The v0.8.8 release of LibreChat

What's Changed Copy Anchor Link
Operator-facing YAML, environment, default, and migration changes are collected in Config v1.3.15, Config v1.3.16, and Config v1.3.17. This release uses Config 1.3.17, Helm chart 2.0.16, and the Agents SDK 4.0.0.

🏞️ Highlights Copy Anchor Link
• Meet Lia: Building LibreChat with LibreChat.
• Agent control: Interrupt, steer, queue messages, answer questions, and approve tool calls.
• Unified Agent Builder: Same-run Skill authoring, opt-in Programmatic Tool Calling, and background tools.
• Background tasks: Clearer task cards, header controls, and automatic delivery of supported results.
• Scheduled Chats: Cron, time zones, and Project destinations. In beta: experimental and disabled by default.
• Code workspaces: Stateful sessions, attached machines, recovery, and guarded permissions. Highly experimental; compatible services required.
• Beta Agents API: Improved compatibility with Chat Completions, Open Responses, Agent/Skill management, and introduced Agent Events
• Experimental Agent Plugins: Bundle Skills and MCP servers, with opt-in command hooks.
• Execution visibility: Live activity, tool timing, Context Usage, optional costs, and a configured Langfuse Trace Viewer.
• Chat improvements: Draggable pins, chat filtering, manual compaction, mobile polish, and automatic attachment routing.
• Model updates: GPT-6 and GPT-6.1 Sol, Claude Opus/Sonnet 5.5, and Gemini 3.8 Flash. GPT-6.1 Sol uses family-fallback limits and pricing.
• Performance and security: Faster rendering and streaming and long-thread sends, stronger credential boundaries, tenant-scoped endpoints, and 2FA management limits.

✨ Features Copy Anchor Link
• 🧷 feat: Carry Ask User Answers Past Compaction by @danny-avila in #15944
• 🪂 feat: Opt-In Text Fallback for Files No Tool Can Read by @danny-avila in #15940
• 🕹️ feat: Run Declared Project Actions on Attached Workers by @danny-avila in #15943
• 🪧 feat: Unify Artifact Triggers as Tool Rows by @berry-13 in #15915
• 🔁 feat: Retry OpenID Discovery After Startup Failures by @danny-avila in #15899
• 🔭 feat: Conversation Trace Viewer by @danny-avila in #15869
• 🦘 feat: Share Run-Scoped Files With Subagents by @usnavy13 in #15848
• 🔎 feat: Filter and Sort the Sidebar Chats List by @berry-13 in #15842
• 📟 feat: Record Safe Upstream Model Failures by @dustinhealy in #15800
• 🔠 feat: Render Safe Upstream Model Errors by @dustinhealy in #15837
• 🖋️ feat: Seal Code Environment Choices Per Conversation by @danny-avila in #15868
• 🏡 feat: Remember Agent Workspace Defaults by @danny-avila in #15843
• 🧮 feat: Surface Retained Tool-Message Context Usage by @berry-13 in #15796
• 🩻 feat: improve agent filter controls for insights by @upman in #15807
• 📌 feat: Unified Pinned Section With Sidebar Drag Interactions by @berry-13 in #15057
• 🥼 feat: Expose BYOM Cancellation Diagnostics by @danny-avila in #15810
• 🪓 feat: Cancel Background Tool Invocations by @danny-avila in #15773
• 🪔 feat: Expose Bounded Attached Bash Timeouts by @danny-avila in #15776
• 🏕️ feat: Select Attached Code Workspaces by @danny-avila in #15768
• 🚚 feat: Route Attachments and Provision Tools Lazily by @danny-avila in #15763
• 🕒 feat: Track terms acceptance timestamp by @berry-13 in #10810
• 🔄 feat: Continue Shared Conversations as Personal Copies by @berry-13 in #13714
• 🪝 feat: HITL Tool Approval Scaffolding (Slice A) by @danny-avila in #12938
• 🧠 feat: Add Memory as an Agent Capability with Inline Tools and Ephemeral Badge by @danny-avila in #13869
• 📇 feat: Agent Contact Visibility with Owner Fallback by @peeeteeer in #13663
• 🪟 feat: Faithful Over-Window Context Estimate via Prune Mirror and Overhead Reserve by @danny-avila in #13959
• 🪭 feat: Add opt-in Langfuse fanout gateway + collector by @upman in #13872
• 🪝 feat: Human-in-the-Loop Runtime - Tool Approval + Ask-User-Question (Slice B) by @danny-avila in #13942
• 🪗 feat: Dock-Style Fisheye Nav Rail With Instant Hover Preview by @danny-avila in #14021
• 🤖 feat: Add Claude Sonnet 5 Support by @danny-avila in #14042
• 🥷 feat: Add showInMenu Option to Model Specs by @alexkorep in #14034
• 🫷 feat: Exclude File Authoring Tools From Eager Execution by @danny-avila in #14051
• 🪝 feat: Configurable Tool-Approval Policy via Programmatic Hooks by @danny-avila in #14025
• 🧹 feat: Eager HITL Checkpoint Cleanup (Expiry + Deletion) & Full-Wiring E2E by @danny-avila in #14123
• 🧰 feat: Redesign Agent Builder with Unified Tools Marketplace, Skills & Orchestration by @berry-13 in #13952
• 📡 feat: add rum browser page-load diagnostics by @upman in #14106
• 🎚️ feat: Explicit "Use All Skills" Toggle in the Skills Section by @berry-13 in #14125
• 🙋 feat: ask_user_question - agent-initiated questions with durable pause/resume by @danny-avila in #14139
• 🗂️ feat: Per-Agent Memory Partitions by @danny-avila in #14084
• 🤖 feat: Add GPT-5.6 (Sol/Terra/Luna) OpenAI Models by @danny-avila in #14206
• 🪭 feat: support per-run central export suppression by @upman in #14207
• ✨ feat: stateful_code_sessions capability for warm Code API sandbox sessions (experimental) by @danny-avila in #14150
• 🧠 feat: Add GPT-5.6 reasoning.mode + reasoning.context (Responses API) by @danny-avila in #14233
• 🧵 feat: Background Tool Calls for Agents & Model Specs by @danny-avila in #14197
• 🗝️ feat: Encrypted Langfuse Fanout Config by @dustinhealy in #14107
• 🧭 feat: Mid-Run Steering and Queued Messages for Agent Runs by @danny-avila in #14220
• ♨️ feat: Prewarm Stateful Code Sandboxes with Cold-Boot UX Feedback by @danny-avila in #14239
• 📛 feat: Add Client Name Header to Tavily Search Requests by @manisrinivasan2k1 in #14082
• 💬 feat: Explain Steering & Queuing at Every User-Facing Surface by @danny-avila in #14260
• 🖼️ feat: Return Sandbox Images From read_file as Viewable Artifacts by @danny-avila in #14277
• feat: add low-noise Redis observability by @upman in #14309
• ✋ feat: Add Reclaim-Gated Controls to In-Flight Steers by @danny-avila in #14321
• 🫧 feat: Float In-Flight Steers Over the Thread with Collapsible Content by @danny-avila in #14365
• ⚡ feat: Add Gemini 3.6 Flash and Gemini 3.5 Flash-Lite Support by @danny-avila in #14369
• 🧵 feat: Native Background Execution for Code Interpreter Tools by @danny-avila in #14386
• ✳️ feat: Claude Opus 5 Support by @danny-avila in #14422
• ⏱️ feat: Configurable HTTP Server Timeouts by @danny-avila in #14481
• 🕶 feat: Generalize Admin Config Secret Redaction by @dustinhealy in #14509
• 🏷️ feat: Activity Groups With Fast-Model Headers by @danny-avila in #14391
• 🗝️ feat: Custom Endpoint API Key Encryption via Array Secret Registry by @danny-avila in #14510
• 🎯 feat: Tool Intent Label Capability (tool_intents) by @danny-avila in #14499
• 🪢 feat: Langfuse Fanout Connection Setting by @danny-avila in #14108
• 🛑 feat: Preemptive Steer - Backend Interrupt & Steer by @danny-avila in #14518
• 🎯 feat: Per-Tool Intent Labels for Model Specs by @danny-avila in #14526
• ⚡ feat: Interrupt & Steer, Client by @danny-avila in #14528
• 🧵 feat: Background-Native Code Execution Tools by @danny-avila in #14532
• 🎯 feat: Render Tool Intent as the Live Tool-Call Label by @danny-avila in #14536
• 🎯 feat: Per-Tool Intent Label Toggles in the Agent Builder by @danny-avila in #14550
• ⚡ feat: Reliable Interrupt & Steer Escalation and Recovery by @danny-avila in #14558
• 💬 feat: Interim Progress Card for Streaming Q&A Calls by @danny-avila in #14576
• 🚦 feat: Configurable Circuit Breakers for Runaway Streamed Tool Args by @danny-avila in #14613
• ⚡ feat: Coalesce Redis Streaming Delta Publications into Windowed Batches by @danny-avila in #14614
• 🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas by @dustinhealy in #14559
• 🌊 feat: Wire Adaptive Stream Smoothing Across Google, Bedrock, and Zero-Disable Semantics by @danny-avila in #14660
• 🔗 feat: Admin Panel Link in Settings for Admins by @dustinhealy in #14662
• 👋 feat: Day-Aware Landing Greeting Schedule by @berry-13 in #14633
• 🔑 feat: Refresh-Capable Google Admin OAuth Sessions by @dustinhealy in #13832
• 🛡️ feat: Add Batched MCP Authority Proofs by @danny-avila in #14688
• 🪝 feat: Add Claude Hook Compatibility Layer by @danny-avila in #14412
• ⛶ feat: add fullscreen artifact previews by @berry-13 in #14585
• 🔌 feat: Add Agent Plugins (Experimental) by @danny-avila in #14704
• 🔗 feat: Shared Conversation Badge and Stable Share Links by @berry-13 in #14712
• 🧜 feat: Open Mermaid Diagrams as Artifacts with SVG/PNG Export by @berry-13 in #14713
• 🪶 feat: Resolve Explicit Subagents Lazily by @danny-avila in #14714
• 📡 feat: Route Web Search and Scrape Egress through the SSRF-safe Agent by @dustinhealy in #14606
• 🎨 feat: Add Versioned Theme Foundation by @danny-avila in #14709
• 🪆 feat: Add Parent Activity Phase Summaries by @danny-avila in #14721
• 🎨 feat: Refine Client Colors and Sharing Dialogs by @berry-13 in #14734
• 🎛️ feat: Adopt Composer Density Tokens by @danny-avila in #14730
• 🍡 feat: Batched User Questions With A Single Bounded Answer Form by @danny-avila in #14737
• 🪝 feat: Execute Agent Plugin Command Hooks by @danny-avila in #14755
• 🚣‍♀️ feat: Smooth Streaming Text Fade-In by @danny-avila in #14757
• 🪢 feat: add Langfuse session links by @upman in #14776
• 🔖 feat: Bound Parent Activity Phases With an Exclusive End Index by @danny-avila in #14768
• 💬 style: Unify Message Row Layout and Edit Surfaces by @berry-13 in #14770
• 📄 feat: accept PowerPoint template MIME type by @snapydziuba in #14761
• ⚡ feat: Add Gemini 3.7 Flash Support by @danny-avila in #14818
• 🪄 feat: Smooth Activity Phase Transitions by @danny-avila in #14832
• 📱 style: Reclaim the Assistant Avatar Gutter on Mobile by @danny-avila in #14836
• 📱 style: Consolidate the Mobile Chat Header by @danny-avila in #14843
• ➡️ style: Flush the In-Flight Steer Stack to the Composer Edge by @danny-avila in #14854
• 🎨 feat: Color the Context Gauge by Category and Collapse its Breakdown by @danny-avila in #14855
• 📐 feat: Match the Message Column to the Composer by @berry-13 in #14851
• 🚏 feat: Central Trace Destination Opt-Out for Langfuse by @danny-avila in #14838
• 🤐 feat: Allow Promptless Sends When Files Are Attached by @i-anubhav-anand in #13717
• 📥 feat: Download Code Blocks as Files by @i-anubhav-anand in #13715
• 📱 feat: Give the Mobile Nav the Whole Screen by @danny-avila in #14849
• 💄 style: Align the Overflow Menu's Icons and Ease the Assistant Header by @danny-avila in #14888
• 🗂️ feat: Display Chat Title in Tab Setting by @berry-13 in #14881
• 🛤️ feat: Per-Agent Code Execution Routing With Stateful Session Scopes by @danny-avila in #14848
• 🗂️ feat: Rework the Projects Dashboard, Sidebar and Scoped Composer by @berry-13 in #14866
• 🎛️ feat: Consistent Dialogs, Clearer Settings, and a Keyboard Shortcuts Switch by @berry-13 in #14882
• ⏱️ feat: Show Run-Step Durations On Tool Cards by @danny-avila in #14892
• 🗄️ feat: Record When a Conversation Was Archived by @berry-13 in #14863
• 💄 style: Align the Thinking Dot with the Header Icon by @danny-avila in #14895
• 🗜️ feat: Let Users Toggle Client-Side Image Resizing by @berry-13 in #14883
• 🧠 feat: Add Live Reasoning Labels by @danny-avila in #14893
• 📱 feat: Swipe the Mobile Drawer Open and Closed by @danny-avila in #14902
• 📜 feat: Follow Streaming Args in Tool Detail Panes by @danny-avila in #14906
• 📋 feat: Attach Long Pasted Text as a File by @berry-13 in #14884
• 🗄️ feat: Archive All Chats From Data Controls by @berry-13 in #14885
• 🛡️ feat: Let Admins Restrict Stateful Workspace Scopes by @danny-avila in #14910
• 🎬 style: Reveal the Chat on Programmatic Drawer Closes by @danny-avila in #14930
• 🛰️ feat: Execute Generic Agent Trigger Deliveries by @danny-avila in #14921
• 📡 feat: Add Generic Agent Trigger Dispatch Seam by @danny-avila in #14916
• 📬 feat: Add Durable Agent Trigger Delivery by @danny-avila in #14925
• 🪜 style: Step Through Batched Questions One at a Time by @danny-avila in #14935
• 🕸️ feat: Run Saved Agent Teams as Subagents by @danny-avila in #14944
• 🪢 feat: Custom Request Headers For Langfuse by @danny-avila in #14945
• 🧵 feat: Persist View-Only Subagent Threads by @danny-avila in #14957
• 💡 feat: add DB-backed admin insights by @upman in #14898
• 📁 feat: Surface Stateful Workspace Downloads by @danny-avila in #14984
• 🛰️ feat: Route Live Subagent Controls Across Replicas by @danny-avila in #14971
• 🪃 feat: Wake Parent Agents on Child Completion by @danny-avila in #14975
• 🎛️ feat: Make Max Subagents Configurable via librechat.yaml by @berry-13 in #15023
• 🔗 feat: Open Footer Site Links in a New Tab by @berry-13 in #15019
• ⏱️ feat: Run Scheduled Chats Through Durable Agent Triggers by @danny-avila in #14939
• 🕊️ feat: Yield to Subagent Completion Wakeups by @danny-avila in #15066
• 🧾 feat: Sibling Task Manifest for Resumed Parent Runs by @danny-avila in #15063
• 📜 feat: Add Optional Collapse for Long User Messages by @berry-13 in #15034
• 🗂️ feat: Scope Scheduled Chats to Chat Projects by @danny-avila in #15056
• 🪟 feat: Read Child Threads Through Their Parent by @danny-avila in #15073
• 🛰️ feat: Show Child Agent Activity in a Side Panel by @danny-avila in #15075
• 🙈 feat: Config Option to Hide Response Feedback Buttons by @berry-13 in #15085
• ✨ feat: Context Gauge Hover Reveal and Breakdown Motion Polish by @berry-13 in #15038
• 🫥 feat: Add Temporary Chat Empty State and Active Indicator by @berry-13 in #15086
• 🎛️ feat: Configurable SearXNG Search Options by @berry-13 in #14987
• 🙋 feat: Collapse Settled Question Records by Default by @danny-avila in #15107
• 🪟 feat: Unify Subagent Activity Panel by @danny-avila in #15106
• 🛂 feat: Filter Model-Bound Content by Source by @danny-avila in #14425
• 📨 feat: Add Authenticated Agent Event Ingress by @danny-avila in #15110
• 📡 feat: Stream Detached Subagent Activity by @danny-avila in #15111
• 🧾 feat: Store Durable Event Actor Receipts by @danny-avila in #15265
• 🧵 feat: Unify Subagent Child Threads by @danny-avila in #15261
• 🧅 feat: Reveal Subagent Thread History and Event Detail on Demand by @danny-avila in #15283
• 🕸️ feat: Complete Keenable Web Search Provider by @danny-avila in #15288
• 🪢 feat: show Langfuse session link in shared chats by @upman in #15273
• 🎼 feat: Unify Agent Turn Execution Behind One Immutable Plan by @danny-avila in #15296
• 🫆 feat: Fingerprint Agent Context for Zero-Read Warm Continuation by @danny-avila in #15299
• 🤖 feat: make Event Actor HITL durable by @danny-avila in #15305
• 🪂 feat: Make Event Actor Detached Actions Durable by @danny-avila in #15307
• 🍱 feat: Guide Compaction With a Bounded Semantic Index by @danny-avila in #15340
• 📬 feat: Establish Background Continuation Admission by @danny-avila in #15348
• 🛑 feat: Cancel MCP Discovery Work at the Caller Deadline by @danny-avila in #15353
• 🛄 feat: Restore Compaction Guidance Across Continuations by @danny-avila in #15356
• 🛎️ feat: Wake Agents on Background Tool Completion by @danny-avila in #15350
• 🍵 feat: Continue Late Steers in Warm Agent Runs by @danny-avila in #15357
• 🧩 feat: Collapsible Wake-Up Task Cards and Subagent UI Consistency by @danny-avila in #15364
• 🗿 feat: Add Attached Stateful Code Environments by @danny-avila in #15352
• 🧲 feat: Enable Secure Attached Environment Pairing by @danny-avila in #15355
• ✅ feat: Delivery Receipt Checkmarks for Steered Messages by @danny-avila in #15376
• 🧳 feat: Register Principal-Owned Code Environments by @danny-avila in #15365
• 🧠 feat: Retain Subagent Reasoning Like Main Chat and Drop the Running Status Chip by @danny-avila in #15379
• 📬 feat: Move Agent Queued Turns Server-Side by @danny-avila in #15370
• 🪗 feat: Fold a Live Run's Tool-Call Groups Into the Phase Card by @danny-avila in #15434
• 🪶 feat: Enable Standalone Skill Authoring by @danny-avila in #15480
• 🛫 feat: Enable Self-Service Code Worker Pairing by @danny-avila in #15367
• 🛞 feat: Manage Personal Code Environment Lifecycles by @danny-avila in #15369
• 🧺 feat: Preserve Partial Work at Tool Call Limits by @berry-13 in #15486
• 🧤 feat: Enforce Safe BYOM Tool Approvals by @danny-avila in #15503
• 🔭 feat: Audit PII Filter Findings by @danny-avila in #15508
• 🕹️ feat: Configure BYOM Tool Permissions by @danny-avila in #15504
• 📖 feat: Add Claude Fable 5.1 Support by @danny-avila in #15512
• 🪪 feat: Propagate Tenant to Agent Model Headers by @dustinhealy in #15521
• ⏭️ feat: Honor an Interrupt Before the Model Has Answered by @danny-avila in #15491
• ⚡ feat: Add Gemini 3.8 Flash Support by @danny-avila in #15519
• 🧊 feat: Persist Context Fading Tier Across Agent Runs by @danny-avila in #15505
• 🏛️ feat: Establish Agent Management API Contract by @danny-avila in #15545
• 🔐 feat: Add M2M Authentication for Agent Management by @dustinhealy in #15555
• 🪵 feat: Add OpenTelemetry Logs Pipeline via Winston Bridge by @danny-avila in #15565
• 👀 feat: Add Agent Management Read Endpoints by @dustinhealy in #15561
• ✨ feat: add morphing state icons across the client by @berry-13 in #14697
• ➕ feat: Add Agent Management Creation Endpoint by @dustinhealy in #15564
• ✏️ feat: Add Agent Management Update Endpoint by @dustinhealy in #15566
• 🪓 feat: Add Tenant-Scoped Agent Deletion by @dustinhealy in #15573
• 👓 feat: Read Attached Workspace Files by @danny-avila in #15524
• 🕯️ feat: Search Text in Attached Workspaces by @danny-avila in #15525
• 🌌 feat: Add GPT-6 Astra Support by @danny-avila in #15567
• 🎨 feat: Theme-Adaptive SVG Support for Custom MCP and Group Icons by @berry-13 in #13817
• 🌳 feat: List Attached Workspace Trees by @danny-avila in #15527
• 🏕️ feat: Provision Native Code Workers by @danny-avila in #15587
• 🛻 feat: Route Bash Through Attached Workspaces by @danny-avila in #15546
• 📓 feat: Author Files in Attached Workspaces by @danny-avila in #15548
• 🛰️ feat: Show BYOM Worker Readiness by @danny-avila in #15618
• 🩻 feat(insights): Scope Insights to Authorized Agents by @upman in #15549
• 📋 feat: Copy Messages as Rich Text by @berry-13 in #15087
• ♿ feat: High Contrast Light and Dark Appearance Modes by @berry-13 in #15178
• 🪪 feat: Add Per-Agent Git Identity by @danny-avila in #15628
• 🔭 feat: Tag Browser Diagnostics With Client Build IDs by @danny-avila in #15656
• 🧶 feat: Flatten Active Message Threads Behind a Flag by @danny-avila in #15633
• 🛅 feat: Add Agent File Management APIs by @danny-avila in #15666
• 🍋 feat: Add AMD Lemonade Provider Recognition and Branding by @berry-13 in #15664
• 🧰 feat: Unify Tool Activity, Reasoning, Search, and Agent Workflows by @berry-13 in #14546
• 🛂 feat: Add Configurable BYOM Enrollment Policy by @danny-avila in #15673
• 📜 feat: Add Skills Discovery and Authoring to the Management API by @danny-avila in #15642
• 🪬 feat: Configure Langfuse Trace User Identity and Metadata by @danny-avila in #15667
• 🗳️ feat: Define Conversation Code Approval Modes by @danny-avila in #15685
• 🧶 feat: Thread Conversation Code Approval Through Requests by @danny-avila in #15698
• 🪧 feat: Surface Conversation Code Approval Modes by @danny-avila in #15703
• 🪗 feat: Compact Context in a Summarize-Only Turn by @danny-avila in #15690
• 🧐 feat: Restore Interactive Tool Approval Review by @danny-avila in #15717
• 🛫 feat: Enable Full Access for BYOM Coding by @danny-avila in #15718
• 🧰 feat: Move Code Settings Into Run Code by @danny-avila in #15722
• ✨ feat: Client-Executed Function Tools for the Responses API by @alexkorep in #16078
• 🛍️ feat: Add Programming App to OpenRouter Categories by @lia-by-librechat in #16228
• 🌞 feat: Add GPT-6 Sol and Luna Support by @lia-by-librechat in #16221
• 🔐 feat: Support Cognito Access Tokens for Agent Management by @dustinhealy in #16224
• 🎹 feat: Add Claude Opus 5.5 Support by @danny-avila in #16215
• ⏲️ feat: Report a Background Task's Start, Settlement and Elapsed Time by @lia-by-librechat in #16193
• 🧑‍🚀 feat: Add Grok 4.7 Support Through xAI by @lia-by-librechat in #16173
• 🫧 feat: Hold a Live Run's Activity at One Row by @danny-avila in #16118
• 📟 feat: Render System Events as Distinct Turns by @danny-avila in #16119
• 💵 feat: Show Cost per Record, Step and Response in the Trace Ledger by @danny-avila in #16120
• 💌 feat: Authenticate RUM Proxy Exports by @lia-by-librechat in #16114
• 🐣 feat: Invoke Newly Authored Skills in the Same Run by @lia-by-librechat in #16036
• 🌳 feat: Isolate Attached Workspaces by Conversation by @danny-avila in #16107
• 💬 feat: Read a Model Call as a Conversation in the Trace Viewer by @danny-avila in #16103
• 🗣️ feat: Trace Viewer Roles, Agent Identity and Tool Rounds by @danny-avila in #16098
• ⛽ feat: Negotiate Background Command Timeouts by @danny-avila in #16100
• 🪜 feat: Trace Viewer Steps, Sequence Scale and Previews by @danny-avila in #16099
• 📪 feat: Send Per-Request MCP Headers Without Hiding the Tool Catalog by @lia-by-librechat in #15988
• 🔌 feat: OpenAPI spec and docs for the public Agents API by @AtefBellaaj in #15928
• 📖 Load Repository Instructions for Attached Workspaces by @danny-avila in #16008
• 🪪 feat: Pass Schedule Identity to MCP Token Providers by @danny-avila in #15962
• 🏚️ feat: Recover Coding Chats With Missing Workspaces by @lia-by-librechat in #16273
• 🌫️ feat: Add Bounded PII Text Transformation (library groundwork only; message ingress still blocks matches) by @lia-by-librechat in #16295
• 📋 feat: View and Stop Background Tasks From the Chat Header by @danny-avila in #16348
• 🧲 feat: Attach or Leave a Workspace on a Saved Chat by @lia-by-librechat in #16124
• 🪜 feat: Title an Open Activity Fold and Reach Failed Calls in One Click by @danny-avila in #16390
• 💭 feat: Bring the Streaming Thought Peek Back Under a Collapsed Live Card by @danny-avila in #16394
• 🎴 feat: Render Background Tasks as Native Tool Cards by @lia-by-librechat in #16407
• 🎼 feat: Add Claude Sonnet 5.5 Support by @danny-avila in #16460
• 🕘 feat: Distinguish Tool Preparation From Tool Call Time by @lia-by-librechat in #16455
• 🛤️ feat: Route Linked Worktree Requests into Per-Worktree Lanes by @danny-avila in #16477
• 🎯 feat: Tolerant Workspace Edits with Host-Rendered Conflict Diagnostics by @danny-avila in #16520
• 🧬 feat: Resolve GPT Point Releases to Their Family and Add GPT-6.1 Sol by @danny-avila in #16526
• 🏝️ feat: Scope YAML Custom Endpoints by Tenant by @danny-avila in #16537

🐛 Fixes Copy Anchor Link
• 🧼 fix: Render Agent Description HTML Safely by @danny-avila in #15951
• 🫴 fix: Preserve Queued Follow-Ups Through Handoff by @danny-avila in #15942
• 📖 fix: Preview Extracted Upload Text by @danny-avila in #15946
• 🔓 fix: Keep Code Approval Mode Selectable Mid-Run by @danny-avila in #15938
• 🎞️ fix: Deliver Opted-In Custom Endpoint Media Safely by @danny-avila in #15937
• 🛅 fix: Preserve Agent Management Upload IDs by @dustinhealy in #15840
• 👯 fix: Reject Duplicate Tool Approval Identities by @danny-avila in #15933
• 📫 fix: Route Azure Astra Through Responses API by @usnavy13 in #15845
• 🗯️ fix: Give Failed Turns Actionable Guidance by @berry-13 in #15896
• 🍵 fix: Support Renewable MCP Credentials for Schedules by @danny-avila in #15908
• 🧷 fix: Keep a Failed Summary From Bounding the Conversation History by @berry-13 in #15913
• 👑 fix: Elect a Single Expired-File Sweeper by @danny-avila in #15909
• 🚛 fix: Move Sealed Chats to New Code Environments by @danny-avila in #15902
• 🏦 fix: Reserve Credits for In-Flight Requests by @danny-avila in #15879
• 📐 fix: Accept Custom WIDTHxHEIGHT Sizes in OpenAI Image Tools by @danny-avila in #15904
• 💰 fix: Bill Stopped Agent Turns From Provider Usage by @danny-avila in #15889
• 🧿 fix: Bind Login Flows to the Browser That Started Them by @danny-avila in #15880
• 🪢 fix: Withhold the Editor's Rerun Where No User Turn Can Be Replayed by @berry-13 in #15887
• 🪟 fix: Opaque Header Controls Over the Chat Gradient by @berry-13 in #15894
• 🧷 fix: Mark a Failed Compaction So Its Rerun Controls Stay Withheld by @berry-13 in #15883
• 🪧 fix: Emit the Configured-Footer Answer With the HTML Shell by @berry-13 in #15886
• 🧾 fix: Count the Tool Results a Tool-Limit Stop Retains by @berry-13 in #15893
• 🏷️ fix: Keep a Configured Sender Label From Revealing the Model on Hover by @aruj0 in #15489
• 🫂 fix: Scope People Picker Searches to Permitted Types by @danny-avila in #15878
• 🛬 fix: Land MCP OAuth Callbacks on Waiting Connections by @danny-avila in #15876
• 💤 fix: Preserve Dormant Workspace Bindings by @danny-avila in #15877
• 🔎 fix: Enforce WEB_SEARCH Role Permission on Agents by @danny-avila in #15875
• 🪂 fix: Release Stalled MCP Catalog Recovery Without Dropping Refreshed Tokens by @danny-avila in #15871
• 📇 fix: Stop an MCP Credential Refresh From Fencing Its Own Catalog Recovery by @danny-avila in #15865
• 🪢 fix: Recover a Failed MCP Server Once When Reinspections Overlap by @danny-avila in #15867
• 🔐 fix: Stop an MCP Credential Refresh From Fencing Its Own Connection by @danny-avila in #15863
• 💠 fix: Paint Native Tool Verification Badges by @berry-13 in #15862
• 🔣 fix: Encode Images From Storage Keys by @Ricky-Hao in #15851
• 🧵 fix: Preserve Per-Message Inspection Budgets Through Provider Preparation by @danny-avila in #15860
• 🧲 fix: Match Directory Users to Existing Principals by @danny-avila in #15855
• 🧨 fix: Defuse Skill and Artifact Parsing Backtracking by @danny-avila in #15856
• 🥅 fix: Keep Tool Error Prefix Parsing In Bounds by @danny-avila in #15857
• 🏰 fix: Read OpenID Flight State From Mongo Primary by @danny-avila in #15849
• 📴 fix: Stop Hidden Code Spinners by @danny-avila in #15846
• 📿 fix: Inspect Stored File Locators Per Message by @danny-avila in #15841
• 🔠 fix: Name Artifact Downloads After Their Titles by @danny-avila in #15836
• 🧊 fix: Withhold Rerun Controls on Compaction Turns by @berry-13 in #15797
• 🏷️ fix: Model-Agnostic Hint for Short Skill Descriptions by @L4XB in #15833
• 🔌 fix: Close Leaked HTTP Server in Server Specs by @jomspk in #15821
• 🪢 fix: Keep One Code File per Sandbox Destination by @jomspk in #15817
• 🥅 fix: Keep Mobile Composer Actions In Bounds by @danny-avila in #15825
• 🛖 fix: Restore Saved Attached Workspaces by @danny-avila in #15811
• 📯 fix: Propagate Host Cancellation Into API Tools by @danny-avila in #15812
• 🈳 fix: Treat Blank Mongo Index Settings as Unset by @Zsanz3 in #15809
• 🎒 fix: Carry Subagent Identity Past Streaming by @dustinhealy in #15795
• 🛂 fix: Back Off MCP OAuth Discovery by @danny-avila in #15783
• 🛎️ fix: Preflight MCP Readiness for Scheduled Chats by @danny-avila in #15782
• 🕳️ fix: Clear Nullable Queue Anchor by @danny-avila in #15794
• 🛟 fix: Recover CodeAPI File Uploads After Throttling by @danny-avila in #15784
• 🫆 fix: Preserve Durable Parents for Queued Turns by @danny-avila in #15787
• 🌳 fix: Guard Ambiguous BYOM Workspace Selection by @danny-avila in #15785
• 🔐 fix: Send One Code API Authentication Method by @danny-avila in #15781
• 🛑 fix: Preserve BYOM Foreground Cancellation Identity by @danny-avila in #15777
• 🪡 fix: Thread Stop Into BYOM Commands by @danny-avila in #15772
• 🪴 fix: Restore Native Workspace Selection by @danny-avila in #15771
• 🧿 fix: Patch gRPC xDS Denial of Service by @danny-avila in #15769
• 🔢 fix: Normalize PDF Citation Page Numbers by @danny-avila in #15731
• 🪫 fix: Gate Programmatic Bash on Stateful Worker Capabilities by @danny-avila in #15726
• 🫧 fix: Raise Nested Popovers Above Dialog Layers by @danny-avila in #15738
• ⏳ fix: Separate Temporary and General Chat Retention by @danny-avila in #15734
• 🛄 fix: Clear MCP Connection State Before Catalog Refresh by @danny-avila in #15741
• 🧘 fix: Settle Stale Response Parts by @danny-avila in #15743
• 🟫 fix: Reject Invalid Hex Color Matches by @danny-avila in #15744
• 🫣 fix: Hide Scroll-to-Bottom Under Composer Panels by @danny-avila in #15746
• 🪪 fix: Guard Null Avatar URLs in Social Login by @ncchinh in #15747
• 👯 fix: Collapse Radix Layer Packages to One Copy by @danny-avila in #15742
• 🧍 fix: Accommodate BYOM Queue and Execution Budgets by @danny-avila in #15750
• 🧷 fix: Keep Ref Cleanup and Hold Consumer Handlers to the Frontmost Dialog by @danny-avila in #15751
• 🗝️ fix: Load User Keys on Resumed Requests by @danny-avila in #15749
• 🗳️ fix: Recover Durable Background Tool Receipts by @danny-avila in #15752
• 🛗 fix: Add Tenant Index Upgrade Migration by @danny-avila in #15767
• 🏠 fix: Keep MCP Caches Fresh on Demand by @danny-avila in #15765
• 🔑 fix: Honor User-Provided MCP API Key Instead of Forcing OAuth by @danny-avila in #13954
• 🪙 fix: Count Quote Tokens on Message Edit by @danny-avila in #13958
• 📋 fix: Route Clipboard Paste Through Upload Options by @dustinhealy in #13957
• 📇 fix: Index sharedlinks updatedAt for Cosmos DB Sorts by @danny-avila in #13979
• 📂 fix: Mount Skill Files Under skills/ in Code Interpreter by @danny-avila in #13961 and #13975
• 🪟 fix: Re-measure Sidebar Chat List on Width Change to Fix Date-Group Spacing by @danny-avila in #13981
• 📏 fix: Make create_file Missing-Content Error Truncation-Aware by @danny-avila in #14043
• fix: use logAxiosError at the RAG file_search/context call sites by @mawburn in #14014
• fix: stripHeavyErrorFields Winston format (defense-in-depth) by @mawburn in #14018
• 📥 fix: Download Original File From Artifact Preview Panel for Office Documents by @berry-13 in #14026
• 🔥 fix: Firebase CDN Initialization Under tsdown CJS Interop by @jakacenta in #14046
• fix: preserve role SHARE permissions across boot in initializeRoles by @mawburn in #14022
• 🧺 fix: Count the Tool Results a Tool-Limit Stop Retains by @berry-13 in #15893
• 🏷️ fix: Keep a Configured Sender Label From Revealing the Model on Hover by @aruj0 in #15489
• 🫂 fix: Scope People Picker Searches to Permitted Types by @danny-avila in #15878
• 🛬 fix: Land MCP OAuth Callbacks on Waiting Connections by @danny-avila in #15876
• 💤 fix: Preserve Dormant Workspace Bindings by @danny-avila in #15877
• 🔎 fix: Enforce WEB_SEARCH Role Permission on Agents by @danny-avila in #15875
• 🪂 fix: Release Stalled MCP Catalog Recovery Without Dropping Refreshed Tokens by @danny-avila in #15871
• 📇 fix: Stop an MCP Credential Refresh From Fencing Its Own Catalog Recovery by @danny-avila in #15865
• 🪢 fix: Recover a Failed MCP Server Once When Reinspections Overlap by @danny-avila in #15867
• 🔐 fix: Stop an MCP Credential Refresh From Fencing Its Own Connection by @danny-avila in #15863
• 💠 fix: Paint Native Tool Verification Badges by @berry-13 in #15862
• 🔣 fix: Encode Images From Storage Keys by @Ricky-Hao in #15851
• 🧵 fix: Preserve Per-Message Inspection Budgets Through Provider Preparation by @danny-avila in #15860
• 🧲 fix: Match Directory Users to Existing Principals by @danny-avila in #15855
• 🧨 fix: Defuse Skill and Artifact Parsing Backtracking by @danny-avila in #15856
• 🥅 fix: Keep Tool Error Prefix Parsing In Bounds by @danny-avila in #15857
• 🏰 fix: Read OpenID Flight State From Mongo Primary by @danny-avila in #15849
• 📴 fix: Stop Hidden Code Spinners by @danny-avila in #15846
• 📿 fix: Inspect Stored File Locators Per Message by @danny-avila in #15841
• 🔠 fix: Name Artifact Downloads After Their Titles by @danny-avila in #15836
• 🧊 fix: Withhold Rerun Controls on Compaction Turns by @berry-13 in #15797
• 🏷️ fix: Model-Agnostic Hint for Short Skill Descriptions by @L4XB in #15833
• 🔌 fix: Close Leaked HTTP Server in Server Specs by @jomspk in #15821
• 🪢 fix: Keep One Code File per Sandbox Destination by @jomspk in #15817
• 🥅 fix: Keep Mobile Composer Actions In Bounds by @danny-avila in #15825
• 🛖 fix: Restore Saved Attached Workspaces by @danny-avila in #15811
• 📯 fix: Propagate Host Cancellation Into API Tools by @danny-avila in #15812
• 🈳 fix: Treat Blank Mongo Index Settings as Unset by @Zsanz3 in #15809
• 🎒 fix: Carry Subagent Identity Past Streaming by @dustinhealy in #15795
• 🛂 fix: Back Off MCP OAuth Discovery by @danny-avila in #15783
• 🛎️ fix: Preflight MCP Readiness for Scheduled Chats by @danny-avila in #15782
• 🕳️ fix: Clear Nullable Queue Anchor by @danny-avila in #15794
• 🛟 fix: Recover CodeAPI File Uploads After Throttling by @danny-avila in #15784
• 🫆 fix: Preserve Durable Parents for Queued Turns by @danny-avila in #15787
• 🌳 fix: Guard Ambiguous BYOM Workspace Selection by @danny-avila in #15785
• 🔐 fix: Send One Code API Authentication Method by @danny-avila in #15781
• 🛑 fix: Preserve BYOM Foreground Cancellation Identity by @danny-avila in #15777
• 🪡 fix: Thread Stop Into BYOM Commands by @danny-avila in #15772
• 🪴 fix: Restore Native Workspace Selection by @danny-avila in #15771
• 🧿 fix: Patch gRPC xDS Denial of Service by @danny-avila in #15769
• 🔢 fix: Normalize PDF Citation Page Numbers by @danny-avila in #15731
• 🪫 fix: Gate Programmatic Bash on Stateful Worker Capabilities by @danny-avila in #15726
• 🫧 fix: Raise Nested Popovers Above Dialog Layers by @danny-avila in #15738
• ⏳ fix: Separate Temporary and General Chat Retention by @danny-avila in #15734
• 🛄 fix: Clear MCP Connection State Before Catalog Refresh by @danny-avila in #15741
• 🧘 fix: Settle Stale Response Parts by @danny-avila in #15743
• 🟫 fix: Reject Invalid Hex Color Matches by @danny-avila in #15744
• 🫣 fix: Hide Scroll-to-Bottom Under Composer Panels by @danny-avila in #15746
• 🪪 fix: Guard Null Avatar URLs in Social Login by @ncchinh in #15747
• 👯 fix: Collapse Radix Layer Packages to One Copy by @danny-avila in #15742
• 🧍 fix: Accommodate BYOM Queue and Execution Budgets by @danny-avila in #15750
• 🧷 fix: Keep Ref Cleanup and Hold Consumer Handlers to the Frontmost Dialog by @danny-avila in #15751
• 🗝️ fix: Load User Keys on Resumed Requests by @danny-avila in #15749
• 🗳️ fix: Recover Durable Background Tool Receipts by @danny-avila in #15752
• 🛗 fix: Add Tenant Index Upgrade Migration by @danny-avila in #15767
• 🏠 fix: Keep MCP Caches Fresh on Demand by @danny-avila in #15765
• 🔑 fix: Honor User-Provided MCP API Key Instead of Forcing OAuth by @danny-avila in #13954
• 🪙 fix: Count Quote Tokens on Message Edit by @danny-avila in #13958
• 📋 fix: Route Clipboard Paste Through Upload Options by @dustinhealy in #13957
• 📇 fix: Index sharedlinks updatedAt for Cosmos DB Sorts by @danny-avila in #13979
• 📂 fix: Mount Skill Files Under skills/ in Code Interpreter by @danny-avila in #13961 and #13975
• 🪟 fix: Re-measure Sidebar Chat List on Width Change to Fix Date-Group Spacing by @danny-avila in #13981
• 📏 fix: Make create_file Missing-Content Error Truncation-Aware by @danny-avila in #14043
• fix: use logAxiosError at the RAG file_search/context call sites by @mawburn in #14014
• fix: stripHeavyErrorFields Winston format (defense-in-depth) by @mawburn in #14018
• 📥 fix: Download Original File From Artifact Preview Panel for Office Documents by @berry-13 in #14026
• 🔥 fix: Firebase CDN Initialization Under tsdown CJS Interop by @jakacenta in #14046
• fix: preserve role SHARE permissions across boot in initializeRoles by @mawburn in #14022

