5267 commits

This branch

This branch

All branches

Author	SHA1	Message	Date
Danny Avila	a9ccac8656	🧲 feat: Enable Secure Attached Environment Pairing (#15355) ... * feat: add secure code environment pairing * fix: satisfy code environment type checks * fix: secure code environment administration * fix: isolate code pairing control plane * fix: validate code pairing control responses * fix: secure code pairing transport * fix: validate code pairing wire format * fix: harden pairing secret lookup	2026-08-30 17:12:20 -04:00
Danny Avila	7533d138fa	🧬 perf: Evolve Compaction Guidance on Warm Turns (#15371) ... * perf: evolve compaction guidance on warm turns * style: sort compaction adapter imports	2026-08-30 17:11:20 -04:00
Danny Avila	9dcef360e2	🧳 fix: Carry Stateful Environments Through Runtime Config (#15374)	2026-08-30 17:08:24 -04:00
Danny Avila	29b3e2ef3e	📜 fix: Resolve MCP Server Instructions for Startup-Deferred Servers (#15361) ... * fix: Fetch MCP Instructions from the First Live Connection Startup inspection intentionally defers servers that need per-user or runtime context, including OAuth/OBO, custom variables, user API keys, runtime placeholders, and startup-disabled servers. An enabled serverInstructions declaration therefore never resolves to text during inspection, even though the first live connection already has the instructions from the initialize response. Backfill resolvedInstructions from that connection through an identity-preserving YAML cache patch. Preserve updatedAt so live connections do not become stale, and globally invalidate the tenant-scoped read-through caches because YAML entries are shared across tenants. Literal instruction strings continue to win. Scope remains YAML-tier servers. Config-overlay servers are keyed by config hash, and DB-backed user servers need a separate identity-preserving write through mongoose timestamps and credential sanitization. * fix: Surface per-identity MCP instruction divergence `resolvedInstructions` is a single field on a config shared by every user of the server, and for a startup-deferred server the text now comes from one user's authenticated connection. That is exact for a server advertising one static block, but a server that tailors instructions per identity cannot be represented by it. Rather than let the stored copy churn per connection — each write invalidates the read-through cache globally, and the model context would vary by whoever connected last — keep the first text and log the divergence, so the assumption is diagnosable instead of silent. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * perf: Skip MCP instruction backfill for non-YAML tiers `setResolvedInstructions` writes only the YAML tier, so a config-overlay, user, or plugin server reached it, spent a cache round-trip — a network hop under Redis — and was refused. That repeated on every connection creation, because the refusal leaves `resolvedInstructions` unset and nothing memoizes the outcome. Gate on the existing `isUserSourced`/`isPluginSourced` predicates plus an explicit `config` check. An unset source still proceeds: it predates per-tier stamping and the registry resolves it by name. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * test: Pin the MCP instruction context read path Every existing assertion read back through `getServerConfig`, but `MCPManager.getInstructions` resolves instructions from `getAllServerConfigs`, which is served by a different read-through cache. A backfill that invalidated only the per-server cache would pass the suite and still leave the reported bug unfixed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: Refuse MCP instruction backfill from mismatched configs Self-review findings on the backfill, both in the shared-copy write: A config-tier override shadowing a YAML base keeps the base's 'yaml' source tag (`overlaySource`), so the connection manager's tier guard cannot see it, and instructions fetched from a tenant's overridden endpoint would be patched into the shared global YAML entry — reaching every other tenant's model context and persisting after the override is removed. `setResolvedInstructions` now takes the config the delivering connection was created from and compares it field-wise against the stored entry over ADMIN_CONFIGURABLE_FIELDS, refusing on mismatch. Field-wise rather than whole-object, since inspector-derived fields legitimately differ. The skip condition also only refused *identical* text, so a connection built from a stale read-through snapshot (resolvedInstructions still unset) could overwrite already-stored different text — violating the documented first-write-wins invariant and re-triggering global cache invalidation per divergence. The condition is now `!= null`. Documented the aggregate-key cross-instance write race alongside its existing tolerance for `reinspectServer`: the backfill patch fires at most once per server per registry lifetime, and the atomic-write upgrade (hash fields or Lua CAS) is the follow-up that closes the race for every writer at once. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: Scope deferred MCP instructions safely * fix: Narrow optional Keyv namespace in Redis store detection Keyv types `namespace` as `string | undefined`, so passing it straight into `FORCED_IN_MEMORY_CACHE_NAMESPACES?.includes(...)` fails `tsc --noEmit` in both cache classes — tsdown builds do not catch it, but the TypeScript type checks CI job runs tsc and would. An unset namespace (never the case after construction) now reads as not Redis-backed, which falls back to the guarded non-Lua path. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: Harden the shared-instruction gate and CAS the patch Codex round two, both verified before fixing: A configured `oauth` block slips the backfill gate whenever `requiresOAuth` is not literally true. The inspector stamps `requiresOAuth = false` on every `startup: false` server without consulting `oauth`, so the stamped population connects bare and fetches anonymously — but the gate's safety rested entirely on that stamp: a config reaching the manager unstamped gets OAuth machinery armed (`isOAuthServer` treats `oauth != null` as OAuth) while `requiresUserScopedConnection` waves it through. The gate now rejects `oauth`/`oauth_headers` outright; genuinely static servers carry neither. The registry validates config identity against a snapshot that can lag by the cache TTL, while the Lua patch checked only that `resolvedInstructions` was unset — so a replica could validate against an old entry, another replica replace it, and the patch land instructions on the replacement. `patch` now takes the validated entry's `updatedAt` and both Lua scripts (and the in-memory and fallback paths) refuse when the stored entry no longer matches: identity validation and the write are one compare-and-set. Both guards verified red-without-fix; suite 36/36. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: Loosen apiKey on the scoping config and sort imports CI caught two things local gates filtered past: `UserScopedConnectionConfig` gained `apiKey` on the strict Pick side, but raw (pre-inspection) configs carry an optional `apiKey.source` — exactly what the type's loosened intersection exists for — so `agents/initialize.ts` stopped compiling. The gate only reads `apiKey?.source`, so the loosened shape is sufficient and the TypeScript type checks job goes green again. The `canBackfillSharedServerInstructions` import landed unsorted in UserConnectionManager.ts, failing the changed-file import-sort gate. Verified with a full `tsc --noEmit` error-list diff against clean dev (zero branch-only errors) rather than per-directory counts, which is how the initialize.ts error slipped local verification. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: Make MCP aggregate writes atomic * test: Fix Redis aggregate spy assertion * fix: Reject placeholder-bearing admin keys from shared backfill Codex round three P1, verified end-to-end before fixing: processMCPEnv injects an admin `apiKey.key` into the request headers (env.ts:448) BEFORE header values get per-user placeholder resolution (env.ts:478), so a key like `{{LIBRECHAT_OPENID_ACCESS_TOKEN}}` makes the connection identity-scoped — while `placeholderBearingFields` never inspects `apiKey.key` and the gate rejected only `source: 'user'`. Instructions fetched under one user's identity could then be stored for everyone. The gate now scans the admin key value with the same runtime-placeholder predicate. Kept narrow deliberately: widening `placeholderBearingFields` itself would change `requiresUserScopedConnection` for every caller — connection pooling included — which is its own decision. Static admin keys still backfill (positive control test); both new refusal tests verified red without the gate change. Suite 39/39. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * refactor: Drop gate term covered by placeholder-bearing apiKey eb117d1b4 added `apiKey.key` to `placeholderBearingFields`, so `requiresUserScopedConnection` now rejects placeholder-bearing admin keys for every caller — connection pooling included — and the explicit scan in `canBackfillSharedServerInstructions` from the rebased 32d598692 became a duplicate of that broader check. The refusal tests stay green through the shared path alone, which also confirms the broader mechanism covers the round-three finding. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: Preserve empty arrays in Redis aggregate mutations * fix: Scope env-expanded MCP placeholders * test: Harden Redis empty-array preservation * style: Fix Redis cache static checks * test: Narrow Redis empty-array fixtures --------- Co-authored-by: Simon Guldager <sg@nobly.dk> Co-authored-by: Claude <noreply@anthropic.com>	2026-08-30 16:17:26 -04:00
Danny Avila	91cfd04f22	🏕️ fix: Restore Code Environments From Runtime Config (#15373)	2026-08-30 16:15:47 -04:00
Danny Avila	30124f21b2	🎻 refactor: Orchestrate Agent Runs Through a Request-Free Host (#15366) ... * refactor: decouple agent initialization from HTTP * refactor: centralize remote agent execution lifecycle * fix: preserve pre-settlement error rendering * fix: preserve request-backed tool loading * style: sort agent execution imports * fix: adapt public agent tool loaders	2026-08-30 15:38:57 -04:00
Danny Avila	c1cb591d49	🗿 feat: Add Attached Stateful Code Environments (#15352) ... * feat: add attached stateful code environments * fix: include code environment in lazy agent type * fix: harden stateful environment routing * fix: complete code environment route isolation * fix: declare code environment map type * fix: preserve configured code execution routes * fix: harden stateful environment updates * test: assert route-scoped sandbox readiness * fix: harden stateful environment lifecycle * fix: isolate migrated code sessions * test: assert route-qualified code sessions	2026-08-30 15:38:45 -04:00
Danny Avila	dc77b78d3e	🔇 refactor: Quiet Framework Logging in Unit Tests (#15363) ... * 🔇 refactor: Quiet Framework Logging in Unit Tests Unit test output was overwhelmingly framework log lines rather than test results. A `packages/api` run printed 9,076 lines for 434 suites; 1,596 of them were the identical `at Console.log (winston/transports/console.js:87)` frame that Jest staples onto every winston write. Three causes: - Each winston logger built its Console transport with a hard-coded `level: 'info'`. Winston resolves a transport's explicit level ahead of its parent's, so the logger's own `NODE_ENV`-derived `warn` never applied — in tests or in production. `CONSOLE_LOG_LEVEL` now drives it, defaulting to the previous `info` so deployments are unaffected. `meiliLogger` had the same hard-coded level and is routed through the same helper. - `LOG_TO_FILE` defaults on, so every Jest worker opened DailyRotateFile transports. A run left `packages/api/logs/` holding a 107KB error log, a gzipped rotation, audit JSON, and — from fake-timer suites — files dated 1969 and 2023. - Client suites carried leftover debug `console.log` in shipped source (`Test mode. Skipping silent refresh.` alone accounted for 109 blocks) plus three test-harness defects whose React error dumps buried everything else: a markdown suite rendering Mermaid with no Router, a `~/Providers` mock missing `useSearchContext` (the component's own catch swallowed the throw, so the sources path was dead while the suite passed), and `getBoundingClientRect` stubs without `left`, which made a computed `right` NaN. A shared `config/jest.setup.logging.cjs` sets the two env vars for both backend workspaces. It sets env only and requires nothing: eagerly requiring the logger froze `CREDS_KEY` into `encryptV3` before specs could set it and broke five suites. `TEST_VERBOSE_LOGS=true` restores the logs for debugging. Output per full run: packages/api 9,076 -> 770 lines (winston lines 1,596 -> 0) packages/data-schemas 2,521 -> 946 lines (winston lines 290 -> 0) client 10,384 -> 3,153 lines (console blocks 285 -> 74) Test counts are unchanged: client 476 suites / 5,827 tests green, and the Ariakit `act(...)` warnings the selector suites emitted are gone rather than suppressed. * 🔧 fix: Settle Shutdown Timers Before Counting Them `destroy()` finishes cancelling its fenced retirement timers on the tick after it resolves. The count only returned to the baseline because a console write from the logger happened to yield first — silencing that logging left four timers still pending at the assertion, deterministically failing the suite in CI's sharded, coverage-enabled run. Advance the fake clock by zero before counting, so the assertion proves the timers were cancelled rather than that something incidental yielded. * 🛡️ fix: Validate CONSOLE_LOG_LEVEL Instead of Trusting It Winston resolves a level name against the logger's level map, so a name outside it resolves to `undefined` and the transport drops every message. Passing `CONSOLE_LOG_LEVEL` straight through meant a typo (`warning`) or a stray space silently muted all console output — a misconfiguration that reads as a dead deployment. Validate against the level set, normalize case and whitespace, and fall back to the default with a warning on the way past, since the logger cannot report its own misconfiguration. The level map itself was duplicated verbatim in both loggers; it now lives in `utils` beside the validation that depends on it. * 🎚️ fix: Let CONSOLE_LOG_LEVEL Outrank DEBUG_CONSOLE `DEBUG_CONSOLE=true` forced the console transport to `debug`, so on those deployments every non-`silent` value of `CONSOLE_LOG_LEVEL` was discarded — `CONSOLE_LOG_LEVEL=error` still emitted debug and info, defeating the control it advertises. `DEBUG_CONSOLE` now only moves the *default* level and keeps choosing the debug format, so an explicit level stays in charge of verbosity. With no explicit level the resolved default is still `debug`, unchanged for existing setups. Covers the wiring with a spec that re-imports the logger per environment, rather than only testing the resolver in isolation.	2026-08-30 15:26:30 -04:00
