Danny Avila 9277620282 🔒 fix: Anchor the /files/usage hold to upload time ... Codex review on b687922. The hold derived each new deadline from `Date.now()`, so a caller touching once a day advanced it by another 24h every time, far below the rate limit. That left indefinite preservation reachable and made the PR's replay claim wrong: the window was bounded per call but not in aggregate. Anchor the deadline to the file's immutable `createdAt` instead of the request clock. `extendFilesTTL` now takes a lifetime and sets `expiresAt = max(expiresAt, createdAt + holdMs)` in an aggregation pipeline, so the target is a fixed point per file and replay is inert rather than merely bounded. `$max` keeps the widen-only property and the `expiresAt: {$exists: true}` filter still refuses to resurrect a released TTL; `createdAt: {$exists: true}` fail-closes when the anchor is absent. The update runs with `timestamps: false`: a hold is TTL bookkeeping, not a content write, and bumping `updatedAt` also made every re-touch count as a modification, hiding whether the deadline actually moved. Also drop four `.node_modules-*` symlinks that `git add -A` swept in from an npm install. They pointed at absolute paths on one machine, so every other checkout got dangling entries. Added the pattern to .gitignore so a workspace install cannot reintroduce them.		2026-07-27 22:16:47 -04:00
..
react-query	📦 chore: bump @librechat/agents to v3.2.42 (#13848)	2026-06-19 09:47:46 -04:00
specs	✳️ feat: Claude Opus 5 Support (#14422)	2026-07-24 21:45:32 -04:00
src	🔒 fix: Bound /files/usage TTL Hold Instead of Clearing It	2026-07-27 19:09:10 -04:00
.gitignore
babel.config.js
check_updates.sh
jest.config.js	⚡ refactor: Parallelize CI Workflows with Isolated Caching and Fan-Out Test Jobs (#12088)	2026-03-05 13:56:07 -05:00
package.json	✨ v0.8.7 (#13907)	2026-06-24 14:49:32 -04:00
server-rollup.config.js
tsconfig.build.json	⚡ refactor: Migrate data-provider Build to tsdown (split tsc dts) (#13597)	2026-06-08 11:09:16 -04:00
tsconfig.json	📦 chore: npm audit fixes and Mongoose 8.23 TypeScript follow-ups (#12996)	2026-05-07 09:47:40 -04:00
tsconfig.spec.json	📦 chore: Update TypeScript Config for TS v7 (#12794)	2026-04-23 12:51:03 -04:00
tsdown.config.mjs	🪟 fix: Cross-Platform Absolute-Path Check in tsdown neverBundle Predicates (#13700)	2026-06-13 11:04:46 -04:00