innFactory · pull · Sep 3, 2026 · Sep 3, 2026
diff --git a/.env.example b/.env.example
@@ -719,6 +719,25 @@ TTS_API_KEY=
 
 # LIBRECHAT_CODE_API_KEY=
 # LIBRECHAT_CODE_BASEURL=
+# Current self-hosted Code Interpreter deployments use per-user LibreChat JWTs outside local mode.
+# Configure the matching public verifier on Code Interpreter; see:
+# https://www.librechat.ai/docs/features/code_interpreter#self-hosted-jwt-authentication
+# CODEAPI_AUTH_PROVIDER=librechat-jwt
+# CODEAPI_JWT_ENABLED=false
+# Set at least one private-key source. Precedence: PEM, base64-encoded PEM, then private JWK JSON.
+# CODEAPI_JWT_PRIVATE_KEY="-----BEGIN PRIVATE KEY-----\n...\n-----END PRIVATE KEY-----"
+# CODEAPI_JWT_PRIVATE_KEY_BASE64=
+# CODEAPI_JWT_PRIVATE_JWK_JSON=
+# CODEAPI_JWT_ALGORITHM=EdDSA
+# CODEAPI_JWT_KID=lc-codeapi-2026-05
+# CODEAPI_JWT_ISSUER=librechat
+# CODEAPI_JWT_AUDIENCE=codeapi
+# CODEAPI_JWT_TTL_SECONDS=300
+# CODEAPI_JWT_MINT_CACHE_SECONDS=30
+# CODEAPI_JWT_SINGLE_TENANT_ID=legacy
+# Multi-tenant deployments can reject requests without authenticated tenant context.
+# The Code Interpreter service must also set CODEAPI_TENANT_ISOLATION_STRICT=true.
+# TENANT_ISOLATION_STRICT=false
 # Optional dedicated Code API deployment for agents with Stateful code sessions enabled.
 # When configured, stateless agents continue using LIBRECHAT_CODE_BASEURL while stateful
 # agents fail closed onto this endpoint. The endpoint must advertise the `stateful` profile.
@@ -945,6 +964,9 @@ OPENID_REUSE_TOKENS=
 #is not rotated/revoked out from under downstream consumers (e.g. MCP servers that introspect the bearer).
 #When OPENID_REUSE_TOKENS=true, the OpenID session cookie maxAge is extended to at least this value.
 OPENID_REUSE_MAX_SESSION_AGE_MS=
+#Short recovery window for a rotated OpenID refresh token while LibreChat publishes the refreshed session. Default 60000 ms (1 min).
+#Accepts arithmetic expressions. Increase only when slow session persistence or cross-replica publication needs more time.
+OPENID_REFRESH_BRIDGE_GRACE_MS=
 #By default, signing key verification results are cached in order to prevent excessive HTTP requests to the JWKS endpoint.
 #If a signing key matching the kid is found, this will be cached and the next time this kid is requested the signing key will be served from the cache.
 #Default is true.
@@ -1024,6 +1046,11 @@ ENTRA_ID_INCLUDE_OWNERS_AS_MEMBERS=false
 # Default scopes provide access to user profiles and group memberships
 OPENID_GRAPH_SCOPES=User.Read,People.Read,GroupMember.Read.All
 
+# Space-separated Microsoft Graph scopes requested by the OBO exchange for
+# {{LIBRECHAT_GRAPH_ACCESS_TOKEN}} placeholders in YAML-defined MCP servers.
+# This is separate from OPENID_GRAPH_SCOPES above.
+# GRAPH_API_SCOPES=https://graph.microsoft.com/.default
+
 # LDAP
 LDAP_URL=
 LDAP_BIND_DN=
@@ -1222,6 +1249,10 @@ HELP_AND_FAQ_URL=https://librechat.ai
 # Redis connection limits
 # REDIS_MAX_LISTENERS=40
 
+# Minimum interval in milliseconds between Keyv reconnect attempts after a
+# READONLY reply during standalone or Sentinel failover (default: 5000)
+# REDIS_READONLY_RECOVERY_INTERVAL=5000
+
 # Redis ping interval in seconds (0 = disabled, >0 = enabled)
 # When set to a positive integer, Redis clients will ping the server at this interval to keep connections alive
 # When unset or 0, no pinging is performed (recommended for most use cases)

diff --git a/.github/SECURITY.md b/.github/SECURITY.md
@@ -8,7 +8,7 @@ At LibreChat, we prioritize the security of our project and value the contributi
 
