pull · Sep 4, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026 · Sep 3, 2026
diff --git a/.env.example b/.env.example
@@ -326,19 +326,28 @@ NODE_MAX_OLD_SPACE_SIZE=6144
 # LANGFUSE_FANOUT_BATCH_SEND_SIZE=128
 # LANGFUSE_FANOUT_METADATA_CARDINALITY_LIMIT=1000
 
-#=======================#
-# OpenTelemetry Tracing #
-#=======================#
+#===============#
+# OpenTelemetry #
+#===============#
 
 # Enables backend OpenTelemetry tracing. General backend visibility only;
 # use Langfuse for GenAI-specific prompt/model observability.
 # OTEL_TRACING_ENABLED=false
+# Exports application logs as OpenTelemetry log records, correlated with the
+# active trace. Logs below OTEL_LOGS_LEVEL are not exported.
+# OTEL_LOGS_ENABLED=false
+# OTEL_LOGS_LEVEL=info
 # OTEL_SERVICE_NAME=librechat
 # OTEL_SERVICE_VERSION=
+# Exporter protocol for every signal: http/protobuf (default, port 4318) or grpc (port 4317).
+# Per-signal overrides: OTEL_EXPORTER_OTLP_TRACES_PROTOCOL, OTEL_EXPORTER_OTLP_LOGS_PROTOCOL.
+# OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf
 # OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4318
 # OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=
+# OTEL_EXPORTER_OTLP_LOGS_ENDPOINT=
 # OTEL_EXPORTER_OTLP_HEADERS=
 # OTEL_TRACES_EXPORTER=otlp
+# OTEL_LOGS_EXPORTER=otlp
 # OTEL_TRACES_SAMPLER=parentbased_always_on
 # OTEL_LOG_LEVEL=INFO
 # OTEL_SDK_DISABLED=false
@@ -578,7 +587,7 @@ GOOGLE_KEY=user_provided
 #============#
 
 OPENAI_API_KEY=user_provided
-# OPENAI_MODELS=gpt-5.6,gpt-5.6-terra,gpt-5.6-luna,gpt-5.5,gpt-5.5-pro,chat-latest,gpt-5.4,gpt-5.4-pro,gpt-5.4-mini,gpt-5.4-nano,gpt-5.3-codex,gpt-5.2,gpt-5,gpt-5-codex,gpt-5-mini,gpt-5-nano,o3-pro,o3,o4-mini,gpt-4.1,gpt-4.1-mini,gpt-4.1-nano,o3-mini,o1-pro,o1,gpt-4o,gpt-4o-mini
+# OPENAI_MODELS=gpt-6-astra,gpt-5.6,gpt-5.6-terra,gpt-5.6-luna,gpt-5.5,gpt-5.5-pro,chat-latest,gpt-5.4,gpt-5.4-pro,gpt-5.4-mini,gpt-5.4-nano,gpt-5.3-codex,gpt-5.2,gpt-5,gpt-5-codex,gpt-5-mini,gpt-5-nano,o3-pro,o3,o4-mini,gpt-4.1,gpt-4.1-mini,gpt-4.1-nano,o3-mini,o1-pro,o1,gpt-4o,gpt-4o-mini
 
 DEBUG_OPENAI=false
 
@@ -805,7 +814,15 @@ TTS_VIOLATION_SCORE=0
 STT_VIOLATION_SCORE=0
 FORK_VIOLATION_SCORE=0
 IMPORT_VIOLATION_SCORE=0
+SHARE_VIOLATION_SCORE=0
 FILE_UPLOAD_VIOLATION_SCORE=0
+# Shared link retrieval re-inspects the whole shared snapshot on every request
+# and is reachable without authentication (defaults: 100 per IP and 60 per user,
+# both per minute).
+# SHARE_IP_MAX=100
+# SHARE_IP_WINDOW=1
+# SHARE_USER_MAX=60
+# SHARE_USER_WINDOW=1
 # Per-user limiter for metadata-only /files/usage requests that renew the TTL
 # of attachments waiting in queued Agent messages (default: 120 per 15 minutes).
 # FILE_USAGE_USER_MAX=120
@@ -1258,6 +1275,18 @@ HELP_AND_FAQ_URL=https://librechat.ai
 # When unset or 0, no pinging is performed (recommended for most use cases)
 # REDIS_PING_INTERVAL=300
 