Danny Avila	b0a559876f	🧩 feat: Collapsible Wake-Up Task Cards and Subagent UI Consistency (#15364) ... * 🧩 feat: Collapsible Wake-Up Task Cards and Subagent UI Consistency * 🧩 fix: Codex Round 1 — Shared Composer Surface, Pinned Event Tasks, Durable Wake-Up Links * 🧩 fix: Codex Round 2 — Pin Requested Event Tasks, Share Gating, Focus Return * 🧩 fix: Codex Round 3 — Promote Composer Surface to @librechat/client Semantic Primitive	2026-08-30 13:53:16 -04:00
Danny Avila	cd3768ed1f	🍵 feat: Continue Late Steers in Warm Agent Runs (#15357) ... * feat: continue late steers in warm agent runs * chore: bump agents sdk to v3.7.9 * fix: guard terminal steer admission	2026-08-30 11:54:17 -04:00
Danny Avila	180b56531a	fix: log config-blocked MCP recovery at debug instead of error (#15360) ... A server blocked by the domain policy (or any configuration that makes discovery impossible) fails recovery deterministically on every catalog request, and each attempt logged at error level. In the e2e suite, where e2e-http is deliberately policy-blocked to exercise the allowlist override flow, this produced an error line every few seconds. Discovery raises McpError InvalidRequest precisely for these config-impossible cases, so classify it in discoverCandidate and log at debug — the level this file already uses for config-proven skips — keeping error for genuinely unexpected failures.	2026-08-30 10:55:58 -04:00
Danny Avila	240e9e920f	🧺 fix: Skip Oversized and Duplicate Files Instead of the Whole Batch (#15358) ... * 🧺 fix: Skip Oversized and Duplicate Files Instead of the Whole Batch Uploading several files at once failed entirely when any single one exceeded `fileSizeLimit`: `validateFileSizes` returned false for the batch and `discardProcessedUploads()` dropped every processed upload, valid files included. Duplicates rejected the selection the same way. Adds `partitionUploads`, which splits a selection into the files that may be uploaded and the ones that cannot, and applies it at both validation points — duplicates against the raw selection, sizes against the processed files whose bytes resizing has already settled. Offenders are discarded individually and named in a toast; the rest upload. Per-file rules only: `totalSizeLimit` describes the batch as a whole, so `validateFileSizes` still enforces it over whatever survives the partition. When nothing survives, the batch keeps reporting the existing all-or-nothing errors rather than per-file skip notices, so single-file uploads are unchanged. * 🧮 fix: Count the Partitioned Selection Against the File Limit Codex round 1. `validateFiles` received the unpartitioned selection, so its `fileList.length + files.size` check spent `fileLimit` slots on files the partition was about to discard — with 9 of 10 slots taken, picking an already-attached file alongside a new one rejected both. The partition now runs first and hands `validateFiles` only the survivors, keeping the count rule in one place. A selection that loses every file still passes the untouched list through, so the batch-level checks report it in their usual order. Also stops the partition tests allocating real buffers: one case built a 500 MiB ArrayBuffer to assert a size-only branch. * 🎚️ fix: Apply the File Count to the Files That Survive Processing Codex round 2. Round 1 stopped duplicates spending `fileLimit` slots, but the count still ran before sizes were known: the pre-processing partition defers size checks, so an oversized file was counted and then discarded. With one slot left, picking an oversized file beside a valid one rejected both. The count now runs where the survivors are finally known — after the post-processing partition — through a `validateFileLimit` extracted from `validateFiles`, so both callers share one rule and one message. The two batch-composition rules the partition now owns, count and duplicates, sit behind a single `skipBatchRules` flag in place of `skipDuplicateValidation`. Selections that overshoot the limit are now processed before being rejected, where they used to be turned away up front. That is the price of counting only what will actually be attached, and matches how duplicates and sizes have always been handled in this function. * 🔕 fix: Hold Skip Notices Until the Batch Is Actually Uploading Codex round 3. The pre-processing partition announced its dropped duplicates as soon as `validateFiles` passed, but the surviving files still had to clear the file count and `totalSizeLimit` afterwards. A selection that failed there showed both "Skipped duplicate file(s)" and the batch rejection, with nothing uploaded — contradicting the notice's own contract that it describes a batch that is otherwise still going. Both partitions' skipped entries are now reported together, after the batch is known to be uploading. A selection rejected in full reports itself through the batch-level errors alone.	2026-08-30 09:04:13 -04:00
Danny Avila	2ae6c8aea9	🛎️ feat: Wake Agents on Background Tool Completion (#15350) ... * feat: wake agents for background tool completion * fix: isolate background completion contracts * fix: anchor background completion identity * fix: close background completion delivery gaps * fix: preserve manual background polling * fix: preserve legacy tool group identity * fix: close background wakeup identity gaps * test: type background wakeup enqueue mock * fix: preserve background completion identity * test: type activity phase fixture * test: mock phase media query * fix: arbitrate background result ownership * fix: retain tool step routing helper * test: expand phase groups before identity checks * fix: preserve background completion ownership * fix: bound durable background results * fix: type wakeup input budget export * chore: sort background handler imports * fix: persist timed-out background completions * fix: reconcile background completion ownership * fix: type background completion capabilities * fix: harden background completion terminalization * test: type missing completion evidence * fix: require evidence for completion retirement * chore: satisfy background completion static checks * test: cover automatic background completion wakeups * test: assert background wakeup agent identity * fix: wake capability-fenced trigger deliveries * test: keep capability shield fixture public * test: assert capability worker wakeup * fix: close background completion ownership gaps * test: satisfy completion lease static checks * fix: preserve artifact completion wakeups * fix: close background delivery recovery gaps * fix: simplify background receipt guidance * fix: recover dead background completion batches * fix: fence background completion recovery * fix: recheck background recovery ownership * fix: fence unpublished background continuations * test: await background message hydration	2026-08-30 08:56:41 -04:00
Danny Avila	e3ccaba5af	🛄 feat: Restore Compaction Guidance Across Continuations (#15356) ... * 🧭 feat: preserve compaction guidance across continuations * 🔧 fix: narrow persisted compaction fields	2026-08-30 08:13:24 -04:00
Danny Avila	b97d2868d4	🛑 feat: Cancel MCP Discovery Work at the Caller Deadline (#15353) ... * feat: cancel discovery probes and tools/list at the caller deadline deadlineMs could only be checked, never enforced: between checkpoints, the health probe's ping ran to the SDK's 60s default, an in-flight tools/list page ran to its page timeout, and a spent budget still paid for credential preparation and a publication-order reservation before anything noticed. Derive one AbortSignal per discovery from the deadline and the caller's own cancellation, and hand it to the work the SDK can genuinely cancel: client.ping (and its fallback verification) via isConnected(signal), and every tools/list page via fetchToolsSnapshot. An aborted probe reports false for that caller only and never mutates connection state, so a shared app connection stays usable for everyone else. Phases that cannot be cancelled are no longer started once the budget is spent: discovery returns before Graph preprocessing and token resolution begin, and a snapshot returns incomplete before reserving publication order. Teardown stays deliberately exempt — dispose() must finish. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: keep aborted probes honest and combine caller signals Codex round 1 on the abort threading found three gaps, all real: - An aborted ping left lastConnectionCheckAt stamped, so a dead shared connection read as healthy for the whole CONNECTION_CHECK_TTL. The probe now restores the stamp when the caller signal caused the failure; the real-SDK test closes the server after an aborted probe and asserts the next caller sees it dead. - The app-connection fast path built its signal from the deadline alone, so cancelling the originating request did not cancel a hung probe or tools/list there. One shared createDeadlineAbortSignal helper now combines both, used by the factory and the manager. - The entry checkpoint could not see a budget that expired during credential preparation; discoverToolsInternal rechecks before token resolution begins. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: consult the caller signal at discovery decision points Round 2 found the pattern left half-applied: the signal cancels SDK requests, but two orchestration points ignored it. - An app-connection probe aborted by the caller fell through to discovery fallback, opening a fresh connection for a request that no longer exists. The manager now returns before the fallback when the caller signal is aborted or the budget spent, and the caller signal travels into non-OAuth discovery too — previously only OAuth connections could carry one, so signal moves to UserConnectionContext. - fetchOrderedToolsSnapshot bounded the refresh wait by the deadline but not the signal, so a signal-only caller stayed blocked for the shared refresh's full cycle. settlesBefore now interrupts on either. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: gate every discovery checkpoint on one cancellation predicate Round 3 exposed the structural cause of the last two rounds: discovery carries the same fact in two forms — a deadline number and a signal — and each gate consulted only the deadline. isDiscoveryCancelled() is now the one predicate at the static entry, the post-preparation entry, and the pre-fallback gate, matching the manager gate and the snapshot gates that already checked both. connect() cannot carry the signal, so a signal-only abort previously waited out the full connection timeout. connectWithinBudget races connect against the timeout and the abort with owned cleanup: the timer is always cleared, the abandoned attempt's rejection is swallowed, and disposal hands whatever the dead connect still constructs to the mid-connect disposal guard.	2026-08-30 08:12:04 -04:00
Danny Avila	41c92dfd06	⏱️ fix: Bound MCP Tool Discovery With a Caller Deadline (#15346) ... * fix: bound MCP tool discovery end to end with a caller deadline connectionTimeout bounds a single connect() only. Discovery then spends it again on the unauthenticated fallback and hands tools/list its own 30s budget, so a caller working to a deadline had no way to cap the whole operation. Thread an optional absolute deadline through discovery into both connect() and the tools/list walk, and dispose a timed-out authenticated connection before the fallback opens its own socket — withTimeout does not cancel the connect it abandoned, so the two were briefly concurrent. Passive catalog recovery now sets one 3s per-server budget instead of a per-attempt timeout it could spend several times over. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: close deadline gaps in the app path, refresh wait, and disposal race Codex review of the deadline threading found three real gaps: - discoverServerTools returns through an app-connection fast path that never reached the factory, so its tools/list kept the 30s default. - fetchOrderedToolsSnapshot checked the deadline before awaiting a refresh but the refresh runs on the connection's own budget, so an in-flight one could still hold a budgeted caller for that budget. Stop waiting on it rather than adopting it. - connectClient never rechecked isDisposed after awaiting constructTransport, so a connect abandoned by its caller could assign a transport and connect after dispose() had already found nothing to close. Disposing before the fallback widened that window, so bound the attempt to its own disposal. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: close the transport itself when disposal beats connect Rewriting the disposal-race test against a real SDK server and transport exposed a defect the mocked version could not see: client.close() only closes a transport the client has adopted, and it has not adopted one when disposal lands before client.connect(). The abandoned attempt's session therefore stayed open and the reference was merely dropped. Close the transport directly before closing the client. The test now asserts the server observed the close, which fails against the previous fix.	2026-08-30 07:44:52 -04:00
