4586 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Danny Avila	77854decdf	🪣 fix: Cap Context Projection Workload Before Tokenization (#13910) ... * fix: bound context projection workload * fix: Address context projection CI failures * fix: Bound context projection database reads * fix: Sort projection spec imports * fix: Cap projection body reads with stats	2026-06-23 08:43:09 -04:00
Danny Avila	2f800c5b52	💰 fix: Bound MCP tools/list Pagination with Aggregate Budgets (#13909) ... * fix: bound MCP tools pagination budgets * fix: enforce MCP tools pagination budgets * fix: cancel MCP tools list timeouts * test: type MCP tools timeout mock	2026-06-23 08:34:09 -04:00
Danny Avila	d9251fc3b6	✂️ fix: Cap Audit Chain Verification and Honor Client Cancellation (#13903)	2026-06-23 08:33:16 -04:00
Danny Avila	ddc763595a	🍪 fix: Validate Shared-File Cookie Auth Against the Live Refresh Session (#13908) ... * fix: validate shared file cookie sessions * fix: run shared file session lookup as system	2026-06-23 08:32:28 -04:00
Danny Avila	725a14e409	🪜 fix: Strip Caller-Supplied Priority from Assign-Only Config Upserts (#13911) ... * fix: prevent assign-only config priority changes * fix: preserve assign-only config priority atomically * style: format config priority guard * fix: type preserve priority upsert option	2026-06-23 08:31:26 -04:00
Danny Avila	edc0aebdb9	🛂 fix: Re-Check execute_code Authorization on Event-Driven Tool Loads (#13912)	2026-06-23 08:30:39 -04:00
Danny Avila	e807c63d5d	🔐 fix: Gate Shared Startup Config By Link Access (#13897) ... * fix: gate shared startup config by link access * fix: satisfy shared config CI checks * fix: align shared config client types * fix: reject expired shared link access	2026-06-23 08:28:37 -04:00
Marco Beretta	ebb4f15dbe	⌨️ feat: Keyboard Shortcuts (#12425) ... * feat: add useKeyboardShortcuts hook and showShortcutsDialog atom Implements the core keyboard shortcuts hook with 11 shortcuts: - General: new chat, focus input, copy last response - Navigation: toggle sidebar, model selector, search, settings - Chat: stop generating, scroll to bottom, temporary chat, copy code Also adds the showShortcutsDialog atom to control dialog visibility. Closes #3664 * feat: add KeyboardShortcutsDialog component Renders a modal dialog listing all available keyboard shortcuts grouped by category (General, Navigation, Chat). Features: - Platform-aware key labels (⌘ on Mac, Ctrl on others) - Clean kbd-style key badges with subtle shadows - Grouped sections with separators - Sticky footer with shortcut to open the dialog itself - Single close button, Escape to dismiss * feat: integrate keyboard shortcuts into Root layout and account menu - Mount useKeyboardShortcuts and KeyboardShortcutsDialog in Root.tsx via a KeyboardShortcutsProvider wrapper (only renders post-auth) - Add 'Keyboard Shortcuts' menu item with Keyboard icon to the account settings popover for discoverability * chore: add data-testid to model selector button Adds data-testid="model-selector-button" to the model selector trigger for reliable DOM targeting by keyboard shortcuts and tests. * i18n: add keyboard shortcuts localization keys Adds 12 new com_shortcut_* translation keys for the keyboard shortcuts feature: group labels, action labels, and dialog title. * style: fix keyboard shortcuts dialog dark mode Replace token-based dark mode styling with explicit white-alpha values for kbd badges, borders, and separators: - Kbd: dark:bg-white/[0.06] dark:border-white/[0.08] dark:shadow-none - Separators: dark:border-white/[0.06] - Dialog border: dark:border-white/[0.06] dark:shadow-2xl Ensures the key badges blend naturally into the dark surface instead of appearing as harsh bright rectangles. * feat(shortcuts): add definitions for 8 new keyboard shortcuts Add shortcut definitions and localization keys for: - Upload file (Cmd/Ctrl+Shift+U) - Toggle right sidebar (Cmd/Ctrl+Shift+R) - Regenerate response (Cmd/Ctrl+Shift+E) - Edit last message (Cmd/Ctrl+Shift+I) - Scroll to top (Cmd/Ctrl+Shift+↑) - Archive conversation (Cmd/Ctrl+Shift+A) - Delete conversation (Cmd/Ctrl+Shift+Backspace) Addresses #3664 * feat(shortcuts): implement handlers for all new shortcuts New handlers: - Upload file: triggers attach-file button click - Toggle right sidebar: clicks parameters-button - Regenerate response: clicks regenerate-generation-button - Edit last message: finds last user-turn and clicks edit button - Scroll to top: scrolls main[role=main] to top - Archive conversation: calls archive mutation + navigates to new chat - Delete conversation: calls delete mutation + navigates to new chat Improvements: - Use getMainScrollContainer() helper targeting main[role=main] instead of fragile class-based selectors - Use data-testid selectors instead of aria-label substring matching for stop-generation and model-selector buttons - Use id-based selectors (button[id^=edit-]) for edit buttons - Add isEditing guard to skip shortcuts when user is typing in inputs, textareas, or contentEditable elements - Refactor handler from if/return chain to switch statement for cleaner flow control * fix(shortcuts): increase dialog scroll height for expanded shortcut list With 20 shortcuts across 3 groups, the previous 480px max was tight. Increase to 560px / 70vh so all shortcuts are visible without excessive scrolling. * refactor(shortcuts): use data-testid selectors for reliable targeting Add data-testid="nav-settings" to the Settings menu item in AccountSettings so the open-settings shortcut no longer relies on fragile text-content matching ('Settings' but not 'Keyboard'). * refactor(shortcuts): two-column layout for shortcuts dialog Split the shortcuts dialog into a two-column grid layout: - Left column: General + Navigation groups - Right column: Chat group (which has the most shortcuts) Reduces vertical height so the full list is visible without scrolling. Widen dialog to max-w-4xl (w-11/12) to accommodate both columns. Simplify Kbd/group styling for cleaner visual density. * refactor(shortcuts): adjust padding in KeyboardShortcutsDialog content * feat(shortcuts): customizable keyboard shortcuts with recorder UI Add per-shortcut overrides stored in localStorage, a recorder component for capturing new key combos with conflict detection, and a per-row edit/reset affordance in the shortcuts dialog. * test(shortcuts): fix specs broken by keyboard shortcut hooks - ExpandedPanel: add customShortcuts atom to the store mock so useShortcutDisplay/useShortcutAriaKey can read state - AttachFileMenu: update queries to the new 'Attach Files' aria-label - Button (Generations): wrap renders in RecoilRoot now that the component reads shortcut state * feat(shortcuts): add panel/submit/bookmark/continue/read-aloud shortcuts - Wire stop, regenerate, continue, and read-aloud handlers to existing buttons via data-testid, fixing handlers that previously queried selectors with no matching DOM nodes. - Add data-testid='nav-panel-${id}' to expanded sidebar nav buttons so the panel-opener shortcuts can target them. - Add new shortcut definitions and handlers: submitMessage, bookmarkConversation, continueResponse, readAloudLastResponse, and the open* panel openers (assistants, agents, prompts, memories, parameters, files, bookmarks, MCP). - Drop the toggleRightSidebar shortcut — there is no right sidebar to toggle in this codebase. - Refresh the KeyboardShortcutsDialog layout and ShortcutRecorder for the new groups, tighten ShortcutKeyCombo styling, and surface the shortcuts hint chips in the account menu. * chore(shortcuts): remove unused translation keys Drop com_shortcut_dialog_subtitle, com_shortcut_not_set, and com_shortcut_reset_aria — no remaining references in the codebase. * fix(shortcuts): resolve keyboard shortcut and footer regressions - Guard the temporary-chat toggle so the shortcut mirrors the UI, only toggling when the conversation has no messages and is not submitting. - Stop Ctrl/Cmd+Enter from double-submitting: the main chat textarea already submits via its own handler, and submit is blocked from unrelated inputs while still working in the chat box. - Ignore repeated keydown events (e.repeat) so held keys no longer re-run toggles or destructive actions. - Scope archive/delete shortcuts to the conversation in the active route using useMatch, preventing mutations of a stale background conversation on non-chat routes. - Keep the recorder conflict controls clickable by including the whole editing row in the outside-click containment check. - Restore privacy policy and terms of service links on public share pages via an opt-in Footer prop. - Expand the sidebar before activating panel shortcuts so they are visible on mobile, and avoid toggling an already-active panel. * fix(shortcuts): reject bare non-printable shortcut bindings A recorded non-printable key (Tab, Enter, Backspace, Delete, arrows, Space) with no Cmd/Ctrl/Alt was treated as valid, so it could be saved and then hijack navigation or fire destructive actions since the global handler preventDefaults it outside text inputs. Require Shift at minimum for these keys, which keeps Shift+Escape (focusChat) valid while rejecting bare single-key bindings. * style: fix import order drift across keyboard shortcut files * fix(shortcuts): guard actions behind dialog and resolve reset conflicts - Ignore global shortcut actions while the shortcuts dialog is open (except the toggle that closes it), so a combo like delete/archive can no longer fire on the conversation behind the modal. - When resetting a shortcut to its default, unbind any other action whose custom binding collides with that restored default, so Reset after a Replace can't leave two rows sharing one binding with one action unreachable. * fix(shortcuts): keep attach menu button accessible name stable The shortcut pass changed the attach menu button's aria-label from the hardcoded "Attach File Options" to localize('com_sidepanel_attach_files') ("Attach Files"), which changed its accessible name and broke the provider-file e2e specs that locate it by name. Restore the original label and keep only the added aria-keyshortcuts. * fix(shortcuts): gate temporary chat toggle to chat routes The Root-level listener runs on non-chat routes (search, settings, panels) where the last loaded conversation may be empty, so Ctrl/Cmd+Shift+T could flip the hidden isTemporary state without the TemporaryChat control being visible. Require an active chat route (routeConvoId) before toggling. * test(shortcuts): align attach menu spec with button accessible name The attach menu button's aria-label was restored to "Attach File Options" (matching dev and the provider-file e2e specs), so update the unit test's button queries from /attach files/i to /attach file options/i. All 26 cases pass. * fix(shortcuts): target conversation bookmark and reveal search panel - Bookmark: query the unique #bookmark-menu-button so the shortcut bookmarks the current conversation. The previous querySelector('[data-testid="bookmark-menu"]') matched the sidebar tag-filter button first (same testid, earlier in the DOM), toggling the filter instead of bookmarking. - Focus search: activate the conversations panel before focusing, since the search input only mounts there and the sidebar renders just the active panel. Route through the nav-panel-conversations button (the listener is outside ActivePanelProvider) and settle before focusing, so Ctrl/Cmd+/ works from any panel. * fix(shortcuts): preserve footer links, cross-platform bindings, modal guard - restore unconditional legal footer links (drop showLegalLinks gate) - keep untouched platform's default when customizing a binding - round-trip bindings whose key is the plus character - suppress global shortcuts while any modal dialog is open - tag read-aloud test id only on assistant turns * fix(shortcuts): include non-Radix dialogs in the modal guard The guard only matched Radix dialogs via data-state="open", missing Headless UI dialogs (e.g. the redesigned Settings modal) that render role="dialog" without data-state. Iterate all dialog/alertdialog nodes and treat one as open unless it is inert or data-state="closed", which also avoids false positives from always-mounted inert panels. * fix(shortcuts): gate temporary chat toggle behind TEMPORARY_CHAT permission * fix(shortcuts): only prevent native key event when shortcut action runs * fix(shortcuts): rebind temporary chat, open settings without toggling menu, release no-op keys * fix(shortcuts): confirm conversation delete, use clipboard fallback, add tests * fix(shortcuts): navigate to new chat after keyboard-confirmed delete * fix(shortcuts): copy last response via message button, guard unavailable controls * fix(shortcuts): keep custom Enter-based submit bindings working in the composer * fix(shortcuts): restrict shift-only bindings to safe keys * fix(shortcuts): submit custom Enter chords in the composer without inserting a newline * fix(shortcuts): block global shortcuts while a menu overlay is focused * fix(shortcuts): rebind archive off the browser-reserved Ctrl+Shift+A * fix(shortcuts): honor submitMessage overrides in the composer	2026-06-22 17:02:46 -04:00
