at both call sites — the same value it already uses as the checkpointer's `thread_id`. The field is optional and the hook is env-gated, so nothing changes when the harness is not in use. Binding then collapses to ownership. A fixture is owned by the conversation that claimed it, and its cursor is authoritative wherever it stands: an extra turn reaches the over-consumption guard rather than falling through to the scripted fake model, and a resumed run keeps replaying with no prompt to match. A different conversation may claim the fixture only by opening it, which rewinds — what a Playwright retry looks like. Everything else is refused, so an unrelated conversation can no longer continue someone else's partly consumed script by repeating a later prompt. The prompt is still re-checked on every real turn; only a resume, which structurally carries no human message, is exempt. The previous text-and-history rules remain as a fallback when identity is absent. The recorder keys the same way: a new attempt is a new conversation, so a resume no longer truncates the fixture mid-turn and discards its tool-call invocation. Record summarization too. The summary provider runs on its own model with its own callback list, so a scenario crossing the context-pruning threshold recorded the agent's invocations but not the summariser's, leaving a fixture that could not reproduce the pruned context. * 🧾 fix: Harden Record Mode and Make the Rendered-Text Assertion Honest CI caught what local runs had not: the committed fixture was never replayed locally, because the record run overwrote it after the replay check rather than before. Re-recording and replaying in that order is what surfaced the rest of this. The DOM assertion compared raw recorded text against rendered markdown. The previous answer opened with `52.`, which Markdown renders as an ordered-list marker, so those characters never appear in the DOM and the match failed on all three CI attempts while replay itself was correct. The closing prompt now asks for prose beginning with a word, a leading enumerator is stripped before matching, and only a prose prefix is compared. Derived configs discarded the record-mode restriction. `config.redis.ts` and `config.mermaid.ts` spread this config and then replace `testMatch`, so `e2e:mock:redis` in record mode would still send its specs to the paid provider. A restriction expressed as an overridable value cannot hold, so record mode now refuses any config but the mock one. Superseded recording callbacks could write across a reset. A failed attempt with a provider call still in flight keeps its handler on the old graph; after the retry reset, that call would allocate an invocation from the new counter or append an `error` entry with a cleared mapping. Handlers now carry the recording generation they were installed for and ignore everything from an older one, and attachment dedupes against the current generation so a graph carried across a restart is not left with an inert handler. * 🚧 fix: Make Summarization an Explicit Boundary, Not a Half-Feature Recording summarization invocations without replaying them is worse than ignoring them. Replay routes the agent model and subagents only, so a recorded summarization entry takes a slot in the fixture sequence that replay never consumes, and the next primary call reads the summariser's chunks — a prompt mismatch or, worse, silently wrong content. The attachment was also aimed at the wrong shape: the SDK reads `summarizationConfig.parameters`, not `.parameters` nested under `.config`, so the previous attempt would have attached to nothing in a real run. Its test passed only because the test built the shape the code expected rather than the shape the SDK provides. Rather than ship a half-routed feature, recording now fails the moment summarization runs, naming the reason. Both shapes are guarded so the guard cannot miss the way the recorder did. Summarization fixtures need replay routing for that model before they can be supported. The derived-config guard added alongside it was itself broken: workers do not carry `--config`, and the argument lookup fell through to `process.argv[0]`, so every recording run aborted claiming the node binary was an unexpected config. The flag is now located explicitly and absence is treated as "not the process that parsed the CLI". * 🔒 fix: Close the -c Config Alias and Pin the Recorder's Fixture Name Playwright documents `-c` as an alias for `--config`, so record mode launched as `playwright test -c e2e/playwright.config.redis.ts` slipped past a guard that recognised only the long spelling. Both spellings and both `=` and space forms are now parsed. Accepting arbitrary fixture names also worked against the ambiguity check. This spec drives one fixed prompt pair, so recording under another name left two fixtures sharing those prompts; replay then refused to bind either and the keyless lane stopped working — a successful documented recording run could disable the suite it exists to serve. The spec now records only the fixture it owns and says so when asked for another. * 🔧 test: Record a Real Tool-Call Turn and Replay It Through the Tool Node The fixture format carried `tool_call_chunks` and the binding advanced through a turn's invocations, but nothing had recorded a real tool-calling conversation end to end — the path was covered only by hand-written synthetic fixtures, and it is the first one a new scenario would exercise. This records one: the provider calls the `remember_fact` MCP tool, the tool runs, and the model is invoked a second time with its result. That is the shape a single prompt cannot express — one user turn spanning several model invocations, all sharing one prompt — so it is what proves the turn-vs-invocation distinction the binding rules were built around. Replay drives the real tool node rather than replaying its output, so the tool executes again and the assertion checks its live result. Two fixtures now coexist, which the record path had to grow for: the config keeps an allowlist so an unknown name is still refused, record mode collects every replay spec, and each spec records only the fixture it owns and stands down for the others. MCP tools reach the model under a server-qualified name (`remember_fact_mcp_e2e-memory`); that qualification has changed before, so the assertions match the base name as a prefix rather than pinning the suffix. Verified: record 1 passed (15.6s, real API) then replay 1 passed (13.6s) against that fixture, ledger drained 2/2 invocations and 35/35 chunks; both replay specs together 2 passed; app-load, completion, chat and mcp-ephemeral 12 passed.	2026-08-25 18:29:55 -04:00
Danny Avila	290b8664d9	🧾 feat: Track Authoritative Agent Event Outcomes (#15213) ... * feat: track authoritative agent event outcomes * fix: isolate agent event outcome types * fix: declare agent event handler result * fix: simplify agent event status selection * fix: preserve authoritative event outcomes * fix: preserve terminal event evidence * test: use completed run-step envelope * test: scope deferred HITL question locator * fix: settle every agent event terminal path * style: sort terminal host action imports * fix: fence agent event terminal evidence * fix: recover agent event terminal settlement * fix: scope terminal retry hints by generation * fix: settle terminal host actions exactly	2026-08-25 18:20:57 -04:00
Danny Avila	6d499ba3ce	⏳ fix: Anchor Resumed Elapsed Time at the Generation's Real Start (#15204) ... * ⏳ fix: Anchor Resumed Elapsed Time at the Generation's Real Start A reload emptied the Recoil anchor, so the indicator fell back to its mount time and visibly reset to 0s over a run that had been generating for much longer. The stream status the resume path already reads carries the server-recorded generation start; the fill now prefers it, so a reattached run reports real elapsed time. The fill remains fill-only: a same-session reattach keeps its original ask baseline, and the indicator's existing clamp absorbs any client/server clock skew. * 🕰️ fix: Rebuild the Resumed Baseline From the Server-Computed Age Codex round 1: anchoring at the server's raw createdAt compares two clocks — a client behind the server froze the resumed reading at 0s for the skew, one ahead inflated it. The status route now also reports the generation's age computed on its own clock, and the client rebuilds a clock-local anchor as Date.now() minus that age, so each machine only ever compares to itself. Raw createdAt stays as the fallback for an older server mid-rolling-deploy. * 📥 fix: Compute Elapsed Age in TypeScript, Anchor It at Status Receipt Codex round 2: the elapsed computation moves into packages/api as getGenerationElapsedMs — the route now just delegates, keeping the response contract type-checked and the /api surface a thin wrapper — and the client subtracts the age from the moment the status response arrived (dataUpdatedAt) rather than from apply time, so a slow history fetch between receipt and apply can no longer shrink the reading. Declined with rationale: a shared clock source across replicas — the residual is inter-replica NTP drift, milliseconds against the minutes-scale client skew this PR eliminates, and the helper gives any future shared-clock upgrade a single home.	2026-08-25 09:35:10 -04:00
Danny Avila	d9e6250d05	🛑 fix: Separate Agent Event Backpressure From User Bans (#15200) ... * 🛑 fix: Separate Agent Event Backpressure From User Bans * fix: Address Agent Event Review Findings * fix: Mirror Case-Insensitive Agent Control Routing	2026-08-25 09:27:35 -04:00