🔧 Refactoring and Performance Copy Anchor Link
• 📜 style: Scroll the Sidebar as One Surface by @berry-13 in #15914
• 🧷 style: Sidebar Row Controls, Pinned Unpin Badge and Drag Rules by @berry-13 in #15870
• 🔡 style: Size Image Tool Labels Like Every Other Activity Row by @danny-avila in #15898
• 🎨 style: Color Image Tool Labels With the Activity Rows' Secondary Role by @danny-avila in #15900
• 🚄 perf: Linearize Conversation Import Lineage by @danny-avila in #15881
• 🧽 style: Composer, Welcome Screen and Context Panel Polish by @berry-13 in #15838
• 🛫 refactor: Promote Generation Protocol V2 Automatically by @danny-avila in #15324
• 🎠 refactor: Route Every Event Actor Turn Through One Lifecycle by @danny-avila in #15325
• 🪩 style: Shimmer Live Reasoning Labels and Timers by @danny-avila in #15431
• ✔️ style: Anchor the Applied Steer Receipt and Name Tool Calls in Its Interrupt Copy by @danny-avila in #15377
• 🧵 refactor: Give the Subagent Panel One Composer and Main Chat's Metrics by @danny-avila in #15436
• 🐆 perf: Build Dev Branch Images on Native ARM and Cheapen Asset Brotli by @danny-avila in #15441
• ♻️ refactor: Compute Context Gauge Client-Side, Drop Projection Endpoint by @danny-avila in #13953
• 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads by @danny-avila in #13978
• 🦥 perf: Lazy-Load Agent Version History in Editor by @danny-avila in #13977
• 🛗 perf: Fetch Pinned Agents Directly Past the Global Agents Map by @danny-avila in #13972
• ⚡ perf: memoize FavoritesList and BookmarkNav to prevent re-renders during streaming by @berry-13 in #14011
• 🗺️ refactor: Light Up In-Viewport Ribs at Rest in Message Nav by @danny-avila in #14041
• ⚡ perf: Minimize group membership query in principal resolution by @danny-avila in #14055
• ⚡ perf: Skip Role Route Capability Probe for Own and Default Roles by @danny-avila in #14073
• 🪭 refactor: safe structured failure logging for langfuse fanout gateway by @upman in #14050
• 📉 perf: Skip Redundant Permission Queries on MCP Servers List by @danny-avila in #14077
• ⚡ perf: Halve Per-Delta Redis Round Trips in Resumable Streams by @danny-avila in #14313
• 🧭 refactor: web_search Description on When To Search vs Answer Directly by @joshbla in #13930
• 🧷 perf: Stabilize Mutation-Dependent Memos in Chat Hooks by @danny-avila in #14328
• 🚰 perf: Suppress No-Op Conversation Writes and Widen-Proof Atom Subscriptions by @danny-avila in #14329
• 🔍 refactor: Surface primary OpenID JWT failure reason in auth failure log by @danny-avila in #14346
• 🧭 perf: Warm Conversation Switches with Single-Navigation Focus Intent by @danny-avila in #14334
• 🧹 perf: Share Voices Store, Gate Timestamp Ticker, Stabilize Greeting Springs by @danny-avila in #14335
• 🎞️ perf: Coalesce Streaming Delta Cache Writes Per Animation Frame by @danny-avila in #14332
• 🎛️ perf: Narrow Composer Subscriptions to Streaming State by @danny-avila in #14333
• 🧬 perf: Memoize Message Spine and Isolate Scroll-Button State by @berry-13 in #14330
• 🪟 perf: Virtualize Search Results and Stop the Per-Query Remount by @danny-avila in #14352
• ⚡ perf: Reduce Agent Chat Startup Latency by @danny-avila in #14423
• 💬 refactor: Raise ask_user_question Option Label Cap to 280 Chars by @danny-avila in #14491
• 🪢 refactor: Move Agent Execution Seam Before Initialization by @danny-avila in #14581
• 📉 perf: Bound Early Event Buffering for Detached Generations by @danny-avila in #14612
• 🎨 refactor: adopt the @librechat/client design system (semantic color tokens + component migration) by @berry-13 in #13879
• 🧩 refactor: Shared UI Design System Tokens by @danny-avila in #14670
• ⚡ perf: Agent List and Model Selector at Scale by @berry-13 in #14601
• 🧭 refactor: make the side panels behave the same way by @berry-13 in #14695
• 🫧 refactor: Fading Pre-Response Dot, Legacy Cursor CSS Removed by @danny-avila in #14772
• 🧱 refactor: Require Broad Config Management for Base Field Mutations by @danny-avila in #14775
• 🖍️ refactor: Typed Console Colors and Hardened Script Helpers by @danny-avila in #14778
• 🧱 refactor: Make Activity Phase Anchor Construction Exhaustive by @danny-avila in #14805
• 🧭 refactor: Resolve Activity Phase Position Once Per Boundary by @danny-avila in #14807
• 🧩 refactor: Extend Step Status To Remaining Cards; Separate Cancelled From Failed by @danny-avila in #14873
• 🎯 refactor: Infer Agents Endpoint for Model Specs Naming an Agent by @danny-avila in #14889
• ⚡ perf: Flip the Pinned Flag Without a Full Conversation Save by @berry-13 in #14862
• ⚡ perf: Optimize First Load of Large Conversations by @danny-avila in #14901
• 🏷️ refactor: Keep Agent Conversations From Revealing Model Labels by @danny-avila in #14909
• 🥚 refactor: Default Agents to Preferred Stateful Workspace Scope by @danny-avila in #14908
• 📱 perf: Instant Mobile View Switching + Uniform Sidebar Toggle by @danny-avila in #14913
• 🧩 refactor: Resolve Tool-Card State Once by @danny-avila in #14934
• ✨ refactor: Presets, Skills Motion and Model Selector Polish by @berry-13 in #14953
• 🧲 refactor: Consolidate Claude Prompt Cache and Context Checks by @danny-avila in #15008
• 🔌 refactor: Extract Git Repository Adapter From Skill Sync by @danny-avila in #15052
• 🔀 perf: Swap the Transcript With the URL on Conversation Switch by @danny-avila in #15054
• ⚡ perf: Warm Feature Catalogs in the Background After First Paint by @berry-13 in #15047
• 🐇 refactor: Decouple Meilisearch From Document Saves by @danny-avila in #15109
• 🧮 perf: Enable Agent Context Count Reuse by @danny-avila in #15130
• ⚡ perf: Cut Serial Round Trips and a 100ms Admission Stall from Chat Turns by @danny-avila in #15138
• ⚡ perf: Append Saved Message Ids Instead of Rebuilding the Conversation Array by @danny-avila in #15141
• ⚡ perf: Plain-JSON Memory Cache and an Idle Backoff for the Trigger Poll by @danny-avila in #15144
• ⚡ perf: Build the Memory Message Copy Only When Something Reads It by @danny-avila in #15164
• 🖼️ refactor: Consolidate Provider Icons Into a Single Registry by @berry-13 in #15148
• 🐇 perf: Bound MCP Agent Access Scan by MCP Referencing Agents and Share the Read-Through Cache by @berry-13 in #15028
• ⚡ perf: Avoid Parallel Full and Paged Prompt Loading on Startup by @berry-13 in #15031
• 🎟️ refactor: Require Credentials for Local Image Access by Default by @danny-avila in #15252
• 🔇 refactor: Quiet Framework Logging in Unit Tests by @danny-avila in #15363
• 🎻 refactor: Orchestrate Agent Runs Through a Request-Free Host by @danny-avila in #15366
• 🧬 perf: Evolve Compaction Guidance on Warm Turns by @danny-avila in #15371
• 🕯️ style: Settle the Applied Steer Receipt Once the Response Is Done by @danny-avila in #15377
• 🔌 refactor: Give the Subagent Surface a Host Seam and Its Own Jotai State by @danny-avila in #15455
• 🔙 refactor: Keep Pasted Text Return Action Visible by @danny-avila in #15586
• style(insights): use Click UI muted token for KPI labels and 32/12 page spacing by @danielclickh in #15551
• 🔣 refactor: Replace Mongo Filters With Typed Criteria by @danny-avila in #15580
• 🏛️ refactor: Extract Engine-Neutral Tenant Policy by @danny-avila in #15575
• style(insights): give panels their own surface in dark mode by @danielclickh in #15552
• 💫 style: Align the Phase Summary Rail and Simplify its Fold by @danny-avila in #15619
• 🎛 refactor: Replace Agent Skills Toggles With a Three-Way Mode Control by @berry-13 in #15520
• 📏 style: Center Every Row Glyph on the Avatar's Axis by @danny-avila in #15643
• 🎖️ perf: Promote Flat Thread Rendering to Default by @danny-avila in #15660
• 📏 style: Put the Grouped Thought on the Row Rail by @berry-13 in #15674
• 🗝️ refactor: Prefer the Recorded Storage Key for Every Download Stream by @danny-avila in #15695
• 🕓 style: Move the Queued-Message Hint Into a Hover Tooltip on the Clock Icon by @danny-avila in #15706
• 🏁 style: Align Streaming Elapsed Reading With Footer Start by @danny-avila in #15720
• 💠 style: Unify Code Approval With Composer Controls by @danny-avila in #15721
• 🐾 style: Show the Multiplier Only on a Generic Tool Line by @lia-by-librechat in #16225
• 🧑‍🤝‍🧑 style: Seat the Live Multiplier Beside Its Status Line by @lia-by-librechat in #16220
• 🛋️ perf: Discover MCP Tools Only When Needed by @lia-by-librechat in #16190
• ⚡ perf: Throttle Code Highlighting While a Message Streams by @berry-13 in #16073
• 🖍️ perf: Highlight Tool Code Once, and Only When Its Pane Is Open by @danny-avila in #16143
• ⚡ perf: Virtualize the Model Selector's Search Results by @berry-13 in #16074
• ⚡ perf: Preserve Message References in the Content Handler by @berry-13 in #16072
• ⚡ perf: Exclude Agent Version History From Default getAgent Reads by @berry-13 in #16070
• ⚡ perf: Split Streaming Markdown Blocks Incrementally by @berry-13 in #16071
• ✂️ refactor: Name Tool Rounds From the Trace, and Match a Cut Response From Its End by @danny-avila in #16113
• 🎫 perf: Limit Redis Script Caching to Atomic Claims by @lia-by-librechat in #16116
• 🚐 perf: Enable Redis Stream Coalescing by Default by @lia-by-librechat in #16093
• 🌓 refactor: Scrim OGDialog With the Overlay Theme Role by @berry-13 in #16068
• 🪶 perf: Cut the Mount Cost of Finished Agent Messages by @danny-avila in #16057
• ⚗️ refactor: Separate Content, Tool, and Agent Types From the Assistants Module by @lia-by-librechat in #15910
• 🛝 refactor: Route Packaged Chat Completion Frames Through a Writer by @lia-by-librechat in #16267
• 🔕 perf: Back Off Idle Durable Agent Recovery Polls by @lia-by-librechat in #16303
• 📐 style: Set the Reasoning Header at the Shared Row Scale by @danny-avila in #16391
• 🐢 perf: Collapse Settled Reasoning Text in AnimatedText by @berry-13 in #16403
• 📟 refactor: Present Background Task Checks as a Distinct Activity by @lia-by-librechat in #16414
• 📃 style: Match File Activity Icons To File Rows by @lia-by-librechat in #16445
• ⏩ refactor: Clarify Steering Timing and First-Response Fallback by @lia-by-librechat in #16465
• 🥧 refactor: Show Failed Call Fractions and Preview Age by @lia-by-librechat in #16468
• 🪮 perf: Match Tolerant Edit Lines Without Rebuilding Windows by @lia-by-librechat in #16562
• 🏎️ perf: Re-render Only the Tail Rows When a Message Is Sent by @danny-avila in #16572

🧪 Tests Copy Anchor Link
• 🧪 test: Wait for the Durable Task Input Before Reserving a Child Control by @danny-avila in #15901
• 🧪 test: Restore Two Rotted Integration Suites and Run Every One in CI by @danny-avila in #15866
• 🧵 test: Type BYOM Cancellation Mock by @danny-avila in #15774
• 📎 test: Verify Stateful Sandbox Upload Continuity by @danny-avila in #14363
• 📐 test: Guard Web Search Description Length by @danny-avila in #14044
• 🛂 test: Cover Tool Approval Workflows End to End by @danny-avila in #14427
• 🧭 test: Cover Agent Handoffs End to End by @danny-avila in #14428
• 🧪 test: Reasoning-Stream Render Perf Benchmark via react-scan by @danny-avila in #14494
• 🎛️ test: Guard Multi-Steer Injection Across Tool Boundaries by @danny-avila in #14498
• 🧪 test: Run mock E2E against Redis in shards by @danny-avila in #14551
• 📎 test: Verify Stateful Sandbox Upload Continuity by @danny-avila in #14363
• 📐 test: Guard Web Search Description Length by @danny-avila in #14044
• 🛂 test: Cover Tool Approval Workflows End to End by @danny-avila in #14427
• 🧭 test: Cover Agent Handoffs End to End by @danny-avila in #14428
• 🧪 test: Reasoning-Stream Render Perf Benchmark via react-scan by @danny-avila in #14494
• 🎛️ test: Guard Multi-Steer Injection Across Tool Boundaries by @danny-avila in #14498
• 🧪 test: Run mock E2E against Redis in shards by @danny-avila in #14551

📦 Dependencies, Chores & CI Copy Anchor Link
• 🚀 v0.8.8-rc4 by @danny-avila in #16147
• 🚚 ci: Make Image Publishing Owner-Agnostic Ahead of the Org Move by @danny-avila in #15952
• 📊 chore: bump Helm chart to 2.0.12 by @danny-avila in #15950
• ⬆️ chore(deps): bump agents to 3.8.7 by @upman in #15947
• 🪓 ci: Cull Stale Codegraph Select Runs by @danny-avila in #15939
• 🏮 docs: Relight the Helm AI Setup Link by @jrlprost in #15808
• 🎖️ chore: Promote Helm Chart to 2.0.11 by @danny-avila in #15905
• 💉 chore: Upgrade @azure/msal-node to v5.6.0 by @danny-avila in #15903
• 🧵 ci: Keep a Floor of Two Jest Workers in CI by @jomspk in #15819
• 🩹 ci: Invoke ESLint and Prettier Binaries Directly in Static Checks by @danny-avila in #15884
• ⏱️ ci: Cut the ESLint Config Sweep to the Rules That Can Regress by @danny-avila in #15890
• 🧷 ci: Await durable finalization in conversation-management mock e2e by @jtodaroii in #15791
• 📦 chore: bump npm audit packages and @librechat/agents to v3.8.5 by @danny-avila in #15770
• 📐 docs: Set PR Description, Review and Completion Standards by @danny-avila in #15753
• 🧱 docs: Hold Module Boundaries, Configurable Levers and Injected Dependencies by @danny-avila in #15754
• 👣 docs: Define CJS and Jotai Migration Triggers by @danny-avila in #15756
• 🧫 chore: Keep Jest Specs Out of Tool Discovery by @danny-avila in #15766
• 🚀 v0.8.8-rc3 by @danny-avila in #15859
• ✨ v0.8.8-rc2 by @danny-avila in #14845
• 📦 chore: bump @librechat/agents to v3.2.52 by @danny-avila in #13939
• ⬆️ chore: Migrate off deprecated @ariakit/react-core to @ariakit/react-components by @danny-avila in #13940
• 🧪 ci: Resolve DataTable test infinite re-render by @danny-avila in #13947
• 📦 chore: bump @librechat/agents to v3.2.54 by @danny-avila in #14035
• 🔄 chore: Bump @librechat/agents to v3.2.55 by @danny-avila in #954caef3a3
• 🧪 ci: De-flake ConversationsSection Memoization Spec on Slow Runners by @danny-avila in #14071
• 🧷 chore: Expose Retain Recent Summarization Config by @danny-avila in #14134
• 📦 chore: bump langfuse fanout Go dependencies by @upman in #14126
• ⭐ docs: update Star History section by @berry-13 in #14198
• 📦 chore: Update @librechat/agents to v3.2.62 by @danny-avila in #14235
• 📦 chore: Update @librechat/agents to v3.2.65 by @danny-avila in #14263
• 🧹 chore: Prune Dangling Images After deployed-update Pull by @danny-avila in #14269
• 🍽️ chore: Drop Pending Composer Draft When Steering or Queuing by @danny-avila in #14289
• 🧩 chore: Prebundle Node Polyfills for Buffer, Process, and Global in Vite optimizeDeps by @danny-avila in #14354
• 📦 chore: Update @librechat/agents to v3.2.66 & npm audit fix by @danny-avila in #14361
• 🧾 ci: Skip Workflows for Markdown-Only Changes by @danny-avila in #14378
• 📦 chore: Update @librechat/agents to v3.2.68 by @danny-avila in #14380
• 🚦 ci: Gate Playwright Runs to Maintainers by @danny-avila in #14385
• 🎭 ci: Scope Playwright

Original source

• Added public Agents API documentation routes

  • openapi.enabled serves the OpenAPI specification at /api/openapi.json and Swagger UI at /api/docs
  • The routes are disabled by default

• Expanded Agent Management OIDC authentication

  • endpoints.agents.managementApi.auth.oidc.audience is now optional
  • tokenUse can require a token type such as access
  • requiredScopes requires every listed OAuth scope, enabling Cognito machine access tokens that use client_id without an aud claim

• Added ACL write conflict limits

  • permissions.maxWriteAttempts controls compare-and-swap attempts per ACL document, including the initial write
  • The default is 3; valid values range from 1 through 100

• Added an xAI Grok 4.7 custom endpoint example

  • Set XAI_API_KEY and use the OpenAI-compatible https://api.x.ai/v1 endpoint
  • Grok 4.7 supports low, medium, high, and xhigh reasoning effort

• Expanded highly experimental stateful Code session controls

  • endpoints.agents.repositoryInstructions.timeoutMs bounds attached-workspace instruction discovery and defaults to 2000 ms
  • statefulCodeSessions.userConfig.bash.maxQueueWaitMs bounds attached Bash capacity retries and defaults to 300000 ms
  • Setting maxQueueWaitMs to 0 disables client retries after initial admission without cancelling admitted or running work

• Added Agent error and background-result limits

  • endpoints.agents.maxProviderErrorChars defaults to 2000; set it to 0 to omit unclassified provider error text
  • endpoints.agents.modelResponseBodyTimeoutMs defaults to 900000 ms and resets whenever a provider response-body chunk arrives
  • endpoints.agents.modelResponseHeadersTimeoutMs defaults to 300000 ms while waiting for provider response headers
  • Set either transport timeout to 0 to disable it; both accept values up to 86400000 ms
  • backgroundTasks.completionResultMaxChars defaults to 24576 characters per delivered result
  • backgroundTasks.completionResultBatchSize defaults to 8 results per continuation and accepts values from 1 through 16

• Expanded MCP request and OAuth configuration

  • mcpServers.<name>.requestHeaders resolves headers only for an active request, merges over headers, and is omitted during tool discovery
  • oauthRefreshCoordination optionally serializes token refresh across replicas through shared Redis
  • oauthRefreshWaitTimeout and oauthPersistenceWaitTimeout both default to 15000 ms
  • Enable refresh coordination only after every replica is upgraded and uses the same Redis deployment and values

• Added authenticated RUM proxy exports

  • RUM_PROXY_AUTHORIZATION supplies the complete server-only Authorization header forwarded to the configured collector
  • Authenticated redirects are rejected; configure the final RUM_PROXY_TARGET_URL

• Updated Redis stream delta coalescing

  • STREAM_DELTA_COALESCE_MS now defaults to 25 ms when unset
  • Set it explicitly to 0 to disable coalescing; values above 1000 are capped

• Expanded Conversation Trace Viewer configuration

  • interface.traceViewer.showToolNames defaults to false
  • Enabling it performs additional Langfuse observation reads and exposes tool names without exposing tool input or output

• Added streaming code-highlight throttling

  • interface.codeHighlightThrottleMs controls the minimum interval between syntax-highlighting passes while streamed code changes
  • The default is 300 ms; set it to 0 to disable throttling

• Added Skill import cleanup concurrency

  • fileConfig.skills.importCleanupConcurrency bounds cleanup after a failed archive import and defaults to 8
  • Set it to 1 for serial cleanup

• Updated file MIME pattern validation

  • Every supportedMimeTypes pattern is compiled with the active server regex engine during configuration validation
  • Unsupported patterns now reject the configuration instead of being silently skipped

• Updated Helm credential Secret handling

  • A non-empty global.librechat.existingSecretName is now required to resolve; missing named Secrets block pod startup
  • Set the value to an empty string only when all LibreChat credentials are injected through other supported environment settings
  • Bundled Meilisearch still requires its separately configured master-key Secret

• Updated the config version to 1.3.17

Original source

The v0.8.8-rc4 release candidate of LibreChat

What's Changed

🏞️ Highlights

• Public Agents API with OpenAPI spec and docs
• Caller-executed tools for the Open Responses API
• GPT-6 Sol, GPT-6 Luna, and Claude Opus 5.5
• Conversation-isolated attached workspaces with repository instructions
• Expanded Trace Viewer with steps, roles, previews, and cost
• Same-run Skill authoring and execution
• System-event turns and single-row live activity
• Faster streaming Markdown, model search, and Agent messages
• Stronger MCP authentication and per-request headers

✨ Features

• ✨ feat: Client-Executed Function Tools for the Responses API by @alexkorep in #16078
• 🛍️ feat: Add Programming App to OpenRouter Categories by @lia-by-librechat in #16228
• 🌞 feat: Add GPT-6 Sol and Luna Support by @lia-by-librechat in #16221
• 🔐 feat: Support Cognito Access Tokens for Agent Management by @dustinhealy in #16224
• 🎹 feat: Add Claude Opus 5.5 Support by @danny-avila in #16215
• ⏲️ feat: Report a Background Task's Start, Settlement and Elapsed Time by @lia-by-librechat in #16193
• 🧑‍🚀 feat: Add Grok 4.7 Support Through xAI by @lia-by-librechat in #16173
• 🫧 feat: Hold a Live Run's Activity at One Row by @danny-avila in #16118
• 📟 feat: Render System Events as Distinct Turns by @danny-avila in #16119
• 💵 feat: Show Cost per Record, Step and Response in the Trace Ledger by @danny-avila in #16120
• 💌 feat: Authenticate RUM Proxy Exports by @lia-by-librechat in #16114
• 🐣 feat: Invoke Newly Authored Skills in the Same Run by @lia-by-librechat in #16036
• 🌳 feat: Isolate Attached Workspaces by Conversation by @danny-avila in #16107
• 💬 feat: Read a Model Call as a Conversation in the Trace Viewer by @danny-avila in #16103
• 🗣️ feat: Trace Viewer Roles, Agent Identity and Tool Rounds by @danny-avila in #16098
• ⛽ feat: Negotiate Background Command Timeouts by @danny-avila in #16100
• 🪜 feat: Trace Viewer Steps, Sequence Scale and Previews by @danny-avila in #16009
• 📪 feat: Send Per-Request MCP Headers Without Hiding the Tool Catalog by @lia-by-librechat in #15988
• 🔌 feat: OpenAPI spec and docs for the public Agents API by @AtefBellaaj in #15928
• 📖 Load Repository Instructions for Attached Workspaces by @danny-avila in #16008
• 🪪 feat: Pass Schedule Identity to MCP Token Providers by @danny-avila in #15962

🐛 Fixes

• 🩼 fix: Keep OpenRouter Category Override Test Type-Safe by @lia-by-librechat in #16229
• 🔍 fix: Enable File Search When Attaching From the Files Panel by @jtodaroii in #16223
• 🎽 fix: Give Each Streamed Tool Call a Stable Outward Index by @lia-by-librechat in #16209
• 🎰 fix: Show Live Tool Combo Multipliers by @lia-by-librechat in #16202
• ⛲ fix: Prevent Agent Model Stream Idle Timeouts by @lia-by-librechat in #16201
• 🥫 fix: Normalize Legacy MCP Header Maps on Cached Reads by @lia-by-librechat in #16200
• 🫥 fix: Preserve Absent MCP Header Maps Across Database Saves by @lia-by-librechat in #16194
• 🍴 fix: Split Combined Bit Updates in ACL Permission Writes by @lia-by-librechat in #16172
• 🚥 fix: Preserve Insights With Guarded ACL Role Updates by @lia-by-librechat in #16170
• 🏦 fix: Require Named Helm Credential Secrets by @lia-by-librechat in #16175
• 🎈 fix: Fill Reasoning Previews Before Throttling by @lia-by-librechat in #16178
• ⏹️ fix: Cancel Stale Throttled Scroll Callbacks by @minwookshin in #16167
• 🧻 fix: Unblock Conversation Deletion After Queued Turns by @lia-by-librechat in #16174
• 🔤 fix: Validate MIME Patterns With the Active Regex Engine by @lia-by-librechat in #16177
• 📯 fix: Explain Tenant Index Migration on Startup Conflicts by @lia-by-librechat in #16176
• 📝 fix: Preserve Chat Drafts Across Navigation and Clearing by @danny-avila in #16161
• 🔂 fix: Reuse Redis Caches Without Changing TTLs by @lia-by-librechat in #16154
• 🪑 fix: Preserve Tool Pane Choices Through Response Finalization by @lia-by-librechat in #16152
• ✒️ fix: Persist a Generated Title Before the Turn Ends by @lia-by-librechat in #16137
• 🌁 fix: Stop Painting the Closed Mobile Drawer by @lia-by-librechat in #16127
• 📠 fix: Preview SVG Artifacts From Their Edited Source by @lia-by-librechat in #16123
• 🖼️ fix: Resolve Pinned Model Icons from Endpoint Config by @jtodaroii in #16089
• ✒️ fix: Render Code in the Bundled Monospace Font by @lia-by-librechat in #16146
• 🫧 fix: Stop the Live Activity Row From Flashing Open on Code Calls and Thoughts by @danny-avila in #16145
• 🚷 fix: Isolate Jina Credential Provenance by @danny-avila in #16134
• 🪢 fix: Bind Preserved MCP API Keys to Server Configuration by @danny-avila in #16136
• ⚓ fix: Keep a Resumed Compaction Anchored to the Turn It Summarizes by @lia-by-librechat in #16037
• 🕳️ fix: Repair Legacy Meili Cleanup Index by @danny-avila in #16133
• ☔ fix: Preserve MCP Authorization During Token Endpoint Outages by @lia-by-librechat in #16126
• 🎽 fix: Hand Same-Batch Code Calls the Files a Skill Just Loaded by @lia-by-librechat in #16115
• 🥢 fix: Exclude Prompt Inputs From Terminal Events by @lia-by-librechat in #16112
• 🥖 fix: Refresh MCP Credentials That Arrive Already Expired by @lia-by-librechat in #16111
• 🧺 fix: Bound Background Completion Batches by @danny-avila in #16102
• 📬 fix: Persist Background Results Before Parent Rows by @danny-avila in #16101
• 📬 fix: Deliver Same-Turn Background Results by @danny-avila in #16097
• 🔑 fix: Stringify Ban Cache Keys When Redis Is Off by @gokay-ai in #16039
• 🗂️ fix: Keep a Running Attachment Chat in the Sidebar by @danny-avila in #16104
• 🥾 fix: Define Code Execution Persistence Boundaries by @danny-avila in #16099
• 📄 fix: Send Textual Documents to Claude Through Gateways as Text by @mihidumh in #16055
• 🎱 fix: Stop Sealing a Code Environment Decision a Chat Never Made by @lia-by-librechat in #16056
• 🫗 fix: Roll Back Incomplete Skill Archive Imports by @lia-by-librechat in #16052
• 📤 fix(langfuse): support documented media upload types by @upman in #16079
• 🎟️ fix: Preserve BYOM Tool Calls Through Capacity Windows by @danny-avila in #16060
• 📱 fix: Open Sign-In and External Links From iOS Home-Screen Apps by @danny-avila in #16077
• 🗾 fix: Route Cross-Region Attachments Through CloudFront by @upman in #16082
• 📱 fix: Fit the Tool Library and Skills Pickers to Small Screens by @berry-13 in #16067
• 🔑 fix: Ask for MCP Sign-In When a Server Rejects Refreshed Tokens by @danny-avila in #16075
• 🔓 fix: Stop Code Outputs and Tool-Routed Spreadsheets From Locking Threads by @danny-avila in #16058
• 🥡 fix: Delete Storage and Embeddings With Owned Agent Files by @lia-by-librechat in #16007
• 👛 fix: Drop Unread Credentials From MCP Domain Validation by @SpectralOne in #16035
• 🗼 fix: Serialize MCP OAuth Token Refresh Across Replicas by @lia-by-librechat in #15993
• 🗣️ fix: Keep Provider Error Text on Unclassified Agent Failures by @berry-13 in #16034
• 🌐 fix(locales): correct English setting descriptions by @simpleqt in #16023
• 📭 fix: Deliver Attachment Text Until a File Tool Holds It by @lia-by-librechat in #16027
• 📖 fix: Verify Agents OpenAPI contracts and disable external reporting by @dustinhealy in #16028
• 🖨️ fix: Regenerate the Agents OpenAPI Spec With repositoryInstructions by @lia-by-librechat in #16029
• 🏛️ fix: Resolve Global Access Roles for Tenant Owner Grants by @lia-by-librechat in #15986
• 🪑 fix: Explain Workspace Capacity Timeouts by @danny-avila in #16016
• 🔅 fix: Theme the Tool Approval Decision Fields by @lia-by-librechat in #16014
• 🛎️ fix: Route Background Tool Handoffs by @danny-avila in #15990
• 🪒 fix: Strip Cache-Bust Suffixes From Every Local File Read by @lia-by-librechat in #15991
• 🎚️ fix: Allow Opting Out of the MCP OAuth resource Parameter by @lia-by-librechat in #15982
• ⛓️ fix: Bind Programmatic Bash to Selected Workspaces by @danny-avila in #15992
• ⏮️ fix: Keep the Last Keystrokes When a Run Finishes by @lia-by-librechat in #15987
• 📓 fix: Keep Typed Text When Starting a New Chat by @lia-by-librechat in #15985
• 🧦 fix: Restore OpenID Refresh After the Session Store TTL Expires by @lia-by-librechat in #15983
• 👆 fix: Thumb-Sized Send Button on Touch Devices by @lia-by-librechat in #15979
• 🪃 fix: Remember the Last Code Approval Mode by @lia-by-librechat in #15973
• 🧱 fix: Keep Streamed Content When a Turn Fails by @danny-avila in #15961
• 🍯 fix: Stop Approval Pauses From Unsealing Code Environments by @danny-avila in #15963

🔧 Refactoring and Performance

• 🐾 style: Show the Multiplier Only on a Generic Tool Line by @lia-by-librechat in #16225
• 🧑‍🤝‍🧑 style: Seat the Live Multiplier Beside Its Status Line by @lia-by-librechat in #16220
• 🛋️ perf: Discover MCP Tools Only When Needed by @lia-by-librechat in #16190
• ⚡ perf: Throttle Code Highlighting While a Message Streams by @berry-13 in #16073
• 🖍️ perf: Highlight Tool Code Once, and Only When Its Pane Is Open by @danny-avila in #16143
• ⚡ perf: Virtualize the Model Selector's Search Results by @berry-13 in #16074
• ⚡ perf: Preserve Message References in the Content Handler by @berry-13 in #16072
• ⚡ perf: Exclude Agent Version History From Default getAgent Reads by @berry-13 in #16070
• ⚡ perf: Split Streaming Markdown Blocks Incrementally by @berry-13 in #16071
• ✂️ refactor: Name Tool Rounds From the Trace, and Match a Cut Response From Its End by @danny-avila in #16113
• 🎫 perf: Limit Redis Script Caching to Atomic Claims by @lia-by-librechat in #16116
• 🚐 perf: Enable Redis Stream Coalescing by Default by @lia-by-librechat in #16093
• 🌓 refactor: Scrim OGDialog With the Overlay Theme Role by @berry-13 in #16068
• 🪶 perf: Cut the Mount Cost of Finished Agent Messages by @danny-avila in #16057
• ⚗️ refactor: Separate Content, Tool, and Agent Types From the Assistants Module by @lia-by-librechat in #15910

🧪 Tests

• 📷 test: Capture Revision-Pinned PR Screenshot Evidence by @lia-by-librechat in #16191
• 🛌 test: Poll Instead of Sleeping for Dead Subagent Owner Expiry by @lia-by-librechat in #16144
• 📍 test: Add Deployed Smoke Profile by @danny-avila in #16135
• 🥊 test: Prove MCP Refresh Coordination Across Replica Processes by @lia-by-librechat in #16131
• 🫛 test: Separate an Authoring Run From a Skills-Off Run by @lia-by-librechat in #16128
• 🚥 test: Hold Group Cache Reads Until Concurrent Callers Arrive by @lia-by-librechat in #16059

📦 Dependencies, Chores & CI

• 🪞 ci: Mirror Published Images to a Legacy GHCR Namespace by @danny-avila in #16214
• 📦 chore: bump agents SDK to v3.9.1 by @danny-avila in #16212
• 🎩 docs: Set Expectations for AI-Assisted Contributions by @lia-by-librechat in #16207
• 🥢 ci: Select Quote Text Across the Streaming Fade's Word Spans by @lia-by-librechat in #16189
• 📋 docs: Clarify Type of Change and Screenshot Uploads in the PR Template by @berry-13 in #16165
• 🦾 chore: Bump Agents SDK to v3.9.0 by @danny-avila in #16142
• 📒 ci: Upload Per-Test Jest Results From Review Workflows by @danny-avila in #16110
• 📋 chore: Restructure Pull Request Template by @berry-13 in #16094

New Contributors

• @minwookshin made their first contribution in #16167
• @gokay-ai made their first contribution in #16039
• @simpleqt made their first contribution in #16023

Full Changelog: v0.8.8-rc3...v0.8.8-rc4

Original source

The v0.8.8-rc3 release candidate of LibreChat

What's Changed Copy Anchor Link
Operator-facing YAML, environment, default, and migration changes are collected in Config v1.3.16.

🏞️ Highlights Copy Anchor Link
• Interrupt, steer, or queue Agent runs, with HITL approvals, questions, and tool-limit recovery
• Scheduled Chats with cron, time zones, MCP readiness checks, and Project destinations
• New models: GPT-5.6 and GPT-6 Astra; Claude Fable 5.1, Opus 5, and Sonnet 5; Gemini 3.8, 3.7, 3.6 Flash, and 3.5 Flash-Lite
• Live activity, phase, reasoning, and tool-intent labels
• Unified Agent Builder with Skill authoring, background tools, and Programmatic Tool Calling
• Beta durable Agent Events and saved Agent teams with background wakeups and automatic continuation
• Beta Agent Plugins and highly experimental selectable Code workspaces with saved defaults and guarded permissions
• Beta Agent Management API for Agent and Skill automation with M2M OIDC
• Context Usage for dialogue, tool traffic, cache, instructions, cost, and runway pressure
• Unified draggable Pinned section, manual compaction, mobile polish, and rich-text copy
• Unified attachments with automatic model routing and lazy File Search or Code provisioning
• Stronger MCP, OpenID, shared-link, tenant, file, Redis, and DocumentDB safeguards
• Conversation Trace Viewer, run-scoped Subagent file sharing, and chat-list filtering

