📚 docs: Document Background Responses and Slack Channels

.github/workflows/ci.yml

@@ -59,7 +59,8 @@ jobs:
 
   e2e:
     name: End-to-end tests
-    runs-on: ubuntu-latest
+    # Match the Ubuntu version supported by the locked Playwright browsers.
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v4
 

.github/workflows/update-screenshots.yml

@@ -16,7 +16,8 @@ permissions:
 jobs:
   screenshots:
     name: Capture and open PR
-    runs-on: ubuntu-latest
+    # Match the Ubuntu version supported by the locked Playwright browsers.
+    runs-on: ubuntu-24.04
     environment: Production
     steps:
       - uses: actions/checkout@v4

content/docs/configuration/librechat_yaml/object_structure/agents.mdx

@@ -1497,10 +1497,70 @@ Tokens must be unexpired and present a single, non-conflicting client identifier
 
 Unknown management-auth fields, duplicate client IDs, malformed user or tenant IDs, and enabled authentication without a client binding fail configuration validation. See [Agents API - Agent Management](/docs/features/agents_api#agent-management-api) for routes and examples.
 
+## channels
+
+For organization workspaces, `channels.maxBotManagers` limits the number of explicitly granted bot managers per app/workspace installation (default `50`, range `1`–`1000`). Administrators grant these users through the workspace’s **Manage access** button (**Manage bot access** dialog); bot management does not grant Agent sharing or installation-administration permissions.
+
+Configures the opt-in [Agent Channels integration](/docs/features/agent_channels). Enabled background Responses and a separately running gateway are required. The LibreChat source includes the standalone TypeScript Slack gateway in `packages/channel-gateway`; this setting does not start it or enable execution permissions.
+
+| Option | Default | Accepted values / purpose |
+| --- | --- | --- |
+| `enabled` | `false` | Enable channel setup and service routes |
+| `transport` | `socket_mode` | Select `socket_mode` or `webhook` ingress; manual connections generate a matching manifest and the gateway runs separately |
+| `gatewayUrl` | Omitted | Required HTTPS base URL for generating webhook callback URLs; not needed for Socket Mode |
+| `nativeSessions` | `false` | Enable optional Slack native Agent status emission after app setup |
+| `lifecycleReactions` | `false` | Add optional processing/completion reactions |
+| `signatureToleranceSeconds` | `300` | Webhook signature timestamp window; integer from 1 to 300 seconds |
+| `socketReconnectDelayMs` | `5000` | Socket reconnect delay; integer from 100 to 60000 milliseconds |
+| `ticketLifetimeMs` | `600000` | Link ticket lifetime, `60000`–`3600000` ms |
+| `linkLifetimeMs` | `2592000000` | Accepted link lifetime, `60000`–`7776000000` ms |
+| `leaseMs` | `60000` | Run lease, `10000`–`300000` ms |
+| `responseCredentialLifetimeMs` | `86400000` | Bound execution credential lifetime, `60000`–`604800000` ms |
+| `artifactMaxBytes` | `10485760` | Per-artifact limit, `1`–`52428800` bytes |
+| `artifactMaxFiles` | `5` | Artifacts per run, `1`–`20` |
+| `artifactReadTimeoutMs` | `30000` | Shared artifact-operation budget, `1000`–`60000` ms; not a separate timeout for each file |
+| `artifactAnswerFileThresholdBytes` | `6000` | Create new plain-text answer files only above this UTF-8 byte length, `0`–`52428800`; fenced answers also qualify |
+
+`slackApp` enables organization-owned apps and sets installation/runtime policy. Set `channels.enabled: true`, `transport: webhook` and `slackApp.enabled: true`. Each registered app supports one active workspace. Organization admins register an existing Slack app through **Settings → Account → Slack → Set up/Manage → Add Slack app**, with an optional friendly name and app/client credentials; credentials are encrypted in the database and are not YAML or environment settings. The deployment opt-in `SLACK_WORKSPACES_ENABLED=true` enables these policies and background Responses while preserving other YAML settings. Without the opt-in, YAML remains authoritative. `SLACK_GATEWAY_URL` supplies the public gateway URL. See [Organization workspaces](/docs/features/agent_channels#organization-workspaces) for deployment and UI steps.
