🏞️ Highlights
- 📜 Agent Skills
- Agent Skills let you package reusable agent behavior into
SKILL.mdbundles: instructions, reference files, scripts, assets, and tool permissions can travel together as a capability an agent can invoke automatically, on request, or always-on. - Skills can be imported, size-limited, shared like agents and MCP servers, and scoped per agent, making it easier to build repeatable workflows without baking every instruction into the agent prompt.
- Agent Skills let you package reusable agent behavior into
- 👥 Subagents
- Subagents let agents call other agents as tools, so a primary agent can delegate specialized work, run independent passes in parallel, or even call a configured copy of itself for fan-out style problem solving.
- Subagent runs preserve the surrounding upload, user, and MCP context while enforcing recursion and graph limits, which keeps multi-agent execution powerful without making it unbounded.
- 🖥️ Code Execution & Artifacts (pending OSS Code Interpreter release)
- Text, source-code, DOCX, CSV, XLSX, and PPTX artifacts can render inline or in the side panel with richer previews.
- Nested artifact paths, Unicode filenames, file metadata encoding, and generated-code context filtering received several hardening passes.
- ☁️ CloudFront + S3 File Delivery
- New CloudFront file strategy support includes signed cookies, signed downloads, strict signed-access enforcement, region-aware storage keys, and cookie refresh on auth refresh.
- 🔒 Security, Auth, and MCP Hardening
- Improved security for MCP OAuth, OpenID/OIDC, artifact routing, permission caching, avatar fetching, and HTML rendering
- 🔍 Providers, Search, and Model Support
- Tavily search/scraping, OpenRouter prompt-cache configuration, Vertex AI multi-region endpoints, Anthropic tool-argument streaming, and GPT-5.5 token definitions are now supported.
Click to expand Release Notes
What's Changed
✨ Features
- feat: agent skills by @danny-avila in #12625
- 📄 Auto-render Text-Based Code Execution Artifacts Inline by @danny-avila in #12829
- 🪢 Enable Tool-Output References for Bash Tool by @danny-avila in #12830
- 🪟 Render Code-Execution Text Artifacts as Side-Panel Artifacts by @danny-avila in #12832
- 🪟 Render Source-Code Artifacts in the Side Panel by @danny-avila in #12854
- 🚫 Add Support for
noneReranker Type in Web Search Config by @dlew in #12765 - 💭 Require Explicit Auto-agent Enablement for Memories by @danny-avila in #12886
- 🪟 Add allowedAddresses Exemption List For SSRF-Guarded Targets by @danny-avila in #12933
- 🔍 Add Tavily as Search and Scraper Provider by @yashwanth-alapati in #12581
- 🔐 OIDC Bearer Token Authentication for Remote Agent API by @SpectralOne in #12450
- 📄 Rich File Artifact Previews for DOCX, CSV, XLSX, PPTX by @danny-avila in #12934
- 🌩️ CloudFront CDN File Strategy by @AtefBellaaj in #12193
- 🧵 Enable Anthropic Tool Argument Streaming by @danny-avila in #12962
- 🚀 Decouple File Attachment Persistence from Preview Rendering by @danny-avila in #12957
- 🧮 Add GPT-5.5 Token Definitions by @danny-avila in #12973
- 🧭 Add Message Navigation Strip & Redesign Scroll-to-Bottom by @berry-13 in #12657
- 🔐 Add Signed CloudFront File Downloads by @danny-avila in #12970
- 🌥️ Add Optional Region-aware S3/CloudFront Storage Keys by @danny-avila in #12987
- 🔄 Cross-Origin Admin OAuth Refresh by @dustinhealy in #13007
- 🧭 Add OpenRouter Prompt Cache Setting by @danny-avila in #13029
- 🔐 Mint Code API Auth Tokens by @danny-avila in #13028
- 🌐 Support Vertex AI Multi-Region Endpoints by @danny-avila in #13044
- 📦 Configure Skill Import Size Limit by @danny-avila in #13073