✨ Features Copy Anchor Link
• 🧷 feat: Carry Ask User Answers Past Compaction by @danny-avila in #15944
• 🪂 feat: Opt-In Text Fallback for Files No Tool Can Read by @danny-avila in #15940
• 🕹️ feat: Run Declared Project Actions on Attached Workers by @danny-avila in #15943
• 🪧 feat: Unify Artifact Triggers as Tool Rows by @berry-13 in #15915
• 🔁 feat: Retry OpenID Discovery After Startup Failures by @danny-avila in #15899
• 🔭 feat: Conversation Trace Viewer by @danny-avila in #15869
• 🦘 feat: Share Run-Scoped Files With Subagents by @usnavy13 in #15848
• 🔎 feat: Filter and Sort the Sidebar Chats List by @berry-13 in #15842
• 📟 feat: Record Safe Upstream Model Failures by @dustinhealy in #15800
• 🔠 feat: Render Safe Upstream Model Errors by @dustinhealy in #15837
• 🖋️ feat: Seal Code Environment Choices Per Conversation by @danny-avila in #15868
• 🏡 feat: Remember Agent Workspace Defaults by @danny-avila in #15843
• 🧮 feat: Surface Retained Tool-Message Context Usage by @berry-13 in #15796
• 🩻 feat: improve agent filter controls for insights by @upman in #15807
• 📌 feat: Unified Pinned Section With Sidebar Drag Interactions by @berry-13 in #15057
• 🥼 feat: Expose BYOM Cancellation Diagnostics by @danny-avila in #15810
• 🪓 feat: Cancel Background Tool Invocations by @danny-avila in #15773
• 🪔 feat: Expose Bounded Attached Bash Timeouts by @danny-avila in #15776
• 🏕️ feat: Select Attached Code Workspaces by @danny-avila in #15768
• 🚚 feat: Route Attachments and Provision Tools Lazily by @danny-avila in #15763
• 🕒 feat: Track terms acceptance timestamp by @berry-13 in #10810
• 🔄 feat: Continue Shared Conversations as Personal Copies by @berry-13 in #13714
• 🪝 feat: HITL Tool Approval Scaffolding (Slice A) by @danny-avila in #12938
• 🧠 feat: Add Memory as an Agent Capability with Inline Tools and Ephemeral Badge by @danny-avila in #13869
• 📇 feat: Agent Contact Visibility with Owner Fallback by @peeeteeer in #13663
• 🪟 feat: Faithful Over-Window Context Estimate via Prune Mirror and Overhead Reserve by @danny-avila in #13959
• 🪭 feat: Add opt-in Langfuse fanout gateway + collector by @upman in #13872
• 🪝 feat: Human-in-the-Loop Runtime - Tool Approval + Ask-User-Question (Slice B) by @danny-avila in #13942
• 🪗 feat: Dock-Style Fisheye Nav Rail With Instant Hover Preview by @danny-avila in #14021
• 🤖 feat: Add Claude Sonnet 5 Support by @danny-avila in #14042
• 🥷 feat: Add showInMenu Option to Model Specs by @alexkorep in #14034
• 🫷 feat: Exclude File Authoring Tools From Eager Execution by @danny-avila in #14051
• 🪝 feat: Configurable Tool-Approval Policy via Programmatic Hooks by @danny-avila in #14025
• 🧹 feat: Eager HITL Checkpoint Cleanup (Expiry + Deletion) & Full-Wiring E2E by @danny-avila in #14123
• 🧰 feat: Redesign Agent Builder with Unified Tools Marketplace, Skills & Orchestration by @berry-13 in #13952
• 📡 feat: add rum browser page-load diagnostics by @upman in #14106
• 🎚️ feat: Explicit "Use All Skills" Toggle in the Skills Section by @berry-13 in #14125
• 🙋 feat: ask_user_question - agent-initiated questions with durable pause/resume by @danny-avila in #14139
• 🗂️ feat: Per-Agent Memory Partitions by @danny-avila in #14084
• 🤖 feat: Add GPT-5.6 (Sol/Terra/Luna) OpenAI Models by @danny-avila in #14206
• 🪭 feat: support per-run central export suppression by @upman in #14207
• ✨ feat: stateful_code_sessions capability for warm Code API sandbox sessions (experimental) by @danny-avila in #14150
• 🧠 feat: Add GPT-5.6 reasoning.mode + reasoning.context (Responses API) by @danny-avila in #14233
• 🧵 feat: Background Tool Calls for Agents & Model Specs by @danny-avila in #14197
• 🗝️ feat: Encrypted Langfuse Fanout Config by @dustinhealy in #14107
• 🧭 feat: Mid-Run Steering and Queued Messages for Agent Runs by @danny-avila in #14220
• ♨️ feat: Prewarm Stateful Code Sandboxes with Cold-Boot UX Feedback by @danny-avila in #14239
• 📛 feat: Add Client Name Header to Tavily Search Requests by @manisrinivasan2k1 in #14082
• 💬 feat: Explain Steering & Queuing at Every User-Facing Surface by @danny-avila in #14260
• 🖼️ feat: Return Sandbox Images From read_file as Viewable Artifacts by @danny-avila in #14277
• feat: add low-noise Redis observability by @upman in #14309
• ✋ feat: Add Reclaim-Gated Controls to In-Flight Steers by @danny-avila in #14321
• 🫧 feat: Float In-Flight Steers Over the Thread with Collapsible Content by @danny-avila in #14365
• ⚡ feat: Add Gemini 3.6 Flash and Gemini 3.5 Flash-Lite Support by @danny-avila in #14369
• 🧵 feat: Native Background Execution for Code Interpreter Tools by @danny-avila in #14386
• ✳️ feat: Claude Opus 5 Support by @danny-avila in #14422
• ⏱️ feat: Configurable HTTP Server Timeouts by @danny-avila in #14481
• 🕶 feat: Generalize Admin Config Secret Redaction by @dustinhealy in #14509
• 🏷️ feat: Activity Groups With Fast-Model Headers by @danny-avila in #14391
• 🗝️ feat: Custom Endpoint API Key Encryption via Array Secret Registry by @danny-avila in #14510
• 🎯 feat: Tool Intent Label Capability (tool_intents) by @danny-avila in #14499
• 🪢 feat: Langfuse Fanout Connection Setting by @danny-avila in #14108
• 🛑 feat: Preemptive Steer - Backend Interrupt & Steer by @danny-avila in #14518
• 🎯 feat: Per-Tool Intent Labels for Model Specs by @danny-avila in #14526
• ⚡ feat: Interrupt & Steer, Client by @danny-avila in #14528
• 🧵 feat: Background-Native Code Execution Tools by @danny-avila in #14532
• 🎯 feat: Render Tool Intent as the Live Tool-Call Label by @danny-avila in #14536
• 🎯 feat: Per-Tool Intent Label Toggles in the Agent Builder by @danny-avila in #14550
• ⚡ feat: Reliable Interrupt & Steer Escalation and Recovery by @danny-avila in #14558
• 💬 feat: Interim Progress Card for Streaming Q&A Calls by @danny-avila in #14576
• 🚦 feat: Configurable Circuit Breakers for Runaway Streamed Tool Args by @danny-avila in #14613
• ⚡ feat: Coalesce Redis Streaming Delta Publications into Windowed Batches by @danny-avila in #14614
• 🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas by @dustinhealy in #14559
• 🌊 feat: Wire Adaptive Stream Smoothing Across Google, Bedrock, and Zero-Disable Semantics by @danny-avila in #14660
• 🔗 feat: Admin Panel Link in Settings for Admins by @dustinhealy in #14662
• 👋 feat: Day-Aware Landing Greeting Schedule by @berry-13 in #14633
• 🔑 feat: Refresh-Capable Google Admin OAuth Sessions by @dustinhealy in #13832
• 🛡️ feat: Add Batched MCP Authority Proofs by @danny-avila in #14688
• 🪝 feat: Add Claude Hook Compatibility Layer by @danny-avila in #14412
• ⛶ feat: add fullscreen artifact previews by @berry-13 in #14585
• 🔌 feat: Add Agent Plugins (Experimental) by @danny-avila in #14704
• 🔗 feat: Shared Conversation Badge and Stable Share Links by @berry-13 in #14712
• 🧜 feat: Open Mermaid Diagrams as Artifacts with SVG/PNG Export by @berry-13 in #14713
• 🪶 feat: Resolve Explicit Subagents Lazily by @danny-avila in #14714
• 📡 feat: Route Web Search and Scrape Egress through the SSRF-safe Agent by @dustinhealy in #14606
• 🎨 feat: Add Versioned Theme Foundation by @danny-avila in #14709
• 🪆 feat: Add Parent Activity Phase Summaries by @danny-avila in #14721
• 🎨 feat: Refine Client Colors and Sharing Dialogs by @berry-13 in #14734
• 🎛️ feat: Adopt Composer Density Tokens by @danny-avila in #14730
• 🍡 feat: Batched User Questions With A Single Bounded Answer Form by @danny-avila in #14737
• 🪝 feat: Execute Agent Plugin Command Hooks by @danny-avila in #14755
• 🚣‍♀️ feat: Smooth Streaming Text Fade-In by @danny-avila in #14757
• 🪢 feat: add Langfuse session links by @upman in #14776
• 🔖 feat: Bound Parent Activity Phases With an Exclusive End Index by @danny-avila in #14768
• 💬 style: Unify Message Row Layout and Edit Surfaces by @berry-13 in #14770
• 📄 feat: accept PowerPoint template MIME type by @snapydziuba in #14761
• ⚡ feat: Add Gemini 3.7 Flash Support by @danny-avila in #14818
• 🪄 feat: Smooth Activity Phase Transitions by @danny-avila in #14832
• 📱 style: Reclaim the Assistant Avatar Gutter on Mobile by @danny-avila in #14836
• 📱 style: Consolidate the Mobile Chat Header by @danny-avila in #14843
• ➡️ style: Flush the In-Flight Steer Stack to the Composer Edge by @danny-avila in #14854
• 🎨 feat: Color the Context Gauge by Category and Collapse its Breakdown by @danny-avila in #14855
• 📐 feat: Match the Message Column to the Composer by @berry-13 in #14851
• 🚏 feat: Central Trace Destination Opt-Out for Langfuse by @danny-avila in #14838
• 🤐 feat: Allow Promptless Sends When Files Are Attached by @i-anubhav-anand in #13717
• 📥 feat: Download Code Blocks as Files by @i-anubhav-anand in #13715
• 📱 feat: Give the Mobile Nav the Whole Screen by @danny-avila in #14849
• 💄 style: Align the Overflow Menu's Icons and Ease the Assistant Header by @danny-avila in #14888
• 🗂️ feat: Display Chat Title in Tab Setting by @berry-13 in #14881
• 🛤️ feat: Per-Agent Code Execution Routing With Stateful Session Scopes by @danny-avila in #14848
• 🗂️ feat: Rework the Projects Dashboard, Sidebar and Scoped Composer by @berry-13 in #14866
• 🎛️ feat: Consistent Dialogs, Clearer Settings, and a Keyboard Shortcuts Switch by @berry-13 in #14882
• ⏱️ feat: Show Run-Step Durations On Tool Cards by @danny-avila in #14892
• 🗄️ feat: Record When a Conversation Was Archived by @berry-13 in #14863
• 💄 style: Align the Thinking Dot with the Header Icon by @danny-avila in #14895
• 🗜️ feat: Let Users Toggle Client-Side Image Resizing by @berry-13 in #14883
• 🧠 feat: Add Live Reasoning Labels by @danny-avila in #14893
• 📱 feat: Swipe the Mobile Drawer Open and Closed by @danny-avila in #14902
• 📜 feat: Follow Streaming Args in Tool Detail Panes by @danny-avila in #14906
• 📋 feat: Attach Long Pasted Text as a File by @berry-13 in #14884
• 🗄️ feat: Archive All Chats From Data Controls by @berry-13 in #14885
• 🛡️ feat: Let Admins Restrict Stateful Workspace Scopes by @danny-avila in #14910
• 🎬 style: Reveal the Chat on Programmatic Drawer Closes by @danny-avila in #14930
• 🛰️ feat: Execute Generic Agent Trigger Deliveries by @danny-avila in #14921
• 📡 feat: Add Generic Agent Trigger Dispatch Seam by @danny-avila in #14916
• 📬 feat: Add Durable Agent Trigger Delivery by @danny-avila in #14925
• 🪜 style: Step Through Batched Questions One at a Time by @danny-avila in #14935
• 🕸️ feat: Run Saved Agent Teams as Subagents by @danny-avila in #14944
• 🪢 feat: Custom Request Headers For Langfuse by @danny-avila in #14945
• 🧵 feat: Persist View-Only Subagent Threads by @danny-avila in #14957
• 💡 feat: add DB-backed admin insights by @upman in #14898
• 📁 feat: Surface Stateful Workspace Downloads by @danny-avila in #14984
• 🛰️ feat: Route Live Subagent Controls Across Replicas by @danny-avila in #14971
• 🪃 feat: Wake Parent Agents on Child Completion by @danny-avila in #14975
• 🎛️ feat: Make Max Subagents Configurable via librechat.yaml by @berry-13 in #15023
• 🔗 feat: Open Footer Site Links in a New Tab by @berry-13 in #15019
• ⏱️ feat: Run Scheduled Chats Through Durable Agent Triggers by @danny-avila in #14939
• 🕊️ feat: Yield to Subagent Completion Wakeups by @danny-avila in #15066
• 🧾 feat: Sibling Task Manifest for Resumed Parent Runs by @danny-avila in #15063
• 📜 feat: Add Optional Collapse for Long User Messages by @berry-13 in #15034
• 🗂️ feat: Scope Scheduled Chats to Chat Projects by @danny-avila in #15056
• 🪟 feat: Read Child Threads Through Their Parent by @danny-avila in #15073
• 🛰️ feat: Show Child Agent Activity in a Side Panel by @danny-avila in #15075
• 🙈 feat: Config Option to Hide Response Feedback Buttons by @berry-13 in #15085
• ✨ feat: Context Gauge Hover Reveal and Breakdown Motion Polish by @berry-13 in #15038
• 🫥 feat: Add Temporary Chat Empty State and Active Indicator by @berry-13 in #15086
• 🎛️ feat: Configurable SearXNG Search Options by @berry-13 in #14987
• 🙋 feat: Collapse Settled Question Records by Default by @danny-avila in #15107
• 🪟 feat: Unify Subagent Activity Panel by @danny-avila in #15106
• 🛂 feat: Filter Model-Bound Content by Source by @danny-avila in #14425
• 📨 feat: Add Authenticated Agent Event Ingress by @danny-avila in #15110
• 📡 feat: Stream Detached Subagent Activity by @danny-avila in #15111
• 📨 feat: Continue Bound Child Agents from Events by @danny-avila in #15112
• 🖥️ feat: Stream PTC Inner Tool Calls as a CLI-Style Trace by @danny-avila in #15115
• 🎚️ feat: Configure Agent Event Runtime in YAML by @danny-avila in #15128
• 🪴 feat: Fork Completed Subagents Into Continuable Chats by @danny-avila in #15133
• 📱 feat: Offer a Dismissable Strip of Chat Beside the Mobile Drawer by @berry-13 in #14990
• ⏰ feat: Custom Cron Cadence for Scheduled Chats by @berry-13 in #15084
• 🧭 feat: Choose a Schedule's Time Zone by @berry-13 in #15119
• 📆 feat: Weekly Schedules on Several Days by @berry-13 in #15120
• 🕰️ feat: Clock Format and Week Start Preferences by @berry-13 in #15121
• ⏱️ feat: Shared Time Picker for Schedule Times by @berry-13 in #15122
• 📇 feat: Surface Event Child Activity Through a Bounded Parent Index by @danny-avila in #15142
• 🪹 feat: Shared Empty State for Side Panels by @berry-13 in #15123
• ⏱️ feat: Show Elapsed Time Under the Streaming Response by @danny-avila in #15167
• 🧾 feat: Persist Authoritative Subagent Control Receipts by @danny-avila in #15168
• 🪶 feat: Support Non-Persistent Controlled Themes by @danny-avila in #15170
• 🎛️ feat: Expose Authoritative Subagent Controls by @danny-avila in #15169
• 🔌 feat: Background Execution Toggles for Actions & Plugin Tools by @danny-avila in #14407
• 🦺 feat: Configurable Baseline HTTP Security Headers by @danny-avila in #14445
• 🐚 feat: Nonce-Based Content Security Policy for the SPA Shell by @danny-avila in #14446
• 🪢 feat: Coalesce Bound Agent Event Bursts by @danny-avila in #15208
• 🧾 feat: Track Authoritative Agent Event Outcomes by @danny-avila in #15213
• ✏️ feat: Edit Pasted Text and Clear It on New Chat by @berry-13 in #15017
• 🩻 feat(langfuse): add tenant export telemetry by @upman in #15247
• 🪢 feat: Resume Bound Event Actors from Checkpoint Forks by @danny-avila in #15227
• 📬 feat: Serialize Bound Actor Event Mailboxes by @danny-avila in #15260
• 🧾 feat: Store Durable Event Actor Receipts by @danny-avila in #15265
• 🧵 feat: Unify Subagent Child Threads by @danny-avila in #15261
• 🧅 feat: Reveal Subagent Thread History and Event Detail on Demand by @danny-avila in #15283
• 🕸️ feat: Complete Keenable Web Search Provider by @danny-avila in #15288
• 🪢 feat: show Langfuse session link in shared chats by @upman in #15273
• 🎼 feat: Unify Agent Turn Execution Behind One Immutable Plan by @danny-avila in #15296
• 🫆 feat: Fingerprint Agent Context for Zero-Read Warm Continuation by @danny-avila in #15299
• 🤖 feat: make Event Actor HITL durable by @danny-avila in #15305
• 🪂 feat: Make Event Actor Detached Actions Durable by @danny-avila in #15307
• 🍱 feat: Guide Compaction With a Bounded Semantic Index by @danny-avila in #15340
• 📬 feat: Establish Background Continuation Admission by @danny-avila in #15348
• 🛑 feat: Cancel MCP Discovery Work at the Caller Deadline by @danny-avila in #15353
• 🛄 feat: Restore Compaction Guidance Across Continuations by @danny-avila in #15356
• 🛎️ feat: Wake Agents on Background Tool Completion by @danny-avila in #15350
• 🍵 feat: Continue Late Steers in Warm Agent Runs by @danny-avila in #15357
• 🧩 feat: Collapsible Wake-Up Task Cards and Subagent UI Consistency by @danny-avila in #15364
• 🗿 feat: Add Attached Stateful Code Environments by @danny-avila in #15352
• 🧲 feat: Enable Secure Attached Environment Pairing by @danny-avila in #15355
• ✅ feat: Delivery Receipt Checkmarks for Steered Messages by @danny-avila in #15376
• 🧳 feat: Register Principal-Owned Code Environments by @danny-avila in #15365
• 🧠 feat: Retain Subagent Reasoning Like Main Chat and Drop the Running Status Chip by @danny-avila in #15379
• 📬 feat: Move Agent Queued Turns Server-Side by @danny-avila in #15370
• 🪗 feat: Fold a Live Run's Tool-Call Groups Into the Phase Card by @danny-avila in #15434
• 🪶 feat: Enable Standalone Skill Authoring by @danny-avila in #15480
• 🛫 feat: Enable Self-Service Code Worker Pairing by @danny-avila in #15367
• 🛞 feat: Manage Personal Code Environment Lifecycles by @danny-avila in #15369
• 🧺 feat: Preserve Partial Work at Tool Call Limits by @berry-13 in #15486
• 🧤 feat: Enforce Safe BYOM Tool Approvals by @danny-avila in #15503
• 🔭 feat: Audit PII Filter Findings by @danny-avila in #15508
• 🕹️ feat: Configure BYOM Tool Permissions by @danny-avila in #15504
• 📖 feat: Add Claude Fable 5.1 Support by @danny-avila in #15512
• 🪪 feat: Propagate Tenant to Agent Model Headers by @dustinhealy in #15521
• ⏭️ feat: Honor an Interrupt Before the Model Has Answered by @danny-avila in #15491
• ⚡ feat: Add Gemini 3.8 Flash Support by @danny-avila in #15519
• 🧊 feat: Persist Context Fading Tier Across Agent Runs by @danny-avila in #15505
• 🏛️ feat: Establish Agent Management API Contract by @danny-avila in #15545
• 🔐 feat: Add M2M Authentication for Agent Management by @dustinhealy in #15555
• 🪵 feat: Add OpenTelemetry Logs Pipeline via Winston Bridge by @danny-avila in #15565
• 👀 feat: Add Agent Management Read Endpoints by @dustinhealy in #15561
• ✨ feat: add morphing state icons across the client by @berry-13 in #14697
• ➕ feat: Add Agent Management Creation Endpoint by @dustinhealy in #15564
• ✏️ feat: Add Agent Management Update Endpoint by @dustinhealy in #15566
• 🪓 feat: Add Tenant-Scoped Agent Deletion by @dustinhealy in #15573
• 👓 feat: Read Attached Workspace Files by @danny-avila in #15524
• 🕯️ feat: Search Text in Attached Workspaces by @danny-avila in #15525
• 🌌 feat: Add GPT-6 Astra Support by @danny-avila in #15567
• 🎨 feat: Theme-Adaptive SVG Support for Custom MCP and Group Icons by @berry-13 in #13817
• 🌳 feat: List Attached Workspace Trees by @danny-avila in #15527
• 🏕️ feat: Provision Native Code Workers by @danny-avila in #15587
• 🛻 feat: Route Bash Through Attached Workspaces by @danny-avila in #15546
• 📓 feat: Author Files in Attached Workspaces by @danny-avila in #15548
• 🛰️ feat: Show BYOM Worker Readiness by @danny-avila in #15618
• 🩻 feat(insights): Scope Insights to Authorized Agents by @upman in #15549
• 📋 feat: Copy Messages as Rich Text by @berry-13 in #15087
• ♿ feat: High Contrast Light and Dark Appearance Modes by @berry-13 in #15178
• 🪪 feat: Add Per-Agent Git Identity by @danny-avila in #15628
• 🔭 feat: Tag Browser Diagnostics With Client Build IDs by @danny-avila in #15656
• 🧶 feat: Flatten Active Message Threads Behind a Flag by @danny-avila in #15633
• 🛅 feat: Add Agent File Management APIs by @danny-avila in #15666
• 🍋 feat: Add AMD Lemonade Provider Recognition and Branding by @berry-13 in #15664
• 🧰 feat: Unify Tool Activity, Reasoning, Search, and Agent Workflows by @berry-13 in #14546
• 🛂 feat: Add Configurable BYOM Enrollment Policy by @danny-avila in #15673
• 📜 feat: Add Skills Discovery and Authoring to the Management API by @danny-avila in #15642
• 🪬 feat: Configure Langfuse Trace User Identity and Metadata by @danny-avila in #15667
• 🗳️ feat: Define Conversation Code Approval Modes by @danny-avila in #15685
• 🧶 feat: Thread Conversation Code Approval Through Requests by @danny-avila in #15698
• 🪧 feat: Surface Conversation Code Approval Modes by @danny-avila in #15703
• 🪗 feat: Compact Context in a Summarize-Only Turn by @danny-avila in #15690
• 🧐 feat: Restore Interactive Tool Approval Review by @danny-avila in #15717
• 🛫 feat: Enable Full Access for BYOM Coding by @danny-avila in #15718
• 🧰 feat: Move Code Settings Into Run Code by @danny-avila in #15722

🐛 Fixes Copy Anchor Link
• 🧼 fix: Render Agent Description HTML Safely by @danny-avila in #15951
• 🫴 fix: Preserve Queued Follow-Ups Through Handoff by @danny-avila in #15942
• 📖 fix: Preview Extracted Upload Text by @danny-avila in #15946
• 🔓 fix: Keep Code Approval Mode Selectable Mid-Run by @danny-avila in #15938
• 🎞️ fix: Deliver Opted-In Custom Endpoint Media Safely by @danny-avila in #15937
• 🛅 fix: Preserve Agent Management Upload IDs by @dustinhealy in #15840
• 👯 fix: Reject Duplicate Tool Approval Identities by @danny-avila in #15933
• 📫 fix: Route Azure Astra Through Responses API by @usnavy13 in #15845
• 🗯️ fix: Give Failed Turns Actionable Guidance by @berry-13 in #15896
• 🍵 fix: Support Renewable MCP Credentials for Schedules by @danny-avila in #15908
• 🧷 fix: Keep a Failed Summary From Bounding the Conversation History by @berry-13 in #15913
• 👑 fix: Elect a Single Expired-File Sweeper by @danny-avila in #15909
• 🚛 fix: Move Sealed Chats to New Code Environments by @danny-avila in #15902
• 🏦 fix: Reserve Credits for In-Flight Requests by @danny-avila in #15879
• 📐 fix: Accept Custom WIDTHxHEIGHT Sizes in OpenAI Image Tools by @danny-avila in #15904
• 💰 fix: Bill Stopped Agent Turns From Provider Usage by @danny-avila in #15889
• 🧿 fix: Bind Login Flows to the Browser That Started Them by @danny-avila in #15880
• 🪢 fix: Withhold the Editor's Rerun Where No User Turn Can Be Replayed by @berry-13 in #15887
• 🪟 fix: Opaque Header Controls Over the Chat Gradient by @berry-13 in #15894
• 🧷 fix: Mark a Failed Compaction So Its Rerun Controls Stay Withheld by @berry-13 in #15883
• 🪧 fix: Emit the Configured-Footer Answer With the HTML Shell by @berry-13 in #15886
• 🧾 fix: Count the Tool Results a Tool-Limit Stop Retains by @berry-13 in #15893
• 🏷️ fix: Keep a Configured Sender Label From Revealing the Model on Hover by @aruj0 in #15489
• 🫂 fix: Scope People Picker Searches to Permitted Types by @danny-avila in #15878
• 🛬 fix: Land MCP OAuth Callbacks on Waiting Connections by @danny-avila in #15876
• 💤 fix: Preserve Dormant Workspace Bindings by @danny-avila in #15877
• 🔎 fix: Enforce WEB_SEARCH Role Permission on Agents by @danny-avila in #15875
• 🪂 fix: Release Stalled MCP Catalog Recovery Without Dropping Refreshed Tokens by @danny-avila in #15871
• 📇 fix: Stop an MCP Credential Refresh From Fencing Its Own Catalog Recovery by @danny-avila in #15865
• 🪢 fix: Recover a Failed MCP Server Once When Reinspections Overlap by @danny-avila in #15867
• 🔐 fix: Stop an MCP Credential Refresh From Fencing Its Own Connection by @danny-avila in #15863
• 💠 fix: Paint Native Tool Verification Badges by @berry-13 in #15862
• 🔣 fix: Encode Images From Storage Keys by @Ricky-Hao in #15851
• 🧵 fix: Preserve Per-Message Inspection Budgets Through Provider Preparation by @danny-avila in #15860
• 🧲 fix: Match Directory Users to Existing Principals by @danny-avila in #15855
• 🧨 fix: Defuse Skill and Artifact Parsing Backtracking by @danny-avila in #15856
• 🥅 fix: Keep Tool Error Prefix Parsing In Bounds by @danny-avila in #15857
• 🏰 fix: Read OpenID Flight State From Mongo Primary by @danny-avila in #15849
• 📴 fix: Stop Hidden Code Spinners by @danny-avila in #15846
• 📿 fix: Inspect Stored File Locators Per Message by @danny-avila in #15841
• 🔠 fix: Name Artifact Downloads After Their Titles by @danny-avila in #15836
• 🧊 fix: Withhold Rerun Controls on Compaction Turns by @berry-13 in #15797
• 🏷️ fix: Model-Agnostic Hint for Short Skill Descriptions by @L4XB in #15833
• 🔌 fix: Close Leaked HTTP Server in Server Specs by @jomspk in #15821
• 🪢 fix: Keep One Code File per Sandbox Destination by @jomspk in #15817
• 🥅 fix: Keep Mobile Composer Actions In Bounds by @danny-avila in #15825
• 🛖 fix: Restore Saved Attached Workspaces by @danny-avila in #15811
• 📯 fix: Propagate Host Cancellation Into API Tools by @danny-avila in #15812
• 🈳 fix: Treat Blank Mongo Index Settings as Unset by @Zsanz3 in #15809
• 🎒 fix: Carry Subagent Identity Past Streaming by @dustinhealy in #15795
• 🛂 fix: Back Off MCP OAuth Discovery by @danny-avila in #15783
• 🛎️ fix: Preflight MCP Readiness for Scheduled Chats by @danny-avila in #15782
• 🕳️ fix: Clear Nullable Queue Anchor by @danny-avila in #15794
• 🛟 fix: Recover CodeAPI File Uploads After Throttling by @danny-avila in #15784
• 🫆 fix: Preserve Durable Parents for Queued Turns by @danny-avila in #15787
• 🌳 fix: Guard Ambiguous BYOM Workspace Selection by @danny-avila in #15785
• 🔐 fix: Send One Code API Authentication Method by @danny-avila in #15781
• 🛑 fix: Preserve BYOM Foreground Cancellation Identity by @danny-avila in #15777
• 🪡 fix: Thread Stop Into BYOM Commands by @danny-avila in #15772
• 🪴 fix: Restore Native Workspace Selection by @danny-avila in #15771
• 🧿 fix: Patch gRPC xDS Denial of Service by @danny-avila in #15769
• 🔢 fix: Normalize PDF Citation Page Numbers by @danny-avila in #15731
• 🪫 fix: Gate Programmatic Bash on Stateful Worker Capabilities by @danny-avila in #15726
• 🫧 fix: Raise Nested Popovers Above Dialog Layers by @danny-avila in #15738
• ⏳ fix: Separate Temporary and General Chat Retention by @danny-avila in #15734
• 🛄 fix: Clear MCP Connection State Before Catalog Refresh by @danny-avila in #15741
• 🧘 fix: Settle Stale Response Parts by @danny-avila in #15743
• 🟫 fix: Reject Invalid Hex Color Matches by @danny-avila in #15744
• 🫣 fix: Hide Scroll-to-Bottom Under Composer Panels by @danny-avila in #15746
• 🪪 fix: Guard Null Avatar URLs in Social Login by @ncchinh in #15747
• 👯 fix: Collapse Radix Layer Packages to One Copy by @danny-avila in #15742
• 🧍 fix: Accommodate BYOM Queue and Execution Budgets by @danny-avila in #15750
• 🧷 fix: Keep Ref Cleanup and Hold Consumer Handlers to the Frontmost Dialog by @danny-avila in #15751
• 🗝️ fix: Load User Keys on Resumed Requests by @danny-avila in #15749
• 🗳️ fix: Recover Durable Background Tool Receipts by @danny-avila in #15752
• 🛗 fix: Add Tenant Index Upgrade Migration by @danny-avila in #15767
• 🏠 fix: Keep MCP Caches Fresh on Demand by @danny-avila in #15765
• 🔑 fix: Honor User-Provided MCP API Key Instead of Forcing OAuth by @danny-avila in #13954
• 🪙 fix: Count Quote Tokens on Message Edit by @danny-avila in #13958
• 📋 fix: Route Clipboard Paste Through Upload Options by @dustinhealy in #13957
• 📇 fix: Index sharedlinks updatedAt for Cosmos DB Sorts by @danny-avila in #13979
• 📂 fix: Mount Skill Files Under skills/ in Code Interpreter by @danny-avila in #13961 and #13975
• 🪟 fix: Re-measure Sidebar Chat List on Width Change to Fix Date-Group Spacing by @danny-avila in #13981
• 📏 fix: Make create_file Missing-Content Error Truncation-Aware by @danny-avila in #14043
• fix: use logAxiosError at the RAG file_search/context call sites by @mawburn in #14014
• fix: stripHeavyErrorFields Winston format (defense-in-depth) by @mawburn in #14018
• 📥 fix: Download Original File From Artifact Preview Panel for Office Documents by @berry-13 in #14026
• 🔥 fix: Firebase CDN Initialization Under tsdown CJS Interop by @jakacenta in #14046
• fix: preserve role SHARE permissions across boot in initializeRoles by @mawburn in #14022
• fix: bound peak memory of concurrent base64 attachment encoding by @mawburn in #14023
• 📧 fix: Add .eml (message/rfc822) Support to File Upload by @Zirkonium88 in #13989
• 🚪 fix: Support Admin Redirect Detection for Same-Origin Subpaths by @arjunvijay24 in #14040
• 🩹 fix: Coerce Stringified edit_file Edits (JSON-in-JSON) by @danny-avila in #14056
• 🧠 fix: Apply Bedrock thinking config to bare inference-profile model IDs by @danny-avila in #14054
• 🧠 fix: Default Bedrock thinking maxTokens to model max output by @danny-avila in #14058
• fix: stop the artifact-edit retry loop on unrecoverable 400s by @mawburn in #14060
• 🎣 fix: Surface Resumable Stream Start Errors by @danny-avila in #14072
• 🧯 fix: Harden Principals Cache Invalidation and Lock-Wait Paths by @danny-avila in #14120
• 🏁 fix: Ignore Finalized SSE Transport Errors by @danny-avila in #14114
• fix: fall back to _id for user id in createSafeUser by @mawburn in #14083
• 🌏 fix: guard IME composition on Enter in prompt name/labels and dynamic tag inputs by @mahirhir in #13996
• 🗄️ fix: Return Cached Transaction-Support Value on Cache Hit by @Osamaali313 in #13999
• 🧠 fix: Format Reasoning Exports by @danny-avila in #14116
• 🧮 fix: Prevent String Corruption of Numeric Agent Model Parameters by @danny-avila in #14119
• 🧢 fix: Raise Claude Sonnet 4.6 Output Cap by @danny-avila in #14115
• 🧵 fix: Preserve Fenced Markdown Artifacts by @danny-avila in #14121
• 🔒 fix: Prevent Role Grants on Shared Links by @danny-avila in #14137
• 🤐 fix: Exclude Provider Secrets from HITL Pending Actions by @danny-avila in #14136
• ⏳ fix: Defer MCP Connection for Request-Scoped Placeholders on Reinitialize by @danny-avila in #14148
• 🧷 fix: Align Agent File Attachment Ownership by @danny-avila in #14149
• 🧊 fix: Include Conversation Starters in Agent View and List Responses by @serhiizghama in #14142
• ♊ fix: Resolve Local JSON Pointer Refs & Sanitize Tool Search Schema for Gemini by @usnavy13 in #14161
• 🛡️ fix: Guard HITL checkpoint size against MongoDB 16MB limit by @danny-avila in #14157
• 🔡 fix: Normalize Email Case When Issuing Verification Tokens by @VictorEPlus in #14172
• 🛜 fix: Apply Recursion Limit Config to Subagents by @danny-avila in #14185
• 💂 fix: Enforce ALLOW_EMAIL_LOGIN on the Backend Login Route by @lurkerCha in #14180
• 🧩 fix: Allow compatibility Field in Skill Frontmatter by @danny-avila in #14189
• 📎 fix: Translate Finite supportedMimeTypes Allowlists to Picker Accept by @danny-avila in #14186
• 🪆 fix: Serve Nested Skill Files Through a Wildcard Route by @danny-avila in #14191
• 🃏 fix: Attach Request-Scoped MCP Servers From the Builder via the mcp_all Wildcard by @adamscross04 in #14177
• 🔍 fix: Sync Conversation Title Updates to MeiliSearch by @danny-avila in #14223
• 👻 fix: Guard Redis Stream Resume Against Disposed HITL Graph by @danny-avila in #14258
• 🤝 fix: Discover MCP OAuth Exchange Methods by @danny-avila in #14256
• 👋 fix: Terminate Streamable HTTP MCP Sessions on Teardown by @danny-avila in #14252
• 🗂️ fix: Route read_file Through the Stateful Code Session by @danny-avila in #14259
• 💭 fix: Default GPT-5.6 Reasoning Requests to Responses API by @jomspk in #14232
• 🔖 fix: Preserve Ephemeral Agent Params and Identity for ask_user_question Resume by @jjhidalgar-celonis in #14254
• 🎫 fix: Strip Reserved Fields From Bedrock additionalModelRequestFields by @danny-avila in #14246
• 📱 fix: Single-Tap Select for Pinned Agents, Model Specs & Models on Touch by @danny-avila in #14272
• 🧽 fix: Clear Deleted Chats From Message Cache by @danny-avila in #14270
• 🧟 fix: Prevent Drained Steer From Re-Queuing After Run-End Race by @danny-avila in #14276
• 🙋 fix: Await ask_user_question Tool Factory in loadTools by @danny-avila in #14291
• 🧷 fix: Flush Pending File Deletion on Unmount by @danny-avila in #14293
• 🙋 fix: Stop Answered ask_user_question Card From Reopening Its Popover by @danny-avila in #14297
• 🔒 fix: Scope, Cap, and De-Execute the In-Flight Steer Stack by @danny-avila in #14310
• 📱 fix: Don't Connect the Favorites Drag Source on Touch Pointers by @danny-avila in #14312
• 🧵 fix: Harden Request-Scoped MCP Lifecycle by @danny-avila in #14342
• 🪆 fix: Build RAG-API Chart Before Parent to Bundle PostgreSQL Dependency by @Aho-Bakaa in #14262
• 🚪 fix: Keep Owners From Being Locked Out of Their Own Resource When Sharing by @danny-avila in #14347
• 🚏 fix: Route Admin-Configured Document Types to RAG /text on Agent Upload by @danny-avila in #14345
• 🎟️ fix: Claim Idempotency Keys to Dedup Retried Generation Requests and Prevent Double Billing by @danny-avila in #14344
• 🧠 fix: Restore Agent Memory Scope Control in Unified Builder by @danny-avila in #14292
• 🛟 fix: Keep File Uploads Alive With SSE Heartbeats by @MarcAmick in #14295
• 🧩 fix: Preserve Deployment Skill IDs on Agents by @danny-avila in #14368
• 🧭 fix: Keep Message Nav Chevrons Working on In-Thread Steers by @danny-avila in #14377
• 🤐 fix: Withhold MCP OAuth Headers From Untrusted Preconfigured Discovery by @danny-avila in #14379
• 🔗 fix: Preserve resource owner access when sharing (key share diff by stable id) by @jomspk in #14317
• 🪆 fix: Preserve Nested Subagent Delegation by @danny-avila in #14392
• ✋ fix: Enable Submit on First Tool-Approval Decision by @danny-avila in #14393
• 🎞️ fix: Surface Clear Error for Unprocessable Gemini YouTube Videos by @danny-avila in #14396
• 📌 fix: Pin Scroll-to-Bottom Rib in Message Nav by @danny-avila in #14397
• 🫙 fix: Preserve Loaded Message Content When Resume Snapshot Is Empty by @danny-avila in #14399
• 🎯 fix: Correct Off-by-One Rail Scrub After Pinning the Terminus by @danny-avila in #14409
• ♾️ fix: Preserve Resumable Stream Ordering Across Turns by @danny-avila in #14411
• 🧩 fix: Harden Agent Skill Lifecycles End to End by @danny-avila in #14429
• 📧 fix: Restore invite-user CLI by @unsnow-iac in #14436
• 🔗 fix: Resolve MCP Tool-Key Boundary Against Configured Server Names by @danny-avila in #14448
• 🍃 fix: Strip $-Prefixed Schema Keywords Before Persisting MCP Tool Params by @danny-avila in #14464
• 🔗 fix: Render Shared Links Containing Steers by @danny-avila in #14480
• 🔒 fix: Bound /files/usage TTL Hold Instead of Clearing It by @danny-avila in #14470
• 🤏 fix: Filter Admin Config Reads by Section-Scoped Read Capability by @dustinhealy in #14472
• 🍃 fix: Amazon DocumentDB Compatibility for Pipeline-Form Updates by @danny-avila in #14495
• 🛡️ fix: validate message feedback payloads by @upman in #14500
• 🧩 fix: Apply Every Entry of Multi-Part Stream Deltas by @danny-avila in #14502
• 🏷️ fix: Re-attribute Agent Content After In-Thread Steers by @danny-avila in #14497
• 🎯 fix: Keep Run Steps and Labels in One Index Space After a Resume Sync by @danny-avila in #14516
• 🪶 fix: Yield Soft Default Model Spec to Agent Picks in Picker-Only Deployments by @danny-avila in #14515
• 🪟 fix: Surface MCP Initialization Errors by @danny-avila in #14529
• 🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect by @schumajs in #14538
• 🔒 fix: Remove Owner Email from Agent owner_contact Fallback by @danny-avila in #14541
• 📄 fix: Filter Non-PDF Documents on the Anthropic Encode Path by @danny-avila in #14535
• 🎯 fix: Exact Ask-Question Attribution via Interrupt tool_call_id by @danny-avila in #14539
• 🧹 fix: Clean Up MCP OAuth State Mappings on Uninstall + Reject Superseded Callbacks by @danny-avila in #14549
• 🧠 fix: Preserve Deferred Tool Schemas Across HITL Resume by @danny-avila in #14552
• 🦗 fix: Ignore Sequenced Redis Events Without SSE Subscribers by @danny-avila in #14557
• 🔗 fix: Normalize MCP Tool Keys at Every Producer, Resolve Raw Names via Aliases by @danny-avila in #14553
• 🏢 fix: Preserve Tenant Context for Partial Response Saves on Disconnect by @danny-avila in #14567
• 🦗 fix: Deliver Abort Acknowledgements on Zero-Subscriber Replicas by @danny-avila in #14569
• 🏷️ fix: Skip Title Generation for Preempt-Incomplete Turns by @danny-avila in #14571
• 🪧 fix: Guard Admin OAuth Routes When Providers Are Not Configured by @cyphercodes in #14507
• 🔗 fix: Resolve Relative Skill Markdown Links by @berry-13 in #14586
• 🧭 fix: Drop v6-Only MemoryRouter future Prop from Skill Markdown Spec by @danny-avila in #14588
• 🪪 fix: Strip Unresolved Header Placeholders at Final Resolution by @danny-avila in #14595
• 🔒 fix: Single-Flight MCP OAuth Token Refresh per User/Server by @danny-avila in #14596
• 🪺 fix: Keep Preempt-Abandoned Siblings Nested, Make Message Tree Order-Robust by @danny-avila in #14587
• ⌨️ fix: Honor defaultPrevented in Global Shortcut Dispatch by @danny-avila in #14570
• 🪢 fix: Bind MCP OAuth Secrets to Trusted Endpoints by @danny-avila in #14578
• ⚓ fix: Bind Action Servers to Metadata Ports by @danny-avila in #14575
• 🧱 fix: Enforce Agent Runtime File Trust Boundaries by @danny-avila in #14577
• 📏 fix: Scope Skill Command Query to Text Before the Caret by @danny-avila in #14604
• 🧬 fix: Resolve URL-Named Model Spec to Its Full Preset on Cold Load by @danny-avila in #14610
• ✂️ fix: Truncate Overflowing Activity and Intent Labels in Chat UI by @danny-avila in #14607
• 🚦 fix: Bound, Single-Flight, and Retry Skill File Priming Uploads by @danny-avila in #14611
• 🧹 fix: Exclude Mongo ID From Conversation Updates by @danny-avila in #14631
• ♿️ a11y: improve keyboard operability, focus retention, and accessible naming by @berry-13 in #14600
• 🚏 fix: Localized Guidance for Model-Not-Found Errors by @danny-avila in 557c22d102
• 🛡️ fix: Run message-filter PII patterns on a linear-time regex engine (ReDoS) by @dustinhealy in #14554
• 🪢 fix: disable central fanout media uploads for langfuse by @upman in #14642
• 🧭 fix: Fail Closed When Expected MCP Tools Are Unavailable by @danny-avila in #14646
• 🛂 fix: Honor Claude Document Limits Through Inference Gateways by @danny-avila in #14650
• 🎟️ fix: Reconcile MCP OAuth Readiness Across Pods by @danny-avila in #14629
• 🌊 fix: Preserve Custom Endpoint streamRate When endpoints.all Is Defined by @danny-avila in #14645
• 🔐 fix: Preserve Structured JWT Auth Context by @danny-avila in #14652
• ⏱️ fix: Compile admin file-config MIME patterns on a linear-time engine (ReDoS) by @dustinhealy in #14555
• 🛡️ fix: SSRF-Guard Speech (STT/TTS) and OCR Outbound Requests at Connect Time by @dustinhealy in #14560
• 🔁 fix: Re-Arm Soft Default When a Stored Agent No Longer Resolves by @danny-avila in #14664
• 🔗 fix: Prevent duplicate share rows from clobbering pending role edits (dedupe adds by stable id) by @jomspk in #14655
• 🛟 fix: Stop Agents When Code Resources Cannot Recover by @danny-avila in #14651
• ♿ fix: Restore WCAG AA Contrast for Text Tokens & Hide Edit Action While Streaming by @danny-avila in #14677
• 🩹 fix: Keep Edit Action Fully Hidden While Streaming by @danny-avila in #14687
• 📡 fix: Refresh MCP Tools After List-Changed Notifications by @danny-avila in #14686
• 🧬 fix: Rebind Request Context After Remote Agent Auth by @danny-avila in #14685
• 🧭 fix: Make MCP Catalog Redis Cluster-Safe by @danny-avila in #14717
• 🧬 fix: Normalize Legacy MCP Null Headers by @danny-avila in #14720
• 📁 fix: Consistent Export Filenames Across Formats by @lidonius1122 in #14708
• 🧷 fix: Safely Recover Runtime MCP OAuth Rejections by @danny-avila in #14684
• 🪆 fix: Rebase Activity Phase Bounds over Sparse Content by @danny-avila in #14729
• 📎 fix: Re-enable Send After File Upload by @danny-avila in #14727
• 📸 fix: Guard Screenshot Export Against Main-Thread Freezes by @danny-avila in #14733
• 🔐 fix: Preserve Plugin MCP Provenance Through Registry Storage by @danny-avila in #14744
• 🧭 fix: Re-Anchor Parent Activity Phase Bounds by @danny-avila in #14741
• 🧷 fix: Preserve Elicitation Answers Across Aborts by @danny-avila in #14745
• 📡 fix: Preserve Redis Abort Terminal Delivery by @danny-avila in #14749
• ⌨️ fix: allow file upload shortcut when editing by @likeabas in #14764
• 🛟 fix: Isolate Invalid Skills During GitHub Sync by @berry-13 in #14735
• 📱 fix: Show Quote Popup for Block Selections and on Touch Devices by @danny-avila in #14777
• 🪑 fix: Rebase Activity Phase Bounds Onto Compacted Content and Unskip the MCPManager Suite by @danny-avila in #14782
• 🔖 fix: Split Activity Phases at Substantial Text by @danny-avila in #14785
• 🖌️ style: Use correct text colour for answer textarea in dark mode by @lizzykerrigan in #14791
• 🩹 fix: Restore the @librechat/api Build and Remove Legacy Code by @danny-avila in #14808
• 🩹 fix: apply agent updates that match the newest version entry by @mihidumh in #14810
• 💬 style: Right-Align In-Flight Steer Bubbles to the Message UI by @danny-avila in #14814
• 🔌 fix: Preserve MCP serverInstructions Declaration Through Inspection by @danny-avila in #14815
• 🔌 fix: Recover Quietly From Stale MCP SSE Stream Conflicts by @danny-avila in #14816
• 📎 fix: Alias Shell Script MIME Variants to application/x-sh by @danny-avila in #14817
• 🪢 fix(langfuse): mark provider-backed agent traces by @upman in #14833
• 🔔 fix: Report Agent Saves That Reuse the Newest Version Entry by @berry-13 in #14824
• 🏘️ fix: Scope OpenID User Cache Keys to Signed User Identity by @danny-avila in #14837
• ⚡ fix: avoid modal attachment menu overhead by @danny-avila in #14847
• ⬇️ fix: Keep Scroll-to-Bottom Clear of the In-Flight Steer Stack by @danny-avila in #14844
• 🐛 fix: Give the Header's Sidebar Toggle Its Own Test Id by @danny-avila in #14850
• fix: copy only assistant response text by @berry-13 in #14853
• 🌗 fix: Keep Code Block Header Visible in User Messages by @berry-13 in #14856
• 📐 fix: Size the Model Picker to Its Content by @berry-13 in #14859
• 🩺 fix: Render Stopped Run Steps From Explicit Status by @danny-avila in #14871
• 📡 fix: Publish App-Level MCP Tool Catalogs Without a Reserved Revision by @danny-avila in #14858
• 🧩 fix: Normalize MCP UI Resource Rendering by @danny-avila in #14868
• 🎙️ fix: Prefer Compatible Formats for External STT Recording by @berry-13 in #14864
• 📋 fix: Stop the Copy Button From Clobbering the Clipboard by @berry-13 in #14876
• 🩹 fix: Stop Archived and Shared Chats Dialogs Crashing on Open by @berry-13 in #14886
• 🏷️ fix: Model Spec Menu Label and Agent Avatar Fallbacks by @danny-avila in #14887
• 🔙 fix: Stop Stacking History Entries on New-Chat Param Changes by @danny-avila in #14891
• 📌 fix: Fetch Pinned Chats Independently of the Chats List by @berry-13 in #14860
• 🕰️ fix: Stop Pinning and Archiving From Counting as Chat Activity by @berry-13 in #14861
• 🪟 fix: Resolve Context Windows and Pricing for Newer Model Families by @berry-13 in #14877
• 🖱️ fix: Reveal Message Metadata on Hover, Not on Click by @berry-13 in #14900
• 🏷️ fix: Persist the Ephemeral Agent's Display Label as Sender by @danny-avila in #14899
• 🧩 fix: Align Tenant and MCP Configuration Resolution by @danny-avila in #14904
• 🌉 fix: Preserve Missing Locize Translations by @danny-avila in #14917
• 🔐 fix: Repair Locize PR Authentication by @danny-avila in #14918
• 📚 fix: Keep English Source Repository-Owned by @danny-avila in #14920
• 🚏 fix: Preserve Endpoint Routing on HITL Resume Replay by @danny-avila in #14948
• 🌐 fix: Scrollable Language Dropdown in Shared Chat Settings by @berry-13 in #14954
• 🔒 fix: Hide Sensitive Input in Reset-Password CLI by @jacksonriding in #14923
• 💻 fix(agents): require Code Interpreter for programmatic MCP tools by @upman in #14977
• 🪪 fix: Preserve Stored Access Token Expiry Over ID Token Exp by @dustinhealy in #14982
• 🪢 fix: Harden Langfuse Media Upload Targets by @upman in #14974
• 🙋 fix: Free the Composer When a Question Pause Collapses by @danny-avila in #15011
• 🛂 fix: Preserve OpenID Re-Auth Errors Through MCP Tool Error Classification by @dustinhealy in #15010
• 🪂 fix: Land Navigation Auto-Scroll on the Rendered Thread by @danny-avila in #15014
• 📎 fix: Never Let a Stalled Attachment Disable the Composer by @danny-avila in #15013
• 🪪 fix: Preserve Detached Subagent Owner Context by @danny-avila in #15015
• ✂️ fix(agents): warn when skill descriptions are truncated in the model catalog by @putramkti in #14878
• 🔓 fix: Unblock Detached Subagent Preparation by @danny-avila in #15016
• ♿ fix: Keep Portaled Dropdown Menus Clickable Inside Modal Dialogs by @berry-13 in #15026
• ♿ fix: Resolve axe Violations in Sidebar, Tools Dropdown and Footer by @jtodaroii in #14979
• 🎡 fix: Scheduled Chat Slot Accounting and Reconciliation Rotation by @danny-avila in #15040
• 🗓️ fix: Hide Unsupported Schedule Variables by @danny-avila in #15053
• 🧵 fix: Hide Child Threads From Navigation by @danny-avila in #15041
• 🛑 fix: Confirm Scheduled Stops and Separate Terminal Scheduler Failure from Startup by @danny-avila in #15051
• 🧵 fix: Close Child-Thread Read and Search-Cleanup Gaps by @danny-avila in #15055
• 📱 fix: Recover the Stream After a Mobile Tab is Backgrounded by @danny-avila in #15050
• 🛟 fix: Report Skill Sync Files Whose Paths Cannot Be Mirrored by @danny-avila in #15067
• 🔭 fix: Attach to Runs This Pane Did Not Start by @danny-avila in #15074
• 🪪 fix: Support MCP Server Titles With Hyphens by @danny-avila in #15094
• 📄 fix: Serve Stored Text for "Upload as Text" File Downloads by @lidonius1122 in #14723
• 🪢 fix: Preserve Response Identity and Branch During Resumable SSE Sync by @Falenos in #14788
• ✂️ fix: Strip Redundant Server-Name Prefixes from MCP Tool Keys by @dustinhealy in #14732
• 🪡 fix: Thread Parent Message ID Through MCP Request-Scoped Bodies by @danny-avila in #15095
• 🖼️ fix: Restore Shared Subagent Activity as a Read-Only View by @danny-avila in #15108
• 🧯 fix: Prevent Quote Popup Update Loop by @danny-avila in #15113
• 🚦 fix: Restrict Programmatic Tool Execution Maps by @danny-avila in #15105
• 🛂 fix: Preserve Legacy Assistant Attribution by @danny-avila in #15118
• 🧾 fix: Report Complete Agents API Usage by @danny-avila in #15127
• 📏 fix: Size Agent Builder Tool and Skill Rows by @berry-13 in #15134
• 🫂 fix: Route Subagent Activity Through the Chat Renderer by @danny-avila in #15137
• 🧪 fix: Mock the Parent Subagent Index Handler in Convos Route Tests by @danny-avila in #15146
• 🪶 fix: Polish Event Subagent Activity by @danny-avila in #15152
• 📭 fix: Detect Agent List Pages in useHasData by @jomspk in #15156
• 🎽 fix: Commit Subagent Roster Selections to Form State by @danny-avila in #15154
• 🩹 fix: Restore Provider Typing Against the Agents SDK Declarations by @danny-avila in #15161
• 🕯️ fix: Decay Violation Scores With a Configurable TTL by @danny-avila in #15153
• 🥁 fix: Compare TOTP Codes in Constant Time by @pacocartones in #15157
• 🧳 fix: Port Subagent Control Receipt Writes to DocumentDB-Safe Operators by @danny-avila in #15171
• ✂️ fix: Unclip the Share Dialog's Public Role Menu by @danny-avila in #15177
• 🛗 fix: Add Tenant Index Upgrade Migration by @danny-avila in #15767
• 🧱 fix: Close MCP OAuth Teardown Races by @danny-avila in #15716
• 🪫 fix: Recharge Direct OpenID MCP Bearer Sessions by @danny-avila in #15704
• 🪬 fix: Fence Agent Checkpoint Ownership and Cleanup Recovery by @dustinhealy in #15680
• 🏠 fix: Preserve Stateful Deployment Default by @danny-avila in #15719
• 🩻 fix: Preserve Workspace Tool HTTP Diagnostics by @danny-avila in #15723
• 🪹 fix: Attach Ready OAuth MCP Servers With Empty Catalogs by @danny-avila in #15727
• ⛔ fix: Bind Tool Approvals to Generation Scope by @danny-avila in #15724

