📦 chore: Bump librechat-data-provider and @librechat/data-schemas#77
Merged
danny-avila merged 9 commits intoJun 17, 2026
Merged
Conversation
…0.0.53 Bumps the data-provider and data-schemas patch versions to pick up the upstream changes merged since 0.8.503 / 0.0.52. Notable user-visible additions surfaced automatically by the schema-driven UI: modelSpecs conversation_starters (upstream #13710), interface.retainAgentFiles, interface.sharedLinks, interface.mcpServers.configureObo, baseEndpoint titleTiming, agentsEndpoint skills.maxCatalogSkills, custom endpoint reasoningFormat/reasoningKey. Three follow-on type fixes were needed to consume the new versions: role.ts adds a PERMISSION_TYPE_SCHEMA entry for the new PermissionTypes.SHARED_LINKS enum value (upstream #13051). CapabilityPanel.tsx casts cap to BaseSystemCapability in the implication lookup since the union tightened past plain string. server/config.ts drops the AppService call in parseImportedYaml (it was returning an AppConfig wrapper while the consumer ImportYamlDialog expects the flat config) and widens the appConfig return to Record<string, ConfigValue>. The widening also sidesteps a type-identity collision introduced by the data-schemas tsdown migration (upstream #13578), which ships dual .d.cts/.d.mts declaration bundles that get nominally distinct under moduleResolution: bundler.
…3 bump The librechat-data-provider 0.8.505 and @librechat/data-schemas 0.0.53 bump in 09f214e surfaced new schema fields that rendered as raw com_config_field_* keys in the admin panel UI. Added English labels for every new field flagged by the localization-coverage test, plus singular array-item labels where needed. Labels follow the existing terse sentence-case style (e.g. softDefault becomes "Soft default", titleTiming becomes "Title timing"). Routed the two new top-level sections to tabs in SECTION_META so they no longer fall through to the catch-all "Other" tab: messageFilter to Features (alongside webSearch, summarization, memory) since it is a runtime user-message filtering feature, and skillSync to System (alongside rateLimits, balance, transactions) since it is a scheduled background sync.
Relabel com_config_field_pii from "PII" to "Personally Identifiable Information" since the parent section "Message filter" already provides the filter context. Add com_endpoint_prompt_cache (label) and com_endpoint_anthropic_prompt_cache (description) so the promptCache boolean parameter renders with a real title and explanation instead of raw i18n keys. These label keys are referenced by librechat-data-provider's Anthropic and Bedrock parameter settings (present in the package since at least 0.8.502); the admin panel locale was just missing the entries.
FieldRenderer was passing isSoleField=true whenever the current level had exactly one field and one group, which suppressed the inner field's ConfigRow label and left the parent NestedGroup label as the only label visible. For wrappers like agents.skills = { maxCatalogSkills } and fileConfig.skills = { fileSizeLimit }, that surfaced a bare number input under a generic "Skills" header, with no way to tell which limit it was.
Drop the isSoleField flattening at this site so single-child object wrappers render the inner field's label inside the parent group ("Skills > Max catalog skills: [input]"). The alwaysShowLabels prop that EndpointsRenderer used to opt out of the flattening becomes redundant, so remove it from the FieldRendererProps interface, the FieldRenderer signature, and the EndpointsRenderer call site.
The 0.8.505 schema additions surfaced two fields whose generic control-derived sample values fail the real configSchema safeParse: skillSync.github.intervalMinutes (number) has a min-5 constraint (SKILL_SYNC_MIN_INTERVAL_MINUTES); the default sample value of 1 was rejected. skillSync.github.sources (array of objects) needs a fully-formed source entry that satisfies the GitHub source schema's id/owner/repo/paths required fields plus either credentialKey or token, since the .refine() check on the source object rejects bare strings or partial objects. Add both as path-specific overrides in SAMPLE_OVERRIDES so the config.test.ts control->value->safeParse round-trip stays green.
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 86e411c. Configure here.
