🚀 LibreChat v0.8.6-rc1

What's Changed

🏞️ Highlights

• Agent Skills
  • Agent Skills let you package reusable agent behavior into SKILL.md bundles: instructions, reference files, scripts, assets, and tool permissions can travel together as a capability an agent can invoke automatically, on request, or always-on.
  • Skills can be imported, size-limited, shared through ACLs, and scoped per agent, making it easier to build repeatable workflows without baking every instruction into the agent prompt.
• Subagents
  • Subagents let agents call other agents as tools, so a primary agent can delegate specialized work, run independent passes in parallel, or even call a configured copy of itself for fan-out style problem solving.
  • Subagent runs preserve the surrounding upload, user, and MCP context while enforcing recursion and graph limits, which keeps multi-agent execution powerful without making it unbounded.
• Code Execution & Artifacts
  • Text, source-code, DOCX, CSV, XLSX, and PPTX artifacts can render inline or in the side panel with richer previews.
  • Nested artifact paths, Unicode filenames, file metadata encoding, and generated-code context filtering received several hardening passes.
• CloudFront + S3 File Delivery
  • New CloudFront file strategy support includes signed cookies, signed downloads, strict signed-access enforcement, region-aware storage keys, and cookie refresh on auth refresh.
• Security, Auth, and MCP Hardening
  • MCP OAuth, OpenID/OIDC, SSRF checks, artifact routing, permission caching, avatar fetching, and HTML rendering were tightened across the stack.
• Providers, Search, and Model Support
  • Tavily search/scraping, OpenRouter prompt-cache configuration, Vertex AI multi-region endpoints, Anthropic tool-argument streaming, and GPT-5.5 token definitions are now supported.

---

✨ Features

• feat: agent skills by @danny-avila in #12625
• 📄 Auto-render Text-Based Code Execution Artifacts Inline by @danny-avila in #12829
• 🪢 Enable Tool-Output References for Bash Tool by @danny-avila in #12830
• 🪟 Render Code-Execution Text Artifacts as Side-Panel Artifacts by @danny-avila in #12832
• 🪟 Render Source-Code Artifacts in the Side Panel by @danny-avila in #12854
• 🚫 Add Support for none Reranker Type in Web Search Config by @dlew in #12765
• 💭 Require Explicit Auto-agent Enablement for Memories by @danny-avila in #12886
• 🪟 Add allowedAddresses Exemption List For SSRF-Guarded Targets by @danny-avila in #12933
• 🔍 Add Tavily as Search and Scraper Provider by @yashwanth-alapati in #12581
• 🔐 OIDC Bearer Token Authentication for Remote Agent API by @SpectralOne in #12450
• 📄 Rich File Artifact Previews for DOCX, CSV, XLSX, PPTX by @danny-avila in #12934
• 🌩️ CloudFront CDN File Strategy by @AtefBellaaj in #12193
• 🧵 Enable Anthropic Tool Argument Streaming by @danny-avila in #12962
• 🚀 Decouple File Attachment Persistence from Preview Rendering by @danny-avila in #12957
• 🧮 Add GPT-5.5 Token Definitions by @danny-avila in #12973
• 🧭 Add Message Navigation Strip & Redesign Scroll-to-Bottom by @berry-13 in #12657
• 🔐 Add Signed CloudFront File Downloads by @danny-avila in #12970
• 🌥️ Add Optional Region-aware S3/CloudFront Storage Keys by @danny-avila in #12987
• 🔄 Cross-Origin Admin OAuth Refresh by @dustinhealy in #13007
• 🧭 Add OpenRouter Prompt Cache Setting by @danny-avila in #13029
• 🔐 Mint Code API Auth Tokens by @danny-avila in #13028
• 🌐 Support Vertex AI Multi-Region Endpoints by @danny-avila in #13044
• 📦 Configure Skill Import Size Limit by @danny-avila in #13073
• 🎭 Support OpenID Audience On Refresh Grants by @danny-avila in #13077
• 🌩️ Strict CloudFront signed cookie enforcement via requireSignedAccess by @upman in #13078