Danny Avila	77983dbd42	🐳 feat: Bundle Admin Panel in Docker Compose Stacks (#13876) ... * 🐳 feat: Bundle ClickHouse Admin Panel in Docker Compose Stacks * chore: route admin-panel image through Scarf gateway * chore: route admin-panel image through Scarf gateway (deploy-compose) * 📝 docs: Add Admin Panel to README Features * 🏷️ chore: Rename Admin Panel Container to admin-panel * 🔐 fix: Fall Back Admin Panel SESSION_SECRET to CREDS_KEY * 📝 docs: Reference Open-Source code-interpreter Repo in README	2026-06-22 16:59:08 -04:00
Danny Avila	30f9759380	🌍 i18n: Update translation.json with latest translations (#13892)	2026-06-22 10:23:54 -04:00
Danny Avila	3945533a4e	🏷️ chore: Bump Individual Package Versions (#13891)	2026-06-22 09:54:19 -04:00
Danny Avila	919c79806d	🌍 i18n: Update translation.json with latest translations (#13875)	2026-06-22 09:53:57 -04:00
Danny Avila	465cb6e394	👐 a11y: Bump @ariakit/react, Improve a11y of Token Usage, Archived Chats, Reduce Table Layout Shifts (#13874) ... * chore: Update `@ariakit/react` and `@ariakit/react-core` dependencies to v0.4.29 and v0.4.26 respectively, and add new `@ariakit/components`, `@ariakit/react-components`, `@ariakit/react-store`, and `@ariakit/react-utils` packages to package-lock.json and package.json files. * fix: restore keyboard navigation for Tools dropdown submenus Compose the Artifacts and MCP submenu triggers as a `MenuButton` that receives the parent `MenuItem`'s props/ref directly, instead of nesting a `MenuItem` inside the submenu's own provider and placing the ref on a wrapper div. This registers the focusable trigger with the parent menu store so arrow-key navigation reaches the items, which fully broke under Ariakit 0.4.29. * fix: Improve keyboard navigation for TokenUsageIndicator popover Refactor the TokenUsageIndicator component to enhance keyboard accessibility. The popover now maintains focus on the gauge trigger, ensuring that the Escape key closes the popover without shifting focus to the non-interactive panel. Additionally, the autoFocusOnShow property is set to false to prevent unwanted focus behavior when the popover is displayed. * fix: Stabilize focus and layout shift in Archived Chats dialog Anchor dialog focus to the content element so rapid tabbing during the virtualized table's loading state no longer escapes to the page's top focus guard, and stabilize the columns memo to keep the focus trap intact. Reserve a fixed height and stable scrollbar gutter, and drop the redundant nested scroll wrapper in the shared DataTable to eliminate load-time layout shift. * fix: Add stable scrollbar gutter to SharedLinks DataTable Enhance the layout stability of the SharedLinks component by adding a "scrollbar-gutter-stable" class to the DataTable. This change aims to prevent layout shifts during loading, improving the overall user experience. * fix: Enhance keyboard accessibility and focus management in TokenUsageIndicator Refactor the TokenUsageIndicator component to improve keyboard navigation and focus behavior. Introduced a useRef hook for the disclosure button to ensure focus remains on the gauge trigger when the popover is opened. Updated the popover's finalFocus property to return focus to the trigger on close, enhancing the overall user experience for keyboard users.	2026-06-21 12:53:24 -04:00
Danny Avila	1505fd5262	📦 chore: Bump @librechat/agents to v3.2.44	2026-06-21 08:39:10 -04:00
Danny Avila	5eb1c2c107	🖇️ feat: Reference Selected Chat Text with Multi-Quote Popup (#13868) ... * 🖇️ feat: Reference Selected Chat Text with Multi-Quote Popup Add a ChatGPT/Codex-style quote feature: selecting text in any message shows an 'Add to chat' popup that accumulates removable quote chips above the composer. On submit, the excerpts are merged into the user message text as Markdown blockquotes (counted in the user message token count, not a system message) and persisted on the message so they render on the user bubble and survive reload. - packages/api: add getReferencedQuotes + mergeQuotedText helpers (blockquote merge, length/count caps) with unit tests - BaseClient.sendMessage: temporarily merge req.body.quotes into userMessage.text before buildMessages, restore clean text, persist quotes array - data-schemas + data-provider: add optional quotes field to message schema/type - client: pendingQuotesByConvoId atom, QuoteButton selection popup, PendingQuoteChips composer row, MessageQuotes persistent display - useChatFunctions: drain pending quotes onto the message, carry forward on regenerate - add localization keys and component/integration tests * 🧪 test: Add Playwright e2e for chat quote feature Add e2e/specs/mock/quotes.spec.ts covering select -> 'Add to chat' popup -> chip -> send -> persistent reference block -> reload, plus multi-select accumulation and chip removal. Selection is driven programmatically (real DOM Range + dispatched mouseup) to summon the popup deterministically. Add data-testid hooks (add-to-chat-button, pending-quote-chips, message-quotes) to the quote components for stable selectors. * 🛡️ fix: Address Codex review on quote feature - Run PII filter + OpenAI moderation over req.body.quotes (P1): quoted excerpts are merged into the model-facing user message, so they must clear the same filters; a crafted quotes payload could otherwise bypass them. Adds tests. - Carry quotes through edit/save-and-submit replays (overrideQuotes in EditMessage), mirroring overrideManualSkills, so edited turns keep context. - Hide the quote UI for Assistants endpoints (which bypass BaseClient merge), so users can't queue quotes the assistant never receives. - Clear pending quote/skill queues by resolved conversationId in useClearStates, not the UI index, so queued-but-unsent selections don't linger in Recoil. - Cap queued quotes client-side at 10 to match the backend QUOTE_MAX_COUNT, so the composer never shows more quotes than are actually sent. * 🧵 fix: Durably re-merge quotes + Codex round 2 Address Codex's re-review of the quote feature: - Durable history re-merge (per maintainer decision): quotes are no longer merged at request time and stripped; instead each user message's persisted message.quotes is merged into its formatted content in AgentClient.buildMessages (new prependQuotes helper) for current AND historical turns. The model receives the referenced context on every prompt and the token count stays consistent with what was persisted; stored text stays clean for display. - Attach normalized quotes to the user message in handleStartMethods (before getReqData/onStart) so the optimistic bubble, resumable abort metadata, and saved row all carry them (fixes the abort-metadata gap). - Skip the quote drain entirely for Assistants endpoints in useChatFunctions, leaving the pending atom intact (UI is already hidden there). - Normalize req.body.quotes via getReferencedQuotes before moderation/PII so only the trimmed/truncated/capped excerpts the model will receive are checked. - Tests: prependQuotes unit tests; BaseClient quote tests assert early attachment + clean text; e2e now verifies the model receives the merged blockquote on the current turn and re-merged from history on a later turn (new E2E_ASSERT_QUOTE mock marker). * 🔗 fix: Quote share/memo/abort/PII gaps (Codex round 3) - Shared links: include quotes in the anonymized projection + SharedMessage type (+test) so the /share view renders the same reference blocks as the owner, mirroring manualSkills/alwaysAppliedSkills. - MessageRender memo: compare quotes length so a server/resume copy whose only change is the quote list re-renders (the block no longer goes stale/missing). - Resumable job metadata: include quotes in the userMessage written to GenerationJobManager so a reload/reconnect mid-stream reconstructs the chips. - PII + moderation: also scan the merged blockquote+text exactly as the model receives it, so a secret split across a quote and the typed body (each clean alone) is caught (+cross-boundary test). - e2e: make quote-add robust against the auto-scroll-dismisses-selection race via a retried select+click helper. * 🛑 fix: Keep quotes on aborted turn's request message (Codex round 4) abortMiddleware reconstructs finalEvent.requestMessage from jobData.userMessage but only copied ids + text; include quotes so a stopped quoted turn keeps its MessageQuotes in the UI and a regenerate-before-reload still sends the referenced context. Completes the resumable-metadata fix from the prior round. * 🧮 fix: Quote recount + preliminary abort metadata (Codex round 5) - Force a canonical token recount for messages carrying quotes in AgentClient.buildMessages, so a plain text-only Save edit (which recomputes tokenCount from text alone) can't leave a stale, quote-excluding count that undercounts context on later turns — recount from the quote-merged copy self-heals it. - Seed normalized quotes into the preliminary userMessage metadata (getPreliminaryUserMessage), so an abort during init/tool-loading (before onStart) still reconstructs the stopped turn's MessageQuotes. * ✅ fix: Add getReferencedQuotes to controller test mocks (CI) request.js's getPreliminaryUserMessage now calls getReferencedQuotes; the agents controller specs mock @librechat/api wholesale, so the mock must export it or the call throws and cascades. Added a faithful mock (normalize/cap, null when empty) to request.resumeMetadata.spec.js and jobReplacement.spec.js. * 📐 fix: Quotes in context projection + resumable metadata (Codex round 6) - Context-usage projection (resolveContextProjection): select message.quotes, prepend them into the projected user text, and recount quoted messages so the context gauge counts the same prompt the model receives (a text-only Save edit no longer makes the gauge undercount / over-report remaining budget). - Resumable job metadata: trackUserMessage (created-event rewrite) and abortJob (final requestMessage) now carry quotes; SerializableJobData.userMessage and CreatedEvent.message gained an optional quotes field. With the cross-replica created-event spread, stopping/reconnecting a quoted turn after the created event keeps its MessageQuotes. * 💬 feat: Collapse multi-select quotes into one chip with hover popup Composer feedback: the quote chip area now shows a single chip — the excerpt text for one selection, or a collapsed "{n} selections" pill for multiple, with a hover popup (HoverCard) listing every excerpt and a per-item remove. The chip is taller (py-1.5/text-sm) to read less skinny. Adds com_ui_quote_selections and com_ui_remove_all_quotes; updates unit + e2e tests (e2e drives the count via a data-quote-count hook and exercises the hover popup). * ♿ fix: Make multi-selection quote popup keyboard accessible The collapsed "{n} selections" pill used a HoverCard, which Radix only opens on pointer hover — its interactive content was unreachable by keyboard. Replaced it with a Popover: the trigger is a real button that opens on click / Enter / Space (focus moves into the list, each excerpt's × is tab-navigable, Escape closes and restores focus), with hover-open preserved for mouse via controlled open state + a close grace period. Hover-initiated opens skip auto-focus so they don't pull focus off the composer. Adds an e2e asserting keyboard open/close. * 📐 fix: Clamp the Add-to-chat button within the viewport (Codex round 7) The floating selection button positioned via translate(-50%,-100%) (bottom-center anchor) but clamped top/left as if they were its top-left, so a selection near the viewport top or sides could render the button partly/fully offscreen. Now it measures the button (ref + useLayoutEffect) and computes an on-screen top-left — clamping by the full width within side margins and flipping below the selection when there's no room above — with no transform, and stays hidden until measured so it never flashes at an unclamped spot. * ↩️ fix: Restore pending quotes on early-abort draft (Codex round 8) When a turn is stopped before the created event (e.g. during tool/MCP init), the final handler restores requestMessage.text to the draft, but the pending-quote atom was already drained on submit — so a retry sent no quotes. The abort requestMessage now carries quotes (preliminary metadata + abort fixes), so the three early-abort/no-response draft-restore paths in useEventHandlers now also re-queue pendingQuotesByConvoId from requestMessage.quotes. * ♿ fix: Use Ariakit Popover for quote selections (keyboard focus) The multi-selection popup used a hand-rolled Radix Popover with Popover.Anchor + a manual button, so Radix had no trigger to return focus to — Escape dumped focus to the page top. Refactored to Ariakit (the codebase's popover primitive, per DropdownPopup/Fork): the `PopoverDisclosure` is the real trigger, so Escape closes and returns focus to the composer instead of the top of the page. Keyboard opens (Enter/Space) autofocus into the list and tab through each excerpt's remove; hover opens for mouse with autofocus suppressed so it never pulls focus off the composer. e2e asserts the keyboard open/navigate/Escape flow keeps focus on a real control (never BODY).	2026-06-21 08:33:11 -04:00
