Repository navigation
Temporary: asset upload for upstream PR - #1
Closed
Nk-rodrigues wants to merge 2811 commits into
Closed
Nk-rodrigues wants to merge 2811 commits into
Nk-rodrigues wants to merge 2811 commits into
Conversation
Each mirrored skill now records a sync fingerprint in its sourceMetadata, hashing the mapping version, the upstream identity (source coordinates, skill path and SKILL.md blob id) and the stored definition. When a later run finds the fingerprint still matching and the stored files matching the discovered blobs, it neither downloads SKILL.md nor re-reads and updates the skill; the public viewer grant, name-conflict cleanup, stale-skill reconciliation and status counts run as before. Mirrors without a fingerprint take the full path once and record it.
* fix: Stage URL prompts before agent submission * test: Preserve startup cache in URL composer coverage * fix: Preserve URL drafts and schema-normalized spec readiness * fix: Scope URL submission lifecycle and retain spec overrides * fix: Match retained tools and inherited project transitions * fix: Preserve source drafts while staging URL prompts * fix: Reconcile URL routes and persist settled prompts * fix: Preserve existing project conversation ownership * test: Await settled activity fold before checking its prose * fix: Hold dictation sends during URL preparation * fix: Hold live-run composer actions during URL preparation * fix: Process subsequent URL prompt navigations --------- Co-authored-by: Lia <lia@librechat.ai>
* feat: enforce scheduled MCP read-only authority * fix: preserve startup admission and enforce consent deadline * fix: fail closed on malformed scheduled consent * fix: preserve scheduled MCP authority failure receipts * fix: preserve scheduled MCP handoffs and manual runs * fix: persist mandatory scheduled tool policy denials * fix: fence late scheduled consent and retain denial recovery * fix: retain scheduled transport denials and prevent replay * fix: merge retained scheduled denials during settlement * fix: prevent enrolled schedule completion wakeup escapes * fix: close scheduled consent admission and receipt races * fix: retain scheduled completion authority across approval * fix: retain safe scheduled authorization dependency denials * fix: sanitize scheduled authorization preparation failures * fix: bind schedule completion authority to task origin --------- Co-authored-by: Lia <lia@librechat.ai>
…6727) Co-authored-by: Lia <lia@librechat.ai>
…AI#16728) * fix: Separate workspace admission and transport budgets * fix: Validate workspace run reserves and retry test types --------- Co-authored-by: Lia <lia@librechat.ai>
Co-authored-by: Lia <lia@librechat.ai>
…hat-AI#16697) Reconciles current dev while preserving manual title ownership, existing menus, and configuration regressions. Co-authored-by: Lia <lia@librechat.ai>
…ogs to RUM (LibreChat-AI#16701) * 🔭 feat: Recover Stale Chunks Without the Error Page and Ship Client Logs to RUM Stale chunks: a tab left open across a deploy that opens a code-split panel requests a hashed chunk the new deploy removed. Vite's preload handler hands the failure to the stale-asset recovery, which reloads, but the import then resolves to `undefined` and `React.lazy` throws a TypeError into the route error boundary, so the error page flashes before the reload. Lazy imports now go through `lazyWithRecovery`/`importWithRecovery`, which turn that result into a `ChunkLoadError`; the route boundary recognizes chunk failures (and any error while a recovery reload is underway), asks the page recovery once, and renders a localized "Updating to the latest version…" status. When the loop guard declines, the normal error page with its reload action shows instead. The page recovery is now idempotent within a page, so concurrent callers join the in-flight reload rather than tripping the guard. Client logs: with RUM in proxy mode, the client logger's warn/error calls, error-boundary catches and stale-asset recovery events are exported as OTLP log records through the authenticated `/api/rum/v1/logs` proxy. Records carry allowlisted, scrubbed fields only, follow RUM session sampling, dedupe repeats with a count, are budgeted per minute and per page, batch with backoff, flush with keepalive on page hide, and stop after persistent failures. The proxy now refuses non-OTLP content types and applies a per-user rate limit. `RUM_CLIENT_LOGS=false` turns the export off. * 🔒 fix: Keep Client Logs Opt-In and Drop Application Error Messages - RUM_CLIENT_LOGS now defaults to off, like console capture, so enabling RUM proxy mode never starts a new log stream on its own. - Error messages are exported only for engine, browser and library generated types (TypeError, SyntaxError, DOMException, AxiosError, chunk failures); application errors keep type, status and stack only, since their messages can echo prompt or response text. All quoted fragments are now redacted. - Batches are measured in encoded UTF-8 bytes of the exact request body, and page hide drains every queued record that fits the keepalive quota. - Queued stale-asset events are delivered as soon as the log exporter starts, independent of the