mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-11-12 09:45:47 +00:00
d875425ed2
* 🔐 fix: Authorize Restored MCP Tools Before Agent Revert Writes Them Reverting wrote the version snapshot, including its mcpServerNames, before filterAuthorizedTools ran. Agent-scoped MCP access is granted from that index, so a restored server vouched for itself and an editor without access to it could re-attach it. A snapshot without mcpServerNames also left the current index in place, keeping agent-scoped access to servers no tool used. The handler now authorizes the restored tools against the agent as it stands, treating only its current tools as existing, and passes the authorized tools and rebuilt index to revertAgentVersion so the restore is one write pinned to the revision it was checked against. revertAgentVersion always rewrites the index for the restored tools. * 🔐 fix: Exclude the Target Agent's Own Grant When Authorizing a Revert Moves the restore authorization into authorizeAgentRestore in packages/api, leaving the revert controller as wiring. A newly restored MCP tool whose server the user reaches only through agents must now be reachable through an agent other than the one being reverted, checked fresh against the database. The target's current or cached index (including one left stale by an earlier revert) no longer vouches for it. Prior server names are matched through their normalized aliases, and only for tools the agent already had. When nothing resolves, the pre-restore index is kept instead of deriving names from tool keys. A revision-filtered restore that misses is reported as a 409 conflict. The route spec restores the real ~/config so the MCP registry is consulted rather than reported unavailable. * 🔐 fix: Check Newly Restored MCP Servers Against Live Grants The restore gate now runs for every approved MCP tool, not only consumeOnly ones. A tool the agent doesn't already have, on a DB-backed server, is admitted when a current tool still uses that server, or on a live direct server grant, or through another viewable agent. A grant the registry still caches after revocation no longer becomes durable through the restored index. Admission is memoized per server. A snapshot tools array that sanitizes to nothing restores an explicit empty set. Active-server matching no longer reuses the index fallback, so a stale entry is never read as in use. * 🔐 fix: Treat Legacy Cached DB Configs as User-Sourced in the Restore Gate A config cached before an upgrade may carry a dbId without source. The restore gate now uses isUserSourced, so such configs get the live access check instead of passing as operator-managed. * 🔐 fix: Recheck Unindexed Existing MCP Tools in the Restore Gate Holding a tool no longer exempts it from the live check. Only a current tool whose server the agent's index already lists skips it. Otherwise an unindexed tool on a legacy agent could pass on a revoked grant the registry still caches, and the restore would add its server to the index. * ⚡ perf: Run Restore Admission Checks for Distinct Servers Concurrently filterAuthorizedTools now starts every admission check during its single pass and awaits them together, so each distinct DB-backed server no longer adds a serial lookup wave to the revert. Tool order is preserved and server names are recorded only for admitted tools. |
||
|---|---|---|
| .. | ||
| __tests__ | ||
| callbacks.background.spec.js | ||
| callbacks.js | ||
| client.codeDecision.spec.js | ||
| client.imageDetail.spec.js | ||
| client.js | ||
| client.test.js | ||
| filterAuthorizedTools.spec.js | ||
| openai.js | ||
| protocol.js | ||
| queuedTurns.js | ||
| recordCollectedUsage.spec.js | ||
| request.js | ||
| responses.js | ||
| resume.js | ||
| steer.js | ||
| v1.js | ||
| v1.spec.js | ||