LibreChat/api
Danny Avila 6f87b49df8
🛂 fix: Enforce Actions Capability Gate Across All Event-Driven Tool Loading Paths (#12252)
* fix: gate action tools by actions capability in all code paths

Extract resolveAgentCapabilities helper to eliminate 3x-duplicated
capability resolution. Apply early action-tool filtering in both
loadToolDefinitionsWrapper and loadAgentTools non-definitions path.
Gate loadActionToolsForExecution in loadToolsForExecution behind an
actionsEnabled parameter with a cache-based fallback. Replace the
late capability guard in loadAgentTools with a hasActionTools check
to avoid unnecessary loadActionSets DB calls and duplicate warnings.

* fix: thread actionsEnabled through InitializedAgent type

Add actionsEnabled to the loadTools callback return type,
InitializedAgent, and the initializeAgent destructuring/return
so callers can forward the resolved value to loadToolsForExecution
without redundant getEndpointsConfig cache lookups.

* fix: pass actionsEnabled from callers to loadToolsForExecution

Thread actionsEnabled through the agentToolContexts map in
initialize.js (primary and handoff agents) and through
primaryConfig in the openai.js and responses.js controllers,
avoiding per-tool-call capability re-resolution on the hot path.

* test: add regression tests for action capability gating

Test the real exported functions (resolveAgentCapabilities,
loadAgentTools, loadToolsForExecution) with mocked dependencies
instead of shadow re-implementations. Covers definition filtering,
execution gating, actionsEnabled param forwarding, and fallback
capability resolution.

* test: use Constants.EPHEMERAL_AGENT_ID in ephemeral fallback test

Replaces a string guess with the canonical constant to avoid
fragility if the ephemeral detection heuristic changes.

* fix: populate agentToolContexts for addedConvo parallel agents

After processAddedConvo returns, backfill agentToolContexts for
any agents in agentConfigs not already present, so ON_TOOL_EXECUTE
for added-convo agents receives actionsEnabled instead of falling
back to a per-call cache lookup.
2026-03-15 23:01:36 -04:00
..
app refactor: Replace tiktoken with ai-tokenizer (#12175) 2026-03-10 23:14:52 -04:00
cache 🔌 fix: Resolve MCP OAuth flow state race condition (#11941) 2026-03-02 19:27:36 -05:00
config 🪵 fix: Standardize Logging Directory with Environment-Aware Resolution (#11000) 2025-12-16 18:00:06 -05:00
db 🫙 fix: Force MeiliSearch Full Sync on Empty Index State (#12202) 2026-03-12 20:43:23 -04:00
models 🔏 fix: Scope Agent-Author File Access to Attached Files Only (#12251) 2026-03-15 18:54:34 -04:00
server 🛂 fix: Enforce Actions Capability Gate Across All Event-Driven Tool Loading Paths (#12252) 2026-03-15 23:01:36 -04:00
strategies 🪙 fix: Resolve Azure AD Group Overage via OBO Token Exchange for OpenID (#12187) 2026-03-15 19:09:53 -04:00
test 🪣 fix: S3 path-style URL support for MinIO, R2, and custom endpoints (#11894) 2026-02-21 18:36:48 -05:00
utils 🤖 feat: GPT-5.4 and GPT-5.4-pro Context + Pricing (#12099) 2026-03-06 02:11:01 -05:00
jest.config.js 📏 refactor: Add File Size Limits to Conversation Imports (#12221) 2026-03-14 03:06:29 -04:00
jsconfig.json feat(api): initial Redis support; fix(SearchBar): proper debounce (#1039) 2023-10-11 17:05:47 -04:00
package.json 📦 chore: Bump NPM Audit Packages (#12227) 2026-03-14 03:36:03 -04:00
typedefs.js 🪦 refactor: Remove Legacy Code (#10533) 2025-12-11 16:36:12 -05:00