RUM SDK loading, and marked so they are never logged twice. * 🔒 fix: Export Only Known Generated Error Messages and Ack Queued Events - Error messages are exported only when the whole text matches a known engine, browser or library message shape (property access on undefined, "x is not a function", fetch/abort/axios status, chunk and CSS preload failures). The error class alone no longer qualifies, since any code can throw a TypeError carrying arbitrary text. - Queued stale-asset events are marked logged only after the collector accepts the record carrying them, so an undelivered event replays on the next page; in-flight events are skipped by the SDK path. - A fractional RUM_PROXY_USER_MAX below one falls back to the default instead of flooring to a limit of zero. * 🔒 fix: Hold Unacknowledged Asset Events, Re-send In-Flight Logs on Hide - The RUM SDK flush no longer drops queued stale-asset events whose client log record is still unacknowledged: they stay queued and persisted, flagged so their SDK action is not repeated, and leave the queue once the collector accepts the record. - Page hide re-sends the records of an unanswered regular request with keepalive; each record belongs to the latest request carrying it, so a late response to the original request neither marks nor requeues it. - Client-log export stops when the authenticated layout unmounts. - The proxy refuses /v1/logs while client logs, console capture and replay are all off, so turning RUM_CLIENT_LOGS off also stops tabs that still hold an older startup config. * 🔒 fix: Export Only Complete Stack Frames, Never the Message Header Stack reduction now strips the V8 `name: message` header (including every line of a multi-line message) and keeps only lines with a complete V8, Gecko or WebKit frame shape that ends in a URL or absolute path with a line number. A message ending in a source-position-like suffix can no longer pass as a frame. * fix: centralize RUM delivery and asset recovery lifecycle * fix: preserve RUM page lifetime and collector acknowledgements * fix: retain page transport quotas and recover functional chunks * fix: scope RUM client sessions to authenticated identity --------- Co-authored-by: Lia <lia@librechat.ai>
…#16722) * 🪜 feat: Light the Fold Path to the Hovered Activity Row - Every fold that holds the hovered row lights its rail from its header down to that row; the innermost turns into the row with an elbow, so depth reads as the number of lit rails. - One pointer listener on the outermost fold writes the path onto the rails directly (a data attribute and a length variable), coalesced to one frame: hovering repaints rails, never rows. - Rows are found by the shared glyph slot every row line starts with, so no row component marks itself. - The path clears over a rail (which shows its own collapse hover), on touch, on a press and when the pointer leaves. * fix: Invalidate Fold Hover Paths and Reuse Glyph Lists * fix: Scope Fold Paths to Agent Lanes and Register Subagent Glyphs * fix: Re-Hit-Test Queued Fold Paths After Scroll * fix: Clear Fold Paths After Ancestor Layout Shifts --------- Co-authored-by: Lia <lia@librechat.ai>
…t-AI#16725) * test: Cover Alias Frontmatter Keys in the Skill Sync Skip * test: Assert the Alias Frontmatter Rerun Succeeds Without Skips
* feat: Add Lia's Behavior Engine A framework-free engine that plays Lia's actions step by step, moves her along a platform, and lets her choose her own activities. An attention budget keeps her quiet while the user types and saves bigger routines for when they step away. The catalog holds feelings, speech, gestures, dances, travel, small routines and page reactions. * fix: Let a Click Wake Lia From a Nap and Run One Animation Loop * fix: Keep Lia Stopped When Stopped Mid-Frame and Snap Walks Under Reduced Motion * fix: Wake Lia When Typing Interrupts a Nap and Keep Her Walks on the Current Platform * test: Drive Lia's Engine on Real Animation Frames in a Browser * fix: Keep One Animation Loop Across a Mid-Frame Restart and Place Lia Before Her First Move * fix: Play Every Step of an Action the Host Chains From onAction * test: Require Lia's Reduced-Motion Chooser to Pick Something * fix: Keep Lia Free to Act Before the First Keystroke and Skip Pointer Walks Without a Pointer * fix: Hold Lia's Step While She Has No Layout and Replace Actions Without a Gap * fix: Keep the Walk of an Action Started When the Previous One Ends * fix: Wake Lia From a Nap Played Above Reaction Priority * fix: Pause Lia's Screen and Face Clocks Along With Her Step * fix: Stop Lia's Own Clock While She Has No Layout and Ignore Empty Obstacles
…e Ref's Profile (LibreChat-AI#16671) deleteCodeEnvFile rethrew every error except 404. A deployment that only serves the stateful profile answers a default-profile delete with 409 execution_profile_mismatch on every retry, so the file landed in failedFileIds, its record and agent references stayed, and agents holding it aborted every code turn with "Failed to provision N file(s) to the code environment". The mismatch is now handled like an absent object: logged, and the delete proceeds. Other 409s, 5xx, auth and network errors still fail the delete.
