@iblai/iblai-js 2.7.4 → 2.7.6

package/dist/playwright/playwright/agent-skills-helpers.d.ts

@@ -55,15 +55,17 @@ export declare function addSkillToAgent(page: Page, skillName: string): Promise<
  */
 export declare function verifySkillAdded(page: Page, skillName: string): Promise<void>;
 /**
- * Open the three-dots actions menu for a skill row on the active sub-tab.
- * Agent-tab rows offer "Remove from Agent" only; catalog rows offer
- * Edit/Delete (for editable skills). The menu content portals to
- * document.body, so the returned locator is page-level by design.
+ * Open the three-dots actions menu for a CATALOG skill row (Edit/Delete on
+ * editable skills). Agent-tab rows have no menu — detaching is a direct
+ * "Remove" button there (see `removeSkillFromAgent`). The menu content
+ * portals to document.body, so the returned locator is page-level by design.
  */
 export declare function openSkillActionsMenu(page: Page, skillName: string): Promise<Locator>;
 /**
- * Detach a skill from the agent via its row menu ("Remove from Agent") on the
- * "Agent Skills" sub-tab. Waits for the toast and for the row to disappear.
+ * Detach a skill from the agent via its row's direct "Remove" button on the
+ * "Agent Skills" sub-tab (the visible text is just "Remove"; the button's
+ * accessible name carries the skill, mirroring the catalog's Add button).
+ * Waits for the toast confirming the detach.
  */
 export declare function removeSkillFromAgent(page: Page, skillName: string): Promise<void>;
 /**

package/dist/security/playwright/agent-skills-helpers.d.ts

@@ -55,15 +55,17 @@ export declare function addSkillToAgent(page: Page, skillName: string): Promise<
  */
 export declare function verifySkillAdded(page: Page, skillName: string): Promise<void>;
 /**
- * Open the three-dots actions menu for a skill row on the active sub-tab.
- * Agent-tab rows offer "Remove from Agent" only; catalog rows offer
- * Edit/Delete (for editable skills). The menu content portals to
- * document.body, so the returned locator is page-level by design.
+ * Open the three-dots actions menu for a CATALOG skill row (Edit/Delete on
+ * editable skills). Agent-tab rows have no menu — detaching is a direct
+ * "Remove" button there (see `removeSkillFromAgent`). The menu content
+ * portals to document.body, so the returned locator is page-level by design.
  */
 export declare function openSkillActionsMenu(page: Page, skillName: string): Promise<Locator>;
 /**
- * Detach a skill from the agent via its row menu ("Remove from Agent") on the
- * "Agent Skills" sub-tab. Waits for the toast and for the row to disappear.
+ * Detach a skill from the agent via its row's direct "Remove" button on the
+ * "Agent Skills" sub-tab (the visible text is just "Remove"; the button's
+ * accessible name carries the skill, mirroring the catalog's Add button).
+ * Waits for the toast confirming the detach.
  */
 export declare function removeSkillFromAgent(page: Page, skillName: string): Promise<void>;
 /**

package/dist/web-containers/playwright/agent-skills-helpers.d.ts

@@ -55,15 +55,17 @@ export declare function addSkillToAgent(page: Page, skillName: string): Promise<
  */
 export declare function verifySkillAdded(page: Page, skillName: string): Promise<void>;
 /**
- * Open the three-dots actions menu for a skill row on the active sub-tab.
- * Agent-tab rows offer "Remove from Agent" only; catalog rows offer
- * Edit/Delete (for editable skills). The menu content portals to
- * document.body, so the returned locator is page-level by design.
+ * Open the three-dots actions menu for a CATALOG skill row (Edit/Delete on
+ * editable skills). Agent-tab rows have no menu — detaching is a direct
+ * "Remove" button there (see `removeSkillFromAgent`). The menu content
+ * portals to document.body, so the returned locator is page-level by design.
  */
 export declare function openSkillActionsMenu(page: Page, skillName: string): Promise<Locator>;
 /**
- * Detach a skill from the agent via its row menu ("Remove from Agent") on the
- * "Agent Skills" sub-tab. Waits for the toast and for the row to disappear.
+ * Detach a skill from the agent via its row's direct "Remove" button on the
+ * "Agent Skills" sub-tab (the visible text is just "Remove"; the button's
+ * accessible name carries the skill, mirroring the catalog's Add button).
+ * Waits for the toast confirming the detach.
  */
 export declare function removeSkillFromAgent(page: Page, skillName: string): Promise<void>;
 /**

package/dist/web-containers/source/index.esm.js

@@ -3041,7 +3041,8 @@ var clawSandboxAgentSkills$3 = {
 	noEffectiveSkills: "No skills enabled for this agent yet. Add one from the Available Skills tab.",
 	addToAgent: "Add",
 	addToAgentLabel: "Add {name} to this agent",
-	removeFromAgent: "Remove from Agent",
+	removeFromAgent: "Remove",
+	removeFromAgentLabel: "Remove {name} from this agent",
 	skillAdded: "{name} added",
 	skillRemoved: "{name} removed",
 	featuredBadge: "Featured",
@@ -10204,7 +10205,8 @@ var clawSandboxAgentSkills$2 = {
 	noEffectiveSkills: "Cet agent n'a pas encore de compétences activées. Ajoutez-en une depuis l'onglet Compétences disponibles.",
 	addToAgent: "Ajouter",
 	addToAgentLabel: "Ajouter {name} à cet agent",
-	removeFromAgent: "Retirer de l'agent",
+	removeFromAgent: "Retirer",
+	removeFromAgentLabel: "Retirer {name} de cet agent",
 	skillAdded: "{name} ajoutée",
 	skillRemoved: "{name} retirée",
 	featuredBadge: "En vedette",
@@ -17201,7 +17203,8 @@ var clawSandboxAgentSkills$1 = {
 	noEffectiveSkills: "Este agente aún no tiene habilidades habilitadas. Añade una desde la pestaña Habilidades disponibles.",
 	addToAgent: "Añadir",
 	addToAgentLabel: "Añadir {name} a este agente",
-	removeFromAgent: "Quitar del agente",
+	removeFromAgent: "Quitar",
+	removeFromAgentLabel: "Quitar {name} de este agente",
 	skillAdded: "{name} añadida",
 	skillRemoved: "{name} eliminada",
 	featuredBadge: "Destacada",
@@ -24198,7 +24201,8 @@ var clawSandboxAgentSkills = {
 	noEffectiveSkills: "此智能体尚未启用任何技能。请从“可用技能”标签页添加。",
 	addToAgent: "添加",
 	addToAgentLabel: "将 {name} 添加到此智能体",
-	removeFromAgent: "从智能体中移除",
+	removeFromAgent: "移除",
+	removeFromAgentLabel: "将 {name} 从此智能体中移除",
 	skillAdded: "已添加 {name}",
 	skillRemoved: "已移除 {name}",
 	featuredBadge: "精选",
@@ -236140,12 +236144,31 @@ const EMPTY_SKILL_FORM = {
 };
 /** Page size for both skill lists. */
 const SKILLS_PAGE_SIZE = 10;
-function AgentSkills({ platformKey, mentorUniqueId }) {
+function AgentSkills({ platformKey, mentorUniqueId, mentorDbId }) {
     var _a, _b, _c, _d, _e, _f;
     const t = useT();
     // Skills are managed independently of the sandbox connection — org-level
     // skills and the mentor's assignments both resolve without a wired Claw
     // instance, so we always fetch and let admins add/assign skills freely.