Danny Avila	877b9b2f1a	🐚 feat: Nonce-Based Content Security Policy for the SPA Shell (#14446) ... * 🛡️ feat: Configurable Baseline HTTP Security Headers Adds helmet's CSP-independent headers (HSTS, X-Frame-Options, X-Content-Type-Options, COOP, CORP, Referrer-Policy) on every response, with contentSecurityPolicy explicitly disabled. Every header that can break a deployment is configurable, so there is no allow-list to go stale the way #7377's hardcoded CSP directives did. HSTS includeSubDomains defaults off rather than matching helmet's on-by-default: it would otherwise pin every sibling subdomain to HTTPS for a year in every visitor's browser, and undoing that requires serving max-age=0 from each affected host. * 🛡️ feat: Nonce-Based Content Security Policy for the SPA Shell Adds an opt-in, per-response nonce CSP on the HTML response, resolved once at startup so each request only mints a nonce and concatenates the header. Report-only by default, since that is the rollout step #7377 skipped. Rebase and correctness pass over #13226: - Styles carry no nonce. A nonce in style-src makes browsers ignore 'unsafe-inline', which would have blocked the <style> element the theme script injects at runtime, plus every style third-party components inject. - frame-ancestors 'self' is now a default rather than opt-in, so enabling CSP actually covers the clickjacking half of #7110. - CSP_SCRIPT_SRC_EXTRA now drops 'strict-dynamic', which would otherwise make browsers ignore the very hosts the operator configured. - Nonce stamping runs after the query-devtools bootstrap injection so that injected script is covered too. * fix: replace frame-ancestors instead of merging it Merging the configured value into the default turned a deliberate CSP_FRAME_ANCESTORS='none' into `frame-ancestors 'self' 'none'`, which browsers resolve back to 'self'. Also bail out if the serialized policy somehow lacks the nonce slot rather than emitting a header the shell cannot match. * fix: address Codex review findings on the CSP defaults All five were real against LibreChat's actual runtime: - CSP_REPORT_ONLY now only enforces on an explicit false/off/0/no. A typo or `1` previously fell through isEnabled() to enforcing, turning a config slip into a blocked SPA. Shares the parse helper with headers.ts via a new security/env.ts. - Module preloads are stamped. A production client/dist/index.html carries 32 parser-inserted `<link rel="modulepreload">` tags, which 'strict-dynamic' does not cover and 'self' cannot rescue. - Stale nonce attributes are replaced rather than preserved; only the current response's nonce is authorized. - worker-src allows data:, which Monaco's default CDN loader needs to bootstrap its workers (there is no loader.config() in the client). - script-src allows 'wasm-unsafe-eval' for the HEIC upload path, which compiles WebAssembly through heic-to. Narrower than 'unsafe-eval'. Verified against the real built shell: 4 scripts and all 32 preloads nonced, stylesheets/icons/manifest and <style> untouched. * fix: address second Codex round on CSP rollout controls - SECURITY_HEADERS=false now disables CSP too. It is documented as the global kill switch, and an operator reaching for it to recover a shell broken by an enforcing policy must not be left with that policy on. - The SPA shell is forced to `no-store` while CSP is enabled, ignoring INDEX_CACHE_CONTROL/INDEX_PRAGMA/INDEX_EXPIRES and warning when they are set. A cacheable shell pins one nonce across page loads and users, which is the whole thing a nonce policy defends against. - Added CSP_ALLOW_WASM and CSP_ALLOW_DATA_WORKERS. The previous commit's .env.example claimed CSP_ADDITIONAL_DIRECTIVES could drop 'wasm-unsafe-eval' and data:, but merging only ever appends sources, so the documented hardening step was impossible. These toggles make it real.	2026-08-25 09:18:52 -04:00
James Todaro	018775de07	🧾 fix: Honor Disabled Transactions on the Assistants Usage Path (#15100) ... * 🧾 fix: Honor Disabled Transactions on the Assistants Usage Path Thread the resolved transactions config through `recordUsage` from each of its callers, so `transactions.enabled: false` is honored on the assistants token spend path. * 🧾 fix: Thread the transactions config through the vision-request caller Address review: `ToolService.processVisionRequest` also records usage without the resolved config, and `recordUsage`'s documented return type did not match the function. * 🧾 fix: Set the resolved transactions config after the usage spread - provider usage could carry a `transactions` key that overwrote the trusted value - matches the ordering the other `recordUsage` callers already use	2026-08-25 08:30:12 -04:00
Danny Avila	2ef12b1e1d	🦺 feat: Configurable Baseline HTTP Security Headers (#14445) ... Adds helmet's CSP-independent headers (HSTS, X-Frame-Options, X-Content-Type-Options, COOP, CORP, Referrer-Policy) on every response, with contentSecurityPolicy explicitly disabled. Every header that can break a deployment is configurable, so there is no allow-list to go stale the way #7377's hardcoded CSP directives did. HSTS includeSubDomains defaults off rather than matching helmet's on-by-default: it would otherwise pin every sibling subdomain to HTTPS for a year in every visitor's browser, and undoing that requires serving max-age=0 from each affected host.	2026-08-25 08:21:39 -04:00
Danny Avila	4b113697b5	🔌 feat: Background Execution Toggles for Actions & Plugin Tools (#14407) ... * 🧵 feat: Background Execution Toggles for Actions & Plugin Tools * 🩹 fix: Resolve action background opt-in across encoded-domain forms and scope it per action * 🧹 refactor: Resolve action domain in a single pass * 🧩 fix: Merge Normalized Action Background Options * 🪢 fix: Reconcile Action Background Aliases * 🧭 fix: Harden Action Background Compatibility * 🕰️ test: Allow Settled Task TTL Expiry * 🧬 fix: Merge Refreshed Action Tool Registrations	2026-08-25 08:13:13 -04:00
James Todaro	4d246469dd	🧾 fix: Honor Disabled Transactions on the Abort Paths (#15099) ... Resolve the transactions config from the request and forward it to both abort write paths, so `transactions.enabled: false` is honored when a generation is stopped.	2026-08-25 08:10:26 -04:00
Danny Avila	862ebf3235	🪢 fix: Persist Failed Agent Turns Before Error Publication (#14118)	2026-08-25 06:50:46 -04:00
Danny Avila	ac2aef00f6	🫗 fix: Drain Quoted Excerpts Into Mid-Run Steering (#15175) ... * 🧭 fix: Carry Quoted Excerpts Through Mid-Run Steering "Add to chat" quote chips were dropped by every during-run steer path: the steer POST had no quotes concept, so a composer-origin steer left the chip staged (gluing onto the NEXT send) and a queued item steered into the live run lost its quotes silently. Quotes now ride the steer protocol end to end: - POST + admission: `quotes` on the steer body, normalized like the chat route's (getReferencedQuotes caps), part of the idempotency fingerprint only when present so pre-existing receipts still replay. - Injection: merged into the model-bound turn as Markdown blockquotes at both boundaries (text-only and media paths), mirroring prependQuotes. - Persistence + replay: the STEER content part stores `quotes` separately from the typed text; stampSteerPartMedia re-merges them per turn (even with resendFiles off) via the SDK's transient media stamp, with the quote block folded into the token budget. - UI: composer steers/interrupt-steers drain the chips (skill picks stay staged — they configure a NEW turn's run); SteerPart and the in-flight bubble render the same MessageQuotes reference blocks as user bubbles; queued/failed rows show a quote count; reconnect reseeds fall back to the server item's quotes when no local chip survives. - buildMessages keeps its zero-await path to the parallel context kickoff via a synchronous stamp-target probe. * 🧭 fix: Keep Quotes in the Client-Safe Steer Projection toPendingSteer is the projection behind resume-state pendingSteers, abort responses, and terminal leftover claims — dropping quotes there would lose them on exactly the recovery paths the reconnect reseed's server fallback relies on. * 🧪 test: In-Flight Steer Bubble Renders Carried Quotes * 🔁 fix: Re-Stage Quotes When a Pre-Quotes Replica Accepts the Steer Codex flagged the rolling-deploy window: an old replica 202s a quoted steer while dropping the excerpts, so the client cleared the chips for context the model never received. The 202 (fresh and receipt replay) now echoes quotesAccepted from the DURABLE item; a missing echo on a quote-bearing composer-origin steer re-stages the excerpts as composer chips — the pre-steer behavior, so they ride the next send instead of vanishing — and strips them from the surviving chip so a later terminal conversion cannot duplicate them. Queued-origin steers keep quotes on the item, whose restore paths already return it intact. The residual cross-version lost-ACK retry stays fail-closed as a 409 idempotency conflict (failed chip with retry controls). * 🔁 fix: Close the Remaining Cross-Version Quote-Loss Windows Codex round 2: - Send now of a quoted queued item against a pre-quotes replica now re-stages the excerpts too (the row is consumed and the words inject bare, so the composer is their only remaining home); the strip clears the chip's captured origin copy so reclaims and terminal conversions cannot duplicate them. - A quoted retry whose lost first ACK was accepted by a pre-quotes replica now REPLAYS that legacy receipt instead of 409ing: the stored fingerprint matching the quote-less hash of the same words proves the cross-version case, and the replayed 202's missing echo drives the re-stage. Different quotes against a quote-bearing receipt still conflict. - TSteerAppliedEvent.part gains the quotes field (typed SSE consumers). * 🧪 test: Drop the Stale Narrow SteerDrainOutput Alias The spec's local intersection re-declared injectedMessages with content: string, predating the SDK pin that declares the field natively (content: string | MessageContentComplex[]). Under CI's clean install the hook's BaseHookOutput is no longer assignable to that narrower alias; the plain PostToolBatchHookOutput is the correct type for every drain/boundary assertion. Verified against the published 3.6.16 dist and the local one. * 🔁 fix: Honor the Generation Owner's Quote Capability End to End Codex round 4: - steerQuotesCapable rides job metadata (createJob + HITL resume rewrite), mirroring preemptCapable's owner-recorded pattern: an upgraded admission replica no longer stores quotes — or claims them accepted — for a generation whose older owning drain would silently drop them at injection. The missing echo drives the client re-stage, and a later capable handover cannot double-deliver restored context. - Applied events reconcile dropped quotes: when a quote-less applied part settles a quote-bearing chip (the lost-202 ordering the ACK-echo path cannot see), resolveSteerChip and both reconnect settle paths re-stage the chip's excerpts before removing their only copy. mergeRestagedQuotes dedupe keeps every trigger idempotent for the same excerpts. * 🔁 fix: Re-Read Quote Capability at the Last Moment and Cap Restaged Chips Codex round 5: - A HITL resume rewrites steerQuotesCapable without changing the generation's createdAt, so the enqueue fence cannot see a capable-to-legacy handover landing during admission's awaits. Re-read the owner's flag immediately before item construction (paid for only by quote-bearing requests); the residual between re-read and enqueue commit matches preemptCapable's documented race. - mergeRestagedQuotes now respects the 10-quote contract with the staged chips winning: a restored tail that cannot ride the next send is dropped explicitly instead of rendering as a chip the submission would silently discard. MAX_QUOTE_COUNT moves to utils/steer as the single client source; QuoteButton imports it. * 🔁 fix: Steer Quote Coverage for Preflights, Memory, and Single-Scan Stamping Codex round 6: - Stored-message policy inspection now