* fix: Strengthen Two-Factor Recovery Credentials * fix: Declare Recovery Helper Return Types * fix: Consume Recovery Codes Atomically * fix: Stage Recovery Code Rollout and Improve Input
* 🫰 feat: Configure Tool Approval Modes Per Agent * fix: Fence Remembered Tool Approval Authority * fix: Unify Tool Approval Execution Invariants * fix: Revalidate Learned Approval at MCP Invocation * fix: Preserve One-Time MCP Review at Invocation * fix: Execute Reviewed Calls on Templated MCP Connections * fix: Scope Approval Witnesses to Executing Agents * fix: Retain Approval Bindings for Hook-Rewritten Inputs * fix: Pin Review Authority and Retire Settled Tool Calls * fix: Fingerprint Effective MCP Request Headers * fix: Preserve Routing Around Renewable MCP Token Fragments * fix: Bind Tool Consent to OAuth Credential Generations * test: Keep Mobile Approval Save Outside Drawer Escape Race * fix: Fence OAuth Consent at MCP Transport Retries * fix: Let Shared Agent Viewers Reset Personal Consent * fix: Preserve Renewed Consent Across Reset Races * fix: Resolve Verified Aliases for Personal Tool Reset * fix: Fence Renewed OAuth Consent and Credential Review * fix: Require Foreground Execution for Review-Only MCP Calls * fix: Pin Invocation Ownership and Stable MCP Consent * fix: Fence Superseded Tool Consent Completion Writes * fix: Scope Consent Epochs to Effective MCP Authentication * fix: Scope Approval Admission to Reachable Agent Tools * fix: Preserve Approval Epochs for Runtime-Detected OAuth * fix: Address Tool Approval Review Findings * fix: Preserve Captured Consent When Tool Approval Is Inherited * fix: Preserve Approval Admission Through Lazy Metadata * fix: Fence Programmatic Reviews and Unresolved Lazy Approval Keys * fix: Account for Normalized and Skill-Contributed Lazy Tools * fix: Scope Lazy Approval to Selected Tool Spellings and Servers * fix: Honor Disabled MCP Capability During Lazy Approval Admission * test: Preserve Approval Merge Regressions After Rebase * fix: Preserve One-Time Review During Non-OAuth Grant Outages * fix: Retain One-Time Consent Across Resume Recovery * fix: Preserve Reviewed Consent Through Transport Outages * fix: Preserve Case-Variant Lazy Approval Hook Admission --------- Co-authored-by: Lia <lia@librechat.ai>
…ibreChat-AI#16733) * 🎣 feat: Poll Durable Workspace Requests Without Rejoining Admission * fix: Keep Durable Transport Independent of Workspace Types * fix: Fence Durable Workspace Recovery and Admission Budgets * fix: Recover Accepted Body Resets at the Transport Deadline * fix: Preserve Durable Acceptance, Throttle Recovery and Fallback Defaults * chore: Remove Durable Workspace Client Documentation * fix: Preserve Capability Fallback Reserves and Programmatic Budgets --------- Co-authored-by: Lia <lia@librechat.ai>
) * feat: consolidate orchestration into a native tool * test: complete persisted subagent graph fixture * fix: keep orchestration pickers inside the modal focus scope * fix: preserve runtime-equivalent legacy handoff classification * test: stabilize orchestration dialog lifecycle coverage --------- Co-authored-by: Lia <lia@librechat.ai>
