merge: integrate main (storage_session_id contract alignment) into feat/agent-skills-runtime

[djuillard]

Summary

Brings the freshly-synced main (post PR #6) into our long-lived feature branch feat/agent-skills-runtime. The merge direction is main → feat-branch, not the other way around — feat/agent-skills-runtime is the production branch (built into code-interpreter:agent-skills) and continues to live independently.

Closes the contract divergence with LibreChat dev (post-2026-05-12) reported in our 422 incident earlier today (see SECURITY-OPERATIONS.md §8.5 to be updated post-merge).

What's coming in (4 upstream commits via PR #6)

• 170194f Merge PR fix: Align API contract with LibreChat client (storage_session_id, kind, resource fields) usnavy13/LibreCodeInterpreter#109 — fix-contract-gaps (the bulk of the storage_session_id refactor)
• 7567f3e feat: Enhance file upload and listing with resource kind and version support
• 16bb6b6 refactor: Rename session_id to storage_session_id across API and models
• c34a123 Merge PR fix: Align API contract with LibreChat client (storage_session_id, kind, resource fields) usnavy13/LibreCodeInterpreter#110 — promotes dev to main (505 unit + 239 integration + 86 functional tests passing per the upstream PR)

Conflict resolution

None. git merge origin/main ran clean. feat/agent-skills-runtime hadn't touched src/api/files.py, src/models/exec.py, or tests/integration/test_librechat_compat.py since the previous merge (PR #5 on 2026-05-08) — so the 22 files / +259 / -101 from PR #6 land here as a pure merge with no manual resolution.

Stats

• 22 files changed, +259 insertions, -101 deletions
• Merge commit: 6877fde

Context — superseded local WIP

We had started writing our own compat patch on fix/librechat-dev-2026-05-12-compat (4 commits, 13 integration tests) earlier today before realizing upstream PR usnavy13#110 had been merged 30 min before our commits were ready, covering the same ground with a wider scope (PTCFileInput, FileRef, GET /files query params on top of what we'd planned). That local branch is now abandoned in favour of this sync. The wider upstream patch is in this merge.

Test plan

The merged code requires a rebuild of code-interpreter:agent-skills to take effect. After rebuild:

• code-interpreter-api starts cleanly, logs show Sandbox network access ENABLED and /opt/skill-deps created
• Python DOCX/PPTX/XLSX skills still work (soffice invocation from Python sandbox — guard from our feat-branch /proc + bind syscall config)
• Bash sandbox can also invoke soffice (LibreChat bash_tool compat)
• Functional end-to-end: upload a file via LibreChat UI in a code-interpreter agent chat at https://chat-dev.onbehalf.ai — should no longer return the 422 we hit this morning
• Optional: pytest tests/integration/test_librechat_compat.py (with -e API_KEY=test-api-key-for-testing-12345 env override) passes

Follow-up

Once merged, rebuild + restart code-interpreter-api and validate via the LibreChat UI. Then update SECURITY-OPERATIONS.md §8.5 with today's incident timeline + resolution.

🤖 Generated with Claude Code
via Happy