Danny Avila	70f735336d	🛎️ fix: Enroll Remote Agent Runs in the Generation Lifecycle (#15349) ... * fix: enroll remote agent runs in generation lifecycle * fix: close remote lifecycle ownership gaps * fix: close remote conversation drain races * fix: fence remote runs during conversation deletion * fix: reconcile remote deletion and settlement races * fix: complete owner deletion recovery * fix: preserve remote cleanup receipts * fix: consume deletion receipts before cleanup * fix: expose idempotent deletion option * chore: sort remote lifecycle imports	2026-08-30 07:14:13 -04:00
Dustin Healy	8fcab7e44f	🔄 fix: Recover Missing MCP Marketplace Catalogs (#15323) ... * fix: recover missing MCP marketplace catalogs * fix: make MCP catalog recovery passive * test: type MCP catalog recovery fixtures * fix: bound and back off passive MCP catalog recovery Passive recovery runs inline on `GET /api/mcp/tools` and its results are request-local by design, so every list request re-dialed the same cold servers with the default connection timeout. Three limits keep that cost proportional to what recovery can actually recover: - Cap the discovery timeout at 5s instead of inheriting the connection default (`initTimeout ?? 30s`); a server configured to connect faster keeps its own shorter limit. - Skip a server the config tier already marked `inspectionFailed`, leaving it to that tier's retry window rather than re-dialing it per request. - Skip a server whose declared `customUserVars` are unset, matching the gate `reinitMCPServer` applies for issue #10969 — connecting without them fails auth, so the attempt is spent for nothing. Servers that still fail discovery enter a one-minute per-process cooldown, which is what stops an unreachable server from being re-dialed by every subsequent list request. A server that recovers clears its own entry, and expired entries are swept at most once per window so the map stays bounded. Skipped servers render exactly as they did before recovery existed: present in the catalog with an empty tool list. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: bound passive MCP recovery by deadline, key cooldowns by config Both follow-ups address the same mistake: recovery expressed its own request-level constraints in terms borrowed from other layers. `connectionTimeout` bounds one connection attempt, and `MCPConnectionFactory.discoverToolsInternal` spends it twice — once on the authenticated connection, then again in `attemptUnauthenticatedToolListing` — so capping it bounded no total this layer could reason about. Recovery now enforces its own wall-clock deadline per server with `withTimeout`, which holds however many attempts the factory makes; `connectionTimeout` is left to do only its own job, still honouring a shorter operator `initTimeout`. An attempt abandoned by the deadline disposes its own connection when it settles, and `Promise.race` keeps a handler on it, so a late rejection is not unhandled. A per-request budget now caps total recovery regardless of server count. A server is dialed only if the remaining budget can fund a full deadline; never dialing one is not evidence against it, so a skipped server records no cooldown and a later request reaches it once those ahead are cached or cooling down. Cooldown identity now includes the publication generation — the same effective-config identity the tool caches fence on — instead of just user and server name. Correcting a server's URL or transport keys a new entry, so the refetch the client issues on update is no longer skipped for up to a minute by the previous configuration's failure. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * refactor: keep passive MCP recovery stateless and bounded by its own work Reverts the cooldown, request budget and deadline race added in 257d5cf and fc3e3c9, and keeps only the three stateless limits. The tool cache refuses unfenced writes (`tools.ts`), and a discovery connection owns no publication generation and is disposed, so a recovered catalog cannot be retained by design. Those commits responded by building a cache-shaped memory in front of it — per-process failure state, a scheduling budget, an identity, an eviction sweep — and each round of review found another way that hand-rolled cache differed from a real one: wrong identity for configuration, wrong identity for credentials, no fairness across requests, and a limiter slot released while its network operation was still running. None of that machinery was asked for; all of it was compensation for a result the architecture does not allow keeping. Recovery is now stateless. It skips only what configuration alone proves pointless — a server the config tier already marked `inspectionFailed`, and one whose declared `customUserVars` are unset — and bounds the work itself rather than racing it, so a limiter slot is held for exactly as long as its network operation runs and the concurrency limit of three is real. The attempt timeout is not a compromise: recovery exists for a server that is reachable and authorized but whose catalog cache expired, and such a server answers tools/list well inside 1.5s. Anything slower cannot be rescued here, so failing fast costs nothing. The factory spends that value per attempt, so a server's ceiling is it times the attempts made; the constant documents that rather than hiding it behind a number tuned to today's attempt count. Consequences that were bugs are now gone by construction: every cold server is attempted on every request, so none is starved by those ahead of it, and correcting a server's configuration or credentials takes effect on the next refetch instead of waiting out a stale cooldown. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: correct the inspection-failure skip and bound catalog fan-out Three fixes that belong to this layer; a fourth issue does not, and is described below. The `inspectionFailed` skip was too broad. `MCPServersInitializer` stores a YAML server that was unreachable at startup via `addServerStub`, which stamps `source: 'yaml'`, and only config-tier entries get the timed retry in `ensureSingleConfigServer`. Skipping every failed stub therefore hid a recoverable server from the marketplace permanently — the exact state this recovery exists to escape. It now defers only `source === 'config'`, matching what `reinitMCPServer` already does. Plugin auth is read only when some cold server actually declares `customUserVars`, and only for those servers. The common unauthenticated case no longer pays a MongoDB round trip whose result nothing can consume. Snapshot refreshes are now bounded by the same limiter as discovery. They are not local reads: both connection paths reach `fetchOrderedToolsSnapshot` and issue a real `tools/list`, so a cache reset across many servers previously burst unbounded outbound requests while discovery was capped at three. Not fixed here, because it cannot be: `connectionTimeout` does not bound discovery. It covers `connection.connect()` only, and `fetchToolsSnapshot` then applies its own `TOOLS_LIST_TIMEOUT_MS` (30s) to `tools/list`, so a server that connects fast and stalls while listing still holds its slot for that window. The factory also does not cancel a timed-out connect before starting the unauthenticated fallback. Bounding this end to end needs a deadline threaded through `MCPConnectionFactory` into both `connect()` and `fetchToolsSnapshot()`, which is a change to shared connection machinery rather than to this caller. The constant's comment now states what it does and does not bound instead of implying an end-to-end guarantee. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B * fix: thread live-session OBO context into passive catalog discovery The merge of #15334 sources OBO tokens from the live OpenID session via request-boundary closures. Passive catalog recovery is a discovery call site too; without these options an OBO server whose stored token went stale fails recovery — the exact cold-catalog class this PR fixes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Xr1Dabvdn1mzzyYgpJgU5B --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-30 06:55:30 -04:00
Danny Avila	36f129089b	🔊 fix: Autoplay Latest Message for Browser TTS and short responses (#15347) ... * 🔊 fix: Autoplay Latest Message for Browser TTS and short responses Automatic playback never reached the Web Speech API and dropped audio for short responses. Two independent defects: Autoplay ignored the selected TTS engine. `ChatForm` mounted `StreamAudio` whenever automatic playback was on, and that component always POSTs to `/api/files/speech/tts`, so the Browser engine silently fell through to the external endpoint and `speechSynthesis.speak()` was never called. The engine-aware `useTextToSpeech` hook had no consumers. Autoplay now selects its driver by engine the same way `MessageAudio` does, with the gate shared between both drivers so they trigger on identical terms. `MediaSourceAppender` stranded its queue. `tryAppendNextChunk` only ran from `addData` and `updateend`, while `sourceopen` — which fires only once a media element attaches the object URL — created the `SourceBuffer` without draining what had queued up behind it. A response read in full before that event left every chunk in the queue with no `updateend` to ever restart the drain, so the element sat at `readyState: 0` and never played. Short responses lost the race; longer ones streamed past `sourceopen` and worked. The handler now drains, and `close()` (previously never called) ends the stream once the queue empties. Also in the same path: the error branch had its timeout comparison inverted, so real failures were logged as timeouts and swallowed; and the non-MSE fallback that hands the element a finished blob lived inside the cache-only branch, leaving browsers without MSE support for `audio/mpeg` with no audio at all unless Cache TTS happened to be enabled. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184N7d9kgpdqmbCb9ujMmNX * 🧹 style: Sort imports in autoplay files `npm run sort-imports:check` on the changed files. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0184N7d9kgpdqmbCb9ujMmNX * 🔇 fix: End the media source when no audio ever arrives Codex P2 on #15347. The `hasAppended` guard in `tryEndOfStream` was defensive against a throw that cannot happen: `endOfStream()` only raises `InvalidStateError` while the source is not open or a buffer is updating, both of which the remaining guards already cover. Nothing about an empty buffer throws. The guard's actual effect was to strand the two cases it was meant to protect. A TTS response that completes with zero bytes, or a read timeout that fires before the first byte, both reach `close()` with the MediaSource URL already attached to the element — and left it `open` forever, so the element waited on a source that could never receive data and kept its streaming resources	2026-08-30 06:54:16 -04:00
Danny Avila	16c2bb4149	📬 feat: Establish Background Continuation Admission (#15348) ... * feat: establish background continuation admission * fix: preserve routed subagent wakeup controls * fix: probe configured subagent task store	2026-08-30 06:51:36 -04:00
Danny Avila	4d5126976a	🪭 fix: Settle Parent Phase Cards Without Replaying the Entrance Fold (#15345) ... * 🪭 fix: Settle Parent Phase Cards Without Replaying the Entrance Fold When the final event swaps in the server's compacted content and the streamed-index stamp cannot pair the two arrays, every index-derived key shifts and each already-settled phase card remounts as "new" — replaying its entrance fold over content the reader already watched fold. Guard the entrance by label text as well as render key, so a re-keyed marker whose text was already on screen mounts settled. Also stop tool-call groups from auto-expanding when they remount inside a completed phase card: the phase summary already speaks for the activity, so a group toggling open and shut mid-entrance only adds jitter. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FZjLZhhpjX7XQXwVSkY42c * 🪭 fix: Count Repeated Phase Labels and Keep Pending Approvals Reachable Codex review follow-up: a run can legitimately generate two phases with identical summaries, so the entrance guard now counts label-text occurrences instead of remembering texts — a grown count animates, a settle-time re-key does not. And a pending approval overrides the phase-internal collapse default, since a phase can resolve while an approval inside it still blocks the run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FZjLZhhpjX7XQXwVSkY42c * 🪭 style: Sort ContentParts Imports for the Static Check Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FZjLZhhpjX7XQXwVSkY42c * 🪭 fix: Pair Repeated Phase Labels by Occurrence Across a Re-Key Codex round-two follow-up: the aggregate label count applied to every marker, so a settle that re-keys existing phases while landing a new same-text one replayed every card's entrance. Each marker now carries its occurrence ordinal and animates only past the previously rendered count for its text. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FZjLZhhpjX7XQXwVSkY42c * 🪭 fix: Engage the Phase Label Heuristic Only When a Key Vanishes Codex round-three follow-up: key identity stays authoritative for pure additions, so a marker filling out of order behind an already-rendered same-text twin animates; the text-occurrence pairing now applies only when a previously rendered key has vanished — the signature of a settle-time re-key. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FZjLZhhpjX7XQXwVSkY42c --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-30 01:25:37 -04:00
