* 🎯 fix: Ask Because a Successor Is Owed, Not Because One Might Be
The handover window guessed at how long admission takes. For a queued turn it
never had to: the backend reports the turn as `queued` or `claimed`, which is
positive evidence that a run is coming and that this client will not be the one
to start it. Declare that outright and keep the active-job list live for
exactly as long as it holds.
Read from the server's receipts rather than the chip projection, so admission
semantics stay in one place — `shouldPollAgentQueuedTurns`, shared with the
queue itself — instead of being restated here and drifting. `useSteering` owns
that fetch; subscribing with `enabled: false` observes its cache without
competing for it, and an unpopulated cache falls back to the window. It also
keeps this off Recoil, which the client is migrating away from.
The window stays for successors nothing local predicts — a background-tool
continuation has no receipt to report itself — and is now documented as the
fallback rather than the mechanism.
* 🔗 fix: Carry the Owed Successor Across the Receipt Handover
Codex found the gap in the deterministic path: the receipt that announces a
queued turn reports `admitted` for one fetch at most and is then dropped from
the projection — before the active-job list has necessarily observed the run
it started. If admission outlasted the handover window, the wall-clock
fallback was already spent, and a pane keyed on the receipt alone stopped
listening in exactly the window that mattered.
Two structural changes, so this is not another edge patched.
Owed is held, not read. Once a successor is known to be owed it stays owed
until it is delivered — this pane attaches, or the list names the conversation.
A bounded expiry backstops the case where neither ever happens, and it starts
only once the receipt has gone quiet, so a long wait behind an unadmitted turn
does not burn the window before the handover begins. `admitted` now counts as
owed: the receipt poll stops there because nothing is left to wait for, but an
unattached pane is in the opposite position, and it is the strongest evidence
that pane will get.
The receipt arms on its own. The arm had one announcement source, the list,
which can miss a run that starts and finishes between two polls. An owed turn
is a second source, and the status read the arm enables is the authoritative
answer either way: active attaches, inactive means the history refetch the arm
already performs is the repair. Neither source has to wait on the other.
* 🧹 chore: Sort Imports in useResumeOnLoad
* 🧭 fix: Deliver an Owed Successor Only When the Successor Itself Is Seen
Codex: the latch treated the pane's own live attachment as delivery of the
owed successor. But the successor is usually announced while its predecessor is
still attached — the turn was queued behind it — so the latch was cleared, or
never recorded, in exactly the window it exists for. Once that predecessor
closed and the receipt was dropped, a successor that started and finished
between two list polls was never seen.
Remember which generation was live when the turn became owed. Delivery is then
attachment to a different generation, or the list naming the conversation while
nothing of ours is live. The predecessor no longer counts.
Each half is proved against its own defect: reverting to the old predicate
fails the predecessor-attached case; dropping the generation-aware attach fails
the different-epoch case; and forgetting which generation was the predecessor
livelocks — the latch is set, "delivered" by the very generation it should have
excluded, cleared, and set again.
* 🧷 fix: Judge Successor Delivery by Generation, Re-Arm on Transitions, Expire Off-Screen
Three codex findings on the owed-successor latch, each a way the latch could
be cleared, never recorded, or held too long.
Delivery by generation only. The active-job list carries no generation
identity, so "the conversation is listed" was satisfying delivery while the
listed run was the predecessor — running elsewhere, unattached here — and the
latch was never recorded. The receipt knows the predecessor better than this
pane does: `expectedPredecessorCreatedAt` is stamped from the live epoch at
enqueue and `effectivePredecessorCreatedAt` is the boundary admission actually
consumed. Delivery is now attachment to a generation other than that boundary;
a turn still owed cannot have started, so a generation live when it is first
seen is its predecessor and refines the boundary rather than delivering.
Re-arm on transitions, not heartbeats. A `queued` receipt is refetched every
two seconds during a long wait and advances `dataUpdatedAt` without changing,
and the arm was keyed on that stamp — after the throttle it invalidated status
and history again and again while nothing had happened. It now keys on a
signature of receipt ids and statuses, and refetches history only when a run
is listed or the receipts actually transitioned.
Expire on an absolute window, off-screen too. The expiry effect skipped when
the latched conversation was not the one on screen, so navigating away held
the latch indefinitely and returning later reopened a fresh window. The window
now starts from `quietSince` — set when the receipt stops reporting or the
conversation leaves the screen — and is never pushed back by a remount.
Each change is proved against its own defect: re-adding list-based delivery
fails the listed-predecessor case; removing the transition gate fails the
heartbeat case; skipping expiry off-screen fails the absolute-window case; and
forgetting to learn a live predecessor livelocks the latch.
* 🧽 test: Restore the Admin Allowlist Override This Spec Leaks Into the Shard
The spec writes a per-user `mcpSettings.allowedDomains` override for the shared
primary user and never removes it. The list holds only its own fixture's
origin, and allowlist matching is protocol- and port-inclusive, so for the rest
of the shard every other MCP fixture is blocked: `e2e-oauth` fails inspection,
and an agent expecting its tools initializes into
AGENT_EXPECTED_MCP_TOOLS_UNAVAILABLE (503) instead of producing its OAuth
prompt.
Whether that bites depends only on which specs the shard runs afterwards, so it
surfaces as a deterministic failure in an unrelated spec — `mcp-oauth-resume`
failing an assertion that fires before any resume happens — which passes
whenever it runs first. A client-only PR whose path selection reordered the
shard hit it three times across two heads.
Delete the override in a `finally`, and confirm against the stored config
rather than by re-running `reinitialize`: the connection this test established
stays live, so reinitialize keeps succeeding once the allowlist is gone.
* 🩹 test: Read the Config Wrapper and Treat 404 as Cleared in the Override Teardown
`GET /api/admin/config/:principalType/:principalId` returns `{ config }`, and
deleting the last override removes the document, so the follow-up read is a
404 — the cleared state, not a read failure. The poll treated both as
unreadable and timed out.
* 🧷 fix: Remember Delivered Receipts, Restart the Grace on Delivery, Gate Reopening on Newer Data
Three more codex findings on the owed-successor latch.
Delivered receipts are remembered. An `admitted` receipt stays in the cache for
a fetch after the successor attaches, and it still counts as owed — so the
latch cleared on attachment and was re-recorded from the same receipt on the
next render, synchronously, until the cache moved on. That is React's
maximum-update-depth failure, reachable in the ordinary queued-turn handoff.
The receipt signature that delivered is recorded, and a receipt set with that
signature neither latches nor counts as owing a run; a genuinely new turn can.
Delivery restarts the fallback grace. The list may never have seen the run a
queued turn produced — it can start and finish between two polls — so its own
"recently active" clock is stale, and clearing the latch would have removed
the only reason left to poll. An unpredicted continuation after that run (a
background-tool dispatch finishing) would then go unnoticed until a focus or
reload. Observing the successor live now restarts the handover window.
The window reopens only on newer evidence. Returning to a conversation first
exposes the receipt cached before the turn went quiet, while the authoritative
refetch is still in flight; treating that as "still reporting" reset the
start of an expiry meant to be absolute, so repeated navigation could extend
it indefinitely. Only a server observation newer than the window's start
counts, for reopening and for the reporting check alike.
Each is proved against its defect: forgetting delivered receipts livelocks the
handoff test; skipping the grace restart fails its assertion; reopening on any
report fails the stale-remount case.