+    // Assignment reads/writes are RBAC-gated when the host passes `mentorDbId`:
+    // each action needs its grant from the mentor's permission check (the
+    // endpoints 403 without it). Without a `mentorDbId` there is nothing to
+    // check against, so the gates fail open — previous behavior.
+    const rbacPermissions = useSelector(selectRbacPermissions);
+    const mentorRbacKey = mentorDbId != null ? `/mentors/${mentorDbId}/` : null;
+    const hasMentorRbacData = mentorRbacKey ? mentorRbacKey in rbacPermissions : false;
+    const hasAssignmentGrant = (permission) => mentorRbacKey
+        ? hasMentorRbacData && checkRbacPermission(rbacPermissions, `${mentorRbacKey}#${permission}`)
+        : true;
+    const canViewAssignments = hasAssignmentGrant('view_skill_assignments');
+    const canCreateAssignment = hasAssignmentGrant('create_skill_assignment');
+    const canWriteAssignment = hasAssignmentGrant('write_skill_assignment');
+    const canDeleteAssignment = hasAssignmentGrant('delete_skill_assignment');
+    // The Available Skills catalog is a platform-level resource without its own
+    // mentor-scoped grant; its only purpose here is attaching skills, so the
+    // whole tab (fetch included — it can 403 too) plus skill authoring rides on
+    // `create_skill_assignment` until the backend exposes catalog grants.
+    const canBrowseCatalog = canCreateAssignment;
     // The "Agent Skills" tab pages the assignment list server-side.
     const [agentPage, setAgentPage] = useState(1);
     const { data: assignmentsPage, isLoading: isLoadingAssignments } = useGetMentorSkillAssignmentsQuery({
@@ -236153,7 +236176,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
         mentorUniqueId,
         limit: SKILLS_PAGE_SIZE,
         offset: (agentPage - 1) * SKILLS_PAGE_SIZE,
-    });
+    }, { skip: !canViewAssignments });
     const agentAssignments = (_a = assignmentsPage === null || assignmentsPage === void 0 ? void 0 : assignmentsPage.results) !== null && _a !== void 0 ? _a : [];
     const agentTotalCount = (_b = assignmentsPage === null || assignmentsPage === void 0 ? void 0 : assignmentsPage.count) !== null && _b !== void 0 ? _b : 0;
     const agentTotalPages = Math.max(1, Math.ceil(agentTotalCount / SKILLS_PAGE_SIZE));
@@ -236167,7 +236190,9 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
     const { data: assignmentCoverage } = useGetMentorSkillAssignmentsQuery({
         org: platformKey,
         mentorUniqueId,
-    });
+    }, 
+    // Only powers the catalog tab's "Added" chips — pointless without it.
+    { skip: !canViewAssignments || !canBrowseCatalog });
     const assignedSkillIds = new Set(((_c = assignmentCoverage === null || assignmentCoverage === void 0 ? void 0 : assignmentCoverage.results) !== null && _c !== void 0 ? _c : []).map((a) => a.skill));
     // The "Available skills" tab pages the catalog server-side. Deliberately
     // unfiltered: disabled skills stay listed (switch off) so admins can
@@ -236177,7 +236202,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
         org: platformKey,
         limit: SKILLS_PAGE_SIZE,
         offset: (catalogPage - 1) * SKILLS_PAGE_SIZE,
-    });
+    }, { skip: !canBrowseCatalog });
     const catalogSkills = (_d = catalogSkillsPage === null || catalogSkillsPage === void 0 ? void 0 : catalogSkillsPage.results) !== null && _d !== void 0 ? _d : [];
     const catalogTotalCount = (_e = catalogSkillsPage === null || catalogSkillsPage === void 0 ? void 0 : catalogSkillsPage.count) !== null && _e !== void 0 ? _e : 0;
     const catalogTotalPages = Math.max(1, Math.ceil(catalogTotalCount / SKILLS_PAGE_SIZE));
@@ -236308,7 +236333,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
             }).unwrap();
             // A private skill only takes effect once assigned, and the Agent Skills
             // tab lists assignments — so attach it to this agent right away.
-            if (form.privateToAgent && (created === null || created === void 0 ? void 0 : created.unique_id)) {
+            if (form.privateToAgent && (created === null || created === void 0 ? void 0 : created.unique_id) && canCreateAssignment) {
                 await createAssignment({
                     org: platformKey,
                     mentorUniqueId,
@@ -236348,7 +236373,10 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
             }).unwrap();
             // Making a skill private to this agent implies it should be usable by
             // it — attach it if it isn't assigned yet.
-            if (!privateLocked && form.privateToAgent && !assignedSkillIds.has(editingSkill.unique_id)) {
+            if (!privateLocked &&
+                form.privateToAgent &&
+                canCreateAssignment &&
+                !assignedSkillIds.has(editingSkill.unique_id)) {
                 await createAssignment({
                     org: platformKey,
                     mentorUniqueId,
@@ -236376,17 +236404,21 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
         }
     };
     const renderBadges = (skill) => (jsxs("span", { className: "flex flex-wrap items-center gap-1", children: [skill.category && (jsx("span", { className: "rounded-full bg-gray-100 px-2 py-0.5 text-[0.625rem] text-gray-500", children: skill.category })), skill.skill_type === 'native' && (jsx("span", { className: "rounded-full bg-purple-50 px-2 py-0.5 text-[0.625rem] text-purple-600", children: t('clawSandboxAgentSkills.nativeBadge') })), skill.is_featured && (jsx("span", { className: "rounded-full bg-amber-50 px-2 py-0.5 text-[0.625rem] text-amber-600", children: t('clawSandboxAgentSkills.featuredBadge') })), skill.mentor === mentorUniqueId && (jsx("span", { className: "rounded-full bg-blue-50 px-2 py-0.5 text-[0.625rem] text-blue-600", children: t('clawSandboxAgentSkills.privateBadge') }))] }));
-    // Agent-tab rows are assignments: their only row action is detaching.
-    const renderAssignmentMenu = (assignment) => (jsxs(DropdownMenu, { children: [jsx(DropdownMenuTrigger, { asChild: true, children: jsx(Button$1, { variant: "ghost", size: "sm", "aria-label": t('clawSandboxAgentSkills.skillActions', { name: assignment.skill_name }), children: jsx(Ellipsis, { className: "h-4 w-4" }) }) }), jsx(DropdownMenuContent, { align: "end", children: jsxs(DropdownMenuItem, { className: "cursor-pointer", onClick: () => handleDetach(assignment), children: [jsx(CircleMinus$1, { className: "mr-2 h-4 w-4" }), t('clawSandboxAgentSkills.removeFromAgent')] }) })] }));
+    // Agent-tab rows are assignments: detaching is their only action, so it's
+    // a direct button (mirroring the catalog's "Add to Agent") rather than a
+    // one-item three-dots menu — hidden entirely without the delete grant.