+
+| `slackApp` option | Default | Purpose |
+| --- | --- | --- |
+| `enabled` | `false` | Enable organization app registration and workspace installation |
+| `flowLifetimeMs` | `600000` | Browser install lifetime, `60000`–`3600000` ms |
+| `requestTimeoutMs` | `10000` | Slack installation/verification request deadline, `1000`–`30000` ms |
+| `maxResponseBytes` | `65536` | Maximum Slack response bytes, `1024`–`262144` |
+| `gateway.ingressConcurrency` | `32` | Concurrent shared ingress requests, `1`–`128` |
+| `gateway.workerConcurrency` | `4` | Concurrent durable worker turns per process, `1`–`32` |
+| `gateway.discoveryBatchSize` | `32` | Shared discovery page, `1`–`100`, also capped by `maxMetadataPageSize` |
+| `gateway.pollIntervalMs` | `1000` | Discovery polling interval, `100`–`60000` ms |
+
+Workspace-bound Agent connections require personal identities. Shared gateway mode does not mean the manual owner-only `shared` credential mode; it shares transport and workers across installations, while every member retains their own execution identity.
+
+The artifact budget covers catalog queries, storage acquisition/consumption and final authorization. Limits resolution is capped at the schema maximum of 60 seconds; once resolved, its elapsed time counts toward the configured budget. Expiry omits artifacts rather than returning files without current authorization. The threshold applies to new answer-file projections; existing saved descriptors remain bound to their bytes and require current owner, tenant, retention and maximum-size checks.
+
+`cleanup` accepts `batchSize` (`25`, range `1`–`100`), `intervalMs` (`1000`, range `1000`–`60000`), and `maxIdleIntervalMs` (`30000`, range `1000`–`300000`).
+
+`feedback` accepts `maxConflictRetries` (`5`, range `1`–`20`), `exportTimeoutMs` (`10000`, range `1000`–`60000`), `exportLeaseMs` (`60000`, range `60000`–`300000`), `exportRetryMs` (`5000`, range `1000`–`300000`), and the same `batchSize`, `intervalMs`, and `maxIdleIntervalMs` defaults/ranges as `cleanup`.
+
+The gateway service boundary requires the server-side `CHANNEL_SERVICE_TOKEN`. Do not expose it to browsers or use it as a general Agent execution credential. Channel credential mode (`shared` or `per_user`) belongs to the channel record, not this deployment block. Both modes require explicit current actor linking; `shared` restricts linking to the channel creator's account rather than granting all external participants that account's privileges.
+
+The gateway reads this versioned policy from LibreChat before selecting ingress. `SLACK_TRANSPORT` is optional and asserts the selected mode; a mismatch or unsupported policy prevents startup. Native sessions, lifecycle reactions and signature policy are configured here rather than through gateway process flags. Gateway runtime settings, including its tenant/connection IDs, app-level Socket Mode token and optional `APP_TITLE` label, are documented in [Run the Slack gateway](/docs/features/agent_channels#run-the-slack-gateway).
+
 ## remoteApi
 
 Configuration for Remote Agent API authentication. Controls how external services authenticate when calling the Agents API endpoints.
 
+### remoteApi.background
+
+Enables the opt-in [background Responses lifecycle](/docs/features/background_responses). It does not enable Remote Agents permissions or human approval by itself.
+
+| Option | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `enabled` | Boolean | `false` | Accept durable background Responses requests |
+| `acknowledgementTimeoutMs` | Integer | `10000` | Worker admission acknowledgement timeout, from `100` through `60000` ms; not the model run timeout |
+
+Background requests require an Agent API key, stored responses, and non-streaming submission. Human-action resume requires durable MongoDB checkpoints and the corresponding existing approval/question policy. Set `DOMAIN_CLIENT` to the trusted public owner-review URL origin.
+
 ### remoteApi.auth
 
 <OptionTable