Ayush Verma	6425837269	👔 fix: Route Flux Finetuned Endpoints Regardless of Action (#15336) ... FluxAPI._call() only dispatched to generateFinetunedImage() when action was explicitly "generate_finetuned". If a model set endpoint to /v1/flux-pro-finetuned or /v1/flux-pro-1.1-ultra-finetuned while leaving action at its default ("generate"), the request went through the plain generate payload path instead, which never forwards finetune_id, finetune_strength, or guidance. The finetune was silently dropped and a finetuned endpoint was called without its required finetune_id. Route by endpoint as well as action, and share the finetuned-endpoint list between the dispatcher and generateFinetunedImage's own validation. Fixes #15335	2026-08-30 00:04:06 -04:00
Danny Avila	fa913148fb	🔒 fix: Refresh MCP OBO Tokens From the Live OpenID Session (#15334) ... * 🧊 fix: Inline-refresh OpenID session tokens at MCP OBO call time Resolves the walk-away failure mode where MCP tool calls using OBO auth fail with "No valid OpenID access token is available for OBO exchange" after a user idles past their access-token lifetime. The strategy-time snapshot on `user.federatedTokens` could expire mid-stream before `resolveOboToken` ran, while `req.session.openidTokens` carried a still- valid (or refreshable) token that nothing read. - New OpenIDSessionRefresh service: per-user single-flighted closure that reads `req.session.openidTokens` at OBO time and inline-refreshes via `openid-client.refreshTokenGrant` when expired (30s skew), persisting via `req.session.save()`. No cookie writes (headers already flushed). - `resolveOboToken` gains a required UpstreamTokenProvider parameter (typed as `() => Promise<OIDCTokens | null>`, reusing the shared shape from @librechat/data-schemas). Compile-time guarantee that every call site is updated. - New `session_refresh_failed` OboTokenResolutionReason distinguishes "session expired and IdP rejected refresh" from "no upstream token ever existed." - `req` threaded through createMCPTool/createMCPTools/createToolInstance to construct the closure with captured request, plus fail-closed guards in MCPConnectionFactory.getOboTokens and MCPManager.callTool when the closure isn't plumbed. - Startup warning in MCPServersInitializer when OBO is configured but OPENID_REUSE_TOKENS is unset (the strategy populating user.federatedTokens is only registered under reuse, so OBO would fail every call without it). Tests: 16 new in OpenIDSessionRefresh.spec.js; obo.spec.ts extended for the new param + error reason; wiring smoke tests in MCPManager, MCPConnectionFactory, MCPServersInitializer, and MCP.spec.js. * 🛡️ fix: Harden OBO inline-refresh against token type and session edge cases - Token-preference asymmetry: live-token reuse and expires_at derivation now strictly gate on the access_token, not the id_token. Added a required `tokenPreference` parameter on isLiveSessionTokenStillValid, buildOIDCTokensFromSession, and createOpenIDSessionTokenProvider so every call site is explicit. Dropped the bogus id_token-exp fallback in performIdpRefresh — id_token TTL is governed by IdP session policy and would mark a short-lived access_token reusable past its real lifetime. - Missing req in /reinitialize route: the manual reconnect endpoint now forwards req into reinitMCPServer, so OBO servers can build a session-aware upstream-token closure instead of failing with missing_upstream_token. - Single-flight key collisions: composed key as tenantId:openidIssuer:openidId:sessionId via getSingleFlightKey. Concurrent calls in the same session still coalesce; separate sessions never share an in-flight refresh, preventing refresh-token rotation from breaking sibling sessions and preventing cross-tenant token crossover when distinct users share an IdP sub. - Opaque access token reuse): persist accessTokenExpiresAt (unix seconds, from tokenset.expires_in) on each refresh AND on initial login / SPA refresh in setOpenIDAuthTokens. New getAccessTokenExp helper falls back to it when the access token isn't a JWT, avoiding redundant inline refreshes for Microsoft Graph and Auth0 default audiences. - Log hygiene: the single-flight key (containing sessionId, openidId, openidIssuer, tenantId) is now SHA-256-hashed in the "Joining in-flight refresh" debug log. Preserves cross-line correlation via a 12-char prefix without leaking credential or PII material. Documented req.session.openidTokens shape contract via JSDoc typedef so the new accessTokenExpiresAt field has a discoverable home alongside the existing accessToken/idToken/refreshToken/expiresAt/lastRefreshedAt. Tests: OpenIDSessionRefresh.spec.js up to 30 passing (added coverage for opaque-token reuse, JWT-access-token-exp fallback, no-id_token-fallback regression, cross-session no-coalesce, persistence on refresh, and a guard against stale accessTokenExpiresAt carryover). AuthService.spec.js adds two cases covering accessTokenExpiresAt persistence on login. mcp.spec.js (route) gains a regression test asserting req flows into reinitMCPServer. * 🔍 fix: Detect OBO-only MCP admin config overrides Admin Config overlays for YAML-defined MCP servers compare only ADMIN_CONFIGURABLE_FIELDS to decide whether to lazy-init a config-tier override. The OBO config field was added after that fingerprint list, so an override that only added or changed `obo` was treated as unchanged YAML and skipped. Include `obo` in the admin-configurable field list and add a regression test for an OBO-only override. * 🔊 fix: Mock MCP OAuth timeout in SDK integration test MCPConnectionFactory.attemptToConnect reads mcpConfig.OAUTH_HANDLING_TIMEOUT when building the OAuth connection timeout. The SDK OAuth integration test mocked mcpConfig without that field, which made the timeout calculation produce NaN and caused the test to fail before the OAuth refresh/start path completed. Add OAUTH_HANDLING_TIMEOUT to the test mock. * ♻️ refactor: Pass OBO upstream-token closure into MCP instead of req Build the OpenID upstream-token provider at the request boundary and thread only the closure through MCP handling, so the MCP service layer no longer receives the raw Express request. The closure still reads/refreshes the live session at tool-call time, preserving the walk-away recovery. - Drop `req`/`capturedReq` from createMCPTools, createMCPTool, reconnectServer, createToolInstance, and reinitMCPServer; forward `upstreamTokenProvider` instead. Closure is constructed in loadTools, loadToolDefinitionsWrapper, and the reinitialize route, where req/res are in scope. - OBO: fall back to user.federatedTokens when the provider yields no live session, so OIDC remote-agent calls (verified bearer, no session) still work. - Inline refresh: mirror a rotated refresh token to the refreshToken cookie via a shared setRefreshTokenCookie helper, guarded by !res.headersSent (no-op on the streaming path; session copy stays authoritative). - Single-flight: hydrate a joining request's own session from the resolved tokens so a later OBO call doesn't replay a rotated-away refresh token. Addresses owner feedback and three review findings. * 🔒 fix: Recover OIDC refresh-token rotation after SSE OBO refresh When an inline OBO refresh rotates the OpenID refresh token after SSE headers have already been sent, the browser refreshToken cookie cannot be updated. Store a short-lived encrypted bridge from the stale cookie token to the rotated token so /api/auth/refresh can recover after express-session loss. Use the signed openid_user_id cookie to load user context for bridge validation, retry only on invalid_grant, and delete the bridge only after the bridged refresh succeeds. * 🔨 fix: hydrate joined OIDC refresh sessions with stable refresh tokens Update single-flight OIDC refresh joiners whenever refreshed access token state changes, even if the IdP keeps the refresh token unchanged. This prevents joined requests from retaining stale accessToken or accessTokenExpiresAt values and redundantly refreshing later in the same run. * 🌉 Persist OIDC refresh-token recovery bridges in MongoDB Store SSE OBO refresh-token recovery bridges in MongoDB instead of process-local memory so /api/auth/refresh can recover after worker restarts or cross-worker routing. Derive bridge expiry from REFRESH_TOKEN_EXPIRY so the recovery window matches the stale refreshToken cookie it repairs, and delete bridges after successful recovery. * 🤝 Coordinate OIDC inline refreshes across workers Add a short-lived Mongo-backed refresh-flight record so concurrent OBO refreshes for the same OpenID session do not redeem the same rotating refresh token on different workers. The winning worker performs the IdP refresh and stores an encrypted result; joiners wait for that result, hydrate their request session, and return without calling the IdP. * ⚓ Keep OpenID marker cookies aligned on inline refresh Refresh token_provider and openid_user_id with the same expiry as the rotated refreshToken cookie when an inline OBO refresh can still write headers. Share the marker-cookie writer with the normal OpenID auth refresh path so the fallback /api/auth/refresh branch continues to recognize valid OpenID refresh tokens after session expiry. * 🔑 fix: include refresh token in OIDC local refresh flight key Key the process-local OIDC refresh coalescing by the current session refresh token, matching the Mongo-backed flight key. This prevents a request with a newly rotated token from joining an older pending refresh and inheriting its failure/result. * 🌉 fix: store OIDC refresh bridge without cookie response Treat missing or non-cookie responses like headers-sent streaming responses during inline OIDC refresh. When the IdP rotates the refresh token and cookies cannot be written, persist a recovery bridge so a later /auth/refresh can recover after session expiry. * 🫙 fix: preserve stale OIDC cookie bridge key Track the refresh token last written to the browser cookie separately from the current session refresh token. When inline OIDC refreshes rotate tokens without a writable response, keep bridging from the browser-stale token directly to the latest session token. * 🙌 fix: keep OIDC bridge recovery success on cleanup failure Make refresh-token bridge cleanup best-effort after a bridged OIDC refresh succeeds. A transient delete failure now logs a warning but does not convert the already-refreshed session and cookies into a 403 response. * 📦 test: Exclude RefreshTokenBridge from tenant-isolation coverage Add RefreshTokenBridge to the tenant-isolation coverage allowlist because refresh bridge lookups run during unauthenticated OpenID refresh recovery. The controller first recovers user context from the signed OpenID marker cookie, then the bridge methods apply explicit user and tenant filters. Ambient tenant isolation would bind this recovery path to request-local tenant context that is not available at the point the stale cookie is being resolved * ⚡ Fix OpenID refresh flight retry and marker hydration Allow failed OpenID refresh flights to be reclaimed immediately instead of pinning transient errors. Preserve the browser refresh-token marker when joined refreshes hydrate session tokens from a shared flight result. Stabilize AuthService tests by isolating mocked module imports from prior suites. * 🛠️ fix: centralize OBO identity scoping Add shared auth identity helpers for app user ids, OpenID subjects, tenant ids, and normalized OpenID issuers. Thread a non-placeholder-visible OBO identity context from the real request user through MCP connection, tool-call, reinit, and refresh paths. Keep tenantId and openidIssuer out of createSafeUser so MCP user placeholders do not expose those fields. Scope OBO token cache and in-flight exchange keys by tenant, issuer, OpenID subject, scopes, and a SHA-256 hash of the upstream assertion. This prevents cross-tenant/cross-issuer collisions and avoids reusing tokens minted from stale rotated assertions. Use the shared identity helpers for OpenID refresh-flight keys and refresh-token bridge recovery records so related OBO refresh paths share the same identity normalization rules. The helper is intended for auth-boundary and credential-cache code, not as a blanket replacement for ordinary app user id ownership checks. * 🛠️ fix: preserve OIDC refresh-token sync on save failures Sync OpenID refresh-token cookie/bridge state before persisting the session so a transient session-store failure cannot lose an IdP-rotated refresh token. Also trigger sync when the session refresh token differs from the browser refresh-token marker, not only when the current