* 🧷 fix: Track Delivery Per Turn, Ratchet the Boundary, Keep One Latch Per Conversation
Three more codex findings on the owed-successor latch, plus a bug the second
one's regression test exposed.
Delivery is tracked per queued turn. Two turns queued behind the same
generation deliver one at a time; marking the whole receipt set on the first
would let the still-attached first successor pass as delivery of the second.
While any owed turn is still waiting, nothing is delivered at all — a waiting
turn cannot have produced the live run, so that run is its predecessor.
The boundary ratchets forward. A receipt can name the chain's root long after
a sibling's successor became the link the turn actually waits behind, and the
latch learns that link while the turn waits. Taking the receipt's boundary
first would have "delivered" the second turn on its own predecessor. The
predecessor is the latest link known: the max of what the receipt says, what
the latch learned, and, while waiting, what is live. With no boundary known at
all, a live generation is not delivery; the bounded expiry is the fallback.
Latches are keyed by conversation. Navigating to a conversation that also owes
a run replaced the previous one's latch, cancelling its expiry and the history
repair it performs. Every latch keeps its own absolute window now, and expiry
runs for all of them regardless of which conversation is on screen.
The cherry-picked allowlist-override teardown is synced to its final form
(see #15543): cleanup always runs, only definitive answers end its poll, and
`reinitialize` is no longer used as the reverted signal.
Proofs: marking the whole receipt set is indistinguishable only because the
waiting rule already blocks it; forgetting to learn the live link, or letting
the receipt's root outrank it, both fail the two-turn case; a single-slot latch
fails the two-conversation case; delivering without a boundary fails its case.
* 🧽 test: Restore the Admin Allowlist Override This Spec Leaks Into the Shard
The spec writes a per-user `mcpSettings.allowedDomains` override for the shared
primary user and never removes it. The list holds only its own fixture's
origin, and allowlist matching is protocol- and port-inclusive, so for the rest
of the shard every other MCP fixture is blocked: `e2e-oauth` fails inspection,
and an agent expecting its tools initializes into
AGENT_EXPECTED_MCP_TOOLS_UNAVAILABLE (503) instead of producing its OAuth
prompt.
Whether that bites depends only on which specs the shard runs afterwards, so it
surfaces as a deterministic failure in an unrelated spec — `mcp-oauth-resume`
failing an assertion that fires before any resume happens — which passes
whenever it runs first. A client-only PR whose path selection reordered the
shard hit it three times across two heads.
Delete the override in a `finally`, and confirm against the stored config
rather than by re-running `reinitialize`: the connection this test established
stays live, so reinitialize keeps succeeding once the allowlist is gone.
* 🩹 test: Read the Config Wrapper and Treat 404 as Cleared in the Override Teardown
`GET /api/admin/config/:principalType/:principalId` returns `{ config }`, and
deleting the last override removes the document, so the follow-up read is a
404 — the cleared state, not a read failure. The poll treated both as
unreadable and timed out.
* 🧭 fix: Await Config Cache Invalidation Before Answering Admin Config Writes
Every admin config mutation fired `invalidateConfigCaches` and answered without
waiting for it. The write was durable, but the effective configuration — app
config, per-principal overrides, cached tools, the MCP config-source cache —
could still describe the previous overrides when the response arrived, so a
caller that read right after writing could observe state it had just changed.
That is exactly how the allowlist-override e2e's teardown could report a clean
shard while the leaked allowlist was still in force.
`invalidateConfigCaches` already settles every clear and only logs failures,
so awaiting it cannot fail the request; it only orders the response after the
attempt. The e2e teardown now leans on that instead of polling the config
document, brackets the baseline assertion inside its cleanup scope so an
interrupted attempt can still un-poison the shard on retry, and treats a 404
from cleanup as a failure only when the override was actually installed, so it
can never mask the error that prevented installing it.
* 🧽 test: Confirm the Effective Allowlist Reverted Instead of Awaiting Invalidation
Reverts the awaited cache invalidation in the admin config handlers. Codex was
right on both counts: `invalidateCachedTools` can wait up to 30 seconds on the
Redis tool-cache lock, so awaiting it could hold a committed write until the
client's timeout; and APP_CONFIG is per-container by default, so an await only
ever proves this replica reverted while another keeps the previous overrides
for up to the override TTL. A test-hygiene PR should not ship a product
contract it cannot keep.
The teardown instead confirms the effective allowlist with the cache-backed
read the test already relies on. `reinitialize` disconnects the user
connection and re-resolves the merged allowlists per request, so the baseline
`success: false` returning is the definitive signal that the leaked override no
longer governs connections. The window exceeds the merged-config cache TTL, so
even a missed invalidation converges rather than leaking into the next spec.
The baseline stays inside the cleanup scope and a 404 from cleanup is a failure
only when the override was actually installed.
* 🧽 test: Verify the Override Is Gone, Not That a Connected Server Re-Blocks
The previous teardown polled `reinitialize` for the baseline `success: false`.
CI showed it never returns: a server that has already connected keeps
re-initializing successfully for more than 90 seconds after the override is
removed — past the 60-second merged-config TTL — because its allow decision
is not on the path that poisoned the shard. That path is agent tool loading,
which consults the merged app config per request; it is in-memory in these
shards and cleared by the mutation's asynchronous invalidation, and the
downstream victim, `mcp-oauth-resume`, passes with this cleanup in place.
Cleanup now always runs (a leaked override from an interrupted attempt is the
exact state it exists to remove), confirms the override document is gone with
only 200-without-the-override or 404 as definitive answers (anything else
retries), treats a 404 as a failure only when this attempt installed the
override, and describes the PUT's invalidation as what it is: asynchronous.
* fix(agents): preserve logical endpoints in run inputs
* docs(agents): clarify endpoint input compatibility
* chore: update @librechat/agents to version 3.7.19
* refactor(agents): use released endpoint input type
* fix: Detect silently dead Redis sockets with deadline-bounded heartbeats
A Redis peer can vanish without a FIN or RST (a dropped NAT entry, a proxy
failover, a migrated VM). The socket stays `ready` from ioredis's point of
view, no error fires, and every command on it waits for the kernel's
retransmission timeout — about fifteen minutes at Linux defaults.
Observed in production: while the main client's socket was dead,
POST /api/agents hung until Cloudflare returned a 524; while the subscriber's
socket was dead, every attach failed with "Timed out synchronizing Redis
subscription" for sixteen minutes across five conversations.
`REDIS_PING_INTERVAL` could not help — it awaits ping() with no deadline, so
the probe just joins everything else that is waiting.
- Add startRedisHeartbeat: races a PING against a deadline and destroys the
socket when the probe goes unanswered, so ioredis reconnects, replays queued
commands, and re-subscribes a subscriber's channels.
- Destroy the stream rather than disconnect(true), whose FIN a vanished peer
never acknowledges; cluster clients fall back to the regular reconnect.
- Add createIoRedisSubscriber so every dedicated subscriber gets an error
listener and its own heartbeat, and route the generation-stream and both
subagent-routing subscribers through it.
- Set ioredis keepAlive from REDIS_KEEP_ALIVE (default 10s).
- Add REDIS_PING_TIMEOUT, REDIS_SUBSCRIBER_PING_INTERVAL and REDIS_KEEP_ALIVE,
documented in .env.example.
- Give the fake RESP server a silent mode and a SUBSCRIBE reply so the
dead-peer case can be tested against real clients.
