[pull] main from danny-avila:main

.env.example

@@ -164,6 +164,9 @@ NODE_MAX_OLD_SPACE_SIZE=6144
 # See otel/langfuse-fanout/README.md.
 # LANGFUSE_FANOUT_ENABLED=false
 # LANGFUSE_FANOUT_COLLECTOR_URL=http://langfuse-fanout-collector:4318
+# App-side switch: set true to tell the Langfuse SDK not to create media uploads
+# for central/fallback collector traces. Tenant-routed media uploads are unchanged.
+# LANGFUSE_FANOUT_CENTRAL_MEDIA_UPLOAD_DISABLED=false
 # Emergency switch: unset/false defaults enabled; set true to keep central fanout export but skip tenant trace/score export.
 # LANGFUSE_FANOUT_TENANT_EXPORT_DISABLED=false
 # Langfuse Cloud base URL options: https://cloud.langfuse.com (EU),
@@ -992,6 +995,14 @@ HELP_AND_FAQ_URL=https://librechat.ai
 # pre-v2 build while v2 generations remain active in Redis.
 # GENERATION_PROTOCOL_VERSION=2
 
+# Coalesce streamed model/tool-argument deltas into windowed Redis publications (ms).
+# Unset or 0 (default) publishes per delta. 25 is recommended: it batches the publish
+# EVAL and the durable append across the window (fewer Redis round trips and lower
+# Redis CPU at high token rates) at the cost of up to one window of added delivery
+# latency. Enable only after EVERY replica runs a build with batch-frame support;
+# older subscribers drop coalesced frames. Values are capped at 1000.
+# STREAM_DELTA_COALESCE_MS=25
+
 # Single Redis instance
 # REDIS_URI=redis://127.0.0.1:6379
 

api/config/index.js

@@ -25,6 +25,8 @@ function getFlowStateManager(flowsCache) {
   if (!flowManager) {
     flowManager = new FlowStateManager(flowsCache, {
       ttl: mcpConfig.OAUTH_FLOW_TTL,
+      monitorTimeout: mcpConfig.OAUTH_HANDLING_TIMEOUT,
+      retainedFailureTypes: ['mcp_oauth'],
     });
   }
   return flowManager;

api/package.json

@@ -46,7 +46,7 @@
     "@azure/storage-blob": "^12.30.0",
     "@google/genai": "^2.8.0",
     "@keyv/redis": "^4.3.3",
-    "@librechat/agents": "^3.3.11",
+    "@librechat/agents": "^3.4.0",
     "@librechat/api": "*",
     "@librechat/data-schemas": "*",
     "@microsoft/microsoft-graph-client": "^3.0.7",
@@ -122,10 +122,11 @@
     "pdfjs-dist": "^5.4.624",
     "prom-client": "^15.1.3",
     "rate-limit-redis": "^4.2.0",
+    "re2js": "^2.8.6",
     "sanitize-html": "^2.17.6",
     "sharp": "^0.35.3",
     "ua-parser-js": "^1.0.36",
-    "undici": "^7.24.1",
+    "undici": "^7.29.0",
     "winston": "^3.11.0",
     "winston-daily-rotate-file": "^5.0.0",
     "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz",

api/server/controllers/agents/__tests__/openai.spec.js

@@ -196,6 +196,8 @@ jest.mock('~/cache', () => ({
 jest.mock('~/server/services/ToolService', () => ({
   loadAgentTools: jest.fn().mockResolvedValue([]),
   loadToolsForExecution: jest.fn().mockResolvedValue([]),
+  isExpectedMCPToolsUnavailableError: (error) =>
+    error?.code === 'AGENT_EXPECTED_MCP_TOOLS_UNAVAILABLE',
 }));
 