Danny Avila	e515063ffe	🔗 feat: Snapshot Files for Shared-Link Attachments (#13740) ... * 🔗 feat: Snapshot Files for Shared-Link Attachments Shared-link viewers could read a shared conversation snapshot but not its attachments: file preview/download still went through the owner-scoped file ACL (the /api/files router sits behind requireJwtAuth + owner/agent checks), so anonymous viewers got 401s and authenticated non-owners got 403s — the repeated `[fileAccess] denied` warnings seen for the preview poller. Capture an immutable per-share file snapshot (embedded on the SharedLink document, referencing the original stored object — no byte copy) at share create/update, and serve those files through new share-scoped routes authorized by the existing shared-link view permission (public/ACL) plus snapshot membership, never the owner's live file ACL. - data-schemas: fileSnapshots on the share doc; capture in create/update; read-time rewrite of filepath/preview to /api/share/:id/files/:fileId; getSharedLinkFile + lazy backfillSharedLinkFiles for legacy links - api: GET /api/share/:shareId/files/:file_id[/download|/preview]; route context added to fileAccess denial logs - packages/api: isFileSnapshotEnabled resolver (env + yaml) - data-provider: interface.sharedLinks.snapshotFiles (default on) + client endpoints/services - client: ShareContext.shareId wired to Image, preview hook, and downloads - config: SHARED_LINKS_SNAPSHOT_FILES env override (default on) * 🔒 fix: Address Codex review on shared-link file snapshots Triage of the Codex review on PR #13740 (2 P1, 7 P2 — all valid): - P1 (cross-user access): scope the snapshot lookup to the sharing user's own files so a message referencing another user's file_id can't widen access. - P1 (stored XSS): the inline share-file route now serves only safe preview types inline (raster images/pdf); everything else is forced to attachment with X-Content-Type-Options: nosniff. - Stream shared downloads by default; redirect to a signed URL only on ?direct=true (blob/XHR callers work without bucket CORS). - Read preview status live from the file record (always current for deferred previews) and stop embedding extracted text in the share doc (16MB-limit risk). - Only lazily backfill when the fileSnapshots field is absent (legacy), not on every snapshot miss. - Backfill legacy shares before rewriting message URLs, and gate URL rewriting to public shares so non-public (ACL) shares keep prior behavior (img/anchor can't carry the bearer token). - Frontend: only route a download through the share path when the file was actually snapshotted (rewritten href / filepath), else fall back. * 🔑 feat: Authorize shared-link files for non-public shares via cookie Extends shared-link file access to non-public (ACL) shares (Codex finding 5). `<img>`/anchor requests can't carry the bearer access token, so non-public shares previously 401'd on file loads. Add an optional cookie-auth fallback on the share file routes that resolves the viewer from the `refreshToken` cookie (or signed `openid_user_id` cookie) — the same mechanism secure image links use (validateImageRequest) — then let canAccessSharedLink run the viewer's ACL check. - new middleware optionalShareFileAuth (+ unit spec); applied to the three share file routes after optionalJwtAuth - URL rewriting in getSharedMessages is no longer gated to public shares (the route now authorizes header-less requests), so files work uniformly across public and non-public shares; revert the now-unused req.sharePublic plumbing * 🔒 fix: Second Codex pass on shared-link file snapshots Addresses the follow-up Codex findings on PR #13740: - Don't snapshot transient text-source files: FileSources.text filepaths are Multer temp paths the upload route deletes, so they can't be streamed — removed from the streamable allowlist. - Unset stale snapshots on a disabled-feature update: updateSharedLink now $unsets fileSnapshots when snapshotFiles is false, so an opted-out update can't keep serving file ids the update dropped. - Load tenant config after share resolution: configMiddleware now runs after canAccessSharedLink (which enters the share's tenant ALS context), so per-tenant interface.sharedLinks.snapshotFiles overrides apply to anonymous public views. - Return a clean 404 when the snapshotted object is gone: resolveShareFile now requires the live file record and 404s if it's been deleted/expired, instead of letting the stream error after headers are sent (ENOENT / 500). (The re-flagged P1 about private-viewer rewriting was already fixed in the prior commit's cookie-auth change.) * 🔒 fix: Third Codex pass on shared-link file snapshots Addresses the third Codex review pass on PR #13740: - P1: keep shared previews/files pinned to the snapshotted version. Snapshot the small previewRevision; resolveShareFile 404s when the live file's revision no longer matches (file_id reused/overwritten by a later turn), so old links can't surface post-share content — covers both preview text and streamed bytes. - Honor the toggle as a kill switch: resolveShareFile 404s when snapshotFiles is disabled, instead of only skipping backfill, so disabling stops serving already-snapshotted file URLs. - Lazy-sweep orphaned 'pending' previews to 'failed' in the share preview route (mirrors the owner route) so the client poller reaches a terminal state. - Resolve the cookie-fallback user in runAsSystem so strict tenant isolation doesn't throw before canAccessSharedLink establishes the share tenant context. * ✨ feat: Per-link "share files" checkbox for shared links Add a checkbox to the share-link dialog (checked by default) letting the user choose whether to include the conversation's files in the shared link, with copy explaining images/files won't be visible to viewers otherwise. Opting out skips snapshot creation/serving for that link. - client: ShareButton renders the checkbox gated on the new startupConfig.sharedLinksSnapshotFilesEnabled flag; state threads through SharedLinkButton into the create/update mutations as `snapshotFiles`. - data-provider: createSharedLink/updateSharedLink send `snapshotFiles` in the body; TStartupConfig gains `sharedLinksSnapshotFilesEnabled`. - api: POST/PATCH /api/share compute snapshotFiles as isFileSnapshotEnabled(req.config) && body.snapshotFiles !== false (admin gate AND per-link opt-out); config.js exposes the effective enabled flag to clients. - en locale: com_ui_share_files (+ _description). * 🐛 fix: Make the "share files" opt-out actually hide files Unchecking "share files" at creation didn't hide anything: the shared message JSON still carried each file's original (e.g. static-served) path, and because opting out only meant "no fileSnapshots field" — indistinguishable from a legacy link — getSharedMessages would backfill snapshots on first view whenever the admin feature was on, re-enabling files entirely. Fix by persisting and honoring the per-link choice: - Store `snapshotFiles` (boolean) on the SharedLink so opt-out is distinct from a legacy link; set it on create and update. - getSharedMessages computes includeFiles = adminEnabled && link not opted out; when excluded it strips files/attachments from the payload (no original-path leak) and never backfills the opted-out link. - Surface the stored choice via getSharedLink so the dialog checkbox reflects an existing link's actual setting instead of always defaulting to checked. Note: changing the checkbox on an already-created link still applies only when the link is refreshed (which regenerates the URL) — a UX follow-up. * 🔒 fix: Close remaining shared-link file opt-out leaks (Codex) Follow-up to the per-link opt-out, addressing the third Codex pass: - Honor the opt-out on the file route too: getSharedLinkFile now returns the link's `optedOut` choice; resolveShareFile 404s (and never backfills) an opted-out link, so a direct /files/:id request can't re-create snapshots. - Make read/serve viewer-independent: the gate no longer uses the viewer's resolved config (isFileSnapshotEnabled(req.config)) — it uses the link's stored choice plus a global env-only kill switch (isFileSnapshotKillSwitchActive). A viewer's own interface.sharedLinks.snapshotFiles can no longer hide a link's files. Create/update still use the creator's config to set the per-link choice. - Neutralize render URLs for non-snapshotted files: applyShareFileRoute now strips filepath/preview for any file/attachment not in the snapshot, so the owner's original (e.g. static) path can't be loaded through the share. * 🔒 fix: Harden shared-file version pinning and local path handling (Codex) - Refuse reused/overwritten file snapshots more broadly: resolveShareFile now refuses to serve when either previewRevision OR `bytes` changed vs the snapshot. `bytes` catches non-office reused outputs (e.g. code-exec same-filename images that lack previewRevision) and is stable across S3 URL refresh and the pending->ready transition. Same-size content swaps remain a best-effort gap inherent to the no-byte-copy design. - Strip cache-busting query strings before local streaming: code-output images add `?v=...` to filepath; the share route now splits it off so getLocalFileStream resolves the real filename instead of a literal `*.png?v=...` path. * 💬 fix: Clarify that file-sharing changes apply on link refresh For an already-created shared link, changing the "share files" checkbox only takes effect when the link is refreshed (which regenerates the snapshot). Add a note under the checkbox, shown only when a link already exists, so the behavior isn't surprising: "Refresh the link to apply this change — files are snapshotted when the link is refreshed."	2026-06-20 23:05:13 -04:00
Pascal Garber	ef65f4a015	🪙 chore: drop redundant voxtral-small token pricing key (#13867) ... `voxtral` already matches the versioned id `voxtral-small-24b-2507` via the longest-substring lookup, and both keys carry the same rate, so the separate `voxtral-small` entry is redundant. Follow-up to #13863 per review note.	2026-06-20 17:24:21 -04:00
Danny Avila	c9180d1ad6	🎯 fix: Narrow Public Share 401 Bypass to the Share Endpoint Only (#12905)	2026-06-20 13:57:21 -04:00
Danny Avila	f76a5faa9e	📌 feat: Seed Default Pinned Tools and MCP Dropdown via Interface Config (#13865) ... * ✨ feat: Add `defaultPinnedTools` interface config for default tool & MCP pinning Adds an `interface.defaultPinnedTools` string array letting admins pin tools and the MCP servers dropdown to the prompt bar by default for all users. - Tool keys (artifacts, execute_code, web_search, file_search, skills) pin their badge via `useToolToggle`. - The keyword `'mcp'` or a configured MCP server name pins the MCP dropdown via `useMCPSelect`. - Only seeds initial state; a user's stored pin preference always wins. When unset, tools start unpinned and the MCP dropdown keeps its legacy default (pinned). Unifies the approaches from #11646 (pinnedTools) and #9251 (defaultPinMcp) into one config key. * 🐛 fix: Apply defaultPinnedTools pin once startupConfig resolves On a cold load, useToolToggle can mount before useGetStartupConfig() resolves, so defaultPinned starts false and useLocalStorageAlt eagerly persists it; its init effect never re-runs for the later config-driven default. Fresh users would then miss the admin-configured default pin whenever startup config was not already cached. Capture whether a pin preference existed before mount (pre-seed) and, once startupConfig arrives, apply the real default for users with no prior preference. Runs once and never overrides an existing stored pin, so the conservative behavior for existing users is preserved. * 🐛 fix: Preserve pin clicks made before startupConfig resolves The cold-load default-seeding effect captured the stored-pin state only at mount, so a pin toggled before startupConfig resolved was treated as no-preference and overwritten when the admin default applied. Track explicit pin toggles via a ref (set through the returned setter) and skip the default application when the user has interacted in-session — in addition to the existing stored-preference guard.	2026-06-20 13:40:10 -04:00
Serhii Zghama	8824e8f918	🚪 fix: Gate Artifacts Toggle on Agent Capability Flag (#13665) ... * fix: hide artifacts toggle when capability is disabled The artifacts badge ignored the agent capabilities config, so a pinned toggle stayed visible after the artifacts capability was turned off. Gate the component on artifactsEnabled via useAgentCapabilities, matching how Skills, FileSearch and CodeInterpreter already handle their capability. * style: fix import order in Artifacts.tsx * style: Sort mutation type imports --------- Co-authored-by: Danny Avila <danny@librechat.ai>	2026-06-20 11:52:36 -04:00
Pascal Garber	dfc1178031	🪙 feat: Add Token Pricing for Devstral, Voxtral, Holo2, and Mistral Medium (#13863) ... These open-weight models are not in tokenValues, so they fall back to defaultRate ($6/1M) for balance/transaction accounting on custom OpenAI-compatible endpoints (e.g. Scaleway, where they are served). Add representative per-1M-token USD rates: - devstral 0.4 / 2.0 (Mistral API pricing) - mistral-medium 1.5 / 7.5 (Mistral API pricing, Medium 3.5) - voxtral(-small) 0.1 / 0.4 (Mistral API pricing, text) - holo2 0.3 / 0.7 (Scaleway Generative APIs public pricing) Generic keys are used so versioned ids (e.g. devstral-2-123b-instruct-2512, mistral-medium-3.5-128b, voxtral-small-24b-2507, holo2-30b-a3b) match via the existing longest-substring lookup.	2026-06-20 11:34:09 -04:00