🐛 Fixes

• 🔐 Restore Tenant Context in MCP OAuth Callback by @dustinhealy in #12782
• 🗨️ Restore ModelSpec Preset Greeting (and iconURL Fallback) by @danny-avila in #12809
• 🛡️ Prevent silent crash from unhandled MCP OAuth reconnect rejections by @danny-avila in #12812
• 🌱 Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) by @danny-avila in #12831
• 🚫 Reject Binary Files in read_file Sandbox Fallback (No More Mojibake) by @danny-avila in #12851
• 🔧 Replace Literal NUL Bytes in handlers.spec Test Fixture + Normalize CRLF by @danny-avila in #12852
• 📂 Preserve Nested Folder Paths for Code-Execution Artifacts by @danny-avila in #12848
• 🛂 Skip Inherited / Mark Skill Files Read-Only in Code-Env Pipeline by @danny-avila in #12866
• 💎 Stop Double-Counting Cache Tokens for Gemini/OpenAI in Usage Spend by @danny-avila in #12868
• 🛡️ Filter user_provided Sentinel in Tool Credential Loading by @Falenos in #12840
• 🧹 Graceful MCP OAuth Revoke Cleanup When Tokens Are Missing by @gaurav0107 in #12825
• 🔌 Prevent Repeated Idle Check Triggers for Users With Failed MCP Connections by @darthhexx in #12853
• 🧜‍♂️ Preserve Mermaid foreignObject HTML in Sanitized SVG by @ethanlaj in #12819
• 🩹 Treat responseCode === 0 as Transport Failure, Not Server Error by @derhelge in #12834
• 📂 Preserve Nested Skill Paths in Code-Env Uploads by @danny-avila in #12877
• 🩹 Polish code-execution attachment UX by @danny-avila in #12870
• 🔌 Follow 307/308 redirects in MCP streamable HTTP transport by @ontl in #12850
• 📥 Resolve Imported-Conversation Default Model From Runtime modelsConfig by @danny-avila in #12885
• 🩹 Sync ControlCombobox popover width with trigger after layout changes by @ethanlaj in #12887
• 🛡️ Handle MCP Tool Cache Lookup Failures by @danny-avila in #12910
• 📌 Stabilize Agent Prompt Cache Prefix by @danny-avila in #12907
• 🧭 Migrate Anthropic Long Context by @danny-avila in #12911
• 🧹 Clear MCP OAuth Tokens On Revoke by @danny-avila in #12913
• 🛡️ Harden GitNexus Index Workflow by @danny-avila in #12935
• 🧷 Pin GitNexus Native Dependency by @danny-avila in #12937
• 🛡️ Harden MCP Redirect SSRF Checks by @danny-avila in #12931
• 🧯 Harden Code Env Filepath Uploads by @danny-avila in #12936
• 🔐 Avoid Logging Password On Login Validation Error by @danny-avila in #12926
• 🪪 Validate Avatar URL Before Fetch by @danny-avila in #12928
• 🚦 Make URL Auto-Submit Configurable by @danny-avila in #12929
• 🧼 Sanitize HTML In Admin Banner And MCP Config Dialog by @danny-avila in #12927
• 🐛 Propagate User Identity to Subagent MCP Tool Calls by @danny-avila in #12950
• 🔐 Forward per-file entity_id through code-env priming by @danny-avila in #12958
• 🧬 Subagent MCP requestBody Propagation (bump @librechat/agents to 3.1.78 + cleanup) by @danny-avila in #12959
• 🛰️ Honor Anthropic Vertex Configuration by @danny-avila in #12972
• 🌐 Preserve Unicode Filenames by @danny-avila in #12977
• ⏳ Preserve Temporary Chat Retention Config by @danny-avila in #12985
• 🛂 Harden Agent File Preview Access by @danny-avila in #12981
• 🌐 Percent-encode X-File-Metadata header for Unicode filenames by @usnavy13 in #12983
• ⏱️ Align Auto-Refill Next Date by @danny-avila in #12980
• 🧭 Navigate Signed CDN Downloads by @danny-avila in #12998
• 🪪 Preserve OIDC Logout ID Token Hint by @danny-avila in #12999
• 🧭 Preserve Resend Files for Subagents by @danny-avila in #13030
• 🛟 Persist Vertex Gemini 3 thoughtSignatures across DB round-trips by @danny-avila in #13026
• 🛟 Summarization Provider misses vertexai + case-mismatched custom endpoints by @danny-avila in #13025
• 🗂️ Remove Generated Code Files From Prompt Context by @danny-avila in #13037
• 🛟 Allow Empty modelSpecs.list to Unstick Admin-Panel Saves by @dustinhealy in #13036
• 📜 Scope Read File Prompt For Code Agents by @danny-avila in #13040
• 🦘 Skip OpenAI Model Fetch For User-Provided Keys by @danny-avila in #13038
• ☁️ Enable Azure Agent Provider Uploads by @danny-avila in #13045
• 🛡️ Gate Bash PTC Capabilities by @danny-avila in #13053
• 🛰️ Validate Vertex Endpoint Overrides by @danny-avila in #13054
• 🛂 Restrict OpenID JWT Bearer Reuse by @danny-avila in #13052
• 🧯 Bound Permission Superset Cache Inputs by @danny-avila in #13065
• 🧮 Count Rejected Skill Import Bytes by @danny-avila in #13063
• 🧬 Bound Subagent Expansion by @danny-avila in #13064
• 🗝️ Enforce Skill Share Role Permission by @danny-avila in #13062
• 🪙 Pass appConfig to getBalanceConfig in set-balance script by @Odrec in #13070
• 🛡️ Harden Artifact Routing Lookups by @danny-avila in #13069
• 🧵 Preserve Upload Context Across Multipart Routes by @danny-avila in #13072
• 🍪 Refresh CloudFront Cookies On Auth Refresh by @danny-avila in #13083
• 🛡️ Harden OpenID Session Token Reuse by @danny-avila in #13086