+    const renderAssignmentRemoveButton = (assignment) => !canDeleteAssignment ? null : (jsxs(Button$1, { variant: "outline", size: "sm", className: "cursor-pointer", disabled: isMutatingAgentSkill, onClick: () => handleDetach(assignment), "aria-label": t('clawSandboxAgentSkills.removeFromAgentLabel', {
+            name: assignment.skill_name,
+        }), children: [jsx(CircleMinus$1, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.removeFromAgent')] }));
     // Catalog rows carry the full skill object: edit/delete where allowed.
     const renderSkillMenu = (skill) => {
         if (!isSkillEditable(skill))
             return null;
         return (jsxs(DropdownMenu, { children: [jsx(DropdownMenuTrigger, { asChild: true, children: jsx(Button$1, { variant: "ghost", size: "sm", "aria-label": t('clawSandboxAgentSkills.skillActions', { name: skill.name }), children: jsx(Ellipsis, { className: "h-4 w-4" }) }) }), jsxs(DropdownMenuContent, { align: "end", children: [jsxs(DropdownMenuItem, { className: "cursor-pointer", onClick: () => openEditSkillDialog(skill), children: [jsx(Pen, { className: "mr-2 h-4 w-4" }), t('clawSandboxAgentSkills.edit')] }), jsxs(DropdownMenuItem, { variant: "destructive", className: "cursor-pointer", onClick: () => setDeletingSkill(skill), children: [jsx(Trash2, { className: "mr-2 h-4 w-4" }), t('clawSandboxAgentSkills.delete')] })] })] }));
     };
-    return (jsxs("div", { className: "space-y-4", "data-testid": "agent-skills-content", children: [jsxs("div", { className: "flex items-start justify-between gap-4", children: [jsxs("p", { className: "flex items-start gap-2 text-xs text-gray-500", children: [jsx(Info$3, { className: "mt-0.5 h-4 w-4 shrink-0 text-gray-400" }), jsx("span", { children: t('clawSandboxAgentSkills.sessionNote') })] }), jsxs(Button$1, { onClick: openNewSkillDialog, size: "sm", className: "shrink-0 cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.newSkill')] })] }), jsxs(Tabs, { defaultValue: "agent", className: "w-full", children: [jsxs(TabsList, { "aria-label": t('clawSandboxAgentSkills.tabsAriaLabel'), "data-testid": "agent-skills-tabs", children: [jsx(TabsTrigger, { value: "agent", "data-testid": "agent-skills-tab-agent", children: t('clawSandboxAgentSkills.tabAgentSkills') }), jsx(TabsTrigger, { value: "available", "data-testid": "agent-skills-tab-available", children: t('clawSandboxAgentSkills.tabAvailableSkills') })] }), jsx(TabsContent, { value: "agent", className: "space-y-3", children: isLoadingAssignments ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : agentTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noEffectiveSkills') }) })) : (jsxs(Fragment$1, { children: [agentAssignments.map((assignment) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "agent-skill-row", children: [jsx("div", { className: "min-w-0 space-y-1", children: jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: assignment.skill_name }), assignment.skill_slug && (jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["/", assignment.skill_slug] }))] }) }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [jsx(Switch, { checked: assignment.enabled, onCheckedChange: (checked) => handleToggleAssignment(assignment, checked), disabled: isMutatingAgentSkill, className: "cursor-pointer data-[state=checked]:bg-blue-500", "aria-label": t(assignment.enabled
+    return (jsxs("div", { className: "space-y-4", "data-testid": "agent-skills-content", children: [jsxs("div", { className: "flex items-start justify-between gap-4", children: [jsxs("p", { className: "flex items-start gap-2 text-xs text-gray-500", children: [jsx(Info$3, { className: "mt-0.5 h-4 w-4 shrink-0 text-gray-400" }), jsx("span", { children: t('clawSandboxAgentSkills.sessionNote') })] }), canBrowseCatalog && (jsxs(Button$1, { onClick: openNewSkillDialog, size: "sm", className: "shrink-0 cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.newSkill')] }))] }), jsxs(Tabs, { defaultValue: "agent", className: "w-full", children: [jsxs(TabsList, { "aria-label": t('clawSandboxAgentSkills.tabsAriaLabel'), "data-testid": "agent-skills-tabs", children: [jsx(TabsTrigger, { value: "agent", "data-testid": "agent-skills-tab-agent", children: t('clawSandboxAgentSkills.tabAgentSkills') }), canBrowseCatalog && (jsx(TabsTrigger, { value: "available", "data-testid": "agent-skills-tab-available", children: t('clawSandboxAgentSkills.tabAvailableSkills') }))] }), jsx(TabsContent, { value: "agent", className: "space-y-3", children: isLoadingAssignments ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : agentTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noEffectiveSkills') }) })) : (jsxs(Fragment$1, { children: [agentAssignments.map((assignment) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "agent-skill-row", children: [jsx("div", { className: "min-w-0 space-y-1", children: jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: assignment.skill_name }), assignment.skill_slug && (jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["/", assignment.skill_slug] }))] }) }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [jsx(Switch, { checked: assignment.enabled, onCheckedChange: (checked) => handleToggleAssignment(assignment, checked), disabled: isMutatingAgentSkill || !canWriteAssignment, className: "cursor-pointer data-[state=checked]:bg-blue-500", "aria-label": t(assignment.enabled
                                                         ? 'clawSandboxAgentSkills.skillEnabledLabel'
-                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: assignment.skill_name }) }), renderAssignmentMenu(assignment)] })] }, assignment.id))), jsx(IblPagination, { currentPage: agentPage, totalPages: agentTotalPages, onPageChange: setAgentPage, disabled: isMutatingAgentSkill })] })) }), jsx(TabsContent, { value: "available", className: "space-y-3", children: isLoadingCatalog ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : catalogTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noSkillsAvailable') }) })) : (jsxs(Fragment$1, { children: [catalogSkills.map((skill) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "available-skill-row", children: [jsxs("div", { className: "min-w-0 space-y-1", children: [jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: skill.name }), jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["v", skill.version] }), renderBadges(skill)] }), skill.description && (jsx("p", { className: "line-clamp-2 text-xs text-gray-500", children: skill.description }))] }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [isCoveredByAgent(skill) ? (jsx("span", { className: "rounded-full bg-green-50 px-2 py-0.5 text-xs text-green-700", children: t('clawSandboxAgentSkills.addedBadge') })) : isOtherAgentsPrivate(skill) ? (
+                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: assignment.skill_name }) }), renderAssignmentRemoveButton(assignment)] })] }, assignment.id))), jsx(IblPagination, { currentPage: agentPage, totalPages: agentTotalPages, onPageChange: setAgentPage, disabled: isMutatingAgentSkill })] })) }), canBrowseCatalog && (jsx(TabsContent, { value: "available", className: "space-y-3", children: isLoadingCatalog ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : catalogTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noSkillsAvailable') }) })) : (jsxs(Fragment$1, { children: [catalogSkills.map((skill) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "available-skill-row", children: [jsxs("div", { className: "min-w-0 space-y-1", children: [jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: skill.name }), jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["v", skill.version] }), renderBadges(skill)] }), skill.description && (jsx("p", { className: "line-clamp-2 text-xs text-gray-500", children: skill.description }))] }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [isCoveredByAgent(skill) ? (jsx("span", { className: "rounded-full bg-green-50 px-2 py-0.5 text-xs text-green-700", children: t('clawSandboxAgentSkills.addedBadge') })) : isOtherAgentsPrivate(skill) ? (
                                                 // Another agent's private skill: Add stays visible but
                                                 // disabled, with the reason on hover/focus.
