🛂 fix: Skip Inherited / Mark Skill Files Read-Only in Code-Env Pipeline

[danny-avila]

Summary

Two related fixes for how LibreChat handles files echoed back by the codeapi sandbox in output.artifact.files.

Problem

When a bash/code-interpreter call lists or imports inputs the user already owns (skill files primed via primeInvokedSkills, files inherited from a prior session), codeapi echoes those files back in the tool result so subsequent calls retain visibility.

We were treating every entry as a generated artifact and calling processCodeOutput on each:

1. 403 storms. Skill files are uploaded under the skill's entity_id, but processCodeOutput downloads with the user's session key. Every skill file 403'd — a single bash call that lists 30+ files produces 30+ Unauthorized download log lines.
2. Phantom chips in the UI. Inputs the agent merely referenced show up as if they were generated outputs (~18 ghost chips from a single skill-priming run, see linked issue).
3. Wasted round-trips. Even when no auth boundary is crossed, the file is already persisted at its origin — re-downloading achieves nothing.
4. Modifications surface as ghosts. Even after gating on the runtime inherited flag, any sandboxed code path that mutates a skill file (pip writing pyc near a .py, accidental edits) flows through codeapi's modified-input branch, gets a fresh user-owned file_id, uploads as a "generated" output, and shows up as a chip.

Fix

1. Honor codeapi's runtime inherited flag (3 loops)

Skips files where file.inherited === true in:

• api/server/controllers/tools.js (sync tool invocation)
• api/server/controllers/agents/callbacks.js — createToolEndCallback (streaming)
• api/server/controllers/agents/callbacks.js — createResponsesToolEndCallback (Responses API)

for (const file of artifact.files) {
  if (file.inherited) {
    continue;
  }
  // ...processCodeOutput
}

Inherited files remain available to subsequent calls via primeInvokedSkills / session inheritance — they just don't get redundantly downloaded.

2. Mark skill files read_only at upload time

The inherited skip only handles unchanged inputs. To prevent modified skill files from surfacing as ghosts, this PR also wires the upload-time read_only contract added in the codeapi PR:

• api/server/services/Files/Code/crud.js — batchUploadCodeEnvFiles({ ..., read_only }) forwards the flag as a multipart form field. Default false preserves existing behavior for user-attached files.
• packages/api/src/agents/skillFiles.ts — type signature gains read_only?: boolean; primeSkillFiles passes true.
• packages/api/src/agents/skillFiles.spec.ts — asserts the upload call carries read_only: true.

Codeapi seals these inputs with chmod 444 in the sandbox and the walker echoes the original refs as inherited: true regardless of wasModified — modifications are dropped on the floor.

The flag is intentionally not skill-specific. Any future infrastructure-input flow (system fixtures, cached datasets, etc.) can opt in the same way.

Test plan

• node --check syntax pass for both controllers.
• Lint-staged pre-commit hooks pass (eslint clean).
• npx jest src/agents/skillFiles.spec.ts — 4/4 pass; new assertion confirms read_only: true is forwarded.
• Local: invoke a skill that uploads files (e.g. pptx). After the agent's first bash call lists the skill files, log file should be free of Unauthorized download errors.
• Local: UI shows no phantom chips for skill files.
• Local: subsequent bash calls in the same conversation still see all skill files.
• Local: agent edits a skill file via bash (e.g. echo modified > /mnt/data/pptx/SKILL.md) — original ref still echoed, no new chip appears.
• Local: user-attached input edited by agent — modified output still surfaces correctly (regression guard).

[Copilot]

Pull request overview

This PR updates the server-side handling of execute_code tool results to avoid re-processing code-env file refs that are merely echoed back as unchanged inputs (e.g., skill files or session-inherited inputs) by honoring a new file.inherited flag from codeapi.

Changes:

• Skip artifact.files entries flagged as inherited in the synchronous tool invocation controller.
• Skip output.artifact.files entries flagged as inherited in both streaming tool-end callbacks (classic + Responses API).
• Add inline rationale comments explaining why inherited passthrough files should not be post-processed into attachments.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
api/server/controllers/tools.js	Skips inherited file refs during synchronous execute_code artifact processing.
api/server/controllers/agents/callbacks.js	Skips inherited file refs during streaming artifact processing for both standard and Responses API callbacks.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

GitNexus: 🚀 deployed

The LibreChat-pr-12866 index is now live on the MCP server.
Deploy run

[github-actions]

GitNexus: 🚀 deployed

The LibreChat-pr-12866 index is now live on the MCP server.
Deploy run