…ibreChat-AI#16747) * 🫗 perf: Release Message Histories of Conversations the User Has Left Long agent conversations hold 12-18 MB of message JSON each in the React Query cache, and the default 5-minute cacheTime kept every conversation visited in that window. Switching between a few of them on mobile Safari grew the JS heap past 300 MB and crashed the tab. retainMessages tracks when each per-conversation history loses its last observer and releases it once it has no observers, is not fetching, is not pinned, and is either older than 60 s or beyond the single most recently left conversation. The routed conversation, conversations with a running job, and conversations awaiting an approval decision stay pinned; releases wait while any mutation is pending. Returning to a released conversation refetches its history. * 🫗 fix: Own History Collection, Configure the Grace, and Pin by Server State Per-conversation histories get an infinite cacheTime while retention runs, so React Query's own five-minute collection can no longer drop a history a running job still pins; newly seeded histories schedule a pass; the grace and recent count come from interface.historyCacheTtlMs and interface.historyCacheRecent; the approval pin is replaced by the active-jobs set, which already lists jobs paused for a live approval; and Assistants histories stay pinned because deletion reads their thread id from the cache. * 🫗 fix: Re-arm Collection for Histories Already Counting Down and Recheck Pins Promptly A history left before retention started still had React Query's five-minute GC timer; a momentary observer now re-arms it under the infinite cacheTime. Histories kept only because they are pinned or fetching are judged again after 5 s instead of a full TTL, so a run that ends releases its transcript promptly. * 🫗 fix: Exempt Assistants Histories Without Polling and Leave Fetching Histories Alone Assistants histories are now exempt rather than pinned, so they are kept without a recurring recheck timer. The startup re-arm skips histories with a fetch in flight, since detaching a momentary last observer would cancel the request; settling the fetch re-arms collection on its own.
* feat: Return a Navigable Progress Tree When Checking a Running Subagent check_background_task on a running or finished-but-undelivered subagent now returns an activity digest: the child's turns, tool calls, and replies folded to one line each and addressed by stable positional paths. Callers expand one node or range with expand, and page with since against a settled-node cursor. The owning process folds the child's update stream into a bounded tree that keeps only tool names, the model-authored intent label, the tool-authored outcome label, statuses, timings, and sizes. Routed claims carry the tree to a poll on any replica, lists carry counts and the node in flight, and a finished child whose owner is gone is rebuilt from its durable public projection. The background-task card renders the digest as a foldable tree and links the existing subagent activity panel. * fix: Tighten Progress Digest Verdicts, Overflow Bounds, and Rebuilt Trees Failed reply steps and schema-rejected calls now record as errors, and an overflowed call is counted once without retaining it in the lookup maps. A tree rebuilt from the durable projection re-checks completed calls with the shared failure verdict, carries the projection's truncation, and tells the caller its paths are a reconstruction. The card localizes folded summaries instead of rendering the server's English tally. * fix: Measure Single-Part Message Deltas in the Progress Digest * fix: Scope Nested Progress Ownership by Run and Count Overflow Once Nested runs now attach to the call recorded by their own spawning run, since provider call ids repeat across runs. Only the step that announces a call can count it as overflow, so later sightings of an unretained or evicted call never re-count it or reopen history. A zero-valued since cursor is rejected, and the card labels MCP tools with the configured server names.