                                                 jsx(TooltipProvider, { children: jsxs(Tooltip$1, { children: [jsx(TooltipTrigger, { asChild: true, children: jsx("span", { tabIndex: 0, children: jsxs(Button$1, { variant: "outline", size: "sm", disabled: true, "aria-label": t('clawSandboxAgentSkills.addToAgentLabel', {
@@ -236395,7 +236427,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
                                                         name: skill.name,
                                                     }), children: [jsx(Plus, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.addToAgent')] })), isSkillEditable(skill) && (jsx(Switch, { checked: skill.enabled, onCheckedChange: (checked) => handleToggleSkill(skill, checked), disabled: isUpdatingSkill, className: "cursor-pointer data-[state=checked]:bg-blue-500", "aria-label": t(skill.enabled
                                                         ? 'clawSandboxAgentSkills.skillEnabledLabel'
-                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: skill.name }) })), renderSkillMenu(skill)] })] }, skill.id))), jsx(IblPagination, { currentPage: catalogPage, totalPages: catalogTotalPages, onPageChange: setCatalogPage, disabled: isMutatingAgentSkill })] })) })] }), jsx(OverlayModal, { open: showNewDialog, onClose: closeAllDialogs, title: t('clawSandboxAgentSkills.newSkillDialogTitle'), className: "max-w-2xl", children: jsxs("div", { className: "flex h-[min(75dvh,46rem)] flex-col", children: [jsxs("div", { className: "flex-1 space-y-4 overflow-y-auto pb-4 pr-1", children: [jsx(SkillForm, { form: form, onChange: setForm }), jsx("p", { className: "text-xs text-gray-500", children: t('clawSandboxAgentSkills.filesAfterCreateHint') })] }), jsxs("div", { className: "flex justify-end gap-2 border-t pt-4", children: [jsx(Button$1, { variant: "outline", onClick: closeAllDialogs, children: t('clawSandboxAgentSkills.cancel') }), jsx(Button$1, { onClick: handleCreateSkill, disabled: isCreatingSkill || !form.name || !form.slug, className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: isCreatingSkill
+                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: skill.name }) })), renderSkillMenu(skill)] })] }, skill.id))), jsx(IblPagination, { currentPage: catalogPage, totalPages: catalogTotalPages, onPageChange: setCatalogPage, disabled: isMutatingAgentSkill })] })) }))] }), jsx(OverlayModal, { open: showNewDialog, onClose: closeAllDialogs, title: t('clawSandboxAgentSkills.newSkillDialogTitle'), className: "max-w-2xl", children: jsxs("div", { className: "flex h-[min(75dvh,46rem)] flex-col", children: [jsxs("div", { className: "flex-1 space-y-4 overflow-y-auto pb-4 pr-1", children: [jsx(SkillForm, { form: form, onChange: setForm }), jsx("p", { className: "text-xs text-gray-500", children: t('clawSandboxAgentSkills.filesAfterCreateHint') })] }), jsxs("div", { className: "flex justify-end gap-2 border-t pt-4", children: [jsx(Button$1, { variant: "outline", onClick: closeAllDialogs, children: t('clawSandboxAgentSkills.cancel') }), jsx(Button$1, { onClick: handleCreateSkill, disabled: isCreatingSkill || !form.name || !form.slug, className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: isCreatingSkill
                                         ? t('clawSandboxAgentSkills.creating')
                                         : t('clawSandboxAgentSkills.create') })] })] }) }), jsx(OverlayModal, { open: !!editingSkill, onClose: closeAllDialogs, title: t('clawSandboxAgentSkills.editSkillDialogTitle'), className: "max-w-2xl", children: jsxs(Tabs, { defaultValue: "details", className: "w-full", children: [jsxs(TabsList, { "aria-label": t('clawSandboxAgentSkills.editSkillDialogTitle'), "data-testid": "skill-dialog-tabs", children: [jsx(TabsTrigger, { value: "details", "data-testid": "skill-dialog-tab-details", children: t('clawSandboxAgentSkills.detailsTab') }), jsx(TabsTrigger, { value: "files", "data-testid": "skill-dialog-tab-files", children: t('clawSandboxAgentSkills.filesTab') })] }), jsx(TabsContent, { value: "details", children: jsxs("div", { className: "flex h-[min(75dvh,46rem)] flex-col", children: [jsx("div", { className: "flex-1 space-y-4 overflow-y-auto pb-4 pr-1", children: jsx(SkillForm, { form: form, onChange: setForm, privateLocked: !!editingSkill && isOtherAgentsPrivate(editingSkill) }) }), jsxs("div", { className: "flex justify-end gap-2 border-t pt-4", children: [jsx(Button$1, { variant: "outline", onClick: closeAllDialogs, children: t('clawSandboxAgentSkills.cancel') }), jsx(Button$1, { onClick: handleUpdateSkill, disabled: isUpdatingSkill || !form.name || !form.slug, className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: isUpdatingSkill
                                                     ? t('clawSandboxAgentSkills.saving')
@@ -238996,6 +239028,14 @@ function ChatInputForm({ onSubmit, onScreenSharingClick, isScreenSharingModalOpe
         ? checkRbacPermission(rbacPermissions, `/mentors/${mentorDbId}/#chat`)
         : true; // Default to true if mentor ID not available or RBAC data not loaded
     const isChatDisabledByRbac = !hasChatPermission;
+    // Listing an agent's skills is a separate, stricter grant than chatting:
+    // the per-agent skills endpoint 403s for users without
+    // `view_skill_assignments`, so the `/` picker's fetch stays off until the
+    // mentor's permission check has explicitly granted it (no permission data
+    // loaded means no fetch — chatting never requires this endpoint).