Contributor
Author
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
librechat-admin-panel/src/constants/role.ts
Lines 38 to 43 in 86e411c
Include CONFIGURE_OBO in MCP permissions
With this dependency bump, MCP server permissions include CONFIGURE_OBO for configuring On-Behalf-Of token exchange, but this schema still exposes only use/create/share/public for MCP_SERVERS. In environments using OBO-capable MCP servers, the role editor cannot grant the required action from the admin panel, so users remain unable to configure mcpServers.<server>.obo even though the new config field is present.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The 0.8.505 bump added PermissionTypes.SHARED_LINKS to PERMISSION_TYPE_SCHEMA so defaultPermissions() now seeds role payloads with a sharedLinks section, but RolePermissionsPanel only renders types listed in its local PERMISSION_TYPE_ORDER and SHARED_LINKS was absent there. The result was an editable bit baked into the role payload with no UI surface to toggle it. Add PermissionTypes.SHARED_LINKS after SKILLS in PERMISSION_TYPE_ORDER so the panel renders the new multi-permission card (CREATE / SHARE / SHARE_PUBLIC). Add com_perm_type_SHARED_LINKS and com_perm_desc_SHARED_LINKS locale entries to label the card; the description stops short of "use" since the upstream sharedLinksPermissionsSchema has no USE bit.
Contributor
Author
|
@codex review |
…ilities The 0.0.53 bump added READ_SHARED_LINKS and MANAGE_SHARED_LINKS to SystemCapabilities and bucketed both under the content category in CAPABILITY_CATEGORIES. The admin panel's Grants page renders capability labels via com_cap_<verb>_<value-after-colon>, so the new capabilities surfaced as raw com_cap_read_sharedlinks and com_cap_manage_sharedlinks strings on the grants page. Add the four matching locale entries (read and manage labels plus their _desc variants) so the new capabilities render with proper names. Wording mirrors the existing skills entries since both sit in the same content category.
Contributor
Author
|
@codex review |
The 0.8.505 bump added obo and proxy to the MCP server schema, but only for sse and streamable-http transports. The websocket and stdio variants type obo as ZodOptional<ZodUndefined> (i.e. must stay unset) and omit proxy entirely. McpServersRenderer's visibility filter had no HTTP-only bucket; both fields fell through to the unconditional else branch and rendered in the Advanced section for every transport. An admin filling either out on stdio or websocket then hit a confusing leaf-level safeParse rejection without a transport-aware explanation. Introduce HTTP_ONLY_FIELDS and HTTP_TRANSPORTS sets that mirror REMOTE_ONLY_FIELDS / REMOTE_TRANSPORTS but exclude websocket, and gate the new obo and proxy keys through them. websocket and stdio now only see the fields their transport variant actually accepts.
Contributor
Author
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bb2755c244
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The 0.8.505 bump added Permissions.CONFIGURE_OBO to mcpServersPermissionsSchema upstream, but PERMISSION_TYPE_SCHEMA[MCP_SERVERS] still only exposed USE/CREATE/SHARE/SHARE_PUBLIC. RolePermissionsPanel iterates PERMISSION_TYPE_SCHEMA exclusively, so the new CONFIGURE_OBO toggle never rendered, was never set, and was never sent in the role-save payload. The LibreChat API enforces this capability on MCP create/update routes, so admins effectively could not grant it to any role.
Append Permissions.CONFIGURE_OBO to the MCP_SERVERS entry and add com_perm_CONFIGURE_OBO using the existing sentence-case-after-first style ("Configure on-behalf-of"). Also realign the com_config_field_configureObo config-field label from "Configure On-Behalf-Of" to "Configure on-behalf-of" for cross-UI consistency.
Contributor
Author
|
@codex review |
|
Codex Review: Didn't find any major issues. Already looking forward to the next diff. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
danny-avila
approved these changes
Jun 17, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Bumps
librechat-data-provider0.8.502 → 0.8.505 and@librechat/data-schemas0.0.51 → 0.0.53.What this brings in
modelSpecs.list[].conversation_starters— string array of starter prompts shown while a spec is active (upstream #13710)messageFiltertop-level config block withpii.{starterPatterns, customPatterns}for blocking patterns in user messages before they reach modelsskillSynctop-level config block — scheduled GitHub-based pull of skill definitions (github.{enabled, intervalMinutes, runOnStartup, sources[]})interfacetoggles:contextUsage,contextCost,currency(code+rate),retainAgentFiles,retentionMode,sharedLinks,buildInfomodelSpecs.presetflags:softDefault,showOnLanding,hideBadgeRowagents.skills.maxCatalogSkillscap, newagents.subagents.{allowSelf, agent_ids}blockbedrock.guardrailConfig.{guardrailIdentifier, guardrailVersion, trace, streamProcessingMode}for AWS Bedrock guardrail integrationtitleTiming("immediate" / "final") on endpoint shared settings, plusreasoningFormat/reasoningKeyfor endpoint paramsforward_audience_on_refreshon OAuth OIDC configproxyandobofields on MCP HTTP/SSE server transportsSHARED_LINKSvalue inPermissionTypes(upstream #13051)BaseSystemCapabilityliteral union that no longer accepts plainstringtokenConfigper-model pricing entries (prompt,completion,context,cacheRead,cacheWrite).d.cts/.d.mtsdeclaration bundlesAdmin-panel changes required by the bump