* fix: Probe each cluster node and refuse a non-positive heartbeat deadline
A cluster-level PING is routed to one node, so a healthy reply proved nothing
about the other sockets. The heartbeat now resolves its targets each tick —
every node for a cluster, the client itself otherwise — and races an
independent deadline per target, tearing down only the socket that stops
answering. A non-positive deadline disables the heartbeat with a warning
instead of forcing a reconnect on every tick, and the single-probe test no
longer depends on wall-clock slack.
* 📧 fix: Normalize Token Emails on Write, as Every Read Already Does
`findToken` and `deleteTokens` both trim and lowercase the email before querying —
the comment on `findToken` even documents it as automatic — but nothing normalized
the write. A token created with mixed case or surrounding whitespace could therefore
never be found or deleted again: an invite issued to `User@Example.com` was
unredeemable.
Fixed on the schema rather than in a caller. `createInvite` is the caller that
surfaced it (#15529), but the asymmetry belongs to `Token`, so every writer had the
same trap and any new one would inherit it. `User.email` is already declared
`lowercase: true` in this package, so this only brings `Token.email` in line with the
convention beside it — and a schema-level setter cannot be bypassed the way a helper
can.
Existing documents are not migrated. A token already stored with mixed case stays
unfindable, exactly as it is today; only new writes are corrected.
Fixes#15529
* ✏️ fix: Correct the Schema Comment and Name the No-Email Test for What It Asserts
Both from Copilot's review.
`User.email` sets `lowercase` but not `trim`, so claiming this "mirrors" it overstated
the parallel — this change trims as well, because the read side does. The comment now
states the `findToken`/`deleteTokens` contract it actually follows.
The no-email test was named for `null` while omitting the field and asserting
`undefined`. Renamed to match, and a real null case added: `TokenCreateData.email` is
`string | undefined` so null is only reachable by writing the model directly, but both
read methods branch on `email === null`, so it is worth proving the new setters leave
that value alone.
* 🚰 fix: Record the Provider Drain When Shutdown Cuts a Generation Short
* fix: Await generation settlement on shutdown instead of publishing the drain
* fix: Spend the real shutdown budget and cover the initialization window
* fix: Keep the shutdown registration literal the index spec asserts on
* fix: Keep draining settlements registered while shutdown is waiting
* fix: Track provider executions at the begin/drain chokepoints instead of per caller
* fix: Open the provider tracker before the begin CAS and cap cluster workers to the primary deadline
* fix: Propagate the cluster deadline and release trackers on reconfigure and abandonment
* fix: Hold SIGTERM until the worker acknowledges the cluster deadline
* fix: Refuse provider starts after shutdown begins and harden the cluster deadline handoff
* test: Assert the multi-execution shutdown wait with both executions begun before shutdown
* 🧊 feat: Persist Context Fading Tier Across Agent Runs
Carry the pruner's latched context-fading tier from `@librechat/agents`
through `contextMeta` the way `calibrationRatio` already travels, so a
historical tool result keeps the same truncated bytes from one run to the
next and Anthropic's prefix-based prompt cache survives across turns
(danny-avila/agents#497).
- Add `IAgentFadingTier` to the message and conversation `contextMeta`
types, schemas and the data-provider zod schema
- Add `isAgentFadingTier`, `resolvePersistableFadingTier` and
`resolveRunContextMeta` in `packages/api`; a tier is persisted once it
carries information (masking active or a budget below the window), and
a latched tier is kept even at a neutral calibration ratio
- Seed `createRun({ fadingTier })` from the parent response's contextMeta
regardless of encoding, since caps are character-based; the field rides
the existing forward-compatible `runConfig` variable and older SDK
versions ignore it, as does `Run.getFadingTier` being absent
- Accept a valid `fading` field in event actor context and reject a
malformed one, matching the calibration checks
- Capture run context meta through one module-level helper for both
completion paths instead of two inline copies
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Seed Fading Tier Across HITL Resume, Validate at the DB Layer
Address review findings on fading tier persistence:
- Leave the "is this tier worth persisting" decision to the SDK, whose
`Run.getFadingTier()` now returns only informative tiers; comparing
against the client's window misclassified untouched conversations
whenever a reserve ratio was configured
- Carry `contextMeta` through the HITL pause projection (staged approval,
job metadata, resume state) and seed the rebuilt client from it, so a
paused turn resumes with the same tier and calibration instead of
re-deriving a shallower one and rewriting the prefix
- Share run seeding between `chatCompletion` and `resumeCompletion`, and
make capture tolerate partial runs and bare resume contexts
- Validate `contextMeta.fading` in `commitAgentEventActorState` with a
shared `isAgentFadingTier` guard in data-schemas, so a malformed tier is
rejected at the DB layer instead of silently cold-starting the actor
- Reuse `IAgentEventActorContextMeta` for `IMessage.contextMeta` instead of
extending an inline duplicate
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 test: Cover Resume Seeding From Paused Context Meta
Assert the resume controller seeds the rebuilt client from the context meta
captured at the pause before rebuilding the run, and move the capture
helper's JSDoc back above its function.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧹 style: Sort Imports in Fading Tier Plumbing
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Persist Fading Tier Through Redis Jobs and Branches
Address Codex and Copilot review findings on fading tier persistence:
- Deserialize `contextMeta` in `RedisJobStore`, whose explicit read mapper
rebuilt every other pause field but this one, so Redis-backed
deployments resumed with no tier to seed after every HITL pause
- Copy server-private `contextMeta` onto the assistant message created by
`POST /api/messages/branch`, so the next turn seeds its pruner the same
way it would from the parallel source response
- Constrain the `fading` subdocuments in both Mongoose schemas (version
enum, positive budget, required fields) to match the zod schema
- Throw a distinct "fading tier is invalid" error from both context meta
validators instead of reporting a calibration failure
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Carry Context Meta Through Stop and Re-Pause
Addresses the second Codex pass on the fading-tier persistence:
- A re-pause whose resumed segment has nothing persistable now clears the
job's `contextMeta` in the same transition instead of leaving the first
pause's calibration and tier for the next resume to seed from.
- The client publishes the run's live calibration and fading tier onto the
job after each pre-invoke context snapshot (deduplicated on value), and
the Stop path copies `jobData.contextMeta` onto the stopped response, so
a follow-up from a stopped turn keeps the prompt prefix stable.
- Mid-run captures (HITL pause, Stop) read the graph's live state; `Run`
refreshes its own getters only after the stream settles, so the pause
used to persist the seeds it started from.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Fence Context Meta Publication Ahead of Stop
A Stop handled by another replica reads the job before the owner is
signaled, so a fire-and-forget publish could lose the race, and a run
stopped before its first context snapshot never published the tier it
inherited. The client now publishes the inherited seed before the run
streams or resumes, and the context-usage handler awaits each
snapshot's publish so the write lands before the model call it
describes begins. Failures still only log; the pre-run publish is
optional-called so bare resume contexts keep working.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Read Back Context Meta After the Abort Claim
The run owner publishes its context meta ahead of each model call and
awaits the write, so a publish landing between the abort's initial job
read and its terminal claim describes the call whose partial output the
abort snapshot carries. abortJob now reads the same-epoch job back after
the claim and content re-read and takes its context meta, so the stopped
response persists the tier that produced its bytes. The refresh is
best-effort and logs on failure like the content refresh beside it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Share In-Flight Context Meta Writes and Clear Neutral Live State
Two snapshot callbacks in a parallel-agent run can capture the same tier
before the first write settles; the publisher now caches the in-flight
promise per serialized value so the second caller awaits the same
durable write instead of treating an uncommitted value as published.