+    const hasSkillAssignmentsPermission = mentorDbId && hasMentorRbacData
+        ? checkRbacPermission(rbacPermissions, `/mentors/${mentorDbId}/#view_skill_assignments`)
+        : false;
     const { FreeTrialDialog, closeModal: closeFreeTrialModal, isModalOpen: isFreeTrialModalOpen, executeWithTrialCheck, } = useShowFreeTrialDialog();
     const embedMode = useEmbedMode();
     const inputValue = useSelector(chatInputSliceSelectors.selectTextareaInput);
@@ -239038,7 +239078,7 @@ function ChatInputForm({ onSubmit, onScreenSharingClick, isScreenSharingModalOpe
     const fetchedSlashSkills = useSlashSkills({
         org: tenantKey,
         mentorUniqueId,
-        enabled: slashSkillsEnabled && !slashSkills,
+        enabled: slashSkillsEnabled && !slashSkills && hasSkillAssignmentsPermission,
         active: slashTokenActive,
     });
     const effectiveSlashSkills = slashSkills !== null && slashSkills !== void 0 ? slashSkills : (slashSkillsEnabled ? fetchedSlashSkills.skills : []);

package/dist/web-containers/source/next/index.esm.js

@@ -98586,7 +98586,8 @@ var clawSandboxAgentSkills$3 = {
 	noEffectiveSkills: "No skills enabled for this agent yet. Add one from the Available Skills tab.",
 	addToAgent: "Add",
 	addToAgentLabel: "Add {name} to this agent",
-	removeFromAgent: "Remove from Agent",
+	removeFromAgent: "Remove",
+	removeFromAgentLabel: "Remove {name} from this agent",
 	skillAdded: "{name} added",
 	skillRemoved: "{name} removed",
 	featuredBadge: "Featured",
@@ -105749,7 +105750,8 @@ var clawSandboxAgentSkills$2 = {
 	noEffectiveSkills: "Cet agent n'a pas encore de compétences activées. Ajoutez-en une depuis l'onglet Compétences disponibles.",
 	addToAgent: "Ajouter",
 	addToAgentLabel: "Ajouter {name} à cet agent",
-	removeFromAgent: "Retirer de l'agent",
+	removeFromAgent: "Retirer",
+	removeFromAgentLabel: "Retirer {name} de cet agent",
 	skillAdded: "{name} ajoutée",
 	skillRemoved: "{name} retirée",
 	featuredBadge: "En vedette",
@@ -112746,7 +112748,8 @@ var clawSandboxAgentSkills$1 = {
 	noEffectiveSkills: "Este agente aún no tiene habilidades habilitadas. Añade una desde la pestaña Habilidades disponibles.",
 	addToAgent: "Añadir",
 	addToAgentLabel: "Añadir {name} a este agente",
-	removeFromAgent: "Quitar del agente",
+	removeFromAgent: "Quitar",
+	removeFromAgentLabel: "Quitar {name} de este agente",
 	skillAdded: "{name} añadida",
 	skillRemoved: "{name} eliminada",
 	featuredBadge: "Destacada",
@@ -119743,7 +119746,8 @@ var clawSandboxAgentSkills = {
 	noEffectiveSkills: "此智能体尚未启用任何技能。请从“可用技能”标签页添加。",
 	addToAgent: "添加",
 	addToAgentLabel: "将 {name} 添加到此智能体",
-	removeFromAgent: "从智能体中移除",
+	removeFromAgent: "移除",
+	removeFromAgentLabel: "将 {name} 从此智能体中移除",
 	skillAdded: "已添加 {name}",
 	skillRemoved: "已移除 {name}",
 	featuredBadge: "精选",
@@ -259087,12 +259091,31 @@ const EMPTY_SKILL_FORM = {
 };
 /** Page size for both skill lists. */
 const SKILLS_PAGE_SIZE = 10;
-function AgentSkills({ platformKey, mentorUniqueId }) {
+function AgentSkills({ platformKey, mentorUniqueId, mentorDbId }) {
     var _a, _b, _c, _d, _e, _f;
     const t = useT();
     // Skills are managed independently of the sandbox connection — org-level
     // skills and the mentor's assignments both resolve without a wired Claw
     // instance, so we always fetch and let admins add/assign skills freely.
+    // Assignment reads/writes are RBAC-gated when the host passes `mentorDbId`:
+    // each action needs its grant from the mentor's permission check (the
+    // endpoints 403 without it). Without a `mentorDbId` there is nothing to
+    // check against, so the gates fail open — previous behavior.
+    const rbacPermissions = useSelector(selectRbacPermissions);
+    const mentorRbacKey = mentorDbId != null ? `/mentors/${mentorDbId}/` : null;
+    const hasMentorRbacData = mentorRbacKey ? mentorRbacKey in rbacPermissions : false;
+    const hasAssignmentGrant = (permission) => mentorRbacKey
+        ? hasMentorRbacData && checkRbacPermission(rbacPermissions, `${mentorRbacKey}#${permission}`)
+        : true;
+    const canViewAssignments = hasAssignmentGrant('view_skill_assignments');
+    const canCreateAssignment = hasAssignmentGrant('create_skill_assignment');
+    const canWriteAssignment = hasAssignmentGrant('write_skill_assignment');
+    const canDeleteAssignment = hasAssignmentGrant('delete_skill_assignment');
+    // The Available Skills catalog is a platform-level resource without its own
+    // mentor-scoped grant; its only purpose here is attaching skills, so the
+    // whole tab (fetch included — it can 403 too) plus skill authoring rides on
+    // `create_skill_assignment` until the backend exposes catalog grants.
+    const canBrowseCatalog = canCreateAssignment;
     // The "Agent Skills" tab pages the assignment list server-side.
     const [agentPage, setAgentPage] = useState(1);
     const { data: assignmentsPage, isLoading: isLoadingAssignments } = useGetMentorSkillAssignmentsQuery({
@@ -259100,7 +259123,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
         mentorUniqueId,
         limit: SKILLS_PAGE_SIZE,
         offset: (agentPage - 1) * SKILLS_PAGE_SIZE,
-    });
+    }, { skip: !canViewAssignments });
     const agentAssignments = (_a = assignmentsPage === null || assignmentsPage === void 0 ? void 0 : assignmentsPage.results) !== null && _a !== void 0 ? _a : [];
     const agentTotalCount = (_b = assignmentsPage === null || assignmentsPage === void 0 ? void 0 : assignmentsPage.count) !== null && _b !== void 0 ? _b : 0;
     const agentTotalPages = Math.max(1, Math.ceil(agentTotalCount / SKILLS_PAGE_SIZE));
@@ -259114,7 +259137,9 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
     const { data: assignmentCoverage } = useGetMentorSkillAssignmentsQuery({
         org: platformKey,
         mentorUniqueId,
-    });
+    }, 
+    // Only powers the catalog tab's "Added" chips — pointless without it.
+    { skip: !canViewAssignments || !canBrowseCatalog });
     const assignedSkillIds = new Set(((_c = assignmentCoverage === null || assignmentCoverage === void 0 ? void 0 : assignmentCoverage.results) !== null && _c !== void 0 ? _c : []).map((a) => a.skill));
     // The "Available skills" tab pages the catalog server-side. Deliberately
     // unfiltered: disabled skills stay listed (switch off) so admins can
@@ -259124,7 +259149,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
         org: platformKey,
         limit: SKILLS_PAGE_SIZE,
         offset: (catalogPage - 1) * SKILLS_PAGE_SIZE,
-    });
+    }, { skip: !canBrowseCatalog });
     const catalogSkills = (_d = catalogSkillsPage === null || catalogSkillsPage === void 0 ? void 0 : catalogSkillsPage.results) !== null && _d !== void 0 ? _d : [];
     const catalogTotalCount = (_e = catalogSkillsPage === null || catalogSkillsPage === void 0 ? void 0 : catalogSkillsPage.count) !== null && _e !== void 0 ? _e : 0;
     const catalogTotalPages = Math.max(1, Math.ceil(catalogTotalCount / SKILLS_PAGE_SIZE));
@@ -259255,7 +259280,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
             }).unwrap();
             // A private skill only takes effect once assigned, and the Agent Skills
             // tab lists assignments — so attach it to this agent right away.
