🚀 v0.8.9

content/docs/configuration/admin_panel.mdx

@@ -139,6 +139,8 @@ An override theme that fails the [theme rules](/docs/configuration/librechat_yam
 
 **YAML-only settings.** MCP servers with `type: stdio` or process fields (`command`, `args`, `env`, `cwd`, `stderr`) and `langfuse.headers` can only be set in `librechat.yaml`. The admin API rejects writes to them and overrides cannot replace or remove them. See [Langfuse: Authenticated Proxies and Gateways](/docs/configuration/langfuse#authenticated-proxies-and-gateways).
 
+**Deployment-owned settings.** Base, role, group, and user profiles cannot change `persistence`, `clientLimits`, `telemetry.rum`, `telemetry.stackTraceLimit`, `conversationList`, `passwordHashing`, `interface.colorModeFromUrl`, `fileConfig.skills.deletionCleanupConcurrency`, `endpoints.agents.managementApi`, `endpoints.agents.channels.slackApp`, or `mcpSettings.oauthFailureRetentionMs`. Configure them in deployment YAML. Inspect the admin configuration catalog and applied/skipped write report: saving a profile does not mean a deployment-only value became effective.
+
 **Section-scoped access.** Config capabilities can be broad (`read:configs`, `manage:configs`) or limited to one top-level section (`read:configs:<section>`, `manage:configs:<section>`). Creating, changing, or deleting the Base profile always needs broad `manage:configs`; section-scoped management applies to role, group, and user profiles. See [Admin capabilities](/docs/configuration/access_control#admin-capabilities).
 
 ## Admin API

content/docs/configuration/authentication/email.mdx

@@ -65,7 +65,7 @@ If you want to use a generic SMTP service or need advanced configuration for one
 />
 
 <Callout type="warning" title="Warning">
-If `ALLOW_PASSWORD_RESET=true` and neither Mailgun nor SMTP is configured, LibreChat shows the reset link directly on the page instead of emailing it, so anyone who knows a user's email address can reset that user's password. Configure email before enabling password reset. Email is also what sends verification links to new accounts; see [Authentication](/docs/configuration/authentication#email-verification-and-password-reset).
+Password reset requires working Mailgun or SMTP delivery in addition to `ALLOW_PASSWORD_RESET=true`. The page never displays the reset link. Missing accounts, missing email configuration, and delivery failures receive the same generic acknowledgment; a successful acknowledgment does not confirm that an email was sent. Email also sends verification links to new accounts; see [Authentication](/docs/configuration/authentication#email-verification-and-password-reset).
 </Callout>
 
 ## Setup with Mailgun

content/docs/configuration/authentication/index.mdx

@@ -44,7 +44,7 @@ When an [email service](/docs/configuration/authentication/email) is configured,
 <OptionTable
   options={[
     ['ALLOW_UNVERIFIED_EMAIL_LOGIN', 'boolean', 'Let users sign in before verifying their email. When false, unverified users cannot sign in, and accounts that are never verified are deleted after one week.','ALLOW_UNVERIFIED_EMAIL_LOGIN=true'],
-    ['ALLOW_PASSWORD_RESET', 'boolean', 'Show the Forgot Password? link and allow password resets. Reset links are valid for 15 minutes, and a successful reset ends all of the account\'s sessions. Without an email service the link is shown directly on the page to anyone who enters the address, so only enable this together with email.','ALLOW_PASSWORD_RESET=false'],
+    ['ALLOW_PASSWORD_RESET', 'boolean', 'Show the Forgot Password? link and allow password resets through configured email delivery. Links are valid for 15 minutes, and a successful reset ends the account\'s sessions. Reset credentials are never returned on the page.','ALLOW_PASSWORD_RESET=false'],
   ]}
 />
 

content/docs/configuration/dotenv.mdx

@@ -737,7 +737,7 @@ LibreChat can emit backend OpenTelemetry traces for general API, HTTP, MongoDB,
     [
       'OTEL_SERVICE_VERSION',
       'string',
-      'Service version reported to OpenTelemetry. Defaults to the package version when unset.',
+      'Service version reported to OpenTelemetry. Falls back to BUILD_COMMIT, then npm_package_version, when unset.',
       '# OTEL_SERVICE_VERSION=',
     ],
     [

content/docs/configuration/librechat_yaml/object_structure/config.mdx

@@ -1796,10 +1796,11 @@ see: [Transactions Object Structure](/docs/configuration/librechat_yaml/object_s
 
 ## telemetry
 
-Controls browser real user monitoring (RUM). This block rejects unknown keys.
+Controls error stack depth and browser real user monitoring (RUM). This block rejects unknown keys. These are deployment settings read from base YAML.
 