🔧 Refactoring and Performance Copy Anchor Link
• 📜 style: Scroll the Sidebar as One Surface by @berry-13 in #15914
• 🧷 style: Sidebar Row Controls, Pinned Unpin Badge and Drag Rules by @berry-13 in #15870
• 🔡 style: Size Image Tool Labels Like Every Other Activity Row by @danny-avila in #15898
• 🎨 style: Color Image Tool Labels With the Activity Rows' Secondary Role by @danny-avila in #15900
• 🚄 perf: Linearize Conversation Import Lineage by @danny-avila in #15881
• 🧽 style: Composer, Welcome Screen and Context Panel Polish by @berry-13 in #15838
• 🛫 refactor: Promote Generation Protocol V2 Automatically by @danny-avila in #15324
• 🎠 refactor: Route Every Event Actor Turn Through One Lifecycle by @danny-avila in #15325
• 🪩 style: Shimmer Live Reasoning Labels and Timers by @danny-avila in #15431
• ✔️ style: Anchor the Applied Steer Receipt and Name Tool Calls in Its Interrupt Copy by @danny-avila in #15450
• 🧵 refactor: Give the Subagent Panel One Composer and Main Chat's Metrics by @danny-avila in #15436
• 🐆 perf: Build Dev Branch Images on Native ARM and Cheapen Asset Brotli by @danny-avila in #15441
• ♻️ refactor: Compute Context Gauge Client-Side, Drop Projection Endpoint by @danny-avila in #13953
• 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads by @danny-avila in #13978
• 🦥 perf: Lazy-Load Agent Version History in Editor by @danny-avila in #13977
• 🛗 perf: Fetch Pinned Agents Directly Past the Global Agents Map by @danny-avila in #13972
• ⚡ perf: memoize FavoritesList and BookmarkNav to prevent re-renders during streaming by @berry-13 in #14011
• 🗺️ refactor: Light Up In-Viewport Ribs at Rest in Message Nav by @danny-avila in #14041
• ⚡ perf: Minimize group membership query in principal resolution by @danny-avila in #14055
• ⚡ perf: Skip Role Route Capability Probe for Own and Default Roles by @danny-avila in #14073
• 🪭 refactor: safe structured failure logging for langfuse fanout gateway by @upman in #14050

Original source

Added beta Agent Management API configuration

• endpoints.agents.managementApi.auth.oidc configures the trusted issuer, audience, and optional JWKS URL for machine-to-machine access
• endpoints.agents.managementApi.auth.clients binds allowed OAuth clients to a LibreChat user and optional tenant
• Management requests retain the bound user's role, ACL, capability, ownership, and tenant checks

Expanded highly experimental stateful Code session configuration

• endpoints.agents.statefulCodeSessions.principalWorkers.enabled controls personal worker enrollment and defaults to true
• principalWorkers.maxPerUser defaults to 5; deployment configuration is a hard ceiling and tenant or role overrides may only reduce it
• Setting the limit to 0, or disabling principal workers, prevents new enrollment without removing existing workers
• Attached workspaces now support bounded tree listing, file reads, text search, file authoring, Bash execution, and per-Agent Git identity
• These environments remain highly experimental and may change substantially

Added conversation-level Code approval modes

• Users can choose Ask before changes, Accept edits, or Full access when permitted by deployment policy
• Full access is available only when both file writing and command execution allow it, and does not bypass sandbox, endpoint, role, hook, or Skill confirmation controls

Added Agent attachment context limits

• fileConfig.fileContextSizeLimit caps aggregate model-bound attachment bytes and defaults to 134217728 (128 MiB)
• fileConfig.fileContextCharLimit caps aggregate extracted text and defaults to 1000000 characters
• fileConfig.endpoints.agents.fileLimit caps the number of files attached to an Agent request

Added OpenTelemetry log export

• OTEL_LOGS_ENABLED enables log export independently of trace export; OTEL_SDK_DISABLED disables both
• OTEL_LOGS_LEVEL defaults to info
• OTEL_LOGS_EXPORTER, OTEL_EXPORTER_OTLP_PROTOCOL, and OTEL_EXPORTER_OTLP_LOGS_ENDPOINT configure the exporter and destination

Added configurable Langfuse trace identity and metadata

• langfuse.trace.userIdField selects the internal ID, email, username, or OpenID ID used for Langfuse trace identity
• userMetadataFields and conversationMetadataFields explicitly allowlist additional trace metadata
• Existing internal user IDs remain the default and no additional metadata is exported unless configured

Added shared-link read throttling and audit scoring

• SHARE_IP_MAX and SHARE_IP_WINDOW configure the IP bucket, defaulting to 100 reads per minute
• SHARE_USER_MAX and SHARE_USER_WINDOW configure the authenticated-user bucket, defaulting to 60 reads per minute
• SHARE_VIOLATION_SCORE controls the violation score added for rejected reads and defaults to 0

Added Redis connection health controls

• REDIS_PING_TIMEOUT bounds heartbeat PING calls and defaults to 5000 ms
• REDIS_SUBSCRIBER_PING_INTERVAL detects silent subscriber socket failures and defaults to 15000 ms
• REDIS_KEEP_ALIVE configures the TCP keepalive delay and defaults to 10000 ms

Updated OpenID-backed MCP authentication

• Trusted YAML-defined servers can pass the live upstream token with Authorization: "Bearer {{LIBRECHAT_OPENID_ACCESS_TOKEN}}"
• Explicit MCP OAuth, on-behalf-of exchange, and administrator API-key authentication take precedence
• A rejected bearer can refresh the connection once, but LibreChat never automatically replays the rejected tool call

Updated built-in provider configuration

• Added gpt-6-astra to the default OpenAI model catalog
• GPT-6 Astra uses the Responses API, omits unsupported sampling parameters, and supports a 1,050,000-token context window with up to 128,000 output tokens

Updated configuration examples

• Removed the retired Helicone and Portkey examples

Added unified attachment routing and lazy tool provisioning

• fileConfig.defaultLLMDeliveryPath controls whether unmatched and MIME-specific uploads use native provider delivery, extracted text, or tool-only storage
• Configure fallback plus exact or wildcard overrides; endpoint settings take precedence over global settings
• Without explicit overrides, images, audio, video, and PDFs prefer provider delivery while other recoverable content uses extracted text
• Unsupported native paths fall back to text when extraction is available, or remain available only to tools otherwise
• File Search and Code resources are provisioned only when the selected tools need eligible attachments
• fileConfig.legacyFileUploadUX: true restores the previous destination chooser and eager, user-selected routing globally or for an endpoint

Added MCP foreground refresh controls

• interface.mcpServers.toolsRefreshInterval controls visible tool-catalog polling and defaults to 300000 ms
• interface.mcpServers.statusRefreshInterval controls visible connection-status polling and defaults to 30000 ms
• Set either value to 0 to disable that polling loop

Added MCP catalog recovery controls under mcpSettings.catalogRecovery

• Passive OAuth discovery now uses bounded, coalesced backoff instead of retrying on every catalog request
• Configure discovery and reauthentication delays, credential-generation read deadlines, in-memory state bounds, and durable authorization-fence retries
• Defaults are documented in the MCP Settings reference
• discoverySettleGraceMs defaults to 10000 ms and lets a timed-out discovery settle without being cancelled
• maxDetachedDiscoveries defaults to 3 and bounds still-settling discoveries before new recovery work waits

Added run-scoped Subagent file sharing

• endpoints.agents.fileSharing.enabled defaults to false; each delegating Agent must also opt in with subagents.shareFiles
• Inputs are read-only to recipients; outputs remain private unless explicitly published
• allowSiblingSharing, maxFiles, maxPrivateBytes, and ttlMs bound recipient scope, manifest capacity, retained private outputs, and active lifetime

Added Conversation Trace Viewer configuration

• interface.traceViewer.enabled defaults to false and requires a Langfuse release with the v2 Observations API
• showInputOutput defaults to false; enabling it can reveal prompts, Agent instructions, and tool definitions in trace records
• maxRecords, maxContentLength, requestsPerMinute, and requestTimeoutMs bound trace reads

Added CODE_ENVIRONMENT_DECISION_VERSION=1

• Advertises immutable conversation-owned Code-environment decisions
• Enable it only after every LibreChat API replica supports protocol version 1

Added Agent Code API recovery and attached-command limits

• endpoints.agents.codeApiUploadConcurrency defaults to 3 concurrent uploads per route and authenticated principal
• endpoints.agents.codeApiMaxRetryWaitMs defaults to 20000 ms of total rate-limit waiting per operation
• statefulCodeSessions.environments[].configSchema.limits.maxCommandTimeoutMs exposes a model-requestable attached Bash timeout; omission preserves 30 seconds and the hard ceiling is 300 seconds

Added optional ordinary background-tool cancellation

• endpoints.agents.backgroundTasks.ordinaryToolCancellation defaults to false
• When enabled, owners can cooperatively cancel ordinary background tools, including attached Bash; detached Subagents keep their independent lifecycle

Added Scheduled Chat MCP admission limits

• interface.schedules.admissionConcurrency defaults to 20 readiness admissions per replica
• interface.schedules.mcpPreflightConcurrency defaults to 3 MCP readiness connections per admission
• interface.schedules.mcpPreflightTimeoutMs defaults to 300000 ms

Blank MONGO_AUTO_INDEX and MONGO_AUTO_CREATE values now use Mongoose defaults instead of disabling automatic index or collection creation

Added separate regular-chat retention

• interface.generalChatRetention controls regular conversation retention under retentionMode: "all"
• It accepts 1 to 8760 hours and falls back to temporaryChatRetention when omitted
• Temporary and regular chat policies are evaluated independently
• Changing retention settings does not rewrite deadlines already stored on existing records

Added tenant index upgrade commands

• npm run migrate:tenant-indexes:dry-run reports the planned index changes
• npm run migrate:tenant-indexes applies the upgrade migration
• Follow the Tenant Index Migration guide before restarting database writers

Updated the config version to 1.3.16

Original source

Updated Agent tool capabilities

• run_in_background now supports explicitly selected MCP, Plugin, and Action tools in addition to background-native Code Interpreter tools
• Action selection covers every eligible operation; OAuth Actions and operations that already define run_in_background are excluded
• Programmatic MCP tools require Code Interpreter on the Agent; incompatible builder selections are disabled or cleared, and stale caller options are removed server-side
• Programmatic execution intersects caller-authorized tools with LibreChat's trusted execution registry

Added endpoints.agents.maxSubagents

• Limits explicit subagents in flat Agent lists and Agent team graphs
• Defaults to 10, accepts values from 1 to 50, and is enforced from the base YAML

Added live Agent reasoning-label settings

• reasoningLabel enables a generated orientation for top-level reasoning as a response develops
• reasoningLabelModel, reasoningLabelEndpoint, and reasoningLabelPrompt configure the label call
• reasoningLabelMinChars, reasoningLabelUpdateChars, and reasoningLabelUpdateIntervalMs control streaming revisions
• reasoningLabelMaxPerRun defaults to 8; each attempted revision is a separate model call with its own usage and cost

Updated endpoints.agents.toolApproval

• Static rules are evaluated in deny, ask, then allow order before the configured mode fallback
• Rules match MCP runtime names and model-facing aliases across top-level and nested Subagent tools
• Attached Code environments automatically ask before file writes and command or code execution while leaving read and search operations under the regular policy
• toolApproval.enabled: false is the administrator emergency override for the attached-environment baseline; callers without approval and resume support otherwise fail closed

Added highly experimental Agent Code environment configuration

• endpoints.agents.statefulCodeSessions.allowedEnvironments restricts selectable user, agent-user, and conversation workspace scopes
• statefulCodeSessions.environments defines named managed or attached backends and requires exactly one default when executable entries exist
• Attached environments can route through workerId, enroll an operator worker with pairing.workerId, or allow owner-bound workers with pairing.allowPrincipalWorkers
• pairing.tokenEnv names the secret-bearing environment variable; pairing-only control planes cannot be execution defaults
• configSchema.permissions.fileWrite and commandExecution let administrators expose bounded allow, ask, or deny choices for owner-bound environments; omitted or invalid preferences fall back to ask
• settings is populated from server-validated owner preferences at request time and should not be configured in deployment YAML
• Isolation, networking, mounts, privileged execution, ingress, egress, and secrets remain outside the user-configurable schema
• LIBRECHAT_CODE_BASEURL_STATEFUL selects a dedicated stateful Code API while stateless Agents continue using LIBRECHAT_CODE_BASEURL
• CODE_ENVIRONMENT_PAIRING_USER_MAX and CODE_ENVIRONMENT_PAIRING_USER_WINDOW control per-user pairing limits
• Attached environments, pairing, and stateful workspaces remain highly experimental and may change substantially

Added self-hosted Code Interpreter JWT authentication

• CODEAPI_AUTH_PROVIDER=librechat-jwt and CODEAPI_JWT_ENABLED=true enable per-user bearer tokens
• EdDSA and RS256 private keys can be supplied as PEM, base64-encoded PEM, or private JWK, with configurable key ID, issuer, audience, lifetime, and mint cache
• CODEAPI_JWT_SINGLE_TENANT_ID supplies the non-strict tenant fallback; strict isolation fails closed without authenticated tenant context
• LIBRECHAT_CODE_SANDBOX_OUTPUT_MAX_SIZE defaults to 65536 and derives safe sandbox-image windows
• LIBRECHAT_CODE_IMAGE_CHUNK_BYTES is now an optional exact window override instead of a fixed 32768-byte default

Updated Agent event and background delivery configuration

• Added endpoints.agents.backgroundTasks.completionWakeups, which defaults to true; set it to false for poll-only background tools and Subagents
• endpoints.agents.eventDriven now contains only optional selfUrl; pre-release child-turn, completion, coalescing, mailbox, checkpoint, and receipt fields were removed
• Removed the pre-release ENABLE_AGENT_EVENT_CHILD_TURNS, ENABLE_SUBAGENT_COMPLETION_WAKEUPS, and AGENT_TRIGGERS_DETACHED_ACTIONS_PRODUCER_ENABLED flags
• rateLimits.agentEvents.userMax and userWindowInMinutes configure a separate API-key-principal ingress bucket, defaulting to 40 requests per minute

Added experimental Scheduled Chats configuration

• interface.schedules is absent by default and must be added explicitly to enable the panel and engine
• use, create, maxPerUser, minIntervalMinutes, autoDisableAfterFailures, fireConcurrency, and requireProject configure permissions and limits
• schedules: false and { use: false } are authoritative deployment-wide stops
• SCHEDULES_DISABLED=true immediately blocks automatic and manual runs without deleting definitions
• Multi-replica deployments require Redis-backed resumable streams; SCHEDULES_SINGLE_PROCESS=true is only for a truly single-process deployment without Redis

Added customParams.paramDefinitions[].range.positiveMin

• Allows range.min to remain a sentinel while ordinary values begin at a higher floor
• Validation and UI clamping accept only the sentinel or values from positiveMin through max

Added configurable HTTP security headers

• Baseline HSTS, X-Frame-Options, X-Content-Type-Options, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Referrer-Policy headers are sent by default
• SECURITY_HEADERS=false disables the baseline and acts as the global Content Security Policy kill switch
• CSP_ENABLED=true enables nonce-based CSP; CSP_REPORT_ONLY=true is the default for staged rollout
• CSP_*_EXTRA, CSP_FRAME_ANCESTORS, CSP_ALLOW_WASM, and CSP_ALLOW_DATA_WORKERS adapt the policy to deployment resources

Updated Langfuse configuration

• Added YAML-only langfuse.headers for authenticating one self-hosted Langfuse origin or gateway across traces, media, feedback, project lookup, and credential verification
• Header values support ${ENV_VAR} references, are masked in config output, and fail closed when configuration resolves multiple Langfuse origins
• Authorized administrators can open sampled sessions from Context Usage and authenticated same-tenant shared conversations
• Added export-plan trace attributes and secret-free connection-change events for troubleshooting
• Fanout media upload targets must be absolute HTTPS URLs and upload requests no longer follow redirects

Updated request-scoped MCP configuration

• Added {{LIBRECHAT_BODY_PARENTMESSAGEID}} for native Agent, Chat Completions, and legacy Assistants requests; Open Responses rejects it because no equivalent parent identity exists
• MCP display titles accept Unicode letters and numbers, hyphens, and apostrophes after an initial letter or number
• Redundant server-name prefixes are removed from model-facing tool keys without changing routing
• Deferred servers resolve declared serverInstructions when they become available during an active request

Updated OpenID and SAML settings

• GRAPH_API_SCOPES configures the Microsoft Graph scopes requested for {{LIBRECHAT_GRAPH_ACCESS_TOKEN}} OBO exchange
• OPENID_REFRESH_BRIDGE_GRACE_MS controls the short rotated-token recovery bridge and defaults to 60000 ms
• SAML_NAME_ID_FORMAT requests a stable NameID format; transient identifiers are rejected
• SAML_IDP_ISSUER optionally pins the expected IdP entity ID

Added base-only, source-aware content filters

• Top-level filters can inspect selected fields across messages, prompts, Agent instructions, conversation starters and titles, feedback, Skills, memories, files, tool arguments, model parameters, and Action metadata
• Each source independently selects fields and built-in credential patterns or bounded RE2JS custom patterns
• filters.messages.unattributedAssistantContent controls classification of legacy assistant rows without provenance
• filters.files.pii.uninspectable can allow or block opaque and oversized selected content
• Each source accepts pii.action: block | audit; block remains the default, while audit records raw-free findings without rejecting or changing content
• Explicit filters.files.pii.uninspectable: block remains fail-closed independently of audit mode
• The policy is loaded only from base YAML and cannot be changed through database, role, group, or user overrides
• Legacy messageFilter.pii remains supported, stays block-only, and applies alongside the source-aware policy

Updated web-search configuration

• Added webSearch.searxngSearchOptions for engines, language, time range, and timeout
• Added keyless Keenable search and scraping, with optional KEENABLE_API_KEY, KEENABLE_API_URL, and KEENABLE_FETCH_URL overrides
• keenableSearchOptions and keenableScraperOptions configure result count, domains, attribution titles, and timeouts

Added interface.feedback

• Defaults to true; setting it to false hides response feedback controls and rejects feedback writes

Updated deployment defaults and controls

• secureImageLinks now defaults to true; set it to false only for intentionally public local image URLs
• ENABLE_INSIGHTS=true exposes tenant-scoped MongoDB Insights to authorized administrators
• CONSOLE_LOG_LEVEL selects console verbosity or silent, overriding the DEBUG_CONSOLE fallback
• REDIS_READONLY_RECOVERY_INTERVAL defaults to 5000 ms and debounces Keyv reconnects after a failover leaves a socket on a read-only replica
• VIOLATION_SCORE_TTL expires inactive violation scores; 0 disables expiry
• Startup rejects the retired published JWT_SECRET and JWT_REFRESH_SECRET values
• Removed the pre-release GENERATION_PROTOCOL_VERSION setting; current clients and built-in generation stores select protocol v2 automatically

Updated built-in provider configuration

• Vertex AI Agents use the shared GOOGLE_MODELS catalog unless an explicit vertexai catalog takes precedence
• Google model settings expose resendFiles, bound maxContextTokens to 10-2,000,000, and apply model-aware Gemini 2.5 thinking-budget ranges
• Native Anthropic prompt-cache and 1M-context checks now recognize matching Sonnet and Opus 4.6-or-later model IDs consistently
• Added Claude Fable 5.1 to the direct Anthropic, Vertex AI, and Bedrock model catalogs with its distinct cache-read pricing
• Added Gemini 3.8 Flash to the Google AI Studio and Google Cloud Gemini Enterprise Agent Platform model catalogs with Flash-family thinking, parameter, context, prefill, and pricing behavior
• Agent model headers accept {{LIBRECHAT_USER_TENANT_ID}} and {{LIBRECHAT_USER_TENANTID}}, resolved from authoritative request-scoped tenant context
• Updated built-in GPT-5.6 Sol pricing

Updated the config version to 1.3.15

Original source

The v0.8.8-rc2 release candidate of LibreChat

What's Changed Copy Anchor Link
Operator-facing YAML, environment, default, and migration changes are collected in Config v1.3.15.

🏞️ Highlights Copy Anchor Link
• Interrupt, steer, or queue Agent runs, with HITL approvals, questions, and tool-limit recovery
• Experimental Scheduled Chats with cron, weekly schedules, time zones, and Project destinations
• New models: GPT-5.6; Claude Fable 5.1, Opus 5, and Sonnet 5; Gemini 3.8, 3.7, and 3.6 Flash; and Gemini 3.5 Flash-Lite
• Live activity, phase, reasoning, and tool-intent labels
• Unified Agent Builder with Skill authoring, background tools, and Programmatic Tool Calling
• Durable Agent Events, primarily in beta, with mailboxes, receipts, human pauses, and background wakeups
• Saved Agent teams, primarily in beta, with deeper Subagent history, live controls, and automatic continuation
• Agent Plugins, primarily in beta, plus highly experimental Code environments with guarded permissions
• Agent memory isolation and categorized Context Usage with optional cost
• UI polish across Projects, full-message search, settings, shortcuts, pinning, and mobile navigation
• Stable shared links, personal copies, editable long pastes, and attachment-only turns
• Fullscreen artifacts, Mermaid export, PowerPoint templates, and original file downloads
• Keyless web search with expanded SearXNG and Tavily controls
• Stronger security and admin controls across headers, local images, Code Interpreter, SAML/OIDC, content filtering, and encrypted configuration
• In-app Langfuse connections, tenant fanout, export controls, and authorized session links
• Adaptive streaming, generation protocol v2, Redis failover recovery, and live MCP catalog refresh

✨ Features Copy Anchor Link
• 🕒 feat: Track terms acceptance timestamp by @berry-13 in #10810
• 🔄 feat: Continue Shared Conversations as Personal Copies by @berry-13 in #13714
• 🪝 feat: HITL Tool Approval Scaffolding (Slice A) by @danny-avila in #12938
• 🧠 feat: Add Memory as an Agent Capability with Inline Tools and Ephemeral Badge by @danny-avila in #13869
• 📇 feat: Agent Contact Visibility with Owner Fallback by @peeeteeer in #13663
• 🪟 feat: Faithful Over-Window Context Estimate via Prune Mirror and Overhead Reserve by @danny-avila in #13959
• 🪭 feat: Add opt-in Langfuse fanout gateway + collector by @upman in #13872
• 🪝 feat: Human-in-the-Loop Runtime - Tool Approval + Ask-User-Question (Slice B) by @danny-avila in #13942
• 🪗 feat: Dock-Style Fisheye Nav Rail With Instant Hover Preview by @danny-avila in #14021
• 🤖 feat: Add Claude Sonnet 5 Support by @danny-avila in #14042
• 🥷 feat: Add showInMenu Option to Model Specs by @alexkorep in #14034
• 🫷 feat: Exclude File Authoring Tools From Eager Execution by @danny-avila in #14051
• 🪝 feat: Configurable Tool-Approval Policy via Programmatic Hooks by @danny-avila in #14025
• 🧹 feat: Eager HITL Checkpoint Cleanup (Expiry + Deletion) & Full-Wiring E2E by @danny-avila in #14123
• 🧰 feat: Redesign Agent Builder with Unified Tools Marketplace, Skills & Orchestration by @berry-13 in #13952
• 📡 feat: add rum browser page-load diagnostics by @upman in #14106
• 🎚️ feat: Explicit "Use All Skills" Toggle in the Skills Section by @berry-13 in #14125
• 🙋 feat: ask_user_question - agent-initiated questions with durable pause/resume by @danny-avila in #14139
• 🗂️ feat: Per-Agent Memory Partitions by @danny-avila in #14084
• 🤖 feat: Add GPT-5.6 (Sol/Terra/Luna) OpenAI Models by @danny-avila in #14206
• 🪭 feat: support per-run central export suppression by @upman in #14207
• ✨ feat: stateful_code_sessions capability for warm Code API sandbox sessions (experimental) by @danny-avila in #14150
• 🧠 feat: Add GPT-5.6 reasoning.mode + reasoning.context (Responses API) by @danny-avila in #14233
• 🧵 feat: Background Tool Calls for Agents & Model Specs by @danny-avila in #14197
• 🗝️ feat: Encrypted Langfuse Fanout Config by @dustinhealy in #14107
• 🧭 feat: Mid-Run Steering and Queued Messages for Agent Runs by @danny-avila in #14220
• ♨️ feat: Prewarm Stateful Code Sandboxes with Cold-Boot UX Feedback by @danny-avila in #14239
• 📛 feat: Add Client Name Header to Tavily Search Requests by @manisrinivasan2k1 in #14082
• 💬 feat: Explain Steering & Queuing at Every User-Facing Surface by @danny-avila in #14260
• 🖼️ feat: Return Sandbox Images From read_file as Viewable Artifacts by @danny-avila in #14277
• feat: add low-noise Redis observability by @upman in #14309
• ✋ feat: Add Reclaim-Gated Controls to In-Flight Steers by @danny-avila in #14321
• 🫧 feat: Float In-Flight Steers Over the Thread with Collapsible Content by @danny-avila in #14365
• ⚡ feat: Add Gemini 3.6 Flash and Gemini 3.5 Flash-Lite Support by @danny-avila in #14369
• 🧵 feat: Native Background Execution for Code Interpreter Tools by @danny-avila in #14386
• ✳️ feat: Claude Opus 5 Support by @danny-avila in #14422
• ⏱️ feat: Configurable HTTP Server Timeouts by @danny-avila in #14481
• 🕶 feat: Generalize Admin Config Secret Redaction by @dustinhealy in #14509
• 🏷️ feat: Activity Groups With Fast-Model Headers by @danny-avila in #14391
• 🗝️ feat: Custom Endpoint API Key Encryption via Array Secret Registry by @danny-avila in #14510
• 🎯 feat: Tool Intent Label Capability (tool_intents) by @danny-avila in #14499
• 🪢 feat: Langfuse Fanout Connection Setting by @danny-avila in #14108
• 🛑 feat: Preemptive Steer - Backend Interrupt & Steer by @danny-avila in #14518
• 🎯 feat: Per-Tool Intent Labels for Model Specs by @danny-avila in #14526
• ⚡ feat: Interrupt & Steer, Client by @danny-avila in #14528
• 🧵 feat: Background-Native Code Execution Tools by @danny-avila in #14532
• 🎯 feat: Render Tool Intent as the Live Tool-Call Label by @danny-avila in #14536
• 🎯 feat: Per-Tool Intent Label Toggles in the Agent Builder by @danny-avila in #14550
• ⚡ feat: Reliable Interrupt & Steer Escalation and Recovery by @danny-avila in #14558
• 💬 feat: Interim Progress Card for Streaming Q&A Calls by @danny-avila in #14576
• 🚦 feat: Configurable Circuit Breakers for Runaway Streamed Tool Args by @danny-avila in #14613
• ⚡ feat: Coalesce Redis Streaming Delta Publications into Windowed Batches by @danny-avila in #14614
• 🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas by @dustinhealy in #14559
• 🌊 feat: Wire Adaptive Stream Smoothing Across Google, Bedrock, and Zero-Disable Semantics by @danny-avila in #14660
• 🔗 feat: Admin Panel Link in Settings for Admins by @dustinhealy in #14662
• 👋 feat: Day-Aware Landing Greeting Schedule by @berry-13 in #14633
• 🔑 feat: Refresh-Capable Google Admin OAuth Sessions by @dustinhealy in #13832
• 🛡️ feat: Add Batched MCP Authority Proofs by @danny-avila in #14688
• 🪝 feat: Add Claude Hook Compatibility Layer by @danny-avila in #14412
• ⛶ feat: add fullscreen artifact previews by @berry-13 in #14585
• 🔌 feat: Add Agent Plugins (Experimental) by @danny-avila in #14704
• 🔗 feat: Shared Conversation Badge and Stable Share Links by @berry-13 in #14712
• 🧜 feat: Open Mermaid Diagrams as Artifacts with SVG/PNG Export by @berry-13 in #14713
• 🪶 feat: Resolve Explicit Subagents Lazily by @danny-avila in #14714
• 📡 feat: Route Web Search and Scrape Egress through the SSRF-safe Agent by @dustinhealy in #14606
• 🎨 feat: Add Versioned Theme Foundation by @danny-avila in #14709
• 🪆 feat: Add Parent Activity Phase Summaries by @danny-avila in #14721
• 🎨 feat: Refine Client Colors and Sharing Dialogs by @berry-13 in #14734
• 🎛️ feat: Adopt Composer Density Tokens by @danny-avila in #14730
• 🍡 feat: Batched User Questions With A Single Bounded Answer Form by @danny-avila in #14737
• 🪝 feat: Execute Agent Plugin Command Hooks by @danny-avila in #14755
• 🚣‍♀️ feat: Smooth Streaming Text Fade-In by @danny-avila in #14757
• 🪢 feat: add Langfuse session links by @upman in #14776
• 🔖 feat: Bound Parent Activity Phases With an Exclusive End Index by @danny-avila in #14768
• 💬 style: Unify Message Row Layout and Edit Surfaces by @berry-13 in #14770
• 📄 feat: accept PowerPoint template MIME type by @snapydziuba in #14761
• ⚡ feat: Add Gemini 3.7 Flash Support by @danny-avila in #14818
• 🪄 feat: Smooth Activity Phase Transitions by @danny-avila in #14832
• 📱 style: Reclaim the Assistant Avatar Gutter on Mobile by @danny-avila in #14836
• 📱 style: Consolidate the Mobile Chat Header by @danny-avila in #14843
• ➡️ style: Flush the In-Flight Steer Stack to the Composer Edge by @danny-avila in #14854
• 🎨 feat: Color the Context Gauge by Category and Collapse its Breakdown by @danny-avila in #14855
• 📐 feat: Match the Message Column to the Composer by @berry-13 in #14851
• 🚏 feat: Central Trace Destination Opt-Out for Langfuse by @danny-avila in #14838
• 🤐 feat: Allow Promptless Sends When Files Are Attached by @i-anubhav-anand in #13717
• 📥 feat: Download Code Blocks as Files by @i-anubhav-anand in #13715
• 📱 feat: Give the Mobile Nav the Whole Screen by @danny-avila in #14849
• 💄 style: Align the Overflow Menu's Icons and Ease the Assistant Header by @danny-avila in #14888
• 🗂️ feat: Display Chat Title in Tab Setting by @berry-13 in #14881
• 🛤️ feat: Per-Agent Code Execution Routing With Stateful Session Scopes by @danny-avila in #14848
• 🗂️ feat: Rework the Projects Dashboard, Sidebar and Scoped Composer by @berry-13 in #14866
• 🎛️ feat: Consistent Dialogs, Clearer Settings, and a Keyboard Shortcuts Switch by @berry-13 in #14882
• ⏱️ feat: Show Run-Step Durations On Tool Cards by @danny-avila in #14892
• 🗄️ feat: Record When a Conversation Was Archived by @berry-13 in #14863
• 💄 style: Align the Thinking Dot with the Header Icon by @danny-avila in #14895
• 🗜️ feat: Let Users Toggle Client-Side Image Resizing by @berry-13 in #14883
• 🧠 feat: Add Live Reasoning Labels by @danny-avila in #14893
• 📱 feat: Swipe the Mobile Drawer Open and Closed by @danny-avila in #14902
• 📜 feat: Follow Streaming Args in Tool Detail Panes by @danny-avila in #14906
• 📋 feat: Attach Long Pasted Text as a File by @berry-13 in #14884
• 🗄️ feat: Archive All Chats From Data Controls by @berry-13 in #14885
• 🛡️ feat: Let Admins Restrict Stateful Workspace Scopes by @danny-avila in #14910
• 🎬 style: Reveal the Chat on Programmatic Drawer Closes by @danny-avila in #14930
• 🛰️ feat: Execute Generic Agent Trigger Deliveries by @danny-avila in #14921
• 📡 feat: Add Generic Agent Trigger Dispatch Seam by @danny-avila in #14916
• 📬 feat: Add Durable Agent Trigger Delivery by @danny-avila in #14925
• 🪜 style: Step Through Batched Questions One at a Time by @danny-avila in #14935
• 🕸️ feat: Run Saved Agent Teams as Subagents by @danny-avila in #14944
• 🪢 feat: Custom Request Headers For Langfuse by @danny-avila in #14945
• 🧵 feat: Persist View-Only Subagent Threads by @danny-avila in #14957
• 💡 feat: add DB-backed admin insights by @upman in #14898
• 📁 feat: Surface Stateful Workspace Downloads by @danny-avila in #14984
• 🛰️ feat: Route Live Subagent Controls Across Replicas by @danny-avila in #14971
• 🪃 feat: Wake Parent Agents on Child Completion by @danny-avila in #14975
• 🎛️ feat: Make Max Subagents Configurable via librechat.yaml by @berry-13 in #15023
• 🔗 feat: Open Footer Site Links in a New Tab by @berry-13 in #15019
• ⏱️ feat: Run Scheduled Chats Through Durable Agent Triggers by @danny-avila in #14939
• 🕊️ feat: Yield to Subagent Completion Wakeups by @danny-avila in #15066
• 🧾 feat: Sibling Task Manifest for Resumed Parent Runs by @danny-avila in #15063
• 📜 feat: Add Optional Collapse for Long User Messages by @berry-13 in #15034
• 🗂️ feat: Scope Scheduled Chats to Chat Projects by @danny-avila in #15056
• 🪟 feat: Read Child Threads Through Their Parent by @danny-avila in #15073
• 🛰️ feat: Show Child Agent Activity in a Side Panel by @danny-avila in #15075
• 🙈 feat: Config Option to Hide Response Feedback Buttons by @berry-13 in #15085
• ✨ feat: Context Gauge Hover Reveal and Breakdown Motion Polish by @berry-13 in #15038
• 🫥 feat: Add Temporary Chat Empty State and Active Indicator by @berry-13 in #15086
• 🎛️ feat: Configurable SearXNG Search Options by @berry-13 in #14987
• 🙋 feat: Collapse Settled Question Records by Default by @danny-avila in #15107
• 🪟 feat: Unify Subagent Activity Panel by @danny-avila in #15106
• 🛂 feat: Filter Model-Bound Content by Source by @danny-avila in #14425
• 📨 feat: Add Authenticated Agent Event Ingress by @danny-avila in #15110
• 📡 feat: Stream Detached Subagent Activity by @danny-avila in #15111
• 📨 feat: Continue Bound Child Agents from Events by @danny-avila in #15112
• 🖥️ feat: Stream PTC Inner Tool Calls as a CLI-Style Trace by @danny-avila in #15115
• 🎚️ feat: Configure Agent Event Runtime in YAML by @danny-avila in #15128
• 🪴 feat: Fork Completed Subagents Into Continuable Chats by @danny-avila in #15133
• 📱 feat: Offer a Dismissable Strip of Chat Beside the Mobile Drawer by @berry-13 in #14990
• ⏰ feat: Custom Cron Cadence for Scheduled Chats by @berry-13 in #15084
• 🧭 feat: Choose a Schedule's Time Zone by @berry-13 in #15119
• 📆 feat: Weekly Schedules on Several Days by @berry-13 in #15120
• 🕰️ feat: Clock Format and Week Start Preferences by @berry-13 in #15121
• ⏱️ feat: Shared Time Picker for Schedule Times by @berry-13 in #15122
• 📇 feat: Surface Event Child Activity Through a Bounded Parent Index by @danny-avila in #15142
• 🪹 feat: Shared Empty State for Side Panels by @berry-13 in #15123
• ⏱️ feat: Show Elapsed Time Under the Streaming Response by @danny-avila in #15167
• 🧾 feat: Persist Authoritative Subagent Control Receipts by @danny-avila in #15168
• 🪶 feat: Support Non-Persistent Controlled Themes by @danny-avila in #15170
• 🎛️ feat: Expose Authoritative Subagent Controls by @danny-avila in #15169
• 🔌 feat: Background Execution Toggles for Actions & Plugin Tools by @danny-avila in #14407
• 🦺 feat: Configurable Baseline HTTP Security Headers by @danny-avila in #14445
• 🐚 feat: Nonce-Based Content Security Policy for the SPA Shell by @danny-avila in #14446
• 🪢 feat: Coalesce Bound Agent Event Bursts by @danny-avila in #15208
• 🧾 feat: Track Authoritative Agent Event Outcomes by @danny-avila in #15213
• ✏️ feat: Edit Pasted Text and Clear It on New Chat by @berry-13 in #15017
• 🩻 feat(langfuse): add tenant export telemetry by @upman in #15247
• 🪢 feat: Resume Bound Event Actors from Checkpoint Forks by @danny-avila in #15227
• 📬 feat: Serialize Bound Actor Event Mailboxes by @danny-avila in #15260
• 🧾 feat: Store Durable Event Actor Receipts by @danny-avila in #15265
• 🧵 feat: Unify Subagent Child Threads by @danny-avila in #15261
• 🧅 feat: Reveal Subagent Thread History and Event Detail on Demand by @danny-avila in #15283
• 🕸️ feat: Complete Keenable Web Search Provider by @danny-avila in #15288
• 🪢 feat: show Langfuse session link in shared chats by @upman in #15273
• 🎼 feat: Unify Agent Turn Execution Behind One Immutable Plan by @danny-avila in #15296
• 🫆 feat: Fingerprint Agent Context for Zero-Read Warm Continuation by @danny-avila in #15299
• 🤖 feat: make Event Actor HITL durable by @danny-avila in #15305
• 🪂 feat: Make Event Actor Detached Actions Durable by @danny-avila in #15307
• 🍱 feat: Guide Compaction With a Bounded Semantic Index by @danny-avila in #15340
• 📬 feat: Establish Background Continuation Admission by @danny-avila in #15348
• 🛑 feat: Cancel MCP Discovery Work at the Caller Deadline by @danny-avila in #15353
• 🛄 feat: Restore Compaction Guidance Across Continuations by @danny-avila in #15356
• 🛎️ feat: Wake Agents on Background Tool Completion by @danny-avila in #15350
• 🍵 feat: Continue Late Steers in Warm Agent Runs by @danny-avila in #15357
• 🧩 feat: Collapsible Wake-Up Task Cards and Subagent UI Consistency by @danny-avila in #15364
• 🗿 feat: Add Attached Stateful Code Environments by @danny-avila in #15352
• 🧲 feat: Enable Secure Attached Environment Pairing by @danny-avila in #15355
• ✅ feat: Delivery Receipt Checkmarks for Steered Messages by @danny-avila in #15376
• 🧳 feat: Register Principal-Owned Code Environments by @danny-avila in #15365
• 🧠 feat: Retain Subagent Reasoning Like Main Chat and Drop the Running Status Chip by @danny-avila in #15379
• 📬 feat: Move Agent Queued Turns Server-Side by @danny-avila in #15370
• 🪗 feat: Fold a Live Run's Tool-Call Groups Into the Phase Card by @danny-avila in #15434
• 🪶 feat: Enable Standalone Skill Authoring by @danny-avila in #15480
• 🛫 feat: Enable Self-Service Code Worker Pairing by @danny-avila in #15367
• 🛞 feat: Manage Personal Code Environment Lifecycles by @danny-avila in #15369
• 🧺 feat: Preserve Partial Work at Tool Call Limits by @berry-13 in #15486
• 🧤 feat: Enforce Safe BYOM Tool Approvals by @danny-avila in #15503
• 🔭 feat: Audit PII Filter Findings by @danny-avila in #15508
• 🕹️ feat: Configure BYOM Tool Permissions by @danny-avila in #15504
• 📖 feat: Add Claude Fable 5.1 Support by @danny-avila in #15512
• 🪪 feat: Propagate Tenant to Agent Model Headers by @dustinhealy in #15521
• ⏭️ feat: Honor an Interrupt Before the Model Has Answered by @danny-avila in #15491
• ⚡ feat: Add Gemini 3.8 Flash Support by @danny-avila in #15519
• 🧊 feat: Persist Context Fading Tier Across Agent Runs by @danny-avila in #15505

