📦 chore: npm audit & bump @librechat/agents to v3.1.67

[danny-avila]

v3.1.67

🔍 Fix: Deferred tools no longer inflate instruction token accounting

PR: #105 | Ref: LibreChat#12702

Deferred tool definitions (tools registered for tool_search with defer_loading: true) were counted in both toolSchemaTokens and getTokenBudgetBreakdown().toolCount even though they are never bound to the model until discovered at runtime. For large MCP registries (e.g. 292 tools), this inflated the reported instruction overhead enough to trigger spurious context-overflow errors.

A new getActiveToolDefinitions() private helper now filters out defer_loading === true entries that have not yet appeared in discoveredToolNames. Both calculateInstructionTokens() and getTokenBudgetBreakdown() route through it, matching the existing bind-time filter in getEventDrivenToolsForBinding().

Before: All registered tool definitions, including hundreds of deferred ones, were counted in the token budget. Agents with large tool catalogs could fail to invoke with "context overflow" before sending a single message.

After: Only active (non-deferred or already-discovered) tools consume token budget. toolCount updates live after markToolsAsDiscovered(), while toolSchemaTokens remains a snapshot from the last calculateInstructionTokens() call. A regression test pins this snapshot semantic.

---

🧠 Fix: Widen AnthropicClientOptions['thinking'] for Claude Opus 4.7 adaptive display

PR: #106

Claude Opus 4.7 omits reasoning content by default unless the caller opts in via thinking.display = 'summarized'. Downstream consumers (e.g. LibreChat's Anthropic helpers) previously had to use unsafe casts to pass { type: 'adaptive', display: 'summarized' } because the ThinkingConfig type only accepted the upstream AnthropicInput['thinking'] shape.

A new ThinkingConfigAdaptive variant is added ({ type: 'adaptive'; display?: 'summarized' | 'omitted' }), and AnthropicClientOptions now overrides the thinking property via Omit<AnthropicInput, 'thinking'> so it accepts either the standard config or the adaptive variant without casting.

Before: Passing display: 'summarized' required as unknown as ... casts.
After: The type accepts the adaptive display field natively.

---

📦 Chore: npm audit fix

Patch-level dependency updates in package-lock.json to resolve npm audit advisories. No functional changes.

---

Full Changelog: LibreChat-AI/agents@v3.1.65...v3.1.67

[Copilot]

Pull request overview

Dependency maintenance PR to address npm audit findings and update @librechat/agents, along with related resolution/lockfile updates in this monorepo.

Changes:

• Bump dompurify to ^3.4.0 across client packages and enforce it for monaco-editor via root overrides.
• Bump @librechat/agents to ^3.1.67 in both API workspace package manifests.
• Update root overrides for fast-xml-parser (and update the root lockfile to reflect the new resolved dependency graph).

Reviewed changes

Copilot reviewed 5 out of 6 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
packages/client/package.json	Bumps dompurify dependency.
client/package.json	Bumps dompurify dependency.
packages/api/package.json	Bumps @librechat/agents version.
api/package.json	Bumps @librechat/agents version.
package.json	Updates overrides (notably fast-xml-parser and monaco-editor → dompurify).
package-lock.json	Updates resolved dependency tree for the audit/bumps (agents, dompurify, opentelemetry, protobufjs, etc.).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

GitNexus: 🚀 deployed

The LibreChat-pr-12710 index is now live on the MCP server.
Deploy run