fix(mcp): resolve {{LIBRECHAT_USER_ID}} in loadTools' MCP tool-loading path

.depcheckrc

@@ -0,0 +1,2 @@
+ignores:
+  - "dd-trace"

.env.example

@@ -65,6 +65,22 @@ CONSOLE_JSON=false
 DEBUG_LOGGING=true
 DEBUG_CONSOLE=false
 
+#==================#
+# Langfuse Tracing #
+#==================#
+
+# Enables Langfuse tracing for agent endpoints via OpenTelemetry.
+# All three keys below are required to enable tracing.
+# When enabled, traces include user ID and session (thread) tracking.
+
+# LANGFUSE_SECRET_KEY=sk-lf-...
+# LANGFUSE_PUBLIC_KEY=pk-lf-...
+# LANGFUSE_BASE_URL=https://cloud.langfuse.com
+
+# Optional: Sets the tracing environment label in Langfuse.
+# Defaults to NODE_ENV, then 'development' if NODE_ENV is not set.
+# LANGFUSE_TRACING_ENVIRONMENT=production
+
 #=============#
 # Permissions #
 #=============#
@@ -844,3 +860,10 @@ OPENWEATHER_API_KEY=
 # Skip code challenge method validation (e.g., for AWS Cognito that supports S256 but doesn't advertise it)
 # When set to true, forces S256 code challenge even if not advertised in .well-known/openid-configuration
 # MCP_SKIP_CODE_CHALLENGE_CHECK=false
+
+#======================================#
+# Product Feedback                     #
+#======================================#
+
+# Enable the product feedback feature (thumbs-down stores feedback in MongoDB for review)
+# PRODUCT_FEEDBACK_ENABLED=true

.github/workflows/cbio-build.yml

@@ -0,0 +1,53 @@
+name: Build and Push cBioPortal LibreChat Image
+
+on:
+  push:
+    branches:
+      - '**'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Image tag (e.g. v0.8.3-rc1-custom-v6). Defaults to branch name.'
+        type: string
+        required: false
+
+jobs:
+  build:
+    runs-on: ubuntu-24.04-arm
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Set image tag
+        id: tag
+        run: |
+          if [ -n "${{ github.event.inputs.tag }}" ]; then
+            echo "tag=${{ github.event.inputs.tag }}" >> "$GITHUB_OUTPUT"
+          else
+            # Use branch name, replacing / with -
+            BRANCH="${GITHUB_REF_NAME//\//-}"
+            echo "tag=${BRANCH}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Login to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_USERNAME }}
+          password: ${{ secrets.DOCKER_PASSWORD }}
+
+      - name: Prepare environment
+        run: cp .env.example .env
+
+      - name: Build and push
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: Dockerfile
+          push: true
+          tags: cbioportal/librechat:${{ steps.tag.outputs.tag }}
+          platforms: linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

.github/workflows/unused-packages.yml

@@ -209,6 +209,9 @@ jobs:
             UNUSED=$(depcheck --json | jq -r '.dependencies | join("\n")' || echo "")
             # Exclude dependencies used in scripts, code, and workspace packages
             UNUSED=$(comm -23 <(echo "$UNUSED" | sort) <(cat root_used_deps.txt root_used_code.txt root_workspace_deps.txt | sort) || echo "")
+            # dd-trace is loaded via NODE_OPTIONS=--require dd-trace/init at
+            # runtime — depcheck can't see that.
+            UNUSED=$(echo "$UNUSED" | grep -v "^dd-trace$" || echo "")
             echo "ROOT_UNUSED<<EOF" >> $GITHUB_ENV
             echo "$UNUSED" >> $GITHUB_ENV
             echo "EOF" >> $GITHUB_ENV

Dockerfile.multi

@@ -81,6 +81,10 @@ COPY --from=data-provider-build /app/packages/data-provider/dist ./packages/data
 COPY --from=data-schemas-build /app/packages/data-schemas/dist ./packages/data-schemas/dist
 COPY --from=api-package-build /app/packages/api/dist ./packages/api/dist
 COPY --from=client-build /app/client/dist ./client/dist
+# Create runtime directories with correct permissions
+RUN mkdir -p /app/api/logs /app/uploads /app/client/public/images && \
+    chown -R node:node /app
+USER node
 WORKDIR /app/api
 EXPOSE 3080
 ENV HOST=0.0.0.0

api/app/clients/BaseClient.js

@@ -334,7 +334,7 @@ class BaseClient {
   }
 
   async handleTokenCountMap(tokenCountMap) {
-    if (this.clientName === EModelEndpoint.agents) {
+    if (this.clientName === EModelEndpoint.agents && !this.shouldSummarize) {
       return;
     }
     if (this.currentMessages.length === 0) {
@@ -506,7 +506,7 @@ class BaseClient {
       shouldSummarize &&
       diff === 1 &&
       firstMessage?.summary &&
-      this.previous_summary.messageId === firstMessage.messageId;
+      this.previous_summary?.messageId === firstMessage.messageId;
 
     if (diff > 0) {
       payload = formattedMessages.slice(diff);
@@ -537,16 +537,36 @@ class BaseClient {
     }
 