- 🎭 Support OpenID Audience On Refresh Grants by @danny-avila in #13077
- 🌩️ Strict CloudFront signed cookie enforcement via
requireSignedAccessby @upman in #13078
🐛 Fixes
- 🗨️ Restore ModelSpec Preset Greeting (and iconURL Fallback) by @danny-avila in #12809
- 🛡️ Prevent silent crash from unhandled MCP OAuth reconnect rejections by @danny-avila in #12812
- 🌱 Inject Code-Tool Files Into Graph Sessions on First Call (+ read_file Sandbox Fallback) by @danny-avila in #12831
- 🚫 Reject Binary Files in read_file Sandbox Fallback (No More Mojibake) by @danny-avila in #12851
- 🔧 Replace Literal NUL Bytes in handlers.spec Test Fixture + Normalize CRLF by @danny-avila in #12852
- 📂 Preserve Nested Folder Paths for Code-Execution Artifacts by @danny-avila in #12848
- 🛂 Skip Inherited / Mark Skill Files Read-Only in Code-Env Pipeline by @danny-avila in #12866
- 💎 Stop Double-Counting Cache Tokens for Gemini/OpenAI in Usage Spend by @danny-avila in #12868
- 🛡️ Filter
user_providedSentinel in Tool Credential Loading by @Falenos in #12840 - 🧹 Graceful MCP OAuth Revoke Cleanup When Tokens Are Missing by @gaurav0107 in #12825
- 🔌 Prevent Repeated Idle Check Triggers for Users With Failed MCP Connections by @darthhexx in #12853
- 🧜♂️ Preserve Mermaid
foreignObjectHTML in Sanitized SVG by @ethanlaj in #12819 - 🩹 Treat
responseCode === 0as Transport Failure, Not Server Error by @derhelge in #12834 - 📂 Preserve Nested Skill Paths in Code-Env Uploads by @danny-avila in #12877
- 🩹 Polish code-execution attachment UX by @danny-avila in #12870
- 🔌 Follow 307/308 redirects in MCP streamable HTTP transport by @ontl in #12850
- 📥 Resolve Imported-Conversation Default Model From Runtime modelsConfig by @danny-avila in #12885
- 🩹 Sync ControlCombobox popover width with trigger after layout changes by @ethanlaj in #12887
- 🛡️ Handle MCP Tool Cache Lookup Failures by @danny-avila in #12910
- 📌 Stabilize Agent Prompt Cache Prefix by @danny-avila in #12907
- 🧭 Migrate Anthropic Long Context by @danny-avila in #12911
- 🧹 Clear MCP OAuth Tokens On Revoke by @danny-avila in #12913
- 🛡️ Harden GitNexus Index Workflow by @danny-avila in #12935
- 🧷 Pin GitNexus Native Dependency by @danny-avila in #12937
- 🛡️ Harden MCP Redirect SSRF Checks by @danny-avila in #12931
- 🧯 Harden Code Env Filepath Uploads by @danny-avila in #12936
- 🔐 Avoid Logging Password On Login Validation Error by @danny-avila in #12926
- 🪪 Validate Avatar URL Before Fetch by @danny-avila in #12928
- 🚦 Make URL Auto-Submit Configurable by @danny-avila in #12929
- 🧼 Sanitize HTML In Admin Banner And MCP Config Dialog by @danny-avila in #12927
- 🐛 Propagate User Identity to Subagent MCP Tool Calls by @danny-avila in #12950
- 🔐 Forward per-file entity_id through code-env priming by @danny-avila in #12958
- 🧬 Subagent MCP requestBody Propagation (bump
@librechat/agents to 3.1.78+ cleanup) by @danny-avila in #12959 - 🛰️ Honor Anthropic Vertex Configuration by @danny-avila in #12972
- 🌐 Preserve Unicode Filenames by @danny-avila in #12977
- ⏳ Preserve Temporary Chat Retention Config by @danny-avila in #12985
- 🛂 Harden Agent File Preview Access by @danny-avila in #12981
- 🌐 Percent-encode X-File-Metadata header for Unicode filenames by @usnavy13 in #12983
- ⏱️ Align Auto-Refill Next Date by @danny-avila in #12980
- 🧭 Navigate Signed CDN Downloads by @danny-avila in #12998
- 🪪 Preserve OIDC Logout ID Token Hint by @danny-avila in #12999
- 🧭 Preserve Resend Files for Subagents by @danny-avila in #13030
- 🛟 Persist Vertex Gemini 3 thoughtSignatures across DB round-trips by @danny-avila in #13026
- 🛟 Summarization Provider misses
vertexai+ case-mismatched custom endpoints by @danny-avila in #13025 - 🗂️ Remove Generated Code Files From Prompt Context by @danny-avila in #13037