grant rotates the token. This lets later writable refreshes repair stale browser cookies left behind by SSE refreshes. Route refresh bridge identity through the shared identity helper with the threaded OBO identity context, falling back to request/user context when needed. Add regression coverage for session-save failures, stale browser cookie repair, non-writable bridge storage, and shared-helper identity fallback. * 🛠️ fix: keep OIDC refresh bridge during recovery grace After successful bridged refresh recovery, re-store the stale-cookie bridge with a short grace TTL instead of deleting it immediately. This lets parallel /api/auth/refresh requests that already sent the stale browser cookie recover before they can observe the first response's Set-Cookie. Retarget the bridge to the refresh token returned by the bridged retry so B-to-C refresh-token rotation remains recoverable. The grace TTL is parsed with math() and defaults to 60s, which shrinks the replay window from the original REFRESH_TOKEN_EXPIRY bridge lifetime to the short recovery grace period. Remove the now-unused explicit bridge delete path from the service and data-schemas method surface. Add regression coverage for grace re-store, identity symmetry, retry failure behavior, and same-key upsert replacement. * 🛠️ fix: fail closed on OBO MCP user identity mismatch Add an OBO-specific guard before MCP tool execution that requires the effective invocation user and captured request user to both have ids and to match. This prevents OBO tool calls from falling back to a separate configurable.user_id identity after request-bound OBO context has already been captured. Keep the existing user id fallback behavior for non-OBO MCP calls. Tests cover mismatched OBO users, missing user ids, and the matching-user path ignoring a conflicting configurable.user_id. * 🛠️ fix: Guard OpenID bridge retry user identity Extract the shared OpenID refresh/user-resolution flow in AuthController so the normal refresh path and bridge-recovery retry use the same grant, claims, issuer, user lookup, and diagnostic logging code. Preserve the existing path-specific behavior: the normal path still owns migration updates and 401 login redirects, while the bridge retry still falls through to the existing 403 invalid-token response. Add a bridge-recovery guard that rejects retry results whose resolved user id differs from the signed openid_user_id cookie before issuing tokens or re-storing the grace bridge. Cover both the successful matching-user recovery and the mismatched-user rejection. * 🛠️ fix: type-safety polish on OBO data layer Replace refresh token bridge query/update Record<string, unknown> usage with typed Mongoose FilterQuery and UpdateQuery definitions. Harden OpenID marker cookie JWT expiry handling by converting refresh expiry milliseconds to integer seconds and rejecting invalid or non-positive durations. Add focused CSRF tests for fractional refresh expiry values and invalid expiry configuration. * 🛠️ fix: Bind OpenID session tokens to authenticated identity Stamp OpenID session token state with the LibreChat user id, OpenID subject, tenant id, and normalized issuer when tokens are stored. Fail closed before OBO inline token reuse/refresh when the session token identity does not match the current authenticated identity, preventing a stale or mixed Express session from supplying another user's upstream assertion. Also validate the normal /api/auth/refresh session-token reuse shortcut against the signed marker-cookie user before returning cached session tokens. Note: sessions created before this change carry no identity stamp and are treated as a mismatch. This is self-healing — the reuse path forces a full IdP refresh (which re-stamps the session) and the OBO path throws, surfacing as a one-time re-authentication for active OBO users at deploy time. The session re-stamps within one session lifetime (SESSION_EXPIRY, default 15 min). * 🛠️ fix: Recover OpenID refresh token drift Prefer the browser refresh-token cookie when it differs from the server-side OpenID session state, and force a real IdP refresh in that case instead of reusing stale session tokens. Store a short-lived refresh-token bridge when inline OBO refresh writes a rotated browser cookie but session persistence fails, so follow-up refreshes can still recover from the old token. Keep the bridge grace TTL centralized in RefreshTokenBridge so both recovery paths use the same env-backed value. Note: drift is measured against the last-synced browserRefreshToken marker, so the SSE path (intentionally stale cookie, authoritative session) does not false-positive. Sessions predating the marker have no browserRefreshToken; for those, drift falls back to comparing the cookie against the session refresh token and prefers the cookie on difference. This is the same self-healing pre-change-session window as the identity binding fix and re-syncs within one session lifetime. Tests cover cookie/session drift selection, reusable-session bypass on drift, bridge storage after session-save failure, and the shared bridge constant wiring. * 🛠️ fix: Harden OBO token caching and expiry handling Reject malformed OBO grant responses before writing them to the exchanged-token cache so a missing access_token cannot poison the cache. Store absolute expires_at values with cached OBO tokens and ignore legacy cache entries without usable expiry metadata. This keeps cached-token freshness based on the token’s real remaining lifetime instead of reusing the original relative expires_in on cache hits. Move OBO expiry normalization and skew helpers into packages/api and use them from both the JS exchange service and the TS MCP resolver. Apply a 30-second safety margin with a one- second floor for short-lived tokens, covered by direct helper tests and caller-level regression tests. Tests: - packages/api: npm run build - packages/api: npx jest src/mcp/oauth/expiry.spec.ts src/mcp/oauth/obo.spec.ts - api: npx jest server/services/OboTokenService.spec.js * 🛠️ fix: Harden OBO refresh-token bridge lookup and indexing Reuse getValidOpenIDReuseUserId for the bridge-recovery user lookup in refreshController instead of re-verifying openid_user_id inline. The shared helper enforces the JWT_REFRESH_SECRET presence check and a strict typeof payload.id === 'string' guard, rejecting tokens whose id claim is present but not a string (e.g. a numeric id) that the inline check accepted. Fail closed on issuer mismatch in getRefreshTokenBridge. Both the stored and the expected issuer are now normalized and compared for equality, so a bridge is recovered only when both sides agree (both absent, or both present and equal after normalization). Previously the check was skipped whenever the stored issuer was absent, allowing recovery across mismatched issuer context. Drop the unused {oldRefreshTokenHash, userId, tenantId, openidIssuer} index and the openidIssuer field on RefreshTokenBridgeQuery. The data-layer filter only queries the 3-field {oldRefreshTokenHash, userId, tenantId} index; the issuer is verified in application code, not the query. Hoist the repeated model accessor into getRefreshTokenBridgeModel. Note: issuer is now load-bearing for recovery. A bridge stored with an issuer recovers only when the lookup supplies a matching issuer; the recovery lookup reads user.openidIssuer via AUTH_REFRESH_USER_PROJECTION (an exclusion projection that retains the field). If a user's persisted openidIssuer is empty while the stored bridge has one, recovery fails closed (falls through to normal re-authentication) until the bridge TTLs out — no security regression. Tests cover invalid signed-cookie payloads bypassing the bridge, both asymmetric issuer-presence cases, issuer normalization before comparison, and an index-alignment assertion guarding against re-adding the dropped index. * 🛠️ fix: Degrade OBO discovery on token resolution failures Catch expected OboTokenResolutionError failures during MCP tool discovery and fall back to unauthenticated tool listing instead of aborting discovery. This keeps discovery aligned with the existing unauthenticated listing behavior while preserving unexpected errors as real failures. Also correct OBO tool-call freshness comment and tighten the OBO trust-check permissions type to the existing role permission shape. Tests: - npx jest src/mcp/__tests__/MCPConnectionFactory.test.ts --runInBand --coverage=false - npx jest src/mcp/oauth/obo.spec.ts --runInBand --coverage=false * 🛠️ fix: tighten OBO tool-call errors, bridge logging, and flight typing Move resolveToolCallUserId inside the tool-call try/catch so an OBO identity mismatch surfaces with serverName/toolName context and the standard tool-call-failed message instead of an opaque bare Error. Raise the refresh-token bridge lookup failure log from debug to warn so transient infrastructure failures on the unauthenticated /api/auth/refresh path are observable, and guard the message access against non-Error values. Replace the unknown+cast in isDuplicateKeyError with a hasErrorCode type predicate so the duplicate-key check reads error.code without an assertion. Preserve real math/isEnabled in the MCPConnectionFactory test mock (mock only processMCPEnv) so mcpConfig timeouts no longer resolve to NaN, fixing the TimeoutNaNWarning that masked slow OAuth retry behavior. * 🧪 fix: Restore the Flight Uniqueness Index and Buffer the Graph Cache TTL Two CI failures on the merge, both in suites this environment cannot run (their MongoDB binary download is blocked). `GraphApiService.spec.js` still asserted the unbuffered TTL. Graph tokens route through the same `getTokenCacheTtlMs` as the OBO and openidStrategy caches, so the entry now expires 30s before the credential does. `openidRefreshFlight.spec.ts` dropped the database between tests, which takes the indexes with it, and Mongoose builds them only once when the model is compiled. Whether the unique `key` index survived into a test was a race with that one-time build. Without it a second `create` inserts instead of raising a duplicate-key error, so every worker believes it won the flight — the mutual exclusion the file exists to prove. Indexes are now rebuilt after each drop, which also makes the reclaim and complete cases reach those paths for the right reason. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: address OBO review findings * 🔐 fix: Install Bridge Indexes and Carry OBO Through Assistant Recovery Two findings from the Codex pass on d08c82f0d. The refresh-token bridge relied on Mongoose auto-indexing for both of its indexes, and `MONGO_AUTO_INDEX=false` is a supported deployment setting. A bridge holds an encrypted refresh token and the TTL index is the only thing that ever deletes one, so under that setting they would accumulate for the life of the collection while concurrent upserts lost the compound uniqueness the filter assumes. Installed before the first write, matching the flight methods and the session and schedule methods before them. `recoverServerTools`, the assistant create/update path that reruns `reinitMCPServer` when a referenced server's catalog and connection snapshot are both missing, was the last reinit site not carrying the upstream-token closure. For an OBO server the factory rejects the connection outright, so the assistant write failed with unavailable MCP definitions. It now builds the provider at that request boundary like the other entry points; assistant writes have no `res`, so a rotation there falls back to the recovery bridge. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: harden OBO refresh coordination * ⏳ fix: Keep Elapsed Expiries Elapsed and Revoke the Superseded Session Two of the five findings from the Codex pass on fcdc15885 — the two that are defects in code this branch introduced rather than design questions about the bridge. `getSkewedTokenExpiresAtMs` floored every result at a second in the future, including an expiry the provider had already declared elapsed. An exchange answering `expires_in: 0` or a past `expires_at` was handed to the MCP connection stamped valid for another second, which only moves the failure downstream. The floor now applies to a lifetime that is still live, which is what it was for; an elapsed one stays elapsed so the caller rejects it. Same for the cache TTL, which falls back to the elapsed-credential floor. Bridge recovery left the stale token's durable Session behind. Only the token it recovered through was passed as `existingRefreshToken`, so that one's session was replaced while the token the browser actually presented kept its record until its original expiry. That record, with the marker cookie still bound to it, is what authorizes local image access for OpenID users — so a copy of the stale cookie outlived the rotation it had lost. Revoked explicitly on successful recovery. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: close OBO refresh review findings * 🎟️ fix: Carry the Bridged Token Through a Non-Rotating Recovery Bridge recovery passes the browser's stale token as `existingRefreshToken` so the durable Session naming it is the record replaced. That also makes the stale token the fallback the installed session and the refresh cookie use when a tokenset carries no `refresh_token` of its own, which holds only while the recovery grant rotates. An IdP that answers that grant without rotating sends the browser back to the very token the bridge exists to retire: `storeOpenIDSession` installs and deletes the same stale record in one call, and the cookie is rewritten to a token the IdP already rejected — a sign-out on the next refresh. The grace bridge one line above already guards this with `|| bridgedRefreshToken`; the resolved tokenset now does the same, so leader and followers alike publish the recovered token. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * 🚫 fix: Reject an OBO Exchange That Returns an Expired Credential Preserving an elapsed expiry through the skew helper only helps if something acts on it, and nothing did: `MCPManager.callTool` checks the access token and nothing else before setting the Authorization header, so a credential the IdP declared spent still went downstream to fail there. It is rejected at the exchange now, where the reason is known, and retryably — the exchange itself worked, so a fresh grant can succeed. Completes the elapsed-expiry change in cb26a6f7d, which made the stamp honest without giving anyone a reason to look at it. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: close OpenID refresh review findings * fix: coordinate OpenID refresh entry points * chore: sort OpenID flight imports * fix: fence OpenID refreshes during logout * fix: close OpenID logout publication races * fix: narrow completed refresh flight * test: cover bridge cleanup failure after ownership loss The compensating delete in storeRefreshTokenBridgeWithLease swallows its own failure so the lease error stays the one the caller sees. Nothing asserted that, so removing the inner catch left every suite green while callers began receiving the cleanup error instead. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: compensate OpenID bridges only on proven ownership loss The post-write lease assertion deletes the bridge it just published when it throws, but it threw for two different reasons: a coordination record that is no longer ours, and a coordination read that simply failed. Treating the second as the first destroys the only mapping from the token the browser still holds to the one the IdP already rotated to, so a transient Mongo error on the headers-already-sent path signed the user out. Tag the ownership error where the lease raises it and compensate only for that, preserving the bridge whenever ownership is merely undetermined. A preserved bridge stays behind the logout revocation fence, so the safe default costs nothing. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: reject spent OpenID refresh results Two ways a refresh could report success while handing back a credential nothing can use. An inline refresh carries the previous id_token forward when the IdP omits one on rotation, so tokenset.id_token is not necessarily freshly issued. setOpenIDAuthTokens applied its freshness guard only to the session copy and took tokenset.id_token unconditionally, so /refresh returned an expired bearer even though the grant produced a usable access token. Skip it only when it is provably expired: an id_token whose expiry cannot be read stays preferred, since access_token may be opaque or scoped to another audience. normalizeExpiresIn preserves a zero or negative lifetime rather than discarding it, so a grant declaring an already-spent access token still published, rotating the refresh token and returning a token every freshness check rejects. Each OBO call then repeated the grant. Reject an elapsed lifetime before publishing; an unknown lifetime still publishes. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * fix: harden OpenID refresh publication * fix: keep identity and results intact through OpenID refresh cleanup Two follow-ons from the last round's fixes. Stripping an expired carried-forward id_token from the refresh result removed the only identity material a rotation without id_token leaves behind. The result is rebuilt by buildOIDCTokensFromSession, so it carries no provider claims() either, and getTokenClaims accepts only those two — bridge recovery failed with "no usable identity claims" before setOpenIDAuthTokens could hand back the fresh access token. The stripped token now travels in a non-enumerable marker, alongside the existing browser and predecessor markers, which identity resolution reads and the authentication response never sees. The lease drained a pending renewal by awaiting it in finally, so a transient coordination failure there threw from finally and replaced the operation's result. The refresh had already settled and published, so the caller saw a failure on credentials that had rotated. Proven ownership loss is recorded on ownershipLost and checked before the return, so the drain has nothing to add but noise; it now absorbs and logs. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SxKWxwqxAGckYpRsYTqx3F * refactor: fence OpenID recovery publication * fix: close OpenID publication transaction * refactor: make OpenID publication transactional * fix: satisfy OpenID publication type checks * fix: fence OpenID session publication * fix: authorize OpenID refresh publication * fix: bind OpenID replay generations * fix: fence OpenID response generations * fix: authorize OpenID token delivery * fix: linearize OpenID publication delivery * chore: sort OpenID refresh flight imports --------- Co-authored-by: J.C. Bartle <jcbartle@users.noreply.github.com> Co-authored-by: jbartle <jbartle@rand.org> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: jcbartle <7274202+jcbartle@users.noreply.github.com>	2026-08-29 23:55:58 -04:00
Danny Avila	10981b8637	🍱 feat: Guide Compaction With a Bounded Semantic Index (#15340) ... * 🧭 feat: guide compaction with semantic context * 🛡️ fix: fail closed on semantic intent collisions	2026-08-29 17:53:04 -04:00
Danny Avila	e003eeac56	📭 fix: Drop Empty Summary Parts Before Persistence (#15338)	2026-08-29 17:24:35 -04:00
Danny Avila	149c80bed5	📦 chore: bump @librechat/agents to v3.7.8 (#15337)	2026-08-29 16:17:15 -04:00
Danny Avila	1740f64439	🐺 fix: Stop Routine MCP Teardowns From Failing Concurrent Tool Calls (#15333) ... * 🧵 fix: Re-establish MCP User Connections Fenced by a Concurrent Teardown A teardown of a user's MCP connection cancels every creation in flight for the same user and server, and each cancelled caller threw "Connection creation was cancelled during teardown". Under concurrent tool calls that surfaced as a failed tool call in the chat, while an immediate retry always succeeded. Fencing those creations is correct: they may install a connection built from the state the teardown is removing. Failing their callers is not, since they are next in line rather than stale. - Throw a distinct `ConnectionCreationCancelledError` from the guard checks in `createUserConnectionInternal`, hoisted into one `assertCreationNotCancelled` helper. - Restart the whole attempt in `getUserConnection` when a creation is fenced, so it re-reads the server config, takes a fresh guard and a fresh queue slot, and only then re-establishes the connection. - Bound restarts so back-to-back teardowns cannot spin a caller forever. Fixes #15329 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbvEBnMLdqB1TUEx23A5GG * 🔁 fix: Re-resolve MCP Server Config When Re-establishing a Fenced Creation Callers resolve the server config before calling `getUserConnection` (`MCPManager.getConnection` passes it as `opts.serverConfig`), so a re-established attempt was rebuilding from the config the teardown had invalidated — reconnecting to a pre-update URL or credentials. - Re-read the registry config on every re-establishment, so a committed update is picked up and a deleted user server resolves to nothing and fails the attempt. - Keep a caller-supplied config the registry cannot resolve on its own, so config-source servers still re-establish. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbvEBnMLdqB1TUEx23A5GG * 🧭 fix: Fence MCP Creations by Teardown Reason Instead of Failing Every Caller A re-established attempt cannot re-resolve what its caller resolved: the config comes in as `opts.serverConfig` (with the request's `configServers` overlay applied) and credentials as `opts.customUserVars`, both owned by the api layer. Re-reading only part of that inside the manager reconnects with a base config in place of a tenant overlay, or with credentials a mutation just revoked. So distinguish why a teardown ran instead: - `mutation` (the default, and what every external caller gets) follows a committed config or credential change, so the fence stays fatal exactly as before — the caller resolves again on its next request. - `lifecycle` — a forced replacement, an idle sweep, a dead connection cleaned up, a failed OAuth reconnect — invalidates nothing the caller resolved, so the fenced attempt is re-established instead of failing its caller. This drops the config re-resolution added in e6e331c; a lifecycle teardown leaves the caller's inputs as valid as they were. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbvEBnMLdqB1TUEx23A5GG * 🧹 fix: Keep MCP Activity Timestamps for Connections Installed Mid-Teardown `disconnectUserConnections` cleared the user's activity timestamp unconditionally, so a connection installed while the sweep was still disposing another one stayed cached with no activity entry. Since `checkIdleConnections` walks activity rather than connections, that connection was invisible to every later idle sweep. Clear the timestamp only when the user has no connections left, which keeps the documented purpose of the unconditional delete — dropping an entry `updateUserLastActivity` wrote before a connection attempt that then failed. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbvEBnMLdqB1TUEx23A5GG * 🛡️ fix: Harden MCP Teardown Bookkeeping Around Re-established Creations Two edges around the teardown reason work: - `disconnectUserConnections` keyed its activity-timestamp cleanup on the user's map being absent, so a map left empty would strand the timestamp and make every idle sweep re-fire for that user. Key it on the connection count instead. - A caller that aborted while its creation was fenced no longer re-establishes: there is nobody left to hand the connection to, and a durable one would be installed for a request that is already gone. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbvEBnMLdqB1TUEx23A5GG * 🧷 fix: Keep MCP Teardown Cancellation and Queue Order Ahead of Re-establishment Two ordering edges a re-established creation could lose to: - `disconnectUserConnection` cancelled pending tool publications after awaiting disposal, so a creation re-established inside that window could have its own publication — and its retry timer — dropped by the teardown that fenced it, leaving the shared catalog stale until the next list-change. `cancelMCPToolsChanged` drops the pending change before it awaits, so starting it in the teardown's synchronous stretch closes the window. - Re-establishment re-entered the force-new queue at the tail, so a replacement fenced while queued could run after one queued behind it and overwrite the newer connection with an older caller-resolved config. It now re-establishes inside the queue slot it already holds; a lifecycle fence raised while an attempt waited its turn is cleared as it starts, while a mutation fence is kept and still fails the caller. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01BbvEBnMLdqB1TUEx23A5GG --------- Co-authored-by: Claude <noreply@anthropic.com>	2026-08-29 16:14:40 -04:00
Danny Avila	2acd219c17	🫀 fix: Reconcile Completed Runs Behind Apparently Open Streams on Foreground (#15342)	2026-08-29 16:13:02 -04:00
Danny Avila	7a0061507e	🪪 fix: Admit Confirmed Generation Retries Before Message Limits (#15341) ... * fix: admit idempotent retries before message limits * fix: bound generation retry admission * fix: keep retry probe store-compatible * fix: exclude normalized resume routes * fix: preserve trusted retry exemptions * fix: bound retry claim admission * style: satisfy generation retry static checks	2026-08-29 13:41:26 -04:00
Danny Avila	773127bff2	🎠 refactor: Route Every Event Actor Turn Through One Lifecycle (#15325) ... * refactor: unify Event Actor turn lifecycle * fix: retain Event Actor fence ownership * fix: preserve mixed-version actor suspension safety	2026-08-28 17:30:23 -04:00
Danny Avila	3fa33b740b	🛫 refactor: Promote Generation Protocol V2 Automatically (#15324) ... * refactor: promote generation protocol v2 automatically * fix: remove unused protocol import	2026-08-28 17:17:09 -04:00
Danny Avila	77c2a51cf3	🪧 fix: Advertise Detached Event Actor Support from the Generation Store (#15322) ... * fix: activate detached event actions automatically * fix: shield detached terminal generations * perf: share capability availability index * style: flatten capability status selection * fix: preserve mixed-version lifecycle shells * fix: complete detached action store adapters * fix: close mixed-version capability races * fix: honor legacy capability success	2026-08-28 16:33:23 -04:00
Danny Avila	487984193a	🪂 feat: Make Event Actor Detached Actions Durable (#15307) ... * feat: make Event Actor detached actions durable * fix: align detached actor checks with merged base * fix: close detached actor lifecycle gaps * fix: break detached action outcome cycle * fix: deepen detached action ownership * fix: fence detached launch handoffs * fix: preserve detached rollout fencing * test: type detached recovery failure * fix: close detached ownership handoffs * fix: stage detached action activation * fix: persist detached terminal retries * fix: fence detached durability ownership * fix: fence trigger lane publication * fix: fence detached transition generations * fix: retire failed detached predecessors * fix: close detached rollout consumers * test: type detached retry turns * fix: close detached ownership gaps * fix: fence detached action resumes * fix: fence prior-head event actor resumes * fix: preserve legacy event actor resumes * fix: align detached resume boundaries	2026-08-28 14:21:04 -04:00