🔧 Refactoring

• 🧬 Align LibreChat With Agents LangChain Upgrade by @danny-avila in #12922
• 🛂 Avoid Default Tavily Safe Search by @danny-avila in #12939
• 🛡️ Restrict User Tavily Endpoint URLs by @danny-avila in #12946
• ⚡ Bound Concurrent Office-HTML Rendering for Code Artifacts by @danny-avila in #12951
• 🗃️ Keep Code Artifacts Manual-Open by @danny-avila in #12961
• ⌨️ Clarify Bash Command Drafting State by @danny-avila in #12963
• 🪟 Improve Subagent Dialog Prompt Rendering by @danny-avila in #12982
• 🛡️ Scope allowedAddresses By Port by @danny-avila in #13022
• 🧰 Use Bash PTC for Agent Tools by @danny-avila in #13042
• 🧬 Align OpenRouter Reasoning Payloads by @danny-avila in #13039
• 🪪 Require Remote OIDC Audience by @danny-avila in #13066
• 🏷️ Rename Code Interpreter Labels To Run Code by @danny-avila in #13071
• 🍪 Refresh CloudFront Media Cookies by @danny-avila in #13091

🖥️ UI & Styling

• 🖥️ Render Bash PTC Calls With Bash UI by @danny-avila in #13046

📦 Dependencies, Chores & CI

• 📦 Update TypeScript Config for TS v7 by @danny-avila in #12794
• 🛡️ Bump @xmldom/xmldom to 0.8.13 via Root Override by @danny-avila in #12795
• 📦 Update @librechat/agents to v3.1.74 by @danny-avila in #12869
• 📦 npm audit fixes and Mongoose 8.23 TypeScript follow-ups by @danny-avila in #12996
• 📦 Update @librechat/agents to v3.1.79 by @danny-avila in #13000
• ⛴️ Use Bitnami Legacy MongoDB Image in Helm Chart by @vdittgen in #13032
• 📦 Bump @babel/preset-env to v7.29.5 by @danny-avila in #13034
• 🛡️ Harden Docker Dev Image Builds by @danny-avila in #13041
• 📜 Improve Skill Handling Logs by @danny-avila in #13057
• 🪵 Log Subagent Limit Hits by @danny-avila in #13068
• 📦 Bump @librechat/agents to v3.1.85 and mermaid to v11.15.0 by @danny-avila in #13079
• 🐳 Build Docker Client Package With Data Provider Dist by @danny-avila in #13097
• 📦 Bump @librechat/agents to v3.1.86, npm audit, build fix by @danny-avila in #13105
• ✨ v0.8.6-rc1 by @danny-avila in #13094

📚 Documentation

• 📚 Add Skills, Subagents, and CloudFront References by @danny-avila in #13096

🌍 Internationalization

• 🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12916, #12964, #13058, #13080

New Contributors

• @Falenos made their first contribution in #12840
• @gaurav0107 made their first contribution in #12825
• @ontl made their first contribution in #12850
• @yashwanth-alapati made their first contribution in #12581
• @vdittgen made their first contribution in #13032

Full Changelog: https://github.com/danny-avila/LibreChat/compare/v0.8.5...v0.8.6-rc1