…reChat-AI#16712) * perf: Async Local File Saves and Compile Hot-Path Regexes Once * perf: Check Closing Code Fences Without a Per-Length Regex Cache * test: Build the Delivery Route Config Before Routing Instead of Mutating It mergeFileConfig now memoizes by config identity, so the CSV fallback tests must set textFallbackWithoutTools when they build the request config rather than mutate the object after the agent's routing already merged it. * fix: Write Local Buffers Atomically So Concurrent Saves Cannot Interleave Async writeFile calls to one deterministic path (OpenID and SAML avatars) could truncate and interleave each other. Write through a temp file and a rename instead, and add scenario specs for local saves and longer closing fences. * refactor: Move Local Save Logic Into packages/api saveLocalBuffer, the temp-upload move and the atomic directory writes now live in packages/api/src/storage/local.ts and receive their paths from the caller; the Local strategy in /api keeps its logging and calls through. The traversal check now runs before any directory is created. * fix: Copy Moved Uploads Through a Temp File and Rename Into Place Concurrent async copies to one destination could interleave just like direct writes, so moveLocalFile now fills a sibling temp file and renames it. * fix: Contain Every Local Write and Move Inside Its Target Directory The traversal check that guarded saveLocalBuffer now runs in writeLocalFile and moveLocalFile too, before any directory is created, and the buffer save accepts only the images and uploads base paths. * test: Define the Success Assertion Inside the Local File Saves Scenario * fix: Give Atomic Write Temp Files a Fixed-Length Name So Long Targets Still Fit * test: Send Image Dimensions and Read the Message Array in the Local Saves Scenarios
…at-AI#16709) * perf: Cache package builds and make client coverage opt-in * perf: Add a cached turbo test:ci task and a parallel test:turbo script * perf: Hash default turbo inputs and live-test env for cached tasks * perf: Hash live-test credentials in the turbo test cache key * perf: Hash the ignored backend test env file in the turbo test cache key * perf: Order test tasks after consumed builds and hash cross-workspace test imports * test: Cover the cached test runner's keys, build order and client coverage toggle * perf: Hash the root env file the live responses suite loads * perf: Stop caching test results and hash the client package's baked env * fix: Pass every caller variable to test runs and include the shared client suite
* feat: add app-wide UI scale setting * test: align dev's new header, drawer and combobox specs with the scaled shell * fix: keep design-recorded arbitrary values off the same-count swap * fix: scale composer and reasoning spacing on the spacing scale * test: reach scaled rows and wait on the composer under the unpainted drawer * test: cover the scaled composer at both ends of the range * test: reload the composer scenario at each scale from the live page * fix: leave the root style untouched at the default scale * test: align dev's tool output and subagent inset specs with the rem classes * fix: scale a caller's combobox height cap with its rows * fix: size the conversation list's row estimate on the scaled drawer breakpoint * test: align dev's conversation row status spec with the scaled drawer breakpoint * style: sort the settings dialog imports after the dialog layer merge * fix: scale the collapsed combobox's fallback popover width * fix: size the upload glyph on both axes so it grows with the scale
…ender (LibreChat-AI#17174) * fix: release OpenID delivery lease when the client disconnected before delivery A refresh whose client disconnects before the response is sent claims the delivery lease and then arms finish/close listeners on a response that has already closed. Neither event fires again, so the lease is never released and every later refresh for the same generation polls until the 30-second lease expires. Arm the listeners only while the response is open; otherwise release the lease directly after the send. * fix: defer the silent refresh until a prerendered page is shown A prerendered page runs the startup silent refresh before the user sees it. When the browser discards the prerender, the refresh is aborted mid-flight after the server has already rotated the refresh token, and the page the user actually opens has to recover from a session it never received. Wait for prerenderingchange before refreshing so a prerender has no effect on the session. * refactor: move OpenID response delivery into packages/api
) * 🔐 fix: Skip Reasoning Labels for Encrypted Reasoning OpenAI models on Bedrock (and Claude's redacted thinking on Bedrock) return reasoning as encrypted `redactedContent` bytes. The current agents SDK base64-encodes those bytes into the reasoning stream, so they arrive as THINK text: the reasoning-label wiring summarized the blob ("Inspecting an encoded data snapshot"), activity and phase labels quoted it as reasoning evidence, and the UI rendered it as thinking. Add a shared `stripOpaqueReasoning` / `isOpaqueReasoning` predicate in data-provider that recognizes long unbroken base64/base64url runs (Bedrock redactedContent, Anthropic redacted_thinking data, OpenAI encrypted_content, Gemini thought signatures) and keep them out of every label path: - reasoning labels drop encoded deltas, ignore persisted payloads on resume, and re-check the accumulated text before a billed label call - activity-label and phase-summary evidence carries readable excerpts only; phase anchoring still uses the raw excerpt - the THINK renderer, grouped reasoning rows and the live header