Danny Avila	01f5391ee3	🕰️ fix: Guard expires_in So a Token Response Cannot Outlive Its Credential (#15321) ... * 🕰️ fix: Guard `expires_in` So a Token Response Cannot Outlive Its Credential RFC 6749 §5.1 makes `expires_in` only RECOMMENDED, so a token response may legally omit it. Four sites derived a lifetime from the raw field, where `undefined * 1000` is `NaN`. `NaN` is not a short TTL, it is no TTL. `@keyv/redis` writes the key without `PX` because `NaN` is falsy, so the entry is stored in Redis with no expiration at all; the in-memory backend embeds `expires: NaN` and every check compares with `>`, always false against `NaN`. The namespace default does not stand in either, since Keyv applies it with `??=` and `NaN` is neither `null` nor `undefined`. The exchanged access token was therefore cached permanently at `openidStrategy.js` and `GraphApiService.js`, and once it genuinely expired the poisoned entry kept being served with no path to eviction. The same omission is sharper in `ActionService.js`, where `new Date(NaN).toISOString()` throws `RangeError: Invalid time value`. Both call sites are inside a `try`, so the failure surfaces as a generic "Failed to authenticate OAuth tool" that names nothing, and the refresh site falls through to `requestLogin()` on every attempt, looping with no exit. The rule had six hand-written homes and three of them were wrong, so it now has one. A new `packages/api/src/oauth/expiry.ts` normalizes `expires_in` to a positive finite number of seconds or nothing, and exposes the two shapes callers actually need: a cache TTL that falls back rather than returning `NaN`, and an absolute expiry that is absent rather than Invalid. The four unguarded sites adopt it, and the two ad-hoc guards in `openidStrategy.js` and `OboTokenService.js` are consolidated onto it. `createHandleOAuthToken` is folded in as well. Its guard already handled `null` and unparseable strings but admitted `NaN`, since `typeof NaN === 'number'` satisfied its first branch. The `mcp/oauth` sites are deliberately left alone: `tokens.ts` guards on truthiness and carries richer logic that reads a JWT access token's own expiry when the response omits one, and the file is being reworked in #13901. Closes #15318 Closes #15319 * 🕰️ fix: Address `expires_in` Guard Review Round 1 Preserve an explicitly elapsed lifetime instead of collapsing it into "unknown". `expires_in: 0` is the provider stating the credential is already dead, which is information; treating it as absent handed it the one-hour fallback in `createHandleOAuthToken` and dropped the expiry entirely in `ActionService`, so a credential declared expired could be used and retained for up to an hour. Both sites preserved that value before this branch, so the collapse was a regression introduced here. `normalizeExpiresIn` now returns any finite number, positive or not, and reports `undefined` only for a lifetime that is genuinely unusable. `getTokenExpiresAt` therefore yields a past timestamp for an elapsed lifetime, so callers refresh rather than guess. Cache TTLs cannot pass such a value through raw: Keyv reads a TTL of exactly `0` as "no expiry", turning a dead credential into the immortal entry this module exists to prevent. `getTokenCacheTtlMs` floors an elapsed lifetime at one millisecond, which expires immediately without ever writing an entry that outlives its credential. Parse numeric strings with `Number` rather than `parseInt`, which truncates a complete value such as `"3.6e3"` to `3` and would expire an hour-long credential after three seconds, re-exchanging against the identity provider on every request. An empty or blank string is rejected rather than read as zero, since `Number('')` is `0`. * 🕰️ fix: Bound `expires_in` to Lifetimes a Date Can Represent Parsing the complete numeric string last round made an overflow reachable that `parseInt` had been masking. `parseInt('1e13', 10)` was `1`; `Number('1e13')` is `1e13`, and `1e13` seconds is 1e16 ms, past the ECMAScript time value range of ±8.64e15. Every derived timestamp was therefore an Invalid Date whose `toISOString()` throws `RangeError: Invalid time value` — the exact failure this branch exists to remove, reintroduced by its own fix. The token model derives the same way at `packages/data-schemas/src/methods/token.ts:19`, so storage and authentication would fail with it. A lifetime is now reported as unusable unless it can still produce a valid `Date`. The bound is the time value range halved, leaving room for the `Date.now()` every derived timestamp adds. At roughly 137,000 years it rejects nothing a provider could mean: a one-year refresh token and even a hundred-year lifetime still pass through untouched, while `1e13`, `Number.MAX_SAFE_INTEGER` and `1e300` take the caller's fallback instead of poisoning a timestamp. The invariant tests now carry the overflow shapes rather than a fixed list of small ones, since a guard that only sees the inputs its author imagined is how the previous round's regression got in.	2026-08-28 10:47:09 -04:00
Danny Avila	6c94aa8403	🪪 fix: Reject ID Tokens as the OpenID Bearer Reuse Access Token (#15317) ... The openidJwt reuse strategy substituted the raw incoming Authorization bearer whenever it found no stored access token in the session or cookies. Clearing this strategy's audience check does not make a token an access token: an OIDC ID token is minted for the client id and satisfies the very same check, so the fallback could store an ID token as federatedTokens.access_token. That value is used verbatim as the On-Behalf-Of assertion, and Entra rejects an ID token there with AADSTS240002. It is easy to reach whenever the OpenID session store is not persistent, since express-session falls back to MemoryStore and every restart wipes the stored access tokens for active sessions. Deleting the fallback outright would break the case it legitimately serves, so reuse is now gated on the bearer being identifiable as an access token. Detection rests on the two signals that separate the token types by specification rather than by provider convention: an RFC 9068 `at+jwt` header type, defined for access tokens alone, and an `aud` that omits the OIDC client id, which OIDC Core section 2 requires every ID token to carry. A scp/scope claim is only a supporting signal, applying once the audience has already ruled out an ID token, because providers add claims freely in both directions -- Keycloak has emitted nonce and auth_time in genuine access tokens and maps scope into its ID tokens. at_hash and c_hash veto regardless, since they exist only to bind an ID token to its companion access token or code. An unrecognised token is left unset rather than guessed at, so isOpenIDTokenValid fails closed and the OBO path raises its actionable error instead of attempting a Graph exchange with a token of the wrong type. Reuse now requires either an at+jwt provider or OPENID_AUDIENCE naming a resource distinct from the client id; a bearer audienced only to the client id cannot be told apart from an ID token and fails closed. That applies solely on the degraded path where nothing was stored to begin with. Separately, processSingleValue gated every credential placeholder on isOpenIDTokenValid, which reports on the access token alone, so leaving access_token unset made a header configured with only {{LIBRECHAT_OPENID_ID_TOKEN}} raise re-authentication despite a present, current ID token. Validity now depends on the credential actually requested: an access-token-specific pattern gates the raise, and the ID token resolves through processOpenIDPlaceholders, which already validates its own expiry. processOpenIDPlaceholders takes a fields allowlist so that path resolves the ID token alone and identity metadata keeps its literal-then-strip behaviour.	2026-08-28 10:11:32 -04:00
Danny Avila	d369c649ed	🪥 chore: Run CI's Static Checks on Each Commit's Diff (#15303) ... * 🪝 chore: Run Static Checks on Every Commit Adds `scripts/static-checks.mts`, a local port of the Static Checks CI job (.github/workflows/static-checks.yml) scoped to the files in a diff. It resolves the changed-file list, applies the same `dorny/paths-filter` groups the job uses, and runs whichever checks those paths activate — ESLint, Prettier, import order, ESLint config validation, package.json validation, and (behind `--full`) config migration tests, unused i18n keys and depcheck. Like the job, every selected check runs even after one fails and the failures are summarized at the end. The pre-commit hook keeps lint-staged for the per-file layer, which verifies the exact staged content of partially staged files, then runs the script for everything lint-staged cannot cover. lint-staged now uses the job's ESLint invocation, so warnings fail locally the way they fail CI. The slow gates stay opt-in (`npm run static-checks:full`, or `STATIC_CHECKS_FULL=1`) to keep commit latency unchanged. Hooks were never installed: `config/prepare.js` existed but no `prepare` script called it, so the hook only ran where `core.hooksPath` had been set by hand. Replaces it with an inline `prepare` — both Dockerfiles run `npm ci` after copying only the manifests, so a `node config/prepare.js` step would fail the image build, and husky is absent from `--omit=dev` installs. The i18n scan is a single pass over the source identifiers rather than one grep per key, verified to flag exactly the same keys as the CI loop (including the substring and dynamic-key cases) in 0.5s instead of 14s. * 🩹 fix: Address Codex Round 1 on the Static Checks Runner Activate gates from the unfiltered changed-path list. `dorny/paths-filter` matches deleted paths too, so gating on the `--diff-filter=ACMRTUXB` list the per-file steps use let a delete-only commit — the last reference to a translation key, say — slip past the i18n and depcheck gates. The two lists are now derived separately, the way CI derives them. Pass `-m` to `git diff-tree` in `--commit` mode. Without it a merge commit emits no paths at all, so `--commit <merge-sha>` reported "Nothing to check"; a real merge in this repo's history goes from 0 to 97 files. Build the workspaces the config suite imports instead of skipping when `dist` is absent. The three `dist` directories are gitignored and `npm ci` does not produce them, so a fresh checkout reported a pass for a gate that never ran — and an existing `dist` could be stale. Each is a sub-second tsdown build. Resolve a global depcheck through a shell on Windows, where npm exposes it as `depcheck.cmd` and `spawnSync` cannot see the shim. Skip dot directories when walking for imports. `.claude/worktrees/` can hold a full checkout per branch — 117 on this machine — and the root-wide scan behind the depcheck gate walked every one of them. Records the remaining boundary in the header: the per-file checks see exact staged content via lint-staged, while the tree-wide gates read the working tree, as running them by hand would. * 🩹 fix: Address Codex Round 2 on the Static Checks Runner Treat an unresolvable checker as a failure. ESLint and Prettier missing meant the runner printed "All affected static checks passed" without having linted anything; only depcheck, which CI installs globally and this documents as optional, may still skip. Catch per-check exceptions. The runner promises that every selected check runs even after a failure, but a throw — a malformed translation JSON, say — escaped and cancelled the checks after it. Each is now recorded as that check's failure; verified that depcheck still runs after i18n throws. Restrict `--commit` to the checked-out commit. Paths came from the named commit while contents came from the working tree, so an older revision was scored against the wrong file contents: a file added then deleted vanished, and one modified since was read at its newer contents. It now fails with a pointer to `--against`. Reject unknown options. `--ful` silently ran the fast tier and `--commmit HEAD` treated `HEAD` as a file path, both exiting 0 and implying gates had run. Cover the runner in CI. `scripts/**` was absent from the workflow's trigger paths, so a PR touching only the script the pre-commit hook now depends on got no Static Checks run — and ESLint has no flat-config match for `scripts/**/*.mts`, so nothing else loads it either. Adds the trigger path, a `runner` filter group and a step that runs the script against the PR's own diff. * 🔗 feat: Add Circular Dependency and TypeScript Gates Both already run in CI as jobs of the Backend Unit Tests workflow; this brings them to the local runner so they land before a push rather than after. Circular dependencies (`node config/circular-deps.mjs`) is fast enough at 0.9s to sit in the per-commit tier, gated on the same paths that trigger the CI job. TypeScript stays opt-in behind `--full`: the five projects cost between 2.3s and 20.9s each, which is too much per commit. Each project declares the paths that can affect it — its own sources plus its upstream packages — so an edit to data-provider still typechecks data-schemas, api, packages/client and client, while an `api/**`-only change runs none of them, since no typechecked project includes that directory. The builds a project's imports resolve through are made first, mirroring the CI jobs' dependency on the build artifacts, through a helper the config suite now shares. Also addresses codex round 3: Reject conflicting target