🧳 feat: Register Principal-Owned Code Environments by danny-avila · Pull Request #15365 · LibreChat-AI/LibreChat

danny-avila · 2026-08-30T16:05:31Z

Summary

I added a persisted, tenant-aware code-environment registry governed by LibreChat principals and ACLs, and wired accessible environments into stateful code execution without exposing routing details to clients. This PR depends on #15355 and the paired Code API worker stack.

Add codeEnvironment as an ACL resource with viewer, editor, and owner roles for user, role, group, and public principals.
Require manage:code_environments to register an environment while allowing authenticated users to discover environments granted to their effective principals.
Bind registrations to a deployment-configured attached control plane and ignore client-provided URLs or worker IDs to prevent authenticated SSRF and worker-identity claims.
Keep control-plane URLs and worker IDs server-only while returning safe environment summaries.
Merge only the requesting principal’s accessible environments into the request-scoped agent configuration, with deployment YAML entries taking precedence on ID collisions.
Delete creator-owned environment records and ACL grants during user deletion.
Extend the live bridge E2E to register a principal-owned environment, verify cross-user isolation, and execute two stateful turns through the registered environment.

Change Type

New feature (non-breaking change which adds functionality)

Testing

Built librechat-data-provider, @librechat/data-schemas, and @librechat/api.
Passed 5 focused package tests covering registry ownership, role/group grants, routing secrecy, control-plane binding, collision handling, and user cleanup.
Passed 33 focused API tests covering routes, capability enforcement, deletion lifecycle, and resource coverage.
Passed the live Playwright stateful bridge E2E twice with LibreChat on port 33080, MongoDB on 27028, Redis on 26379, Code API on 23112, an internal Code API queue worker, an outbound paired librechat/code worker, and a network-disabled NsJail sandbox with a real Bash runtime.
Verified a second live user cannot list the owner’s registered environment and verified workspace state persists across two conversation turns.

Test Configuration:

macOS Docker Desktop
Node.js workspace dependencies
Chromium Playwright project
Code API remote-bridge backend with paired worker authentication and stateful affinity
NsJail direct sandbox mode with sandbox networking disabled

Checklist

My code adheres to this project’s style guidelines
I have performed a self-review of my own code
I have commented in complex areas of my code
My changes do not introduce new warnings
I have written tests demonstrating that my changes are effective or that my feature works
Local unit tests pass with my changes
Any changes dependent on mine have been merged and published in downstream modules.

danny-avila · 2026-08-30T16:06:24Z

@codex review

Please review the current PR head b770b93. Confirm that this exact commit is the reviewed commit and ignore findings that apply only to earlier heads.

chatgpt-codex-connector · 2026-08-30T16:06:41Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-30T23:12:50.898210Z	`d6a1a20`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b770b93168

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T18:32:27Z

@codex review

Please review exact head ccd3f1d after the endpoint-discovery fix.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ccd3f1dc91

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T18:47:17Z

@codex review

Please review exact head ced8188 and report only actionable findings introduced by this PR.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ced81883db

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T21:13:01Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d6bc01376d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T21:38:57Z

@codex review exact head 5b2ac50

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 5b2ac505a5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T21:59:45Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6cee1ea5b2

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T22:13:05Z

@codex review exact head 457da5a

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 457da5aea1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T22:26:23Z

@codex review exact head 19ec930

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 19ec930608

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T22:32:37Z

@codex review exact head eb2096e

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eb2096ec92

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T22:38:53Z

@codex review exact head 85c74ef

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 85c74ef0d7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T22:46:07Z

@codex review exact head 99c4e26

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 99c4e26d10

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T22:54:40Z

@codex review exact head 4025d56

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4025d569c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T23:02:52Z

@codex review exact head 99d9f59

chatgpt-codex-connector · 2026-08-30T23:06:17Z

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 99d9f59a9b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

danny-avila · 2026-08-30T23:09:26Z

@codex review exact head d6a1a20

chatgpt-codex-connector · 2026-08-30T23:12:49Z

Codex Review: Didn't find any major issues. Nice work!

Reviewed commit: d6a1a20023

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread api/server/middleware/config/app.js Outdated

Comment thread api/server/routes/code-environments.js Outdated

danny-avila mentioned this pull request Aug 30, 2026

🛫 feat: Enable Self-Service Code Worker Pairing #15367

Merged

9 tasks done

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/code/http.ts Outdated

danny-avila changed the title ~~🧭 feat: Add Principal-Owned Code Environments~~ 🧳 feat: Register Principal-Owned Code Environments Aug 30, 2026

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/code/http.ts Outdated

Comment thread packages/data-schemas/src/methods/accessRole.ts

Comment thread api/server/controllers/UserController.js

danny-avila force-pushed the danny-avila/principal-code-environments branch from 96338b9 to 670498f Compare August 30, 2026 19:38

Base automatically changed from danny-avila/paired-code-environments to dev August 30, 2026 21:12

danny-avila force-pushed the danny-avila/principal-code-environments branch from 670498f to d6bc013 Compare August 30, 2026 21:12

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread api/server/middleware/config/app.js Outdated

Comment thread packages/api/src/code/environments.ts

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/code/http.ts Outdated

Comment thread api/server/routes/accessPermissions.js

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/code/config.ts

Comment thread packages/api/src/code/environments.ts Outdated

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread api/server/controllers/PermissionsController.js Outdated

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/code/config.ts Outdated

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/code/config.ts Outdated

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/code/config.ts Outdated

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/app/service.ts

Comment thread packages/api/src/code/config.ts

chatgpt-codex-connector Bot reviewed Aug 30, 2026

View reviewed changes

Comment thread packages/api/src/app/service.ts Outdated

Comment thread packages/api/src/code/config.ts Outdated

danny-avila added 16 commits August 30, 2026 19:32

feat: add principal-owned code environments

43b8f50

fix: address code environment CI coverage

d4c687b

fix: expose principal code environments in endpoint config

d25cf36

fix: reject missing code environment bodies

3423b71

fix: harden code environment lifecycle

8f7edd4

fix: revalidate principal code environments

22e2804

fix: synchronize code environment authorization

15b979a

fix: bind code environments to current principals

0eff28a

fix: fail closed on code ACL cache errors

e8704a8

fix: prevent code environment override shadowing

414db13

fix: preserve principal environment defaults

b27a2ed

fix: suppress revoked code environment aliases

5525060

fix: fail closed on environment augmentation

c0452c2

fix: narrow code environment defaults

f01831d

fix: isolate code environment fallback

3f7f0ab

style: sort code config imports

d31916f

danny-avila force-pushed the danny-avila/principal-code-environments branch from 65f7f8d to d31916f Compare August 30, 2026 23:32

danny-avila merged commit fcae102 into dev Aug 30, 2026
13 checks passed

danny-avila deleted the danny-avila/principal-code-environments branch August 30, 2026 23:33

Conversation

danny-avila commented Aug 30, 2026

Summary

Change Type

Testing

Test Configuration:

Checklist

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot commented Aug 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

danny-avila commented Aug 30, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot commented Aug 30, 2026 •

edited

Loading