show a neutral "Reasoning (encrypted)" marker instead of the payload, and ignore labels previously generated from it Readable reasoning on every provider, including readable text mixed with an encoded payload in the same step, is still labeled. * fix: Classify streamed and persisted payloads by readable content - isOpaqueReasoning / stripOpaqueReasoning ignore the persisted `<think>` wrapper, so stored encrypted reasoning renders as the encrypted marker and never reaches label evidence as tags-only "text" - add advanceOpaqueReasoning, a streaming cursor that holds a trailing payload-alphabet run until it settles as a word or grows into a payload, so a payload split across sub-threshold deltas is dropped as it streams - reasoning labels count only settled readable characters plus a word-sized pending tail, so ciphertext fragments never advance the minChars or updateChars gates or trigger extra billed label calls * fix: Show readable reasoning around payloads and settle words before counting - the reasoning disclosures, grouped rows, live header and conversation export render and copy the readable text of a THINK part with encoded payloads removed; the encrypted marker stays for parts with nothing readable - reasoning labels count and send only settled readable text: an undecided trailing run never advances minChars/updateChars or reaches the prompt, whatever the configured thresholds, and a short final word settles when the step closes * fix: Classify reasoning before every bound and across resume - once a run is classified as a payload, it continues through the next non-payload character even when that arrives in the same delta as readable text, so no tail fragment of the payload is released as readable - add sliceReasoningTail: the activity-phase rolling reasoning window (and its snapshot/restore bounds) never starts inside an unbroken run, so a payload cut by the window cannot leave a fragment too short to classify; the window stays a substring of the raw THINK text, so phase anchoring is unchanged - a resumed reasoning step replays its persisted text through the stream filter and keeps the resulting cursor, so a payload prefix that was still undecided at the snapshot is dropped once the continuation classifies it * fix: Classify phase evidence while it streams and mask payloads while pending - activity phases classify each reasoning delta with the stream cursor and keep a readable rolling window beside the raw anchor window; tracked activities carry readableExcerpts as prompt evidence, so a window cut into a payload can never forward a fragment (older snapshots fall back to stripping); the cursor-free sliceReasoningTail is removed - add readableReasoning / flushOpaqueReasoning: while reasoning streams, the disclosures and live header hold back a trailing run that could still grow into a payload instead of showing its first characters - the message editor offers no field for payload-only reasoning and shows only the readable text of mixed reasoning; an unchanged part is never written, so its stored payload stays intact * fix: Replay legacy phase snapshots through the reasoning stream filter A pending-reasoning lane restored from a snapshot without a readable window or cursor is replayed through advanceOpaqueReasoning instead of stripped, so a payload prefix that was still undecided at the snapshot stays in the cursor and is dropped once the continuation classifies it. * fix: Drop the cut leading run of a full legacy phase window A legacy pending-reasoning window that filled the 600-char bound may have been cut inside a payload, so its leading payload-alphabet run is dropped before the replay; a shorter window is the whole lane and is replayed as is. * fix: Keep payload-bearing reasoning read-only and drop payload-derived titles on resume - reasoning that carries an encoded payload is not offered in the message editor: the edit endpoint replaces the whole value and the payload cannot be positioned in an edited draft, so editing would silently delete it - a resumed reasoning step whose persisted text has no readable reasoning drops its existing title (which could only describe the payload) instead of carrying it forward where a short readable continuation would revive it * fix: Reset a resumed payload-derived title on the client, only for payload-only steps - a resumed step drops its title only when its persisted reasoning is entirely an encoded payload, so a short readable token (still undecided for the stream cursor) keeps a valid title - dropping it emits a same-step on_reasoning_label reset, which the client already applies, so a resumed client clears the snapshot title too
…rts (LibreChat-AI#17024) * 🪄 fix: Ground the Default Artifacts Prompt in What the Renderer Supports * 🧪 test: Stub IntersectionObserver with a Class the Checker Accepts
…7019) Plan the complete mock suite's shards from recorded per-file durations instead of Playwright's equal-count split, widen the memory lanes from six to ten, and give the nightly full suite ten shards per store so it fits its 30-minute job timeout again.
…vccf-f47h) (LibreChat-AI#17015) Bump @modelcontextprotocol/sdk from ^1.30.0 to ^1.32.1 in api and packages/api. 1.31.0 binds stored OAuth credentials to the issuing authorization server; LibreChat does not use the affected auth()/ authProvider path and already pins refreshes to the stored token endpoint. 1.32.0 makes the client transports follow same-origin redirects themselves, which would re-issue requests the connection fetch declined (hop cap, reauthorized tools/call). Set redirectPolicy: 'follow' so redirects stay with the connection fetch, and cover both transports with real-SDK tests.