🐛 Fixes Copy Anchor Link
• 🔑 fix: Honor User-Provided MCP API Key Instead of Forcing OAuth by @danny-avila in #13954
• 🪙 fix: Count Quote Tokens on Message Edit by @danny-avila in #13958
• 📋 fix: Route Clipboard Paste Through Upload Options by @dustinhealy in #13957
• 📇 fix: Index sharedlinks updatedAt for Cosmos DB Sorts by @danny-avila in #13979
• 📂 fix: Mount Skill Files Under skills/ in Code Interpreter by @danny-avila in #13961 and #13975
• 🪟 fix: Re-measure Sidebar Chat List on Width Change to Fix Date-Group Spacing by @danny-avila in #13981
• 📏 fix: Make create_file Missing-Content Error Truncation-Aware by @danny-avila in #14043
• fix: use logAxiosError at the RAG file_search/context call sites by @mawburn in #14014
• fix: stripHeavyErrorFields Winston format (defense-in-depth) by @mawburn in #14018
• 📥 fix: Download Original File From Artifact Preview Panel for Office Documents by @berry-13 in #14026
• 🔥 fix: Firebase CDN Initialization Under tsdown CJS Interop by @jakacenta in #14046
• fix: preserve role SHARE permissions across boot in initializeRoles by @mawburn in #14022
• fix: bound peak memory of concurrent base64 attachment encoding by @mawburn in #14023
• 📧 fix: Add .eml (message/rfc822) Support to File Upload by @Zirkonium88 in #13989
• 🚪 fix: Support Admin Redirect Detection for Same-Origin Subpaths by @arjunvijay24 in #14040
• 🩹 fix: Coerce Stringified edit_file Edits (JSON-in-JSON) by @danny-avila in #14056
• 🧠 fix: Apply Bedrock thinking config to bare inference-profile model IDs by @danny-avila in #14054
• 🧠 fix: Default Bedrock thinking maxTokens to model max output by @danny-avila in #14058
• fix: stop the artifact-edit retry loop on unrecoverable 400s by @mawburn in #14060
• 🎣 fix: Surface Resumable Stream Start Errors by @danny-avila in #14072
• 🧯 fix: Harden Principals Cache Invalidation and Lock-Wait Paths by @danny-avila in #14120
• 🏁 fix: Ignore Finalized SSE Transport Errors by @danny-avila in #14114
• fix: fall back to _id for user id in createSafeUser by @mawburn in #14083
• 🌏 fix: guard IME composition on Enter in prompt name/labels and dynamic tag inputs by @mahirhir in #13996
• 🗄️ fix: Return Cached Transaction-Support Value on Cache Hit by @Osamaali313 in #13999
• 🧠 fix: Format Reasoning Exports by @danny-avila in #14116
• 🧮 fix: Prevent String Corruption of Numeric Agent Model Parameters by @danny-avila in #14119
• 🧢 fix: Raise Claude Sonnet 4.6 Output Cap by @danny-avila in #14115
• 🧵 fix: Preserve Fenced Markdown Artifacts by @danny-avila in #14121
• 🔒 fix: Prevent Role Grants on Shared Links by @danny-avila in #14137
• 🤐 fix: Exclude Provider Secrets from HITL Pending Actions by @danny-avila in #14136
• ⏳ fix: Defer MCP Connection for Request-Scoped Placeholders on Reinitialize by @danny-avila in #14148
• 🧷 fix: Align Agent File Attachment Ownership by @danny-avila in #14149
• 🧊 fix: Include Conversation Starters in Agent View and List Responses by @serhiizghama in #14142
• ♊ fix: Resolve Local JSON Pointer Refs & Sanitize Tool Search Schema for Gemini by @usnavy13 in #14161
• 🛡️ fix: Guard HITL checkpoint size against MongoDB 16MB limit by @danny-avila in #14157
• 🔡 fix: Normalize Email Case When Issuing Verification Tokens by @VictorEPlus in #14172
• 🪜 fix: Apply Recursion Limit Config to Subagents by @danny-avila in #14185
• 💂 fix: Enforce ALLOW_EMAIL_LOGIN on the Backend Login Route by @lurkerCha in #14180
• 🧩 fix: Allow compatibility Field in Skill Frontmatter by @danny-avila in #14189
• 📎 fix: Translate Finite supportedMimeTypes Allowlists to Picker Accept by @danny-avila in #14186
• 🪆 fix: Serve Nested Skill Files Through a Wildcard Route by @danny-avila in #14191
• 🃏 fix: Attach Request-Scoped MCP Servers From the Builder via the mcp_all Wildcard by @adamscross04 in #14177
• 🔍 fix: Sync Conversation Title Updates to MeiliSearch by @danny-avila in #14223
• 👻 fix: Guard Redis Stream Resume Against Disposed HITL Graph by @danny-avila in #14258
• 🤝 fix: Discover MCP OAuth Exchange Methods by @danny-avila in #14256
• 👋 fix: Terminate Streamable HTTP MCP Sessions on Teardown by @danny-avila in #14252
• 🗂️ fix: Route read_file Through the Stateful Code Session by @danny-avila in #14259
• 💭 fix: Default GPT-5.6 Reasoning Requests to Responses API by @jomspk in #14232
• 🔖 fix: Preserve Ephemeral Agent Params and Identity for ask_user_question Resume by @jjhidalgar-celonis in #14254
• 🎫 fix: Strip Reserved Fields From Bedrock additionalModelRequestFields by @danny-avila in #14246
• 📱 fix: Single-Tap Select for Pinned Agents, Model Specs & Models on Touch by @danny-avila in #14272
• 🧽 fix: Clear Deleted Chats From Message Cache by @danny-avila in #14270
• 🧟 fix: Prevent Drained Steer From Re-Queuing After Run-End Race by @danny-avila in #14276
• 🙋 fix: Await ask_user_question Tool Factory in loadTools by @danny-avila in #14291
• 🧷 fix: Flush Pending File Deletion on Unmount by @danny-avila in #14293
• 🙋 fix: Stop Answered ask_user_question Card From Reopening Its Popover by @danny-avila in #14297
• 🔒 fix: Scope, Cap, and De-Execute the In-Flight Steer Stack by @danny-avila in #14310
• 📱 fix: Don't Connect the Favorites Drag Source on Touch Pointers by @danny-avila in #14312
• 🧵 fix: Harden Request-Scoped MCP Lifecycle by @danny-avila in #14342
• 🪆 fix: Build RAG-API Chart Before Parent to Bundle PostgreSQL Dependency by @Aho-Bakaa in #14262
• 🚪 fix: Keep Owners From Being Locked Out of Their Own Resource When Sharing by @danny-avila in #14347
• 🚏 fix: Route Admin-Configured Document Types to RAG /text on Agent Upload by @danny-avila in #14345
• 🎟️ fix: Claim Idempotency Keys to Dedup Retried Generation Requests and Prevent Double Billing by @danny-avila in #14344
• 🧠 fix: Restore Agent Memory Scope Control in Unified Builder by @danny-avila in #14292
• 🛟 fix: Keep File Uploads Alive With SSE Heartbeats by @MarcAmick in #14295
• 🧩 fix: Preserve Deployment Skill IDs on Agents by @danny-avila in #14368
• 🧭 fix: Keep Message Nav Chevrons Working on In-Thread Steers by @danny-avila in #14377
• 🤐 fix: Withhold MCP OAuth Headers From Untrusted Preconfigured Discovery by @danny-avila in #14379
• 🔗 fix: Preserve resource owner access when sharing (key share diff by stable id) by @jomspk in #14317
• 🪆 fix: Preserve Nested Subagent Delegation by @danny-avila in #14392
• ✋ fix: Enable Submit on First Tool-Approval Decision by @danny-avila in #14393
• 🎞️ fix: Surface Clear Error for Unprocessable Gemini YouTube Videos by @danny-avila in #14396
• 📌 fix: Pin Scroll-to-Bottom Rib in Message Nav by @danny-avila in #14397
• 🫙 fix: Preserve Loaded Message Content When Resume Snapshot Is Empty by @danny-avila in #14399
• 🎯 fix: Correct Off-by-One Rail Scrub After Pinning the Terminus by @danny-avila in #14409
• ♾️ fix: Preserve Resumable Stream Ordering Across Turns by @danny-avila in #14411
• 🧩 fix: Harden Agent Skill Lifecycles End to End by @danny-avila in #14429
• 📧 fix: Restore invite-user CLI by @unsnow-iac in #14436
• 🔗 fix: Resolve MCP Tool-Key Boundary Against Configured Server Names by @danny-avila in #14448
• 🍃 fix: Strip $-Prefixed Schema Keywords Before Persisting MCP Tool Params by @danny-avila in #14464
• 🔗 fix: Render Shared Links Containing Steers by @danny-avila in #14480
• 🔒 fix: Bound /files/usage TTL Hold Instead of Clearing It by @danny-avila in #14470
• 🤏 fix: Filter Admin Config Reads by Section-Scoped Read Capability by @dustinhealy in #14472
• 🍃 fix: Amazon DocumentDB Compatibility for Pipeline-Form Updates by @danny-avila in #14495
• 🛡️ fix: validate message feedback payloads by @upman in #14500
• 🧩 fix: Apply Every Entry of Multi-Part Stream Deltas by @danny-avila in #14502
• 🏷️ fix: Re-attribute Agent Content After In-Thread Steers by @danny-avila in #14497
• 🎯 fix: Keep Run Steps and Labels in One Index Space After a Resume Sync by @danny-avila in #14516
• 🪶 fix: Yield Soft Default Model Spec to Agent Picks in Picker-Only Deployments by @danny-avila in #14515
• 🪟 fix: Surface MCP Initialization Errors by @danny-avila in #14529
• 🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect by @schumajs in #14538
• 🔒 fix: Remove Owner Email from Agent owner_contact Fallback by @danny-avila in #14541
• 📄 fix: Filter Non-PDF Documents on the Anthropic Encode Path by @danny-avila in #14535
• 🎯 fix: Exact Ask-Question Attribution via Interrupt tool_call_id by @danny-avila in #14539
• 🧹 fix: Clean Up MCP OAuth State Mappings on Uninstall + Reject Superseded Callbacks by @danny-avila in #14549
• 🧠 fix: Preserve Deferred Tool Schemas Across HITL Resume by @danny-avila in #14552
• 🦗 fix: Ignore Sequenced Redis Events Without SSE Subscribers by @danny-avila in #14557
• 🔗 fix: Normalize MCP Tool Keys at Every Producer, Resolve Raw Names via Aliases by @danny-avila in #14553
• 🏢 fix: Preserve Tenant Context for Partial Response Saves on Disconnect by @danny-avila in #14567
• 🦗 fix: Deliver Abort Acknowledgements on Zero-Subscriber Replicas by @danny-avila in #14569
• 🏷️ fix: Skip Title Generation for Preempt-Incomplete Turns by @danny-avila in #14571
• 🪧 fix: Guard Admin OAuth Routes When Providers Are Not Configured by @cyphercodes in #14507
• 🔗 fix: Resolve Relative Skill Markdown Links by @berry-13 in #14586
• 🧭 fix: Drop v6-Only MemoryRouter future Prop from Skill Markdown Spec by @danny-avila in #14588
• 🪪 fix: Strip Unresolved Header Placeholders at Final Resolution by @danny-avila in #14595
• 🔒 fix: Single-Flight MCP OAuth Token Refresh per User/Server by @danny-avila in #14596
• 🪺 fix: Keep Preempt-Abandoned Siblings Nested, Make Message Tree Order-Robust by @danny-avila in #14587
• ⌨️ fix: Honor defaultPrevented in Global Shortcut Dispatch by @danny-avila in #14570
• 🪢 fix: Bind MCP OAuth Secrets to Trusted Endpoints by @danny-avila in #14578
• ⚓ fix: Bind Action Servers to Metadata Ports by @danny-avila in #14575
• 🧱 fix: Enforce Agent Runtime File Trust Boundaries by @danny-avila in #14577
• 📏 fix: Scope Skill Command Query to Text Before the Caret by @danny-avila in #14604
• 🧬 fix: Resolve URL-Named Model Spec to Its Full Preset on Cold Load by @danny-avila in #14610
• ✂️ fix: Truncate Overflowing Activity and Intent Labels in Chat UI by @danny-avila in #14607
• 🚦 fix: Bound, Single-Flight, and Retry Skill File Priming Uploads by @danny-avila in #14611
• 🧹 fix: Exclude Mongo ID From Conversation Updates by @danny-avila in #14631
• ♿️ a11y: improve keyboard operability, focus retention, and accessible naming by @berry-13 in #14600
• 🚏 fix: Localized Guidance for Model-Not-Found Errors by @danny-avila in 557c22d102
• 🛡️ fix: Run message-filter PII patterns on a linear-time regex engine (ReDoS) by @dustinhealy in #14554
• 🪢 fix: disable central fanout media uploads for langfuse by @upman in #14642
• 🧭 fix: Fail Closed When Expected MCP Tools Are Unavailable by @danny-avila in #14646
• 🛂 fix: Honor Claude Document Limits Through Inference Gateways by @danny-avila in #14650
• 🎟️ fix: Reconcile MCP OAuth Readiness Across Pods by @danny-avila in #14629
• 🌊 fix: Preserve Custom Endpoint streamRate When endpoints.all Is Defined by @danny-avila in #14645
• 🔐 fix: Preserve Structured JWT Auth Context by @danny-avila in #14652
• ⏱️ fix: Compile admin file-config MIME patterns on a linear-time engine (ReDoS) by @dustinhealy in #14555
• 🛡️ fix: SSRF-Guard Speech (STT/TTS) and OCR Outbound Requests at Connect Time by @dustinhealy in #14560
• 🔁 fix: Re-Arm Soft Default When a Stored Agent No Longer Resolves by @danny-avila in #14664
• 🔗 fix: Prevent duplicate share rows from clobbering pending role edits (dedupe adds by stable id) by @jomspk in #14655
• 🛟 fix: Stop Agents When Code Resources Cannot Recover by @danny-avila in #14651
• ♿ fix: Restore WCAG AA Contrast for Text Tokens & Hide Edit Action While Streaming by @danny-avila in #14677
• 🩹 fix: Keep Edit Action Fully Hidden While Streaming by @danny-avila in #14687
• 📡 fix: Refresh MCP Tools After List-Changed Notifications by @danny-avila in #14686
• 🧬 fix: Rebind Request Context After Remote Agent Auth by @danny-avila in #14685
• 🧭 fix: Make MCP Catalog Redis Cluster-Safe by @danny-avila in #14717
• 🧬 fix: Normalize Legacy MCP Null Headers by @danny-avila in #14720
• 📁 fix: Consistent Export Filenames Across Formats by @lidonius1122 in #14708
• 🧷 fix: Safely Recover Runtime MCP OAuth Rejections by @danny-avila in #14684
• 🪆 fix: Rebase Activity Phase Bounds over Sparse Content by @danny-avila in #14729
• 📎 fix: Re-enable Send After File Upload by @danny-avila in #14727
• 📸 fix: Guard Screenshot Export Against Main-Thread Freezes by @danny-avila in #14733
• 🔐 fix: Preserve Plugin MCP Provenance Through Registry Storage by @danny-avila in #14744
• 🧭 fix: Re-Anchor Parent Activity Phase Bounds by @danny-avila in #14741
• 🧷 fix: Preserve Elicitation Answers Across Aborts by @danny-avila in #14745
• 📡 fix: Preserve Redis Abort Terminal Delivery by @danny-avila in #14749
• ⌨️ fix: allow file upload shortcut when editing by @likeabas in #14764
• 🛟 fix: Isolate Invalid Skills During GitHub Sync by @berry-13 in #14735
• 🎙️ fix: Align Speech Engine Configuration With Runtime by @berry-13 in #14736
• 🧩 fix: Normalize Malformed MCP Required Schemas by @danny-avila in #14771
• 🧾 fix: Honor Disabled Transactions on the Token-Count Fallback Path by @jtodaroii in #14774
• 🛰️ fix: Attach Request-Scoped MCP Servers by @danny-avila in #14780
• 📱 fix: Show Quote Popup for Block Selections and on Touch Devices by @danny-avila in #14777
• 🪑 fix: Rebase Activity Phase Bounds Onto Compacted Content and Unskip the MCPManager Suite by @danny-avila in #14782
• 🔖 fix: Split Activity Phases at Substantial Text by @danny-avila in #14785
• 🖌️ style: Use correct text colour for answer textarea in dark mode by @lizzykerrigan in #14791
• 🩹 fix: Restore the @librechat/api Build and Remove Legacy Code by @danny-avila in #14808
• 🩹 fix: apply agent updates that match the newest version entry by @mihidumh in #14810
• 💬 style: Right-Align In-Flight Steer Bubbles to the Message UI by @danny-avila in #14814
• 🔌 fix: Preserve MCP serverInstructions Declaration Through Inspection by @danny-avila in #14815
• 🔌 fix: Recover Quietly From Stale MCP SSE Stream Conflicts by @danny-avila in #14816
• 📎 fix: Alias Shell Script MIME Variants to application/x-sh by @danny-avila in #14817
• 🪢 fix(langfuse): mark provider-backed agent traces by @upman in #14833
• 🔔 fix: Report Agent Saves That Reuse the Newest Version Entry by @berry-13 in #14824
• 🏘️ fix: Scope OpenID User Cache Keys to Signed User Identity by @danny-avila in #14837
• ⚡ fix: avoid modal attachment menu overhead by @danny-avila in #14847
• ⬇️ fix: Keep Scroll-to-Bottom Clear of the In-Flight Steer Stack by @danny-avila in #14844
• 🐛 fix: Give the Header's Sidebar Toggle Its Own Test Id by @danny-avila in #14850
• fix: copy only assistant response text by @berry-13 in #14853
• 🌗 fix: Keep Code Block Header Visible in User Messages by @berry-13 in #14856
• 📐 fix: Size the Model Picker to Its Content by @berry-13 in #14859
• 🩺 fix: Render Stopped Run Steps From Explicit Status by @danny-avila in #14871
• 📡 fix: Publish App-Level MCP Tool Catalogs Without a Reserved Revision by @danny-avila in #14858
• 🧩 fix: Normalize MCP UI Resource Rendering by @danny-avila in #14868
• 🎙️ fix: Prefer Compatible Formats for External STT Recording by @berry-13 in #14864
• 📋 fix: Stop the Copy Button From Clobbering the Clipboard by @berry-13 in #14876
• 🩹 fix: Stop Archived and Shared Chats Dialogs Crashing on Open by @berry-13 in #14886
• 🏷️ fix: Model Spec Menu Label and Agent Avatar Fallbacks by @danny-avila in #14887
• 🔙 fix: Stop Stacking History Entries on New-Chat Param Changes by @danny-avila in #14891
• 📌 fix: Fetch Pinned Chats Independently of the Chats List by @berry-13 in #14860
• 🕰️ fix: Stop Pinning and Archiving From Counting as Chat Activity by @berry-13 in #14861
• 🪟 fix: Resolve Context Windows and Pricing for Newer Model Families by @berry-13 in #14877
• 🖱️ fix: Reveal Message Metadata on Hover, Not on Click by @berry-13 in #14900
• 🏷️ fix: Persist the Ephemeral Agent's Display Label as Sender by @danny-avila in #14899
• 🧩 fix: Align Tenant and MCP Configuration Resolution by @danny-avila in #14904
• 🌉 fix: Preserve Missing Locize Translations by @danny-avila in #14917
• 🔐 fix: Repair Locize PR Authentication by @danny-avila in #14918
• 📚 fix: Keep English Source Repository-Owned by @danny-avila in #14920
• 🚏 fix: Preserve Endpoint Routing on HITL Resume Replay by @danny-avila in #14948
• 🌐 fix: Scrollable Language Dropdown in Shared Chat Settings by @berry-13 in #14954
• 🔒 fix: Hide Sensitive Input in Reset-Password CLI by @jacksonriding in #14923
• 💻 fix(agents): require Code Interpreter for programmatic MCP tools by @upman in #14977
• 🪪 fix: Preserve Stored Access Token Expiry Over ID Token Exp by @dustinhealy in #14982
• 🪢 fix: Harden Langfuse Media Upload Targets by @upman in #14974
• 🙋 fix: Free the Composer When a Question Pause Collapses by @danny-avila in #15011
• 🛂 fix: Preserve OpenID Re-Auth Errors Through MCP Tool Error Classification by @dustinhealy in #15010
• 🪂 fix: Land Navigation Auto-Scroll on the Rendered Thread by @danny-avila in #15014
• 📎 fix: Never Let a Stalled Attachment Disable the Composer by @danny-avila in #15013
• 🪪 fix: Preserve Detached Subagent Owner Context by @danny-avila in #15015
• ✂️ fix(agents): warn when skill descriptions are truncated in the model catalog by @putramkti in #14878
• 🔓 fix: Unblock Detached Subagent Preparation by @danny-avila in #15016
• ♿ fix: Keep Portaled Dropdown Menus Clickable Inside Modal Dialogs by @berry-13 in #15026
• ♿ fix: Resolve axe Violations in Sidebar, Tools Dropdown and Footer by @jtodaroii in #14979
• 🎡 fix: Scheduled Chat Slot Accounting and Reconciliation Rotation by @danny-avila in #15040
• 🗓️ fix: Hide Unsupported Schedule Variables by @danny-avila in #15053
• 🧵 fix: Hide Child Threads From Navigation by @danny-avila in #15041
• 🛑 fix: Confirm Scheduled Stops and Separate Terminal Scheduler Failure from Startup by @danny-avila in #15051
• 🧵 fix: Close Child-Thread Read and Search-Cleanup Gaps by @danny-avila in #15055
• 📱 fix: Recover the Stream After a Mobile Tab is Backgrounded by @danny-avila in #15050
• 🛟 fix: Report Skill Sync Files Whose Paths Cannot Be Mirrored by @danny-avila in #15067
• 🔭 fix: Attach to Runs This Pane Did Not Start by @danny-avila in #15074
• 🪪 fix: Support MCP Server Titles With Hyphens by @danny-avila in #15094
• 📄 fix: Serve Stored Text for "Upload as Text" File Downloads by @lidonius1122 in #14723
• 🪢 fix: Preserve Response Identity and Branch During Resumable SSE Sync by @Falenos in #14788
• ✂️ fix: Strip Redundant Server-Name Prefixes from MCP Tool Keys by @dustinhealy in #14732
• 🪡 fix: Thread Parent Message ID Through MCP Request-Scoped Bodies by @danny-avila in #15095
• 🖼️ fix: Restore Shared Subagent Activity as a Read-Only View by @danny-avila in #15108
• 🧯 fix: Prevent Quote Popup Update Loop by @danny-avila in #15113
• 🚦 fix: Restrict Programmatic Tool Execution Maps by @danny-avila in #15105
• 🛂 fix: Preserve Legacy Assistant Attribution by @danny-avila in #15118
• 🧾 fix: Report Complete Agents API Usage by @danny-avila in #15127
• 📏 fix: Size Agent Builder Tool and Skill Rows by @berry-13 in #15134
• 🫂 fix: Route Subagent Activity Through the Chat Renderer by @danny-avila in #15137
• 🧪 fix: Mock the Parent Subagent Index Handler in Convos Route Tests by @danny-avila in #15146
• 🪶 fix: Polish Event Subagent Activity by @danny-avila in #15152
• 📭 fix: Detect Agent List Pages in useHasData by @jomspk in #15156
• 🎽 fix: Commit Subagent Roster Selections to Form State by @danny-avila in #15154
• 🩹 fix: Restore Provider Typing Against the Agents SDK Declarations by @danny-avila in #15161
• 🕯️ fix: Decay Violation Scores With a Configurable TTL by @danny-avila in #15153
• 🥁 fix: Compare TOTP Codes in Constant Time by @pacocartones in #15157
• 🧳 fix: Port Subagent Control Receipt Writes to DocumentDB-Safe Operators by @danny-avila in #15171
• ✂️ fix: Unclip the Share Dialog's Public Role Menu by @danny-avila in #15177
• 🧮 fix: Currency-Safe Single-Dollar LaTeX via Micromark Tokenizer by @danny-avila in #15181
• 🫗 fix: Drain Quoted Excerpts Into Mid-Run Steering by @danny-avila in #15175
• 📌 fix: Keep the Settled Turn Mounted Through Final Content Compaction by @danny-avila in #15186
• 🪢 fix: Persist Failed Agent Turns Before Error Publication by @danny-avila in #14118
• 📐 fix: Set the Elapsed Reading on the Column Its Neighbors Share by @danny-avila in #15195
• 🧾 fix: Honor Disabled Transactions on the Abort Paths by @jtodaroii in #15099
• 🥛 fix: Drop Stale Saved Model Defaults in Builder Forms by @upman in #15179
• 🧾 fix: Honor Disabled Transactions on the Assistants Usage Path by @jtodaroii in #15100
• 🎛️ fix: Withhold the Seeded Model Catalogue Until Models Resolve by @berry-13 in #15035
• 🕶️ fix: Unhide Event Subagent Names on the Dark Surface by @danny-avila in #15206
• 🛑 fix: Separate Agent Event Backpressure From User Bans by @danny-avila in #15200
• ⏳ fix: Anchor Resumed Elapsed Time at the Generation's Real Start by @danny-avila in #15204
• 🧠 fix: Correct Memory Token Accounting by @danny-avila in #15224
• 🎢 fix: Restore Schedule Dialog Scrolling So Save Stays Reachable by @danny-avila in #15225
• 🗄️ fix: support DocumentDB aggregations for insights by @upman in #15226
• 🔁 fix: Rerun a Message the Editor Has Not Changed by @berry-13 in #15212
• 🧮 fix: Render Google Settings From the Shared Schema and Bound Them Per Model by @berry-13 in #14989
• 🧠 fix: Apply the Configured Reasoning Effort to Summarization by @danny-avila in #15232
• 🧢 fix: Bound Tokenizer Work Per Input by @danny-avila in #15246
• 🔣 fix: Escape SPA Language Attribute by @danny-avila in #15248
• 🪺 fix: Heal MCP HITL Aliases Through Nested Subagents by @danny-avila in #15258
• 🧢 fix: Cap Batched HITL Answers Before PII and Moderation by @danny-avila in #15257
• 🖇️ fix: Bind Model-Spec Authorization to the Loaded Agent by @danny-avila in #15256
• 📮 fix: Screen User-Supplied Structured Tool Endpoints by @danny-avila in #15253
• 🪪 fix: Preserve SAML NameID Bindings by @danny-avila in #15254
• 🧬 fix: Harden SAML Identity Binding by @danny-avila in #15264
• 🛗 fix: Anchor Message Nav Gestures to One Measured Rib Layout by @danny-avila in #15272
• 🌐 fix: Expose Gemini Models to Vertex AI Agents by @danny-avila in #15234
• 🥫 fix: Refuse to Boot on Retired JWT Secret Defaults by @danny-avila in #15282
• 📌 fix: Keep Pinned Chats Pinned Through a New Turn by @berry-13 in #15230
• 🧷 fix: Verify Scheduled HITL State Before Pausing by @danny-avila in #15284
• ♟️ fix: Settle First Bound Actor Events by @danny-avila in #15300
• 🎰 fix: Merge Message Provenance With Compare-and-Swap Retries by @danny-avila in #15304
• 🧵 fix: Retry Shared Links After Message Persistence Gaps by @danny-avila in #15306
• 🎫 fix: Exclude System Tenant Sentinel from Code API JWT Claims by @danny-avila in #15316
• 🪪 fix: Reject ID Tokens as the OpenID Bearer Reuse Access Token by @danny-avila in #15317
• 🕰️ fix: Guard expires_in So a Token Response Cannot Outlive Its Credential by @danny-avila in #15321
• 🪧 fix: Advertise Detached Event Actor Support from the Generation Store by @danny-avila in #15322
• 🪪 fix: Admit Confirmed Generation Retries Before Message Limits by @danny-avila in #15341
• 🫀 fix: Reconcile Completed Runs Behind Apparently Open Streams on Foreground by @danny-avila in #15342
• 🐺 fix: Stop Routine MCP Teardowns From Failing Concurrent Tool Calls by @danny-avila in #15333
• 📭 fix: Drop Empty Summary Parts Before Persistence by @danny-avila in #15338
• 🔒 fix: Refresh MCP OBO Tokens From the Live OpenID Session by @danny-avila in #15334
• 👔 fix: Route Flux Finetuned Endpoints Regardless of Action by @AyushCipher in #15336
• 🪭 fix: Settle Parent Phase Cards Without Replaying the Entrance Fold by @danny-avila in #15345
• 🔊 fix: Autoplay Latest Message for Browser TTS and short responses by @danny-avila in #15347
• 🔄 fix: Recover Missing MCP Marketplace Catalogs by @dustinhealy in #15323
• 🛎️ fix: Enroll Remote Agent Runs in the Generation Lifecycle by @danny-avila in #15349
• ⏱️ fix: Bound MCP Tool Discovery With a Caller Deadline by @danny-avila in #15346
• 🧺 fix: Skip Oversized and Duplicate Files Instead of the Whole Batch by @danny-avila in #15358
• fix: log config-blocked MCP recovery at debug instead of error by @danny-avila in #15360
• 🏕️ fix: Restore Code Environments From Runtime Config by @danny-avila in #15373
• 📜 fix: Resolve MCP Server Instructions for Startup-Deferred Servers by @danny-avila in #15361
• 🧳 fix: Carry Stateful Environments Through Runtime Config by @danny-avila in #15374
• 🍃 fix: Restore Amazon DocumentDB Compatibility Across Trigger and Subagent Writes by @danny-avila in #15375
• 🧪 fix: Align Detached Activity E2E With the Removed Running Chip by @danny-avila in #15382
• 🪟 fix: Keep the Subagent Panel Steady and Honest Across Event Deliveries by @danny-avila in #15387
• 🍃 fix: Send a Pure Inclusion Projection From the Legacy Receipt Sweep by @danny-avila in #15390
• 🎛️ fix: Settle New Turns at the Bottom, Steady Status Dots, and Elapsed Time in the Panel by @danny-avila in #15394
• 🖍️ fix: Honor Agent Image Detail Settings by @danny-avila in #15407
• 🪁 fix: Keep Tool Flyouts in View by @alexsr1 in #15404
• 🧰 fix: Keep File-Backed Agent Capabilities and Their Saved Tools in Agreement by @danny-avila in #15418
• 🧷 fix: Attach to a Continuation the Finished Run Left Behind by @danny-avila in #15414
• 🕰️ fix: Anchor Temporal Prompt Variables to Turn Start by @danny-avila in #15419
• 🧷 fix: Fence Server-Admitted Queue Boundaries by @danny-avila in #15393
• 🧴 fix: Strip LangChain URLs From Provider Errors by @danny-avila in #15421
• 🧿 fix: Restore Shared IP Limits for Generation Retries by @danny-avila in #15427
• 🫀 fix: Expire Aborted Background Tool Leases by @danny-avila in #15428
• 🧺 fix: Funnel MCP Catalog Work Through a Shared Gate by @danny-avila in #15429
• 🔐 fix: Redirect OAuth Browser Navigations Instead of Rendering JSON by @berry-13 in #15440
• 🎯 fix: Keep the Thinking Label on the Lightbulb's Axis While Shimmering by @danny-avila in #15437
• 🖼️ fix: Give a Phase's Files Their Own Media Row by @danny-avila in #15435
• 🧩 fix: Scope Each Image's Digest Artifacts to Its Own Manifest Merge by @danny-avila in #15444
• 🛄 fix: Refresh Stale Skill File References by @putramkti in #15413
• 🩹 fix: Stop the Subagent Composer Unmounting, and Give It Main Chat's Shape by @danny-avila in #15448
• 🗂️ fix: Resolve Code Interpreter Destination Collisions by @danny-avila in #15449
• 🧲 fix: Draw OpenID Refresh Lookups Into System Context by @danny-avila in #15451
• 🚦 fix: Downgrade Stale Generation Fence Telemetry by @danny-avila in #15452
• 🖼️ fix: Stop Reporting a Failed Sandbox Image Read as an Unreadable Format by @danny-avila in #15453
• 🪄 fix: Reuse Downloaded Artifacts for Image Reads by @danny-avila in #15454
• 🪂 fix: Preserve Subscribers Through Terminal Handoffs by @danny-avila in #15462
• 🫴 fix: Hand Composer Focus Back After Upload Dialogs by @danny-avila in #15469
• 📎 fix: Keep SharePoint Picker Selections While Navigating by @danny-avila in #15389
• 🔐 fix: Keep OpenID Metadata Out of Logs and Traces by @danny-avila in #15470
• 🎖️ fix: Apply Fallback Role on Group Overage by @danny-avila in #15472
• 🛄 fix: Reclaim Pending MCP OAuth Prompts on Resume by @danny-avila in #15471
• 🚮 fix: Replace Backtracking LangChain Error Regexes by @danny-avila in #15473
• 🧫 fix: Contain Detached Tool Output by @danny-avila in #15476
• 🗿 fix: Bound Background Task Retention by @danny-avila in #15477
• 🧶 fix: Preserve Multi-Agent Tool Call History by @danny-avila in #15468
• 🧲 fix: Anchor Memory Partitions to Accessible Agents by @danny-avila in #15475
• 🫥 fix: Clear Hidden MCP Chat Selections by @danny-avila in #14159
• 🔑 fix: Decode Action OAuth Credentials After Decryption by @lidonius1122 in #14698
• 🛞 fix: Roll Overflow Tenant Labels Into Aggregate Metrics by @danny-avila in #15474
• 🚧 fix: Narrow Chat MCP Selections to What the Picker May Offer by @danny-avila in #15478
• 🔎 fix: Respect Search Page Limits in MeiliSearch Queries by @csdivad in #15482
• 🧳 fix: Carry Custom Endpoint Names Through Chat URLs by @abhishekbiswas772 in #15424
• 🔍 fix: Include Message-Matched Conversations in Sidebar Search by @csdivad in #15483
• 🔄 fix: Reindex MeiliSearch Documents After Indexed-Projection Changes by @csdivad in #15484
• 🧶 fix: Untangle Parallel Subagent Descriptor Paths by @danny-avila in #15492
• 🚢 fix: Reconnect Keyv Redis After Replica Failover by @danny-avila in #15502
• 🫱 fix: Keep Polling Through Queued Run Handoffs by @danny-avila in #15509
• 🛑 fix: Forward Run Abort Signal to Foreground Tool Calls by @danny-avila in #15517
• 🫙 fix: Drop Blank Content Blocks From Promptless Sends by @danny-avila in #15530

