Merge upstream LibreChat v0.8.7 into Paychex fork#163
Merged
Conversation
- Upgraded @langchain/langgraph from 1.3.2 to 1.3.4 - Upgraded @langchain/langgraph-checkpoint from 1.0.2 to 1.0.4 - Upgraded @langchain/langgraph-sdk from 1.9.4 to 1.9.15 - Updated uuid from 10.0.0 to 14.0.0 across multiple packages - Upgraded @langchain/protocol from 0.0.15 to 0.0.16 - Upgraded @remix-run/router from 1.23.2 to 1.23.3 - Upgraded hono from 4.12.18 to 4.12.23 - Upgraded react-router from 6.30.3 to 6.30.4
* feat: Improve skill authoring guidance * test: Guard tool description lengths * fix: Align skill template guidance * fix: Satisfy advisory limit test lint * fix: Transform LangGraph ESM in Jest
…n check 0d The v0.8.6 merge dropped 'export * from ./schema' from packages/api/src/utils/index.ts. This caused sanitizeSchemaMetadata to be undefined at runtime, crashing the server on startup. Root cause: check 0d validates the compiled @librechat/api dist, not the source. The dist from before the merge was still correct, so check 0d silently passed even though the source export had been dropped. The bug was only caught at runtime after running the backend. Two fixes: 1. verify-paychex-customizations.sh: add check 0f — validates the SOURCE of packages/api/src/utils/index.ts directly, confirming the Paychex- added 'export * from ./schema' re-export is present. Catches the drop before a rebuild exposes it at runtime. 2. upstream-merge.agent.md: step 10 now requires 'npm run build:api' before './scripts/verify-paychex-customizations.sh', with an explanation of why the order matters. Added Don't (run check 0d against stale dist) and Do (run build:api first) to the pitfalls section.
…ted (danny-avila#13525) * fix(projects): clear landing scope when the selected project is deleted When a project-scoped new-chat landing (/c/new?projectId=...) was open and the project got deleted, the chip kept showing the dead project and sends targeted it (saving unscoped with a visual glitch). - ChatRoute: only trust the scope when the project query succeeds (isSuccess), so React Query's retained-on-error data can't keep a deleted project's chip alive; strip ?projectId once the query settles to not-found so the landing reverts to a normal unscoped chat. - useDeleteProjectMutation: invalidate the project-detail query instead of removing it, so active observers refetch and settle into an error state (removing left them stuck loading under refetchOnMount: false). - e2e: regression test for delete-while-scoped. Fixes a follow-up issue to the projects feature (danny-avila#13467). * fix(projects): only drop scope on definitive not-found; clear inactive deleted detail Address Codex review on danny-avila#13525: - ChatRoute: gate scope removal on a 404 (isNotFoundError) or a success that resolves to a different/empty project, so a transient (non-404) failure under retry:false no longer unscopes a valid project; keep the chip through transient errors via retained data. - useDeleteProjectMutation: also removeQueries({ type: 'inactive' }) so a deleted project's inactive cached detail is dropped and a later visit refetches into a not-found state instead of rendering stale cache within cacheTime.
…nny-avila#13531) The Projects section defaulted to expanded, taking sidebar space for users with no projects. Now derive the default: collapsed when there are no projects and the user has never toggled the section; expanded once they have a project or explicitly expand it. Any explicit toggle (new projectsSectionToggled flag) — or a collapse set before this default existed — is respected.