 <OptionTable
   options={[
+    ['stackTraceLimit', 'Integer', 'Error stack frames recorded by V8. Accepts 1 to 1000. Omitted, preserves Node\'s process default (normally 10, or the NODE_OPTIONS --stack-trace-limit value).', ''],
     ['rum.enabled', 'Boolean', 'Enables browser RUM. When omitted, the RUM_ENABLED environment variable decides.', ''],
     ['rum.sessionReplay.enabled', 'Boolean', 'Enables session replay. Only takes effect when RUM itself is enabled. Defaults to false.', ''],
   ]}
@@ -1884,10 +1885,11 @@ Time budgets, in milliseconds, for outbound calls made inside a request. Each ke
 <OptionTable
   options={[
     ['ragMs', 'Integer', 'RAG API queries for file search and message context.', '30000'],
+    ['directoryMs', 'Integer', 'Entire permission-directory verification phase, including token exchange and pagination.', '30000'],
     ['ocrMs', 'Integer', 'Each OCR provider call (upload, signed URL, OCR, delete).', '300000'],
     ['actionsMs', 'Integer', 'Each action (OpenAPI tool) HTTP call.', '300000'],
     ['moderationMs', 'Integer', 'The OpenAI moderation check that runs before a chat turn.', '10000'],
-    ['imageFetchMs', 'Integer', 'Fetching a stored image by URL to encode it for a provider.', '30000'],
+    ['imageFetchMs', 'Integer', 'Reading a stored image by URL or from blob storage to encode it for a provider.', '30000'],
     ['toolsMs', 'Integer', 'Each call a built-in tool makes to its API (weather, Wolfram, web search).', '60000'],
     ['speechMs', 'Integer', 'Each text-to-speech or speech-to-text provider request.', '300000'],
     ['imageGenerationMs', 'Integer', 'Each Stable Diffusion image generation request.', '300000'],
@@ -1932,8 +1934,9 @@ Upper bounds on independent lookups a request runs at once. Each key is optional
 
