mirror of
https://github.com/danny-avila/LibreChat.git
synced 2026-10-30 18:48:48 +00:00
dcdaaeac67
* 🤐 fix: Exclude Provider Secrets from HITL Pending Actions Sanitize resolved model parameters before persisting them in the pending action's resumeContext, and strip resumeContext/requestFingerprint from every client-facing copy (SSE emit, reconnect gap-fill, resume state, status route). The full record stays server-side for resume replay. * 🤐 fix: Treat Header-Carrier Keys as Sensitive Wholesale Google llmConfig places the Authorization header in customHeaders, and header names like Ocp-Apim-Subscription-Key defeat name heuristics. Match 'header' as a key fragment so every header-carrier object is dropped rather than relying on exact carrier names. * 🤐 fix: Strip Preconfigured Client Instances from Resume Params Bedrock stores a BedrockRuntimeClient on llmConfig.client when PROXY or a bearer token is configured; replaying it would also fold a mangled client object into additionalModelRequestFields on resume. |
||
|---|---|---|
| .. | ||
| __tests__ | ||
| actions.js | ||
| chat.js | ||
| index.js | ||
| middleware.js | ||
| openai.js | ||
| responses.js | ||
| tools.js | ||
| v1.js | ||