Tómas Pálsson	229c54c843	🪢 fix: Paginate MCP tools/list to Load All Tools (#13840) ... * 🪢 fix: Paginate MCP tools/list to load all tools MCP `tools/list` is cursor-paginated, but LibreChat only ever read the first page. `MCPConnection.fetchTools()` called `client.listTools()` once and discarded `nextCursor`, and `MCPServerInspector` — which builds the agent-facing tool registry at startup and per request — called the raw `client.listTools()` directly. Servers that paginate (e.g. an aggregating gateway exposing hundreds of tools) only ever exposed page one; tools on later pages were never registered, and invoking one returned "This tool's MCP server is temporarily unavailable." - `MCPConnection.fetchTools()` now follows `nextCursor` across pages and concatenates every page's tools, bounded by a configurable page cap (`MCP_TOOLS_LIST_MAX_PAGES`, default 50) and a repeated-cursor guard so a misbehaving server cannot loop forever. Tools already fetched are returned if a later page fails, and the no-throw error contract is unchanged. - `MCPServerInspector.getToolFunctions()` and `fetchServerCapabilities()` now route through `fetchTools()`, so the canonical startup and per-request tool registry is fully paginated too. * style: Sort MCP test imports * style: Sort mutation type imports --------- Co-authored-by: Danny Avila <danny@librechat.ai>	2026-06-20 11:04:06 -04:00
Danny Avila	ff81377573	🚦 ci: Stop Auto-Indexing PR Branches in GitNexus Index (#13866)	2026-06-20 11:03:21 -04:00
Danny Avila	9dd0df9d61	🔑 feat: Surface User-Provided API Keys in Settings, Scoped to Reachable Endpoints (#13864) ... Adds a "Provider API keys" entry under Settings → Data controls → API keys that lists every endpoint requiring a user-provided credential and lets users set or rotate its key via SetKeyDialog. This is always reachable, so keys can be managed even when `interface.modelSelect` is hidden by `modelSpecs`. The endpoint list is filtered the same way the mention popover and model selector menu are: - No modelSpecs → every user-provided endpoint. - modelSpecs configured → limited to spec endpoints ∪ `modelSpecs.addedEndpoints`. - agents reachable (with access) → expanded to the agents `allowedProviders` (all providers when unrestricted). Reworks #13303 onto the registry-driven Settings dialog (#13722); the prior standalone tab and the `APIKeys` directory are superseded (the latter also collided with the agent `ApiKeys` feature from #13819).	2026-06-20 10:54:30 -04:00
Matheus Serpa	21d98b85bd	🏷️ fix: Scope File Search entity_id to Agent Knowledge-Base Files Only (#13693) ... User-attached files are embedded by the RAG API under the user id (no entity), while only agent knowledge-base files are embedded under the agent's entity_id. Sending entity_id in every /query request made the RAG API's entity filter return no results for user attachments — with a shared agent, files attached to the message were effectively invisible to the file_search tool, while knowledge-base files kept working (which masked the bug). primeFiles now tags each file with fromAgent (whether it belongs to the agent's file_search.file_ids) and createQueryBody only includes entity_id when fromAgent === true — the safe default for callers that omit the flag is to query without entity scoping. Tests cover KB files, user attachments, the omitted-flag default, and restore RAG_API_URL.	2026-06-20 10:18:25 -04:00
Airam Hernández Hernández	3926fda234	🎒 fix: Apply OCR Context to Responses API Agents and Handoffs (#13707)	2026-06-20 10:17:09 -04:00
Danny Avila	59637e136f	📦 chore: Bump @librechat/agents to v3.2.43 (#13854)	2026-06-19 16:20:27 -04:00
Danny Avila	f8aa45d05e	🔚 feat: Add Bottom Terminus Node to Message Minimap Navigation (#13853) ... * ✨ feat: Add scroll-to-bottom terminus node to MessageNav Append the chat's bottom (#messages-end) as a terminal rib in the message minimap so it is reachable by click, drag-scrub, and the down chevron like any message. Rendered as a distinct centered dot rather than a line rib, and gated on the #messages-end sentinel actually existing. Also clamp each rib's snap target to the container's max scroll so the down chevron no longer stays stuck enabled at the bottom (the terminus can never scroll its top to the container top). * 🐛 fix: Scope MessageNav terminus to its own scroll container The terminus rib stored the shared constant id 'messages-end', which is rendered once per MessagesView. With multiple navs mounted, the global document.getElementById lookups resolved the first chat's sentinel, breaking the per-instance isolation guaranteed by the existing multi-instance tests. Resolve the terminus via the nav's own scrollableRef container (querySelector), leaving the globally-unique message ids on the fast getElementById path. Adds a multi-instance test covering the terminus.	2026-06-19 14:10:59 -04:00
Danny Avila	8969034ad1	♊ fix: Strip remaining unsupported JSON Schema keywords for Gemini MCP tools (#13850) ... * ♊ fix: Strip remaining unsupported JSON Schema keywords for Gemini MCP tools Gemini's FunctionDeclaration.parameters schema rejects more JSON Schema keywords than sanitizeGeminiSchema previously stripped. MCP tools shipping examples/readOnly/multipleOf/uniqueItems/prefixItems/etc. still 400 with `Unknown name "<key>"`, the same class as #13623 (exclusiveMinimum). Verified live against gemini-2.5-flash and gemini-3.5-flash: each added keyword is rejected through `parameters`, and @langchain/google-genai only removes additionalProperties/$schema, so they must be stripped here. * ♊ refactor: Make Gemini strip-list fully live-verified; preserve `default` Probed every candidate keyword against both the live Gemini API (gemini-2.5-flash, gemini-3.5-flash) and Vertex AI. Confirmed the inferred siblings (dependencies/dependentSchemas/contentSchema) are rejected, so they stay. Dropped `default`: it is part of Gemini's Schema and is accepted by both the Gemini API and Vertex (no documented reason for its removal in #13623), so it is now preserved instead of stripped. * ♊ fix: Preserve `default` data and synthesize array `items` (Codex P2s) Addresses two Codex findings on the strip-list rework: - `default` is now copied verbatim instead of recursed, so object/array default values (e.g. `{ id: 'abc', readOnly: true }`) keep ordinary data keys that the schema-recursion would otherwise strip. - `prefixItems` is dropped but its first member is synthesized into `items`, since Gemini's API requires `items` on every array (live: itemless array => 400; the synthesized `{type:array, items:{...}}` => 200 on Gemini 2.5/3.5 and Vertex). Third finding (patternProperties -> empty object) not actioned: live probing shows `{type:'object'}` with no properties is accepted by both the Gemini API and Vertex. * ♊ fix: Treat boolean/tuple array `items` as missing (Codex P2) The Draft 2020 tuple form `prefixItems: [...], items: false` slipped through: the `'items' in collapsed` check treated boolean `false` as a real item schema, so no fallback was synthesized and `items: false` was emitted — which Gemini rejects (live: `items: false`/`true` => 400 "Invalid value"). Now `items` is only kept when it is a schema object; boolean and tuple-array (`items: [...]`) forms are dropped, a `prefixItems` member is synthesized when present, and any array still missing `items` falls back to `{}` (verified accepted by the Gemini API and Vertex). Adds an `isObjectSchema` guard + tests.	2026-06-19 13:14:47 -04:00
Danny Avila	36ae268620	🐛 fix: resolve dayjs plugin ESM imports in data-provider (#13851) ... `parsers.ts` imported `dayjs/plugin/utc` and `dayjs/plugin/timezone` without a file extension. The tsdown build externalizes all bare imports, so it emitted those specifiers verbatim into `dist/index.mjs`. dayjs@1.11 ships no `exports` map, so under strict Node ESM the extensionless subpaths fail with ERR_MODULE_NOT_FOUND ("Did you mean to import 'dayjs/plugin/utc.js'?"), breaking every strict-ESM consumer that transitively imports data-provider (and data-schemas, which re-exports it) — e.g. vitest suites in downstream apps. Add the `.js` extension so the externalized imports resolve. With moduleResolution: bundler the types still resolve from the plugin `.d.ts`. Bump to 0.8.507 to supersede the broken 0.8.506 publish. Verified: build clean, `dist/index.mjs` imports under strict Node ESM (node --input-type=module), parsers specs 50/50.	2026-06-19 11:11:08 -04:00
Danny Avila	e6fc232ed2	🌍 i18n: Update translation.json with latest translations (#13836)	2026-06-19 10:42:15 -04:00
Danny Avila	91f25b8302	📦 chore: bump @librechat/agents to v3.2.42 (#13848) ... * 🔧 chore: Update dependencies in package-lock.json and package.json Bump `form-data` to version 4.0.6 and update `hasown` and `mime-types` dependencies in package-lock.json. Add an `overrides` section in package.json to ensure compatibility with the new `form-data` version. * 📦 chore: Bump `@librechat/agents` to v3.2.42	2026-06-19 09:47:46 -04:00
Danny Avila	2c6db6bf73	🪞 fix: Match Prompt Cache TTL Control to Region Combobox Styling (#13839) ... The Prompt Cache Duration control used `component: 'dropdown'` (DynamicDropdown → SelectDropDown), which renders with a different trigger style than the sibling Region selector and expands its options inline (headless-ui Listbox) — causing a visual mismatch and layout shift in the parameters panel. Switch both the Anthropic and Bedrock promptCacheTtl definitions to `component: 'combobox'` (DynamicCombobox → ControlCombobox), the same component Region uses: matching rounded trigger styling, an Ariakit popover (portal, no layout shift), and — as a bonus — it persists selections via setOption on custom endpoints (DynamicDropdown's custom branch is a no-op TODO). Renames the placeholder fields to the combobox's selectPlaceholder/selectPlaceholderCode.	2026-06-18 22:25:54 -04:00
Danny Avila	268fcbb78d	🕐 feat: Add promptCacheTtl model parameter for 1h/5m cache duration (#13835) ... * 🕐 feat: Add promptCacheTtl model parameter for 1h/5m cache duration Adds a user-configurable `promptCacheTtl` parameter (dropdown: 5m | 1h) alongside the existing `promptCache` toggle for Anthropic, Bedrock, and OpenRouter endpoints. Default is undefined so the agents SDK applies its own default (1h), letting users opt down to the legacy 5m TTL. - data-provider: schema, parameterSettings dropdown, types, bedrock picks - data-schemas: convo/preset types + mongoose defaults - api: thread promptCacheTtl into anthropic + openai(OpenRouter) llmConfig - i18n: en translation keys for label/description/default placeholder - tests: anthropic llm.spec coverage for set + unset cases * 🔧 fix: Tie Bedrock promptCacheTtl to promptCache + thread OpenRouter TTL params (Codex review) - bedrock.ts: clear promptCacheTtl whenever promptCache is off/unsupported, so an unsupported 1h is never sent on a non-caching Bedrock request - openai/llm.ts: resolve promptCacheTtl through the same defaultParams/ addParams/dropParams machinery as promptCache (via promptCacheTtlValue) so OpenRouter custom endpoints can configure/override/drop it - tests: bedrock TTL-tied-to-promptCache cases; OpenRouter TTL default/add/drop * 🎨 style: Sort imports in openai/llm.spec.ts (CI sort-imports) * ✅ test: Prove OpenRouter TTL-only selection honors promptCache default (Codex review) OPENROUTER_DEFAULT_PARAMS injects promptCache:true into defaultParams, so a TTL-only dropdown selection (promptCacheTtl set, promptCache switch untouched) still resolves caching on and forwards the TTL. Add regression tests via the real getOpenAIConfig entry point: TTL-only -> promptCache+TTL both set; explicit promptCache:false -> both dropped. * 🔖 chore: Bump librechat-data-provider to 0.8.506 * 🔧 fix: Drop Anthropic promptCacheTtl when promptCache is dropped (Codex review) dropParams: ['promptCache'] deleted requestOptions.promptCache but left promptCacheTtl behind, so the admin opt-out path could still carry a TTL on a request with caching disabled. Clear the TTL alongside promptCache.	2026-06-18 16:36:43 -04:00