🔧 Refactoring and Performance Copy Anchor Link
• 🛫 refactor: Promote Generation Protocol V2 Automatically by @danny-avila in #15324
• 🎠 refactor: Route Every Event Actor Turn Through One Lifecycle by @danny-avila in #15325
• 🪩 style: Shimmer Live Reasoning Labels and Timers by @danny-avila in #15431
• ✔️ style: Anchor the Applied Steer Receipt and Name Tool Calls in Its Interrupt Copy by @danny-avila in #15450
• 🧵 refactor: Give the Subagent Panel One Composer and Main Chat's Metrics by @danny-avila in #15436
• 🐆 perf: Build Dev Branch Images on Native ARM and Cheapen Asset Brotli by @danny-avila in #15441
• ♻️ refactor: Compute Context Gauge Client-Side, Drop Projection Endpoint by @danny-avila in #13953
• 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads by @danny-avila in #13978
• 🦥 perf: Lazy-Load Agent Version History in Editor by @danny-avila in #13977
• 🛗 perf: Fetch Pinned Agents Directly Past the Global Agents Map by @danny-avila in #13972
• ⚡ perf: memoize FavoritesList and BookmarkNav to prevent re-renders during streaming by @berry-13 in #14011
• 🗺️ refactor: Light Up In-Viewport Ribs at Rest in Message Nav by @danny-avila in #14041
• ⚡ perf: Minimize group membership query in principal resolution by @danny-avila in #14055
• ⚡ perf: Skip Role Route Capability Probe for Own and Default Roles by @danny-avila in #14073
• 🪭 refactor: safe structured failure logging for langfuse fanout gateway by @upman in #14050
• 📉 perf: Skip Redundant Permission Queries on MCP Servers List by @danny-avila in #14077
• ⚡ perf: Persist HITL checkpoints only on pause (lazy checkpointer) by @danny-avila in #14024
• 🗃️ perf: Cache Group Memberships for ACL Principal Resolution by @danny-avila in #14075
• ⚙️ perf: reduce first-load MongoDB round trips by @upman in #14101
• 🎯 style: Center Scroll-to-Bottom Rib in Message Nav Rail by @danny-avila in #14151
• 📉 perf: cache OpenID JWT user documents by @upman in #14187
• 📉 perf: start message queries before file map loads by @upman in #14188
• 🪜 style: Adjust rib dimensions and button sizes in MessageNav by @danny-avila in #14234
• 🪜 style: Center scroll-to-bottom marker in MessageNav by @danny-avila in #14238
• 🛞 style: Reveal the Steered "?" on Message Hover/Focus by @danny-avila in #14271
• 🙊 refactor: Clarify Ask Question Schema Errors and Retry Guidance by @danny-avila in #14279
• 💬 refactor: Anchor In-Flight Steers Above the Composer by @danny-avila in #14308
• ⚡ perf: Halve Per-Delta Redis Round Trips in Resumable Streams by @danny-avila in #14313
• 🧭 refactor: web_search Description on When To Search vs Answer Directly by @joshbla in #13930
• 🧷 perf: Stabilize Mutation-Dependent Memos in Chat Hooks by @danny-avila in #14328
• 🚰 perf: Suppress No-Op Conversation Writes and Widen-Proof Atom Subscriptions by @danny-avila in #14329
• 🔍 refactor: Surface primary OpenID JWT failure reason in auth failure log by @danny-avila in #14346
• 🧭 perf: Warm Conversation Switches with Single-Navigation Focus Intent by @danny-avila in #14334
• 🧹 perf: Share Voices Store, Gate Timestamp Ticker, Stabilize Greeting Springs by @danny-avila in #14335
• 🎞️ perf: Coalesce Streaming Delta Cache Writes Per Animation Frame by @danny-avila in #14332
• 🎛️ perf: Narrow Composer Subscriptions to Streaming State by @danny-avila in #14333
• 🧬 perf: Memoize Message Spine and Isolat

Original source

Updated Agents endpoint capabilities

• Added memory and ask_user_question to the default capability list
• Added highly experimental, opt-in stateful_code_sessions for reusable Code Interpreter workspaces; behavior and configuration may change substantially during experimentation
• Added opt-in run_in_background; Code Interpreter tools are background-eligible by default while MCP tools remain per-tool opt-ins
• Added opt-in tool_intents for live model-written labels on native and selected MCP tool calls

Added Agent activity-group settings

• activityLabel enables generated one-line headers for contiguous reasoning and tool-call blocks
• activityModel, activityEndpoint, and activityPrompt select and configure the header model call
• activityMaxPerRun and activityCharLimit bound additional calls and prompt input
• Fields can be set under endpoints.all, endpoints.agents, or the backing provider/custom endpoint and resolve independently by precedence

Added parent Agent activity-phase settings

• activityPhaseLabel generates a collapsed summary for run phases containing at least two logical activities
• activityPhaseModel, activityPhaseEndpoint, and activityPhasePrompt configure the summary model call
• activityPhaseMaxPerRun defaults to 5; activityCharLimit also bounds phase-summary evidence
• Phase settings fall back through activity-label, title-model, and current-run settings and use the same endpoint configuration precedence
• Short progress remains grouped, substantial answer text closes the active phase before the result, and later activity blocks can create another phase in the same run
• Persisted phase boundaries are rebased after content compaction so they remain aligned after reload

Added endpoints.agents.toolApproval

• Enables human approval for matching Agent tool calls
• Supports default, dontAsk, and bypass modes plus glob-based allow, deny, and ask rules
• Supports trusted programmatic hooks for context-aware approval policy; hooks can only make the static policy stricter

Added endpoints.agents.checkpointer

• Persists paused Ask User and tool-approval runs so they can resume later
• Uses MongoDB by default with a 24-hour TTL
• Supports configurable collection names and a process-local memory mode for development

Added summarization.retainRecent

• turns preserves a configurable number of recent complete conversation turns outside the summary
• tokens sets a recent token-retention budget

Updated automatic memory extraction

• memory.agent.enabled: true is now required to run the automatic memory agent
• Manual memories and Agent memory tools remain available when automatic extraction is off

Added model spec controls

• showInMenu can hide a spec from the selector while retaining trusted explicit spec access
• memory equips an ephemeral Agent with memory tools
• askUserQuestion enables durable question-and-resume flows
• runInBackground now accepts a boolean or resolved tool-ID list; false or [] opts out of background-native code tools
• describeIntent accepts a boolean or resolved tool-ID list for live tool intent labels

Added OpenAI reasoning controls

• reasoning_mode supports standard and pro
• reasoning_context supports auto, current_turn, and all_turns
• reasoning_effort now supports max on compatible models
• GPT-5.6 reasoning requests default to the Responses API unless useResponsesApi: false is set explicitly

Added top-level langfuse tenant configuration

• Stores enabled state, public key, encrypted secret key, verified project ID, masked secretKeyPreview, and an approved destination key
• Added an admin-only Settings → Langfuse connection flow with server-side credential verification
• Complete environment credentials take precedence in single-tenant deployments; fanout availability remains deployment-controlled
• Removed the legacy displaySecretKey and nested fanout.enabled fields
• Added opt-in Compose and Helm fanout deployment settings for central and tenant-scoped trace export
• Added LANGFUSE_FANOUT_LISTEN_ADDR to override the gateway's default :4318 listen address
• Added LANGFUSE_PROJECT_ID, LANGFUSE_TRACING_ENABLED, and deterministic LANGFUSE_SAMPLE_RATE
• Authorized administrators can open a sampled conversation's Langfuse session directly from the Context Usage breakdown

Expanded admin config secret handling

• Registered OCR, speech, web-search, Assistants, Azure Assistants, and Langfuse keys are encrypted and redacted on admin writes and reads
• endpoints.custom[].apiKey literals are encrypted; environment references and user_provided remain passthrough values
• Registered secret fields expose server-generated Preview companions

Added Node.js HTTP server timeout settings

• HTTP_KEEP_ALIVE_TIMEOUT_MS and HTTP_KEEP_ALIVE_TIMEOUT_BUFFER_MS
• HTTP_HEADERS_TIMEOUT_MS and HTTP_REQUEST_TIMEOUT_MS
• Values are non-negative milliseconds; 0 disables the corresponding timeout

Added Code Interpreter runtime settings

• CODE_SANDBOX_PREWARM controls stateful sandbox prewarming
• CODE_SANDBOX_COLD_AFTER_MS controls when tracked sandboxes are treated as cold
• LIBRECHAT_CODE_IMAGE_CHUNK_BYTES controls transport chunk size for sandbox images returned by read_file

Added experimental Agent Plugin runtime settings

• DEPLOYMENT_PLUGINS_DIR selects the startup-loaded plugin package directory and defaults to ./plugin
• DEPLOYMENT_PLUGIN_DATA_DIR selects the persistent per-plugin data root and defaults to ./data/plugins
• Agent Plugins 1.0.0 can bundle deployment Skills and MCP servers
• DEPLOYMENT_PLUGIN_HOOKS=true opts trusted plugins into command hook execution on the API host; hooks are ignored with a warning by default
• Command hooks receive bounded lifecycle payloads over standard input, run with a minimal environment plus explicit allowedEnvVars, and can return event-appropriate decisions

Updated GitHub Skill Sync isolation

• Valid Skills can publish when another Skill in the source is invalid or conflicts
• Partially successful runs report partial with bounded skipped-Skill counts and details
• Skipped Skills preserve last-known-good mirrors; source authentication, rate-limit, lock-loss, and rollback failures remain fatal

Updated speech.speechTab engine defaults

• engineSTT accepts browser and external; legacy openai and azureOpenAI values normalize to external
• engineTTS accepts browser and external; legacy provider values normalize to external
• Saved legacy values are migrated before speech settings initialize, and unavailable external engines fall back to browser

Added file upload runtime settings

• FILE_UPLOAD_SSE_ENABLED keeps long-running uploads alive with SSE heartbeats
• REMOTE_FILE_FETCH_TIMEOUT_MS limits server-side remote file download time
• REMOTE_FILE_FETCH_MAX_BYTES limits server-side remote file download size
• FILE_USAGE_USER_MAX and FILE_USAGE_USER_WINDOW limit queued-attachment TTL renewal requests separately from upload limits
• Shell MIME variants application/x-shellscript and text/x-shellscript normalize to the canonical application/x-sh before endpoint allowlist checks
• Rejected uploads now return their specific unsupported-file message and HTTP status instead of a generic server error

Expanded PowerPoint template handling

• .potx files are recognized by their standard MIME type across uploads and SharePoint imports
• PowerPoint templates can use file search, Code Interpreter, OCR, and inline presentation previews

Added separate authentication token-submission rate limits

• RESET_PASSWORD_SUBMISSION_MAX and RESET_PASSWORD_SUBMISSION_WINDOW limit password-reset token validation independently from reset-email requests
• VERIFY_EMAIL_SUBMISSION_MAX and VERIFY_EMAIL_SUBMISSION_WINDOW limit verification-token validation independently from email resends
• Added separate violation-score controls for both submission limiters

Added Agent conversation control STEER_MAX_LENGTH

• Caps the length of one mid-run steering message

Added GENERATION_PROTOCOL_VERSION

• Supports the rolling-upgrade-safe cutover to interrupt, recovery, and durable queue protocol v2 on Redis-backed deployments

Added section-scoped administrator configuration access

• Read responses are filtered to sections the administrator can access
• Managing a configuration section also grants read access to that section
• Every mutation of the base base profile requires broad manage:configs; section-scoped management applies to role, group, and user overrides

Updated request-scoped MCP server behavior

• Agent Builder attaches servers that use {{LIBRECHAT_BODY_*}} as a whole and resolves their tool catalog during the active run
• OAuth completion stores authorization but defers the request-scoped connection until chat context is available

Updated MCP server instruction handling

• Preserves the configured serverInstructions declaration separately from instructions fetched during inspection
• Keeps true declarations and literal overrides authoritative across cached registry reloads
• Refreshes Redis-backed registry entries written by earlier builds during initialization

Updated MCP transport compatibility

• Upgraded @modelcontextprotocol/sdk to 1.30.0
• Streamable HTTP responses are classified by their parsed Content-Type media type instead of substring matching
• Individual STDIO messages now have the SDK's 10 MB default buffer limit and fail the transport when exceeded

Updated transaction recording

• transactions.enabled: false is honored on the token-count fallback path when a provider does not return usable stream usage
• balance.enabled: true continues to require transaction recording regardless of the transaction setting

Updated Admin Panel configuration and Google SSO

• ADMIN_PANEL_URL now also exposes an admin-only link under Settings -> General
• Google admin OAuth requests offline access and can refresh the panel session while rechecking current account, tenant, domain, ban, and admin-access policy

Added authentication and permission cache settings

• ALLOW_EMAIL_LOGIN_OVERRIDE permits audited direct API email login while the regular email login UI is disabled
• AUTH_USER_CACHE_MODE=on opts into a short Redis-backed authenticated-user cache
• USER_PRINCIPALS_CACHE_TTL_MS, USER_PRINCIPALS_LOCK_TTL_MS, and USER_PRINCIPALS_LOCK_WAIT_MS tune ACL principal caching and cross-process cache builds

Added {{LIBRECHAT_USER_TERMSACCEPTEDAT}}

• Makes the recorded terms acceptance timestamp available to MCP and custom endpoint header templates
• Existing accepted users can be backfilled with npm run migrate:terms-timestamp

Updated built-in model defaults

• Added GPT-5.6 Sol, Terra, and Luna
• Added Claude Sonnet 5, including Bedrock model IDs
• Added Gemini 3.6 Flash and Gemini 3.5 Flash-Lite
• Added Gemini 3.7 Flash for Google AI Studio and Vertex AI with a 1,048,576-token context window
• Defaults Gemini 3.7 Flash to MEDIUM thinking and maps its unsupported MINIMAL level to LOW
• Uses introductory Gemini 3.6/3.7 Flash input, output, and cache pricing through December 31, 2026

Added Agent stream circuit breakers

• endpoints.agents.maxToolCallArgBytes limits one streamed tool call's cumulative argument bytes
• maxDeltaEventsPerTurn limits stream events from one model generation
• maxToolCallArgBytesByTool provides per-tool overrides, including the shipped 128 KiB create_file allowance

Added STREAM_DELTA_COALESCE_MS

• Optionally batches Redis delta publications to reduce round trips and Redis CPU at high token rates
• Defaults off; 25 ms is recommended and values are capped at 1000
• Must be enabled only after every replica supports batch frames

Added LANGFUSE_FANOUT_CENTRAL_MEDIA_UPLOAD_DISABLED

• Disables app-side media upload creation for central and fallback collector traces without changing tenant-routed media

Updated custom PII filters to use RE2

• Custom patterns now run on a linear-time engine and are validated at config load
• Backreferences and lookaround are not supported

Updated administrator-configured file MIME patterns to use RE2 on the server

• Invalid patterns are skipped and logged
• If every configured pattern is invalid, the resulting list fails closed and rejects every file

Added allowedAddresses to speech.tts, speech.stt, and ocr

• Speech and OCR requests now enforce private-address SSRF checks at connect time and disable redirects
• Exact trusted private host:port entries bypass the block without restricting public destinations
• Literal private destinations remain blocked through a proxy unless exempted; proxied hostname egress remains the proxy's responsibility

Added webSearch.allowedAddresses

• Web search, scrape, and rerank connections now block private, loopback, link-local, and cloud-metadata destinations at connect time
• The field exempts exact trusted private host:port services without becoming a public-host allowlist
• Self-hosted SearXNG, Firecrawl, Jina, or compatible provider endpoints on private networks must be exempted

Updated provider stream smoothing

• OpenAI, custom, Anthropic, Google, Bedrock, and Agents SDK-backed streams use adaptive smoothing with a 25 ms target by default
• Endpoint streamRate remains in effect when endpoints.all omits it, and an explicit 0 disables adaptive smoothing

Removed published credential and search defaults

• Blank CREDS_KEY, CREDS_IV, JWT_SECRET, and JWT_REFRESH_SECRET values generate temporary credentials, reusing LIBRECHAT_TEMP_CREDENTIALS_PATH when available
• Bundled Compose files persist /app/data/.env.temp; production and multi-replica deployments must still provide permanent shared values
• SEARCH now defaults to false and MEILI_MASTER_KEY is blank so operators must opt in with a unique key

Updated the config version to 1.3.14

Original source

The v0.8.8-rc1 release of LibreChat

What's Changed

🏞️ Highlights

• Interrupt or steer Agent runs in progress, or queue the next message
• Agents can ask up to four related questions in one form, pause for input or approval, then resume
• Redesigned Agent Builder with a unified Tools marketplace and background tools
• Experimental Agent Plugins with deployment Skills, MCP servers, and opt-in command hooks
• Activity groups, parent phase summaries, and live tool intent labels
• Experimental stateful Code Interpreter sessions with reusable conversation workspaces
• Agent-managed memory with optional per-agent isolation
• Stable shared-link updates, active-link badges, and personal copies
• Fullscreen artifact previews and Mermaid SVG/PNG export
• In-app Langfuse connections, tenant fanout, and admin session links
• Unified message layouts, multi-part response editing, and full-message copy
• Smooth text fade-in, adaptive streaming, and live MCP tool-catalog refresh
• Stronger SSRF guards for speech, OCR, and web tools
• Provider updates: GPT-5.6, Claude Opus 5 and Sonnet 5, Gemini 3.7 and 3.6 Flash, and Gemini 3.5 Flash-Lite

✨ Features

• 🕒 feat: Track terms acceptance timestamp by @berry-13 in #10810
• 🔄 feat: Continue Shared Conversations as Personal Copies by @berry-13 in #13714
• 🪝 feat: HITL Tool Approval Scaffolding (Slice A) by @danny-avila in #12938
• 🧠 feat: Add Memory as an Agent Capability with Inline Tools and Ephemeral Badge by @danny-avila in #13869
• 📇 feat: Agent Contact Visibility with Owner Fallback by @peeeteeer in #13663
• 🪟 feat: Faithful Over-Window Context Estimate via Prune Mirror and Overhead Reserve by @danny-avila in #13959
• 🪭 feat: Add opt-in Langfuse fanout gateway + collector by @upman in #13872
• 🪝 feat: Human-in-the-Loop Runtime - Tool Approval + Ask-User-Question (Slice B) by @danny-avila in #13942
• 🪗 feat: Dock-Style Fisheye Nav Rail With Instant Hover Preview by @danny-avila in #14021
• 🤖 feat: Add Claude Sonnet 5 Support by @danny-avila in #14042
• 🥷 feat: Add showInMenu Option to Model Specs by @alexkorep in #14034
• 🫷 feat: Exclude File Authoring Tools From Eager Execution by @danny-avila in #14051
• 🪝 feat: Configurable Tool-Approval Policy via Programmatic Hooks by @danny-avila in #14025
• 🧹 feat: Eager HITL Checkpoint Cleanup (Expiry + Deletion) & Full-Wiring E2E by @danny-avila in #14123
• 🧰 feat: Redesign Agent Builder with Unified Tools Marketplace, Skills & Orchestration by @berry-13 in #13952
• 📡 feat: add rum browser page-load diagnostics by @upman in #14106
• 🎚️ feat: Explicit "Use All Skills" Toggle in the Skills Section by @berry-13 in #14125
• 🙋 feat: ask_user_question - agent-initiated questions with durable pause/resume by @danny-avila in #14139
• 🗂️ feat: Per-Agent Memory Partitions by @danny-avila in #14084
• 🤖 feat: Add GPT-5.6 (Sol/Terra/Luna) OpenAI Models by @danny-avila in #14206
• 🪭 feat: support per-run central export suppression by @upman in #14207
• ✨ feat: stateful_code_sessions capability for warm Code API sandbox sessions (experimental) by @danny-avila in #14150
• 🧠 feat: Add GPT-5.6 reasoning.mode + reasoning.context (Responses API) by @danny-avila in #14233
• 🧵 feat: Background Tool Calls for Agents & Model Specs by @danny-avila in #14197
• 🗝️ feat: Encrypted Langfuse Fanout Config by @dustinhealy in #14107
• 🧭 feat: Mid-Run Steering and Queued Messages for Agent Runs by @danny-avila in #14220
• ♨️ feat: Prewarm Stateful Code Sandboxes with Cold-Boot UX Feedback by @danny-avila in #14239
• 📛 feat: Add Client Name Header to Tavily Search Requests by @manisrinivasan2k1 in #14082
• 💬 feat: Explain Steering & Queuing at Every User-Facing Surface by @danny-avila in #14260
• 🖼️ feat: Return Sandbox Images From read_file as Viewable Artifacts by @danny-avila in #14277
• feat: add low-noise Redis observability by @upman in #14309
• ✋ feat: Add Reclaim-Gated Controls to In-Flight Steers by @danny-avila in #14321
• 🫧 feat: Float In-Flight Steers Over the Thread with Collapsible Content by @danny-avila in #14365
• ⚡ feat: Add Gemini 3.6 Flash and Gemini 3.5 Flash-Lite Support by @danny-avila in #14369
• 🧵 feat: Native Background Execution for Code Interpreter Tools by @danny-avila in #14386
• ✳️ feat: Claude Opus 5 Support by @danny-avila in #14422
• ⏱️ feat: Configurable HTTP Server Timeouts by @danny-avila in #14481
• 🕶 feat: Generalize Admin Config Secret Redaction by @dustinhealy in #14509
• 🏷️ feat: Activity Groups With Fast-Model Headers by @danny-avila in #14391
• 🗝️ feat: Custom Endpoint API Key Encryption via Array Secret Registry by @danny-avila in #14510
• 🎯 feat: Tool Intent Label Capability (tool_intents) by @danny-avila in #14499
• 🪢 feat: Langfuse Fanout Connection Setting by @danny-avila in #14108
• 🛑 feat: Preemptive Steer - Backend Interrupt & Steer by @danny-avila in #14518
• 🎯 feat: Per-Tool Intent Labels for Model Specs by @danny-avila in #14526
• ⚡ feat: Interrupt & Steer, Client by @danny-avila in #14528
• 🧵 feat: Background-Native Code Execution Tools by @danny-avila in #14532
• 🎯 feat: Render Tool Intent as the Live Tool-Call Label by @danny-avila in #14536
• 🎯 feat: Per-Tool Intent Label Toggles in the Agent Builder by @danny-avila in #14550
• ⚡ feat: Reliable Interrupt & Steer Escalation and Recovery by @danny-avila in #14558
• 💬 feat: Interim Progress Card for Streaming Q&A Calls by @danny-avila in #14576
• 🚦 feat: Configurable Circuit Breakers for Runaway Streamed Tool Args by @danny-avila in #14613
• ⚡ feat: Coalesce Redis Streaming Delta Publications into Windowed Batches by @danny-avila in #14614
• 🔒 feat: Add allowedAddresses Exemption to Speech (STT/TTS) and OCR Config Schemas by @dustinhealy in #14559
• 🌊 feat: Wire Adaptive Stream Smoothing Across Google, Bedrock, and Zero-Disable Semantics by @danny-avila in #14660
• 🔗 feat: Admin Panel Link in Settings for Admins by @dustinhealy in #14662
• 👋 feat: Day-Aware Landing Greeting Schedule by @berry-13 in #14633
• 🔑 feat: Refresh-Capable Google Admin OAuth Sessions by @dustinhealy in #13832
• 🛡️ feat: Add Batched MCP Authority Proofs by @danny-avila in #14688
• 🪝 feat: Add Claude Hook Compatibility Layer by @danny-avila in #14412
• ⛶ feat: add fullscreen artifact previews by @berry-13 in #14585
• 🔌 feat: Add Agent Plugins (Experimental) by @danny-avila in #14704
• 🔗 feat: Shared Conversation Badge and Stable Share Links by @berry-13 in #14712
• 🧜 feat: Open Mermaid Diagrams as Artifacts with SVG/PNG Export by @berry-13 in #14713
• 🪶 feat: Resolve Explicit Subagents Lazily by @danny-avila in #14714
• 📡 feat: Route Web Search and Scrape Egress through the SSRF-safe Agent by @dustinhealy in #14606
• 🎨 feat: Add Versioned Theme Foundation by @danny-avila in #14709
• 🪆 feat: Add Parent Activity Phase Summaries by @danny-avila in #14721
• 🎨 feat: Refine Client Colors and Sharing Dialogs by @berry-13 in #14734
• 🎛️ feat: Adopt Composer Density Tokens by @danny-avila in #14730
• 🍡 feat: Batched User Questions With A Single Bounded Answer Form by @danny-avila in #14737
• 🪝 feat: Execute Agent Plugin Command Hooks by @danny-avila in #14755
• 🚣‍♀️ feat: Smooth Streaming Text Fade-In by @danny-avila in #14757
• 🪢 feat: add Langfuse session links by @upman in #14776
• 🔖 feat: Bound Parent Activity Phases With an Exclusive End Index by @danny-avila in #14768
• 💬 style: Unify Message Row Layout and Edit Surfaces by @berry-13 in #14770
• 📄 feat: accept PowerPoint template MIME type by @snapydziuba in #14761
• ⚡ feat: Add Gemini 3.7 Flash Support by @danny-avila in #14818

🐛 Fixes

• 🔑 fix: Honor User-Provided MCP API Key Instead of Forcing OAuth by @danny-avila in #13954
• 🪙 fix: Count Quote Tokens on Message Edit by @danny-avila in #13958
• 📋 fix: Route Clipboard Paste Through Upload Options by @dustinhealy in #13957
• 📇 fix: Index sharedlinks updatedAt for Cosmos DB Sorts by @danny-avila in #13979
• 📂 fix: Mount Skill Files Under skills/ in Code Interpreter by @danny-avila in #13961 and #13975
• 🪟 fix: Re-measure Sidebar Chat List on Width Change to Fix Date-Group Spacing by @danny-avila in #13981
• 📏 fix: Make create_file Missing-Content Error Truncation-Aware by @danny-avila in #14043
• fix: use logAxiosError at the RAG file_search/context call sites by @mawburn in #14014
• fix: stripHeavyErrorFields Winston format (defense-in-depth) by @mawburn in #14018
• 📥 fix: Download Original File From Artifact Preview Panel for Office Documents by @berry-13 in #14026
• 🔥 fix: Firebase CDN Initialization Under tsdown CJS Interop by @jakacenta in #14046
• fix: preserve role SHARE permissions across boot in initializeRoles by @mawburn in #14022
• fix: bound peak memory of concurrent base64 attachment encoding by @mawburn in #14023
• 📧 fix: Add .eml (message/rfc822) Support to File Upload by @Zirkonium88 in #13989
• 🚪 fix: Support Admin Redirect Detection for Same-Origin Subpaths by @arjunvijay24 in #14040
• 🩹 fix: Coerce Stringified edit_file Edits (JSON-in-JSON) by @danny-avila in #14056
• 🧠 fix: Apply Bedrock thinking config to bare inference-profile model IDs by @danny-avila in #14054
• 🧠 fix: Default Bedrock thinking maxTokens to model max output by @danny-avila in #14058
• fix: stop the artifact-edit retry loop on unrecoverable 400s by @mawburn in #14060
• 🎣 fix: Surface Resumable Stream Start Errors by @danny-avila in #14072
• 🧯 fix: Harden Principals Cache Invalidation and Lock-Wait Paths by @danny-avila in #14120
• 🏁 fix: Ignore Finalized SSE Transport Errors by @danny-avila in #14114
• fix: fall back to _id for user id in createSafeUser by @mawburn in #14083
• 🌏 fix: guard IME composition on Enter in prompt name/labels and dynamic tag inputs by @mahirhir in #13996
• 🗄️ fix: Return Cached Transaction-Support Value on Cache Hit by @Osamaali313 in #13999
• 🧠 fix: Format Reasoning Exports by @danny-avila in #14116
• 🧮 fix: Prevent String Corruption of Numeric Agent Model Parameters by @danny-avila in #14119
• 🧢 fix: Raise Claude Sonnet 4.6 Output Cap by @danny-avila in #14115
• 🧵 fix: Preserve Fenced Markdown Artifacts by @danny-avila in #14121
• 🔒 fix: Prevent Role Grants on Shared Links by @danny-avila in #14137
• 🤐 fix: Exclude Provider Secrets from HITL Pending Actions by @danny-avila in #14136
• ⏳ fix: Defer MCP Connection for Request-Scoped Placeholders on Reinitialize by @danny-avila in #14148
• 🧷 fix: Align Agent File Attachment Ownership by @danny-avila in #14149
• 🧊 fix: Include Conversation Starters in Agent View and List Responses by @serhiizghama in #14142
• ♊ fix: Resolve Local JSON Pointer Refs & Sanitize Tool Search Schema for Gemini by @usnavy13 in #14161
• 🛡️ fix: Guard HITL checkpoint size against MongoDB 16MB limit by @danny-avila in #14157
• 🔡 fix: Normalize Email Case When Issuing Verification Tokens by @VictorEPlus in #14172
• 🪜 fix: Apply Recursion Limit Config to Subagents by @danny-avila in #14185
• 💂 fix: Enforce ALLOW_EMAIL_LOGIN on the Backend Login Route by @lurkerCha in #14180
• 🧩 fix: Allow compatibility Field in Skill Frontmatter by @danny-avila in #14189
• 📎 fix: Translate Finite supportedMimeTypes Allowlists to Picker Accept by @danny-avila in #14186
• 🪆 fix: Serve Nested Skill Files Through a Wildcard Route by @danny-avila in #14191
• 🃏 fix: Attach Request-Scoped MCP Servers From the Builder via the mcp_all Wildcard by @adamscross04 in #14177
• 🔍 fix: Sync Conversation Title Updates to MeiliSearch by @danny-avila in #14223
• 👻 fix: Guard Redis Stream Resume Against Disposed HITL Graph by @danny-avila in #14258
• 🤝 fix: Discover MCP OAuth Exchange Methods by @danny-avila in #14256
• 👋 fix: Terminate Streamable HTTP MCP Sessions on Teardown by @danny-avila in #14252
• 🗂️ fix: Route read_file Through the Stateful Code Session by @danny-avila in #14259
• 💭 fix: Default GPT-5.6 Reasoning Requests to Responses API by @jomspk in #14232
• 🔖 fix: Preserve Ephemeral Agent Params and Identity for ask_user_question Resume by @jjhidalgar-celonis in #14254
• 🎫 fix: Strip Reserved Fields From Bedrock additionalModelRequestFields by @danny-avila in #14246
• 📱 fix: Single-Tap Select for Pinned Agents, Model Specs & Models on Touch by @danny-avila in #14272
• 🧽 fix: Clear Deleted Chats From Message Cache by @danny-avila in #14270
• 🧟 fix: Prevent Drained Steer From Re-Queuing After Run-End Race by @danny-avila in #14276
• 🙋 fix: Await ask_user_question Tool Factory in loadTools by @danny-avila in #14291
• 🧷 fix: Flush Pending File Deletion on Unmount by @danny-avila in #14293
• 🙋 fix: Stop Answered ask_user_question Card From Reopening Its Popover by @danny-avila in #14297
• 🔒 fix: Scope, Cap, and De-Execute the In-Flight Steer Stack by @danny-avila in #14310
• 📱 fix: Don't Connect the Favorites Drag Source on Touch Pointers by @danny-avila in #14312
• 🧵 fix: Harden Request-Scoped MCP Lifecycle by @danny-avila in #14342
• 🪆 fix: Build RAG-API Chart Before Parent to Bundle PostgreSQL Dependency by @Aho-Bakaa in #14262
• 🚪 fix: Keep Owners From Being Locked Out of Their Own Resource When Sharing by @danny-avila in #14347
• 🚏 fix: Route Admin-Configured Document Types to RAG /text on Agent Upload by @danny-avila in #14345
• 🎟️ fix: Claim Idempotency Keys to Dedup Retried Generation Requests and Prevent Double Billing by @danny-avila in #14344
• 🧠 fix: Restore Agent Memory Scope Control in Unified Builder by @danny-avila in #14292
• 🛟 fix: Keep File Uploads Alive With SSE Heartbeats by @MarcAmick in #14295
• 🧩 fix: Preserve Deployment Skill IDs on Agents by @danny-avila in #14368
• 🧭 fix: Keep Message Nav Chevrons Working on In-Thread Steers by @danny-avila in #14377
• 🤐 fix: Withhold MCP OAuth Headers From Untrusted Preconfigured Discovery by @danny-avila in #14379
• 🔗 fix: Preserve resource owner access when sharing (key share diff by stable id) by @jomspk in #14317
• 🪆 fix: Preserve Nested Subagent Delegation by @danny-avila in #14392
• ✋ fix: Enable Submit on First Tool-Approval Decision by @danny-avila in #14393
• 🎞️ fix: Surface Clear Error for Unprocessable Gemini YouTube Videos by @danny-avila in #14396
• 📌 fix: Pin Scroll-to-Bottom Rib in Message Nav by @danny-avila in #14397
• 🫙 fix: Preserve Loaded Message Content When Resume Snapshot Is Empty by @danny-avila in #14399
• 🎯 fix: Correct Off-by-One Rail Scrub After Pinning the Terminus by @danny-avila in #14409
• ♾️ fix: Preserve Resumable Stream Ordering Across Turns by @danny-avila in #14411
• 🧩 fix: Harden Agent Skill Lifecycles End to End by @danny-avila in #14429
• 📧 fix: Restore invite-user CLI by @unsnow-iac in #14436
• 🔗 fix: Resolve MCP Tool-Key Boundary Against Configured Server Names by @danny-avila in #14448
• 🍃 fix: Strip $-Prefixed Schema Keywords Before Persisting MCP Tool Params by @danny-avila in #14464
• 🔗 fix: Render Shared Links Containing Steers by @danny-avila in #14480
• 🔒 fix: Bound /files/usage TTL Hold Instead of Clearing It by @danny-avila in #14470
• 🤏 fix: Filter Admin Config Reads by Section-Scoped Read Capability by @dustinhealy in #14472
• 🍃 fix: Amazon DocumentDB Compatibility for Pipeline-Form Updates by @danny-avila in #14495
• 🛡️ fix: validate message feedback payloads by @upman in #14500
• 🧩 fix: Apply Every Entry of Multi-Part Stream Deltas by @danny-avila in #14502
• 🏷️ fix: Re-attribute Agent Content After In-Thread Steers by @danny-avila in #14497
• 🎯 fix: Keep Run Steps and Labels in One Index Space After a Resume Sync by @danny-avila in #14516
• 🪶 fix: Yield Soft Default Model Spec to Agent Picks in Picker-Only Deployments by @danny-avila in #14515
• 🪟 fix: Surface MCP Initialization Errors by @danny-avila in #14529
• 🪃 fix: Resolve User Vars Before the First Post-OAuth Reconnect by @schumajs in #14538
• 🔒 fix: Remove Owner Email from Agent owner_contact Fallback by @danny-avila in #14541
• 📄 fix: Filter Non-PDF Documents on the Anthropic Encode Path by @danny-avila in #14535
• 🎯 fix: Exact Ask-Question Attribution via Interrupt tool_call_id by @danny-avila in #14539
• 🧹 fix: Clean Up MCP OAuth State Mappings on Uninstall + Reject Superseded Callbacks by @danny-avila in #14549
• 🧠 fix: Preserve Deferred Tool Schemas Across HITL Resume by @danny-avila in #14552
• 🦗 fix: Ignore Sequenced Redis Events Without SSE Subscribers by @danny-avila in #14557
• 🔗 fix: Normalize MCP Tool Keys at Every Producer, Resolve Raw Names via Aliases by @danny-avila in #14553
• 🏢 fix: Preserve Tenant Context for Partial Response Saves on Disconnect by @danny-avila in #14567
• 🦗 fix: Deliver Abort Acknowledgements on Zero-Subscriber Replicas by @danny-avila in #14569
• 🏷️ fix: Skip Title Generation for Preempt-Incomplete Turns by @danny-avila in #14571
• 🪧 fix: Guard Admin OAuth Routes When Providers Are Not Configured by @cyphercodes in #14507
• 🔗 fix: Resolve Relative Skill Markdown Links by @berry-13 in #14586
• 🧭 fix: Drop v6-Only MemoryRouter future Prop from Skill Markdown Spec by @danny-avila in #14588
• 🪪 fix: Strip Unresolved Header Placeholders at Final Resolution by @danny-avila in #14595
• 🔒 fix: Single-Flight MCP OAuth Token Refresh per User/Server by @danny-avila in #14596
• 🪺 fix: Keep Preempt-Abandoned Siblings Nested, Make Message Tree Order-Robust by @danny-avila in #14587
• ⌨️ fix: Honor defaultPrevented in Global Shortcut Dispatch by @danny-avila in #14570
• 🪢 fix: Bind MCP OAuth Secrets to Trusted Endpoints by @danny-avila in #14578
• ⚓ fix: Bind Action Servers to Metadata Ports by @danny-avila in #14575
• 🧱 fix: Enforce Agent Runtime File Trust Boundaries by @danny-avila in #14577
• 📏 fix: Scope Skill Command Query to Text Before the Caret by @danny-avila in #14604
• 🧬 fix: Resolve URL-Named Model Spec to Its Full Preset on Cold Load by @danny-avila in #14610
• ✂️ fix: Truncate Overflowing Activity and Intent Labels in Chat UI by @danny-avila in #14607
• 🚦 fix: Bound, Single-Flight, and Retry Skill File Priming Uploads by @danny-avila in #14611
• 🧹 fix: Exclude Mongo ID From Conversation Updates by @danny-avila in #14631
• ♿️ a11y: improve keyboard operability, focus retention, and accessible naming by @berry-13 in #14600
• 🚏 fix: Localized Guidance for Model-Not-Found Errors by @danny-avila in 557c22d102
• 🛡️ fix: Run message-filter PII patterns on a linear-time regex engine (ReDoS) by @dustinhealy in #14554
• 🪢 fix: disable central fanout media uploads for langfuse by @upman in #14642
• 🧭 fix: Fail Closed When Expected MCP Tools Are Unavailable by @danny-avila in #14646
• 🛂 fix: Honor Claude Document Limits Through Inference Gateways by @danny-avila in #14650
• 🎟️ fix: Reconcile MCP OAuth Readiness Across Pods by @danny-avila in #14629
• 🌊 fix: Preserve Custom Endpoint streamRate When endpoints.all Is Defined by @danny-avila in #14645
• 🔐 fix: Preserve Structured JWT Auth Context by @danny-avila in #14652
• ⏱️ fix: Compile admin file-config MIME patterns on a linear-time engine (ReDoS) by @dustinhealy in #14555
• 🛡️ fix: SSRF-Guard Speech (STT/TTS) and OCR Outbound Requests at Connect Time by @dustinhealy in #14560
• 🔁 fix: Re-Arm Soft Default When a Stored Agent No Longer Resolves by @danny-avila in #14664
• 🔗 fix: Prevent duplicate share rows from clobbering pending role edits (dedupe adds by stable id) by @jomspk in #14655
• 🛟 fix: Stop Agents When Code Resources Cannot Recover by @danny-avila in #14651
• ♿ fix: Restore WCAG AA Contrast for Text Tokens & Hide Edit Action While Streaming by @danny-avila in #14677
• 🩹 fix: Keep Edit Action Fully Hidden While Streaming by @danny-avila in #14687
• 📡 fix: Refresh MCP Tools After List-Changed Notifications by @danny-avila in #14686
• 🧬 fix: Rebind Request Context After Remote Agent Auth by @danny-avila in #14685
• 🧭 fix: Make MCP Catalog Redis Cluster-Safe by @danny-avila in #14717
• 🧬 fix: Normalize Legacy MCP Null Headers by @danny-avila in #14720
• 📁 fix: Consistent Export Filenames Across Formats by @lidonius1122 in #14708
• 🧷 fix: Safely Recover Runtime MCP OAuth Rejections by @danny-avila in #14684
• 🪆 fix: Rebase Activity Phase Bounds over Sparse Content by @danny-avila in #14729
• 📎 fix: Re-enable Send After File Upload by @danny-avila in #14727
• 📸 fix: Guard Screenshot Export Against Main-Thread Freezes by @danny-avila in #14733
• 🔐 fix: Preserve Plugin MCP Provenance Through Registry Storage by @danny-avila in #14744
• 🧭 fix: Re-Anchor Parent Activity Phase Bounds by @danny-avila in #14741
• 🧷 fix: Preserve Elicitation Answers Across Aborts by @danny-avila in #14745
• 📡 fix: Preserve Redis Abort Terminal Delivery by @danny-avila in #14749
• ⌨️ fix: allow file upload shortcut when editing by @likeabas in #14764
• 🛟 fix: Isolate Invalid Skills During GitHub Sync by @berry-13 in #14735
• 🎙️ fix: Align Speech Engine Configuration With Runtime by @berry-13 in #14736
• 🧩 fix: Normalize Malformed MCP Required Schemas by @danny-avila in #14771
• 🧾 fix: Honor Disabled Transactions on the Token-Count Fallback Path by @jtodaroii in #14774
• 🛰️ fix: Attach Request-Scoped MCP Servers by @danny-avila in #14780
• 📱 fix: Show Quote Popup for Block Selections and on Touch Devices by @danny-avila in #14777
• 🪑 fix: Rebase Activity Phase Bounds Onto Compacted Content and Unskip the MCPManager Suite by @danny-avila in #14782
• 🔖 fix: Split Activity Phases at Substantial Text by @danny-avila in #14785
• 🖌️ style: Use correct text colour for answer textarea in dark mode by @lizzykerrigan in #14791
• 🩹 fix: Restore the @librechat/api Build and Remove Legacy Code by @danny-avila in #14808
• 🩹 fix: apply agent updates that match the newest version entry by @mihidumh in #14810
• 💬 style: Right-Align In-Flight Steer Bubbles to the Message UI by @danny-avila in #14814
• 🔌 fix: Preserve MCP serverInstructions Declaration Through Inspection by @danny-avila in #14815
• 🔌 fix: Recover Quietly From Stale MCP SSE Stream Conflicts by @danny-avila in #14816
• 📎 fix: Alias Shell Script MIME Variants to application/x-sh by @danny-avila in #14817

