LibreChat/api
Danny Avila d411512a98
⬆️ chore: Bump @librechat/agents to v3.6.0 (#14890)
* ⬆️ chore: Bump `@librechat/agents` to v3.6.0

Bumps the pin in `api` and `packages/api` from `^3.5.1` to `^3.6.0`. The
caret on `^3.5.1` cannot cross the minor, so both manifests and the lockfile
need the explicit bump.

v3.6.0 contains three changes over v3.5.1, all additive:

- `fix: Close Subagent Child-Graph Run Steps` — subagent child graphs run via
  `workflow.invoke()` outside `Run.processStream`, so the terminal sweep never
  reached their steps. They now close on both the success and error paths,
  which is what makes `on_run_step_closed` reliable for subagent tool cards.
- `fix: Restore Run Steps Across Process Resumes` — open run-step lifecycle
  state is now persisted in LangGraph checkpoints, so a step opened by one
  process closes correctly after a resume on another.
- `feat: route code execution per agent profile` — new optional
  `codeSessionKey` partition for code-session ids and file refs.

No breaking changes: every new field on the public type surface is optional,
and the package's own dependency set is unchanged between the two versions
(verified against the registry), so the lockfile diff is limited to the
`@librechat/agents` entry itself.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014vLhxCFMYkCaTsoFTiAjJ5

* 🔒 chore: Sync `bun.lock` with the agents v3.6.0 bump

`bun.lock` still recorded both workspace requirements and the resolved
package as `@librechat/agents@3.5.1`, which no longer satisfies `^3.6.0`, so
`bun install --frozen-lockfile` would reject the committed state.

`bun install --lockfile-only` cannot run in this environment: bun stores no
integrity for the `xlsx` URL dependency and therefore re-fetches
`cdn.sheetjs.com`, which the sandbox network policy denies (403 on CONNECT).
The entry was updated directly instead, which is exact here because the
package's dependency graph does not move between the two versions: its
`dependencies`, `peerDependencies` and `optionalPeers` at 3.6.0 are identical
to 3.5.1 (checked against the registry), so only the version, the resolution
id and the integrity hash change. The integrity matches the one npm resolved
into `package-lock.json`, and the two existing
`@librechat/agents/*` hoisting overrides stay valid because the dependency
set they resolve is unchanged.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_014vLhxCFMYkCaTsoFTiAjJ5

---------

Co-authored-by: Claude <noreply@anthropic.com>
2026-08-16 09:15:35 -04:00
..
app 🤐 feat: Allow Promptless Sends When Files Are Attached (#13717) 2026-08-15 12:47:31 -04:00
cache
config 🫆 chore: Remove Published Credential Defaults (#14680) 2026-08-07 07:25:05 -04:00
db
models
server 🧩 fix: Normalize MCP UI Resource Rendering (#14868) 2026-08-15 12:49:59 -04:00
strategies 🏘️ fix: Scope OpenID User Cache Keys to Signed User Identity (#14837) 2026-08-14 15:51:18 -04:00
test 🧱 fix: Enforce Agent Runtime File Trust Boundaries (#14577) 2026-08-02 14:18:28 -04:00
utils feat: Add Gemini 3.7 Flash Support (#14818) 2026-08-14 01:12:42 -04:00
jest.config.js
jsconfig.json
package.json ⬆️ chore: Bump @librechat/agents to v3.6.0 (#14890) 2026-08-16 09:15:35 -04:00
typedefs.js 🛂 test: Cover Tool Approval Workflows End to End (#14427) 2026-07-26 21:58:25 -04:00