Dustin Healy	6a63531eb4	📒 feat: Audit Log Backend for SystemGrant Assign and Revoke Events (#13087) ... * 🛡️ feat: Audit log backend for SystemGrants changes Add an AuditLog Mongoose collection that records every grant assign/revoke as an append-only entry capturing the actor, target principal, capability, timestamp, and tenant scope. Wire the entry-write into the existing admin assignGrant and revokeGrant handlers so the admin panel's audit-log tab populates as grants happen. The data-schemas package gains the IAuditLog type, a Mongoose schema with tenant + target compound indexes for keyset pagination, a model factory wired through createModels, and an AuditLog methods factory exposing recordAuditEntry, listAuditLogPage (cursor-paginated, faceted, search-aware), findAuditLogEntry, and streamAuditLogEntries. The packages/api admin layer adds createAdminAuditLogHandlers with three handlers backing the routes the admin panel already consumes: GET /api/admin/audit-log returns paginated entries, GET /api/admin/audit-log/:id returns a single entry for the permalink drawer, and GET /api/admin/audit-log/export.csv streams CSV with formula-injection defang plus UTF-8 BOM. The Express layer mounts the new router at /api/admin/audit-log behind requireJwtAuth and the ACCESS_ADMIN capability, matching the existing admin route pattern. The audit emission failure is logged via logger.error but never rolls back the grant. * 🧹 chore: Audit log backend cleanup — offset pagination, name-based filters, type tightening Switch listAuditLogPage from cursor-based to offset-based pagination with skip().limit() + parallel countDocuments, returning { entries, total } instead of { entries, nextCursor }; the cursor encode and decode helpers are no longer needed and have been removed. Interpret the actorId and targetPrincipalId filter parameters as case-insensitive partial regex against the denormalized actorName and targetName fields rather than exact-match against the underlying ObjectId. Admin panel users naturally filter by human name, not by Mongo identifier. Replace the broad Record<string, unknown> casts on req.query with a typed AuditLogQuery shape, drop two unused exported types and the now-unused mongoose Types import, and fix the streamAuditLogEntries Omit literal to match the interface and the offset-based design. * 🛠️ fix: Address audit log review feedback (CI typecheck, ISO offsets, no-op revoke, deps surface, schema, backpressure, tests) Resolve the duplicate AuditAction export that broke the data-schemas TypeScript check by importing the canonical declaration from types/admin instead of re-declaring it in types/auditLog. Accept timezone-offset ISO 8601 timestamps such as 2026-05-01T09:30:00+02:00 in the from and to filter params and reject local-time strings without a zone so every request resolves to an unambiguous instant. Skip the audit emission on no-op revokes: revokeCapability now returns deletedCount so the admin handler can omit the grant_removed entry when the target grant did not exist, keeping the audit trail factually accurate. Mocks in the existing grants.spec.ts updated to the new return shape. Drop the required recordAuditEntry from AdminAuditLogDeps since the audit-log handler factory never consumes it; the grants handler factory keeps its optional dep for the write path. Tighten the tenantId validator on the audit log schema to require a non-empty trimmed string, and rewrite the listing-index comment to describe deterministic offset sort instead of keyset pagination. Stream the CSV export with explicit backpressure (await drain when res.write returns false) and abort on client disconnect so a cancelled download no longer pins a Mongo cursor or buffers unbounded data in memory. Add packages/data-schemas/src/methods/auditLog.spec.ts covering tenant and platform scoping, single and multi action filtering, partial-name filtering for actor and capability, the createdAt window, offset pagination with total, ObjectId and date stringification on the wire, regex-metacharacter escape, and streaming completeness. * 🛠️ fix: Address P1 audit-log review findings (cursor cancel, drain race, filter naming, type dedupe, tenant scope, log enrichment) The CSV stream handler kept draining Mongo batches after the client disconnected because the `for await` loop only honored its abort flag inside `onEntry`. Thread an `isCancelled` callback into `streamAuditLogEntries` so the methods layer closes the cursor as soon as the handler sees `close`/`aborted`; a `finally` block guarantees release on throw. The drain promise in `writeChunk` now races against the response's `close` event so a destroyed socket cannot strand the handler on a `drain` that will never fire. The HTTP filter keys `actorId` and `targetPrincipalId` always did case-insensitive substring matches on the denormalized `actorName` / `targetName` columns, never on ObjectIds — a client passing a real id silently got zero rows. Renamed the wire-level keys to `actorQuery` / `targetQuery` (matching what the matcher actually does) and kept the old names as deprecated aliases for one release so the sibling admin-panel PR can migrate without breaking; each legacy use logs a deprecation warning. Renamed the corresponding fields in `AuditLogFilters` too. `AdminAuditLogEntryWire` duplicated `AdminAuditLogEntry` from `types/admin.ts` field-for-field, violating the no-duplicate-types rule. Deleted the duplicate, hoisted `AuditLogPage`, `RecordAuditEntryInput`, and `AuditLogFilters` from `methods/auditLog.ts` into `types/auditLog.ts`, and updated the handler, method factory, and re-exports accordingly. `tenantFilter` treated `''` as a valid tenant scope, producing a `{ tenantId: '' }` query that silently returned nothing while the schema validator rejected `''` on writes. Switched to a strict `typeof tenantId === 'string' && tenantId.trim().length > 0` check so reads agree with writes, with new spec coverage for empty and whitespace-only inputs. Audit-write failures now log the full forensic payload (action, capability, tenantId, actorId, target metadata) inside a single meta object so winston's standard signature surfaces it correctly; a comment on the catch block explains why the failure mode stays silent (it must never block a privileged operation). Stronger filter parsing: invalid `action` values and unknown `targetPrincipalType` now return 400 instead of silently dropping. Extracted `MAX_LIMIT` to a constant. Replaced the `Record<string, Date>` cast in `buildFilter` with a typed local. Switched the stream cursor to `lean<IAuditLog[]>()` and removed the `as IAuditLog` cast inside the loop. * ✅ test: Cover admin audit-log handler with unit tests for auth, validation, tenant isolation, CSV output, and abort The sibling admin handlers (grants, groups, roles, users) all have handler specs; this one was missing. The new suite covers 401 on a missing `req.user`, 400 on malformed ISO `from` / `to`, 400 on limit > 500, 400 on negative offset, 400 on an unknown action or `targetPrincipalType`, 400 on a non-ObjectId `:id`, 404 when the methods layer returns null, that the caller's `tenantId` (not a forged query-string `tenantId`) is the one passed to the methods layer, that `actorQuery` / `targetQuery` round-trip, that the deprecated `actorId` / `targetPrincipalId` aliases still map through, that the CSV stream emits the BOM as the first chunk with CRLF line endings and the expected header labels, that quotes, commas, and newlines are properly escaped, that the formula-injection prefixes (`=` `+` `-` `@` tab CR) are defanged, that an `isCancelled` callback reaches the methods layer and flips to true on client `close`, and that `res.end` is skipped when the client disconnected mid-stream. * 🛡️ feat: Enforce append-only AuditLog at the schema level Every field is now marked `immutable: true`, and pre-hooks on the schema reject `updateOne`, `updateMany`, `findOneAndUpdate`, `findOneAndReplace`, `replaceOne`, `deleteOne`, `deleteMany`, `findOneAndDelete`, plus any `save()` against an existing document. `timestamps` is reduced to `{ createdAt: true, updatedAt: false }` since a mutable timestamp would imply mutation is allowed, and `updatedAt` is dropped from `AuditLog` / `IAuditLog`. The methods spec resets state between tests via the raw driver (`AuditLog.collection.deleteMany`), which bypasses the pre-hooks; new specs assert that the model-level update / delete / re-save paths reject with the append-only error and that `updatedAt` is not stamped on new documents. * ♻️ refactor: Share MAX_AUDIT_LOG_LIMIT between methods and handler Renamed the methods-layer constant from the generic `MAX_LIMIT` to `MAX_AUDIT_LOG_LIMIT`, exported it through `@librechat/data-schemas`, and consumed it from the handler instead of duplicating `500` there. Now the limit is single-sourced; bumping it once updates both the clamp inside `listAuditLogPage` and the 400-error boundary the handler returns to clients. * 🛡️ feat: Gate audit-log routes on a dedicated `READ_AUDIT_LOG` capability The audit-log routes were gated on `ACCESS_ADMIN`, which conflates "can log into the admin panel" with "can see who granted what to whom." Anyone with `ACCESS_ADMIN + READ_CONFIGS` (a config reviewer with no people-management authority) could read the grant history of every user, group, and role — information they have no need to know. `READ_AUDIT_LOG` ('read:audit_log') is now an explicit, separately grantable read capability with no MANAGE counterpart, matching the append-only nature of the collection. `seedSystemGrants` iterates `Object.values(SystemCapabilities)` so existing ADMIN-role seeds pick it up automatically on next startup. This also makes an "auditor" persona possible: hold `ACCESS_ADMIN + READ_AUDIT_LOG` without any MANAGE_* grants and you can review history without modifying anything. * ♻️ refactor: Share AUDIT_ACTIONS, tighten audit dep types, document route order Exports a runtime AUDIT_ACTIONS array from packages/data-schemas alongside the AuditAction type so the Mongoose schema enum and the HTTP handler's whitelist consume one source of truth instead of duplicating the literal pair. Switches the grants handler's recordAuditEntry dep typing from a duplicated inline object literal returning Promise<unknown> to the published RecordAuditEntryInput type returning Promise<void>, and tightens the local emitAudit args to AuditAction. Replaces the local ParsedFilters interface in the audit-log handler with Omit<AuditLogFilters, 'offset' | 'limit'> to drop the duplicate definition. Drops the optional marker on AuditLog.createdAt. Mongoose always sets it at insert time, so callers treating it as nullable were guarding against a state the schema does not produce. Adds a comment on api/server/routes/admin/audit.js noting that /export.csv must precede /:id so a future contributor does not accidentally reorder them into a 404 trap. * 🛡️ feat: Resolve audit names without extra DB round-trips For the actor name, JWT-authenticated `req.user` already carries `name`, `username`, and `email`. `resolveUser` now derives the actor display name from `req.user` directly and threads it through the caller context, so every grant assign and revoke no longer triggers a separate `getUserById` lookup. For the target name, replaces the previous always-store-the-principalId behavior (which buried opaque ObjectId strings in immutable audit rows for USER and GROUP targets) with a `resolveTargetName` dep. ROLE principals continue to use `principalId` directly because the SystemGrant model stores role names there. USER and GROUP principals route through the new dep, which in `api/server/routes/admin/grants.js` calls `db.getUserById` or `db.findGroupById` respectively and falls back to the principalId on miss or error so the audit row stays intelligible. Drops the misleading "display name lookup happens in a later iteration" comment. * ✅ test: Cover audit emission, scope emitAudit to today's ROLE-only surface Fixes a misleading test that claimed to verify "idempotent even if the grant does not exist" while mocking deletedCount: 1 (the grant DID exist). Replaces it with the actual no-op scenario (deletedCount: 0) and adds an assertion that recordAuditEntry is NOT called, since the whole point of the deletedCount > 0 gate is to avoid fictitious revocation rows. Adds a dedicated audit emission describe block covering: grant_assigned emission with the actor name resolved from req.user, grant_removed emission when deletedCount is positive, and the no-emission fallback when recordAuditEntry is not configured. The actor-name assertions exercise the name / username / email fallback chain in resolveUser. The previous commit also added a `resolveTargetName` dep and an emitAudit branch for USER/GROUP targets. The grants surface is ROLE-only today (MANAGE_CAPABILITY_BY_TYPE has only PrincipalType.ROLE), so that code path is unreachable from the handler. Removed the dep and the branch; the audit row uses principalId as the target name, which is the human-readable role name for ROLE principals. A comment in emitAudit flags where to plumb resolveTargetName back in once USER and GROUP grants are enabled. * 🛠️ fix: Inclusive `to` date filter and reject inverted ranges A `?to=2025-01-15` filter previously stopped at midnight UTC of that day, silently excluding everything that happened on January 15. The `parseIsoDate` helper now widens a bare `YYYY-MM-DD` to 23:59:59.999Z when called with the `end` boundary. Full ISO timestamps are honored exactly, so callers that want minute-precision can still get it. Also rejects inverted ranges (`from` later than `to`) with a 400 so operators see a clear error instead of a silent empty result. * 🛡️ feat: Cap audit-log CSV exports at 100k rows; cover stream error path Introduces MAX_AUDIT_EXPORT_ROWS (100k) and threads a `maxRows` option through streamAuditLogEntries. The handler now passes the cap into the stream so a careless admin script or a hostile auditor cannot pin a Node worker and a Mongo cursor by exporting unbounded result sets. Beyond 100k rows, callers should slice exports by from / to date. Adds a methods-layer spec for the cap behavior, a handler-layer spec that asserts the option is plumbed through, and a handler-layer spec that exercises the streamAuditLogEntries-throws-after-headers-sent path (catch block falls through to res.end instead of attempting JSON). Documents on buildFilter that case-insensitive substring regex filters (actorName, targetName, capability, search) cannot use a B-tree index and degrade to a tenant-scoped partition scan, so deployments with hundreds of thousands of audit rows per tenant should constrain those queries with a date window. * 🧹 chore: Spell CSV_BOM as  and drop a gratuitous optional chain `revokeCapability` is typed `Promise<{ deletedCount: number }>` so the `?.