src/constants/role.ts— added[PermissionTypes.SHARED_LINKS]entry toPERMISSION_TYPE_SCHEMAsinceRecord<PermissionTypes, Permissions[]>is exhaustive over the enumsrc/components/grants/CapabilityPanel.tsx— castcap as BaseSystemCapabilityinside.includes(...); the tightened literal union no longer accepts plainstringsrc/server/config.ts— dropped theAppService(...)call inparseImportedYamland widened the success return toRecord<string, ConfigValue>. TheAppServicebranch was returning anAppConfigwrapper, not the flat config theImportYamlDialogconsumer treats asRecord<string, ConfigValue>. Removing it also sidesteps a type-identity collision introduced by the tsdown migration (#13578), which ships dual.d.cts/.d.mtsdeclaration bundles that resolve to nominally distinct types undermoduleResolution: bundler.com_config_field_*keys (including 4_itemarray-row entries) covering every field flagged by the localization-coverage test so it passes againcom_config_section_*title + description pairs (messageFilter,skillSync)messageFilter→ Features tab andskillSync→ System tab entries inSECTION_META, otherwise both fall into the catch-all "Other" tabcom_config_field_piirelabeled from "PII" to "Personally Identifiable Information" since the parent "Message filter" section already provides the filter contextcom_endpoint_prompt_cache(label) andcom_endpoint_anthropic_prompt_cache(description). Both label keys were already referenced bylibrechat-data-provider's Anthropic / Bedrock parameter settings since at least 0.8.502 but the admin-panel locale was missing them, so thepromptCacheboolean rendered with raw i18n keys.src/server/config.test.tsgained two newSAMPLE_OVERRIDESentries (skillSync.github.intervalMinutes≥ 5;skillSync.github.sourcesas a fully-formed GitHub source entry withcredentialKey) so the control → value → safeParse round-trip stays green for the new schema additionsSchema-driven form renderer fix
The new bump surfaced an existing rendering bug.
FieldRendererwas passingisSoleField={true}whenever a rendered level had exactly one field and one group, which suppressed the inner field'sConfigRowlabel and left the parentNestedGrouplabel as the only label visible. For wrappers likeagents.skills = { maxCatalogSkills }andfileConfig.skills = { fileSizeLimit }, that surfaced a bare number input under a generic "Skills" header with no indication of which limit it was.Dropped the flattening so single-child object wrappers now render as
Skills > Max catalog skills: [input]with both labels visible. ThealwaysShowLabelsopt-out prop (only used byEndpointsRendererto defeat this same flattening for priority fields) becomes redundant and was removed fromFieldRendererProps.Test plan
npx tsc --noEmitcleanbun run lintcleanbun run test: 710/710 passingbun run dev:conversation_startersas editable string arraySHARED_LINKSpermission row editable alongside existing typesNote
Medium Risk
Touches YAML import behavior (no AppService merge), permission defaults for a new type, and broad config UI/i18n for new schema blocks; dependency bumps may carry upstream behavioral changes beyond what this repo wires up.
Overview
Upgrades
librechat-data-provider(0.8.502 → 0.8.505) and@librechat/data-schemas(0.0.51 → 0.0.53), pulling in new config surface (e.g. message filter, skill sync, shared links permissions, and related schema fields) that the admin UI must expose.Configuration UI: Adds Features entries for
messageFilterand System forskillSyncin section metadata, plus many newcom_config_field_*/ section i18n strings (including prompt-cache labels and a clearer PII label). YAML import no longer runsAppServiceafter validation—it returns the parsed config asRecord<string, ConfigValue>to matchImportYamlDialogand avoid tsdown dual-declaration type clashes. Roles gain aSHARED_LINKSpermission block; Grants casts capabilities when resolving implied-capability badges after the tighterBaseSystemCapabilityunion.Form renderer: Stops treating single-field/single-group blocks as “sole field” (and removes
alwaysShowLabels), so nested settings like agents/files Skills show both group and field labels instead of a bare input under a generic header. Config tests add skillSync sample overrides for round-trip validation.Reviewed by Cursor Bugbot for commit 86e411c. Bugbot is set up for automated code reviews on this repo. Configure here.