-            if (form.privateToAgent && (created === null || created === void 0 ? void 0 : created.unique_id)) {
+            if (form.privateToAgent && (created === null || created === void 0 ? void 0 : created.unique_id) && canCreateAssignment) {
                 await createAssignment({
                     org: platformKey,
                     mentorUniqueId,
@@ -259295,7 +259320,10 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
             }).unwrap();
             // Making a skill private to this agent implies it should be usable by
             // it — attach it if it isn't assigned yet.
-            if (!privateLocked && form.privateToAgent && !assignedSkillIds.has(editingSkill.unique_id)) {
+            if (!privateLocked &&
+                form.privateToAgent &&
+                canCreateAssignment &&
+                !assignedSkillIds.has(editingSkill.unique_id)) {
                 await createAssignment({
                     org: platformKey,
                     mentorUniqueId,
@@ -259323,17 +259351,21 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
         }
     };
     const renderBadges = (skill) => (jsxs("span", { className: "flex flex-wrap items-center gap-1", children: [skill.category && (jsx("span", { className: "rounded-full bg-gray-100 px-2 py-0.5 text-[0.625rem] text-gray-500", children: skill.category })), skill.skill_type === 'native' && (jsx("span", { className: "rounded-full bg-purple-50 px-2 py-0.5 text-[0.625rem] text-purple-600", children: t('clawSandboxAgentSkills.nativeBadge') })), skill.is_featured && (jsx("span", { className: "rounded-full bg-amber-50 px-2 py-0.5 text-[0.625rem] text-amber-600", children: t('clawSandboxAgentSkills.featuredBadge') })), skill.mentor === mentorUniqueId && (jsx("span", { className: "rounded-full bg-blue-50 px-2 py-0.5 text-[0.625rem] text-blue-600", children: t('clawSandboxAgentSkills.privateBadge') }))] }));
-    // Agent-tab rows are assignments: their only row action is detaching.
-    const renderAssignmentMenu = (assignment) => (jsxs(DropdownMenu, { children: [jsx(DropdownMenuTrigger, { asChild: true, children: jsx(Button$1, { variant: "ghost", size: "sm", "aria-label": t('clawSandboxAgentSkills.skillActions', { name: assignment.skill_name }), children: jsx(Ellipsis, { className: "h-4 w-4" }) }) }), jsx(DropdownMenuContent, { align: "end", children: jsxs(DropdownMenuItem, { className: "cursor-pointer", onClick: () => handleDetach(assignment), children: [jsx(CircleMinus$1, { className: "mr-2 h-4 w-4" }), t('clawSandboxAgentSkills.removeFromAgent')] }) })] }));
+    // Agent-tab rows are assignments: detaching is their only action, so it's
+    // a direct button (mirroring the catalog's "Add to Agent") rather than a
+    // one-item three-dots menu — hidden entirely without the delete grant.
+    const renderAssignmentRemoveButton = (assignment) => !canDeleteAssignment ? null : (jsxs(Button$1, { variant: "outline", size: "sm", className: "cursor-pointer", disabled: isMutatingAgentSkill, onClick: () => handleDetach(assignment), "aria-label": t('clawSandboxAgentSkills.removeFromAgentLabel', {
+            name: assignment.skill_name,
+        }), children: [jsx(CircleMinus$1, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.removeFromAgent')] }));
     // Catalog rows carry the full skill object: edit/delete where allowed.
     const renderSkillMenu = (skill) => {
         if (!isSkillEditable(skill))
             return null;
         return (jsxs(DropdownMenu, { children: [jsx(DropdownMenuTrigger, { asChild: true, children: jsx(Button$1, { variant: "ghost", size: "sm", "aria-label": t('clawSandboxAgentSkills.skillActions', { name: skill.name }), children: jsx(Ellipsis, { className: "h-4 w-4" }) }) }), jsxs(DropdownMenuContent, { align: "end", children: [jsxs(DropdownMenuItem, { className: "cursor-pointer", onClick: () => openEditSkillDialog(skill), children: [jsx(Pen, { className: "mr-2 h-4 w-4" }), t('clawSandboxAgentSkills.edit')] }), jsxs(DropdownMenuItem, { variant: "destructive", className: "cursor-pointer", onClick: () => setDeletingSkill(skill), children: [jsx(Trash2, { className: "mr-2 h-4 w-4" }), t('clawSandboxAgentSkills.delete')] })] })] }));
     };
-    return (jsxs("div", { className: "space-y-4", "data-testid": "agent-skills-content", children: [jsxs("div", { className: "flex items-start justify-between gap-4", children: [jsxs("p", { className: "flex items-start gap-2 text-xs text-gray-500", children: [jsx(Info$3, { className: "mt-0.5 h-4 w-4 shrink-0 text-gray-400" }), jsx("span", { children: t('clawSandboxAgentSkills.sessionNote') })] }), jsxs(Button$1, { onClick: openNewSkillDialog, size: "sm", className: "shrink-0 cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.newSkill')] })] }), jsxs(Tabs, { defaultValue: "agent", className: "w-full", children: [jsxs(TabsList, { "aria-label": t('clawSandboxAgentSkills.tabsAriaLabel'), "data-testid": "agent-skills-tabs", children: [jsx(TabsTrigger, { value: "agent", "data-testid": "agent-skills-tab-agent", children: t('clawSandboxAgentSkills.tabAgentSkills') }), jsx(TabsTrigger, { value: "available", "data-testid": "agent-skills-tab-available", children: t('clawSandboxAgentSkills.tabAvailableSkills') })] }), jsx(TabsContent, { value: "agent", className: "space-y-3", children: isLoadingAssignments ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : agentTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noEffectiveSkills') }) })) : (jsxs(Fragment$1, { children: [agentAssignments.map((assignment) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "agent-skill-row", children: [jsx("div", { className: "min-w-0 space-y-1", children: jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: assignment.skill_name }), assignment.skill_slug && (jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["/", assignment.skill_slug] }))] }) }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [jsx(Switch, { checked: assignment.enabled, onCheckedChange: (checked) => handleToggleAssignment(assignment, checked), disabled: isMutatingAgentSkill, className: "cursor-pointer data-[state=checked]:bg-blue-500", "aria-label": t(assignment.enabled