` on `revokeResult?.deletedCount` only obscured that the value cannot be nullish. `CSV_BOM` was a literal U+FEFF character invisible in most editors. Now spelled as the Unicode escape so readers can see the constant; the test that asserts on the first emitted chunk uses the same escape. * 🔧 chore: Allowlist AuditLog in the tenant-isolation coverage guard The AuditLog collection carries a tenantId field but scopes tenancy manually inside listAuditLogPage / streamAuditLogEntries / recordAuditEntry using the same $exists: false convention as SystemGrant. The tenant-isolation plugin coverage spec now allows that and asserts it stays accurate. * 🛠️ fix: Normalize blank tenantId before persisting audit entries The `recordAuditEntry` write path was treating any non-null tenantId as a real string, so empty or whitespace-only values reached the schema validator, failed the non-empty-string check, and silently dropped the audit row. The read-side `tenantFilter` already treats those values as platform-level scope, so the write path now mirrors it: blank or whitespace-only tenantId becomes an omitted field, which matches `{ tenantId: { $exists: false } }` queries and clears validation. Added a regression test that records two entries with blank and whitespace tenantId and asserts both persist with the tenantId field absent. * 🎨 style: collapse expect.objectContaining onto one line to satisfy prettier * 🔒 fix: block document-level deleteOne/updateOne on AuditLog Mongoose registers deleteOne and updateOne pre-hooks as query middleware by default. The query-level append-only block on AuditLog therefore did not cover Document.prototype.deleteOne() or Document.prototype.updateOne(), leaving a path where a caller that had already loaded an audit row via findOne could call .deleteOne() or .updateOne() on the instance and bypass the schema contract. Explicit { document: true, query: false } registrations close the holes, and the spec now covers both code paths against a real in-memory Mongo. * 🔒 fix: require ACCESS_ADMIN on audit-log routes Every other admin router (config, grants, users, roles, groups, auth) enforces requireJwtAuth followed by requireCapability(ACCESS_ADMIN) before any feature-specific capability check. The audit-log router only required READ_AUDIT_LOG, which is independent of ACCESS_ADMIN in CapabilityImplications, so a role delegated only READ_AUDIT_LOG without ACCESS_ADMIN could read or CSV-export the audit trail and bypass the admin boundary. Aligned the middleware chain with the rest of the admin surface so ACCESS_ADMIN gates entry and READ_AUDIT_LOG gates the feature within it. * 🎨 chore: re-sort imports after dev rebase Post-rebase sort-imports against the merge target — six audit-log files landed with stale import ordering relative to the current scripts/sort-imports.mts rules on dev. CI's import-order job flagged the drift; running the script locally rewrites them in place. No semantic changes. * 🔧 fix: explicit type annotations on audit-log model + schema exports Dev migrated packages/data-schemas builds from rollup to tsdown with --isolatedDeclarations enabled, which requires every exported function to declare its return type and every exported variable to declare its type. Two of our audit-log exports got swept up: TS9007 models/auditLog.ts:12 createAuditLogModel return type TS9010 schema/auditLog.ts:12 auditLogSchema variable type Added Model<t.IAuditLog> on the factory and Schema<IAuditLog> on the schema variable, matching the sibling SystemGrant convention. No runtime behavior change. * 🔧 fix: align revokeCapability type annotation with implementation The rebase auto-merge of systemGrant.ts kept dev's outer type annotation (`revokeCapability: ... => Promise<void>`) but our implementation returns `Promise<{ deletedCount: number }>` (added during the bot-review loop to let the audit emitter distinguish a real revoke from a no-op against a nonexistent grant). The mismatch surfaced as TS2719 on the methods record return at line 520. Updated the type annotation to match the impl. The caller at packages/api/src/admin/grants.ts:444 reads `revokeResult.deletedCount` to gate the audit emit, so the wider return type is what the rest of the code already assumes. * 🔧 fix: explicit factory return type on createAdminAuditLogHandlers Same tsdown --isolatedDeclarations migration that hit packages/data-schemas also applies to packages/api; the audit-log handler factory's inferred return type tripped TS9013 against the new build pipeline. Annotated the factory with explicit handler signatures matching the sibling createAdminGrantsHandlers convention. Used Promise<Response | void> for the export handler because its final res.end() path returns undefined, unlike the other two handlers which always return a Response. * 🛡️ feat: Generalize audit log into a tamper-evident, extensible event substrate Reworks the SystemGrant-only audit log into a general-purpose, append-only compliance substrate designed to absorb future event classes (agent runs, tool/MCP calls, config + permission changes, approvals) without reshaping the record. Nothing was shipped yet, so this replaces the grant-specific wire shape rather than layering aliases. Schema / record shape (packages/data-schemas): - schemaVersion + two-level taxonomy: category + namespaced action (grant.assigned/grant.removed), first-class outcome and severity. - Structured actor{type,id,name} supporting non-user actors (system, agent, service, schedule, webhook, api); generic target{type,id,name}; open metadata map; request context{requestId,ip,userAgent,sessionId}. Tamper-evidence (hash chain): - Per-tenant chain keyed by chainKey with seq/prevHash/hash. Appends link to the previous hash; a unique {chainKey,seq} index serializes concurrent writes (dup-key retry) so the chain can never fork. createdAt is explicit so it's covered by the hash. - verifyAuditChain() walks a chain and detects modification, deletion, and forged links; exposed via GET /api/admin/audit-log/verify. Other best-practice gaps from the review: - Keyset (cursor) pagination over seq alongside offset; stable under concurrent appends. nextCursor in the page payload. - Retention: purgeAuditLogEntries() privileged prefix-purge with a confirm latch, returns a checkpoint; verify tolerates a purged prefix. - Fail-closed option (AUDIT_LOG_FAIL_CLOSED) so a failed audit write can fail the grant request instead of being swallowed; default stays fail-open. - Grant handlers now capture request context and emit the new shape. CSV export updated for the new columns (incl. seq/hash). data-schemas bumped to 0.0.54 for the sibling admin-panel consumer. Tests rewritten: 28 methods-layer cases (chain genesis/linking, tamper detection, keyset, purge) and the handler/grants specs updated for the new shape, fail-closed, and the verify endpoint. * 🛠️ fix: Address Codex review on the audit-log substrate - F1 (fail-closed atomicity): assign/revoke now compensate (rollback grant / restore grant) when a fail-closed audit write fails, so a 5xx never leaves an unaudited mutation. - F5: only emit grant.assigned for a real change — skip the audit when the role already holds the capability (idempotent re-assert). - F7: verifyAuditChain no longer silently trusts a non-genesis start; a purged prefix must be authorized by a trusted checkpoint (purge now returns {throughSeq, prevHash}), else verification fails as tampering. - F4: block Model.bulkWrite on AuditLog (would bypass the append-only middleware). - F3: CSV export appends an explicit TRUNCATED marker + logs when the row cap is hit. - F6: reject out-of-range date-only filters (2025-02-31) instead of normalizing. - F2: regenerate package-lock.json for the 0.0.54 data-schemas bump. Tests: +1 methods (bulkWrite) +2 verify (deleted-prefix / checkpoint mismatch), updated purge test for checkpoint flow; +4 api (re-assert skip, assign/revoke fail-closed rollback, date reject, CSV truncation marker). * 🛠️ fix: Address Codex round-2 on the audit-log substrate - R2-1/R2-5 (P1/P2): base the grant.assigned audit decision on the atomic upsert result. grantCapability now returns { grant, created } via includeResultMetadata; the handler audits only when created. Removes the racy pre-read, which also mis-handled inherited platform grants vs a new tenant-scoped insert and concurrent double-assign. - R2-2 (P2): namespace tenant chain keys (tenant:<id>) so a tenant whose id is literally the platform sentinel can't share the platform audit chain. - R2-4 (P2): validate literal calendar tokens for full ISO timestamps too, so 2025-02-31T00:00:00Z is rejected instead of normalizing to March 3. Tests updated for the grantCapability { grant, created } contract (systemGrant + grants specs) and the namespaced chain key (auditChainKey helper); +1 api date case. data-schemas 141, api grants/audit 107 green. R2-3 (deprecated actorId/targetPrincipalId aliases): not reinstating — the surface is pre-release and its only consumer (admin-panel PR) migrates to the new shape in lockstep, so there are no legacy clients to support. R2-6 (role-deletion cascade emits no grant.removed): valid but a separate workflow in roles.ts; tracked as a follow-up to keep this PR scoped. * 🛠️ fix: Address Codex round-3 on the audit-log substrate - R3-3 (P2): make a grant re-assert a true no-op — move grantedAt/grantedBy to $setOnInsert so an existing grant is never silently mutated when the audit is skipped (created:false now means nothing changed). grantedAt/grantedBy record the original grant. - R3-2 (P2): report CSV export truncation exactly. streamAuditLogEntries returns { count, truncated }; truncated is true only when rows existed beyond the cap, so an exact-cap export is no longer falsely marked truncated. - R3-5 (P2): block AuditLog.insertMany (another bulk path that skips the save hook and could inject forged seq/prevHash/hash and poison the chain). Tests: +insertMany rejection, +exact-cap vs truncated stream cases, +exact-cap export-not-truncated handler case. ds 142, api 108 green. R3-1 (deprecated query aliases) and R3-4 (role-deletion cascade audit) are re-flags of R2-3/R2-6 — holding the prior decisions (pre-release surface; separate roles.ts workflow tracked as a follow-up), pending maintainer direction. * 🛡️ feat: Audit grant removals from the role-deletion cascade Closes the forensic gap Codex flagged (R2-6/R3-4): deleting a role removed its SystemGrants with no audit entries. `deleteGrantsForPrincipal` now returns the removed grants, and the role-deletion handler emits a `grant.removed` audit entry per removed grant (actor = caller, target = role, metadata.capability, request context), matching the explicit revoke endpoint. Fail-open — the role is already deleted, so a failed audit is logged, not propagated; sequential to keep the per-tenant hash chain ordered. Extracted `buildAuditContext` to admin/context.ts (shared by grants + roles). Tests: role-deletion emits one entry per grant / none when no grants; ds 110, api admin 202 green. * 🛠️ fix: Address Codex round-4 on the audit-log substrate - R4-1 (P2): don't silently drop an audit row under heavy append contention. recordAuditEntry now retries duplicate-key seq collisions up to 12× with jittered backoff (was 5, no backoff), so realistic bursts of parallel admin writes resolve; the failClosed escape still applies on true exhaustion. - R4-3 (P2): purge a contiguous seq prefix, not a date range. createdAt is app-generated, so under multi-instance clock skew a later seq can carry an earlier timestamp; a raw date delete could remove an interior row and break verification. purgeAuditLogEntries now resolves the date to the first retained seq and deletes only strictly-lower seqs, keeping the remaining chain contiguous. Tests: +clock-skew purge case (no gap created). ds auditLog 33 green. R4-2 (role-deletion grant audit) is a re-flag of R2-6/R3-4, already implemented in 15472127d6 (roles.ts emitGrantRemovals + route wiring + tests); the finding's cited line numbers predate that commit. * 🛠️ fix: Address Codex round-5 on the audit-log substrate - R5-1 (P2): scope each cascade grant.removed entry to the removed grant's own tenant, not the caller's. A platform admin deleting a role can remove tenant-scoped grants; those removals now land in the affected tenant's chain. - R5-2 (P2): only return a purge checkpoint when rows were actually deleted. A no-op confirmed purge no longer mints a trust boundary that could legitimize a prefix it didn't authorize. - R5-3 (P2): ensure the unique { chainKey, seq } index exists before appending (memoized createIndexes), so serialization doesn't depend on a background build — closes a silent chain-fork window under MONGO_AUTO_INDEX=false or at startup. Tests: +per-grant-tenant cascade audit, +no-op-purge-no-checkpoint, +index-built-before-append. ds auditLog 35, api roles 95 green. --------- Co-authored-by: Danny Avila <danny@librechat.ai>	2026-06-18 15:42:33 -04:00