 When reporting a security vulnerability, you have the following options to reach out to us:
 
-- **Option 1: GitHub Security Advisory System**: We encourage you to use GitHub's Security Advisory system to report any security vulnerabilities you find. This allows us to receive vulnerability reports directly through GitHub. For more information on how to submit a security advisory report, please refer to the [GitHub Security Advisories documentation](https://docs.github.com/en/code-security/getting-started-with-security-vulnerability-alerts/about-github-security-advisories).
+- **Option 1: GitHub Private Vulnerability Reporting**: Submit sensitive vulnerability details through LibreChat's [private vulnerability reporting form](https://github.com/danny-avila/LibreChat/security/advisories/new). This sends the report confidentially to the project maintainers.
 
 - **Option 2: GitHub Issues**: You can initiate first contact via GitHub Issues. However, please note that initial contact through GitHub Issues should not include any sensitive details.
 
@@ -53,9 +53,10 @@ We would like to express our gratitude to the security researchers and community
 
 We currently do not have a bug bounty program in place. However, we welcome and appreciate any
 
- security-related contributions through pull requests (PRs) that address vulnerabilities in our codebase. We believe in the power of collaboration to improve the security of our project and invite you to join us in making it more robust.
+security-related contributions through pull requests (PRs) that address vulnerabilities in our codebase. We believe in the power of collaboration to improve the security of our project and invite you to join us in making it more robust.
 
 **Reference**
+
 - https://cheatsheetseries.owasp.org/cheatsheets/Vulnerability_Disclosure_Cheat_Sheet.html
 
 ---

diff --git a/Dockerfile b/Dockerfile
@@ -1,4 +1,4 @@
-# v0.8.8-rc1
+# v0.8.8-rc2
 
 # Base node image
 FROM node:24.16.0-alpine AS node

diff --git a/Dockerfile.multi b/Dockerfile.multi
@@ -1,5 +1,5 @@
 # Dockerfile.multi
-# v0.8.8-rc1
+# v0.8.8-rc2
 