extracts steer-part quotes as quote fragments (path /content/N/quotes/M), so conversation import and shared link preflights inspect the newly persisted field exactly like top-level message.quotes. - The memory copy gets its own quote-merge stamp (text only, resendFiles false): formatAgentMessages ignores part.quotes, so without it a steer whose substance lives in its excerpt reached the chat model but never memory extraction. - collectSteerStampTargets replaces the boolean probe: buildMessages collects once and hands the targets to stampSteerPartMedia, keeping the zero-await fast path without scanning the history twice. * 🔁 fix: Redis Quote Plumbing, Conversion-Race Guard, and Quote-Bound Recovery Proof Codex round 7: - RedisJobStore.deserializeJob now restores steerQuotesCapable (the explicit mapper otherwise dropped it on every read, leaving quote steering inert in Redis deployments), with the round-trip spec extended. - Both Lua parked-steer projections (terminal close + generation replacement) forward item.quotes, matching toPendingSteer — a lost final no longer strips excerpts from durable recovery in Redis mode. - The no-echo restage reads the SURVIVING chip (reclaimRejectedChipQuotes): a terminal conversion that beat the delayed 202 already moved the quotes onto the queued follow-up, and re-staging them again double-delivered. Regression-tested with the conversion-before-ACK ordering. - RecoveredSteerPayload binds normalized, order-significant quotes (builder, validator, TS matcher, and the Lua decode+matcher): a stale client presenting the same recoverySteerId with altered or missing quotes cannot consume the parked source. Quote-less sources keep matching quote-less recoveries. * 🔁 fix: Execution-Bound Quote Capability with an Atomic Enqueue Predicate Codex round 8: - steerQuotesCapable becomes a transient assertion translated (at createJob and in ApprovalLifecycle.resolve) into steerQuotesExecutionId, valid only while it equals the LIVE providerExecutionId. A legacy replica winning a HITL resume rewrites the execution id without knowing the marker, so its stale assertion self-invalidates — a bare boolean could not be cleared by code that predates it. - The fenced enqueue evaluates that equality atomically (all three Redis scripts decode-and-strip like the existing preemptCapable normalization; both InMemory sites mirror it) and returns the persisted item, so the quotesAccepted echo reflects exactly what was stored even when a handover lands between admission's read and the commit. The last-moment re-read is gone — the transaction is the authority. - Tests: capable-resume re-binding, legacy-resume omit-not-clear invalidation, the admission-vs-handover race (capability read true, then execution rewritten before enqueue), and the Redis round-trip of the marker. * 🔁 fix: Full Redis Parking Coverage and Loss-Moment Quote Restaging Codex round 9: - The two remaining Redis parking projections (terminal status CAS and stale-running cleanup) forward item.quotes — every field-picked steer projection now carries them (audited: 2 Lua 'projected' + 2 Lua 'clientItem' + toPendingSteer). - The ordinary no-echo ACK no longer re-stages: the steer has not injected yet, so the quotes stay carried on the pending chip. A quote-less applied event re-stages them at the actual loss; a terminal leftover conversion carries them onto the recovered row, whose normal send delivers quotes on any server — re-staging at the ACK let that leftover auto-send bare text while the excerpts glued onto an unrelated draft. Only the settled receipt replay (already injected, no future event) reclaims immediately. * 🔁 fix: Legacy-Replayable Receipts with Separate Quote Identity Codex round 10: an upgraded-first receipt stored a quote-inclusive fingerprint no pre-quotes replica could recompute, so a lost-ACK retry routed through one 409'd already-accepted words with duplicate-send controls. The durable fingerprint reverts to the quote-independent 3-field hash — the one shape EVERY deployed version computes, replayable across a rolling deploy in both directions — and quote identity moves beside it as requestedQuotesFingerprint (of the REQUESTED quotes, pre any capability strip, so an incapable-owner acceptance still replays its own retries). Absent records (legacy-written or quote-less) accept any same-words retry, preserving the round-5 rule; present records must match exactly, keeping different-quotes clientSteerId reuse a 409 on quote-aware readers. Under the keep-on-chip client contract a legacy replay's missing echo is harmless — the excerpts stay carried on the pending chip. * 🧪 chore: Re-Trigger CI After Dropped Workflow Events	2026-08-24 22:29:13 -04:00
Danny Avila	69e7c73614	🎛️ feat: Expose Authoritative Subagent Controls (#15169) ... * feat: expose authoritative subagent controls * fix: reconcile subagent control races * fix: reconcile durable control conflicts * fix: preserve authoritative subagent control outcomes * fix: fence subagent controls to child thread * fix: validate subagent control targets before routing * fix: close subagent control boundary gaps * fix: keep control reservations private * fix: close subagent control admission gaps * fix: preserve authoritative control history * style: sort subagent control imports * fix: preserve authoritative subagent control retries * style: sort control state imports	2026-08-24 20:37:49 -04:00
Danny Avila	d641c398d5	🧳 fix: Port Subagent Control Receipt Writes to DocumentDB-Safe Operators (#15171) ... * fix: harden subagent control receipt persistence * fix: harden durable subagent control replay * fix: await terminal control receipts on shutdown * fix: close subagent control replay races * test: type stale-owner transport fixture * fix: quiesce durable subagent controls * test: await subagent shutdown durability boundary * fix: serialize durable subagent controls * fix: fail shutdown on cleanup errors * fix: report cancellable result availability accurately * fix: fence subagent control receipt ownership * fix: close distributed control receipt races * test: type control receipt race fixture * chore: require authoritative control receipts * fix: close subagent control lifecycle races * style: separate control reservation member * test: harden subagent settlement wait * fix: preserve authoritative control replay state	2026-08-24 20:05:39 -04:00
Danny Avila	a997275902	🧾 feat: Persist Authoritative Subagent Control Receipts (#15168) ... * feat: persist subagent control receipts * fix: require control receipt persistence * fix: preserve authoritative control history	2026-08-24 11:39:56 -04:00
Danny Avila	5a8700643c	⚡ perf: Build the Memory Message Copy Only When Something Reads It (#15164) ... buildMessages formatted every history row twice per turn — a prompt copy and a memory copy — then discarded the entire memory payload unless some row carried fileContext, which is the rare case. The memory copy has exactly two consumers: that payload, and the canonical recount of a row, where it is content-identical to the prompt copy unless the row itself has fileContext. So the prompt copy is now the recount surface for context-free rows, a fileContext row builds its memory copy at recount time, and the full memory payload is assembled in a deferred pass — same formatting, same per-row merge order — only once a row has proven the payload will be kept. The common turn formats each row once instead of twice and no longer allocates a payload it throws away. Also forwards the run's useLegacyContent to formatAgentMessages as the new legacyContent option, inert on the current SDK release: once the SDK change ships, text history is emitted pre-flattened so the per-request legacy projection stops cloning every message and the context meter's identity-based count reuse holds across the projection.	2026-08-24 10:33:47 -04:00
Paco Cartones	bf1e13b806	🥁 fix: Compare TOTP Codes in Constant Time (#15157) ... Co-authored-by: pacocartones <pacocartones@users.noreply.github.com>	2026-08-24 09:10:03 -04:00
Danny Avila	d85bea41cc	🧪 ci: Mock the Parent Subagent Index Handler in Convos Route Tests (#15146)	2026-08-23 22:54:19 -04:00
Danny Avila	fc2b8584c4	📇 feat: Surface Event Child Activity Through a Bounded Parent Index (#15142) ... * feat: surface event-driven child activity * fix: keep child task aggregation documentdb-compatible * fix: address event activity review findings * test: provide markdown message context defaults * fix: report bounded child history truncation * fix: preserve current child activity state * fix: preserve durable event child activity * fix: handle missing task timestamps * fix: keep active event snapshots live * fix: preserve event activity across valid anchors * fix: close event child activity gaps * fix: preserve event activity across resume	2026-08-23 18:50:00 -04:00
Danny Avila	d864597731	⚡ perf: Append Saved Message Ids Instead of Rebuilding the Conversation Array (#15141) ... * ⚡ perf: Append Saved Message Ids Instead of Rebuilding the Conversation Array Every saveConvo read every message id in the conversation (sorted) and wrote the array back onto the document — twice per chat turn, O(n) in conversation length, from a write path. The turn's savers know exactly which message they just wrote, so they now pass it as metadata.appendMessageIds and saveConvo $addToSet-s it, skipping the read and the full-array rewrite. Every save without the option — titles, archive, fork, import, threads — still rebuilds from the database, which remains the heal point for the drift that message deletion has always left behind (deletes never ran saveConvo). The array's consumers read presence or length, or use it as an optimistic cache placeholder, so incremental maintenance is behaviorally identical; on traced turns the array stays exactly equal to the messages collection. Per-turn queries: 15 -> 13 (two Message.find gone), and the growing array payload no longer crosses the wire twice per turn. * 🎯 fix: Brand the Lineage-Only Resolved Conversation Instead of Guessing by Shape The resolved-conversation files fast path treated an absent files property as unresolved so the lineage-only partial from a bound agent-event continuation could not silently hide a conversation's uploads. But MongoDB never stores an empty files array, so nearly every real conversation also lacks the property and the fast path never fired — a follow-up turn on an upload-free conversation still paid the getConvoFiles round trip. The synthesized partial is the one object that cannot speak for the database, so it now carries an explicit symbol brand (PARTIAL_RESOLVED_CONVERSATION, non-serializing and invisible to key iteration), and a stored document without files means what it means: no files. Traced follow-up turns drop from 14 queries to 13. * 🧪 test: Expect the Appended Message Id in the Route's saveConvo Metadata messages-get.spec.js pins the exact metadata POST /api/messages passes to saveConvo; the route now forwards the saved message's _id as appendMessageIds, which is the behavior the append path depends on.	2026-08-23 16:52:44 -04:00