 <OptionTable
   options={[
+    ['permissionPrincipalLookups', 'Integer', 'Principal verification and provisioning during permission updates.', '4'],
     ['connectedAgentLoads', 'Integer', 'Connected agents initialized together per level while discovering a handoff graph.', '4'],
-    ['mcpCatalogLookups', 'Integer', 'MCP tool catalog reads when assembling an ephemeral or added agent.', '4'],
+    ['mcpCatalogLookups', 'Integer', 'MCP tool catalog reads when assembling an agent\'s tools.', '4'],
     ['skillNameLookups', 'Integer', 'Model spec skill name resolutions.', '8'],
     ['skillFileInspections', 'Integer', 'Bundled skill file inspections before a skill is primed.', '4'],
     ['resumeAgentLoads', 'Integer', 'Agent reads while building the resume snapshot of a paused run.', '4'],
@@ -1946,6 +1949,63 @@ concurrency:
   skillNameLookups: 8
 ```
 
+## persistence
+
+Selects storage for tool favorites only. MongoDB remains required for the rest of LibreChat. This is deployment-owned configuration; admin Base, role, group, and user profiles cannot change it.
+
+`favorites` accepts `mongo` (default) or `postgres`. The PostgreSQL implementation requires PostgreSQL 16 and a migrated, verified favorites database. It does not automatically fall back to MongoDB or synchronize writes between backends.
+
+```yaml filename="persistence"
+persistence:
+  favorites: mongo
+  postgres:
+    connectionStringEnv: LIBRECHAT_POSTGRES_DSN
+    max: 10
+    maxWaiting: 100
+    acquireTimeoutMs: 5000
+    queryTimeoutMs: 15000
+    idleTimeoutMs: 30000
+```
+
+Set the actual connection string in the named environment variable; `connectionStringEnv` accepts the variable's name, not a literal DSN. The example shows pool defaults. Pool size accepts 1 to 100; `maxWaiting` accepts 1 to 1000; acquisition timeout accepts 1 to 60000 ms; query and idle timeouts accept 1 to 300000 ms.
+
+Keep `favorites: mongo` during preparation. Stop all application, worker, and migration writers before importing or verifying a snapshot:
+
+```bash
+npm run postgres -- migrate
+npm run postgres -- import --offline --dry-run
+npm run postgres -- import --offline
+npm run postgres -- verify --offline
+```
+
+After successful migration, import, and verification, set `favorites: postgres` and restart the deployment consistently. Once activated, the importer rejects replay. Do not select a new empty database to bypass migration checks; the import command's `--verified-empty` option is only for an explicitly verified empty source.
+
+Before returning to MongoDB after PostgreSQL writes, stop every writer and reconcile the current PostgreSQL snapshot back to MongoDB:
+
+```bash
+npm run postgres -- reconcile-mongo --offline --dry-run
+npm run postgres -- reconcile-mongo --offline
+```
+
+Reconciliation replaces the MongoDB favorites collection, including deletions; back up both stores first. The command does not change storage selection. Select `mongo` and restart only after reconciliation succeeds.
+
+## spreadsheetParsing
+
+Bounds spreadsheet text extraction performed by the built-in parser. The parser runs in a separate process with a deadline and an admission limit; a timed-out or saturated parse fails instead of running without a limit.
+
+<OptionTable
+  options={[
+    ['timeoutMs', 'Integer', 'Maximum parse duration in milliseconds. Accepts 100 to 60000.', '5000'],
+    ['maxConcurrent', 'Integer', 'Maximum concurrent spreadsheet parses per API process. Accepts 1 to 8.', '2'],
+  ]}
+/>
+
+```yaml filename="spreadsheetParsing"
+spreadsheetParsing:
+  timeoutMs: 5000
+  maxConcurrent: 2
+```
+
 ## clientLimits
 
 Request deadlines for the browser client, in milliseconds, and upload concurrency. Every key is optional; omitting the block keeps the defaults. Raise a deadline when your infrastructure legitimately needs longer. Deadlines accept positive integers up to 3600000, and unknown keys are rejected.

content/docs/configuration/librechat_yaml/object_structure/file_config.mdx

@@ -362,7 +362,25 @@ fileConfig:
 
 ## stt
 
-`fileConfig.stt` is not read in current versions of LibreChat; an `stt` block here is ignored. Audio files added as text are transcribed when a speech-to-text provider is configured under [`speech.stt`](/docs/configuration/librechat_yaml/object_structure/speech), using a built-in list of audio types: MP3, MPEG, WAV, OGG, Vorbis, MP4 and M4A audio, FLAC, WebM, AAC, WMA, and Opus.
+`fileConfig.stt.supportedMimeTypes` controls which uploaded MIME types are routed to speech-to-text when added as text. A provider must also be configured under [`speech.stt`](/docs/configuration/librechat_yaml/object_structure/speech). This controls uploaded-file transcription, not microphone recording.
+
+Omitting the list keeps the built-in audio types: MP3, MPEG, WAV, OGG, Vorbis, MP4 and M4A audio, FLAC, WebM, AAC, WMA, and Opus. Setting a list replaces those patterns.
+
+```yaml filename="fileConfig / stt"
+fileConfig:
+  stt:
+    supportedMimeTypes:
+      - '^audio/(mpeg|wav|webm)$'
+```
+
+## deletionRetryLimit
+
+Maximum automatic retries when cleaning up a discarded upload. The default is `5`; set a positive integer. Retry counts survive tab reloads so a failing deletion does not retry indefinitely. This is separate from server-side retention and vector cleanup.
+
+```yaml filename="fileConfig / deletionRetryLimit"
+fileConfig:
+  deletionRetryLimit: 5
+```
 
 ## File Processing Priority
 

content/docs/configuration/librechat_yaml/object_structure/model_specs.mdx

@@ -453,6 +453,8 @@ This feature is particularly useful when you want to add descriptions to models
 
 Use this when a curated model spec should not let users turn on tools from the composer. It hides the **Tools**, **Skills** and **MCP Servers** sections of the [composer's **+** palette](/docs/features/composer#turn-on-tools-skills-and-mcp-servers) and their chips on the composer. File uploads stay available. The name is kept from the earlier badge row it used to hide.
 
+Visible model-spec tool flags normally provide defaults that explicit user toggles can override. With `hideBadgeRow: true` or `showInMenu: false`, capabilities explicitly configured by the spec stay authoritative. `skills: false` is always a hard opt-out, and MCP servers pinned by the spec that are not selectable from chat remain pinned.
+
 **Example:**
 
