[fix] Give the skill registry ops a build-kit permission so skills load again

[mmabrouk]

Context

On release/v0.116.0 the Skills page, POST /api/skills/query, and the agent catalog answer 500 with operation_id: query_registry_skills. The API log shows KeyError: 'search_skills' from build_agent_template_overlay. The skill registry added search_skills, check_skill_updates, and apply_skill_update to DEFAULT_BUILD_KIT_OPS, and the later permissions change added _BUILD_KIT_OP_PERMISSIONS without them. Every overlay build looks up a permission for each op, so the first missing one raises. Found while doing QA for #6743 on a stack built from the release branch.

Changes

The permission map gains the three ops. The two reads allow. The apply asks, because it is a write and its approval card is the user prompt, which is what the comment above the op list already says.

Before:

KeyError: 'search_skills'  -> 500 on skills query, skills page, agent catalog

After:

search_skills: allow, check_skill_updates: allow, apply_skill_update: ask

The overlay unit test's expected permission map gains the same three entries. It was red on the release branch for the same reason.

Tests

• api/oss/tests/pytest/unit/applications/test_build_kit_overlay.py and api/oss/tests/pytest/unit/workflows/test_static_catalog.py: 51 passed. Before the change, 7 of 8 overlay tests failed with the same KeyError.
• ruff format and ruff check on both files: clean.

What to QA

• Open the Skills page on a release build. It lists the registry instead of an error.
• Open an agent. The build kit loads and the agent runs.
• Regression: in the agent's Permissions section, the skill ops show allow for search and update check, and ask for apply.

https://claude.ai/code/session_01AY886ajXX65KAa1Vc9JCXU

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
agenta-documentation	Ready	Preview	Sep 10, 2026 10:50am UTC

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Mahmoud Mabrouk seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Advanced

Run ID: b52041a6-dbba-4c63-ab27-9e448c02e13a

📥 Commits

Reviewing files that changed from the base of the PR and between 80e48e9 and 6245b0f.

📒 Files selected for processing (2)

• api/oss/src/core/workflows/build_kit.py
• api/oss/tests/pytest/unit/applications/test_build_kit_overlay.py

Included review availability: Your plan provides up to 8 included reviews per hour; 6 remain after this review.

---

📝 Summary

Summary by CodeRabbit

• New Features
  • Added support for skill discovery and update checks.
  • Skill updates now require user approval before being applied.

Walkthrough

The build kit now assigns permissions to three skill operations. Unit test expectations match the new values: allow for search and update checks, and ask for applying updates.

Changes

Build Kit skill permissions

Layer / File(s)	Summary
Skill operation permission mapping api/oss/src/core/workflows/build_kit.py, api/oss/tests/pytest/unit/applications/test_build_kit_overlay.py	Adds search_skills and check_skill_updates with allow permission. Adds apply_skill_update with ask permission. Updates the expected test mapping to match.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 6245b

This restores Skills and agent catalog functionality while preserving approval for skill updates. No actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains the missing skill registry permissions, resulting KeyError, affected endpoints, implemented fix, and validation steps.
Title check	✅ Passed	The title clearly summarizes the primary change: adding build-kit permissions for skill registry operations so skills load correctly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/build-kit-skill-op-permissions

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Railway Preview Environment

Status	Destroyed (PR closed)

Updated at 2026-09-10T11:19:03.453Z