A live snapshot with nothing left to persist after an earlier publish now
writes a neutral record (ratio 1, no tier), since a running job's fields
cannot be deleted through the metadata writer, so a Stop no longer
persists an earlier non-neutral state onto the response. The pre-run
seed publish is unchanged and is told apart from live snapshots by a
flag from the context-usage sink.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 chore: Drop Unused Rest Parameter in Context Meta Test
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 feat: Persist Per-Agent Fading Tiers as Compact Context Meta
Reconciles the host with @librechat/agents at 9aacad1a, where graph
history stays canonical and each Run derives a provider-only projection
from the latched tiers. LibreChat therefore persists only compact state:
the calibration ratio, the default agent's tier, and now the per-agent
tiers from Run.getFadingTiers(), stored as validated entries so agent IDs
never become MongoDB field names and restored onto a null-prototype
record for RunConfig.fadingTiers. Truncated messages, canonical tool
content, projection provenance and per-message truncation state are
never persisted; the SDK's latched flag is stripped on capture.
The per-agent map travels everywhere the single tier already did:
response contextMeta, event-actor checkpoint state, HITL pause and
resume job metadata in both stores, the Stop path, and branch creation.
A shared Mongoose definition keeps the message and conversation schemas
identical, the zod schema validates entries, and commitAgentEventActorState
rejects malformed maps. Comments no longer describe graph messages as
truncated; only the provider projection is.
Tests cover: tool results and inputs reach the persisted content parts
at full size; contextMeta carries exactly the compact tier and
calibration fields; a persisted snapshot round-trips into the seeded
RunConfig unchanged and prototype-safe; per-agent tiers survive pause,
Redis job round-trips, and event-actor context validation.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Restore Event Actor Types and Publish Seeds Before Abortable Setup
The previous commit's doc rewording in the conversation types dropped the
event-actor interfaces that precede the fading tier, which broke the
declaration bundle in CI; they are restored unchanged.
The inherited context meta is now published onto the job as soon as the
parent's state is loaded and awaited at the top of chatCompletion and
resumeCompletion, ahead of run creation and the other abortable setup
stages, so a Stop during setup still persists the parent's tiers onto the
stopped response. The partial response saved when every subscriber
disconnects now carries the job's context meta like the Stop and pause
paths do. The branch route keeps the source's context meta in the saved
message but strips it from the HTTP response, matching client reads.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Serialize Distinct Context Meta Publications
Overlapping snapshots from parallel agents could carry different tiers;
each started its own write and both job stores keep whichever write
finished last, so an older snapshot could overwrite a newer one. Each
distinct publication is now issued after the previous one settles, in
call order, so the newest snapshot is what a Stop reads back. Equal
values still share one write.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Project Root Message Reads and Keep Inherited Meta on Setup Failure
The root GET /api/messages paths returned raw documents: the
single-message query read called getMessages without a projection and the
cursor page performed an unprojected find. Both now apply
CLIENT_MESSAGE_SELECT, with getMessagesByCursor accepting a select option,
so the persisted fading tiers never reach the client through the
paginated endpoint; the search-hydration read projects the same way.
A turn that loads a parent's context meta but fails before its run exists
used to replace the inherited meta with the capture of a missing run, so
the persisted error response lost the last valid tiers. Both finalizers
now keep the inherited meta when no run was created while a created run's
neutral state may still clear it.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 refactor: Move Context Meta Publication Into packages/api
The publication coordinator (ordering, deduplication, in-flight sharing,
failure state) now lives in packages/api as createContextMetaPublisher,
with selectRunContextMetaToPublish deciding what a publication carries;
the legacy client keeps only the wiring to the job metadata writer. A
transiently failing write is retried with a short backoff before the
publication is reported and forgotten, so a snapshot's model call no
longer proceeds on the first rejection while the job holds the previous
record. The SDK swallows handler errors, so retrying is the only way to
strengthen the fence without failing the turn.
A terminal save now supplies contextMeta: null when the finished run has
nothing to carry, and saveMessage unsets a previously stored value in
that case, so a disconnect snapshot's record cannot outlive the run that
completed neutrally.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Widen the saveMessage Method Type for the Null Unset
The exported method interface still typed contextMeta as the message
field, so the spec exercising the null unset failed typechecking; it now
mirrors the implementation signature.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Publish Every Agent's Snapshot, Sanitize Search Hits, Unbound Agent IDs
The context-usage handler now awaits the run's context meta publish for
every ON_CONTEXT_USAGE event, hidden sequential agents included, while
the visible-snapshot bookkeeping and the client emission keep their gate;
a Stop before the next visible snapshot finds the tier a hidden agent's
model call latched. Search results are built from the hydrated hit minus
its server-private contextMeta, since Meilisearch hydration projects every
schema field. The per-agent tier entry guard no longer caps the agent ID
length: ephemeral agent IDs encode endpoint, model and sender without a
bound, and dropping such an entry would let that agent alone re-derive
its tier on the next turn. Also formats the publication spec so the
static checks pass.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Unset Context Meta Atomically, Keep Publication State After a Failed Write
- `saveMessage` folds the `contextMeta` unset into the same update that
persists the terminal response, on both the plain and the provenance-merge
paths, so a failure between two writes can no longer leave a completed row
carrying a disconnect snapshot's state.
- `createContextMetaPublisher` tracks whether any record has committed
separately from the retryable latest publication, so `hasPublished` stays
true after a later publication exhausts its retries and a following neutral
snapshot still overwrites the earlier record on the job.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Carry Context Meta Through the Resumable Stop Route and Neutral Resumed Completions
- The resumable Stop route copies the refreshed `jobData.contextMeta` onto the
terminal assistant message it persists, as the abort middleware already
does, so a stopped resumable response keeps the tiers that produced its
partial output.
- A resumed run that completes with neutral context state now saves
`contextMeta: null`, which unsets the paused segment's record instead of
letting an omitted field keep it on the completed row.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Trust Only Server-Authored Context Meta, Unset It on a Neutral Stop, Read It From the Job on Disconnect
- `POST /api/messages/:conversationId` and conversation imports drop any
client-supplied `contextMeta`, and the run seeds its calibration and fading
tiers only from a server-authored parent response, so a forged tier can never
shape a provider projection.
- Both Stop paths save `contextMeta: jobData.contextMeta ?? null`, so a job that
re-paused with neutral state unsets what an earlier pause stored on the row
instead of leaving it behind.
- The disconnect partial save reads the same-epoch job record for the run's
published context meta, since the client-facing resume snapshot never carries
server-private state.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧪 test: Mock the Job Store in the Resume Metadata Spec
The disconnect partial save now reads the same-epoch job record through
`GenerationJobManager.getJobStore()`, so the resume metadata spec's manager
mock provides it as the other disconnect spec already does.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🧊 fix: Keep Context Meta Off the POST Message Response
`POST /api/messages/:conversationId` returned the saved row verbatim, so a
client write against an existing server-authored message echoed the row's
stored context meta. The route now projects the row through the same client
projection the branch route uses, which drops the server-private field.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 📦 chore: Bump @librechat/agents to 3.7.16 for Persisted Fading Tiers
3.7.16 is the first release that carries danny-avila/agents#497, so
`Run.getFadingTier()` / `getFadingTiers()` now report the latched tier
this branch persists and `RunConfig.fadingTier` / `fadingTiers` seed the
next run from it. The dependency set is unchanged from 3.7.15; only the
package entry moves.