 ```yaml filename="modelSpecs / hideBadgeRow"
@@ -759,6 +761,26 @@ modelSpecs:
 
 ---
 
+### deferLoading
+
+Controls which equipped tools are exposed only after the model discovers them through Tool Search. Requires the deployment-level `deferred_tools` Agent capability. Omitted or `false` keeps existing loading behavior; `true` defers every eligible tool, and an array selects tool names or capability markers. Code execution, web search, file search, and memory can be deferred alongside MCP tools.
+
+```yaml filename="modelSpecs / deferLoading"
+modelSpecs:
+  list:
+    - name: 'research-assistant'
+      webSearch: true
+      executeCode: true
+      deferLoading: ['web_search', 'execute_code']
+      preset:
+        endpoint: 'openAI'
+        model: 'gpt-4o-mini'
+```
+
+Tool Search, Skill discovery, background polling, programmatic Bash orchestration, and Ask User stay loaded. This setting does not equip additional tools or bypass tool permissions. See [Deferred tools](/docs/features/agents#deferred-tools).
+
+---
+
 ### describeIntent
 
 <OptionTable

content/docs/configuration/logging.mdx

@@ -150,6 +150,10 @@ By default, the JSON string length is truncated to 255 characters. You can confi
 
 LibreChat can emit backend OpenTelemetry traces for server, database, Redis, and outbound HTTP visibility. Redis command-level spans are opt-in so default traces stay high-level. This is separate from Langfuse, which remains the recommended option for GenAI-specific prompt and model observability.
 
+Service-version precedence is `OTEL_SERVICE_VERSION`, then the image's `BUILD_COMMIT`, then `npm_package_version`. Logs and request spans include `librechat.config.digest`, a 12-character SHA-256 prefix identifying the parsed YAML; it changes after a successful config publication. Configure error stack depth with [`telemetry.stackTraceLimit`](/docs/configuration/librechat_yaml/object_structure/config#telemetry).
+
+With the existing `OTEL_LOGS_ENABLED` pipeline enabled, host-dispatched tools emit payload-free execution start and completion records. These include execution identity, mode, outcome, and elapsed time, but exclude arguments, results, artifacts, arbitrary metadata, and error text. Background completion reflects the actual invocation, not the initial task handle. SDK-owned orchestration and approval pauses are not reported as host tool invocations.
+
 <OptionTable
   options={[
     [

content/docs/configuration/pre_configured_ai/anthropic.mdx

@@ -19,6 +19,8 @@ ANTHROPIC_MODELS=claude-fable-5-1,claude-fable-5,claude-opus-5-5,claude-opus-5,c
 
 You can also set the list in `librechat.yaml` with `endpoints.anthropic.models`, an array of model IDs. A list configured there replaces `ANTHROPIC_MODELS`. It is read from the configuration resolved for each request, so a configuration override applied to a role or group can narrow it for those users.
 