Danny Avila	f3c6e24f84	⚡ perf: Cut Serial Round Trips and a 100ms Admission Stall from Chat Turns (#15138) ... * ⚡ perf: Stop Awaiting the Conversation Access Marker Write Without Redis the CONVO_ACCESS violations namespace is backed by keyv-file, whose debounced write resolves after ~100ms. validateConvoAccess awaited that write before calling next(), so the first message to any existing conversation waited ~100ms before the request was even admitted — once per conversation per ten-minute window, on every default deployment. The marker only short-circuits the next check, so the write no longer gates the request. The same read now stashes the full document on req.resolvedConversation (null when absent) for downstream consumers. First-turn ack on an existing conversation: 109ms -> 5ms. * ⚡ perf: Read the Conversation Once per Chat Turn A chat turn read the same conversation document four times: the access check (two fields), the subagent thread guard (full document), agent initialization (the files field), and the first save. The access check now reads the full document and leaves it on req.resolvedConversation, the guard accepts that pre-resolved document instead of re-reading, and initializeAgent takes the conversation's file refs from it rather than issuing a separate findOne. Two serial round trips removed from every turn; the same document still serves the first save as before. * ⚡ perf: Remove Duplicate JWT Authentication on Agents Routes routes/agents/index.js applies requireJwtAuth and then mounts the v1 router at '/', which applied requireJwtAuth again. Every request through the agents router — chat turns included — ran the passport strategy twice: two signature checks and two user document reads. The v1 router is mounted nowhere else; its separately exported avatar router carries its own auth in files/index.js. * ⚡ perf: Skip the History Read for Root-Parent Turns and Walk the Tree in O(n) loadHistory fetched every message in the conversation and then walked the parent chain from the request's head. For a new conversation — or a new branch from the root of an existing one — the head is the root sentinel, which no message carries as its id, so the walk was empty by construction and the fetch was wasted. It now returns early. getMessagesForConversation found each ancestor with Array.find inside the walk, O(n^2) on a linear conversation (~5ms at 1000 messages). A Map by messageId makes it O(n); first-match semantics are preserved.	2026-08-23 15:17:35 -04:00
Danny Avila	1d9c2fc591	🪴 feat: Fork Completed Subagents Into Continuable Chats (#15133) ... * feat: continue completed subagents as chats * chore: sort continuation imports	2026-08-23 10:09:14 -04:00
Danny Avila	77cb72e50c	🧮 perf: Enable Agent Context Count Reuse (#15130) ... * perf: enable agent context count reuse * fix: declare token counter return type * fix: initialize cached token counters * style: sort token counter imports * fix: Keep cached token counts exact	2026-08-23 03:05:02 -04:00
Danny Avila	8969ee4b18	🎚️ feat: Configure Agent Event Runtime in YAML (#15128)	2026-08-23 02:37:33 -04:00
Danny Avila	dd146ff74d	🧾 fix: Report Complete Agents API Usage (#15127) ... * fix: report complete agents api usage * fix: preserve invoked usage context * test: cover absent usage context * fix: type responses usage finalization * fix: preserve reasoning usage aliases * fix: declare reasoning usage alias	2026-08-23 02:37:09 -04:00
Danny Avila	2018c70040	🧫 test: Lock Subagent File Context Propagation (#15126)	2026-08-23 02:06:57 -04:00
Danny Avila	c2aa688d73	🖥️ feat: Stream PTC Inner Tool Calls as a CLI-Style Trace (#15115) ... * 🖥️ feat: Stream PTC Inner Tool Calls as a CLI-Style Trace Programmatic tool calling runs a whole program inside the sandbox, and the tool calls that program makes open no run step of their own. The card showed one running spinner for the entire execution, with no sign of what the code was doing. Emit a new `on_ptc_tool_call` step event for each inner invocation — once on dispatch, once on settle — and render them under the code as a terminal-style trace: status glyph, tool identity, argument preview, duration, with a failure message printed under the call that produced it. The seam is the tool map the sandbox bridge resolves inner calls against. `instrumentPtcToolMap` proxies `invoke` on each entry and leaves every other property (name, schema, mcp) passing straight through, so nothing about execution changes and emission failures can never fail a tool call. Client state is a per-tool-call Recoil atom keyed like the sandbox-starting and subagent atoms — live for the session, cleared on conversation switch so a finished program's trace stays readable. * 🩹 fix: Address Codex Review on the PTC Tool Trace Five findings, all confirmed against the source before fixing. Scope the trace atoms to a message occurrence. The hook already documents that providers repeat a tool_call_id across turns and even within one message, and `call_id` restarts at :0 for every outer call — so two programs sharing `call_0` merged into one card. Key by (response message id, tool call id) via `ptcTraceKey`, mirroring `subagentProgressKey`; the event's `runId` already carries the message id and the card reads its own from MessageContext. Prune unsettled rows on resume. Inner calls are not content parts, so the resume snapshot cannot rebuild them, and `trackReplayEvent` only persists OAuth events — a call that settled during a disconnect left a spinner that never resolved. Settled rows are real history and stay. Make the argument preview budget-aware. Iterate keys rather than entries so the budget check can actually skip work, and clip against a bounded window so a multi-megabyte value is never collapsed in full to build a 40-character preview. Catch the resumable emission promise. The synchronous try/catch around the emitter cannot observe a rejected `emitChunk`, so a failing transport raised an unhandled rejection per event instead of dropping telemetry. Announce completion to assistive technology. The check glyph is decorative and a fast call renders no duration, so a settled row previously announced no outcome; each row now carries an sr-only status and the visible cell that duplicated it is hidden. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MBRQUsPXSvDBnjrSDoXWHP * 🧹 fix: Repair CI Failures on the PTC Tool Trace Two failures on the previous head, both mine. `Tests: api (shard 2/3)` — 46 failures in `initialize.spec.js`, all `TypeError: createPtcProgressEmitter is not a function`. The suite mocks the callbacks module with an object literal, and wiring the new emitter into `initialize.js` without adding it there left the factory undefined at call time. Added it alongside `createAttachmentEmitter`, plus an assertion that it receives the same generation fence as every other resumable emitter — a stale epoch would leak one run's inner calls into the next. `Static checks` — import-order drift in `PtcToolTrace.tsx` and `handlers.ts`, repaired with `scripts/sort-imports.mts`. ESLint and Prettier both passed, so only the dedicated check caught it. `openai.js` and `responses.js` never take the emitter, so their specs were unaffected; verified the initialize mock now covers every name the module destructures. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MBRQUsPXSvDBnjrSDoXWHP * 🔐 fix: Address Second Codex Review on the PTC Tool Trace Three of five findings actioned; two answered on the thread. Respect tool-argument PII filtering (P1). Inner calls never reach `filteredToolArgumentsResult` — the sandbox bridge invokes them directly — so the trace was the one path putting their values on the wire in a deployment that had configured `filters.toolArguments.pii`. When any of the name / arguments / output fields are filtered, the emitter now omits both the argument preview and the failure message, which routinely quotes the argument that caused it. Name, status and duration still report. Drop the light/dark-specific background (P1). `dark:bg-transparent` stepped outside the semantic roles and would lose the intended separation under a custom theme. The pane now sets no background at all and inherits the card's surface, which resolves to the same color the override produced in both default themes and stays correct when a theme reassigns its roles. Bound the live trace (P2). A program looping over a large collection made every event copy an ever-growing array and rendered a row per call. The trace now keeps a rolling tail of 100 rows and counts what it evicted, surfaced as "+N earlier calls" so the cap is never silent. A settle whose row is gone — evicted, or pruned across a resume gap — no longer reappears out of order. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MBRQUsPXSvDBnjrSDoXWHP * ✅ test: Keep PTC Trace Tests Aligned With Caller-Capability Filtering Left out of the merge commit by a staging slip; without them `handlers.spec.ts` fails on the merged tree. `#15105` restricts the PTC tool map to tools whose `allowed_callers` admit code execution, so the existing trace test's registry entry — which declared none, defaulting to `direct` — was filtered out before the instrumentation could see it. Declare the fixture `code_execution`. Add a guard for the resolution itself: a `direct`-only tool must never appear in the instrumented map. Tracing wraps the eligible map, and this fails if a later change reorders that and lets the trace widen what the sandbox reaches. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MBRQUsPXSvDBnjrSDoXWHP * 🛡️ fix: Close Name Disclosure and Follow the PTC Trace Tail Two findings from the third Codex pass on `17a9ec9`. Redact filtered inner-tool names (P1). The previous gate suppressed argument and failure previews but the event still carried `name` verbatim, so a deployment whose `filters.toolArguments.pii.fields` includes `name` could see a blocked identifier disclosed through the trace — the one path inner calls take, since they never reach `filteredToolArgumentsResult`. Inner tool names are now inspected once per PTC call with the same `extractToolArgumentContent` + `inspectContent` pair the executor uses; any that trip the policy are left unwrapped, so they still execute and emit nothing. An un-inspectable name fails closed. Follow the trace tail (P2). The row list is a 200px scroller that never moved, so once a program exceeded the viewport the card sat on the oldest calls while live activity accumulated below the fold. Reuse `useFollowScroll` — the hook the code and command panes already use — which pins to the tail while calls are running and yields the moment the reader scrolls up. The host card threads its disclosure state so a collapsed pane is never scrolled invisibly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MBRQUsPXSvDBnjrSDoXWHP * 📌 fix: Pin the PTC Trace Through Its Final Settle The fourth Codex pass on `4bf68e1`, one P2 finding. `useFollowScroll` returned early whenever `active` was false, so the one change it most needed to follow was the one it skipped. A failing inner call settles by appending its error line in the same commit that clears the last running row: the content grows and the stream ends together, and the pin that would have revealed that line never fired. On an expanded, bottom-pinned pane the failure — the row a reader most wants — stayed below the fold. The falling edge of `active` now pins too, but only when the content changed with it. Ending a stream on its own still leaves the pane where the reader left it, which is what the existing contract promises and what the sibling code and command panes rely on; a reader who has scrolled up is untouched either way. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MBRQUsPXSvDBnjrSDoXWHP * 🔌 fix: Keep PTC Calls That Outlive a Reconnect Fifth Codex pass on `085a83f`; one of its two findings. Pruning rows across a resume gap deleted every `running` row, but a stream gap is not proof the call ended. A call still executing across the reconnect settles normally on the restored live stream — and `applyPtcToolCall` drops a settle whose row is gone, by design, so an evicted row cannot reappear out of order. The call therefore vanished from the trace despite having run, which is worse than the spinner the pruning existed to prevent. Rows are now marked `interrupted` instead of removed. A call whose settle was genuinely lost in the gap reports that honestly rather than spinning forever, and one that survives the gap settles onto the row it opened, reporting its real outcome and duration. `interrupted` is a client-side conclusion, so it widens the row status locally and leaves the wire contract alone. Two cases added: the gap marks rather than drops, and a post-reconnect settle lands on its marked row; plus a render case for the new outcome. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MBRQUsPXSvDBnjrSDoXWHP --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-23 01:18:14 -04:00
Danny Avila	1de88e7e91	📨 feat: Continue Bound Child Agents from Events (#15112) ... * feat: add authenticated agent event ingress * style: sort agent ingress imports * fix: harden agent event ingress * fix: bind event provenance to API keys * fix: inspect event input with legacy PII filters * fix: scope event status reads to source keys * fix: bind event status reads to remote sources * feat: add bound event-driven child turns * fix: harden event-bound child continuations * fix: satisfy event binding type contracts * fix: close event actor lifecycle races * fix: harden event actor dispatch continuity * fix: fence event actor resume lifecycle * fix: bind event actor state to lifecycle * fix: preserve cascade write outcomes * test: type cascade failure injection * style: sort cascade test imports * fix: harden event child lifecycle boundaries * fix: make event cleanup retryable * fix: annotate event retention clock * fix: reconcile partial cascade metadata * fix: recheck event binding expiry on resume * fix: fence event actors by retention deadline * fix: close event actor lifecycle races * fix: harden event child lease acquisition * fix: lazy-load event child lease adapter	2026-08-23 01:15:57 -04:00
Danny Avila	8f9fae0a6e	🛂 fix: Preserve Legacy Assistant Attribution (#15118)	2026-08-22 16:21:45 -04:00
Danny Avila	89494d45fd	🚦 fix: Restrict Programmatic Tool Execution Maps (#15105) ... * fix: restrict programmatic tool execution maps * chore: bump `@librechat/agents` to v3.6.10 * fix: honor live programmatic caller projections * style: sort caller capability imports * test: expect caller projection loader argument * chore: bump agents sdk to v3.6.11 * refactor: use SDK caller projection type * style: sort agent handler imports	2026-08-22 11:02:09 -04:00
Danny Avila	d3e70159ca	📡 feat: Stream Detached Subagent Activity (#15111) ... * feat: stream detached subagent activity * fix: annotate activity stream limits * fix: isolate subagent activity imports * fix: harden detached subagent activity lifecycle * test: cover synchronous activity transport failure * test: include required subagent activity identity * fix: identify and reconnect subagent activity events * fix: bound subagent activity lifecycles * fix: close subagent activity handoff races * fix: bind and synchronize activity subscriptions * fix: detect fresh activity attachment * fix: complete activity synchronization handoff * fix: bind activity sync and failure circuits * fix: expose subscription-bound synchronization * fix: fence activity reconnect publications * test: make detached timeout settlement deterministic * fix: fence Redis activity attachments * fix: close failed activity streams * perf: reuse fenced activity frontier * style: sort subagent thread imports * fix: preserve queued subagent activity * test: type activity publication counter * fix: disconnect subagent activity subscriber * fix: close background activity lifecycle gaps * fix: preserve streamed activity spacing * fix: preserve bounded live subagent activity * fix: merge durable subagent activity safely * fix: model detached activity coverage * fix: type detached activity inputs * fix: order overlapping subagent activity * chore: sort activity test imports * fix: buffer subagent activity handoff gaps * fix: flush activity after parent close * fix: advance closed activity suffixes * fix: preserve detached activity ordering * fix: close detached activity delivery races * fix: bound shared Redis subscriber readiness * fix: expire shared Redis subscription readiness * fix: clean up late Redis subscriptions * fix: preserve late Redis subscription fallback	2026-08-22 09:45:27 -04:00
Danny Avila	3ebef4c84e	📨 feat: Add Authenticated Agent Event Ingress (#15110) ... * feat: add authenticated agent event ingress * style: sort agent ingress imports * fix: harden agent event ingress * fix: bind event provenance to API keys * fix: inspect event input with legacy PII filters * fix: scope event status reads to source keys * fix: bind event status reads to remote sources	2026-08-22 01:09:04 -04:00
Danny Avila	67b7b441b2	🛂 feat: Filter Model-Bound Content by Source (#14425) ... * feat: introduce optional content protection seam * feat: enforce source-aware content filters * feat: complete source-aware content enforcement * test: activate skill file-text fail-close fixtures * fix: harden source-aware content filters * fix: harden model-bound content filtering * fix: preserve legacy filters and generated files * fix: inspect shared scalar metadata * test: align mocks with current dev dependencies * feat: add persisted content filter safeguards * feat: complete source-aware content filter enforcement * fix: move resume content preflight into TypeScript * fix: close content inspection edge cases * fix: harden content protection boundaries * fix: complete content protection safeguards * test: align persisted memory filter coverage * fix: reconcile content protection with current dev * fix: reconcile content protection with latest dev * fix: close content protection review gaps * fix: enforce source-aware provider boundaries * fix: preserve legacy PII preflight semantics * test: stabilize stored branch preflight fixture * fix: defer agent writes until protected model admission * perf: harden source-aware model-bound filtering * fix: canonicalize provider lineage before validation * fix: satisfy model-bound callback type checks * perf: Bound content protection filtering work * fix: Bound submission array traversal * fix: Stabilize bounded content snapshots * fix: Scope model-bound traversal overflows * fix: Preserve scoped content inspection * fix: Accumulate aggregate traversal scopes * fix: centralize content policy boundaries * test: align deferred tool policy context * test: align controller policy mocks * style: normalize content protection imports * fix: close content policy review gaps * fix: narrow active skill policy config * fix: address content protection review boundaries * fix: retain exact provenance overflow sentinel * fix: preserve literal and scoped provenance updates * fix: narrow persisted edit provenance * fix: isolate exact overflow attribution * fix: centralize stored prompt protection * fix: fail closed on incomplete transcript evidence * fix: align canonical transcript routing * refactor: centralize content policy preflights * fix: isolate upload policy error typing * style: sort policy preflight imports * refactor: centralize content policy boundaries	2026-08-21 22:43:32 -04:00
Marco Beretta	199de92c51	⚡ perf: Warm Feature Catalogs in the Background After First Paint (#15047) ... * perf: warm feature catalogs in the background after first paint Prompt groups and MCP server/tool queries no longer fire on the app startup path. A catalog warmup store releases them after first paint on browser idle, staggered with jitter so a fleet of clients does not burst the API all at once. Panels opened before warmup activates their catalog immediately and fall back to their existing loading states. The prompts list endpoints now also run their independent access lookups in parallel instead of in three serial rounds. * perf: gate MCP icon observers and re-arm warmup across sessions MCP icon/name observers mounted from rendered messages now wait for the warmup gate like every other server-catalog consumer, so conversations with MCP tool calls no longer pull the server list onto the first-render path. The warmup schedule resets on logout so a second login in the same tab warms on its own stagger instead of releasing every catalog at once. Panel mount activations now require a visible sidebar, since a persisted active panel stays mounted while hidden. * perf: void stale warmup callbacks and gate the agent panel tools query Reset now bumps a generation captured by every idle callback and its stagger timer, so callbacks pending across a logout can no longer release catalogs into the next session. The agent form's MCP tools query keeps its own readiness gate so a hidden persisted panel cannot pull the tools request ahead of its stagger once the server list resolves. * perf: reset warmup on Root unmount and honor the insights route collapse Root can unmount in the same render that flips authentication on logout, so the warmup effect now resets from its cleanup as well as the unauthenticated branch. Panel activations mirror UnifiedSidebar's panelExpanded condition, treating the insights route as collapsed instead of reading the raw sidebar atom. * test: re-expand the approval tool card the saved message remounts The helper opened the card once and then waited on its body. Saving the response swaps the placeholder message id for the persisted one, which rekeys every part in the turn: the card remounts collapsed, its body unmounts, and the output assertion waits out its timeout against a disclosure nothing is going to reopen. The redis transport lane pays a round trip per stream event, so its finalization lands late enough to catch the helper mid-assertion. Wait for the closing model turn before expanding anything, then re-open the group and the card on each attempt until the scoped output is on screen. * Update AgentPanelContext.tsx import order --------- Co-authored-by: Danny Avila <danny@librechat.ai>	2026-08-21 20:33:29 -04:00