     if (usePrevSummary) {
-      summaryMessage = { role: 'system', content: firstMessage.summary };
+      const summaryRole = this.clientName === EModelEndpoint.agents ? 'user' : 'system';
+      const summaryContent = this.clientName === EModelEndpoint.agents
+        ? `[Previous conversation summary]\n${firstMessage.summary}`
+        : firstMessage.summary;
+      summaryMessage = { role: summaryRole, content: summaryContent };
       summaryTokenCount = firstMessage.summaryTokenCount;
-      payload.unshift(summaryMessage);
+      if (this.clientName === EModelEndpoint.agents) {
+        payload.unshift(
+          summaryMessage,
+          { role: 'assistant', content: 'Understood, I have the context from our previous conversation.' },
+        );
+      } else {
+        payload.unshift(summaryMessage);
+      }
       remainingContextTokens -= summaryTokenCount;
     } else if (shouldSummarize && messagesToRefine.length > 0) {
       ({ summaryMessage, summaryTokenCount } = await this.summarizeMessages({
         messagesToRefine,
         remainingContextTokens,
       }));
-      summaryMessage && payload.unshift(summaryMessage);
+      if (summaryMessage) {
+        if (this.clientName === EModelEndpoint.agents) {
+          payload.unshift(
+            summaryMessage,
+            { role: 'assistant', content: 'Understood, I have the context from our previous conversation.' },
+          );
+        } else {
+          payload.unshift(summaryMessage);
+        }
+      }
       remainingContextTokens -= summaryTokenCount;
     }
 

api/app/clients/tools/util/handleTools.js

@@ -410,7 +410,7 @@ const loadTools = async ({
   /** MCP server tools are initialized sequentially by server */
   let index = -1;
   const failedMCPServers = new Set();
-  const safeUser = createSafeUser(options.req?.user);
+  const safeUser = createSafeUser(options.req?.user, user);
   for (const [serverName, toolConfigs] of Object.entries(requestedMCPTools)) {
     index++;
     /** @type {LCAvailableTools} */

api/app/clients/tools/util/handleTools.test.js

@@ -28,11 +28,25 @@ jest.mock('~/server/services/Config', () => ({
       },
     },
   }),
+  getMCPServerTools: jest.fn(),
+}));
+
+jest.mock('~/config', () => ({
+  ...jest.requireActual('~/config'),
+  getMCPServersRegistry: jest.fn(),
+}));
+
+jest.mock('~/server/services/MCP', () => ({
+  ...jest.requireActual('~/server/services/MCP'),
+  createMCPTools: jest.fn(),
 }));
 
 const { Calculator } = require('@librechat/agents');
+const { Constants } = require('librechat-data-provider');
 
 const { User } = require('~/db/models');
+const { getMCPServersRegistry } = require('~/config');
+const { createMCPTools } = require('~/server/services/MCP');
 const PluginService = require('~/server/services/PluginService');
 const { validateTools, loadTools, loadToolWithAuth } = require('./handleTools');
 const { StructuredSD, availableTools, DALLE3 } = require('../');
@@ -283,4 +297,54 @@ describe('Tool Handlers', () => {
       delete process.env.SD_WEBUI_URL;
     });
   });
+
+  describe('loadTools MCP user id propagation', () => {
+    // Regression guard: MCP tool-call requests shipped the literal "{{LIBRECHAT_USER_ID}}"
+    // placeholder in x-user-id headers because `loadTools` built the MCP `user` object from
+    // `options.req?.user` alone. When `req.user` is a plain object deserialized from the
+    // passport session (no `id` virtual, no `_id`), that object resolves to no usable id even
+    // though `loadTools` is already given the caller's resolved id via its own `user` param
+    // (see ToolService.js: `loadTools({ user: req.user.id, ... })`). Assert that id makes it
+    // into the object handed to `createMCPTools`.
+    const mcpServerName = 'test-mcp-server';
+    const mcpAllToolName = `${Constants.mcp_all}${Constants.mcp_delimiter}${mcpServerName}`;
+
+    beforeEach(() => {
+      getMCPServersRegistry.mockReturnValue({
+        getServerConfig: jest.fn().mockResolvedValue({ startup: true }),
+      });
+      createMCPTools.mockResolvedValue([]);
+    });
+
+    it('falls back to the loadTools `user` param when req.user has neither id nor _id', async () => {
+      const userId = fakeUser._id.toString();
+      const sessionUser = { email: 'fakeuser@example.com', provider: 'local' };
+
+      await loadTools({
+        user: userId,
+        tools: [mcpAllToolName],
+        options: { req: { user: sessionUser } },
+      });
+
+      expect(createMCPTools).toHaveBeenCalledWith(
+        expect.objectContaining({
+          user: expect.objectContaining({ id: userId }),
+        }),
+      );
+    });
+
+    it('prefers a resolvable req.user id over the loadTools `user` param', async () => {
+      await loadTools({
+        user: fakeUser._id.toString(),
+        tools: [mcpAllToolName],
+        options: { req: { user: { id: 'explicit-req-user-id' } } },
+      });
+
+      expect(createMCPTools).toHaveBeenCalledWith(
+        expect.objectContaining({
+          user: expect.objectContaining({ id: 'explicit-req-user-id' }),
+        }),
+      );
+    });
+  });
 });

api/models/Agent.js

@@ -717,6 +717,7 @@ const getListAgentsByAccess = async ({
     category: 1,
     support_contact: 1,
     is_promoted: 1,
+    conversation_starters: 1,
   }).sort({ updatedAt: -1, _id: 1 });
 
   // Only apply limit if pagination is requested