🔧 Refactoring and Performance

• ♻️ refactor: Compute Context Gauge Client-Side, Drop Projection Endpoint by @danny-avila in #13953
• 🪣 refactor: Rate-Limit Token Routes and Cap Remote File Downloads by @danny-avila in #13978
• 🦥 perf: Lazy-Load Agent Version History in Editor by @danny-avila in #13977
• 🛗 perf: Fetch Pinned Agents Directly Past the Global Agents Map by @danny-avila in #13972
• ⚡ perf: memoize FavoritesList and BookmarkNav to prevent re-renders during streaming by @berry-13 in #14011
• 🗺️ refactor: Light Up In-Viewport Ribs at Rest in Message Nav by @danny-avila in #14041
• ⚡ perf: Minimize group membership query in principal resolution by @danny-avila in #14055
• ⚡ perf: Skip Role Route Capability Probe for Own and Default Roles by @danny-avila in #14073
• 🪭 refactor: safe structured failure logging for langfuse fanout gateway by @upman in #14050
• 📉 perf: Skip Redundant Permission Queries on MCP Servers List by @danny-avila in #14077
• ⚡ perf: Persist HITL checkpoints only on pause (lazy checkpointer) by @danny-avila in #14024
• 🗃️ perf: Cache Group Memberships for ACL Principal Resolution by @danny-avila in #14075
• ⚙️ perf: reduce first-load MongoDB round trips by @upman in #14101
• 🎯 style: Center Scroll-to-Bottom Rib in Message Nav Rail by @danny-avila in #14151
• 📉 perf: cache OpenID JWT user documents by @upman in #14187
• 📉 perf: start message queries before file map loads by @upman in #14188
• 🪜 style: Adjust rib dimensions and button sizes in MessageNav by @danny-avila in #14234
• 🪜 style: Center scroll-to-bottom marker in MessageNav by @danny-avila in #14238
• 🛞 style: Reveal the Steered "?" on Message Hover/Focus by @danny-avila in #14271
• 🙊 refactor: Clarify Ask Question Schema Errors and Retry Guidance by @danny-avila in #14279
• 💬 refactor: Anchor In-Flight Steers Above the Composer by @danny-avila in #14308
• ⚡ perf: Halve Per-Delta Redis Round Trips in Resumable Streams by @danny-avila in #14313
• 🧭 refactor: web_search Description on When To Search vs Answer Directly by @joshbla in #13930
• 🧷 perf: Stabilize Mutation-Dependent Memos in Chat Hooks by @danny-avila in #14328
• 🚰 perf: Suppress No-Op Conversation Writes and Widen-Proof Atom Subscriptions by @danny-avila in #14329
• 🔍 refactor: Surface primary OpenID JWT failure reason in auth failure log by @danny-avila in #14346
• 🧭 perf: Warm Conversation Switches with Single-Navigation Focus Intent by @danny-avila in #14334
• 🧹 perf: Share Voices Store, Gate Timestamp Ticker, Stabilize Greeting Springs by @danny-avila in #14335
• 🎞️ perf: Coalesce Streaming Delta Cache Writes Per Animation Frame by @danny-avila in #14332
• 🎛️ perf: Narrow Composer Subscriptions to Streaming State by @danny-avila in #14333
• 🧬 perf: Memoize Message Spine and Isolate Scroll-Button State by @danny-avila in #14330
• 🪟 perf: Virtualize Search Results and Stop the Per-Query Remount by @danny-avila in #14352
• ⚡ perf: Reduce Agent Chat Startup Latency by @danny-avila in #14423
• 💬 refactor: Raise ask_user_question Option Label Cap to 280 Chars by @danny-avila in #14491
• 🪢 refactor: Move Agent Execution Seam Before Initialization by @danny-avila in #14581
• 📉 perf: Bound Early Event Buffering for Detached Generations by @danny-avila in #14612
• 🎨 refactor: adopt the @librechat/client design system (semantic color tokens + component migration) by @berry-13 in #13879
• 🧩 refactor: Shared UI Design System Tokens by @danny-avila in #14670
• ⚡ perf: Agent List and Model Selector at Scale by @berry-13 in #14601
• 🧭 refactor: make the side panels behave the same way by @berry-13 in #14695
• 🫧 refactor: Fading Pre-Response Dot, Legacy Cursor CSS Removed by @danny-avila in #14772
• 🧱 refactor: Require Broad Config Management for Base Field Mutations by @danny-avila in #14775
• 🖍️ refactor: Typed Console Colors and Hardened Script Helpers by @danny-avila in #14778
• 🧱 refactor: Make Activity Phase Anchor Construction Exhaustive by @danny-avila in #14805
• 🧭 refactor: Resolve Activity Phase Position Once Per Boundary by @danny-avila in #14807

🧪 Tests

• 📐 test: Guard Web Search Description Length by @danny-avila in #14044
• 🛂 test: Cover Tool Approval Workflows End to End by @danny-avila in #14427
• 🧭 test: Cover Agent Handoffs End to End by @danny-avila in #14428
• 🧪 test: Reasoning-Stream Render Perf Benchmark via react-scan by @danny-avila in #14494
• 🎛️ test: Guard Multi-Steer Injection Across Tool Boundaries by @danny-avila in #14498
• 🧪 test: Run mock E2E against Redis in shards by @danny-avila in #14551
• 🎲 test: Replace Microtask Timing Assumptions in Client Specs by @berry-13 in #14653
• 🐘 test: refresh FerretDB harness, registry-derived models, bulkWrite coverage by @danny-avila in #14679
• test(mcp): mock static tool startup sync by @danny-avila in #14711
• 🧪 test(e2e): add Bombadil property exploration by @upman in #14462
• 🧾 test: Pin the Transactions Config Wiring on the Fallback Path by @danny-avila in #14779

📦 Dependencies, Chores & CI

• 📦 chore: bump @librechat/agents to v3.2.52 by @danny-avila in #13939
• ⬆️ chore: Migrate off deprecated @ariakit/react-core to @ariakit/react-components by @danny-avila in #13940
• 🧪 ci: Resolve DataTable test infinite re-render by @danny-avila in #13947
• 📦 chore: bump @librechat/agents to v3.2.54 by @danny-avila in #14035
• 🔄 chore: Bump @librechat/agents to v3.2.55 by @danny-avila in 954caef3a3
• 🧪 ci: De-flake ConversationsSection Memoization Spec on Slow Runners by @danny-avila in #14071
• 🧷 chore: Expose Retain Recent Summarization Config by @danny-avila in #14134
• 📦 chore: bump langfuse fanout Go dependencies by @upman in #14126
• ⭐ docs: update Star History section by @berry-13 in #14198
• 📦 chore: Update @librechat/agents to v3.2.62 by @danny-avila in #14235
• 📦 chore: Update @librechat/agents to v3.2.65 by @danny-avila in #14263
• 🧹 chore: Prune Dangling Images After deployed-update Pull by @danny-avila in #14269
• 🍽️ chore: Drop Pending Composer Draft When Steering or Queuing by @danny-avila in #14289
• 🧩 chore: Prebundle Node Polyfills for Buffer, Process, and Global in Vite optimizeDeps by @danny-avila in #14354
• 📦 chore: Update @librechat/agents to v3.2.66 & npm audit fix by @danny-avila in #14361
• 🧾 ci: Skip Workflows for Markdown-Only Changes by @danny-avila in #14378
• 📦 chore: Update @librechat/agents to v3.2.68 by @danny-avila in #14380
• 🚦 ci: Gate Playwright Runs to Maintainers by @danny-avila in #14385
• 🎭 ci: Scope Playwright Runs to Relevant Changes by @danny-avila in #14388
• 🍃 chore: Bump Mongoose to 8.24.1 to Patch Prototype Pollution by @danny-avila in #14461
• 🗺️ chore: Bump PostCSS to 8.5.18 to Patch Source Map Traversal by @danny-avila in #14463
• 📦 chore: bump @librechat/agents to v3.3.4 by @danny-avila in #14482
• 🍂 chore: Prune Deprecated Packages From the Dependency Tree by @danny-avila in #14483
• 🌯 chore: Retire Rollup-Era devDependencies After tsdown Migration by @danny-avila in #14496
• 📦 chore: Bump @librechat/agents to v3.3.5 by @danny-avila in #14506
• 📦 chore: bump @librechat/agents to v3.3.8 by @danny-avila in #14525
• 🧪 chore: Add the Activity-Label Prose Eval Harness by @danny-avila in #14527
• 🟦 chore: Convert Activity-Label Eval Harness to TypeScript by @danny-avila in #14530
• 📦 chore: bump @librechat/agents to v3.3.9 by @danny-avila in #14548
• 📦 chore: bump @librechat/agents to v3.3.11 by @danny-avila in #14562
• 📦 chore: update sanitize-html to latest by @danny-avila in #14573
• 🌀 ci: Deterministic Circular Dependency Checks by @danny-avila in #14579
• 🔒 chore: Upgrade react-router-dom to v7.18.2 (security) by @danny-avila in #14582
• 🧪 ci: Settle to render-idle before ConversationsSection memo baselines by @danny-avila in #14590
• 🧹 chore: Migrate Legacy Duplicate Code Files Blocking Dedupe Index by @danny-avila in #14593
• 📦 chore: npm audit by @danny-avila in #14640
• 🛰️ chore: bump @librechat/agents to v3.4.0, cover streamed subagent results e2e by @danny-avila in #14647
• 🫆 chore: Remove Published Credential Defaults by @danny-avila in #14680
• 🐋 chore: add opt-in alternative local stack experiments by @danny-avila in #14678
• ⚙️ ci: Bump GitHub Actions to Node.js 24 Runtimes by @berry-13 in #14689
• 📦 chore: bump @librechat/agents to v3.4.2 and npm audit by @danny-avila in #14702
• 🚦 ci: Reduce GitHub Actions Runner Pressure by @berry-13 in #14716
• 🧩 ci: Close Workflow Path-Filter Gaps by @danny-avila in #14728
• 🛻 ci: Move the ESLint Config Sweep Into Its Own Job by @danny-avila in #14742
• 🧷 ci: Enforce Durable Agent Finalization for E2E tests by @danny-avila in #14740
• 🪶 chore: Aggregate Empty MCP Tool Logs by @danny-avila in #14767
• 📦 chore: Update @librechat/agents to v3.4.6 by @danny-avila in #14781
• 🌍 ci: Harden Locize Translation Sync by @danny-avila in #14784
• 🔌 chore: Bump the MCP SDK to 1.30.0 and Parse Content-Type Instead of Searching It by @danny-avila in #14820
• ci: gate the e2e activity-phase DOM assertions on the persisted phase by @danny-avila in #14821

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14053
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14070
• 🌍 i18n: Localize Token Balance Error Message by @Philipp-Voss in #14169
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14266
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14307
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14266
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14376
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14406
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14460
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14598
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #14739
• 🌐 chore: Restore English Localization Source Values by @danny-avila in #14743

New Contributors

• @alexkorep made their first contribution in #14034
• @jakacenta made their first contribution in #14046
• @Zirkonium88 made their first contribution in #13989
• @arjunvijay24 made their first contribution in #14040
• @mahirhir made their first contribution in #13996
• @Osamaali313 made their first contribution in #13999
• @Philipp-Voss made their first contribution in #14169
• @VictorEPlus made their first contribution in #14172
• @adamscross04 made their first contribution in #14177
• @manisrinivasan2k1 made their first contribution in #14082
• @jomspk made their first contribution in #14232
• @jjhidalgar-celonis made their first contribution in #14254
• @Aho-Bakaa made their first contribution in #14262
• @joshbla made their first contribution in #13930
• @unsnow-iac made their first contribution in #14436
• @schumajs made their first contribution in #14538
• @cyphercodes made their first contribution in #14507
• @likeabas made their first contribution in #14764
• @jtodaroii made their first contribution in #14774
• @lizzykerrigan made their first contribution in #14791
• @mihidumh made their first contribution in #14810
• @snapydziuba made their first contribution in #14761

Full Changelog: v0.8.7...v0.8.8-rc1

Original source

What's Changed

• 🧹 chore: Add CI workflow and PR template by @dustinhealy in #2
• 🪟 fix: Correctly Resolve Windows Path by @danny-avila in #1
• 🎨 style: Improved Sidebar, Accordion, and Help Page UI by @danielclickh in #3
• 📜 chore: Bump deps, fix TOC navigation, add Click UI tooling, code splitting by @danny-avila in #4
• 🖱️ fix: Role and Group Scroll Areas by @dustinhealy in #5
• 🛝 fix: Render Sidebar Text by @dustinhealy in #6
• ☸️ feat: Add API_SERVER_URL for separate server-side and browser API URLs by @dustinhealy in #14
• 🌏 i18n: Localize Stray Strings by @dustinhealy in #7
• 👆 fix: Widen Click Area on Capability Panel Headers by @dustinhealy in #10
• 🔒 fix: Read-Only Edit Dialogs Without Manage Permission by @dustinhealy in #11
• 🔍 fix: Roles Search and Pagination by @dustinhealy in #12
• 🐛 fix: Copy tools/ Dir in Dockerfile for Local ESLint Plugin Dependency and Pin Bun to Latest by @dustinhealy in #15
• 🐳 feat: Add GHCR Docker Image Publish Workflow by @dustinhealy in #16
• 🗿 fix: Static Cache Headers by @danny-avila in #19
• 🐛 fix: Lowercase GHCR Tag and Add Workflow Path Trigger by @dustinhealy in #17
• 🐳 chore: Use Published GHCR Image in Docker Compose by @dustinhealy in #20
• ♿ chore: Bump Click UI to v0.2.0-rc.4, Fix Dialog A11y Warnings by @punkbit in #21
• 🍪 feat: Configurable Secure Cookie Behavior by @XHyperDEVX in #25
• 🔭 feat(o11y): Add Prometheus Metrics Endpoint and HTTP Instrumentation by @pjhampton in #26
• 🛠 chore: Copy src/server to Runtime Image for Metrics Module by @dustinhealy in #31
• 🐛 fix: Move useEffect before conditional return in AppLayout by @chemsseddine in #41
• 🐛 fix: Preserve typed values when adding entries to new sections by @dustinhealy in #37
• 🐛 fix: Stop guessing URL fields from key names in config form by @dustinhealy in #38
• 🔄 feat: Body-Based OpenID Refresh for Cross-Origin Admin Panels by @dustinhealy in #46
• 🔒 feat: Enforce minimum length for SESSION_SECRET by @danny-avila in #49
• 🪵 refactor: Improve OpenID redirect origin handling and startup logs by @danny-avila in #50
• 🧷 chore: Pin TanStack Dependency Versions by @danny-avila in #51
• fix: bound admin panel metrics labels by @danny-avila in #58
• fix: guard admin sso pkce verifier loss by @danny-avila in #59
• 📦 chore: Bump librechat-data-provider and @librechat/data-schemas by @dustinhealy in #64
• fix: Avoid admin route fan-out after denied capabilities by @danny-avila in #67
• feat: add subpath route support by @Airamhh in #60
• feat: add ADMIN_SSO_ENABLED to hide SSO login button by @danny-avila in #71
• fix: use durable mcp tombstones for scoped deletes by @danny-avila in #70
• 📦 chore: Bump librechat-data-provider and @librechat/data-schemas by @dustinhealy in #77
• 🪒 feat: Tighten Read-Only UX in Disabled Config Sections by @dustinhealy in #76
• ci: declare least-privilege workflow-level contents: read by @arpitjain099 in #66
• ↪️ fix: Follow IdP end-session Redirect on Admin Sign Out by @ahmedai1 in #69
• 👯‍♀️ fix: Dedupe @radix-ui/react-dismissable-layer to Unblock Body Clicks by @dustinhealy in #80
• 🥂 feat: Toasts on All Save Actions by @dustinhealy in #81
• 🪵 feat: Audit Logs by @dustinhealy in #52
• 🛗 chore: Bump Dependencies & Fix "Add / Remove Item" form submission by @danny-avila in #83
• ♻️ feat: Reset Base Config to Default i.e. librechat.yaml if configured by @danny-avila in #84
• 🚦 fix: Fail Fast on Missing SESSION_SECRET, Harden Session Read by @danny-avila in #85
• ⬆️ chore: Bump LibreChat Packages & Add Locale Keys for New Config Fields by @danny-avila in #89

New Contributors

• @danny-avila made their first contribution in #1
• @danielclickh made their first contribution in #3
• @punkbit made their first contribution in #21
• @XHyperDEVX made their first contribution in #25
• @pjhampton made their first contribution in #26
• @chemsseddine made their first contribution in #41
• @Airamhh made their first contribution in #60
• @arpitjain099 made their first contribution in #66
• @ahmedai1 made their first contribution in #69

Full Changelog: https://github.com/ClickHouse/librechat-admin-panel/commits/v1.0.0

Original source

The v0.8.7 release of LibreChat

What's Changed

🏞️ Highlights

• Chat projects for organizing chats into folders
• Context Usage gauge showing current window usage, tokens used, and cost (optional)
• Agents with skills enabled can author new skills on the fly
• GitHub sync for skills, and local bundled skills
• Settings redesign, keyboard shortcuts, default pinned tools, and pinned conversations.
• Provider updates:
  • Claude Fable 5, Anthropic custom endpoints, prompt cache TTL, Google URL Context with YouTube handling, and custom endpoint option for reasoning replay.
• Shared links, OpenID, and MCP now have stronger access controls and safer auth flows.
• Bundled Admin Panel to default compose files
• Released Code Interpreter for secure code execution and file generation

✨ Features

• 🔐 feat: Use SecretInput for Sensitive Fields by @berry-13 in #12955
• 📡 feat: Add Authenticated Proxy Mode for Browser RUM Telemetry by @upman in #13464
• 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP server connections by @jcbartle in #13429
• 🪜 feat: Add OpenID Role Sync by @danny-avila in #13415
• 🗃️ feat: Retain Agent Files During All-Data Retention by @danny-avila in #13477
• 🎭 feat: Add Credential-Free Playwright Smoke Suite with a Local Mock LLM by @teresama in #13472
• ⚡ feat: Immediate Conversation Title Generation by @danny-avila in #13395
• 🛰️ feat: Add Auth Fallback Observability by @danny-avila in #13488
• 🔗 feat: Add Granular Access Control to Shared Links via ACL System by @AtefBellaaj in #13051
• 🗂️ feat: Add Private Chat Projects by @danny-avila in #13467
• 🎚️ feat: Add Focus Management and Drag-to-Scrub to MessageNav by @danny-avila in #13497
• 🗂️ feat: Add Agent File Authoring Tools by @danny-avila in #13435
• 📜 feat: Improve Skill Authoring Guidance by @danny-avila in #13517
• 🧭 feat: Scope Model Spec Skills by @danny-avila in #13522
• 🗂️ feat: Add Deployment Skill Directory by @danny-avila in #13523
• 🏪 feat: Surface Agent Marketplace in Model Selector by @danny-avila in #13553
• 🌱 feat: Support Soft Default Model Spec by @danny-avila in #13554
• ⏳ feat: Make OpenID Token Reuse Window Configurable by @pboers1988 in #13546
• 📊 feat: Surface Message Feedback as Langfuse Scores by @graphaelli in #13544
• 🧩 feat: Enable Model Spec Subagents by @danny-avila in #13598
• 🛡️ feat: Configurable Message PII Filter by @dustinhealy in #13602
• 📖 feat: Add Claude Fable 5 Support by @danny-avila in #13628
• 🛰️ feat: Add GPT-5.5 + Frontier OpenAI Models, Drop Deprecated Defaults by @danny-avila in #13636
• 🧬 feat: Add GitHub Skill Sync by @danny-avila in #13293
• 🏷️ feat: Surface Model Spec Branding on Landing and Selector by @danny-avila in #13662
• 📊 feat: Real-Time Context Window & Token Usage Tracking by @danny-avila in #13670
• 📬 feat: Report Tool Results Per Call via onResult Channel by @danny-avila in #13698
• ⌚ feat: Show Message Timestamps on Hover by @danny-avila in #13709
• 💬 feat: Conversation Starters for Model Specs by @danny-avila in #13710
• 💾 feat: Persist Context Breakdown & Branch/Total Usage Cost by @danny-avila in #13734
• 💸 feat: Per-Agent Endpoint Token Config in Multi-Endpoint Billing by @danny-avila in #13738
• 🪙 feat: Context Gauge UX, Hover Snapshot, Click Breakdown, Currency, Cost-On-By-Default by @danny-avila in #13739
• 📨 feat: Custom Headers on Built-in Provider Endpoints by @danny-avila in #13742
• 🅰️ feat: Native Anthropic Provider for Custom Endpoints by @danny-avila in #13748
• 🔚 feat: Add Bottom Terminus Node to Message Minimap Navigation by @danny-avila in #13853
• 🪙 feat: SDK-Aligned Context-Usage Projection by @danny-avila in #13801
• 🔖 feat: Add Pinned Conversations by @dlew in #13492
• 📛 feat: Tag Langfuse Traces With Tenant ID by @upman in #13808
• 🕰️ feat: Resolve Agent Prompt Time Variables in User's Timezone by @berry-13 in #13815
• 🎛️ feat: Redesign Settings with Registry-Driven Dialog, Search, and Mobile Drill-In by @berry-13 in #13722
• 🔑 feat: Agent API Keys management UI in Settings → Data controls by @berry-13 in #13819
• 📒 feat: Audit Log Backend for SystemGrant Assign and Revoke Events by @dustinhealy in #13087
• 🕐 feat: Add promptCacheTtl model parameter for 1h/5m cache duration by @danny-avila in #13835
• 🔑 feat: Surface User-Provided API Keys in Settings, Scoped to Reachable Endpoints by @danny-avila in #13864
• 🪙 feat: Add Token Pricing for Devstral, Voxtral, Holo2, and Mistral Medium by @JumpLink in #13863
• 📌 feat: Seed Default Pinned Tools and MCP Dropdown via Interface Config by @danny-avila in #13865
• 🔗 feat: Snapshot Files for Shared-Link Attachments by @danny-avila in #13740
• 🖇️ feat: Reference Selected Chat Text with Multi-Quote Popup by @danny-avila in #13868
• 🐳 feat: Bundle Admin Panel in Docker Compose Stacks by @danny-avila in #13876
• ⌨️ feat: Keyboard Shortcuts by @berry-13 in #12425
• 🧠 feat: Configurable Reasoning Replay for Custom Endpoints by @danny-avila in #13921
• 📺 feat: Google URL Context Param with Native YouTube Video Understanding by @danny-avila in #13924

🐛 Fixes

• 💭 fix: Preserve Custom Endpoint Reasoning Params by @danny-avila in #13447
• 🪝 fix: Apply Isolation Plugin to Distinct Queries by @danny-avila in #13457
• 🪝 fix: Preserve Grouped Tool Expansion During Streaming by @danny-avila in #13462
• 🛂 fix: Gate RUM Proxy Route on the RUM_ENABLED Flag by @upman in #13475
• 🏷️ fix: Prevent Bedrock Cache Tokens from Inflating Completion Count by @joohan-lee in #13468
• 🪤 fix: Reload Messages When Reopening a Chat from a Non-Chat Route by @danny-avila in #13501
• 🚦 fix: Gate Chat Starts During Readiness by @danny-avila in #13502
• 🧷 fix: Bind Agent File Context to Current Turn by @danny-avila in #13506
• 💼 fix: Harden Shared-Link Message Sanitization with an Allowlist by @danny-avila in #13510
• 🖼️ fix: Upgrade Framer Motion for Vite 8 Compatibility by @dlew in #13512
• 🪡 fix: Handle Missing Skill File Upsert Metadata by @danny-avila in #13520
• 👻 fix: Clear Project-Scoped Landing When the Selected Project Is Deleted by @danny-avila in #13525
• 🧭 fix: Restore Empty Skill Allowlist Catalog by @danny-avila in #13526
• 🪦 fix: Add Durable MCP Config Tombstones by @danny-avila in #13534
• 🔐 fix: Handle Multiple Concurrent MCP OAuth Login Prompts by @janluedemann-esome in #13200
• 🔐 fix: Reuse MCP OAuth Authorization URL by @danny-avila in #13532
• 🪪 fix: Filter ACL Principal Details by @danny-avila in #13524
• 🖼️ fix: Support Known Endpoint Group Icons by @danny-avila in #13542
• 📊 fix: Contain Markdown Table Overflow by @danny-avila in #13543
• 📎 fix: Preserve Provider Document Uploads by @danny-avila in #13550
• 🛠️ fix: Enable Gemini Mixed Tool Config by @danny-avila in #13538
• 🚦 fix: Guard Auth Continuation with Dedicated Limiter by @danny-avila in #13555
• 🏷️ fix: Categorize Auth Tokens by Flow Type by @danny-avila in #13556
• 📎 fix: Scope Attachment Usage to Request Owner by @danny-avila in #13557
• 🛂 fix: Normalize Verification Flow Error Responses by @danny-avila in #13558
• 🔀 fix: Reconcile Agent Action Credential Merges by @danny-avila in #13559
• 🧼 fix: Prevent Shared Link Caching and Strengthen Log Redaction by @danny-avila in #13561
• 🩹 fix: Double-Assert Partial Test Fixture in EndpointIcon by @danny-avila in #13567
• 🩹 fix: Bump GitNexus to 1.6.5 and Fail-Soft the PR Index Job by @danny-avila in #13569
• 🏷️ fix: Preserve Generated Conversation Title on Stop by @danny-avila in #13568
• 📻 fix: Replay MCP OAuth Prompts for Coalesced Connections by @danny-avila in #13565
• 🔐 fix: Resolve Env Variables in MCP OAuth URL Fields by @rene84 in #13573
• 🌿 fix: Anchor Post-Auth MCP Stream to Submission Message Tree by @danny-avila in #13582
• 🚧 fix: Add Per-User Throttle to 2FA Continuation Attempts by @danny-avila in #13583
• 📌 fix: Preserve Project Scope Through Enforced Model Specs by @danny-avila in #13586
• 🪞 fix: Preserve Model Spec Icons Across Stream Resume and Abort by @danny-avila in #13603
• 🧠 fix: Bound Memory Agent Input by @danny-avila in #13606
• 👷 fix: Preserve disabled build info flag in loadDefaultInterface by @ethanlaj in #13608
• ✂️ fix: Deduplicate Skill Bodies Across Fresh Primes and History by @danny-avila in #13610
• 🌍 fix: Prefer Imagen-Specific Location over Default Google Region by @pedrojreis in #13613
• 🛬 fix: Coalesce Auth Recovery into a Single Refresh Flight by @danny-avila in #13618
• 🧵 fix: Reject Preliminary Parent Follow-Ups by @danny-avila in #13619
• ⏳ fix: Extend and Decouple MCP OAuth Flow Timeouts by @danny-avila in #13622
• ♊ fix: Sanitize MCP Tool Schemas for Gemini/Vertex Compatibility by @danny-avila in #13623
• 🚫 fix: Hide Empty Agents Endpoint from Model Selector by @danny-avila in #13624
• 🗝️ fix: Resolve MCP Runtime User and Request Placeholders by @danny-avila in #13626
• 🔇 fix: Suppress Expected Speech Synthesis Cancellation Errors by @upman in #13627
• 🎙️ fix: Resolve Speech Recognition CJS/ESM Import Shape by @upman in #13631
• 🕳️ fix: Guard Sparse Content Parts in Message Nav Preview by @upman in #13632
• 🎞️ fix: Stream File Authoring Previews from Partial Tool Args by @danny-avila in #13634
• 📥 fix: ChatGPT Conversation Import Failures by @danny-avila in #13637
• 🪶 fix: Prevent Soft Default Model Spec from Overriding User Selections by @danny-avila in #13642
• 🧭 fix: Mobile Sidebar Navigation on Projects View by @danny-avila in #13647
• 🎫 fix: Forward User Auth Headers on Model Fetch by @Ivan-Apro in #13616
• 🚪 fix: Align Mobile Sidebar Toggle Gating with JS Breakpoint Across Views by @danny-avila in #13654
• 📐 fix: Sidebar Chat List Width Tracking and Stale Row Measurements by @danny-avila in #13655
• 🚷 fix: Reject Client-Supplied Subagent Configuration by @danny-avila in #13660
• 🎒 fix: Carry Request-Scoped MCP Tools into PTC Execution by @danny-avila in #13669
• 🚐 fix: Reuse Request-Scoped MCP Connections per Run by @danny-avila in #13673
• 🔒 fix: Scan All Message Roles in messageFilter.pii by @dustinhealy in #13677
• 🛟 fix: Auto-Recover from Stale Service Worker Assets After Deploys by @danny-avila in #13686
• 🥇 fix: Send First OpenID Audience on Authorization Requests by @danny-avila in #13694
• 🔌 fix: Preserve Ephemeral MCP Selections Across Model Switches by @danny-avila in #13697
• 🛬 fix: Prevent Viewed Conversations from Re-Arming the Soft Default Spec by @danny-avila in #13699
• 🪢 fix: Prune Dangling Skill IDs from Agent Allowlists by @danny-avila in #13702
• 🗄️ fix: Gate Request-Scoped MCP Servers Out of Persistent Tool Cache by @danny-avila in #13672
• 🧾 fix: Bill Subagent Child-Run Model Usage in Parent Transactions by @danny-avila in #13683
• 🔧 fix: Honor NO_PROXY for OpenID requests when PROXY is set by @danny-avila in #13716
• 🌐 fix: Centralize Outbound Proxy Handling by @danny-avila in #13726
• 🌿 fix: Preserve Viewed Branch on Sibling-Tree Churn by @danny-avila in #13732
• 🎨 fix: Gate message hover-reveal controls on hover capability, not width by @danny-avila in #13712
• 🔍 fix: Render Web Search Favicons on Raw SERP Results During Streaming by @danny-avila in #13741
• 🔢 fix: Prevent "approximately" tildes from rendering as markdown subscript by @danny-avila in #13743
• 🪙 fix: Correct Context Usage Gauge After Summarization by @danny-avila in #13744
• 📈 fix: Isolate RUM Telemetry Proxy Auth from App Auth by @danny-avila in #13765
• 🫷 fix: Withhold Anthropic Custom Headers From User URLs by @danny-avila in #13767
• 🏘️ fix: Scope Skill Sync Status by @danny-avila in #13771
• 🗂️ fix: Scope Token Config Cache by @danny-avila in #13770
• 🪢 fix: Tie MCP Cleanup To Resumable Runs by @danny-avila in #13769
• 🫷 fix: Withhold Anthropic Custom Headers From User URLs by @danny-avila in #13767
• 🏘️ fix: Scope Skill Sync Status by @danny-avila in #13771
• 🗂️ fix: Scope Token Config Cache by @danny-avila in #13770
• 🎤 fix: Keep Microphone Icon Visible On Initial Chat Render by @danny-avila in #13788
• 🗜️ fix: Support Windows ZIP MIME Uploads by @danny-avila in #13794
• 🥽 fix: Restrict MCP Server URL Disclosure to Admins, Owners, and Editors by @dustinhealy in #13784
• 🩹 fix: Bill Anthropic Prompt-Cache Tokens Once by @danny-avila in #13798
• 🪃 fix: Restore Raw Spec Fallback for Enforced Presets by @danny-avila in #13804
• 🔐 fix: Honor Admin-Panel MCP Allowlist Overrides Without Restart by @danny-avila in #13814
• 🔖 fix: Decrement Bookmark Counts When Deleting Conversations by @danny-avila in #13830
• 🔗 fix: Surface Share Permissions Load Error as Alert Button With Tooltip by @danny-avila in #13833
• 🧷 fix: Preserve Document Priority on Section-Scoped Config Writes by @dustinhealy in #13772
• 🪞 fix: Match Prompt Cache TTL Control to Region Combobox Styling by @danny-avila in #13839
• 🐛 fix: Resolve dayjs plugin ESM imports in data-provider by @danny-avila in #13851
• ♊ fix: Strip Remaining Unsupported JSON Schema Keywords for Gemini MCP Tools by @danny-avila in #13850
• 🎒 fix: Apply OCR Context to Responses API Agents and Handoffs by @Airamhh in #13707
• 🏷️ fix: Scope File Search entity_id to Agent Knowledge-Base Files Only by @msserpa in #13693
• 🪢 fix: Paginate MCP tools/list to Load All Tools by @TomasPalsson in #13840
• 🚪 fix: Gate Artifacts Toggle on Agent Capability Flag by @serhiizghama in #13665
• 🎯 fix: Narrow Public Share 401 Bypass to the Share Endpoint Only by @danny-avila in #12905
• 🔐 fix: Gate Shared Startup Config By Link Access by @danny-avila in #13897
• ✂️ fix: Cap Audit Chain Verification and Honor Client Cancellation by @danny-avila in #13903
• 🍪 fix: Validate Shared-File Cookie Auth Against the Live Refresh Session by @danny-avila in #13908
• 💰 fix: Bound MCP tools/list Pagination with Aggregate Budgets by @danny-avila in #13909
• 🪣 fix: Cap Context Projection Workload Before Tokenization by @danny-avila in #13910
• 🪜 fix: Strip Caller-Supplied Priority from Assign-Only Config Upserts by @danny-avila in #13911
• 🛂 fix: Re-Check execute_code Authorization on Event-Driven Tool Loads by @danny-avila in #13912
• 🤐 fix: Withhold Custom Endpoint Headers for User URLs by @danny-avila in #13917
• 🧾 fix: Harden Historical File Authorization by @danny-avila in #13918
• 🧭 fix: Harden User Provided Endpoint URL Protection by @danny-avila in #13919
• 🐛 fix: Prevent Infinite Render Loop on Code-Execution File Preview by @danny-avila in #13922
• 🖱️ fix: Summon Quote Popup on Double-Click Word Selection by @danny-avila in #13923
• 🧹 fix: Order Enabled Guard After Config Expansion in useGetAgentByIdQuery by @dlew in #13927
• 🌵 fix: Align Mention Empty Result Behavior With Skills Command by @Oliver777int in #13928
• 🪤 fix: Guard Prompts Popover Against Empty Result Keyboard Navigation by @danny-avila in #13931

🔧 Refactoring and Performance

• 👑 refactor: Scope Role Cache Keys by Isolation Context by @danny-avila in #13454
• 🎛️ refactor: Scope App-Config Override Cache by Isolation Context by @danny-avila in #13455
• 🩻 refactor: Replace Opaque OAuth Errors with Structured Failure Diagnostics by @danny-avila in #13471
• 🃏 refactor: Agent Avatar Conversation Icons and Streaming Indicators by @danny-avila in #13563
• 🏛️ refactor: Prioritize Deployment Skills over Persisted Duplicates by @danny-avila in #13575
• 🧊 perf: Memoize Completed Markdown Blocks During Streaming by @danny-avila in #13576
• ⚡ perf: Migrate data-schemas Build to tsdown with isolatedDeclarations by @danny-avila in #13578
• ⚡️ refactor: Migrate @librechat/api Build to tsdown by @danny-avila in #13595
• ⚡ refactor: Migrate data-provider Build to tsdown by @danny-avila in #13597
• ⚡ refactor: Migrate @librechat/client Build to tsdown by @danny-avila in #13596
• 📦 chore: Declare runtime deps externalized by tsdown in @librechat/api by @danny-avila in #13600
• 📋 refactor: Attach Message Context to Langfuse Feedback Scores by @danny-avila in #13604
• ⚙️ refactor: Lazy-load HEIC upload conversion by @upman in #13638
• ⚙️ refactor: lazy-load React Query Devtools by @upman in #13639
• ⚙️ refactor: Lazy load locale resources by @upman in #13640
• ⚙️ refactor: Brotli asset serving behind a feature toggle by @upman in #13641
• 🤫 refactor: Silent MCP OAuth Refresh on Mid-Session 401 by @danny-avila in #13369
• 📡 refactor: Gate Noisy Redis OTEL Instrumentation by @danny-avila in #13764
• 🧾 refactor: Disable Context Cost By Default by @danny-avila in #13768
• 🪙 refactor: Reconcile Context Gauge to Actual Provider Tokens by @danny-avila in #13780
• 🪵 refactor: Bound Log Traversal And Remove Legacy api/config Logger by @danny-avila in #13813
• 🦜 refactor: Use path for Read/Write/Edit/Create File Tools by @danny-avila in #13834
• 🛂 refactor: Accept Targeted assign:configs for Config Scope-Lifecycle Endpoints by @dustinhealy in #13773
• 👐 a11y: Bump @ariakit/react , Improve a11y of Token Usage, Archived Chats, Reduce Table Layout Shifts by @danny-avila in #13874
• 🛑 refactor: Demote User Abort Logs by @danny-avila in #13904
• 🪶 refactor: Ground Default Model Spec Selection in Conversation Recency by @danny-avila in #13915

🧪 Tests

• 🧪 test: Add E2E Regression For 2FA framer-motion Crash by @danny-avila in #13513
• 🎭 test: Run Mock E2E Suite Through createRun With In-Process Fake Model by @danny-avila in #13508
• 🌲 test: Add E2E Coverage for Message Tree Streaming by @danny-avila in #13570
• ✅ ci: Add mock e2e coverage for agents, prompts, MCP, and chat flows by @teresama in #13589

📦 Dependencies, Chores & CI

• 🏷️ ci: Sync Helm Chart Tags by @danny-avila in #13446
• 🐳 chore: Upgrade Docker Builds To Node 24 by @danny-avila in #13448
• ⛑️ ci: Fix Helm Tag Sync Workflow Planning by @danny-avila in #13451
• ⚡ chore: Upgrade Vite For Node 24 by @danny-avila in #13450
• 🗼 ci: Guard Scoped Model Applies the Isolation Plugin by @danny-avila in #13458
• 🪪 ci: Fix Helm Tag Sync Git Auth by @danny-avila in #13460
• 🤫 chore: Quiet Repetitive Log Noise from Balance, CloudFront, and Capability Paths by @danny-avila in #13461
• 📉 refactor: Reduce Frontend Build Warning Noise by @danny-avila in #13463
• 🌎 ci: Fix Locize Sync CDN Mode by @danny-avila in #13465
• ⚡ refactor: Change Minifier from 'terser' to 'oxc' in Vite Config by @danny-avila in #13476
• 🧭 ci: Use System Chrome for Mock E2E by @danny-avila in #13481
• 🪧 chore: Generalize Project Name Placeholder by @danny-avila in #13514
• 📦 chore: npm audit fix by @danny-avila in #13515
• 🗼 ci: Shard Windows Frontend Unit Tests by @danny-avila in #13651
• 🗜️ ci: Cache Dependencies and Builds in Cache Integration Tests by @danny-avila in #13652
• 🤗 ci: Cache and Authenticate HF Model Downloads in GitNexus Index by @danny-avila in #13653
• ⏫ ci: Bump GitNexus to 1.6.7 to Fix Embeddings Index Timeout by @danny-avila in #13658
• 🗝️ chore: Use Element Access over any -Casts in Registry Cache Spec by @danny-avila in #13664
• 📦 chore: Update Turbo package to v2.9.17 by @danny-avila in #13593
• 🧹 ci: Relieve disk pressure on GitNexus deploy by @danny-avila in #13666
• 📦 chore: npm audit fix by @danny-avila in #13701
• 🧂 chore: Require an Operator-Supplied Admin Panel Session Secret by @danny-avila in #13902

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13466
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13482
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13505
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13766
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13836
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13875
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13892
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13914

New Contributors

• @jcbartle made their first contribution in #13429
• @teresama made their first contribution in #13472
• @joohan-lee made their first contribution in #13468
• @graphaelli made their first contribution in #13544
• @rene84 made their first contribution in #13573
• @pedrojreis made their first contribution in #13613
• @Ivan-Apro made their first contribution in #13616
• @berry-13 made their first contribution in #12425
• @JumpLink made their first contribution in #13863
• @TomasPalsson made their first contribution in #13840
• @msserpa made their first contribution in #13693
• @Airamhh made their first contribution in #13707
• @serhiizghama made their first contribution in #13665
• @Oliver777int made their first contribution in #13928

Full Changelog: v0.8.6...v0.8.7

Original source

Added interface.sharedLinks

• Allows shared-link permissions to be bootstrapped from librechat.yaml
• Supports either a boolean or granular create, share, and public permissions
• public controls whether authenticated users can share links with everyone; anonymous access remains controlled by ALLOW_SHARED_LINKS_PUBLIC

Added interface.mcpServers.configureObo

• Seeds the permission required to configure MCP On-Behalf-Of token exchange
• Applies to the MCP_SERVERS.CONFIGURE_OBO role permission

Added mcpServers..obo

• Allows sse and streamable-http MCP servers to exchange the current user's OpenID token for a delegated downstream token
• Requires a non-empty scopes value