Danny Avila	8ae94afa91	🪡 fix: Thread Parent Message ID Through MCP Request-Scoped Bodies (#15095) ... * fix: Unify MCP request-scoped headers * fix: address request-scoped MCP review findings * test: preserve request scope on status errors * fix: treat authorized on-demand MCP servers as ready * refactor: separate MCP readiness from connection state * fix: preserve on-demand MCP readiness labels * test: satisfy OpenAI conversation ownership guard * fix: keep MCP action predicates boolean * fix: close deferred MCP request context gaps * fix: preserve on-demand MCP configuration actions * fix: fail closed on unavailable MCP parent context * test: complete MCP connecting-state mocks * fix: preserve missing MCP parent on continuations * fix: align native MCP request identities * fix: preserve edited MCP parent identity * test: use scoped Agent initializer fixture * test: expose MCP request body helper * fix: preserve MCP turn identity across resume * style: sort stream metadata imports * fix: carry normalized MCP identity to execution	2026-08-21 16:33:01 -04:00
Dustin Healy	f02ce63d57	✂️ fix: Strip Redundant Server-Name Prefixes from MCP Tool Keys (#14732) ... * ✂️ fix: Strip Redundant Server-Name Prefixes from MCP Tool Keys MCP servers that prefix every tool with their own name produce model-facing keys that embed the server twice once the _mcp_<server> suffix is appended, pushing long tool names past provider 64-character function-name limits. Tool keys now drop a leading <normalizedServerName>_ prefix (case-insensitive, skipped when a sibling tool already owns the stripped name). The original upstream name is recorded as serverToolName on the cached definition and is always what tool calls send to the server, and runtime lookups also try the stripped spelling of persisted pre-strip keys so existing agents keep resolving. * 🩹 fix: Keep Stripped MCP Tool Keys Provider-Safe and Collision-Free Assistant writers submit catalog entries verbatim, so the internal serverToolName mapping is now removed from provider-facing definitions before they reach create/update payloads. Prefix stripping is collision-guarded over the resulting name set rather than raw siblings only, which also covers case-variant prefixed pairs under the case-insensitive match. Assistant payload healing now rewrites a pre-strip persisted key to the stripped catalog key when that key actually exists in the loaded definitions, and legacy agent references keep their persisted spelling as the runtime instance name so per-tool options stay applied while the upstream call still uses the matched entry's raw name. * 🧷 fix: Harden Stripped MCP Tool Keys Against Heal, Collision, and Cache Edges The pre-strip heal now resolves the key boundary against both raw and normalized server spellings, mapping back to the raw name for the shadow and membership guards, so keys persisted after server-name normalization heal too. Collision detection iterates to a fixpoint so a fallback to a raw name cannot silently collide with another sibling's stripped result, and a stripped remainder equal to a synthetic marker (wildcard or server pin) is never produced. MCP catalog cache slices are versioned so replicas that predate serverToolName never read stripped entries during a rolling deploy; stale slices expire on their own. * 🔎 fix: Resolve Pre-Strip Keys in Event-Driven Definitions and Reinspect Persisted Catalogs The event-driven definitions loader now tries the stripped spelling of a persisted key when the exact lookup misses, keeping the persisted name so it matches the runtime instance, which stops legacy agents from failing initialization with expected tools unavailable. The registry storage schema version is bumped so followers rebuild persisted toolFunctions instead of republishing pre-strip definitions into the versioned catalog namespace. The assistants heal also fails closed when a normalized-suffix reference lands on a contested server-name slot, since rewriting persisted data must not bind an ambiguous reference to the tie-break winner. * 🛰️ fix: Reserve the Synthetic OAuth Name and Heal User-Owned Server Keys A stripped remainder equal to oauth would make the client stream handlers treat a real tool call as a synthetic authentication prompt, so it joins the reserved remainders alongside the wildcard and pin markers. The assistants heal now audits the FULL accessible server set on every run instead of operator config names only, since assistants reference user-owned servers whose catalogs the definitions loader already resolves; an unavailable audit still skips healing entirely. * 🧬 fix: Verify Upstream Identity for Legacy Keys and Reserve Sibling Raw Names Stripped results now reserve every sibling's raw name even when that sibling itself strips, so a stripped key can never shadow another tool's pre-rollout persisted references within the same snapshot. Every legacy fallback (runtime lookup, event-driven definitions, assistants heal) accepts a stripped-spelling match only when the entry's recorded serverToolName proves the same upstream tool, so a stale key for a removed tool degrades to unavailable instead of calling a different sibling. To keep that identity visible to the heal, assistant tool definitions retain serverToolName and the controllers sanitize entries through toProviderToolDefinition at the provider submission boundary instead. The agent editor migrates pre-strip persisted ids the same identity-verified way, with the upstream name exposed on the MCP tools payload. * 🧭 fix: Heal Wildcard Tool Options and Reserve the OAuth Namespace Wildcard-expanded catalogs rename stripped tools without any agent.tools entry to preserve the spelling, so buildToolClassification now aliases persisted pre-strip tool_options keys onto the current instance names in place, identity-gated on the definition's recorded upstream name and never overriding an explicit entry. Both loading modes flow through it: instances carry mcpServerToolName from createToolInstance and event-driven definitions thread serverToolName from the catalog. stripServerNamePrefix also reserves the entire oauth namespace rather than the exact name, since the client stream handlers classify every oauth-prefixed key as a synthetic authentication call. * 🛡️ fix: Derive the Full Reserved Namespace and Heal Approval Policies The reservation guard now covers every namespace consumers classify by prefix: the wildcard and server-pin markers alongside oauth, plus the server-scoped mcp_ pluginKey namespace that pre-strip keys could never enter. Stripping also never produces a key whose isActionTool classification differs from the raw key's, since a server whose normalized name contains _action_ would otherwise see a real MCP tool routed down the OpenAPI action path past MCP authorization. Admin toolApproval globs written against upstream tool naming keep applying: pattern lists are healed at run wiring with the current names of tools whose pre-strip spelling matches, list-level so deny, ask, and allow precedence is unchanged and a non-matching deny can no longer fail open. The MCP tools wire type also declares serverToolName end to end. * 🪪 fix: Alias Both Key Spellings for Approval Policies and Hook Matchers Identity aliases are now collected once at tool classification, in both directions: a stripped instance aliases its pre-strip spelling and a legacy-named instance aliases its current catalog spelling, with the current name recorded on legacy matches by the runtime lookup and the event-driven definitions loader alike. The aliases ride the agent config through both loading modes, so approval pattern healing applies to deny rules written against either spelling, closing the bypass where a rule targeting the current name missed an unedited agent's legacy instance. Programmatic approval hook matchers get the same treatment: each hook is additionally registered under an anchored exact-name pattern for tools whose other spelling its regex matches, keeping the admin's matcher semantics intact while argument, user, and tenant specific deny or ask decisions keep executing for renamed tools. * 🔁 fix: Alias Tool Options in Both Spelling Directions Options aliasing now consumes the same bidirectional alias pairs as policy healing and hook matchers, so options the editor migrated to the current catalog spelling still reach a legacy-named instance retained by an unedited agent.tools entry. The previous serverToolName-only derivation skipped exactly that case since the legacy key equals the instance name there. * 🤝 fix: Reserve the Agent Handoff Namespace Before Stripping The client renders any lc_transfer_to_ prefixed call as an agent handoff and the background and intent passes exclude such names, so a stripped remainder inside that namespace would misclassify a real upstream tool. It joins the mcp_ pluginKey namespace as a bare-prefix reservation, which pre-strip keys could never enter. * ⚡ fix: Reuse the Loader's Server Snapshot and Index the Editor Catalog getAssistantToolDefinitions now returns the accessible-server snapshot from the same merged registry read that resolved the catalogs, and the heal consumes it instead of repeating the app-config and registry round trips on the assistant write path; without a snapshot the heal still fetches and fails closed as before. The agent editor's id migration uses a memoized tool_id map, so the per-key form heal does constant-time lookups instead of scanning the catalog per option. --------- Co-authored-by: Danny Avila <danny@librechat.ai>	2026-08-21 14:30:29 -04:00