+LibreChat includes `claude-fable-5-2` in its default catalog. It also recognizes `claude-mythos-5-2`, but Mythos requires provider verification and is deliberately absent from defaults; configure it only for an account with access. For these families, LibreChat uses adaptive thinking, requests summarized thinking by default, and omits unsupported sampling parameters. Explicit model lists still control which choices your users see.
+
 **Notes:**
 
 - Claude Opus 5.5 (`claude-opus-5-5`), Claude Sonnet 5.5 (`claude-sonnet-5-5`), and Claude Haiku 5.5 (`claude-haiku-5-5`) are part of LibreChat's default Anthropic model catalog. Haiku 5.5 is assigned a 1M-token context window.

content/docs/configuration/pre_configured_ai/openai.mdx

@@ -15,6 +15,8 @@ To get your OpenAI API key, you need to:
 OPENAI_API_KEY=user_provided
 ```
 
+**Restricted models:** `gpt-6-cyber` must be explicitly configured and requires provider-approved Daybreak access; LibreChat does not advertise it in universal model defaults or grant access to it. Native requests default to Responses, except an exact direct endpoint URL ending in `/chat/completions`; explicit transport settings and administrator drop policies still apply. LibreChat supplies the native access-program field and derives the safety identifier from the authenticated tenant and user. Custom gateways and OpenRouter retain their own request contract rather than automatically receiving native Cyber shaping.
+
 <Callout type="info" title="Where users enter their own key">
 
 With `user_provided`, you supply no key at all: each user enters their own from the chat UI. Open the endpoint menu, and next to **OpenAI** there is a gear icon labelled **Set API Key**. Clicking it opens a dialog with a field for the key and a dropdown for how long it should be kept: 30 minutes, 2 hours, 12 hours (the default), 1 day, 7 days, 30 days, or never expire.

content/docs/configuration/rag_api.mdx

@@ -11,7 +11,7 @@ The RAG API indexes user-uploaded files and retrieves relevant passages to augme
 </Callout>
 
 <Callout type="info" title="Do I need both MongoDB and PostgreSQL?">
-MongoDB is required: LibreChat stores users, conversations, messages, and settings in it. PostgreSQL is optional: only the RAG API uses it, to store document embeddings, and LibreChat itself never connects to it. The default Docker Compose files start both because they include the RAG API (and its `vectordb` service) out of the box. For a [local npm install](/docs/local/npm), you only need PostgreSQL if you set up the RAG API; without `RAG_API_URL`, LibreChat runs normally but file search uploads are unavailable.
+MongoDB is required: LibreChat stores users, conversations, messages, and settings in it. PostgreSQL is optional for the RAG API's document embeddings. Separately, LibreChat can use PostgreSQL 16 for [tool favorites](/docs/configuration/librechat_yaml/object_structure/config#persistence) when explicitly configured; that does not replace MongoDB. The default Docker Compose files start PostgreSQL because they include the RAG API and its `vectordb` service. A [local npm install](/docs/local/npm) needs PostgreSQL only for a feature configured to use it. Without `RAG_API_URL`, LibreChat runs normally but file search uploads are unavailable.
 </Callout>
 
 ## Availability

content/docs/configuration/tools/openai_image_gen.mdx

@@ -52,6 +52,8 @@ The image size an agent can request depends on the model: `auto`, `1024x1024`, `
 
 OpenAI retired `gpt-image-1` on October 23, 2026. If you set it in `IMAGE_GEN_OAI_MODEL`, remove it or switch to a current model.
 
+LibreChat also recognizes `gpt-image-2.6-sunburst` and `gpt-image-2.6-flare`. Select either explicitly with `IMAGE_GEN_OAI_MODEL`; adding support does not change the default from `gpt-image-2.5-flare`. The recognized 2.6 models expose `xhigh` and `max` quality options in addition to the baseline choices. Size may be `auto` or a positive `WIDTHxHEIGHT` value, with supported dimensions validated by the provider.
+
 ## Keeping large images
 
 LibreChat resizes saved images so the shorter side is at most 768 pixels, so a `3840x2160` result is stored at 1365x768. To keep the size the model returned, set [`fileConfig.imageGeneration`](/docs/configuration/librechat_yaml/object_structure/file_config#imagegeneration) to `percentage: 100`.