* feat: scope model spec skills * style: format skill catalog limit * fix: serialize model spec skill resolution * test: satisfy model spec load config typing * fix: apply model spec skills to added conversations * fix: support alwaysApply frontmatter alias * fix: address model spec skills review
* feat: Add deployment skill directory * chore: Address deployment skill review feedback * fix: Include deployment skill file metadata * test: Add deployment skills e2e smoke test
* fix: add durable MCP config tombstones * fix: preserve scoped config tombstones * fix: clean up config tombstone lint * fix: handle empty model spec skill allowlist * fix: preserve inactive config tombstones
…a#13200) * fix: handle multiple MCP OAuth prompts * fix: address MCP OAuth review feedback * fix: address MCP OAuth prompt lifecycle review * fix: narrow OAuth prompt slot cleanup * fix: format OAuth prompt test --------- Co-authored-by: Danny Avila <danny@librechat.ai>
* fix: reuse MCP OAuth authorization URL * fix: validate MCP OAuth initiate flow ID
* fix: filter ACL principal details * test: type ACL permission pipeline assertions * test: add ACL permissions e2e coverage
* fix: Support known endpoint group icons * fix: Resolve known endpoint group icon edge cases
* fix: Contain Markdown table overflow * fix: Improve Markdown table scrollbar
* fix: Preserve provider document uploads * test: Add provider upload e2e coverage
…Bump `@librechat/agents` (danny-avila#13552) * 🔧 chore: Update ESLint config, add import sorting script, Test Sharding, Bump `@librechat/agents` * Change 'no-nested-ternary' rule from 'warn' to 'error' in ESLint config * Add new scripts for sorting imports in the project * Update lint-staged configuration to include import sorting * Modify GitHub Actions workflows to support sharding for unit tests * chore: remove nested ternary expressions * refactor: Extract scale multiplier logic into a separate function in CircleRender component * refactor: Simplify auto-refill rendering logic in Balance component for better readability * refactor: Improve width style handling in DataTable components for clarity and maintainability * chore: remove CircleRender component * delete: Remove CircleRender component as it is no longer needed in the project * chore: Bump @librechat/agents to version 3.2.31 and update Node.js engine requirement * Update @librechat/agents dependency from 3.2.2 to 3.2.31 in package-lock.json, api/package.json, and packages/api/package.json * Change Node.js engine requirement from >=20.0.0 to >=24.0.0 in @librechat/agents * chore: Add import sorting check to ESLint CI workflow * Implement a new job in the GitHub Actions workflow to verify import ordering on changed files. * The job checks for changes in specific file types and reports any import order drift, providing instructions for local fixes.
* fix: enable Gemini mixed tool config * fix: apply Gemini mixed tool flag after skills * style: match initialize formatting * style: wrap final tool check * fix: Respect Vertex auth mode * style: Sort Agent Initialize Imports * fix: Tighten Gemini Mixed Tool Gate
* feat: surface marketplace in model selector * chore: sort marketplace selector imports * fix: localize marketplace selector search
* feat: add soft default model spec * chore: sort ChatRoute imports
* fix: Scope auth token lifecycle * fix: Preserve legacy auth token lookup * fix: Scope verification token cleanup
* fix: harden attachment usage handling * fix: sort file method imports * fix: clarify file usage scope
* fix: normalize verification flow responses * fix: keep verification responses consistent
* fix: Refine Agent Action Updates * fix: Format Action Update Helper * fix: Refine Agent Action Update Handling * fix: Move Agent Action Update Planning * fix: Sort Action Update Imports * chore: Reorder imports in actions.js for clarity
* feat: make OpenID token reuse window configurable via OPENID_REUSE_MAX_SESSION_AGE_MS
The OpenID session-token reuse window in AuthController was a hardcoded 15-minute
constant, forcing /api/auth/refresh to perform a real refreshTokenGrant against the
IdP every 15 minutes even when the current access token is still valid. IdPs that
rotate and revoke the previous access token on refresh then invalidate a token that
is still in use by downstream consumers of the reused OpenID token (e.g. MCP servers
that receive {{LIBRECHAT_OPENID_TOKEN}} and introspect the bearer), producing
~15-minute 401 cycles regardless of the access token's actual lifetime.
Read the window from process.env.OPENID_REUSE_MAX_SESSION_AGE_MS via the existing
math() helper, so it accepts an arithmetic expression like SESSION_EXPIRY (e.g.
60 * 60 * 24 * 1000), defaulting to the existing 15 minutes so behavior is unchanged
unless explicitly configured. The existing 30s-before-expiry guard still forces a
refresh before genuine expiry, so a larger window remains safe.
* fix: extend OpenID reuse session lifetime
---------
Co-authored-by: Danny Avila <danny@librechat.ai>
The `client/` workspace was never type-checked: the existing typecheck
job only covered `packages/` and `api/`, and Vite/esbuild transpiles
without type-checking, so type errors shipped through every CI gate.
- Add a `typecheck` job to frontend-review.yml running `tsc --noEmit`
over `client/` (zero tolerance), reusing the data-provider +
client-package build artifacts. Triggers on `client/**`,
`packages/client/**`, `packages/data-provider/**`.
- Fix all 168 pre-existing client type errors this surfaced (source +
tests), including genuine latent bugs:
- `getFileConfig()` was typed as merged `FileConfig`, but the server
returns the raw config that `mergeFileConfig()` consumes (`TFileConfig`).
- SidePanel/Agents `Retrieval`/`ImageVision` were bound to `AgentForm`
but use the assistants `Capabilities` enum → `AssistantForm`.
- `useSearchResultsByTurn` read a `sources` field its type lacked.
- Removed orphaned dead code: `Artifacts/Mermaid.tsx` (imported a
never-installed dep) and dead barrel re-exports (`./Plugins`, `./MCPAuth`).