Adds an SDK-backed round trip to the fading spec: a first pruner latches
an informative tier, `resolveRunContextMeta` reduces it to the persisted
shape, and a second pruner seeded from that shape reproduces the first
run's projected tool-exchange bytes under instruction and calibration
drift, while an unseeded pruner under the same drift relaxes its tier and
rewrites them.
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
---------
Co-authored-by: Claude <noreply@anthropic.com>
* ⚡ feat: Add Gemini 3.8 Flash Support
Adds first-class support for Google's Gemini 3.8 Flash (`gemini-3.8-flash`,
GA 2026-09-02) for both the Gemini API (AI Studio) and Google Cloud Gemini
Enterprise Agent Platform, following the Gemini 3.7 Flash integration (#14818).
The Flash-family handler that PR generalized already carries the shape 3.8
needs, so registering the model is a one-line rule rather than new behavior:
it inherits the strip of deprecated sampling params (temperature/topP/topK),
the rejected penalty params, and `thinkingBudget`, defaults to `medium`
thinking, and — like 3.7 — errors on `minimal`, so an explicit `minimal` is
substituted with the nearest supported level, `low`.
- Context window (1,048,576) in googleModels; API + cache pricing in tx.ts
- Model dropdown (config.ts) and GOOGLE_MODELS examples for both integrations
- Register the model in the Flash-family thinking-rule table
- Apply the same introductory pricing as 3.6/3.7 Flash ($0.75 in / $3.75 out /
$0.075 cached, per 1M), reverting to $1.50 / $7.50 / $0.15 on 2027-01-01;
the existing comments at both call sites now name 3.8 alongside 3.6/3.7
- Tests mirroring the 3.7 Flash coverage: thinking default, legacy-param strip,
explicit level pass-through, `minimal` substitution, versioned aliases,
context window, model-key mapping, and rates
Refs #15516
Ref: https://ai.google.dev/gemini-api/docs/models/gemini-3.8-flash
Ref: https://ai.google.dev/gemini-api/docs/pricing
* 🔧 chore: Update @librechat/agents dependency to version 3.7.15 in package-lock.json and related package.json files
* ⏭️ feat: Honor an Interrupt Before the Model Has Answered
An interrupt armed while the model is still thinking sat as "Interrupting"
until the entire turn finished, then landed as a terminal continuation. The
cause is upstream: the SDK reads `shouldPreempt` once per streamed chunk, and
its seal gate requires non-empty text — so a silent provider is never polled at
all, and a reasoning-only turn is never sealable.
`@librechat/agents` gains a discard-and-restart path for exactly that window
(`HOOK_PREEMPT_RESTART_CAPABLE`). This wires the host half:
- `GenerationJobManager.subscribePreempt` registers run-scoped wake listeners,
notified after an ACCEPTED arm — local or cross-replica, since both land in
`armPreemptIds`. Fenced on `createdAt` like every other preempt entry point,
and a throwing listener never fails the arm a queued steer depends on.
- `createSteerPreemptPoll` hands that channel to the SDK as
`StreamPreemption.subscribe`, gated on a new `isSteerPreemptRestartSupported`
probe so an SDK that cannot act on a wake is never handed one.
The wake is a hint only: `isPreemptRequested` stays the single authority, so
the level-triggered contract the seal path depends on is unchanged.
Inert until `@librechat/agents` publishes the restart contract — the probe
returns false against the pinned 3.7.11 and the run keeps today's behavior.
* 🩹 fix: Replay an Already-Armed Preempt on Subscribe
Preempt requests are level-triggered, and the window between a job becoming
steerable and the SDK installing its model-attempt listener is real. An
interrupt landing there was recorded with no callbacks to notify, and on a
silent or reasoning-only turn no later chunk poll may ever run — leaving the
request to wait out the whole turn, the exact stall this channel removes.
`subscribePreempt` now replays an existing arm to the newly registered listener
only, after registration: waking the whole set would re-notify runs that
already looked, and waking before registration would leave a concurrent arm
with nowhere to land. The `createdAt` fence is unchanged and still gates the
replay.
The SDK also reads the level flag once at each attempt's start, so this is
belt-and-braces rather than the sole cover — but it makes the host correct on
its own terms instead of resting on when the SDK happens to look.
* 🔧 chore: Update @librechat/agents dependency to version 3.7.14 in package-lock.json and related package.json files
* 🔧 chore: Update dependencies in package-lock.json and package.json
- Bump versions for @humanfs/core (0.19.1 to 0.19.2), @humanfs/node (0.16.6 to 0.16.8), @xmldom/xmldom (0.8.13 to 0.8.15), and qs (6.15.2 to 6.16.0).
- Add @humanfs/types (0.15.0) as a new dependency for @humanfs/node.
- Update dependencies for side-channel and side-channel-list to their latest versions.
* 🛑 fix: Forward Run Abort Signal to Foreground Tool Calls
Stopping a generation left in-flight tool calls running on the far side.
For MCP over streamable-http the external server kept burning CPU until
the tool finished or timed out, with no `notifications/cancelled` ever
sent.
The MCP layer was never the problem: `MCPManager.callTool` already
spreads `options.signal` into `client.request`, and the SDK's
`Protocol.request` sends `notifications/cancelled` the moment that signal
aborts. The signal simply never arrived.
Agent tools do not execute inside LangGraph's ToolNode — `eventDrivenMode`
dispatches `on_tool_execute` and `createToolExecuteHandler` invokes them.
The agents SDK puts the run's abort signal on the batch request
(`ToolExecuteBatchRequest.signal`, documented as one handlers should
forward), but the handler destructured every field except `signal` and
built its invoke config without it. `config.signal` was therefore
`undefined` in every foreground tool, so `createMCPTool` derived no
signal and the SDK registered no abort listener.
Forward it. This restores cancellation for all signal-aware foreground
tools, not just MCP. The detached background invoke keeps its own
controller, since that work deliberately outlives the turn.
An aborted call now rejects promptly and resolves an error result rather
than hanging, so the abort is logged at debug instead of as a tool error
— a user pressing Stop should not spray the error log.
* 🔇 fix: Keep Cancelled Tool Calls on the Filtered Path and Out of Error Logs
Addresses both findings from the Codex review of 48fded564a.
P1 — the cancellation branch returned before `filteredToolOutputResult`,
so with tool-output filtering configured an aborted call's error text
reached the turn uninspected. Worse, `runSignal.aborted` says the run is
over, not that this rejection was the cancellation: an unrelated failure
racing the Stop took the same unfiltered exit. Cancellation now only
selects the log level; filtering and the result shape are unchanged.
P2 — `createMCPTool` logs its own error before wrapping and rethrowing,
so every Stop during an MCP call still emitted an error-level MCP entry
and could pollute operational alerts. That catch now recognizes the abort
and logs at debug; the wrapped message still reaches the turn.
Both are covered by tests that fail against the previous commit.
* 🎯 fix: Require an Abort-Shaped Error and Spare Shared OAuth Flows
Addresses both findings from the Codex review of b3c67082cd.
An aborted run signal proves the turn is over, not that the rejection in
hand was the cancellation — a permission, OAuth, or upstream failure can
reject in the same tick a user presses Stop. Both quiet-log branches now
require the error to look like an abort as well, so a real failure racing
the Stop stays at error level and visible to operational alerts.
`isAbortError` moves to `@librechat/api` and the copy in
`abortMiddleware` is retired, keeping one implementation. Its spec pulls
the real function through its partial package mock rather than asserting
a stub.