+    return (jsxs("div", { className: "space-y-4", "data-testid": "agent-skills-content", children: [jsxs("div", { className: "flex items-start justify-between gap-4", children: [jsxs("p", { className: "flex items-start gap-2 text-xs text-gray-500", children: [jsx(Info$3, { className: "mt-0.5 h-4 w-4 shrink-0 text-gray-400" }), jsx("span", { children: t('clawSandboxAgentSkills.sessionNote') })] }), canBrowseCatalog && (jsxs(Button$1, { onClick: openNewSkillDialog, size: "sm", className: "shrink-0 cursor-pointer bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: [jsx(Plus, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.newSkill')] }))] }), jsxs(Tabs, { defaultValue: "agent", className: "w-full", children: [jsxs(TabsList, { "aria-label": t('clawSandboxAgentSkills.tabsAriaLabel'), "data-testid": "agent-skills-tabs", children: [jsx(TabsTrigger, { value: "agent", "data-testid": "agent-skills-tab-agent", children: t('clawSandboxAgentSkills.tabAgentSkills') }), canBrowseCatalog && (jsx(TabsTrigger, { value: "available", "data-testid": "agent-skills-tab-available", children: t('clawSandboxAgentSkills.tabAvailableSkills') }))] }), jsx(TabsContent, { value: "agent", className: "space-y-3", children: isLoadingAssignments ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : agentTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noEffectiveSkills') }) })) : (jsxs(Fragment$1, { children: [agentAssignments.map((assignment) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "agent-skill-row", children: [jsx("div", { className: "min-w-0 space-y-1", children: jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: assignment.skill_name }), assignment.skill_slug && (jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["/", assignment.skill_slug] }))] }) }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [jsx(Switch, { checked: assignment.enabled, onCheckedChange: (checked) => handleToggleAssignment(assignment, checked), disabled: isMutatingAgentSkill || !canWriteAssignment, className: "cursor-pointer data-[state=checked]:bg-blue-500", "aria-label": t(assignment.enabled
                                                         ? 'clawSandboxAgentSkills.skillEnabledLabel'
-                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: assignment.skill_name }) }), renderAssignmentMenu(assignment)] })] }, assignment.id))), jsx(IblPagination, { currentPage: agentPage, totalPages: agentTotalPages, onPageChange: setAgentPage, disabled: isMutatingAgentSkill })] })) }), jsx(TabsContent, { value: "available", className: "space-y-3", children: isLoadingCatalog ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : catalogTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noSkillsAvailable') }) })) : (jsxs(Fragment$1, { children: [catalogSkills.map((skill) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "available-skill-row", children: [jsxs("div", { className: "min-w-0 space-y-1", children: [jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: skill.name }), jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["v", skill.version] }), renderBadges(skill)] }), skill.description && (jsx("p", { className: "line-clamp-2 text-xs text-gray-500", children: skill.description }))] }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [isCoveredByAgent(skill) ? (jsx("span", { className: "rounded-full bg-green-50 px-2 py-0.5 text-xs text-green-700", children: t('clawSandboxAgentSkills.addedBadge') })) : isOtherAgentsPrivate(skill) ? (
+                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: assignment.skill_name }) }), renderAssignmentRemoveButton(assignment)] })] }, assignment.id))), jsx(IblPagination, { currentPage: agentPage, totalPages: agentTotalPages, onPageChange: setAgentPage, disabled: isMutatingAgentSkill })] })) }), canBrowseCatalog && (jsx(TabsContent, { value: "available", className: "space-y-3", children: isLoadingCatalog ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.loadingSkills') })] })) : catalogTotalCount === 0 ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: t('clawSandboxAgentSkills.noSkillsAvailable') }) })) : (jsxs(Fragment$1, { children: [catalogSkills.map((skill) => (jsxs("div", { className: "flex items-center justify-between gap-4 rounded-lg border p-4", "data-testid": "available-skill-row", children: [jsxs("div", { className: "min-w-0 space-y-1", children: [jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [jsx("span", { className: "text-sm font-medium text-gray-700", children: skill.name }), jsxs("span", { className: "hidden text-xs text-gray-400 sm:inline", children: ["v", skill.version] }), renderBadges(skill)] }), skill.description && (jsx("p", { className: "line-clamp-2 text-xs text-gray-500", children: skill.description }))] }), jsxs("div", { className: "flex shrink-0 items-center gap-2", children: [isCoveredByAgent(skill) ? (jsx("span", { className: "rounded-full bg-green-50 px-2 py-0.5 text-xs text-green-700", children: t('clawSandboxAgentSkills.addedBadge') })) : isOtherAgentsPrivate(skill) ? (
                                                 // Another agent's private skill: Add stays visible but
                                                 // disabled, with the reason on hover/focus.
                                                 jsx(TooltipProvider, { children: jsxs(Tooltip$1, { children: [jsx(TooltipTrigger, { asChild: true, children: jsx("span", { tabIndex: 0, children: jsxs(Button$1, { variant: "outline", size: "sm", disabled: true, "aria-label": t('clawSandboxAgentSkills.addToAgentLabel', {
@@ -259342,7 +259374,7 @@ function AgentSkills({ platformKey, mentorUniqueId }) {
                                                         name: skill.name,
                                                     }), children: [jsx(Plus, { className: "h-4 w-4" }), t('clawSandboxAgentSkills.addToAgent')] })), isSkillEditable(skill) && (jsx(Switch, { checked: skill.enabled, onCheckedChange: (checked) => handleToggleSkill(skill, checked), disabled: isUpdatingSkill, className: "cursor-pointer data-[state=checked]:bg-blue-500", "aria-label": t(skill.enabled
                                                         ? 'clawSandboxAgentSkills.skillEnabledLabel'
-                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: skill.name }) })), renderSkillMenu(skill)] })] }, skill.id))), jsx(IblPagination, { currentPage: catalogPage, totalPages: catalogTotalPages, onPageChange: setCatalogPage, disabled: isMutatingAgentSkill })] })) })] }), jsx(OverlayModal, { open: showNewDialog, onClose: closeAllDialogs, title: t('clawSandboxAgentSkills.newSkillDialogTitle'), className: "max-w-2xl", children: jsxs("div", { className: "flex h-[min(75dvh,46rem)] flex-col", children: [jsxs("div", { className: "flex-1 space-y-4 overflow-y-auto pb-4 pr-1", children: [jsx(SkillForm, { form: form, onChange: setForm }), jsx("p", { className: "text-xs text-gray-500", children: t('clawSandboxAgentSkills.filesAfterCreateHint') })] }), jsxs("div", { className: "flex justify-end gap-2 border-t pt-4", children: [jsx(Button$1, { variant: "outline", onClick: closeAllDialogs, children: t('clawSandboxAgentSkills.cancel') }), jsx(Button$1, { onClick: handleCreateSkill, disabled: isCreatingSkill || !form.name || !form.slug, className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: isCreatingSkill