Added mcpServers..customUserVars..sensitive

• Controls whether a user-provided MCP variable is treated as a secret in the UI
• Defaults to masked/secret behavior when omitted

Added plugin authConfig[].sensitive

• Controls whether plugin authentication fields render as secret inputs
• Defaults to masked/secret behavior when omitted

Updated MCP OAuth URL handling

• YAML-defined OAuth URL fields now resolve ${ENV_VAR} values before URL validation
• User-submitted MCP OAuth endpoint URLs reject ${ENV_VAR} placeholders so server environment variables remain admin-controlled

Added MCP OAuth timeout environment variables

• MCP_OAUTH_HANDLING_TIMEOUT controls how long LibreChat waits for a user to complete an MCP OAuth flow
• MCP_OAUTH_FLOW_TTL controls OAuth flow-state retention and is clamped to outlive the handling timeout
• The MCP server-card polling window now follows the server-configured OAuth timeout

Added OTEL_IOREDIS_TRACING_ENABLED

• Enables Redis command-level OpenTelemetry spans when backend tracing is enabled
• Defaults to disabled so normal backend traces stay high-level and avoid noisy Redis spans

Updated authenticated RUM proxy behavior

• RUM proxy auth now drops invalid or expired browser telemetry with 204 instead of returning API auth errors
• RUM proxy outcomes are counted with rum_proxy_requests_total by endpoint and result

Added interface.retainAgentFiles

• Allows persistent agent resource files to be exempted from retentionMode: "all"
• Non-agent files and message attachments still expire according to the configured retention policy

Added endpoint titleTiming

• immediate generates titles as soon as the request starts, in parallel with the model response
• final keeps the legacy behavior and waits for the full response before title generation
• Can be set per endpoint or globally under endpoints.all

Added endpoints.agents.skills.maxCatalogSkills

• Caps the number of active accessible skills exposed in the model-visible skill catalog

Added memory.maxInputTokens

• Caps the number of recent-chat tokens sent to the automatic memory agent
• Defaults to 12000
• Long memory-agent inputs are truncated from the beginning so the newest context is preserved

Added endpoints.custom[].customParams.reasoningFormat

• Controls how OpenAI-compatible custom endpoints receive reasoning parameters
• Supports reasoning_effort, reasoning_object, and disabled

Added endpoints.custom[].customParams.reasoningKey

• Controls which response key is read for provider reasoning content
• Supports reasoning and reasoning_content

Updated endpoints.custom[].headers model-fetch behavior

• Header templates are now resolved and forwarded to models.fetch requests when the endpoint base URL is admin-controlled
• A configured Authorization header takes precedence over the endpoint apiKey Bearer fallback
• Header templates are not forwarded when baseURL: "user_provided" is configured

Added built-in endpoint headers

• endpoints.openAI.headers, endpoints.anthropic.headers, and endpoints.google.headers forward custom request headers to provider calls while preserving native provider request shapes
• endpoints.all.headers can set global headers, with endpoint-specific headers winning on key collisions
• Values support ${ENV_VAR}, {{LIBRECHAT_USER_*}}, and request body placeholders such as {{LIBRECHAT_BODY_CONVERSATIONID}}
• Provider-managed auth and required protocol headers remain authoritative, and admin-configured headers are withheld when a user controls the destination base URL

Added endpoints.custom[].provider

• Currently supports provider: anthropic
• Routes that custom endpoint through the native Anthropic /v1/messages client instead of the default OpenAI-compatible client
• Uses the custom endpoint's baseURL, apiKey, headers, addParams, dropParams, and customParams.paramDefinitions
• Implies the Anthropic parameter set for the UI unless customParams.defaultParamsEndpoint is explicitly set to another value
• Native Anthropic custom endpoints should list models explicitly under models.default; OpenAI-style model auto-fetch is not used for this provider

Added modelSpecs.list[].softDefault

• Selects a model spec for first-time users without overriding later user selections

Added modelSpecs.list[].skills

• Enables, disables, or allowlists Skills for a model spec

Added modelSpecs.list[].subagents

• Enables or disables Subagents for ephemeral agents created from a model spec
• Supports enabled, allowSelf, and a private server-side agent_ids allowlist
• agent_ids is capped by the shared MAX_SUBAGENTS limit and is removed from startup config sent to clients
• Client-supplied Subagent configuration is rejected; model-spec values remain server-controlled

Added modelSpecs.list[].showOnLanding

• Shows the model spec's label and description on the chat landing in place of the default greeting
• Existing model specs are unchanged unless showOnLanding: true is set

Added modelSpecs.list[].conversation_starters

• Defines curated starter prompts shown on the chat landing when the model spec is selected
• Works with model-spec landing branding so admins can pair a spec label, description, and suggested first prompts

Updated modelSpecs.list[].description

• Plain text descriptions still render in the model selector
• Descriptions that start with < render through the config HTML sanitizer so admins can include safe inline markup and media in model selector items and landing branding

Added interface.contextUsage

• Controls whether the real-time context window and token usage gauge is shown in the conversation UI
• Defaults to true

Added interface.contextCost

• Controls whether usage cost is shown with context and token usage details
• Defaults to true

Added interface.currency

• Converts displayed usage costs from USD into another currency with code and positive rate
• Example: currency: { code: EUR, rate: 0.92 }

Added endpoints.custom[].tokenConfig

• Defines per-model context windows and per-million-token rates for custom endpoints
• Supports prompt, completion, context, and optional cacheRead and cacheWrite values for each model name
• Used by real-time context tracking, visible usage/cost breakdowns, and multi-endpoint agent billing

Updated context usage after summarization

• Persisted context usage now records a summary baseline marker after compaction
• Reloaded conversations use the compacted summary baseline plus post-summary turns instead of re-summing discarded pre-summary history
• The usage/cost walk still keeps cumulative spend across the full branch

Added skillSync.github

• Mirrors Skills from GitHub repositories into LibreChat
• Supports scheduled syncs with enabled, intervalMinutes, runOnStartup, and sources
• Each source supports id, owner, repo, ref, paths, skillDiscoveryDepth, credentialKey, token, and tenantId
• Sources must provide exactly one credential reference: either credentialKey for a stored admin credential or token as an environment variable reference like ${GITHUB_SKILLS_TOKEN}
• skillDiscoveryDepth defaults to 2 and is capped at 10
• intervalMinutes defaults to 60 and must be at least 5

Added messageFilter.pii

• Rejects submitted text that matches credential-shaped starter patterns or operator-defined regex patterns before it reaches the model or persistence
• The LibreChat chat route checks submitted user text; OpenAI-compatible Chat Completions and Responses requests scan text content across all caller-supplied message roles
• Starter pattern ids are sk_prefix, bearer_header, and api_key_header
• Custom patterns support id, label, and a JavaScript regex string

Updated OPENID_AUDIENCE

• Comma-separated values are accepted for JWT audience validation
• Authorization requests send the first non-empty audience value so providers that reject multi-value audience parameters still receive a single audience

Updated MCP runtime placeholders

• {{LIBRECHAT_BODY_*}} placeholders create request-scoped MCP connections that are reused for the current run and cleaned up when the request ends
• Request-scoped MCP servers are excluded from the persistent tool cache so request-specific headers and URLs are not reused outside the active run
• {{LIBRECHAT_USER_*}}, {{LIBRECHAT_OPENID_*}}, and {{LIBRECHAT_GRAPH_*}} placeholders still require user-scoped connections, but HTTP transports refresh resolved headers before each tool call without forcing a reconnect by themselves

Updated outbound proxy environment handling

• PROXY applies to both HTTP and HTTPS targets for supported server-side clients
• When PROXY is unset, supported clients honor HTTP_PROXY, HTTPS_PROXY, and NO_PROXY / no_proxy
• OpenID requests honor NO_PROXY even when PROXY is configured

Added ENABLE_STATIC_ASSET_BROTLI

• Enables serving precompressed .br static app assets when available
• When enabled, Brotli is preferred before gzip for API-served static files

Updated the config version to 1.3.13

Original source

The v0.8.7-rc1 release of LibreChat

What's Changed

🏞️ Highlights

• Access Control, Auth, and MCP
  • Added granular shared-link permissions, OpenID role sync, configurable OpenID token reuse windows, and MCP On-Behalf-Of token exchange for delegated downstream access.
  • Hardened MCP OAuth prompts, token flow categorization, OpenID audience handling, shared-link caching, auth continuation limiting, ACL principal filtering, runtime user/request placeholders, request-scoped MCP connections, request-scoped MCP tool caching, outbound proxy handling, and configurable MCP OAuth completion windows.
• Agents, Skills, and Projects
  • Added private chat projects, agent file authoring tools, deployment-provided Skills, GitHub Skill Sync, model-spec Skill/Subagent scoping, model-spec conversation starters, soft-default model specs, model-spec landing branding, and the agent marketplace in the model selector.
  • Deployment Skills now take precedence over persisted duplicates, memory-agent input is bounded, and repeated Skill bodies are deduplicated across fresh primes and message history.
• Safety and Admin Controls
  • Added configurable message PII filtering for credential-shaped text across caller-supplied API message roles and hardened model-spec Subagent config so clients cannot supply private Subagent allowlists.
• Observability and Operations
  • Added authenticated browser RUM proxy mode with isolated auth and outcome metrics, auth fallback observability, opt-in Redis command tracing, Langfuse feedback scores with message context metadata, Node 24 Docker builds, system Chrome mock E2E, and CI type checking for the client workspace.
• Conversation UX and Reliability
  • Conversation titles can now generate immediately, message navigation supports focus and drag-to-scrub, message timestamps appear on hover, shared-link snapshots are sanitized, viewed branches stay stable when sibling branches change, file-authoring previews stream earlier, stale service-worker assets auto-recover after deploys, and reopened chats reload correctly from non-chat routes.
• Provider and Reasoning Updates
  • Added Claude Fable 5, GPT-5.5, chat-latest, and refreshed frontier OpenAI defaults while dropping deprecated OpenAI defaults.
  • Custom endpoints preserve reasoning params, support native Anthropic-compatible providers, Bedrock cache tokens no longer inflate completion counts, Gemini mixed tool config is enabled, Gemini/Vertex MCP tool schemas are sanitized, Imagen uses its configured region, built-in provider endpoints can forward custom gateway headers, and provider document uploads are preserved.
• Streaming and Performance
  • Completed Markdown blocks are memoized during streaming, tool execution can report per-call results through onResult, context usage and cost update in real time with persisted branch/total breakdowns and correct post-summarization baselines, subagent child-run usage is billed into parent transactions, model-spec icons survive stream resume/abort, HEIC conversion, locale resources, React Query Devtools, and Brotli asset serving are lazy/toggled, message tree streaming is covered by E2E tests, and shared package builds now use tsdown with isolated declarations.

✨ Features

• 🔐 feat: Use SecretInput for Sensitive Fields by @berry-13 in #12955
• 📡 feat: Add Authenticated Proxy Mode for Browser RUM Telemetry by @upman in #13464
• 🔒 feat: Add On-Behalf-Of (OBO) token exchange support for MCP server connections by @jcbartle in #13429
• 🪜 feat: Add OpenID Role Sync by @danny-avila in #13415
• 🗃️ feat: Retain Agent Files During All-Data Retention by @danny-avila in #13477
• 🎭 feat: Add Credential-Free Playwright Smoke Suite with a Local Mock LLM by @teresama in #13472
• ⚡ feat: Immediate Conversation Title Generation by @danny-avila in #13395
• 🛰️ feat: Add Auth Fallback Observability by @danny-avila in #13488
• 🔗 feat: Add Granular Access Control to Shared Links via ACL System by @AtefBellaaj in #13051
• 🗂️ feat: Add Private Chat Projects by @danny-avila in #13467
• 🎚️ feat: Add Focus Management and Drag-to-Scrub to MessageNav by @danny-avila in #13497
• 🗂️ feat: Add Agent File Authoring Tools by @danny-avila in #13435
• 📜 feat: Improve Skill Authoring Guidance by @danny-avila in #13517
• 🧭 feat: Scope Model Spec Skills by @danny-avila in #13522
• 🗂️ feat: Add Deployment Skill Directory by @danny-avila in #13523
• 🏪 feat: Surface Agent Marketplace in Model Selector by @danny-avila in #13553
• 🌱 feat: Support Soft Default Model Spec by @danny-avila in #13554
• ⏳ feat: Make OpenID Token Reuse Window Configurable by @pboers1988 in #13546
• 📊 feat: Surface Message Feedback as Langfuse Scores by @graphaelli in #13544
• 🧩 feat: Enable Model Spec Subagents by @danny-avila in #13598
• 🛡️ feat: Configurable Message PII Filter by @dustinhealy in #13602
• 📖 feat: Add Claude Fable 5 Support by @danny-avila in #13628
• 🛰️ feat: Add GPT-5.5 + Frontier OpenAI Models, Drop Deprecated Defaults by @danny-avila in #13636
• 🧬 feat: Add GitHub Skill Sync by @danny-avila in #13293
• 🏷️ feat: Surface Model Spec Branding on Landing and Selector by @danny-avila in #13662
• 📊 feat: Real-Time Context Window & Token Usage Tracking by @danny-avila in #13670
• 📬 feat: Report Tool Results Per Call via onResult Channel by @danny-avila in #13698
• ⌚ feat: Show Message Timestamps on Hover by @danny-avila in #13709
• 💬 feat: Conversation Starters for Model Specs by @danny-avila in #13710
• 💾 feat: Persist Context Breakdown & Branch/Total Usage Cost by @danny-avila in #13734
• 💸 feat: Per-Agent Endpoint Token Config in Multi-Endpoint Billing by @danny-avila in #13738
• 🪙 feat: Context Gauge UX, Hover Snapshot, Click Breakdown, Currency, Cost-On-By-Default by @danny-avila in #13739
• 📨 feat: Custom Headers on Built-in Provider Endpoints by @danny-avila in #13742
• 🅰️ feat: Native Anthropic Provider for Custom Endpoints by @danny-avila in #13748

🐛 Fixes

• 💭 fix: Preserve Custom Endpoint Reasoning Params by @danny-avila in #13447
• 🪝 fix: Apply Isolation Plugin to Distinct Queries by @danny-avila in #13457
• 🪝 fix: Preserve Grouped Tool Expansion During Streaming by @danny-avila in #13462
• 🛂 fix: Gate RUM Proxy Route on the RUM_ENABLED Flag by @upman in #13475
• 🏷️ fix: Prevent Bedrock Cache Tokens from Inflating Completion Count by @joohan-lee in #13468
• 🪤 fix: Reload Messages When Reopening a Chat from a Non-Chat Route by @danny-avila in #13501
• 🚦 fix: Gate Chat Starts During Readiness by @danny-avila in #13502
• 🧷 fix: Bind Agent File Context to Current Turn by @danny-avila in #13506
• 💼 fix: Harden Shared-Link Message Sanitization with an Allowlist by @danny-avila in #13510
• 🖼️ fix: Upgrade Framer Motion for Vite 8 Compatibility by @dlew in #13512
• 🪡 fix: Handle Missing Skill File Upsert Metadata by @danny-avila in #13520
• 👻 fix: Clear Project-Scoped Landing When the Selected Project Is Deleted by @danny-avila in #13525
• 🧭 fix: Restore Empty Skill Allowlist Catalog by @danny-avila in #13526
• 🪦 fix: Add Durable MCP Config Tombstones by @danny-avila in #13534
• 🔐 fix: Handle Multiple Concurrent MCP OAuth Login Prompts by @janluedemann-esome in #13200
• 🔐 fix: Reuse MCP OAuth Authorization URL by @danny-avila in #13532
• 🪪 fix: Filter ACL Principal Details by @danny-avila in #13524
• 🖼️ fix: Support Known Endpoint Group Icons by @danny-avila in #13542
• 📊 fix: Contain Markdown Table Overflow by @danny-avila in #13543
• 📎 fix: Preserve Provider Document Uploads by @danny-avila in #13550
• 🛠️ fix: Enable Gemini Mixed Tool Config by @danny-avila in #13538
• 🚦 fix: Guard Auth Continuation with Dedicated Limiter by @danny-avila in #13555
• 🏷️ fix: Categorize Auth Tokens by Flow Type by @danny-avila in #13556
• 📎 fix: Scope Attachment Usage to Request Owner by @danny-avila in #13557
• 🛂 fix: Normalize Verification Flow Error Responses by @danny-avila in #13558
• 🔀 fix: Reconcile Agent Action Credential Merges by @danny-avila in #13559
• 🧼 fix: Prevent Shared Link Caching and Strengthen Log Redaction by @danny-avila in #13561
• 🩹 fix: Double-Assert Partial Test Fixture in EndpointIcon by @danny-avila in #13567
• 🩹 fix: Bump GitNexus to 1.6.5 and Fail-Soft the PR Index Job by @danny-avila in #13569
• 🏷️ fix: Preserve Generated Conversation Title on Stop by @danny-avila in #13568
• 📻 fix: Replay MCP OAuth Prompts for Coalesced Connections by @danny-avila in #13565
• 🔐 fix: Resolve Env Variables in MCP OAuth URL Fields by @rene84 in #13573
• 🌿 fix: Anchor Post-Auth MCP Stream to Submission Message Tree by @danny-avila in #13582
• 🚧 fix: Add Per-User Throttle to 2FA Continuation Attempts by @danny-avila in #13583
• 📌 fix: Preserve Project Scope Through Enforced Model Specs by @danny-avila in #13586
• 🪞 fix: Preserve Model Spec Icons Across Stream Resume and Abort by @danny-avila in #13603
• 🧠 fix: Bound Memory Agent Input by @danny-avila in #13606
• 👷 fix: Preserve disabled build info flag in loadDefaultInterface by @ethanlaj in #13608
• ✂️ fix: Deduplicate Skill Bodies Across Fresh Primes and History by @danny-avila in #13610
• 🌍 fix: Prefer Imagen-Specific Location over Default Google Region by @pedrojreis in #13613
• 🛬 fix: Coalesce Auth Recovery into a Single Refresh Flight by @danny-avila in #13618
• 🧵 fix: Reject Preliminary Parent Follow-Ups by @danny-avila in #13619
• ⏳ fix: Extend and Decouple MCP OAuth Flow Timeouts by @danny-avila in #13622
• ♊ fix: Sanitize MCP Tool Schemas for Gemini/Vertex Compatibility by @danny-avila in #13623
• 🚫 fix: Hide Empty Agents Endpoint from Model Selector by @danny-avila in #13624
• 🗝️ fix: Resolve MCP Runtime User and Request Placeholders by @danny-avila in #13626
• 🔇 fix: Suppress Expected Speech Synthesis Cancellation Errors by @upman in #13627
• 🎙️ fix: Resolve Speech Recognition CJS/ESM Import Shape by @upman in #13631
• 🕳️ fix: Guard Sparse Content Parts in Message Nav Preview by @upman in #13632
• 🎞️ fix: Stream File Authoring Previews from Partial Tool Args by @danny-avila in #13634
• 📥 fix: ChatGPT Conversation Import Failures by @danny-avila in #13637
• 🪶 fix: Prevent Soft Default Model Spec from Overriding User Selections by @danny-avila in #13642
• 🧭 fix: Mobile Sidebar Navigation on Projects View by @danny-avila in #13647
• 🎫 fix: Forward User Auth Headers on Model Fetch by @Ivan-Apro in #13616
• 🚪 fix: Align Mobile Sidebar Toggle Gating with JS Breakpoint Across Views by @danny-avila in #13654
• 📐 fix: Sidebar Chat List Width Tracking and Stale Row Measurements by @danny-avila in #13655
• 🚷 fix: Reject Client-Supplied Subagent Configuration by @danny-avila in #13660
• 🎒 fix: Carry Request-Scoped MCP Tools into PTC Execution by @danny-avila in #13669
• 🚐 fix: Reuse Request-Scoped MCP Connections per Run by @danny-avila in #13673
• 🔒 fix: Scan All Message Roles in messageFilter.pii by @dustinhealy in #13677
• 🛟 fix: Auto-Recover from Stale Service Worker Assets After Deploys by @danny-avila in #13686
• 🥇 fix: Send First OpenID Audience on Authorization Requests by @danny-avila in #13694
• 🔌 fix: Preserve Ephemeral MCP Selections Across Model Switches by @danny-avila in #13697
• 🛬 fix: Prevent Viewed Conversations from Re-Arming the Soft Default Spec by @danny-avila in #13699
• 🪢 fix: Prune Dangling Skill IDs from Agent Allowlists by @danny-avila in #13702
• 🗄️ fix: Gate Request-Scoped MCP Servers Out of Persistent Tool Cache by @danny-avila in #13672
• 🧾 fix: Bill Subagent Child-Run Model Usage in Parent Transactions by @danny-avila in #13683
• 🔧 fix: Honor NO_PROXY for OpenID requests when PROXY is set by @danny-avila in #13716
• 🌐 fix: Centralize Outbound Proxy Handling by @danny-avila in #13726
• 🌿 fix: Preserve Viewed Branch on Sibling-Tree Churn by @danny-avila in #13732
• 🎨 fix: Gate message hover-reveal controls on hover capability, not width by @danny-avila in #13712
• 🔍 fix: Render Web Search Favicons on Raw SERP Results During Streaming by @danny-avila in #13741
• 🔢 fix: Prevent "approximately" tildes from rendering as markdown subscript by @danny-avila in #13743
• 🪙 fix: Correct Context Usage Gauge After Summarization by @danny-avila in #13744
• 📈 fix: Isolate RUM Telemetry Proxy Auth from App Auth by @danny-avila in #13765

🔧 Refactoring and Performance

• 👑 refactor: Scope Role Cache Keys by Isolation Context by @danny-avila in #13454
• 🎛️ refactor: Scope App-Config Override Cache by Isolation Context by @danny-avila in #13455
• 🩻 refactor: Replace Opaque OAuth Errors with Structured Failure Diagnostics by @danny-avila in #13471
• 🃏 refactor: Agent Avatar Conversation Icons and Streaming Indicators by @danny-avila in #13563
• 🏛️ refactor: Prioritize Deployment Skills over Persisted Duplicates by @danny-avila in #13575
• 🧊 perf: Memoize Completed Markdown Blocks During Streaming by @danny-avila in #13576
• ⚡ perf: Migrate data-schemas Build to tsdown with isolatedDeclarations by @danny-avila in #13578
• ⚡️ refactor: Migrate @librechat/api Build to tsdown by @danny-avila in #13595
• ⚡ refactor: Migrate data-provider Build to tsdown by @danny-avila in #13597
• ⚡ refactor: Migrate @librechat/client Build to tsdown by @danny-avila in #13596
• 📦 chore: Declare runtime deps externalized by tsdown in @librechat/api by @danny-avila in #13600
• 📋 refactor: Attach Message Context to Langfuse Feedback Scores by @danny-avila in #13604
• ⚙️ refactor: Lazy-load HEIC upload conversion by @upman in #13638
• ⚙️ refactor: lazy-load React Query Devtools by @upman in #13639
• ⚙️ refactor: Lazy load locale resources by @upman in #13640
• ⚙️ refactor: Brotli asset serving behind a feature toggle by @upman in #13641
• 🤫 refactor: Silent MCP OAuth Refresh on Mid-Session 401 by @danny-avila in #13369
• 📡 refactor: Gate Noisy Redis OTEL Instrumentation by @danny-avila in #13764

🧪 Tests

• 🧪 test: Add E2E Regression For 2FA framer-motion Crash by @danny-avila in #13513
• 🎭 test: Run Mock E2E Suite Through createRun With In-Process Fake Model by @danny-avila in #13508
• 🌲 test: Add E2E Coverage for Message Tree Streaming by @danny-avila in #13570
• ✅ ci: Add mock e2e coverage for agents, prompts, MCP, and chat flows by @teresama in #13589

📦 Dependencies, Chores & CI

• 🏷️ ci: Sync Helm Chart Tags by @danny-avila in #13446
• 🐳 chore: Upgrade Docker Builds To Node 24 by @danny-avila in #13448
• ⛑️ ci: Fix Helm Tag Sync Workflow Planning by @danny-avila in #13451
• ⚡ chore: Upgrade Vite For Node 24 by @danny-avila in #13450
• 🗼 ci: Guard Scoped Model Applies the Isolation Plugin by @danny-avila in #13458
• 🪪 ci: Fix Helm Tag Sync Git Auth by @danny-avila in #13460
• 🤫 chore: Quiet Repetitive Log Noise from Balance, CloudFront, and Capability Paths by @danny-avila in #13461
• 📉 refactor: Reduce Frontend Build Warning Noise by @danny-avila in #13463
• 🌎 ci: Fix Locize Sync CDN Mode by @danny-avila in #13465
• ⚡ refactor: Change Minifier from 'terser' to 'oxc' in Vite Config by @danny-avila in #13476
• 🧭 ci: Use System Chrome for Mock E2E by @danny-avila in #13481
• 🪧 chore: Generalize Project Name Placeholder by @danny-avila in #13514
• 📦 chore: npm audit fix by @danny-avila in #13515
• 🪹 feat: Collapse Empty Projects Section in the Sidebar by Default by @danny-avila in #13531
• 🔧 chore: Update ESLint config, Import Sorting script, Test Sharding, Bump @librechat/agents by @danny-avila in #13552
• 👷 ci: Type-check the Client Workspace by @danny-avila in #13560
• 📦 chore: Update Turbo to v2.9.16 by @danny-avila in #13564
• ⬆️ chore: Bump TypeScript to 5.9.3 by @danny-avila in #13584
• 🔧 chore: Enforce isolatedDeclarations in data-schemas tsconfig by @danny-avila in #13593
• 👷 ci: Add API runtime smoke (boot the production image) to docker-smoke by @danny-avila in #13605
• ♊ chore: Upgrade @google/genai SDK to ^2.8.0 by @danny-avila in #13625
• 📦 chore: Bump @librechat/agents to v3.2.32 by @danny-avila in #13633
• 📦 chore: Bump jest-junit to v17.0.0 by @danny-avila in f074bd9
• 📦 chore: Bump @librechat/agents to v3.2.33 by @danny-avila in e25373d
• 🚰 ci: Close Leaked Redis Clients in Cache Integration Tests by @danny-avila in #13649
• 🪟 ci: Shard Windows Frontend Unit Tests by @danny-avila in #13651
• 🗜️ ci: Cache Dependencies and Builds in Cache Integration Tests by @danny-avila in #13652
• 🤗 ci: Cache and Authenticate HF Model Downloads in GitNexus Index by @danny-avila in #13653
• ⏫ ci: Bump GitNexus to 1.6.7 to Fix Embeddings Index Timeout by @danny-avila in #13658
• 🗝️ chore: Use Element Access over any-Casts in Registry Cache Spec by @danny-avila in #13664
• 📦 chore: Update Turbo package to v2.9.17 by @danny-avila in eebbde7
• 🧹 ci: Relieve disk pressure on GitNexus deploy by @danny-avila in #13666
• 📦 chore: npm audit fix by @danny-avila in #13701
• 🪟 fix: Cross-Platform Absolute-Path Check in tsdown neverBundle Predicates by @danny-avila in #13700

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13466
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13482
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13505

New Contributors

• @jcbartle made their first contribution in #13429
• @teresama made their first contribution in #13472
• @joohan-lee made their first contribution in #13468
• @graphaelli made their first contribution in #13544
• @rene84 made their first contribution in #13573
• @pedrojreis made their first contribution in #13613
• @Ivan-Apro made their first contribution in #13616

Full Changelog: v0.8.6...v0.8.7-rc1

Original source

The v0.8.6 release of LibreChat

What's Changed

🏞️ Highlights

• Agent Skills & Subagents
  • Agent Skills package reusable instructions, references, scripts, assets, and permissions into portable capabilities that agents can invoke automatically or on request.
  • Subagents let agents delegate specialized work to other agents while preserving upload, user, and MCP context with recursion and graph limits.
• Code Execution & Artifacts
  • Text, source-code, DOCX, CSV, XLSX, and PPTX artifacts can render inline or in the side panel with richer previews.
  • Artifact editing, Gemini PDF media blocks, model-spec icons, and persistent agent resource files received reliability fixes.
• Observability & Operations
  • Added Prometheus metrics, backend OpenTelemetry tracing, SSE lifecycle tracing, HyperDX browser RUM, structured logging context, explicit readiness endpoints, file-log controls, and graceful HTTP shutdown.
• MCP, Auth, and Admin Hardening
  • Improved MCP remote proxy support, OAuth audience handling, JWT expiry fallback, optional OpenID/MCP client-secret flows, multi-audience OpenID validation, trusted registration overrides, admin-panel SSO redirects, streamable HTTP limits, and MCP permission enforcement for agent tools.
• Provider and Model Updates
  • Added Claude Opus 4.8 support, Gemini 3.5 Flash support, Gemini tool combinations, Gemma 4 thinking-level support, model-aware Google/Gemini max output tokens, Bedrock AWS profile/API key support, and Bedrock guardrail handling.
• Reliability and UI Polish
  • Hardened retention semantics, user/config response sanitization, configured rich-text rendering, Redis/in-memory generation cleanup, all-data retention for agent files, MCP title rendering, sidebar/chat race handling, hover actions, shared links, generated file chips, and balance script config loading.

For detailed changes in the release candidate, see:

v0.8.6-rc1

Changes Since v0.8.6-rc1

✨ Features

• 🚧 feat: Support Guardrail Config Option streamProcessingMode by @dlew in #12815
• 📈 feat: Add Prometheus Metrics Endpoint + AWS Credential Providers by @danny-avila in #13111
• 🧾 feat: Add Structured Logging Context by @danny-avila in #13110
• 🛡️ feat: Bedrock Guardrail Config Environment Variable Resolution by @entropic489 in #11717
• 📡 feat: Add Backend OpenTelemetry Tracing by @danny-avila in #12909
• 🏷️ feat: Hide Model Spec Badge Rows by @danny-avila in #13124
• 👟 feat: Enable Eager Execution of Tool Calls by @danny-avila in #13192
• 🍪 feat: Add Session Cookie Secure Override by @danny-avila in #13189
• 🪂 feat: Graceful HTTP shutdown on SIGTERM/SIGINT by @pjhampton in #13211
• 🩺 feat: Add Explicit Readiness Endpoints by @danny-avila in #13212
• 🗂️ feat: Allow Disabling File Log Transports by @danny-avila in #13215
• ⚡ feat: Add Gemini 3.5 Flash Support by @danny-avila in #13231
• 🛣️ feat: Add MCP Remote Proxy Support by @danny-avila in #13076
• ⚖️ feat: Add Operational Prometheus Metrics by @danny-avila in #13265
• 🖲️ feat: Trace SSE Stream Lifecycle with OTel by @upman in #13266
• 📜 feat: Add Explicit new Skill Route from Agent Builder by @sand116 in #13119
• 🆔 feat: Built-in Build Metadata for Support Triage by @danny-avila in #12756
• 🛂 feat: Add AWS Profile Support for Bedrock Credentials by @iElsha in #10504
• 🪙 feat: Add AWS Bedrock API key support by @dustinhealy in #8690
• 🛰️ feat: Support Gemini Tool Combinations by @danny-avila in #13273
• 🧠 feat: Add Claude Opus 4.8 Support by @danny-avila in #13380
• ♊ feat: Model-Aware Max Output Tokens for Google/Gemini by @danny-avila in #13390
• 📡 feat: Add Configurable HyperDX Browser Real User Monitoring by @upman in #13287
• 🪪 feat: Accept Multiple OpenID JWT Audiences by @danny-avila in #13404
• 🪪 feat: MCP OAuth - Support audience parameter for Auth0/Cognito-style providers by @Freudator86 in #13402
• 💠 feat: Extend thinkingLevel Support to Gemma 4 Models by @King-of-Infinite-Space in #13088

🐛 Fixes

• 🧰 fix: Scope MCP Registry Initialization To Config Fingerprints by @danny-avila in #13115
• 🧹 fix: Reset Redis Reorder State After Last Unsubscribe by @sand116 in #13117
• 🏷️ fix: Harden Helm Chart Tag Parsing by @danny-avila in #13123
• 🛡️ fix: Sanitize Agent List Skill Scope by @danny-avila in #13122
• 🗝️ fix: Protect Model Spec Instructions by @danny-avila in #13125
• 🪵 fix: Restore Winston Format Factory Shape In Test Mocks by @JorgeCosta87 in #13139
• 🛡️ fix: Escape People Picker Search Regex by @danny-avila in #13169
• 🤝 fix: Honor OPENID_REUSE_TOKENS in Admin OAuth Exchange by @jangByeongHui in #13154
• 🪪 fix: Resolve Group-Scoped Config Overrides by @danny-avila in #13176
• 🧽 fix: Strip Admin OAuth Redirect Params by @danny-avila in #13181
• 🔍 fix: Prefer LibreChat Web Search over Anthropic's when Both Selected by @danny-avila in #13166
• 🗂️ fix: Scope Handoff Agent Context Docs by @danny-avila in #13167
• 🪪 fix: Scope Message Conversation Access by @danny-avila in #13183
• 🧭 fix: Reduce MCP Registry ACL Lookups by @danny-avila in #13195
• ⛴️ fix: Stop Double-Wrapping configYamlContent in Helm ConfigMap by @vdittgen in #13198
• 📡 fix: Handle Pre-Session 406 for Optional SSE MCP Stream by @pnancarrow in #13202
• 🧯 fix: Harden Data Retention Semantics by @danny-avila in #13049
• 🪪 fix: Add Admin Panel SSO URL Config by @danny-avila in #13220
• 🦣 fix: Response Size Limits for Streamable HTTP MCP Responses by @danny-avila in #13219
• 🏃 fix: Improve OpenID Lookup Planning by @danny-avila in #13229
• 🧩 fix: Support DocumentDB Prompt Group Lookup by @danny-avila in #13232
• 📡 fix: Respect Custom Endpoint Stream Usage Opt-In by @danny-avila in #13237
• 🍞 fix: don't show 'deleting file' toast on attached files by @dlew in #13239
• 🧵 fix: Preserve Streaming Messages During Stale Refetch by @danny-avila in #13247
• 🛡️ fix: Harden MCP OAuth Request Handling by @danny-avila in #13264
• 🪪 fix: Consolidate MCP OAuth Policy by @danny-avila in #13254
• 🪪 fix: Prevent MCP Server Name Collisions by @danny-avila in #13256
• ⌛ fix: Use JWT exp claim for MCP when OAuth token omits expires_in by @devanchohan in #13248
• 🪪 fix: Support OpenID PKCE Without Client Secret by @eleite93 in #12364
• 🪪 fix: Allow Optional client_secret for MCP OAuth by @aupuzikov in #12460
• 🛂 fix: Detect OAuth Errors From HTTP 400 Responses by @janluedemann-esome in #11961
• 🪬 fix: Skip MCP Tools When Required Custom User Vars Are Unset by @verifizieren in #13152
• 🪨 fix: Normalize Empty MCP Tool Descriptions to undefined for Bedrock Compat. by @serhiizghama in #13217
• 📡 fix: Tighten Streaming Message Cache Preservation by @danny-avila in #13271
• 🧷 fix: Harden MCP Proxy SSRF Checks by @danny-avila in #13274
• 🧱 fix: Validate Bedrock User Credentials by @danny-avila in #13277
• 🧷 fix: Pin MCP OAuth Client Secrets by @danny-avila in #13276
• 🏣 fix: Reject System Tenant In Auth Context by @danny-avila in #13278
• 🧾 fix: Validate Bedrock User Credentials by @danny-avila in #13279
• 🪟 fix: Apply Admin-Panel Config Overrides To YAML-Defined MCP Servers by @dustinhealy in #13173
• 🪡 fix: Prevent Hover Actions Flash While Streaming by @danny-avila in #13285
• 🧩 fix: Add REDIS_CLUSTER_SAFE_DELETE Flag for ElastiCache Serverless CROSSSLOT Errors by @serhiizghama in #13275
• 🧵 fix: Prevent Message Loading Race During Streaming by @danny-avila in #13295
• ⏭️ fix: Avoid False Resume Submission Stale Detection by @danny-avila in #13297
• 🧯 fix: Suppress Google Service Key Noise by @danny-avila in #13322
• ✂️ fix: Truncate Long MCP Server Titles In Builder Panel by @dustinhealy in #13321
• 📎 fix: Preserve Gemini PDF Media Blocks by @danny-avila in #13357
• 🛡️ fix: Harden Model Spec Icon Rendering by @danny-avila in #13356
• 🪡 fix: Artifact Edit Saves by @danny-avila in #13358
• 🛡️ fix: Cap Default Limit on Agent List Queries by @danny-avila in #13382
• 🪨 fix: Preserve Bedrock Guardrail Config by @danny-avila in #13381
• ⚓ fix: Skip Retention for Persistent Agent Resource Files by @maxesse in #13394
• 🧟 fix: Reap Hung In-Memory Generations for Redis Failsafe Parity by @danny-avila in #13396
• 🪃 fix: Retry MCP OAuth Token Refresh Without Scope on Server Rejection by @danny-avila in #13412
• 🖼️ fix: Preserve Model Spec Icon URLs by @danny-avila in #13370
• 🔑 fix: support 'userinfo' in OPENID_REQUIRED_ROLE_TOKEN_KIND by @pboers1988 in #13182
• 🪪 fix: Preserve Trusted Registration Provider Overrides by @danny-avila in #13307
• 💰 fix: Load app config in set-balance script to respect balance settings by @ucodia in #12669
• 📬 fix: Honor Admin-Panel allowedDomains Override at Registration by @nangelovv in #13204
• 🔒 fix: Strip post-login fields from unauthenticated /api/config response by @ChrisJr404 in #13102
• 🏟️ fix: Restrict MCP OAuth Audience in User-Managed Configs by @danny-avila in #13418
• 🛂 fix: Enforce MCP Permissions for Agent Tools by @danny-avila in #13174
• 🧼 fix: Sanitize User Response Fields by @danny-avila in #13421
• 🧼 fix: Harden Configured Rich Text Rendering by @danny-avila in #13423
• 🪪 fix: Use Shared IdP Avatar Processing by @danny-avila in #13422

🔧 Refactoring

• 📸 refactor: Refresh Shared Links With Latest Snapshot by @danny-avila in #13095
• 🗂️ refactor: Collapse Generated File Chips by @danny-avila in #13116
• 🛟 refactor: Gracefully Skip Unavailable Web Search Rerankers by @danny-avila in #13191
• 🗂️ refactor: Clarify Code Sandbox File Guidance by @danny-avila in #13236
• 🧬 refactor: Derive Latest Message From Cache by @danny-avila in #13294
• ⏱️ refactor: Optimistically Show New Chats In Sidebar by @danny-avila in #13298
• 🧠 refactor: Replay DeepSeek reasoning_content via OpenRouter by @danny-avila in #13368
• 📤 refactor: Align Mention Options With Model Selector by @danny-avila in #13397
• 🧠 refactor: Memoize MCP Permission Checks Per Request by @danny-avila in #13419
• 🗄️ refactor: Honor All-Data Retention for Agent Files by @danny-avila in #13424

🧪 Tests

• 🛟 test: Restore Playwright Smoke E2E by @danny-avila in #13020

📦 Dependencies, Chores & CI

• 🧹 chore: Type Agent MCP lean projection in ServerConfigsDB by @gaurav0107 in #13171
• 🛡️ chore: Harden CI Supply Chain Workflows by @danny-avila in #13090
• 🕵🏻 ci: Improve Flaky Subagents Test by @dustinhealy in #13185
• 📦 chore: npm audit fix, bump otel & @librechat/agents by @danny-avila in #13186
• 📦 chore: Bump @librechat/agents to v3.1.88 by @danny-avila in #13187
• 🧪 ci: Stabilize Virtualized Agent Grid Tests by @danny-avila in #13214
• 🧵 chore: Raise MCP SSE Line Default by @danny-avila in #13224
• 📦 chore: bump @librechat/agents, qs, langfuse by @danny-avila in #13299
• 🐢 ci: Raise test-packages-api timeout to 20 min by @danny-avila in #13326
• 🧮 chore: Update Gemma Context Token Defaults by @danny-avila in #13410
• ✂️ chore: Strip Session JWT Forwarding from Browser RUM by @danny-avila in #13414
• 📦 chore: Bump @hyperdx/browser to v0.24.0 by @danny-avila in #13416
• 🔧 chore: Drop duplicate getAppConfig import in set-balance.js by @danny-avila in #13417

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #13107
• 🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #13128
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13230
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13283
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13291
• 🌍 i18n: Update translation.json with latest translations by @danny-avila in #13325

New Contributors

• @entropic489 made their first contribution in #11717
• @sand116 made their first contribution in #13117
• @JorgeCosta87 made their first contribution in #13139
• @jangByeongHui made their first contribution in #13154
• @pjhampton made their first contribution in #13211
• @devanchohan made their first contribution in #13248
• @eleite93 made their first contribution in #12364
• @aupuzikov made their first contribution in #12460
• @janluedemann-esome made their first contribution in #11961
• @verifizieren made their first contribution in #13152
• @serhiizghama made their first contribution in #13217
• @iElsha made their first contribution in #10504
• @Freudator86 made their first contribution in #13402
• @pboers1988 made their first contribution in #13182
• @King-of-Infinite-Space made their first contribution in #13088
• @nangelovv made their first contribution in #13204
• @ChrisJr404 made their first contribution in #13102

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.6-rc1...v0.8.6

Original source