 const mockGetMultiplier = jest.fn().mockReturnValue(1);
@@ -393,6 +395,31 @@ describe('OpenAIChatCompletionController', () => {
         expect.objectContaining({ agentResourceType: ResourceType.REMOTE_AGENT }),
       );
     });
+
+    it('returns 503 when an agent expects MCP tools but resolves none', async () => {
+      const { initializeAgent } = require('@librechat/api');
+      const { loadAgentTools } = require('~/server/services/ToolService');
+      const toolError = Object.assign(new Error('Expected MCP tools are unavailable'), {
+        code: 'AGENT_EXPECTED_MCP_TOOLS_UNAVAILABLE',
+        status: 503,
+        statusCode: 503,
+      });
+      loadAgentTools.mockRejectedValueOnce(toolError);
+      initializeAgent.mockImplementationOnce(async ({ req, res, loadTools, agent }) => {
+        await loadTools({
+          req,
+          res,
+          tools: ['run_query_mcp_warehouse'],
+          model: agent.model,
+          agentId: agent.id,
+          provider: agent.provider,
+        });
+      });
+
+      await OpenAIChatCompletionController(req, res);
+
+      expect(res.status).toHaveBeenCalledWith(503);
+    });
   });
 
   describe('execution envelope', () => {

api/server/controllers/agents/__tests__/responses.unit.spec.js

@@ -211,6 +211,8 @@ jest.mock('@librechat/api', () => ({
 jest.mock('~/server/services/ToolService', () => ({
   loadAgentTools: jest.fn().mockResolvedValue([]),
   loadToolsForExecution: jest.fn().mockResolvedValue([]),
+  isExpectedMCPToolsUnavailableError: (error) =>
+    error?.code === 'AGENT_EXPECTED_MCP_TOOLS_UNAVAILABLE',
 }));
 
 const mockGetMultiplier = jest.fn().mockReturnValue(1);
@@ -343,6 +345,36 @@ describe('createResponse controller', () => {
     };
   });
 
+  it('returns 503 when an agent expects MCP tools but resolves none', async () => {
+    const { initializeAgent, sendResponsesErrorResponse } = require('@librechat/api');
+    const { loadAgentTools } = require('~/server/services/ToolService');
+    const toolError = Object.assign(new Error('Expected MCP tools are unavailable'), {
+      code: 'AGENT_EXPECTED_MCP_TOOLS_UNAVAILABLE',
+      status: 503,
+      statusCode: 503,
+    });
+    loadAgentTools.mockRejectedValueOnce(toolError);
+    initializeAgent.mockImplementationOnce(async ({ req, res, loadTools, agent }) => {
+      await loadTools({
+        req,
+        res,
+        tools: ['run_query_mcp_warehouse'],
+        model: agent.model,
+        agentId: agent.id,
+        provider: agent.provider,
+      });
+    });
+
+    await createResponse(req, res);
+
+    expect(sendResponsesErrorResponse).toHaveBeenCalledWith(
+      res,
+      503,
+      'Expected MCP tools are unavailable',
+      'server_error',
+    );
+  });
+
   describe('execution envelope', () => {
     it('creates the portable run input before agent initialization', async () => {
       req.user = {

api/server/controllers/agents/openai.js

@@ -49,6 +49,7 @@ const {
   loadAgentTools,
   loadToolsForExecution,
   getAccessibleMcpServerNames,
+  isExpectedMCPToolsUnavailableError,
 } = require('~/server/services/ToolService');
 const {
   findAccessibleResources,
@@ -103,6 +104,9 @@ function createToolLoader(signal, definitionsOnly = true) {
       });
     } catch (error) {
       logger.error('Error loading tools for agent ' + agentId, error);
+      if (isExpectedMCPToolsUnavailableError(error)) {
+        throw error;
+      }
     }
   };
 }
@@ -189,7 +193,9 @@ const executeOpenAIChatCompletion = async (envelope, { req, res }) => {
     return sendErrorResponse(
       res,
       400,
-      `Message contains a ${piiHit.label}. Remove it and try again.`,
+      piiHit.misconfigured
+        ? 'Message filtering is misconfigured; contact your administrator.'
+        : `Message contains a ${piiHit.label}. Remove it and try again.`,
       'invalid_request_error',
       'message_filter_pii_block',
     );