- compression ^1.8.2, handlebars ^4.7.10, sharp ^0.35.5 (librsvg 2.63.2), @opentelemetry/instrumentation-mongoose ^0.67.0 as direct bumps - proxy-addr 2.0.8 and source-map-js 1.2.2 as in-range lockfile refreshes - raise the existing katex overrides from ^0.16.21 to ^0.18.2 (resolves 0.18.10)
…ges/api (LibreChat-AI#17118) * refactor: Remove Unused Agent Helpers and Superseded Wrappers * refactor: Remove Dead Auth, Middleware, Protection and Prompt Helpers * refactor: Remove Dead MCP, File, Skill and Endpoint Code * refactor: Remove Dead Stream, Telemetry, Utility and Type Exports * chore: Drop Unused packages/api Dependencies From bun.lock * refactor: Keep Published Compatibility and Deprecated packages/api Exports
…AI#17079) * 🐛 fix: Keep Artifact Download Clear of Message Navigation * 🐛 fix: Clear Navigation for Every Artifact Download State * 🧪 test: Assert Artifact Download Clears Navigation Rail * 🐛 fix: Preserve Artifact Download Target Size * 🐛 fix: Tighten Artifact Navigation Clearance * 🐛 fix: Constrain Artifact Preview Rows to Message Width
…Chat-AI#16878) * feat: complete Skill management CRUD * fix: make Skill file deletion retryable * fix: delete local Skill files by recorded owner * fix: narrow skill management CRUD and honor blob owners * fix: preserve request-scoped storage deletion ownership
* feat: expose Skill deletion in management API * fix: canonicalize deleted Skill IDs * feat: gate machine Skill deletion until cleanup rollout * Revert "feat: gate machine Skill deletion until cleanup rollout" This reverts commit 2a3c2da. * fix: normalize deleted Skill IDs before lookup * fix: require Skill deletion cleanup status in management contract
* feat: add Skill lifecycle persistence primitives * fix: scope Skill lifecycle records and retain canonical blob keys * fix: default and fence skill deletion lifecycle state
* feat: add Skill upload reservation helpers * fix: preserve reserved Skill blob keys and validate cleanup strategy * fix: preserve Skill upload compensation on journal failures * fix: reconcile ambiguous Skill upload intent states * fix: align Skill uploads and public helper exports * fix: plan skill blob locations before writes * test: verify Skill exports without prior package build
* feat: add bounded whole-Skill cleanup engine * fix: type deferred upload-intent cleanup * fix: preserve completed Skill deletion across rollout rollback * fix: fence Skill deletion completion by active claim
…ibreChat-AI#17043) * feat: integrate durable Skill lifecycle across writers and routes * 🧪 test: Cover Skill Management Deletion End to End * fix: Queue superseded Skill blobs for durable cleanup * fix: Reject Skill file storage moves without new identity * 🧪 test: Cover Skill UI Delete and Cleanup Restart * 🧪 test: Assert Durable Cleanup for Replaced Skill Files * fix: release Skill names during account deletion marking * fix: use reserved Skill blob plans across writers * fix: hold superseded Skill blobs until sync commits * test: preserve account deletion retry coverage after restack * test: verify durable Skill cleanup after account erasure * fix: complete Skill cleanup leases and avoid historical metadata scans * fix: bound Skill cleanup manifest processing
…ch-to-Text Recorded transcription: - Send `prompt`, `keywords[]`, and `languages[]` to gpt-transcribe models and never the singular `language`; older models keep `language` and `prompt`. - The user's speech language narrows the admin `languages` list. - Responses carrying detected-language metadata still resolve to `text`. Live transcription (opt-in via `speech.stt.openai.realtime`): - New "Live" engine under Settings > Speech > Engine, offered only when the admin configures it; `speechTab.speechToText.engineSTT: realtime` defaults it. - POST /api/files/speech/stt/realtime exchanges the browser's WebRTC offer for the provider's answer using a 60s client secret, so no credential reaches the browser. Metered by the existing STT limiters and SSRF-guarded. - Deltas stream into the composer; Stop commits the buffer and the final transcript stays editable. Auto Transcribe, Auto Send, cancel, connecting and reconnecting states, and permission/connection/provider errors are handled. Shared silence detection moves to `hooks/Input/silence.ts`.
Owner
Author
|
Closing: only used to upload media for LibreChat-AI#17190. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
10 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Temporary draft used only to upload the screenshots and recording for the upstream LibreChat-AI/LibreChat pull request. It will be closed right away.
Live dictation recording