 # Set configurable max-old-space-size with default
 ARG NODE_MAX_OLD_SPACE_SIZE=6144

diff --git a/README.md b/README.md
@@ -51,25 +51,30 @@
   </a>
 </p>
 
-## 🚀 What's New in v0.8.8-rc1
-
-- **Agent run control:** Interrupt or steer an Agent mid-run, queue follow-up messages, and reclaim, edit, or escalate pending steers.
-- **Human-in-the-loop Agents:** Agents stream question progress, ask up to four related questions in one form, pause for input or tool approval, and resume.
-- **Unified Agent Builder:** A redesigned Tools marketplace brings together Skills, MCP, Code Interpreter, orchestration, Programmatic Tool Calling, model-spec controls, and per-tool background and intent settings.
-- **Readable Agent activity:** Generated activity-group headers, parent phase summaries, and live tool intent labels make long reasoning and tool runs easier to scan.
-- **Code Interpreter workflows:** Code and shell tools can run in the background, sandbox images return as viewable artifacts, and highly experimental stateful sessions can reuse prewarmed conversation workspaces.
-- **Agent extensibility:** Experimental Agent Plugins can bundle deployment Skills, MCP servers, and opt-in command hooks, while explicit subagents initialize only when selected.
-- **Memory, context, and identity:** Agents can manage memory with optional per-agent isolation, expose support contacts safely, and show a more faithful Context Usage gauge.
-- **Sharing and files:** Shared conversations show a badge and update at a stable URL, while signed-in viewers can continue them as personal copies.
-- **Artifact workflows:** Open previews fullscreen, work with PowerPoint `.potx` templates across upload, search, and code execution, upload shell scripts across common MIME variants, export Mermaid diagrams as SVG or PNG, and download original Office files from the artifact panel.
-- **Models and reasoning:** Added GPT-5.6 with Responses API reasoning controls, Claude Opus 5 and Sonnet 5, Gemini 3.7 and 3.6 Flash, and Gemini 3.5 Flash-Lite.
-- **Langfuse observability:** Configure encrypted Langfuse connections in-app, let authorized admins open sampled sessions directly, optionally fan out traces by tenant, and suppress central export per run.
-- **Administration and security:** Delegate config sections, encrypt registered secrets, enforce SSRF checks for speech, OCR, and web tools, and generate unique temporary credentials when secrets are blank.
-- **Messages and navigation:** Right-aligned user turns, unified multi-part editing, full-message copy, a dock-style message rail, virtualized search, smooth streaming, and faster Agent startup.
-- **Streaming and tool reliability:** Adaptive provider smoothing, Redis delta batching, dynamic MCP tool refresh, parsed MCP response media types, runtime OAuth recovery, and Agent stream circuit breakers improve long-running workflows.
-- **Deployment and reliability:** Added configurable HTTP timeouts, Amazon DocumentDB 5.0+ support, low-noise Redis and browser observability, and a rolling-upgrade-safe generation protocol.
-
-Read the [full v0.8.8-rc1 changelog](https://www.librechat.ai/changelog/v0.8.8-rc1).
+## 🚀 What's New in v0.8.8-rc2
+
+- **Agent run control:** Interrupt an Agent before visible answer text, steer runs with files and quoted excerpts, durably queue follow-ups, and recover saved partial work with **Keep going** or **Answer now**.
+- **Agent activity:** Optional generated labels group reasoning and tool work, fold completed groups into live phase cards, keep generated files visible, summarize multi-step phases, and show the current reasoning direction.
+- **Human-in-the-loop Agents:** Stream up to four related questions, pause for input or tool approval, and resume durably.
+- **Unified Agent Builder:** Configure Skills, MCP, Code Interpreter, orchestration, Programmatic Tool Calling, model-spec controls, and per-tool background and intent settings in one Tools marketplace; Skills can be enabled for standalone runtime authoring without exposing the existing catalog.
+- **Durable Agent automation:** Authenticated Agent Events support bound child actors, expected-action receipts, per-actor mailboxes, event batching, durable human pauses, and automatic detached Actions across built-in stream stores.
+- **Deeper Subagent history:** Browse branch-aware child turns with bounded reasoning and stable live event views, load earlier activity, inspect event details, continue completed child chats, and automatically wake saved parent Agents when detached work settles.
+- **Background tools:** Eligible Code Interpreter, MCP, Plugin, and Action tools can run while an Agent keeps working, with automatic delivery for supported completions and polling controls when needed.
+- **Code Interpreter workflows:** Sandbox images return as viewable artifacts; highly experimental stateful sessions add scoped managed, attached, or personal environments, per-message file downloads, and guarded file-write and command permissions.
+- **Agent extensibility:** Experimental Agent Plugins bundle deployment Skills, MCP servers, and opt-in command hooks; saved Agent teams run as isolated Subagent graphs.
+- **Scheduled Chats (experimental):** Run saved Agents with presets or custom cron, selectable time zones, multi-day weekly cadence, and optional Chat Project destinations.
+- **Memory and context:** Agents can use optionally isolated memory, preserve adaptive context fading across turns, and show categorized current-window usage, tokens, and optional cost.
+- **Editable long pastes:** Long pasted text becomes an editable attachment that can be moved back into the composer; attachment-only turns and reliable Upload as Text downloads are also supported.
+- **Projects, settings, and navigation:** Search conversation titles and message contents, manage project chats, use searchable settings and shortcuts, pin chats, choose clock/week conventions, and navigate faster on mobile.
+- **Sharing and artifacts:** Stable shared links support personal copies; fullscreen previews, Mermaid export, PowerPoint templates, shell scripts, and original Office downloads expand file workflows.
+- **Web search:** Keenable adds keyless search and page fetch, while SearXNG and Tavily gain richer controls and all web-tool egress uses stronger SSRF protection.
+- **Security and authentication:** Default HTTP security headers, opt-in nonce CSP, authenticated local images, per-user Code Interpreter JWTs, stable SAML identity binding, live-session OpenID token refresh, and retired JWT-secret rejection harden deployments.
+- **Models and reasoning:** Added GPT-5.6 with Responses reasoning controls, Claude Fable 5.1, Opus 5, and Sonnet 5, plus Gemini 3.8/3.7/3.6 Flash and Gemini 3.5 Flash-Lite.
+- **Langfuse observability:** Configure encrypted in-app connections, tenant fanout, authenticated gateways, export-decision telemetry, and authorized session links in chats and shared views.
+- **Administration:** Source-aware content filters can audit or block model-bound data, while tenant Insights, delegated configuration, encrypted secrets, and expiring violation scores improve operations.
+- **Streaming and reliability:** Adaptive smoothing, Redis delta batching and failover recovery, automatic generation protocol v2, live MCP catalog refresh, Agent circuit breakers, and DocumentDB support improve long runs and scaled deployments.
+
+Read the [full v0.8.8-rc2 changelog](https://www.librechat.ai/changelog/v0.8.8-rc2).
 
