Summary

I fixed a critical bug where CREATE, SHARE, and SHARE_PUBLIC permissions were being reset to defaults when using boolean configuration (e.g., agents: true or prompts: true), overwriting admin panel customizations on application restart.

• Implemented conditional logic to preserve existing CREATE, SHARE, and SHARE_PUBLIC permissions when not explicitly configured in librechat.yaml
• Aligned permission handling across all types (prompts, agents, mcpServers, remoteAgents) to ensure consistent granular control
• Added create field support to permission configuration schemas, allowing explicit control over CREATE permissions alongside USE
• Refactored helper functions to extract create, share, and public values from both boolean and object configurations
• Ensured boolean configs function as feature toggles (USE only), while object configs provide granular permission control
• Added three comprehensive regression tests validating boolean config preservation, explicit object config updates, and partial object config preservation
• Updated existing test assertions to reflect the new permission handling logic with detailed comments explaining behavior
• Fixed performance issue in ToolService.js by moving domainSeparatorRegex creation outside the loop to avoid redundant regex instantiation

The changes ensure that when agents: true is configured, only the USE permission is updated, treating it as a feature toggle. CREATE, SHARE, and SHARE_PUBLIC remain untouched in the database, preserving admin panel customizations. When agents: { create: false, share: true } is explicitly configured, only the specified permissions are updated, providing granular control over each permission type.

Change Type

• Bug fix (non-breaking change which fixes an issue)
• This change requires a documentation update

Testing

I verified the fix by writing and running three new regression tests that cover all permission configuration scenarios:

1. Boolean config with existing permissions: Validates that prompts: true and agents: true preserve existing CREATE/SHARE/SHARE_PUBLIC database values, only updating USE
2. Explicit object config: Validates that agents: { use: true, share: true, public: true } updates SHARE and SHARE_PUBLIC as expected
3. Partial object config: Validates that agents: { use: true, create: false } updates USE and CREATE while preserving existing SHARE/SHARE_PUBLIC values

All tests pass, confirming that admin panel permission changes are no longer overwritten on restart and that boolean configs function as intended feature toggles.

Test Configuration:

• Tested with mock database containing existing CREATE/SHARE/SHARE_PUBLIC permissions set to true
• Tested with boolean config: interface.agents: true (only USE updated)
• Tested with full object config: interface.agents: { use: true, share: true, public: true } (all specified permissions updated)
• Tested with partial object config: interface.agents: { use: true, create: false } (only USE and CREATE updated, SHARE/SHARE_PUBLIC preserved)
• Verified behavior on first-time setup (no existing permissions) defaults to schema values

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

Relevant updated docs: LibreChat-AI/librechat.ai#497