- Narrow `client/tsconfig.json` to the client app (drop `../e2e` and
`../config/translations`, which reference backend/tooling modules) so
the gate's scope matches its trigger.
No `any`/`@ts-ignore`/`as unknown as`. Localized newly-surfaced strings.
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
…evelop # Conflicts: # e2e/setup/global-setup-ci.ts
Upstream: danny-avila/LibreChat v0.8.7 (2026-06-24) Branch: upstream/v0.8.7-integration (from upstream/v0.8.6-integration) ## Key upstream v0.8.7 features merged: - Chat Projects (project-based conversation organization) - Skill authoring system - Context gauge (token budget visualization) - Settings redesign - Native Anthropic custom endpoints - Gemini MCP schema sanitization (upstream now has similar logic) - tsdown build migration for packages/api - TypeScript 5.9.3 - Lazy-loading i18n locales - New Artifacts UI components ## Paychex customizations preserved: 1. filterCrossProviderToolCalls (BaseClient.js) - Gemini tool call safety 2. sanitizeSchemaMetadata (tools.js) - OpenAPI schema cleanup for Gemini 3. Gemini custom endpoint detection (MCP.js) - 2 locations 4. normalizeServerName (MCP.js) - Server name normalization 5. ContentTypes import (MCP.js) - Content type handling 6. Anthropic image encoding (encode.js) - Claude/Anthropic image format 7. Prompt Catalog deep links (prompthub.js, useQueryParams.ts, ChatRoute.tsx) 8. promptCatalog export (packages/api/src/index.ts) 9. Pendo analytics span (ModelSelector.tsx) 10. DropdownPopup descriptions (DropdownPopup.tsx) 11. stopReconnecting (MCPServerInspector.ts) 12. data.choices = [] (generators.ts) 13. xlsx from npm registry (not CDN) 14. Dockerfile && operators for build error handling 15. Translation keys: com_ui_prompt_catalog_insert_error, com_nav_changelog, com_ui_default_model 16. RootRedirect (preserves query params for promptCatalogId) 17. supportContact in Landing.tsx 18. Help/FAQ + Changelog links in AccountSettings.tsx 19. DEFAULT badge on model specs (ModelSpecItem.tsx) ## Paychex-specific decisions: - Node version: Pinned to 22 LTS (upstream uses 24) - Keep ALL Paychex customizations even where upstream now has overlapping features - i18n: Preserved translationEnOverride merge pattern within upstream's new lazy-loading structure ## Conflict resolution (22 files): - packages/api/package.json: Kept xlsx ^0.18.5 from npm, merged tsdown + TS 5.9.3 - client/src/locales/en/translation.json: Kept Paychex keys, removed deprecated upstream keys - client/src/locales/i18n.ts: Preserved override pattern in upstream's new lazy-load structure - client/src/components/Chat/Landing.tsx: Added upstream branding + kept supportContact - client/src/components/Chat/Menus/Endpoints/components/ModelSpecItem.tsx: Kept DEFAULT badge + upstream SpecDescription - client/src/components/Nav/AccountSettings.tsx: Kept links + added upstream Archived Chats - client/src/hooks/Endpoint/useEndpoints.ts: Fixed duplicate import + kept URLIcon - client/src/hooks/useNewConvo.ts: Kept spec/preset logic + added chat projects - client/src/routes/index.tsx: Kept RootRedirect + added project routes - packages/api/src/mcp/tools.ts: Merged normalizeServerName + ParsedServerConfig imports - packages/api/src/mcp/tools.spec.ts: Kept normalizeServerName test + added upstream tests - packages/api/src/oauth/csrf.ts: Accepted upstream (type annotations only) - CLAUDE.md: Accepted upstream + Paychex context - Dockerfile: Pinned node:22-alpine (upstream had node:24.16.0-alpine)
…lity The tsdown build with --isolatedDeclarations requires explicit return type annotations. Added return type to createPromptHubResolveInsertHandler and its inner function to satisfy TypeScript 5.9.3 + tsdown v0.22.2.
…e-shaking workaround) rolldown/tsdown v0.22.2 tree-shakes named exports that are only consumed by external packages. resolveTitleTiming was re-exported through barrel files but never imported within the packages/api source, causing it to be dropped from the CJS bundle. Adding an explicit named re-export in src/index.ts forces rolldown to preserve it. Fixes config.spec.js and config.rum.spec.js test failures.