Forwarding the run signal also reached ActionService, where two of the
three OAuth flows are keyed `userId:action_id` and so outlive the run
that opened them: a second run for the same action joins the very same
record, and the browser's OAuth callback reads its metadata to exchange
the code. `monitorFlow` deletes the key when a waiter's signal aborts, so
one Stop could strand a concurrent run and discard an authorization the
user had already granted. Those two flows no longer take the signal; the
run-scoped login flow, keyed by thread and run, still does.
Every guard is covered by a test that fails when the guard is removed.
* 🧷 fix: Detach the Stopped OAuth Waiter Instead of Dropping Its Signal
Addresses the Codex review of d53ff170ab.
Withholding the run signal from the shared Action OAuth flows protected
concurrent runs and the browser callback, but left this invocation
attached to the flow after the Stop. A callback landing late then resumed
`_call` straight into `preparedExecutor.execute` — a consequential API
request running after the user had already stopped the turn. Handing the
signal back is not the answer either, since `monitorFlow` deletes the
shared `userId:action_id` key on abort.
`detachOnAbort` separates the two: the caller stops waiting the moment
the signal aborts, while the shared flow runs on for whoever else needs
it — another run, or the callback exchanging its code. Late settlement of
the detached work is swallowed rather than surfacing as an unhandled
rejection.
Both shared flows now use it. The run-scoped login flow keeps the signal
directly, as nothing outside its run observes it.
* 🪪 fix: Keep an Action OAuth Abort an Abort
Addresses two of the three findings from the Codex review of 70fc0782b1.
Detaching the stopped waiter left the rejection to be misread on the way
out. The refresh catch treated it as a failed refresh and called
`requestLogin()`, emitting an OAuth prompt and opening pending
authorization state for a turn that had already ended. `requestLogin` and
the surrounding auth catch relabelled it `Failed to authenticate OAuth
tool` / `Authentication failed`, and the outer catch handed that to
`logAxiosError` — so an ordinary Stop produced two error-level entries
and returned failure text as the tool's result. Each boundary now lets an
abort through unchanged, and the outer catch logs it at debug and
rethrows so it stays a cancellation end to end.
Deferred: waiter-only cancellation in `FlowStateManager`, so a detached
`monitorFlow` stops polling instead of running out the flow's TTL. That
poller is bounded at three minutes and lives exactly as long as it does
for a waiter that never left, so it changes no lifetime this branch
introduced; giving `FlowStateManager` a non-destructive abort mode is its
own change, shared with MCP and indexSync.
* 🤫 fix: Classify the Abort at the MCPManager Boundary Too
Addresses the Codex review of 9bcf1aa57e.
`MCPManager.callTool` logs every rejection at error level before
rethrowing to `createMCPTool`, so a user Stop still emitted an MCP error
from the inner boundary even after the outer one learned to recognize it.
The same signal-plus-abort-shape classification now applies here.
The review also noted, correctly, that the existing test could not have
caught this: it replaces `getMCPManager` wholesale, so it only ever
exercised the outer logger. The new cases drive the real manager with a
connection whose `client.request` rejects the way the SDK does once a
request signal aborts, and cover both the cancellation and a genuine
failure racing the Stop.
* 🧹 chore: Restore Import Order in the Agents Tool Handler
Claude Fable 5.1 (`claude-fable-5-1`, GA 2026-09-01) succeeds Claude Fable 5
at the same input/output prices, with a 1M context window and 128K max output.
The Mythos-class helpers added for Fable 5 already match it — `isMythosClassModel`
tests `claude-(?:fable|mythos)[-.]?\d`, so adaptive thinking, summarized-display
opt-in, sampling omission, 1M context, the 128K output clamp, prompt caching,
the Vertex multi-region gate, and the Bedrock PDF exemption all cover 5.1
without a code change. What was missing was registration and pricing.
Cache reads are the one rate that differs, and the substring matcher would have
silently gotten it wrong: `claude-fable-5-1` falls through to the `claude-fable-5`
key, which prices cache hits at the usual 0.1x base input ($1/MTok). Fable 5.1
and Mythos 5.1 price them at 0.025x ($0.25/MTok), so every cache read would have
billed 4x — on exactly the long agentic sessions this model is built for.
- Register `claude-fable-5-1` in the shared Anthropic list and
`global.anthropic.claude-fable-5-1` in the Bedrock list
- Add 1M context / 128K output entries for `claude-fable-5-1` and
`claude-mythos-5-1`
- Add $10/$50 rates and `{ write: 12.5, read: 0.25 }` cache rates for both
- Update the `.env.example` and Vertex `librechat.example.yaml` examples
- Test that 5.1 resolves to its own key rather than collapsing onto 5.0, across
token maps, pricing, cache rates, and Mythos-class detection
The three documented breaking changes from Fable 5 need no handling here:
LibreChat never sends a forced `tool_choice` on the Anthropic path (the agents
SDK omits the param when unset, so the API default `auto` applies); thinking
blocks an earlier model can't read are dropped server-side, unbilled; and
history is rebuilt from stored content parts rather than replayed signed
thinking blocks, so the prefix-binding check has nothing to reject.
Refs #15506
Queue a message during a run — queue, not steer — and the row is server-owned:
`useQueueDrain` deliberately declines the boundary (`serverOwnsBoundary`) and
the backend admits the successor itself. So the client has to hear about that
run through the active-job list, exactly like a background-tool continuation.
It cannot. Finishing a run empties the list — the client removes its own job
optimistically the moment FINAL lands — and the poll is disabled on an empty
list, so it goes quiet at precisely the moment the successor is admitted. With
the tab already focused there is no focus refetch either, which is why this
reproduces on desktop and not only on mobile. The announcement never arrives,
so the re-arm never runs and the pane sits on the previous turn until a reload.
Keep asking for a bounded window after the last known job ends. The window is
module-scoped rather than per-observer because this is one shared query and a
component mounting mid-handover should inherit the grace, not restart it.
This is the other half of the previous commits: without the re-arm the
announcement lands on a pane that still reads its finished submission as an
attachment, and without this the announcement never lands at all. Neither half
is observable alone.
* 🔁 fix: Recover Keyv Redis Client From READONLY Replica After Failover
When a Sentinel failover demotes the master a pod is connected to, the
ioredis client recovers through `reconnectOnError`, but the Keyv/node-redis
client never does: `socket.reconnectStrategy` only runs when the socket
closes, and a demoted replica keeps existing sockets open while rejecting
every write with `READONLY`. Every cache write through the Keyv client
(USER_PRINCIPALS, MCP catalog, server configs) then fails until restart.
