Repository navigation
fix: backport specialist MCP reconnect recovery to v0.8.8 - #8
Conversation
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
@codex review commit c20d954. The earlier review has remained marked running since this morning; please retry it after the host interruption. The built image's two OAuth browser tests passed as UID/GID 1001:1001. Final performance and clean archive build checks are resuming; production is unchanged. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c20d954154
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0a66ca7ee2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review commit 0a66ca7. The latest two findings were audited and resolved with code/test evidence: aggregation/classification already lives in packages/api/src/agents/errors.ts, with CJS call-through only; the mock config assigns baseEnv into process.env before defining webServer, so PORT/config/runtime paths are populated. The documented image command passed both OAuth tests against the final image, and image Lighthouse successfully produced all three audits. Please inspect those complete paths when rechecking. Runtime code remains unchanged; no review-driven refactor is needed for these two findings. |
0a66ca7 to
bff53f4
Compare
|
@codex review commit bff53f4. Rebased onto the deployed security source e032f5b; security Docker/dependency changes are preserved, with SDK 4.0.1 unchanged. Focused checks passed: 166 frontend, 475 API/MCP/skill-sync, 145 ToolService and 11 SDK tests; API/client TypeScript and affected static checks. The only additional test behavior keeps Lighthouse headers in a temporary protected file instead of process arguments. Image acceptance/performance are still pending; no deployment. |
|
Codex Review: Didn't find any major issues. Hooray! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
When a parent has started streaming and a specialist then needs MCP authorization, its sign-in card can overwrite parent content or disappear. This v0.8.8 backport keeps one actionable sign-in prompt beside the parent, restores it after reload and resumes the same execution after authorization. Specialist startup failures distinguish incomplete authentication from unavailable tools using fixed messages, without exposing arbitrary provider errors.
The base is deployed security revision e032f5b (the same tree as image source ed295ac). Security updates, LC-005 and LC-006 are preserved. The older SSE handler separates synthetic OAuth rows from model indices and correlates flows/current responses. Host-owned typed failures select safe SDK messages. The committed agents SDK patch requires exactly 4.0.1 and every input/output hash; CJS, ESM, declarations and source are patched together. Dependency versions match the security baseline.
Validation at head bff53f4:
Local image: gridonic/librechat:v0.8.8-gridonic.bff53f4a6-mcp2; image ID sha256:8677b174ed3d8fdf0ad5a45de9e171a61ff5e7127bd85f7ade5f13ad9772ec9c. Node 24.22.1, npm 11.21.1, uv 0.13.4 and UV_SYSTEM_CERTS=true are verified.
Upstream references: LibreChat-AI#17300, LibreChat-AI#17302, LibreChat-AI/agents#632. This prepares a local candidate only; the production image selector is unchanged and nothing is deployed. Real-provider expiry/grant compatibility and paused-job survival across restarts are outside these synthetic checks.