Repository navigation
Conversation
…cleanup, upload concurrency)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9fbec6d34a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const REFRESH_TOKEN_TIMEOUT_MS = 30_000; | ||
|
|
||
| const refreshToken = (retry?: boolean): Promise<t.TRefreshTokenResponse | undefined> => | ||
| _post(endpoints.refreshToken(retry)); | ||
| _post(endpoints.refreshToken(retry), undefined, { timeout: REFRESH_TOKEN_TIMEOUT_MS }); |
There was a problem hiding this comment.
For deployments where token refresh legitimately takes more than 30 seconds, this unconditional deadline now triggers auth recovery failure and redirects users to login, with no operator override. The new TTS, SharePoint, and CloudFront deadlines likewise impose fixed limits without configuration fields. AGENTS.md explicitly requires newly introduced timeouts and limits to be configurable through configSchema and librechat.yaml; explaining why a timeout is needed does not explain why its duration must be fixed. Add configuration fields and pass the resolved budgets to these clients so operators can accommodate their infrastructure without rebuilding.
AGENTS.md reference: AGENTS.md:L91-L93
Useful? React with 👍 / 👎.
Summary
Fixes the client hygiene findings from the 2026-10-19 Devin performance scan. The token refresh request had no timeout, and every API call waits on that shared promise, so one hung refresh froze the app until reload; it now times out after 30 seconds and falls into the existing redirect-to-login path. The TTS stream fetch, SharePoint downloads and the CloudFront cookie refresh get abort timeouts for the same reason.
Smaller fixes: lodash is imported per function in
AuthContext,utils/conversation,useChatFunctions,ask/turnandopenidRoleSyncinstead of pulling the whole library into the entry chunk; the Lia mascot reads the caret position at most once per animation frame;useWakeLockreleases a lock that resolves after the effect was cleaned up; the SharePoint picker removes its window and port listeners on unmount; title-generation module state is cleared on logout; and multi-file project uploads run three at a time instead of one by one, keeping per-file error reporting.Type of change
Testing
Tested environments/configuration: jsdom unit tests.
Automated tests:
clientjest oversrc/data-provider,src/hooks,src/components/Projects,src/components/Lia,src/components/Chat/Input,src/utils: pass. Added tests forclearTitleGenerationStateand its logout call; the Projects spec now expects overlapping uploads.packages/clientcloudfront (8/8) andpackages/data-providerrequest (39/39): pass.tsc --noEmitinclient,packages/data-providerandpackages/clientclean.Screenshots / recordings
No user-facing change.
Risk / compatibility
A refresh slower than 30 seconds now sends the user to login instead of hanging. Project uploads can finish in a different order than selected. The timeouts (30 s refresh, 60 s TTS headers, 5 min SharePoint download, 15 s CloudFront refresh) are fixed client constants.
Checklist