- Add a READONLY recovery hook for the standalone node-redis client that
tears the socket down and reconnects, re-resolving to the current master
- Debounce attempts with `REDIS_READONLY_RECOVERY_INTERVAL` (5s default)
and retry on the next error, since a reconnect issued before the
topology settles can land on the demoted node again
- Route all three surfaces where READONLY replies appear through the hook:
the client error event, the Keyv cache error funnel, and Lua scripts
evaluated via `evalKeyvRedisScript`, which reject straight to callers
- Skip cluster clients, which follow MOVED to the owning master already
- Cover the hook with a fake RESP server so real node-redis and Keyv code
paths are exercised against a node whose role flips mid-connection
Fixes#15500
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🛟 fix: Harden READONLY Recovery Retry, Clear Path, and Clock
Address review findings on the READONLY failover recovery:
- Retry on the next error of any kind after a failed reconnect. A failed
`connect()` leaves the client closed, so later failures surface as
ClientClosedError rather than READONLY and the hook never fired again
- Route the namespace `clear()` override through recovery. It deletes
through the raw client, bypassing the Keyv error funnel, so a READONLY
rejection there previously left the pod stranded
- Debounce on an injectable monotonic clock (`performance.now`) instead of
`Date.now`, so wall-clock steps cannot suppress or duplicate attempts;
the interval test drives the clock instead of sleeping
- Reuse `isReadonlyReplicaError` in the ioredis `reconnectOnError` hook so
READONLY detection has one definition
- Document the in-flight command rejection that a socket teardown implies
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WNbgMeR2aZDyhsqAy4L8gF
* 🛟 fix: Gate READONLY Recovery on Client State
Address the second review pass on the READONLY failover recovery:
- Act only on a client the hook can reason about: a READONLY reply on a
ready socket, or a client its own failed reconnect left closed. While
node-redis runs its own reconnect loop (open but not ready) the hook
stays out, since a second `connect()` would start a concurrent loop
that leaks sockets into one shared reply decoder
- Clear the pending retry whenever an error arrives on a ready client, so
a client that Keyv auto-connected after a failed attempt is never torn
down by a later unrelated error
- Drop the client error-event wiring: node-redis rejects command error
replies straight to the command promise and emits `error` only from its
socket and connect loop, so that listener could never see a READONLY
reply and only fed connect-loop errors back into the hook
- Cover the connect-loop, self-recovered, and Keyv auto-connect outage
cases, and a rejected namespace clear, with a SCAN-aware RESP server
- Add the new export to the `redisClients` mocks in the cacheFactory specs
* 🔧 fix: Update sanitize-html to version 2.17.7 in package.json and package-lock.json
* 🔧 chore: Update postcss-selector-parser to versions 6.1.3 and 7.1.3 in package.json
* feat: Handle reaching the agent tool-call limit gracefully
When the graph exhausts its per-turn step budget, persist the turn as
unfinished with finish_reason tool_call_limit instead of a red error.
Warn the model as the budget runs low, and offer Keep going or Answer now.
* docs: Add screenshots of the tool-call-limit notice
Light and dark captures of the unfinished-turn card for the PR description.
* style: Tighten the tool-call-limit notice card
Pin dismiss to the top-right with uniform rounding, use a slightly
smaller hit target, and round the card to xl. Refresh the PR screenshots.
* fix: Address Copilot review findings on the step-budget path
Skip empty and subagent-scoped PostToolBatch events when counting
rounds. Drop the double-cast in the notice test helper and coerce the
tool-call-limit finish reason in the Continue-gate spec.
* fix: Address Codex review findings on budget and dismiss
Pass the resolved recursion limit into the OpenAI-compatible
processStream path so the step-budget hook matches the graph.
Reset the notice dismiss state when the displayed message id changes.
* fix: Unblock CI typecheck and import sorting
Declare recursion_limit on the OpenAI service agent type, sort that
file's local imports, and route the notice test context through unknown
so tsc accepts the partial ChatContext fixture.
* fix: Sort remaining PR imports for static checks
* chore: Remove tool-call-limit notice screenshots
* fix: Keep recovery actions from consuming composer drafts
Pass empty file, skill, and quote overrides on Keep going and Answer
now so a staged compose is not attached or drained.
* 🔄 fix: Reindex MeiliSearch Documents After Indexed-Projection Changes
- Introduce _meiliIndexSchemaVersion schema field and MEILI_INDEX_SCHEMA_VERSION constant
- Stamp schema version on single-document and batch index writes
- Query unindexed and stale-version documents in syncWithMeili
- Count stale documents in pendingIndexing in getSyncProgress
- Add spec coverage for reindexing stale-version documents
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* 🔄 test: use the registered Meili conversation model
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* 🔄 style: satisfy Prettier in Meili indexing progress counts
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Danny Avila <danny@librechat.ai>
* 🔍 fix: Include Message-Matched Conversations in Sidebar Search
- Union conversation and message index matches in getConvosByCursor
- Type searchMessages with SearchParams and SchemaWithMeiliMethods
- Inject searchMessages into createConversationMethods
- Bound sidebar Meili queries with 1000 limit and attributesToRetrieve
- Fall back to title-only matches when message search fails or is uninjected
- Escape filter user values in search queries
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(search): preserve original conversation keys in sidebar hits
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* 🔍 fix: reuse the loaded conversation model
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* 🔍 fix: type the loaded conversation search model
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
`createPayload` interpolated the endpoint name straight into the chat URL,
so a custom endpoint named `Company/API` produced
`/api/agents/chat/Company/API`. The slash reads as a path separator, the
request no longer matches the router's `/:endpoint`, and it falls through
to the catch-all handler, which answers `404 Endpoint not found`.
Encoding the name keeps it a single path segment. Express matches the
encoded segment and decodes it back, and the endpoint the server acts on
comes from the request body regardless, so nothing else has to change.
Closes#15270
* fix(api): align message search with page size
Pass a positive, capped page size to MeiliSearch and use the same conversation limit so requested message search pages are not silently truncated.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* fix(data-schemas): expand shared-link search results
Request the MeiliSearch result ceiling using only conversationId so cursor pagination is not limited to the default 20 hits or burdened with unused fields.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* 🚧 fix: Narrow Chat MCP Selections to What the Picker May Offer
The chat MCP picker offers a server only when the operator has not hidden it
(`chatMenu: false`) and the user reaches it directly rather than through an
agent (`consumeOnly`). Nothing enforced either condition on the request, so a
stale client, a replayed body, or a hand-written one could name any server and
get its tools — `consumeOnly` in particular is a permission the registry derives
per user, so ignoring it let a user reach in plain chat a server they had only
been granted through an agent.
Narrow the picker's selection in the two ephemeral loaders, against the same
predicate the client's `selectableServers` uses. The resolver is injected, so
`packages/api` stays free of the registry and the loaders keep their existing
`deps` shape.
Provenance is why this lives in the loaders rather than at the tool-resolution
chokepoint: only here is a server name known to have come from the picker.
Servers a model spec pins are the operator's own choice and are added after the
narrowing, so pinning a chat-hidden server to a spec keeps working.
`chatMenu` only ever comes from the config tier, so the overlay settles it with
no lookup at all. Lookups for the rest run concurrently and are cached per
server and user. A name the registry cannot resolve — request-tier, declared on
the body and never registered — is kept, as is one whose lookup fails: this
narrows an already-authenticated selection and is not the authorization
boundary.
* 📝 docs: Say What chatMenu Now Bounds
The schema still described `chatMenu` as dropdown visibility alone, which is
misleading now that it also bars a server from the chat selection a request
carries. Spell out both halves, and what it deliberately does not restrict:
agents, and servers a model spec pins.
* 🛡️ fix: Close Four Gaps in the Chat MCP Narrowing
Dedupe before resolving. The selection is request-supplied and the loaders used
to build a `Set` immediately; mapping the raw array first let one body repeat a
name enough times to launch a resolver — registry, cache, and ACL reads, with no
single-flight — per occurrence.
Resolve names through the tool-loading aliases. A configured `private server` is
addressable as `private_server` downstream, so an exact-key lookup let the
normalized spelling walk past a `chatMenu: false` check and still load tools.
Names are returned as sent; only the decision is canonicalized.