… registry The v0.8.7 upstream merge brought in the SheetJS CDN URL (xlsx-0.20.3.tgz) in the lock file, conflicting with Paychex's package.json which specifies xlsx@^0.18.5 via npm registry (Paychex Artifactory). This caused 'npm ci' to fail with 'Missing: xlsx@0.18.5 from lock file'. Regenerated the lock file so xlsx and its transitive dependencies (adler-32, cfb, codepage, crc-32, ssf, wmf, word, frac) resolve correctly from the Paychex Artifactory npm registry.
paychex-joser
force-pushed
the
upstream/v0.8.7-integration
branch
from
June 29, 2026 15:54
2c44e9c to
420bda0
Compare
|
New Issues (1009)Checkmarx found the following issues in this Pull Request
|
- Fix Prompts component imports for v0.8.7 subdirectory restructure (dialogs/, display/, editor/, fields/, lists/, sidebar/, utils/, buttons/) - Add missing localization keys (16 new keys in translation.json) - Add TStartupConfig.instanceProjectId and TPromptGroup.projectIds types - Fix Footer.tsx to include changelogURL in Pick type - Fix Nav.tsx: remove obsolete MemoNewChat props (subHeaders, etc.) - Create DashboardContext provider for useDashboardContext hook - Fix PromptGroupsContext null checks in GroupSidePanel and PromptForm - Remove ManagePrompts reference (component no longer exists in v0.8.7) - Fix usePendo: add Window.pendo type augmentation, fix comparison narrowing - Fix useNewConvo: add keepLatestMessage param, fix agentOptions access - Fix ChatRoute: fix agentOptions type access on stored conversation - Fix useQueryParams: type-safe preset.spec assignment via spread+cast - Fix removeUnavailableTools: explicit TPreset return type annotation
…ection to merge agent Lessons from v0.8.7 merge where ~50 client TypeScript errors were produced with zero merge conflicts (upstream restructured Prompts into subdirectories, changed component APIs, added i18n keys, and introduced new providers). upstream-merge.agent.md: - Add check 1g: client-side tsc --noEmit (catches import paths, API mismatches, missing providers, type signature changes 5-10 min earlier than npm run build) - Add error categorization table to help fix client tsc errors efficiently - Expand Translation File Trap with failure mode 2: compare key counts between upstream and merged to catch dropped upstream keys - Add upstream restructure detection to Step 9 with directory diff commands - Add 3 new pitfall entries and 3 new Do entries merge-process.instructions.md: - Add v0.8.7 Known Upstream Refactoring Patterns table - Update post-merge validation to include both backend and client tsc
…o prevent it from being executed in the production environment. This change ensures that the runCode feature is disabled, enhancing security and stability in the production setup.
- Re-add PendoInitializer wrapping WithRum in AuthLayout (client/src/routes/index.tsx) - Upstream v0.8.7 replaced PendoInitializer with WithRum; both must coexist - Update merge docs to mark client/src/routes/index.tsx as critical priority - Add verification check #29 to verify-paychex-customizations.sh - Promotes Pendo from WARNING to CRITICAL in customizations catalog Fixes: 'See newest features' Pendo Resource Center button missing after upgrade
- Add description property to all upload menu items in AttachFileMenu.tsx - Add locale keys: com_ui_upload_image_input_description, com_ui_upload_ocr_text_description, com_ui_upload_provider_description, com_ui_upload_file_search_description, com_ui_upload_code_environment_description - Descriptions match production v0.8.4 style (Paychex customization #10)
- Add customization #10b documenting AttachFileMenu description properties - Add AttachFileMenu.tsx and translation.json to medium priority merge list - Add 6 verification checks for upload menu description locale keys - Add note about translation.json being prone to key loss during merges
Remove duplicate endpoints/azureOpenAI block accidentally introduced in develop by PR #162. Take HEAD's version which has the correct single endpoints declaration.
…ed by ADFS policy
gmarcelino-paychex
approved these changes
Jun 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Upstream Merge: LibreChat v0.8.7
Merges upstream LibreChat v0.8.7 into the Paychex fork.
Scope
@librechat/apiPost-Merge Fixes Applied
edb7cd327— Dockerfile: use Node 24 (align with upstream v0.8.7)0be548270— fix(api): add explicit return type forisolatedDeclarationscompatibility566d5950e— fix(api): add explicit re-export forresolveTitleTiming(rolldown tree-shaking workaround)Paychex Customization Verification ✅
All 9 critical customizations verified intact:
filterCrossProviderToolCalls)sanitizeSchemaMetadata)agentUsersspan)item.description)&&chaining)Build & Test Results
@librechat/apibuild: ✅ PassesloadAsyncEndpoints.spec.js, not a regressionReview Notes