selectors. `--against origin/dev package.json` silently checked only the file, and `--against <bad-ref> --commit HEAD` never resolved the bad base, so a caller could believe a range had been checked. Require a clean worktree in `--commit` mode. The HEAD-only restriction was not enough: contents still come from the working tree, so an uncommitted edit was scored against the named commit — an invalid uncommitted package.json failing a valid HEAD, or an uncommitted fix masking a defect in it. The summary now names how many checks were skipped rather than reporting a bare pass, and a typecheck failure carries the stale-workspace-build hint — inside a git worktree `librechat-data-provider` resolves to the main checkout, whose dist can predate the branch and shows up as missing properties. * 🩹 fix: Address Codex Round 4 on the Static Checks Runner Diff `--against` from the merge base. A two-dot diff reports the base branch's own commits in reverse once it advances, so `--against origin/dev` scored 64 files for a branch that changed 7, activating gates for files the branch never touched. Three dots makes the documented PR-style command mean what it says. Typecheck on root manifest changes. Both review workflows trigger their TypeScript jobs on package.json and package-lock.json, because a dependency or @types bump breaks compilation on its own; the local filter ignored them, so `static-checks:full` passed where CI would fail. Validate every workspace manifest. The list mirrored the four the CI step happens to name, so a malformed packages/api, data-provider or data-schemas manifest passed validation in the revision modes, which have no lint-staged pass behind them. Both lists now cover all seven. Make the runner smoke execute a check. `--list` never runs one, and a script-only PR activates no group, so the CI coverage added for exactly that case could pass with the execution path untouched. It now runs against an explicit target. * 🩹 fix: Address Codex Round 5 on the Static Checks Runner Activate the JSON gate for every manifest it validates. Round 4 added the four workspace manifests to the validation list but not to the filter that turns the gate on, so a malformed packages/data-provider or data-schemas manifest still passed when it was the only changed file — the list grew and the trigger did not. The same two entries also feed the unused-package calculation, reached through api/package.json's @librechat/data-schemas dependency. Include the owning workflows in the imported gates' filters. Circular dependencies and TypeScript come from the review workflows, both of which list their own YAML in `on.paths` and therefore rerun those jobs when the workflow changes; locally the gates stayed inactive, so a change to how they are built or invoked could bypass the local equivalent. Added to the group filters and to the per-project predicates, since a workflow-only change would otherwise activate the group and then select no project. Bound command batches by characters rather than file count. Windows caps a command line at 32767 characters, far below POSIX ARG_MAX, and a count does not bound that: 400 of this repository's longer paths already come to 30176 characters before the executable and fixed arguments. Verified that a list spanning several batches still reports a defect in its final file.	2026-08-28 10:08:37 -04:00
Danny Avila	14d6ce7caf	🎫 fix: Exclude System Tenant Sentinel from Code API JWT Claims (#15316) ... `resolveTenantId` accepted any truthy tenant value, including the `SYSTEM_TENANT_ID` sentinel that `runAsSystem()` installs for background work. The expired-file sweep runs entirely under `runAsSystem()`, so on deployments without multi-tenant onboarding (`file.tenantId` undefined) it minted Code API tokens claiming `tenant_id: '__SYSTEM__'`. The Code API derives its storage namespace from that claim, so the re-derived session key never matches the one cached at upload time and the delete is rejected with 403. `deleteCodeEnvFile` only treats 404/405 as already-gone, so `expiredAt` is never cleared and the same files are retried on every sweep cycle and every process boot. Treat the sentinel as absent tenant context, consistent with every other identity-bearing `getTenantId()` consumer, so resolution falls through to `CODEAPI_JWT_SINGLE_TENANT_ID` (both sides default to `legacy`) or fails fast under `TENANT_ISOLATION_STRICT`.	2026-08-28 09:19:01 -04:00
Danny Avila	04a7577821	🧵 fix: Retry Shared Links After Message Persistence Gaps (#15306) ... * fix: Retry shared links after message persistence gaps * chore: Sort share test imports * fix: Address share review feedback * fix: Normalize hydrated share target	2026-08-28 08:05:52 -04:00
Danny Avila	c06b09c945	🤖 feat: make Event Actor HITL durable (#15305) ... * 🤖 feat: make event actor HITL durable * 🤖 fix: break event actor outcome cycle * 🤖 fix: close durable actor terminal races * fix: harden durable event actor recovery proofs * fix: close event actor resume publication races	2026-08-28 08:05:11 -04:00
Danny Avila	31325b4f61	🎰 fix: Merge Message Provenance With Compare-and-Swap Retries (#15304) ... * fix: preserve provenance with classic updates * test: reject provenance update arrays	2026-08-28 00:24:07 -04:00
Danny Avila	6fba51a35a	🫆 feat: Fingerprint Agent Context for Zero-Read Warm Continuation (#15299) ... * feat: add context-fingerprinted warm continuation * fix: preserve manual skills across warm turns * perf: keep ordinary agent initialization neutral * fix: fingerprint complete agent topology * fix: close warm context replay gaps * fix: preserve lazy subagent memory scope * perf: fingerprint only model-bound memory * fix: project lazy memory capability * style: sort warm continuation imports * fix: make warm continuation reconstructable * fix: preserve lazy skill isolation * fix: retain scoped skill semantics	2026-08-27 23:01:14 -04:00
Danny Avila	a5fd00cd7a	🎼 feat: Unify Agent Turn Execution Behind One Immutable Plan (#15296) ... * feat: unify agent turn execution planning * fix: preserve automatic subagent activity handles * fix: gate subagent wakeups for ephemeral parents * fix: scope subagent wakeup guidance by agent	2026-08-27 22:26:46 -04:00
Danny Avila	f4efef4b3a	♟️ fix: Settle First Bound Actor Events (#15300)	2026-08-27 19:06:41 -04:00
Ravi Kumar L	a70bcf66a4	🪢 feat: show Langfuse session link in shared chats (#15273) ... * feat: show Langfuse sessions in shared chats * fix: wait for optional auth before loading shares * fix: require Langfuse access for shared session links * refactor: move shared Langfuse policy into API package * fix: wrap shared chat actions on mobile * fix: coordinate shared Langfuse link loading * perf: batch shared Langfuse capability checks	2026-08-27 14:29:57 -04:00
Danny Avila	03fa98eb37	🕸️ feat: Complete Keenable Web Search Provider (#15288) ... * feat: wire Keenable web-search provider into config, schema, and UI Keenable landed as a search provider in @librechat/agents (#285, shipped in 3.2.58+), but LibreChat did not yet expose it. This adds the config/schema/UI glue so it can be selected, mirroring the existing Tavily provider. - data-provider: add `keenable` to SearchProvider type + SearchProviders enum, keenableApiKey/keenableApiUrl schema fields, and a keenableSearchOptions block (maxResults, site, attributionTitle, timeout). - data-schemas: register keenable in webSearchAuth.providers and default the key/URL placeholders in loadWebSearchConfig. - api/web: pass keenableSearchOptions through to the provider and handle Keenable's keyless model. Unlike other providers it authenticates with no key (the public endpoint), picking up an optional key/URL when set; the URL override is SSRF-preflighted like other user-provided URLs. - client: add Keenable to the provider dropdown with an optional API-key input. - docs: document KEENABLE_API_KEY/KEENABLE_API_URL in .env.example and a webSearch example in librechat.example.yaml. - tests: keyless + keyed auth resolution, config defaults, and schema parsing. * fix: ESLint no-unused-vars and clarify Keenable yaml example - Remove the now-unused RerankerTypes import in data-schemas web.ts (the lint job runs with --max-warnings 0 on changed files, so this latent warning failed CI once the file was touched). - Note in the librechat.example.yaml Keenable stanza that a scraper (and reranker) is still required for web search to load, and include a Firecrawl scraper in the example. * chore: fix import order drift (sort-imports) * feat: add Keenable as a keyless scraper and select it without a pinned provider The Keenable scraper landed in @librechat/agents#337, so wire the scraper category the same way the search provider already is: `scraperProvider: keenable` reads pages through Keenable's public fetch endpoint with no key (a key only lifts rate limits, and the endpoint is overridden with KEENABLE_FETCH_URL). Paired with `rerankerType: none` this makes a fully keyless web-search stack possible for the first time. Also closes the Codex finding on this PR: because none of Keenable's auth fields are required, the generic auth loop skips it whenever it isn't pinned, so a key submitted through the API-key dialog (which cannot pin a provider) left the providers category unauthenticated. Keenable is now selected in that case, gated on one of its values actually being present so installs that configured nothing keep their current behavior. The scraper gets the same fallback, additionally gated on Keenable being the resolved search provider, so it never silently scrapes for another provider. * fix: select the Keenable scraper from a supplied key, not only for Keenable search The API-key dialog submits credentials and cannot pin a provider, so choosing Keenable as the scraper while search stays on Serper/SearXNG/Tavily had no effect: the unpinned-scraper fallback required Keenable to also be the resolved search provider. A supplied Keenable value now triggers it as well, which is the only signal the dialog can send. The fallback still runs only when no keyed scraper authenticated, and with neither trigger the category stays unauthenticated, so a deployment that never configured Keenable is unaffected. Note the fully keyless choice still cannot be expressed through the dialog: Keenable's key is optional, so picking it with no key submits nothing at all. librechat.example.yaml now documents pinning scraperProvider: keenable for that case. * style: Sort Keenable imports * fix: Harden Keenable auth resolution * fix: Preserve Keenable selection intent * fix: Fail closed on invalid web search auth * fix: close keenable auth gaps * style: sort web auth imports * fix: preserve web search selection integrity * fix: isolate web search auth ordering * fix: silence expected credential misses * chore: bump agents sdk * fix: preserve web search preference ownership * fix: forward cleared Keenable endpoint * style: sort web search hook imports * fix: require intent for credential clears --------- Co-authored-by: Ilya Bogin <ilya.bogin@keenable.ai>	2026-08-27 14:29:20 -04:00
Danny Avila	8ba76507ae	🧷 fix: Verify Scheduled HITL State Before Pausing (#15284) ... * fix: require durable storage for scheduled HITL * fix: verify scheduled HITL checkpoints before pause * fix: narrow scheduled HITL capability checks * fix: honor ask tool filters in schedule preflight * fix: enforce durability across scheduled HITL resumes * fix: scope scheduled HITL admission to active tools * refactor: move scheduled HITL admission to TypeScript * fix: close scheduled HITL admission gaps * fix: bind scheduled pauses to current checkpoint * fix: cap pending actions at binding deadline * fix: reject expired pending actions * fix: guard approval deadlines atomically	2026-08-27 11:16:24 -04:00
Danny Avila	ab2c0d5362	📦 chore: bump @librechat/agents to v3.7.5	2026-08-27 10:08:28 -04:00
Danny Avila	de59da9636	🎟️ refactor: Require Credentials for Local Image Access by Default (#15252) ... * 🔐 fix: Protect Local Image Access by Default * 🔐 fix: Scope Image Authorization to Active Sessions * 🧹 style: Format Image Authorization Checks * 🛡️ fix: Harden Image Avatar Authorization * 🧭 style: Sort Image Authorization Imports * 🔐 fix: Close Image Authorization Review Gaps * 🧭 fix: Normalize Stored Avatar Base Paths * 🏢 fix: Resolve Tenant Assistant Image Policy * 🛂 fix: Enforce Effective Image Access Policy * 🧹 style: Flatten Assistant Config Selection * 🧷 fix: Preserve Image Access Compatibility * 🪪 fix: Make Image Sessions Revocable * 🏗️ fix: Move Image Session Policy Into API	2026-08-27 09:55:27 -04:00
Danny Avila	ff1784568b	📦 chore: bump axios to v1.20.0, @librechat/agents to v3.7.4 (#15285) ... * chore: bump axios to v1.20.0 * chore: bump axios in react-query package.json * chore: bump agents sdk to v3.7.4	2026-08-27 08:56:29 -04:00
Danny Avila	41ba808e6f	🧅 feat: Reveal Subagent Thread History and Event Detail on Demand (#15283) ... * ✨ feat: Refine Subagent Thread Activity UX * test: align subagent completion lifecycle * chore: satisfy subagent panel static checks * fix: harden subagent activity pagination * fix: preserve paged subagent history * fix: surface unrecoverable activity boundaries * fix: rebase paged activity after live advances * fix: bound child activity history state * fix: preserve rebased child history order * fix: retain unavailable child history boundary * fix: fence child history cursor generations * fix: preserve subagent history continuity * fix: retain live turns during history rebase * fix: close subagent history edge cases * fix: harden subagent history phase transitions	2026-08-27 08:56:06 -04:00