+# Milliseconds a heartbeat PING may go unanswered before the socket is presumed dead and
+# reconnected (default: 5000). Applies to REDIS_PING_INTERVAL and the subscriber heartbeat.
+# REDIS_PING_TIMEOUT=5000
+
+# Heartbeat interval in seconds for dedicated pub/sub subscriber connections (default: 15, 0 = disabled)
+# Subscribers carry no traffic between generations, so a peer that vanished without closing the
+# socket would otherwise go unnoticed until the kernel gives up (about 15 minutes at Linux defaults)
+# REDIS_SUBSCRIBER_PING_INTERVAL=15
+
+# TCP keepalive idle delay in milliseconds for ioredis sockets (default: 10000, 0 = kernel default)
+# REDIS_KEEP_ALIVE=10000
+
 # Force specific cache namespaces to use in-memory storage even when Redis is enabled
 # Comma-separated list of CacheKeys
 # Defaults to CONFIG_STORE,APP_CONFIG so YAML-derived config stays per-container (safe for blue/green deployments)

diff --git a/CONTEXT.md b/CONTEXT.md
@@ -1,5 +1,6 @@
 # Domain language
 
+- **Attached code environment**: A principal- or deployment-authorized stateful workspace owned by an outbound `librechat-code` worker on a user-chosen machine or VM. LibreChat selects it and enforces approval policy, Code API authenticates and dispatches to it, and the worker's local sandbox and capability flags remain the final execution ceiling. The environment interface is runtime-neutral: native SRT, WSL2, Docker/NsJail, and future adapters expose the same workspace operations without leaking host paths or runtime configuration into agent tools.
 - **Agent run envelope**: the versioned, JSON-safe request contract created after ingress authentication and protocol validation but before agent, provider, tool, or MCP initialization. It carries only the validated protocol payload and the minimum trusted principal identifiers. The execution host rehydrates all runtime state from those identifiers.
 - **Agent execution context**: runtime-only, transport-free state rehydrated beside an Agent run envelope. It contains the authenticated user, application configuration, normalized request metadata, and resolved conversation facts needed by initialization, but never Express request/response objects or serialized credentials.
 - **Agent execution host**: the protocol-neutral module that owns run admission, disconnect cancellation, provider-start fencing, and terminal settlement. Protocol implementations execute behind its callback interface; HTTP adapters retain validation and final stream rendering.

diff --git a/api/cache/getLogStores.js b/api/cache/getLogStores.js
@@ -30,6 +30,7 @@ const namespaces = {
   [ViolationTypes.TTS_LIMIT]: violationCache(ViolationTypes.TTS_LIMIT),
   [ViolationTypes.STT_LIMIT]: violationCache(ViolationTypes.STT_LIMIT),
   [ViolationTypes.CONVO_ACCESS]: violationCache(ViolationTypes.CONVO_ACCESS),
+  [ViolationTypes.SHARE_LIMIT]: violationCache(ViolationTypes.SHARE_LIMIT),
   [ViolationTypes.TOOL_CALL_LIMIT]: violationCache(ViolationTypes.TOOL_CALL_LIMIT),
   [ViolationTypes.FILE_UPLOAD_LIMIT]: violationCache(ViolationTypes.FILE_UPLOAD_LIMIT),
   [ViolationTypes.VERIFY_EMAIL_LIMIT]: violationCache(ViolationTypes.VERIFY_EMAIL_LIMIT),

diff --git a/api/jest.config.js b/api/jest.config.js
@@ -7,6 +7,13 @@ const esModules = [
   '@langchain/langgraph-sdk',
   '@mistralai/mistralai',
   'uuid',
+  'sanitize-html',
+  'htmlparser2',
+  'domhandler',
+  'domelementtype',
+  'domutils',
+  'dom-serializer',
+  'entities',
 ].join('|');
 
 module.exports = {

diff --git a/api/package.json b/api/package.json
@@ -46,7 +46,7 @@
     "@azure/storage-blob": "^12.30.0",
     "@google/genai": "^2.8.0",
     "@keyv/redis": "5.1.6",
-    "@librechat/agents": "^3.7.17",
+    "@librechat/agents": "^3.7.21",
     "@librechat/api": "*",
     "@librechat/data-schemas": "*",
     "@microsoft/microsoft-graph-client": "^3.0.7",
@@ -62,6 +62,7 @@
     "@opentelemetry/resources": "^2.6.1",
     "@opentelemetry/sdk-node": "^0.221.0",
     "@opentelemetry/semantic-conventions": "^1.39.0",
+    "@opentelemetry/winston-transport": "^0.28.0",
     "@redis/client": "5.10.0",
     "@smithy/node-http-handler": "^4.4.5",
     "ai-tokenizer": "^1.0.6",
@@ -73,6 +74,7 @@
     "cookie-parser": "^1.4.7",
     "cors": "^2.8.5",
     "dedent": "^1.5.3",
+    "dompurify": "^3.4.12",
     "dotenv": "^16.0.3",
     "eventsource": "^3.0.2",
     "express": "^5.2.1",
@@ -88,6 +90,7 @@
     "https-proxy-agent": "^7.0.6",
     "ioredis": "^5.3.2",
     "js-yaml": "^4.2.0",
+    "jsdom": "^26.1.0",
     "jsonwebtoken": "^9.0.0",
     "jszip": "^3.10.1",
     "jwks-rsa": "^3.2.0",