api/server/controllers/agents/responses.js

@@ -57,7 +57,11 @@ const {
   createToolEndCallback,
   agentLogHandlerObj,
 } = require('~/server/controllers/agents/callbacks');
-const { loadAgentTools, loadToolsForExecution } = require('~/server/services/ToolService');
+const {
+  loadAgentTools,
+  loadToolsForExecution,
+  isExpectedMCPToolsUnavailableError,
+} = require('~/server/services/ToolService');
 const {
   findAccessibleResources,
   getEffectivePermissions,
@@ -113,6 +117,9 @@ function createToolLoader(signal, definitionsOnly = true) {
       });
     } catch (error) {
       logger.error('Error loading tools for agent ' + agentId, error);
+      if (isExpectedMCPToolsUnavailableError(error)) {
+        throw error;
+      }
     }
   };
 }
@@ -622,7 +629,9 @@ const executeResponse = async (envelope, { req, res }) => {
       return sendResponsesErrorResponse(
         res,
         400,
-        `Message contains a ${piiHit.label}. Remove it and try again.`,
+        piiHit.misconfigured
+          ? 'Message filtering is misconfigured; contact your administrator.'
+          : `Message contains a ${piiHit.label}. Remove it and try again.`,
         'invalid_request',
         'message_filter_pii_block',
       );

api/server/controllers/mcp.js

@@ -5,10 +5,12 @@
  * @import { MCPServerRegistry } from '@librechat/api'
  * @import { MCPServerDocument } from 'librechat-data-provider'
  */
+const { randomUUID } = require('crypto');
 const { logger, SystemCapabilities } = require('@librechat/data-schemas');
 const {
   checkAccess,
   isUserSourced,
+  MCPConnection,
   MCPErrorCodes,
   splitMCPToolKey,
   normalizeServerName,
@@ -403,13 +405,19 @@ const createMCPServerController = async (req, res) => {
     const reservedServerNames = [
       ...new Set([...configNames, ...configNames.map(normalizeServerName)]),
     ];
-    const result = await getMCPServersRegistry().addServer(
-      'temp_server_name',
-      validation.data,
-      'DB',
-      userId,
-      reservedServerNames,
-    );
+    const inspectionServerName = `temp_server_${randomUUID()}`;
+    let result;
+    try {
+      result = await getMCPServersRegistry().addServer(
+        inspectionServerName,
+        validation.data,
+        'DB',
+        userId,
+        reservedServerNames,
+      );
+    } finally {
+      MCPConnection.clearCooldown(inspectionServerName);
+    }
     res.status(201).json({
       serverName: result.serverName,
       ...redactServerSecrets(result.config, { canEdit: true }),

api/server/experimental.js

@@ -24,6 +24,7 @@ const {
   maybeInjectQueryDevtoolsBootstrap,
   preAuthTenantMiddleware,
   configureServerTimeouts,
+  configureMessageFilterRegexValidator,
 } = require('@librechat/api');
 const { connectDb, indexSync } = require('~/db');
 const initializeOAuthReconnectManager = require('./services/initializeOAuthReconnectManager');
@@ -49,6 +50,9 @@ const optionalJwtAuth = require('./middleware/optionalJwtAuth');
 const noIndex = require('./middleware/noIndex');
 const routes = require('./routes');
 
+/** Reject messageFilter PII patterns the RE2 runtime engine cannot compile, at config load. */
+configureMessageFilterRegexValidator();
+
 const { PORT, HOST, ALLOW_SOCIAL_LOGIN, DISABLE_COMPRESSION, TRUST_PROXY } = process.env ?? {};
 
 /** Allow PORT=0 to be used for automatic free port assignment */

api/server/index.js

@@ -32,6 +32,7 @@ const {
   configureServerTimeouts,
   setupGracefulShutdown,
   updateInterfacePermissions,
+  configureMessageFilterRegexValidator,
 } = require('@librechat/api');
 const { connectDb, indexSync } = require('~/db');
 const {
@@ -56,6 +57,9 @@ const staticCache = require('./utils/staticCache');
 const noIndex = require('./middleware/noIndex');
 const routes = require('./routes');
 
+/** Reject messageFilter PII patterns the RE2 runtime engine cannot compile, at config load. */
+configureMessageFilterRegexValidator();
+
 const { PORT, HOST, ALLOW_SOCIAL_LOGIN, DISABLE_COMPRESSION, TRUST_PROXY } = process.env ?? {};
 
 // Allow PORT=0 to be used for automatic free port assignment