LibreChat is joining ClickHouse to power the open-source Agentic Data Stack 🎉 Learn more
← Back to changelog

⚙️ Config v1.3.15

v1.3.15

  • Updated Agent tool capabilities

    • run_in_background now supports explicitly selected MCP, Plugin, and Action tools in addition to background-native Code Interpreter tools
    • Action selection covers every eligible operation; OAuth Actions and operations that already define run_in_background are excluded
    • Programmatic MCP tools require Code Interpreter on the Agent; incompatible builder selections are disabled or cleared, and stale caller options are removed server-side
    • Programmatic execution intersects caller-authorized tools with LibreChat's trusted execution registry

  • Added endpoints.agents.maxSubagents

    • Limits explicit subagents in flat Agent lists and Agent team graphs
    • Defaults to 10, accepts values from 1 to 50, and is enforced from the base YAML

  • Added live Agent reasoning-label settings

    • reasoningLabel enables a generated orientation for top-level reasoning as a response develops
    • reasoningLabelModel, reasoningLabelEndpoint, and reasoningLabelPrompt configure the label call
    • reasoningLabelMinChars, reasoningLabelUpdateChars, and reasoningLabelUpdateIntervalMs control streaming revisions
    • reasoningLabelMaxPerRun defaults to 8; each attempted revision is a separate model call with its own usage and cost

  • Updated endpoints.agents.toolApproval

    • Static rules are evaluated in deny, ask, then allow order before the configured mode fallback
    • Rules match MCP runtime names and model-facing aliases across top-level and nested Subagent tools
    • Attached Code environments automatically ask before file writes and command or code execution while leaving read and search operations under the regular policy
    • toolApproval.enabled: false is the administrator emergency override for the attached-environment baseline; callers without approval and resume support otherwise fail closed

  • Added highly experimental Agent Code environment configuration

    • endpoints.agents.statefulCodeSessions.allowedEnvironments restricts selectable user, agent-user, and conversation workspace scopes
    • statefulCodeSessions.environments defines named managed or attached backends and requires exactly one default when executable entries exist
    • Attached environments can route through workerId, enroll an operator worker with pairing.workerId, or allow owner-bound workers with pairing.allowPrincipalWorkers
    • pairing.tokenEnv names the secret-bearing environment variable; pairing-only control planes cannot be execution defaults
    • configSchema.permissions.fileWrite and commandExecution let administrators expose bounded allow, ask, or deny choices for owner-bound environments; omitted or invalid preferences fall back to ask
    • settings is populated from server-validated owner preferences at request time and should not be configured in deployment YAML
    • Isolation, networking, mounts, privileged execution, ingress, egress, and secrets remain outside the user-configurable schema
    • LIBRECHAT_CODE_BASEURL_STATEFUL selects a dedicated stateful Code API while stateless Agents continue using LIBRECHAT_CODE_BASEURL
    • CODE_ENVIRONMENT_PAIRING_USER_MAX and CODE_ENVIRONMENT_PAIRING_USER_WINDOW control per-user pairing limits
    • Attached environments, pairing, and stateful workspaces remain highly experimental and may change substantially

  • Added self-hosted Code Interpreter JWT authentication

    • CODEAPI_AUTH_PROVIDER=librechat-jwt and CODEAPI_JWT_ENABLED=true enable per-user bearer tokens
    • EdDSA and RS256 private keys can be supplied as PEM, base64-encoded PEM, or private JWK, with configurable key ID, issuer, audience, lifetime, and mint cache
    • CODEAPI_JWT_SINGLE_TENANT_ID supplies the non-strict tenant fallback; strict isolation fails closed without authenticated tenant context
    • LIBRECHAT_CODE_SANDBOX_OUTPUT_MAX_SIZE defaults to 65536 and derives safe sandbox-image windows
    • LIBRECHAT_CODE_IMAGE_CHUNK_BYTES is now an optional exact window override instead of a fixed 32768-byte default

  • Updated Agent event and background delivery configuration

    • Added endpoints.agents.backgroundTasks.completionWakeups, which defaults to true; set it to false for poll-only background tools and Subagents
    • endpoints.agents.eventDriven now contains only optional selfUrl; pre-release child-turn, completion, coalescing, mailbox, checkpoint, and receipt fields were removed
    • Removed the pre-release ENABLE_AGENT_EVENT_CHILD_TURNS, ENABLE_SUBAGENT_COMPLETION_WAKEUPS, and AGENT_TRIGGERS_DETACHED_ACTIONS_PRODUCER_ENABLED flags
    • rateLimits.agentEvents.userMax and userWindowInMinutes configure a separate API-key-principal ingress bucket, defaulting to 40 requests per minute

  • Added experimental Scheduled Chats configuration

    • interface.schedules is absent by default and must be added explicitly to enable the panel and engine
    • use, create, maxPerUser, minIntervalMinutes, autoDisableAfterFailures, fireConcurrency, and requireProject configure permissions and limits
    • schedules: false and { use: false } are authoritative deployment-wide stops
    • SCHEDULES_DISABLED=true immediately blocks automatic and manual runs without deleting definitions
    • Multi-replica deployments require Redis-backed resumable streams; SCHEDULES_SINGLE_PROCESS=true is only for a truly single-process deployment without Redis

  • Added customParams.paramDefinitions[].range.positiveMin

    • Allows range.min to remain a sentinel while ordinary values begin at a higher floor
    • Validation and UI clamping accept only the sentinel or values from positiveMin through max