diff --git a/api/server/controllers/__tests__/tools.callTool.contentFilter.spec.js b/api/server/controllers/__tests__/tools.callTool.contentFilter.spec.js
@@ -523,8 +523,12 @@ describe('callTool generated-content protection', () => {
     expect(mockProcessCodeOutput).toHaveBeenCalledWith(
       expect.objectContaining({ downloadFallback: true, preparedBuffer: undefined }),
     );
+    /* The cause rides the warning so the failure is diagnosable at all, but
+     * only through `getSafeErrorMetadata` — the upstream message here is
+     * `PRIVATE-DOWNLOAD-ERROR`, and that is precisely what must not appear. */
     expect(mockLogger.warn).toHaveBeenCalledWith(
       '[preflightCodeOutputBatch] Generated artifact 1 could not be inspected',
+      { type: 'Error' },
     );
     expect(JSON.stringify(mockLogger.warn.mock.calls)).not.toContain('PRIVATE-');
     expect(res.status).toHaveBeenCalledWith(200);

diff --git a/api/server/controllers/agents/__tests__/resume.spec.js b/api/server/controllers/agents/__tests__/resume.spec.js
@@ -1530,7 +1530,7 @@ describe('ResumeAgentController (POST /agents/chat/resume)', () => {
       const res = await post(approveBody());
 
       expect(res.status).toBe(400);
-      expect(mockGetActions).toHaveBeenCalledWith({ agent_id: { $in: [AGENT_ID] } }, false);
+      expect(mockGetActions).toHaveBeenCalledWith({ agentId: [AGENT_ID] }, false);
       expect(mockDecryptMetadata).not.toHaveBeenCalled();
       expect(mockGenerationJobManager.approvals.resolve).not.toHaveBeenCalled();
       expect(mockInitializeClient).not.toHaveBeenCalled();

diff --git a/api/server/controllers/agents/__tests__/v1.spec.js b/api/server/controllers/agents/__tests__/v1.spec.js
@@ -68,7 +68,7 @@ describe('duplicateAgent', () => {
     await duplicateAgent(req, res);
 
     expect(getAgent).toHaveBeenCalledWith({ id: 'agent_123' });
-    expect(getActions).toHaveBeenCalledWith({ agent_id: 'agent_123' }, true);
+    expect(getActions).toHaveBeenCalledWith({ agentId: 'agent_123' }, true);
     expect(createAgent).toHaveBeenCalledWith(
       expect.objectContaining({
         id: 'agent_new_123',

diff --git a/api/server/controllers/agents/v1.js b/api/server/controllers/agents/v1.js
@@ -1465,7 +1465,7 @@ const duplicateAgentHandler = async (req, res) => {
       return res.status(subagentReferenceError.status).json(subagentReferenceError.body);
     }
 
-    const originalActions = (await db.getActions({ agent_id: id }, true)) ?? [];
+    const originalActions = (await db.getActions({ agentId: id }, true)) ?? [];
     const sanitizedActions = originalActions.map((action) => {
       const metadata = { ...(action.metadata || {}) };
       for (const field of sensitiveFields) {
@@ -1550,7 +1550,7 @@ const duplicateAgentHandler = async (req, res) => {
       const fullActionId = `${domain}${actionDelimiter}${newActionId}`;
 
       const newAction = await db.updateAction(
-        { action_id: newActionId, agent_id: newAgentId },
+        { actionId: newActionId, agentId: newAgentId },
         {
           metadata: action.metadata,
           agent_id: newAgentId,
@@ -1575,7 +1575,7 @@ const duplicateAgentHandler = async (req, res) => {
     try {
       newAgent = await db.createAgent(newAgentData);
     } catch (error) {
-      await db.deleteActions({ agent_id: newAgentId, user: userId }).catch((cleanupError) => {
+      await db.deleteActions({ agentId: newAgentId, user: userId }).catch((cleanupError) => {
         logger.error(
           '[/agents/:id/duplicate] Failed to clean up cloned Actions after Agent creation failed:',
           cleanupError,
@@ -2065,7 +2065,7 @@ const revertAgentVersionHandler = async (req, res) => {
       .filter(Boolean);
     const actions =
       actionIds.length > 0
-        ? ((await db.getActions({ agent_id: id, action_id: { $in: actionIds } }, true)) ?? [])
+        ? ((await db.getActions({ agentId: id, actionId: actionIds }, true)) ?? [])
         : [];
 
     if (