Yorgos K	9f8d71a3c5	🪢 fix: Preserve Response Identity and Branch During Resumable SSE Sync (#14788) ... * fix(client): preserve resumable response identity Fixes #14787 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test(client): align resumable sync regressions Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test(client): clarify resumable response ownership Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(client): preserve resumed regeneration ordering Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test(client): cover missing resumed response row Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(client): preserve resume identity on page reload * fix(client): replace reassigned resume placeholder * fix(client): preserve content during response id handoff * fix(client): limit resume placeholder handoff * fix(client): preserve resume display metadata * fix(client): reconcile resume metadata in one pass * fix(client): reconcile preliminary resume user * fix(client): restore regenerated branch on early abort * test(client): cover external regeneration resume * fix(client): preserve regeneration history on errors * fix(client): replace reused regeneration error ids * fix(client): preserve exact-id regeneration rollback --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Danny Avila <danny@librechat.ai>	2026-08-21 14:25:03 -04:00
Oliver Faust	b399ad8370	📄 fix: Serve Stored Text for "Upload as Text" File Downloads (#14723) ... * 📄 fix: Serve Stored Text for Text-Source File Downloads "Upload as Text" attachments store extracted content in the DB with source 'text'; OCR uploads persist the OCR strategy name (e.g. 'mistral_ocr') as a filepath placeholder since no backing file exists. The download route resolved these records to the local strategy and passed the placeholder to fs.createReadStream, which failed with ENOENT — and the response was never ended after the stream error, so the request hung until the client timed out. Serve the stored text directly as a .txt download for text-source files (re-fetched by _id, as getFiles excludes 'text' by default), and end the response on stream errors: 500 without the download headers before headers are sent, otherwise abort the truncated response so clients detect the failure. * fix: Preserve text-source preview semantics * fix: Complete text-source download coverage * fix: Tie text downloads to blob lifecycle * fix: Isolate preview downloads and share text snapshots * fix: Keep shared previews in share scope * style: Sort text download imports --------- Co-authored-by: Danny Avila <danny@librechat.ai>	2026-08-21 14:24:43 -04:00
Marco Beretta	29f6ec6eae	🙈 feat: Config Option to Hide Response Feedback Buttons (#15085) ... * feat: add interface option to hide response feedback buttons Adds `interface.feedback` to librechat.yaml. When set to false, the thumbs up/thumbs down buttons are removed from the message action row and the feedback endpoint rejects writes with 403, so deployments that do not consume the data can stop collecting it. Defaults to true. * refactor: hoist the feedback gate out of the message row and into typed middleware Reading startup config inside HoverButtons put a query observer and two Recoil subscriptions on every message row, and rows never unmount, so the cost grew with the conversation. Resolve the flag once per chat in useChatHelpers and carry it on TMessageChatContext; useMessageActions withholds handleFeedback when it is off, which the action row already treats as "no feedback controls". The flag now stays false until the config resolves, so a disabled deployment never flashes controls whose writes are rejected. Move the server-side policy into requireFeedbackEnabled under packages/api so the route keeps no policy of its own. * test: stub the feedback gate in specs that replace the api package The messages router now imports requireFeedbackEnabled, and express rejects an undefined handler at require time, so every spec that mocks @librechat/api wholesale has to carry the export.	2026-08-21 11:16:44 -04:00
Danny Avila	634432b2ae	🪟 feat: Read Child Threads Through Their Parent (#15073) ... * feat: add parent-scoped subagent thread reads * fix: tighten child thread read bounds * perf: project child activity messages * test: update child activity route fixtures * test: satisfy response mock types * fix: bound child activity reads at storage * style: sort child activity imports * fix: bound child activity storage reads	2026-08-21 11:10:26 -04:00
Danny Avila	8c14f03432	🗂️ feat: Scope Scheduled Chats to Chat Projects (#15056) ... * 🗂️ feat: Scope Scheduled Chats to Chat Projects Adds an optional chat-project destination to a schedule, plus the operator config to require one — or to pin every scheduled run to a specific project. Feature: - `chatProjectId` on the schedule row, accepted on create/update, projected on the wire, and carried into the run's conversation through the durable trigger envelope's `run` context. - `interface.schedules.requireProject` refuses schedules that are not filed under a project; `interface.schedules.projectId` pins every run to one project and implies the requirement. - Dialog gains a project picker (required when configured, a read-only row when pinned); the card shows the destination and the new disabled reasons. Invariants: - ONE resolver (`resolveScheduleProjectId`) decides the destination for the write handler, the fire path, and the wire projection alike, and an operator pin OUTRANKS the stored id in all three. Tightening the config therefore redirects — or stops — existing schedules instead of grandfathering where their runs land. A pin implies `requireProject` for the same reason: without it, a row created before the pin would keep firing with no project at all. - Create/fire precheck symmetry, mirroring `resolveAgentFireAccess`: a write this handler accepts is one the next fire also accepts. Any edit leaving a schedule ENABLED re-validates its EFFECTIVE (possibly stored) project, like the existing stored-agent and cadence-floor rechecks. A DISABLING edit skips the requirement, or a schedule auto-disabled for `project_required` could never be turned off. - Fire-time enforcement auto-disables rather than filing runs loose, matching agent_deleted: new `project_required` (requirement raised after creation) and `project_deleted` (gone, or pinned to a project this owner does not have) reasons, both refused BEFORE a billed generation is dispatched, and both advancing so a schedule can never wedge on the occurrence. - `computeCreateDigest` appends the field only when present, so a payload without a project digests byte-identically to one from before this change — a create retried across the upgrade still matches its own row instead of reading as key reuse. - Project reads are scoped to the owner, so ownership and existence are the same lookup; a read ERROR propagates instead of failing closed, so a Mongo blip retries the fire rather than auto-disabling the schedule. The trigger idempotency key hashes principal/event/target and never `envelope.run`, so the added run field cannot destabilize delivery identity. * 🗜️ fix: Keep the Schedule Dialog Inside Its Height Budget The project picker landed as a new ROW in the schedule dialog, which broke the e2e edit spec: `md:overflow-visible` turns off the template's scrolling from `md` up, so the dialog's content must fit the viewport. The extra row pushed the footer's Save button below a 720x1280 window, where Playwright reported a visible, enabled button it could never click — 226 scroll-into-view retries and a 2-minute timeout, on all three attempts. Measured against `dev` at 1280x720 (Save button's bottom edge, viewport 720): dev 688 (32px slack) project row ~790 (off-screen, CI failure) 3-column row 704 (16px slack — half the budget spent) this commit 686 (34px slack, 2px better than dev) The identity row is now three columns — name, agent, project — and its caption moved out of the agent cell to sit full width beneath the row: at a third of the dialog that sentence wraps an extra line, and the row is the tallest thing competing for the budget. The caption is grouped with the row rather than left to the form's own 4-unit rhythm, which spent more height on the gap than the caption occupies. The e2e spec now asserts the button is in the viewport before clicking it, so the next field that overflows this dialog says so in one line instead of a two-minute timeout on a visible element. FOLLOWUPS.md records what the planned dialog controls (multi-day weekly, timezone, attachments) need first: give `ControlCombobox` the `portalElement` prop `Dropdown` already has, portal the popovers into the dialog content, and let the form scroll again. * 🧹 fix: Address Codex Review on Scheduled Chat Project Scope Four P2 findings, all real. Unreachable clearing path (ScheduleDialog). The picker only held live projects, so `com_ui_schedule_project_none` was a PLACEHOLDER — nothing selectable. Once a schedule had a project the owner could never take it away, leaving the server's `chatProjectId: null` path reachable only by API. The picker now carries a real "No project" option whenever a project is optional, and omits it when one is required, where there is nothing valid to select. Placeholder shown for a real project (ScheduleDialog). A stored or pinned project outside the first loaded page had no name in the paged map, and the combobox renders its placeholder for an empty display value — telling the owner a scoped schedule had no project. That one project is now read by id, with the raw id as a last resort: a poor label, but an honest one. Project policy skipped at the resume boundary (service.ts). `claimScheduleResume` re-applied the schedules gate, the revision fence, the kill switch and SCHEDULES:USE, but not the project policy this PR added. Approving a paused run whose project was deleted — or whose owner now sits under a requirement or a pin it no longer satisfies — billed a continuation the very next scheduled fire would refuse and auto-disable the schedule for. The effective-project resolution now runs there too, refused before the lease and the capacity slot so a policy refusal costs nothing and leaves no state to unwind. NOTE: agent access and balance are still not rechecked on resume; that gap predates this PR and is left alone. Per-card project derivation (ScheduleCard). Every card ran the projects hook and rebuilt the full option array, name map, and one icon element per project, to use a single name — O(schedules x projects) per render and per project-list refresh. The hook is split: `useChatProjectNames` (map only, for the panel, which resolves every card's name once and passes it down) and `useChatProjectPicker` (options and pagination, for the dialog's one combobox). The panel skips the query entirely until some schedule actually has a scope. Tests: four at the resume boundary (verified failing without the gate) and four in the dialog spec. The picker selection in one existing test now goes through the search field — the popover's VIRTUALIZED renderer sizes its window from a scroll