Merge branch 'danny-avila:main' into new/s3-support-path-style-urls

Author: darthhexx

.devcontainer/docker-compose.yml

@@ -20,8 +20,7 @@ services:
     environment:
       - HOST=0.0.0.0
       - MONGO_URI=mongodb://mongodb:27017/LibreChat
-      # - CHATGPT_REVERSE_PROXY=http://host.docker.internal:8080/api/conversation # if you are hosting your own chatgpt reverse proxy with docker
-      # - OPENAI_REVERSE_PROXY=http://host.docker.internal:8070/v1/chat/completions # if you are hosting your own chatgpt reverse proxy with docker
+      # - OPENAI_REVERSE_PROXY=http://host.docker.internal:8070/v1
       - MEILI_HOST=http://meilisearch:7700
 
     # Runs app on the same network as the service container, allows "forwardPorts" in devcontainer.json function.

.env.example

@@ -129,7 +129,6 @@ ANTHROPIC_API_KEY=user_provided
 # AZURE_OPENAI_API_VERSION= # Deprecated
 # AZURE_OPENAI_API_COMPLETIONS_DEPLOYMENT_NAME= # Deprecated
 # AZURE_OPENAI_API_EMBEDDINGS_DEPLOYMENT_NAME= # Deprecated
-# PLUGINS_USE_AZURE="true" # Deprecated
 
 #=================#
 #   AWS Bedrock   #
@@ -230,14 +229,6 @@ ASSISTANTS_API_KEY=user_provided
 # More info, including how to enable use of Assistants with Azure here:
 # https://www.librechat.ai/docs/configuration/librechat_yaml/ai_endpoints/azure#using-assistants-with-azure
 
-#============#
-# Plugins    #
-#============#
-
-# PLUGIN_MODELS=gpt-4o,gpt-4o-mini,gpt-4,gpt-4-turbo-preview,gpt-4-0125-preview,gpt-4-1106-preview,gpt-4-0613,gpt-3.5-turbo,gpt-3.5-turbo-0125,gpt-3.5-turbo-1106,gpt-3.5-turbo-0613
-
-DEBUG_PLUGINS=true
-
 CREDS_KEY=f34be427ebb29de8d88c107a71546019685ed8b241d8f2ed00c3df97ad2566f0
 CREDS_IV=e2341419ec3dd3d19b13a1a87fafcbfb
 
@@ -785,3 +776,7 @@ OPENWEATHER_API_KEY=
 
 # Cache connection status checks for this many milliseconds to avoid expensive verification
 # MCP_CONNECTION_CHECK_TTL=60000
+
+# Skip code challenge method validation (e.g., for AWS Cognito that supports S256 but doesn't advertise it)
+# When set to true, forces S256 code challenge even if not advertised in .well-known/openid-configuration
+# MCP_SKIP_CODE_CHALLENGE_CHECK=false

.github/workflows/backend-review.yml

@@ -4,6 +4,7 @@ on:
     branches:
       - main
       - dev
+      - dev-staging
       - release/*
     paths:
       - 'api/**'
@@ -71,4 +72,4 @@ jobs:
         run: cd packages/data-schemas && npm run test:ci
 
       - name: Run @librechat/api unit tests
-        run: cd packages/api && npm run test:ci
+        run: cd packages/api && npm run test:ci

.github/workflows/cache-integration-tests.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - dev
+      - dev-staging
       - release/*
     paths:
       - 'packages/api/src/cache/**'
@@ -61,30 +62,23 @@ jobs:
           npm run build:data-schemas
           npm run build:api
 
-      - name: Run cache integration tests
+      - name: Run all cache integration tests (Single Redis Node)
         working-directory: packages/api
         env:
           NODE_ENV: test
           USE_REDIS: true
+          USE_REDIS_CLUSTER: false
           REDIS_URI: redis://127.0.0.1:6379
-          REDIS_CLUSTER_URI: redis://127.0.0.1:7001,redis://127.0.0.1:7002,redis://127.0.0.1:7003
-        run: npm run test:cache-integration:core
+        run: npm run test:cache-integration
 
-      - name: Run cluster integration tests
+      - name: Run all cache integration tests (Redis Cluster)
         working-directory: packages/api
         env:
           NODE_ENV: test
           USE_REDIS: true
-          REDIS_URI: redis://127.0.0.1:6379
-        run: npm run test:cache-integration:cluster
-
-      - name: Run mcp integration tests
-        working-directory: packages/api
-        env:
-          NODE_ENV: test
-          USE_REDIS: true
-          REDIS_URI: redis://127.0.0.1:6379
-        run: npm run test:cache-integration:mcp
+          USE_REDIS_CLUSTER: true
+          REDIS_URI: redis://127.0.0.1:7001,redis://127.0.0.1:7002,redis://127.0.0.1:7003
+        run: npm run test:cache-integration
 
       - name: Stop Redis Cluster
         if: always()
@@ -93,4 +87,4 @@ jobs:
 
       - name: Stop Single Redis Instance
         if: always()
-        run: redis-cli -p 6379 shutdown || true
+        run: redis-cli -p 6379 shutdown || true

.github/workflows/client.yml

@@ -13,26 +13,32 @@ on:
         required: false
         default: 'Manual publish requested'
 
+permissions:
+  id-token: write  # Required for OIDC trusted publishing
+  contents: read
+
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    environment: publish  # Must match npm trusted publisher config
     steps:
       - uses: actions/checkout@v4
 
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      
+      - name: Update npm for OIDC support
+        run: npm install -g npm@latest  # Must be 11.5.1+ for provenance
 
