🏺 fix: Preserve Last Good Config on Reload

[lia-by-librechat]

Summary

A later read of librechat.yaml currently reuses the startup loader. If a cache invalidation lands while the local file is missing, a remote CONFIG_PATH is unavailable, or the YAML is invalid, the live process either replaces its config with defaults or exits.

This change separates startup and reload failure policy. Startup keeps its existing validation and exit behavior, while every later source, parse, validation, or enrichment failure preserves the last configuration that this process successfully served. Local files and remote HTTP(S) configuration sources follow the same safe reload path.

How it works

getAppConfig
  ensureBaseConfig
    startup: load + validate + cache
    reload:  single-flight load
      success -> replace the cached base config
      failure -> restore the last-good base and tool caches

The custom-config reader now lives in packages/api with injected local loading, path resolution, and redaction boundaries. The legacy /api module is only the CommonJS composition adapter.

Type of change

• Bug fix
• Tests / tooling / CI

Testing

Tested environments/configuration:

• Local and remote CONFIG_PATH loader paths
• Startup and post-invalidation reload modes

Automated tests:

• cd packages/api && ../../node_modules/.bin/jest src/app/service.spec.ts --coverage=false --runInBand
• cd api && ../node_modules/.bin/jest server/services/Config/loadCustomConfig.spec.js --coverage=false --runInBand
• cd packages/api && ../../node_modules/.bin/tsc --noEmit
• cd packages/api && ./node_modules/.bin/tsdown

Screenshots / recordings

No user-facing change.

Risk / compatibility

Startup behavior and admin override merge precedence are unchanged. The last-good snapshot is process-local, matching the existing APP_CONFIG cache, and this PR does not add cross-replica propagation.

Checklist

• I reviewed my own changes
• Relevant tests have been added or updated
• Existing relevant tests pass
• The change does not introduce new warnings or errors
• User-facing or complex behavior is documented where necessary
• Required dependency changes have been merged/published
• Required documentation PR: N/A

[lia-by-librechat]

Ready for review at 36fb24a6c9579672ab3f4a6c9dad43a839d67c2c. This head preserves the last good local or remote custom config on post-startup load failures and single-flights concurrent base reloads; startup validation behavior remains unchanged.

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-26T09:31:36.247902Z	36fb24a	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 36fb24a6c9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Defer committing the subagent cap until reload publication

When a reload file validates but a later stage rejects—for example, AppService, setCachedTools, or cache.set in loadAndCacheBaseConfig—this call has already replaced the process-global maximum and considers the loader successful, so the finally block does not restore it. The service then returns lastGoodBaseConfig, but agent and model-spec validators read getMaxSubagents() and enforce the rejected file's limit, potentially accepting more subagents than the preserved configuration permits or rejecting previously valid requests. Keep the cap provisional until the complete base configuration is published, or restore it from the service's failure path.

AGENTS.md reference: AGENTS.md:L80-L86

Useful? React with 👍 / 👎.

[lia-by-librechat]

Restored the previously committed maxSubagents cap when post-parse base publication fails in 5dfe289. Focused app service tests exercise the rollback; typecheck, build and static checks passed.

[chatgpt-codex-connector]

Keep empty OpenRouter endpoint values on the defaulting path

For an OpenRouter endpoint whose customParams.defaultParamsEndpoint is an empty string, this now returns true, whereas the previous truthiness check treated the value as absent and replaced it with openrouter. Because endpointSchema permits any string, such an existing configuration passes schema validation but now reaches parseCustomParams, is rejected as an invalid endpoint, and can terminate startup. Preserve the prior falsy-value behavior or make the schema reject and migrate this value explicitly.

AGENTS.md reference: AGENTS.md:L42-L46

Useful? React with 👍 / 👎.

[lia-by-librechat]

Preserved empty OpenRouter defaultParamsEndpoint fallback behavior in 5dfe289. The startup loader regression test covers the empty string case.

[lia-by-librechat]

Ready for Codex security review at 5dfe289ff8429660533c79c4ff35e5b78096a511. This revision restores the subagent cap when post-parse base publication fails and preserves empty OpenRouter endpoint defaulting. Focused tests, typecheck, build, and static checks pass.