  • Added configurable HTTP security headers

    • Baseline HSTS, X-Frame-Options, X-Content-Type-Options, Cross-Origin-Opener-Policy, Cross-Origin-Resource-Policy, and Referrer-Policy headers are sent by default
    • SECURITY_HEADERS=false disables the baseline and acts as the global Content Security Policy kill switch
    • CSP_ENABLED=true enables nonce-based CSP; CSP_REPORT_ONLY=true is the default for staged rollout
    • CSP_*_EXTRA, CSP_FRAME_ANCESTORS, CSP_ALLOW_WASM, and CSP_ALLOW_DATA_WORKERS adapt the policy to deployment resources

  • Updated Langfuse configuration

    • Added YAML-only langfuse.headers for authenticating one self-hosted Langfuse origin or gateway across traces, media, feedback, project lookup, and credential verification
    • Header values support ${ENV_VAR} references, are masked in config output, and fail closed when configuration resolves multiple Langfuse origins
    • Authorized administrators can open sampled sessions from Context Usage and authenticated same-tenant shared conversations
    • Added export-plan trace attributes and secret-free connection-change events for troubleshooting
    • Fanout media upload targets must be absolute HTTPS URLs and upload requests no longer follow redirects

  • Updated request-scoped MCP configuration

    • Added {{LIBRECHAT_BODY_PARENTMESSAGEID}} for native Agent, Chat Completions, and legacy Assistants requests; Open Responses rejects it because no equivalent parent identity exists
    • MCP display titles accept Unicode letters and numbers, hyphens, and apostrophes after an initial letter or number
    • Redundant server-name prefixes are removed from model-facing tool keys without changing routing
    • Deferred servers resolve declared serverInstructions when they become available during an active request

  • Updated OpenID and SAML settings

    • GRAPH_API_SCOPES configures the Microsoft Graph scopes requested for {{LIBRECHAT_GRAPH_ACCESS_TOKEN}} OBO exchange
    • OPENID_REFRESH_BRIDGE_GRACE_MS controls the short rotated-token recovery bridge and defaults to 60000 ms
    • SAML_NAME_ID_FORMAT requests a stable NameID format; transient identifiers are rejected
    • SAML_IDP_ISSUER optionally pins the expected IdP entity ID

  • Added base-only, source-aware content filters

    • Top-level filters can inspect selected fields across messages, prompts, Agent instructions, conversation starters and titles, feedback, Skills, memories, files, tool arguments, model parameters, and Action metadata
    • Each source independently selects fields and built-in credential patterns or bounded RE2JS custom patterns
    • filters.messages.unattributedAssistantContent controls classification of legacy assistant rows without provenance
    • filters.files.pii.uninspectable can allow or block opaque and oversized selected content
    • Each source accepts pii.action: block | audit; block remains the default, while audit records raw-free findings without rejecting or changing content
    • Explicit filters.files.pii.uninspectable: block remains fail-closed independently of audit mode
    • The policy is loaded only from base YAML and cannot be changed through database, role, group, or user overrides
    • Legacy messageFilter.pii remains supported, stays block-only, and applies alongside the source-aware policy

  • Updated web-search configuration

    • Added webSearch.searxngSearchOptions for engines, language, time range, and timeout
    • Added keyless Keenable search and scraping, with optional KEENABLE_API_KEY, KEENABLE_API_URL, and KEENABLE_FETCH_URL overrides
    • keenableSearchOptions and keenableScraperOptions configure result count, domains, attribution titles, and timeouts

  • Added interface.feedback

    • Defaults to true; setting it to false hides response feedback controls and rejects feedback writes

  • Updated deployment defaults and controls

    • secureImageLinks now defaults to true; set it to false only for intentionally public local image URLs
    • ENABLE_INSIGHTS=true exposes tenant-scoped MongoDB Insights to authorized administrators
    • CONSOLE_LOG_LEVEL selects console verbosity or silent, overriding the DEBUG_CONSOLE fallback
    • REDIS_READONLY_RECOVERY_INTERVAL defaults to 5000 ms and debounces Keyv reconnects after a failover leaves a socket on a read-only replica
    • VIOLATION_SCORE_TTL expires inactive violation scores; 0 disables expiry
    • Startup rejects the retired published JWT_SECRET and JWT_REFRESH_SECRET values
    • Removed the pre-release GENERATION_PROTOCOL_VERSION setting; current clients and built-in generation stores select protocol v2 automatically

  • Updated built-in provider configuration

    • Vertex AI Agents use the shared GOOGLE_MODELS catalog unless an explicit vertexai catalog takes precedence
    • Google model settings expose resendFiles, bound maxContextTokens to 10-2,000,000, and apply model-aware Gemini 2.5 thinking-budget ranges
    • Native Anthropic prompt-cache and 1M-context checks now recognize matching Sonnet and Opus 4.6-or-later model IDs consistently
    • Added Claude Fable 5.1 to the direct Anthropic, Vertex AI, and Bedrock model catalogs with its distinct cache-read pricing
    • Added Gemini 3.8 Flash to the Google AI Studio and Google Cloud Gemini Enterprise Agent Platform model catalogs with Flash-family thinking, parameter, context, prefill, and pricing behavior
    • Agent model headers accept {{LIBRECHAT_USER_TENANT_ID}} and {{LIBRECHAT_USER_TENANTID}}, resolved from authoritative request-scoped tenant context
    • Updated built-in GPT-5.6 Sol pricing

  • Updated the config version to 1.3.15