Dustin Healy	fa20003952	🛂 refactor: Accept Targeted assign:configs for Config Scope-Lifecycle Endpoints (#13773) ... * 🔓 fix: Accept Targeted assign:configs for Config Scope-Lifecycle Endpoints Three admin-config endpoints currently require broad manage:configs: PUT /:principalType/:principalId for empty-overrides scope creation, DELETE /:principalType/:principalId for scope removal, and PATCH /:principalType/:principalId/active for the active toggle. The capability model already defines assign:configs:user|group|role for delegated administrators and validates that shape in isValidCapability, but no handler accepts it, so a delegate granted assign:configs:role via /api/admin/grants cannot manage scope lifecycle for the principal type they were explicitly delegated. This aligns the server-side auth with the documented capability surface. Every destructive lateral path stays behind broad manage:configs: operations against the base config principal (__base__), non-empty PUT payloads that $set the full overrides field, and DELETE or toggle on a document whose existing overrides are non-empty (which would erase or neutralize sections the caller could not author). The new hasCapability dep on AdminConfigDeps is optional with a false default, so external consumers continue to get pre-PR behavior until they wire the resolver. * 🛡️ fix: Block Assign-Only Scope-Lifecycle When Existing Doc Has Tombstones The existing-overrides guard introduced in the prior commit only checked overrides, but configs also carry tombstones (suppressed inherited field paths) which are iterated during cascade resolution. An assign-only caller could delete, toggle, or empty-upsert a doc whose overrides is empty but whose tombstones is non-empty, which would erase or neutralize suppressions on fields they could not author. Extends the guard at all three call sites to treat a non-empty tombstones array as destructive state. * 🚨 fix: Log TOCTOU Race When Assign-Only Lifecycle Op Hits Non-Empty Doc The empty-state guard for assign-only callers performs a read-then-write across two DB roundtrips, so a concurrent broad-manage write can land between the guard and the destructive op. Adds post-write detection on the delete and toggle handlers: when the destructive op returns a doc whose state was non-empty at write time, emit logger.warn with the caller id, principal, and observed-state counts so ops can detect the race and restore from audit logs. A fully atomic fix would require extending deleteConfig, toggleConfigActive, and upsertConfig in packages/data-schemas/src/methods/config.ts to support compare-and-swap filters, which is a wider design change than this PR's auth scope. Empty-payload upsert is not covered because $set replaces overrides, so the post-write doc no longer reflects pre-write state. * 🔒 fix: Atomic Empty-State Filter for Assign-Only Scope-Lifecycle Writes Replaces the read-then-check guard with an atomic Mongo filter on the destructive write itself. Adds an options.expectEmpty parameter to deleteConfig, toggleConfigActive, and upsertConfig in the shared data-schemas layer. When set, the filter requires both overrides and tombstones to be empty before the write matches. The TOCTOU race window is eliminated: a concurrent write cannot land between the empty-state check and the destructive op because they are now a single atomic operation. For upsertConfig, the E11000 retry path returns null instead of falling back to a filterless update when expectEmpty is set, preserving the atomic property. Handlers fall back to findConfigByPrincipal only to disambiguate the null return between 404 (doc absent) and 403 (doc exists with non-empty state). The post-write logger.warn race detection added in the prior commit is removed as unreachable.	2026-06-18 15:40:58 -04:00
Dustin Healy	84886c56fb	🧷 fix: Preserve Document Priority on Section-Scoped Config Writes (#13772) ... The patch and tombstone admin-config handlers accept a priority field on the request body, which controls the position of the entire Config document in the precedence cascade. Today, that priority is written unconditionally, even when the caller holds only a section-scoped grant such as manage:configs:memory. On a document containing overrides for other sections, this lets a section-scoped caller silently reorder overrides they have no permission to author. This is a defense-in-depth fix for deployments using section-scoped grants. In a vanilla setup where admins hold broad manage:configs, the path is unreachable because the broad-capability short-circuit lets every priority change through, so the fix is a no-op for those callers. The change makes the contract safe-by-construction for any deployment that narrows the auth model, at no cost to upstream behavior.	2026-06-18 15:39:44 -04:00
Danny Avila	68d142d0e9	🦜 refactor: Use path for Read/Write/Edit/Create File Tools (#13834) ... * fix(agents): use `path` for read/write/edit/create file tools Pairs with @librechat/agents renaming the read_file/write_file/edit_file tool parameter from `file_path` to `path` (models — esp. Kimi K2 — emit `path` far more reliably, and it matches grep/glob/list_directory which already use `path`). - tools.ts: LibreChat's own code/skill file-tool schemas use `path` (the skill read_file tool inherits the SDK definition, which is already renamed) - handlers.ts: read `args.path` for the model-facing tool arg + error messages - the internal host `readSandboxFile`/`writeSandboxFile` contract is unchanged - tests updated Requires @librechat/agents with the param rename (danny-avila/agents#250). All agents unit suites green (175). * chore: update @librechat/agents to v3.2.41 and bump related dependencies in package-lock.json and package.json files * fix(api): Refactor header merging in MCPConnection to use Object.assign for clarity * test(e2e): mock emits `path` for create/edit file-authoring tools The mock LLM still sent `file_path` for the create_file/edit_file calls, which the renamed handlers no longer read -> the skill-file-authoring e2e failed with 'Expected skill to be persisted'. Switch the fixture to `path` to match the tools. (The internal readSandboxFile/writeSandboxFile contract stays on `file_path`, so api/server/services/Files/Code/process.js and its spec are unchanged.)	2026-06-18 14:44:51 -04:00
Danny Avila	2fcba914f7	🔗 fix: Surface Share Permissions Load Error as Alert Button With Tooltip (#13833)	2026-06-18 13:37:49 -04:00
Marco Beretta	a468becf8c	🔑 feat: Agent API Keys management UI in Settings → Data controls (#13819) ... * feat(client): add optional copyButton slot to SecretInput * refactor: redesign Agent API Keys settings into a Data controls dialog * chore: remove unused com_ui_last_used i18n key	2026-06-18 12:58:17 -04:00
Marco Beretta	9de3249e9c	🎛️ feat: Redesign Settings with Registry-Driven Dialog, Search, and Mobile Drill-In (#13722) ... * i18n: add settings reorganization keys * feat(settings): add tab/section types and tab metadata * feat(settings): add useSettingsContext guard hook * feat(settings): add pure settings search filter with tests * feat(settings): extract selectors and add control wrappers * feat(settings): add setting registry, memory and billing controls, integrity test * feat(settings): add Section and Advanced disclosure with test * feat(settings): add content pane with tab and search views * feat(settings): add sidebar and dialog shell with tests * refactor(settings): wire new dialog and remove superseded containers * fix(settings): restore speech external engine option, escape-to-clear search, results a11y - SpeechControls.tsx: read sttExternal/ttsExternal from useGetCustomConfigSpeechQuery instead of hardcoding false, so external engine options appear on qualifying deployments - Sidebar: Escape clears search input when non-empty, stops propagation to avoid closing dialog - Content: persistent aria-live="polite" wrapper covers both populated results and empty state - context: useMemo on returned ctx object so Content's useMemo deps are referentially stable - locales/README.md: update stale path from deleted General.tsx to Selectors.tsx * refactor(settings): reorganize categories, remove advanced disclosure, add About - Re-categorize settings into logical groups (username display -> Chat/Messages, keep-screen-awake -> Accessibility, fork/prompts surfaced into Chat sections) - Dissolve thin Personalization tab; move Memory into Data & Privacy - Remove the Advanced collapsible; all settings always visible, destructive actions grouped in an always-visible Danger zone - Wire the new About tab into the registry-driven dialog - Standardize spacing with bordered, evenly-divided section cards - Use semantic text-text-* / border tokens so dark mode renders correctly - Sync LangSelector language-loading indicator from dev * feat(settings): move archived chats to the account menu Add an Archived chats item to the account dropdown next to My Files, opening the archived chats table in a modal. Removes it from the settings dialog where it no longer fit the data/privacy grouping. * feat(settings): polish About panel and use shared CopyButton - Flatten the build-info into a single divided key/value list (drop the redundant inner card now that it sits inside a section card) - Replace the hand-rolled copy button with the shared animated CopyButton - Shorten the copied label so it fits the button without clipping * fix(settings): set primary text color on setting rows for dark mode Leaf control labels rendered without a text color and fell back to the browser default (black), making them invisible on the dark panel. Set text-text-primary on the section and search-results row containers so labels inherit a visible color, matching the old container behavior. * fix(settings): use visible icon for dialog close button The plain multiplication-sign close button had no text color and was invisible on the dark panel. Replace it with the lucide X icon using text-text-secondary/hover:text-text-primary so it shows in both themes. * fix(nav): drop focus ring on account menu items, use hover background only The account-settings popover drew a 2px ring around the active menu item. Remove that override so items show only the standard hover background, consistent with every other menu. * fix(settings): replace native search clear with a real X button The settings search used type=search, whose native WebKit clear control rendered as a blue X. Switch to a text input and add a real lucide X clear button styled text-text-secondary, shown only when there's a query. * fix(speech): disable dependent dropdowns and switches when STT/TTS is off Add a disabled prop to the shared Dropdown component, then gate the speech engine/voice/language dropdowns and the automatic-playback switch on their parent toggle (speechToText / textToSpeech), matching the controls that already disabled correctly. * feat(settings): mobile drill-in navigation for settings tabs On small screens the horizontal scrolling tab row is replaced with a full-width vertical list (with chevrons); tapping a tab drills into its content with a Back header. Searching shows results full-width. Desktop keeps the side-by-side sidebar + content layout unchanged. * chore(settings): remove orphaned i18n keys, fix import order and review notes - Drop the i18n keys left unused after the refactor (old Commands/Balance/ Personalization tab labels, the Speech simple/advanced labels, and the former About section headings) - Sort imports in the rebased files the lint-staged hook never touched - Guard the language fallback against an empty navigator.languages - Import the RefObject type instead of leaning on the React namespace * feat(settings): searchable language dropdown Add an opt-in searchable mode to the shared Dropdown (Ariakit Select + Combobox) and use it for the language selector, which has 40+ options. The trigger styling is unchanged so it stays consistent with the other settings rows; only the popover gains a filter input. Accessibility: the filtered listbox is labeled, the empty state is moved out of the listbox and announced via an aria-live status region, and the decorative selected-state checkmark is hidden from assistive tech. * fix(settings): restore guards dropped in dialog refactor - Fall back to the General tab when the active tab becomes hidden (e.g. About when buildInfo is disabled) instead of rendering an empty panel. - Normalize a deprecated/invalid engineTTS (e.g. 'edge') back to browser during speech init so read-aloud controls keep rendering. - Hide the cloud browser voices toggle unless Browser TTS is active. * test(e2e): match agent-creation toast exactly to avoid SR-announce collision The agent builder spec asserted the creation toast with a non-exact getByText, which also matched Radix Toast's transient role="status" announce region ("Notification Successfully created ..."), causing a strict-mode violation. Mirror the mcp spec by using { exact: true }. * fix(settings): render the active panel as a tabpanel Wrap the non-search settings body in Tabs.Content so the selected panel gets role=tabpanel with Radix's id/aria-labelledby wiring, resolving the aria-controls target on each tab trigger. Search results stay a labeled live region (the tab list is hidden during mobile search, so a tabpanel aria-labelledby would dangle).	2026-06-18 08:51:07 -04:00