Let the request overlay settle `chatMenu`. The config tier is where the flag
lives and is what the picker itself was built from, so an overlay that re-enables
a server now outranks the durable config the registry returns, which was silently
dropping a valid selection. `consumeOnly` still comes from the registry.
Narrow the request body, not just the loader's copy. `applyContextToAgent` reads
`req.body.ephemeralAgent.mcp` directly and prefers it over the agent's tools, so
a hidden server's `serverInstructions` reached the model context even after its
tools were dropped.
* 🧭 fix: Ask the Registry Which MCP Servers the Picker May Offer
Three rounds of review found the same mistake in three disguises: this narrowing
re-derived the registry's tier precedence instead of asking for it. A config
entry was treated as authoritative over a user-DB or process-backed server of the
same name; the alias map was built from config names only, so a DB server named
`private_server` was misrouted to a config `private server`; and the overlay
short-circuit ran before any of that could be consulted.
Resolve the accessible set through `resolveAllMcpConfigs` instead — the same call
behind `GET /api/mcp/servers`, so what the request may use and what the picker
was offered come from one place and cannot drift. Precedence, cross-tier name
collisions, and the config overlay are the registry's job again, and the
selectability test is a single flag check over what it returns.
The result is smaller: no overlay branch, no per-server lookups, one catalog read
regardless of how long the selection is, and aliases built over the whole
accessible set so an exact name always outranks another server's normalized form.
Publish the servers actually in play back onto the request body, spec pins
included. `applyContextToAgent` prefers that list over the agent's tools, so
narrowing to the picker selection alone had started dropping a spec-pinned
server's `serverInstructions` while suppressing a hidden one's.
* 🔑 fix: Decode Action OAuth Credentials After Decryption
Action client credentials are URL-encoded before encryption, but the OAuth
token exchange decrypted them with `decryptV2` alone, sending values like
`abc%40domain.com` to the provider and causing 401s for secrets containing
`@`, `+`, `=`, `/` or `:`. Decoding falls back to the raw decrypted value so
legacy secrets stored before 299cabd6e (which contain an unescaped `%`) still work.
Fixes#14636
* 🔑 fix: Share Action Credential Codec Between Read Paths
The encode-before-encrypt convention had two readers with different
behaviour. `ActionService.decryptSensitiveValue` decoded unconditionally,
so a credential stored before encoding was introduced (299cabd6e, March
2025) containing a stray `%` threw `URIError` and failed every read of the
action, not just the token exchange.
Extract the pair into `packages/api/src/actions/crypto.ts` as the single
implementation and consume it from both `ActionService` and the OAuth token
exchange, so the two paths cannot drift again.
Tests cover the codec against real crypto: reserved characters and literal
percent escapes round-trip, pre-encoding values are returned unchanged, and
a pre-encoding value with a stray `%` no longer throws.
A version marker on newly encrypted values was prototyped and dropped: it
changes the stored format for every action credential while fixing nothing,
since values written by the encoding convention already decode correctly
and pre-encoding values stay unmarked either way.
---------
Co-authored-by: Danny Avila <danny@librechat.ai>
* 🫥 fix: Clear Hidden MCP Chat Selections
A server hidden with `chatMenu: false` stayed active in chat when it had been
selected while still visible. The selection persists to localStorage, and the
guard that clears stale selections tested the *filtered* server list — which is
empty precisely when every configured server is hidden, so the guard could never
fire and the selection survived every reload.
Gate the prune on the unfiltered catalog instead. It is non-empty in exactly the
case the old guard missed, and it stays a guard rather than a load flag so an
empty catalog — still loading, or a degraded read — is never mistaken for "the
admin removed everything" and used to wipe a selection irrecoverably.
Clear the ephemeral agent alongside the atom: it is what carries the selection to
the server, so a hidden name has to leave it too, not just the dropdown's state.
Also label the dropdown badge from the servers the menu actually offers. It
counted the raw selection, so a hidden server rendered as "Server Four" or
"2 selected" above an empty menu — the symptom that reads as a server you cannot
turn off.
* 🔧 fix: Keep Spec-Assigned MCP Servers Out of the Hidden-Server Prune
A model spec may deliberately assign a server the chat menu hides, and
`applyModelSpecEphemeralAgent` seeds it straight into `ephemeralAgent.mcp`. The
prune could not tell that apart from a stale selection, so activating such a spec
dropped its server — and because the same function re-reads `LAST_MCP_` for
existing conversations, the loss persisted across navigation.
Exempt whatever the active spec pins. `chatMenu` hides a picker entry; it does
not override an admin's spec assignment.
* 🔒 fix: Confine the MCP Selection Prune to the Hook Instance That Owns It
`useMCPServerManager` has seven call sites, and only `BadgeRowContext` reads the
chat selection — the rest mount it for the catalog, the server actions, or the
status icons. Every instance keyed to the same conversation shares one atom and
one ephemeral agent, so those six were all running the prune too, and the
always-mounted `useSideNavLinks` has no spec context to exempt from: it would
rewrite the selection the picker's own instance was deliberately keeping.
Make managing the selection opt-in, off by default at both layers, and let the
badge row alone opt in. The six catalog consumers stop touching chat selection
state entirely, which is what they should have been doing all along.
Tests now state whether they own the selection rather than inheriting it from a
default, so each one exercises the same configuration as the instance it models.
* 🔁 fix: Mirror the MCP Selection Everywhere, Prune It Only in the Owner
Gating the whole ephemeral-agent sync on selection ownership was too broad. The
action paths — `initializeServer`'s OAuth success, the revoke handler — build
their next selection from `mcpValues` and write it back through `setMCPValues`,
which also rewrites the shared ephemeral agent. An unmirrored instance therefore
wrote a stale list: authenticating server B could drop an existing selection of
server A, leaving only B.
Mirroring and pruning are separate concerns. Every instance mirrors, so each one
builds on the current selection; only the owner prunes, because only it knows
which servers a spec pins.
The picker never set `selection.enablePersistence`, so it dropped the current
selection every time the user opened another folder or switched pivot. A selection
could only ever be assembled from a single location — pick three files, open another
folder, and the three are gone.
One option on the picker configuration; no change to what LibreChat does with the
result.
Fixes the selection half of #15237. Folder selection — the other half — is a new
capability rather than a fix, and is parked on `feat/sharepoint-folder-selection`.
Typing a message, pasting an image, then pressing Enter did nothing: the
composer held the full draft, the send button was enabled, and Enter was
inert until the user clicked back into the textarea — which reads as
"the textarea needs a text change before it will submit".
The send gating was never at fault. Radix's modal `DialogContent` always
cancels its default close-focus restore and focuses
`context.triggerRef.current` instead. `DragDropModal` — the "Select Upload
Type" dialog a paste or a drop opens — is opened programmatically and so has
no `Dialog.Trigger`, leaving that ref null: nothing is focused and focus
falls to `document.body` when the dialog unmounts. Enter-to-send is a
keydown handler on the textarea, so from `body` it is never reached.
`UploadModalProvider` now records the element the upload was started from,
captured in `openModal` before the dialog mounts (an effect runs too late —
Radix has already moved focus), and restores it once the dialog closes,
queued behind Radix's own deferred restore. This covers every close path:
picking a destination, Cancel, Escape, and dismissing the overlay.
`OGDialog`'s existing `triggerRef` seam does not reach this case, since it
only fires through Radix's `onOpenChange` and choosing an upload destination
calls `closeModal()` directly.