 # ✨ Features
 

diff --git a/api/package.json b/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/backend",
-  "version": "v0.8.8-rc1",
+  "version": "v0.8.8-rc2",
   "description": "",
   "scripts": {
     "start": "echo 'please run this from the root directory'",

diff --git a/bun.lock b/bun.lock
diff --git a/client/jest.config.cjs b/client/jest.config.cjs
@@ -1,4 +1,4 @@
-/** v0.8.8-rc1 */
+/** v0.8.8-rc2 */
 module.exports = {
   roots: ['<rootDir>/src'],
   testEnvironment: 'jsdom',

diff --git a/client/package.json b/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/frontend",
-  "version": "v0.8.8-rc1",
+  "version": "v0.8.8-rc2",
   "description": "",
   "type": "module",
   "scripts": {

diff --git a/e2e/jestSetup.js b/e2e/jestSetup.js
@@ -1,3 +1,3 @@
-// v0.8.8-rc1
+// v0.8.8-rc2
 // See .env.test.example for an example of the '.env.test' file.
 require('dotenv').config({ path: './e2e/.env.test' });
diff --git a/helm/librechat/Chart.yaml b/helm/librechat/Chart.yaml
@@ -15,15 +15,15 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 2.0.8
+version: 2.0.9
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
 
 # renovate: image=registry.librechat.ai/danny-avila/librechat
-appVersion: "v0.8.8-rc1"
+appVersion: "v0.8.8-rc2"
 
 home: https://www.librechat.ai
 

diff --git a/librechat.example.yaml b/librechat.example.yaml
@@ -2,7 +2,7 @@
 # https://www.librechat.ai/docs/configuration/librechat_yaml
 
 # Configuration version (required)
-version: 1.3.14
+version: 1.3.15
 
 # Cache settings: Set to true to enable caching
 cache: true
@@ -591,6 +591,15 @@ endpoints:
   #         # receive a one-time code for an outbound @librechat/code worker.
   #         # The administrator secret stays in the named environment variable.
   #         owner: deployment
+  #         # Optionally expose only these bounded preferences to environment owners.
+  #         configSchema:
+  #           permissions:
+  #             fileWrite:
+  #               allowed: [allow, ask, deny]
+  #               default: ask
+  #             commandExecution:
+  #               allowed: [ask, deny]
+  #               default: ask
   #         pairing:
   #           allowPrincipalWorkers: true
   #           tokenEnv: CODE_BRIDGE_ADMIN_TOKEN

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "LibreChat",
-  "version": "v0.8.8-rc1",
+  "version": "v0.8.8-rc2",
   "description": "",
   "packageManager": "npm@11.13.0",
   "workspaces": [

diff --git a/packages/api/package.json b/packages/api/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/api",
-  "version": "1.7.46",
+  "version": "1.7.47",
   "type": "commonjs",
   "description": "MCP services for LibreChat",
   "main": "dist/index.cjs",

diff --git a/packages/client/package.json b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/client",
-  "version": "0.4.76",
+  "version": "0.4.77",
   "description": "React components for LibreChat",
   "repository": {
     "type": "git",

diff --git a/packages/data-provider/package.json b/packages/data-provider/package.json
@@ -1,6 +1,6 @@
 {
   "name": "librechat-data-provider",
-  "version": "0.8.521",
+  "version": "0.8.522",
   "description": "data services for librechat apps",
   "main": "dist/index.js",
   "module": "dist/index.mjs",

diff --git a/packages/data-provider/src/config.ts b/packages/data-provider/src/config.ts
@@ -3356,7 +3356,7 @@ export enum Constants {
    */
   VERSION = '__LIBRECHAT_VERSION__',
   /** Key for the Custom Config's version (librechat.yaml). */
-  CONFIG_VERSION = '1.3.14',
+  CONFIG_VERSION = '1.3.15',
   /** Standard value for the first message's `parentMessageId` value, to indicate no parent exists. */
   NO_PARENT = '00000000-0000-0000-0000-000000000000',
   /** Standard value to use whatever the submission prelim. `responseMessageId` is */

diff --git a/packages/data-schemas/package.json b/packages/data-schemas/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@librechat/data-schemas",
-  "version": "0.0.68",
+  "version": "0.0.69",
   "description": "Mongoose schemas and models for LibreChat",
   "type": "module",
   "main": "dist/index.cjs",