Marco Beretta	d8474864e9	🕰️ feat: Resolve Agent Prompt Time Variables in User's Timezone (#13815) ... Server-side resolution of {{current_date}} and {{current_datetime}} for agent instructions used the server's timezone, so agents received UTC instead of the user's local time the variables are documented to provide. The browser's IANA timezone is now sent with each request and threaded through replaceSpecialVars, anchoring those variables to the user's local wall clock. {{iso_datetime}} stays UTC. Invalid or missing zones fall back to the previous behavior.	2026-06-18 08:39:56 -04:00
Danny Avila	58647bc08b	🔖 fix: Decrement Bookmark Counts When Deleting Conversations (#13830) ... * 🔖 fix: Decrement Bookmark Counts When Deleting Conversations Deleting a bookmarked/tagged conversation removed the conversation but never decremented the affected ConversationTag counts, leaving stale bookmark counts in the UI. - Add decrementTagCounts helper that atomically decrements tag counts (clamped at 0, deduped per conversation) in deleteConvos, covering single delete, clear-all, and account deletion. - Invalidate the conversationTags query in the single-delete and clear-all client mutations so counts refetch. - Add deleteConvos tag-count tests. * 🔒 fix: Guard tag-count decrement on actual deletion and message-failure Addresses Codex review findings: - Guard the decrement on deleteConvoResult.deletedCount > 0 so a losing concurrent delete (double-click/two-tab) does not decrement counts for a conversation it did not actually remove. - Move the count adjustment to run immediately after the conversation deletion, before message cleanup, so a deleteMessages failure cannot leave bookmark counts permanently stale. - Add regression tests for both cases. * 🔀 fix: Refresh project stats after message cleanup in deleteConvos Addresses Codex finding: bundling refreshChatProjectStatsForUser into a Promise.all before deleteMessages let a stats-refresh error abort the function and orphan the deleted conversations' messages. Split the steps so the (best-effort) tag-count decrement still runs before message cleanup (counts reconciled even if messages fail), while project-stats refresh runs after, matching the original ordering. * ✅ test: Add e2e coverage for bookmark counts on conversation delete Two mock-harness specs for the deleteConvos bookmark-count behavior: - Deleting the only conversation carrying a bookmark drops its count to 0. - Deleting one of two conversations that share a bookmark leaves the count at 1. Both assert the persisted server count via GET /api/tags after the real delete round-trip. * chore: import order	2026-06-18 08:37:08 -04:00
Danny Avila	a6b5343220	📦 chore: npm audit fix (#13828) ... * 🔧 chore: Update `@librechat/agents` to v3.2.38 and bump related dependencies in package-lock.json and package.json files * 🔧 chore: Upgrade `multer` dependency to version 2.2.0 in package-lock.json and package.json * 🔧 chore: Upgrade `nodemailer` dependency to version 9.0.1 in package-lock.json and package.json * 🔧 chore: Upgrade `@aws-sdk/client-bedrock-agent-runtime` and `@aws-sdk/client-bedrock-runtime` to versions 3.1071.0, update related dependencies in package-lock.json and package.json * 🔧 chore: Upgrade `form-data` to version 4.0.6 and `hono` to version 4.12.25, update related dependencies in package-lock.json and package.json * 🔧 chore: npm audit fix * 🔧 chore: Remove unused Babel dependencies from package-lock.json and package.json * 🔧 chore: Add '@mistralai/mistralai' to esModules in Jest configuration files	2026-06-17 21:54:04 -04:00
Ravi Kumar L	27b0782201	📛 feat: Tag Langfuse Traces With Tenant ID (#13808) ... * feat: tag Langfuse traces with tenant id * fix: propagate tenant id to agent Langfuse config	2026-06-17 20:27:55 -04:00
Danny Avila	8628897c9c	📦 chore: Bump @librechat/agents to v3.2.37 (#13826)	2026-06-17 20:27:36 -04:00
Dan Lew	743f57f63e	🔖 feat: Add Pinned Conversations (#13492) ... * feat: add `convo.pinned` We want to be able to pin convos (so users can easily find them), thus we added a new field to the DB schema: `pinned`. We also had to add an API method for pinning a convo. It's got thorough tests. It's structured just like how /api/convos/archive works, only for pinning. * feat: add 'pinned' section to conversation list If there are any pinned conversations, they will appear above the normal "chats" list, with a pinned icon next to them. * feat: added pin/unpin to convo options ConvoOptions now has a pin/unpin button which lets you change the pin status of any given conversation. * fix: adjust ellipsizing gradient on ConvoLink Because it went across the whole ConvoLink, it would cover up any children (i.e. icons) that appear after the title. However, the point of the gradient is just to gradually make the title disappear, not the icons. This change places the gradient on the title only, so it achieves the same ellipsizing effect without interfering with the display of the child icons. * Fixed import sorting	2026-06-17 20:26:55 -04:00
Danny Avila	49f4b659f6	🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart (#13814) ... * 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart MCPServersRegistry was built once at boot from getAppConfig({ baseOnly: true }), freezing allowedDomains/allowedAddresses to YAML. Admin-panel mcpSettings overrides were ignored by both inspection (addServer/ reinspectServer/updateServer/lazyInitConfigServer) and runtime connection enforcement (assertResolvedRuntimeConfigAllowed), so a domain allowed only via the panel failed inspection and never connected. Make the registry's effective allowlists mutable and refresh them from the merged admin-panel config: seed at boot, and re-apply on every config mutation via invalidateConfigCaches -> clearMcpConfigCache. Both inspection and connection paths read the same getters, so both honor overrides without a restart. Fail-safe: current allowlists are preserved when the merged read fails. * 🛡️ fix: Scope MCP allowlist refresh to global config, fail-safe on DB error Address Codex P1 review findings on the allowlist-refresh path: - Tenant-scoped config mutations no longer push one tenant's merged mcpSettings into the process-wide registry singleton (read by all MCP connection paths), which would leak allowlists across tenants. Only global (non-tenant) mutations refresh the registry; tenant mutations still evict the config-server cache. - The refresh read now uses strictOverrides:true so a transient DB error throws instead of silently returning YAML base config — preserving the last-known allowlists rather than overwriting them with fallback values. Adds the strictOverrides option to getAppConfig (default off, no behavior change for existing callers). * ♻️ refactor: Resolve MCP allowlists per-request (tenant-scoped) instead of a global singleton Supersedes the prior global-mutation approach. MCP allowlists live in mcpSettings, which is tenant/principal-scoped admin config, so a process-wide singleton value is the wrong model — it caused cross-tenant bleed and stale reads. Instead, inject a resolver (from the app layer, where the merged config lives) that the registry calls per inspection and per connection. It reads the ALS tenant context via getAppConfig and accepts the acting user so user/role-scoped overrides resolve; config-source inspection (no user) resolves at tenant scope. Falls back to the YAML base allowlists when no resolver is set or the lookup fails, so a transient error fails to the operator baseline rather than disabling the allowlist. Removes the now-unnecessary setAllowlists / boot-seed / invalidateConfigCaches refresh / getAppConfig.strictOverrides machinery. * 🔒 fix: Scope config-source cache by allowlist; resolve OAuth allowlists per-request Address Codex review of the per-request resolver: - Config-source cache key now folds in the resolved allowlists, not just the raw-config hash. Inspection results became allowlist-dependent, so without this a tenant whose allowlist rejects a URL could poison the shared key with an inspectionFailed stub for a tenant that allows it (and vice versa). The tenant-scoped allowlist is resolved once per ensureConfigServers pass and threaded through the cache key + inspection. - The two remaining request-time OAuth allowlist reads now use the merged config instead of the YAML base getters: the fallback OAuth-initiate path (routes/mcp.js) via resolveAllowlists, and OAuth revocation (UserController.maybeUninstallOAuthMCP) via the request's already-merged appConfig.mcpSettings. Without this, an OAuth endpoint allowed only by an admin-panel override was rejected while inspection/connection allowed it. * ✅ test: Update MCP OAuth registry/config mocks for per-request allowlists CI fix for the Finding-12 change. The OAuth-initiate route now calls registry.resolveAllowlists() and the revocation path reads the merged appConfig.mcpSettings, so the affected specs' mocks were asserting the old base-getter values: - routes/__tests__/mcp.spec.js: add resolveAllowlists to the registry mock. - UserController.mcpOAuth.spec.js: provide mcpSettings on the getAppConfig mock so revokeOAuthToken still receives the expected allowlists. * 🧪 test: e2e proof that admin-panel MCP allowlist override takes effect Adds a Playwright mock-harness spec for #13809. A URL-based MCP fixture (e2e-http, streamable-http SDK server) boots inspectionFailed because its origin is omitted from the YAML mcpSettings.allowedDomains; the spec adds that origin via an admin config override (PUT /api/admin/config/user/:id) and asserts the server reinitializes — exercising the real resolver path through the backend + DB. Before the fix, reinspection used the frozen YAML allowlist and the server stayed unreachable. - e2e/setup/fake-mcp-http-server.js: streamable-HTTP MCP fixture (health GET /). - e2e/playwright.config.mock.ts: boot the fixture as a second webServer. - e2e/config/librechat.e2e.yaml: mcpSettings.allowedDomains (excludes 127.0.0.1) + the e2e-http server. - e2e/specs/mock/mcp-allowlist-override.spec.ts: login → baseline reinit fails → apply override → reinit succeeds.	2026-06-17 20:14:53 -04:00
Danny Avila	c04bddd304	🪵 refactor: Bound Log Traversal And Remove Legacy api/config Logger (#13813) ... * 🛡️ fix: Bound object-traverse against DAG fan-out and shared refs Detect cycles via the ancestor chain (so shared, non-circular references in sibling branches / DAGs are traversed correctly) and add defensive maxNodes (100k) / maxDepth (100) caps. The removed global visited set was implicitly bounding work at O(distinct nodes); ancestor-chain-only detection is O(root-to-node paths), exponential on DAGs (a depth-24 diamond went from 26 to 50M visits / 1.6s of synchronous work). The caps bound it to ~9ms while leaving normal traversal untouched. Adds a spec covering shared refs, cycles, DAGs, and both bounds. The lone consumer, debugTraverse, inherits the defaults with no change. * 🪵 refactor: Remove legacy api/config logger duplicate The api/config winston logger was a stale parallel implementation of the canonical @librechat/data-schemas logger, with unbounded redaction (regex-only redactFormat, npm traverse-based debugTraverse). Its winston instance and the logger export from api/config/index.js had zero consumers — every ~/config importer uses the MCP/flow-manager exports. The only live tie was ToolService's use of redactMessage. Re-export redactMessage from @librechat/data-schemas (behaviorally identical, a superset of the regex set), point ToolService at it, delete api/config/winston.js and api/config/parsers.js, drop the dead logger export, and remove the orphaned ~/config/parsers mock from the global test setup. * 🧹 chore: Drop orphaned traverse dep and stale legacy logger tests Deleting api/config/{winston,parsers}.js left the npm 'traverse' package unused in api/package.json (flagged by the detect-unused-packages CI check) and orphaned two tests that imported the deleted modules. Remove the traverse dependency (sync package-lock), and delete api/config/__tests__/{parsers,logToFile}.spec.js — the canonical logger's behavior is covered by packages/data-schemas/src/config/parsers.spec.ts. * 🩹 fix: Make object-traverse caps bound work and survive update() Address Codex review: (1) break the child loops as soon as the node budget is spent and iterate objects via for...in instead of materializing Object.entries/Object.keys, so maxNodes actually bounds work for wide arrays/objects; (2) detect ancestor cycles against an immutable original-node stack rather than context.node, which a callback's update() can reassign (the debug formatter rewrites array nodes in place). Adds tests for the wide-array bound and the update()-cycle case. * 🎚️ fix: Tighten object-traverse defaults to a ~1ms log budget Lower maxNodes 100000 -> 2500 and maxDepth 100 -> 5. Measured cost is ~140ns/node with the debug formatter callback, so 2500 nodes keeps a single log under ~1ms even on slower prod hardware; real log objects are ~25-30 nodes at depth 3-4, leaving ample headroom. maxNodes is the fan-out/cost lever; maxDepth bounds recursion and output readability (depth-5 covers typical logs, deeper renders compactly).	2026-06-17 12:31:32 -04:00
Danny Avila	6055ad0af2	🪃 fix: Restore Raw Spec Fallback for Enforced Presets (#13804) ... * fix: rebuild enforced specs from preset * test: Add enforced model spec e2e coverage * test: Align enforced spec regression scope	2026-06-16 21:10:22 -04:00