LibreChat/client
Danny Avila 5ceabad5f3
🪢 fix: Prune Dangling Skill IDs from Agent Allowlists (#13702)
* 🧹 fix: Prune Dangling Skill IDs from Agent Allowlists

Deleted skills left their ids behind in every agent's `skills` allowlist:
nothing removed them on skill deletion, the builder rendered no chip for
unresolvable ids (so users could neither see nor remove them), and at
runtime the non-empty allowlist intersected with accessible skills to an
empty set — silently disabling the entire skills catalog for the agent
even though the panel looked like "no skills selected."

- deleteSkill / deleteUserSkills now $pull deleted ids from all agent
  allowlists (no versioning, timestamps untouched)
- createAgent / updateAgent prune allowlist ids whose skill doc no longer
  exists (existence-only check, never ACL), so poisoned agents self-heal
  on the next save — including duplicates and sync paths
- the builder renders unresolvable allowlist entries as removable
  "Unavailable skill" chips once the catalog query resolves

* 🪞 fix: Keep Skill Queries and Authoring Labels Truthful After Chat Edits

Skills authored mid-chat via create_file/edit_file never reached the
Skills panel or builder without a manual refresh, and a create_file that
overwrote an existing file still announced "Created" in the tool card.

- invalidate all skill query caches (refetchType: 'all', since the skill
  hooks opt out of refetchOnMount) when a completed create_file/edit_file
  call targets a skills/ path
- label create_file completions from the host-authored output summary:
  overwrites now read "Updated <file>" with the edit icon

* ♻️ refactor: Inject Skill Authoring Callback Instead of Query Client

useStepHandler took useQueryClient directly, forcing a QueryClientProvider
wrapper onto all 54 renderHook calls in its spec. Its only consumer,
useEventHandlers, already holds the query client and does this exact
invalidation pattern for project/MCP keys — so pass an optional
onSkillAuthoringComplete callback instead. Detection stays in the
completion handler; the side effect lives with the client. Spec diff
collapses to pure additions.

* 🩹 fix: Resolve Codex Review Findings on Allowlist Pruning

- normalize allowlist candidates to lowercase in filterExistingSkillIds:
  isValidObjectIdString accepts uppercase hex, but _id.toString() is
  lowercase, so a casing mismatch silently emptied a valid allowlist
  (widening scope to the full catalog)
- prune agent allowlists immediately after the Skill row deletion in
  deleteSkill: a SkillFile cleanup failure previously skipped the prune
  forever, since retries exit early on deletedCount === 0
- filter version-snapshot skills through filterExistingSkillIds in
  revertAgentVersion so reverting to a pre-delete version cannot
  resurrect dangling ids
- resolve allowlist ids missing from the builder's first catalog page
  individually via getSkill before labeling them unavailable — a cache
  miss on a >100-skill catalog no longer invites removing a valid skill

* 🚪 fix: Fail Closed When Pruning Empties a Skill Allowlist

Codex round 2: an automated prune that empties an enabled allowlist
would silently widen the agent to the full accessible catalog (empty +
enabled = full per the #13526 semantics). Hygiene must only ever narrow.

- deleteSkill/deleteUserSkills: agents whose entire allowlist is being
  deleted get skills disabled instead of an emptied-but-enabled list;
  ids are lowercased before the $pull so an uppercase-but-valid id
  cannot leave the dangling entry behind
- createAgent/updateAgent/revertAgentVersion: pruning a non-empty
  allowlist to zero survivors disables skills; an explicit user-sent
  skills: [] keeps the full-catalog semantics
- builder: a per-id skill lookup only renders the removable
  "Unavailable skill" chip on a confirmed 404/403 — transient and
  server errors keep the chip hidden rather than inviting removal
2026-06-13 11:16:14 -04:00
..
public 🎨 chore: Update Agent Tool with new SVG assets (#12065) 2026-03-04 09:28:19 -05:00
scripts
src 🪢 fix: Prune Dangling Skill IDs from Agent Allowlists (#13702) 2026-06-13 11:16:14 -04:00
sw 🛟 fix: Auto-Recover from Stale Service Worker Assets After Deploys (#13686) 2026-06-11 11:57:06 -04:00
test 🧑‍🎨 refactor: Prompts/Sidebar styles for improved UI Consistency (#12426) 2026-04-09 00:02:31 -04:00
babel.config.cjs 🧑‍🎨 refactor: Prompts/Sidebar styles for improved UI Consistency (#12426) 2026-04-09 00:02:31 -04:00
check_updates.sh
index.html 🛟 fix: Auto-Recover from Stale Service Worker Assets After Deploys (#13686) 2026-06-11 11:57:06 -04:00
jest.config.cjs v0.8.6 (#13302) 2026-05-31 17:36:47 -04:00
nginx.conf 📬 docs: Add Forwarded Headers to Nginx SSL Proxy Template (#12379) 2026-03-25 13:04:19 -04:00
package.json 📦 chore: Bump jest-junit to v17.0.0 2026-06-09 20:38:30 -04:00
postcss.config.cjs
tailwind.config.cjs style(MCP): Enhance dialog accessibility and styling consistency (#11585) 2026-02-11 22:08:40 -05:00
tsconfig.json 👷 ci: Type-check the Client Workspace (#13560) 2026-06-06 18:40:31 -04:00
vite.config.ts 🛟 fix: Auto-Recover from Stale Service Worker Assets After Deploys (#13686) 2026-06-11 11:57:06 -04:00