       - name: Install client dependencies
         run: cd packages/client && npm ci
 
       - name: Build client
         run: cd packages/client && npm run build
 
-      - name: Set up npm authentication
-        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.PUBLISH_NPM_TOKEN }}" > ~/.npmrc
-        
       - name: Check version change
         id: check
         working-directory: packages/client
@@ -55,4 +61,4 @@ jobs:
       - name: Publish
         if: steps.check.outputs.skip != 'true'
         working-directory: packages/client
-        run: npm publish *.tgz --access public
+        run: npm publish *.tgz --access public --provenance

.github/workflows/data-provider.yml

@@ -13,6 +13,10 @@ on:
         required: false
         default: 'Manual publish requested'
 
+permissions:
+  id-token: write  # Required for OIDC trusted publishing
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -27,14 +31,17 @@ jobs:
   publish-npm:
     needs: build
     runs-on: ubuntu-latest
+    environment: publish  # Must match npm trusted publisher config
     steps:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
           node-version: 20
           registry-url: 'https://registry.npmjs.org'
+      
+      - name: Update npm for OIDC support
+        run: npm install -g npm@latest  # Must be 11.5.1+ for provenance
+      
       - run: cd packages/data-provider && npm ci
       - run: cd packages/data-provider && npm run build
-      - run: cd packages/data-provider && npm publish
-        env:
-          NODE_AUTH_TOKEN: ${{secrets.NPM_TOKEN}}
+      - run: cd packages/data-provider && npm publish --provenance

.github/workflows/data-schemas.yml

@@ -13,26 +13,32 @@ on:
         required: false
         default: 'Manual publish requested'
 
+permissions:
+  id-token: write  # Required for OIDC trusted publishing
+  contents: read
+
 jobs:
   build-and-publish:
     runs-on: ubuntu-latest
+    environment: publish  # Must match npm trusted publisher config
     steps:
       - uses: actions/checkout@v4
 
       - name: Use Node.js
         uses: actions/setup-node@v4
         with:
           node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      
+      - name: Update npm for OIDC support
+        run: npm install -g npm@latest  # Must be 11.5.1+ for provenance
 
       - name: Install dependencies
         run: cd packages/data-schemas && npm ci
 
       - name: Build
         run: cd packages/data-schemas && npm run build
 
-      - name: Set up npm authentication
-        run: echo "//registry.npmjs.org/:_authToken=${{ secrets.PUBLISH_NPM_TOKEN }}" > ~/.npmrc
-        
       - name: Check version change
         id: check
         working-directory: packages/data-schemas
@@ -55,4 +61,4 @@ jobs:
       - name: Publish
         if: steps.check.outputs.skip != 'true'
         working-directory: packages/data-schemas
-        run: npm publish *.tgz --access public
+        run: npm publish *.tgz --access public --provenance

.github/workflows/dev-staging-images.yml

@@ -0,0 +1,66 @@
+name: Docker Dev Staging Images Build
+
+on:
+  workflow_dispatch:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        include:
+          - target: api-build
+            file: Dockerfile.multi
+            image_name: lc-dev-staging-api
+          - target: node
+            file: Dockerfile
+            image_name: lc-dev-staging
+
+    steps:
+      # Check out the repository
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Set up QEMU
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
+      # Set up Docker Buildx
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      # Log in to GitHub Container Registry
+      - name: Log in to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # Login to Docker Hub
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKERHUB_USERNAME }}
+          password: ${{ secrets.DOCKERHUB_TOKEN }}
+
+      # Prepare the environment
+      - name: Prepare environment
+        run: |
+          cp .env.example .env
+
+      # Build and push Docker images for each target
+      - name: Build and push Docker images
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: ${{ matrix.file }}
+          push: true
+          tags: |
+            ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}:${{ github.sha }}
+            ghcr.io/${{ github.repository_owner }}/${{ matrix.image_name }}:latest
+            ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:${{ github.sha }}
+            ${{ secrets.DOCKERHUB_USERNAME }}/${{ matrix.image_name }}:latest
+          platforms: linux/amd64,linux/arm64
+          target: ${{ matrix.target }}
+

.github/workflows/eslint-ci.yml

@@ -5,6 +5,7 @@ on:
     branches:
       - main
       - dev
+      - dev-staging
       - release/*
     paths:
       - 'api/**'
@@ -35,8 +36,6 @@ jobs:
 
       # Run ESLint on changed files within the api/ and client/ directories.
       - name: Run ESLint on changed files
-        env:
-          SARIF_ESLINT_IGNORE_SUPPRESSED: "true"
         run: |
           # Extract the base commit SHA from the pull_request event payload.
           BASE_SHA=$(jq --raw-output .pull_request.base.sha "$GITHUB_EVENT_PATH")
@@ -52,22 +51,10 @@ jobs:
           # Ensure there are files to lint before running ESLint
           if [[ -z "$CHANGED_FILES" ]]; then
             echo "No matching files changed. Skipping ESLint."
-            echo "UPLOAD_SARIF=false" >> $GITHUB_ENV
             exit 0
           fi
 
-          # Set variable to allow SARIF upload
-          echo "UPLOAD_SARIF=true" >> $GITHUB_ENV
-
           # Run ESLint
           npx eslint --no-error-on-unmatched-pattern \
             --config eslint.config.mjs \
-            --format @microsoft/eslint-formatter-sarif \
-            --output-file eslint-results.sarif $CHANGED_FILES || true
-
-      - name: Upload analysis results to GitHub
-        if: env.UPLOAD_SARIF == 'true'
-        uses: github/codeql-action/upload-sarif@v3
-        with:
-          sarif_file: eslint-results.sarif
-          wait-for-processing: true
+            $CHANGED_FILES

.github/workflows/frontend-review.yml

@@ -5,6 +5,7 @@ on:
     branches: 
       - main
       - dev
+      - dev-staging
       - release/*
     paths:
       - 'client/**'