- 🛟 Allow Empty
modelSpecs.listto Unstick Admin-Panel Saves by @dustinhealy in #13036 - 📜 Scope Read File Prompt For Code Agents by @danny-avila in #13040
- 🦘 Skip OpenAI Model Fetch For User-Provided Keys by @danny-avila in #13038
- ☁️ Enable Azure Agent Provider Uploads by @danny-avila in #13045
- 🛡️ Gate Bash PTC Capabilities by @danny-avila in #13053
- 🛰️ Validate Vertex Endpoint Overrides by @danny-avila in #13054
- 🛂 Restrict OpenID JWT Bearer Reuse by @danny-avila in #13052
- 🧯 Bound Permission Superset Cache Inputs by @danny-avila in #13065
- 🧮 Count Rejected Skill Import Bytes by @danny-avila in #13063
- 🧬 Bound Subagent Expansion by @danny-avila in #13064
- 🗝️ Enforce Skill Share Role Permission by @danny-avila in #13062
- 🪙 Pass appConfig to getBalanceConfig in set-balance script by @Odrec in #13070
- 🛡️ Harden Artifact Routing Lookups by @danny-avila in #13069
- 🧵 Preserve Upload Context Across Multipart Routes by @danny-avila in #13072
- 🍪 Refresh CloudFront Cookies On Auth Refresh by @danny-avila in #13083
- 🛡️ Harden OpenID Session Token Reuse by @danny-avila in #13086
🔧 Refactoring
- 🧬 Align LibreChat With Agents LangChain Upgrade by @danny-avila in #12922
- 🛂 Avoid Default Tavily Safe Search by @danny-avila in #12939
- 🛡️ Restrict User Tavily Endpoint URLs by @danny-avila in #12946
- ⚡ Bound Concurrent Office-HTML Rendering for Code Artifacts by @danny-avila in #12951
- 🗃️ Keep Code Artifacts Manual-Open by @danny-avila in #12961
- ⌨️ Clarify Bash Command Drafting State by @danny-avila in #12963
- 🪟 Improve Subagent Dialog Prompt Rendering by @danny-avila in #12982
- 🛡️ Scope
allowedAddressesBy Port by @danny-avila in #13022 - 🧰 Use Bash PTC for Agent Tools by @danny-avila in #13042
- 🧬 Align OpenRouter Reasoning Payloads by @danny-avila in #13039
- 🪪 Require Remote OIDC Audience by @danny-avila in #13066
- 🏷️ Rename Code Interpreter Labels To Run Code by @danny-avila in #13071
- 🍪 Refresh CloudFront Media Cookies by @danny-avila in #13091
🖥️ UI & Styling
- 🖥️ Render Bash PTC Calls With Bash UI by @danny-avila in #13046
📦 Dependencies, Chores & CI
- 📦 Update TypeScript Config for TS v7 by @danny-avila in #12794
- 🛡️ Bump
@xmldom/xmldomto 0.8.13 via Root Override by @danny-avila in #12795 - 📦 Update
@librechat/agentsto v3.1.74 by @danny-avila in #12869 - 📦 npm audit fixes and Mongoose 8.23 TypeScript follow-ups by @danny-avila in #12996
- 📦 Update
@librechat/agentsto v3.1.79 by @danny-avila in #13000 - ⛴️ Use Bitnami Legacy MongoDB Image in Helm Chart by @vdittgen in #13032
- 📦 Bump
@babel/preset-envto v7.29.5 by @danny-avila in #13034 - 🛡️ Harden Docker Dev Image Builds by @danny-avila in #13041
- 📜 Improve Skill Handling Logs by @danny-avila in #13057
- 🪵 Log Subagent Limit Hits by @danny-avila in #13068
- 📦 Bump
@librechat/agentsto v3.1.85 andmermaidto v11.15.0 by @danny-avila in #13079 - 🐳 Build Docker Client Package With Data Provider Dist by @danny-avila in #13097
- 📦 Bump
@librechat/agentsto v3.1.86, npm audit, build fix by @danny-avila in #13105 - ✨ v0.8.6-rc1 by @danny-avila in #13094
📚 Documentation
- 📚 Add Skills, Subagents, and CloudFront References by @danny-avila in #13096
🌍 Internationalization
- 🌍 i18n: Update translation.json with latest translations by @github-actions[bot] in #12916, #12964, #13058, #13080
New Contributors
- @Falenos made their first contribution in #12840
- @gaurav0107 made their first contribution in #12825
- @ontl made their first contribution in #12850
- @yashwanth-alapati made their first contribution in #12581
- @vdittgen made their first contribution in #13032
Full Changelog: v0.8.5...v0.8.6-rc1