height jsdom always reports as 0, so with three options it materialized only two. Full schedules e2e re-run green against the rebuilt client. * 🎯 fix: Settle Project-Policy Refusals and Keep Create Retries Idempotent Second Codex round, four P2s. Three were consequences of the resume gate added in the previous commit, which was half-built: it admitted where it should not and stranded the run where it refused. Project policy moves from `claimScheduleResume` into `isScheduleLive`'s `policy` branch. Both entry points consult that branch FIRST, and both already route its refusal through abort-and-settle — so a policy stop now settles the occurrence instead of answering a bare 409 while the job stays `requires_action`, the card keeps reading "Needs approval", and every retry repeats the same 409 until expiry. No change to resume.js: the existing branch does the work. The rule is deliberately NARROW. It refuses only where no valid destination is left — the requirement is on with nothing satisfying it, or the schedule's own project is gone (which also unset it on the conversation). It does NOT refuse because an operator's pin moved: the paused conversation cannot be rebound (`chatProjectId` is excluded from the resume context and the continuation reuses the same conversationId), so refusing would strand a pending approval over a destination it can never reach, for a pin that governs only where the NEXT run lands — which the fire path already redirects. Create retries are idempotent again. Project policy had been applied BEFORE the `clientRequestId` replay lookup, so a raised requirement, a deleted project, or a moved pin could answer 400 for a create that already committed — pushing the client to rotate its key and create a DUPLICATE schedule, the exact failure the key exists to prevent. Policy now applies only to a genuinely new insert, and the digest is computed from the CLIENT's payload rather than the resolved destination, so today's policy can no longer re-digest a genuine retry into a mismatch. An explicit `chatProjectId: null` under a pin is refused rather than silently resolved to the pin. The payload contract defines `null` as clearing the scope; answering 201 while filing under the pin reported success for the opposite of what was asked. Only an OMITTED field takes the pin silently. Tests: five on the policy branch (both refusals verified failing without it, plus guards that a moved pin and a live project still admit) and two on the handlers (the pinned explicit clear, and a committed create recovered by retry after the policy tightened — verified answering 400 without the reordering). * 🧭 fix: Converge the Stored Project on the Destination a Fire Resolved Third Codex round, four P2s. The root confusion behind the resume findings: an operator pin outranks the stored id at fire time, `fireSchedule` sends the pin in the trigger envelope, and the row keeps its old value. The row therefore LIED about where that occurrence's conversation went, and every later re-validation — the resume boundary above all — checked a project the conversation was never filed under. A schedule storing A, pinned to B, with B later deleted and A still live, was admitted for resume into a conversation that had just been unscoped. Fixed at the source rather than at each reader: a fire that resolves a destination different from the stored one writes it back, claim-token fenced like every other worker-side write and deliberately WITHOUT a configRevision bump — this is the server reconciling itself to policy, not an owner edit, and a bump would fence an in-flight occurrence off its own run. Written only AFTER the destination validates, so an unusable pin never lands in the row, and best-effort: the envelope already carries the right destination, so a failed write costs accuracy on a later recheck, never the run itself. The wire projection already reported the pin, so this also stops the row and the UI disagreeing. An explicit `chatProjectId: null` under a pin is now refused on the DISABLING edit path too. The pin check and the requirement are independent rules, and folding them together let `{enabled: false, chatProjectId: null}` skip the pin check entirely, unset the row, and answer with a wire projection still naming the pin. Only the requirement is waived for a disabling edit. The dialog no longer requires a project for an edit that leaves a schedule DISABLED. The server waives the requirement there precisely so a row auto-disabled for `project_required` can still be renamed or tidied up; requiring it in the form made that unreachable, and an owner with no projects could not edit the stopped schedule at all. FOLLOWUPS.md records the two residual gaps with their exact triggers: the sub-second deletion race inside the resume claim window (which needs the effective project persisted per OCCURRENCE plus a distinct policy conflict routed through abort-and-settle), and the fact that convergence happens only when a schedule fires. Tests: four on convergence (pin written, no write when unchanged, no write for a destination that failed validation, fire survives a failed write), two on the disabling-edit pin rules, two in the dialog. Schedules e2e re-run green. * 🔑 fix: Keep an Explicit Project Clear Out of an Omitted Field's Digest `computeCreateDigest` appended `chatProjectId` on `!= null`, so an OMITTED field and an explicit `null` produced the same digest. Because the replay lookup and `matchesCreateIntent` deliberately run before project policy, a request could reuse a pinned create's `clientRequestId` while explicitly sending `chatProjectId: null` and receive 201 describing the pinned row — success reported for the opposite of what it asked, and the pinned-clear refusal the normal create path applies never reached. Now `!== undefined`: an omitted field still digests byte-identically to a payload from before project scope existed, so a create in flight across the upgrade still matches its own row, while an explicit clear is a distinct intent and digests differently. A pre-scope client never sent the field at all, so nothing legacy can carry an explicit null. * 📍 fix: Validate a Paused Run Against the Project Its Own Occurrence Used The schedule-wide convergence from the previous commit was not enough, and the reason is the single-active run index: it covers `status: 'started'` only, so a PAUSED run does not block the next occurrence. While run 1 sat paused in project A, a pin move plus one later fire rewrote the schedule row to B — and the resume policy then validated B while run 1's conversation was still filed under A. Delete A and the continuation was admitted into a conversation that had just been unscoped. That window lasts as long as the pause, not the sub-second race the previous commit documented. The reservation now records the destination THIS occurrence used, and `isScheduleLive` validates that record when given the occurrence's `scheduledFor` — which `resume.js` already reads two lines above the call. No new conflict type and no settlement-path surgery: the refusal rides the abort-and-settle branch that check already has. An ABSENT record falls back to the schedule-level resolution rather than reading as unscoped. A pre-scope occurrence, or one whose row is gone, must never be treated as evidence to stop a run — the fallback keeps legacy paused runs behaving exactly as they do today. Schedule-wide convergence stays: it keeps the row honest for the UI and for every check that has no occurrence in hand. FOLLOWUPS.md now describes the one remaining gap accurately — a deletion inside the claim window, which needs a distinct policy conflict routed through abort-and-settle rather than the bare 409 an `inactive` conflict produces. Tests: three on occurrence-vs-row precedence (the decisive one verified failing without the lookup), two on what the reservation records, and the resume controller spec now pins `scheduledFor` in the policy call. Schedules e2e re-run green. * 🏷️ fix: Tell a Deliberately Unscoped Occurrence From an Unrecorded One The occurrence fallback added in the previous commit conflated two different absences. A post-upgrade run that deliberately went unscoped omitted the field exactly like a row written before the field existed, so both took the fallback — and a paused unscoped run was then validated against the schedule's CURRENT project. Under a requirement or a pin added while it sat paused, that admitted a billed continuation into a conversation satisfying no present policy. The reservation now ALWAYS records its decision, `null` for unscoped, and the read reports `recorded` from key PRESENCE rather than truthiness. Only an unknown record — a pre-scope row, or no row at all — falls back to the schedule-level resolution; a recorded null is the genuinely unscoped occurrence it says it is, and is refused once a project becomes required. The distinction rests entirely on a stored `null` surviving as a present key while a never-written field stays absent, so that is asserted against real Mongo rather than assumed: if it ever stopped holding, unscoped runs would silently start being validated against the schedule's current project again. Tests: two against mongodb-memory-server (recorded null vs never-written vs missing row), plus refusal of a recorded-unscoped occurrence under a new requirement and the preserved fallback for a pre-scope one. Schedules e2e green. * 🔁 fix: Validate an Initial Scheduled Start Against Its Own Occurrence The initial-start policy check in `request.js` called `isScheduleLive(..., { policy: true })` without `scheduledFor`, so it fell back to the schedule-level resolution even though the run row already carries the occurrence's recorded scope. An occurrence reserved unscoped, with a pin introduced while its loopback request sat queued, was therefore admitted against the new pin — producing a billed unscoped conversation under a requirement it does not satisfy, from an envelope already built without a project. `scheduledFor` was already in scope there. Passing it makes the initial start and the resume validate the same way: against the destination the occurrence itself recorded.	2026-08-21 11:09:04 -04:00
Danny Avila	a5cb041f47	🕊️ feat: Yield to Subagent Completion Wakeups (#15066) ... * 🕊️ feat: yield to subagent completion wakeups * ⚡ fix: bound wakeup status guidance	2026-08-21 01:45:42 -04:00
Danny Avila	d0f9d5625e	🧵 fix: Close Child-Thread Read and Search-Cleanup Gaps (#15055) ... * fix: close child thread read and cleanup gaps * fix: preserve child search cleanup invariants * test: complete mocked update result * perf: parallelize scoped message reads * fix: close child thread compatibility gaps * test: expect preserved cleanup failure * fix: reconcile legacy Meili cleanup markers	2026-08-21 00:44:37 -04:00