+                                                        : 'clawSandboxAgentSkills.skillDisabledLabel', { name: skill.name }) })), renderSkillMenu(skill)] })] }, skill.id))), jsx(IblPagination, { currentPage: catalogPage, totalPages: catalogTotalPages, onPageChange: setCatalogPage, disabled: isMutatingAgentSkill })] })) }))] }), jsx(OverlayModal, { open: showNewDialog, onClose: closeAllDialogs, title: t('clawSandboxAgentSkills.newSkillDialogTitle'), className: "max-w-2xl", children: jsxs("div", { className: "flex h-[min(75dvh,46rem)] flex-col", children: [jsxs("div", { className: "flex-1 space-y-4 overflow-y-auto pb-4 pr-1", children: [jsx(SkillForm, { form: form, onChange: setForm }), jsx("p", { className: "text-xs text-gray-500", children: t('clawSandboxAgentSkills.filesAfterCreateHint') })] }), jsxs("div", { className: "flex justify-end gap-2 border-t pt-4", children: [jsx(Button$1, { variant: "outline", onClick: closeAllDialogs, children: t('clawSandboxAgentSkills.cancel') }), jsx(Button$1, { onClick: handleCreateSkill, disabled: isCreatingSkill || !form.name || !form.slug, className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: isCreatingSkill
                                         ? t('clawSandboxAgentSkills.creating')
                                         : t('clawSandboxAgentSkills.create') })] })] }) }), jsx(OverlayModal, { open: !!editingSkill, onClose: closeAllDialogs, title: t('clawSandboxAgentSkills.editSkillDialogTitle'), className: "max-w-2xl", children: jsxs(Tabs, { defaultValue: "details", className: "w-full", children: [jsxs(TabsList, { "aria-label": t('clawSandboxAgentSkills.editSkillDialogTitle'), "data-testid": "skill-dialog-tabs", children: [jsx(TabsTrigger, { value: "details", "data-testid": "skill-dialog-tab-details", children: t('clawSandboxAgentSkills.detailsTab') }), jsx(TabsTrigger, { value: "files", "data-testid": "skill-dialog-tab-files", children: t('clawSandboxAgentSkills.filesTab') })] }), jsx(TabsContent, { value: "details", children: jsxs("div", { className: "flex h-[min(75dvh,46rem)] flex-col", children: [jsx("div", { className: "flex-1 space-y-4 overflow-y-auto pb-4 pr-1", children: jsx(SkillForm, { form: form, onChange: setForm, privateLocked: !!editingSkill && isOtherAgentsPrivate(editingSkill) }) }), jsxs("div", { className: "flex justify-end gap-2 border-t pt-4", children: [jsx(Button$1, { variant: "outline", onClick: closeAllDialogs, children: t('clawSandboxAgentSkills.cancel') }), jsx(Button$1, { onClick: handleUpdateSkill, disabled: isUpdatingSkill || !form.name || !form.slug, className: "bg-gradient-to-r from-[#2563EB] to-[#93C5FD] text-white hover:opacity-90", children: isUpdatingSkill
                                                     ? t('clawSandboxAgentSkills.saving')
@@ -261773,6 +261805,14 @@ function ChatInputForm({ onSubmit, onScreenSharingClick, isScreenSharingModalOpe
         ? checkRbacPermission(rbacPermissions, `/mentors/${mentorDbId}/#chat`)
         : true; // Default to true if mentor ID not available or RBAC data not loaded
     const isChatDisabledByRbac = !hasChatPermission;
+    // Listing an agent's skills is a separate, stricter grant than chatting:
+    // the per-agent skills endpoint 403s for users without
+    // `view_skill_assignments`, so the `/` picker's fetch stays off until the
+    // mentor's permission check has explicitly granted it (no permission data
+    // loaded means no fetch — chatting never requires this endpoint).
+    const hasSkillAssignmentsPermission = mentorDbId && hasMentorRbacData
+        ? checkRbacPermission(rbacPermissions, `/mentors/${mentorDbId}/#view_skill_assignments`)
+        : false;
     const { FreeTrialDialog, closeModal: closeFreeTrialModal, isModalOpen: isFreeTrialModalOpen, executeWithTrialCheck, } = useShowFreeTrialDialog();
     const embedMode = useEmbedMode();
     const inputValue = useSelector(chatInputSliceSelectors.selectTextareaInput);
@@ -261815,7 +261855,7 @@ function ChatInputForm({ onSubmit, onScreenSharingClick, isScreenSharingModalOpe
     const fetchedSlashSkills = useSlashSkills({
         org: tenantKey,
         mentorUniqueId,
-        enabled: slashSkillsEnabled && !slashSkills,
+        enabled: slashSkillsEnabled && !slashSkills && hasSkillAssignmentsPermission,
         active: slashTokenActive,
     });
     const effectiveSlashSkills = slashSkills !== null && slashSkills !== void 0 ? slashSkills : (slashSkillsEnabled ? fetchedSlashSkills.skills : []);
@@ -268657,7 +268697,7 @@ function PlatformSidebarFooter({ collapsed, config, }) {
  * defined for completeness so adding "Organization" later is a one-line
  * change.
  */
-function PlatformAccountSheet({ tab, onClose, tenantKey, username, email, onInviteClick, mainPlatformKey, authUrl, currentSpa, platformBaseDomain, showGradebookTab = false, }) {
+function PlatformAccountSheet({ tab, onClose, tenantKey, username, email, onInviteClick, mainPlatformKey, authUrl, currentSpa, platformBaseDomain, showGradebookTab = false, onboardingBasePath = '', rbacPermissions = {}, }) {
     const t = useT();
     const open = tab !== null;
     const accountTabTitles = {
@@ -268676,11 +268716,11 @@ function PlatformAccountSheet({ tab, onClose, tenantKey, username, email, onInvi
         advanced: t('platformSidebar.accountDescAdvanced'),
         billing: t('platformSidebar.accountDescBilling'),
     };
-    return (jsx(Dialog, { open: open, onOpenChange: (o) => !o && onClose(), children: jsxs(DialogContent, { className: "mx-auto my-auto flex h-[90vh] w-[95vw] max-w-none flex-col justify-between gap-0 rounded-lg p-0 sm:max-w-7xl", children: [jsxs(DialogHeader, { className: "flex-shrink-0 border-b border-gray-200 p-4 pt-[30px]", children: [jsx(DialogTitle, { className: "text-lg font-medium text-gray-900 dark:text-gray-100", children: tab ? accountTabTitles[tab] : '' }), jsx(DialogDescription, { className: "text-sm leading-relaxed text-gray-600", children: tab ? accountTabDescriptions[tab] : '' })] }), jsxs("div", { className: "min-h-0 flex-1 overflow-y-auto p-6", children: [tab === 'management' && (jsx(Admin, { tenant: tenantKey, onInviteClick: onInviteClick, 
+    return (jsx(Dialog, { open: open, onOpenChange: (o) => !o && onClose(), children: jsxs(DialogContent, { className: "mx-auto my-auto flex h-[90vh] w-[95vw] max-w-none flex-col justify-between gap-0 rounded-lg p-0 sm:max-w-7xl", children: [jsxs(DialogHeader, { className: "flex-shrink-0 border-b border-gray-200 p-4 pt-[30px]", children: [jsx(DialogTitle, { className: "text-lg font-medium text-gray-900 dark:text-gray-100", children: tab ? accountTabTitles[tab] : '' }), jsx(DialogDescription, { className: "text-sm leading-relaxed text-gray-600", children: tab ? accountTabDescriptions[tab] : '' })] }), jsxs("div", { className: "min-h-0 flex-1 overflow-y-auto p-6", children: [tab === 'management' && (jsx(Admin, { onboardingBasePath: onboardingBasePath, tenant: tenantKey, onInviteClick: onInviteClick, 
                             // RBAC is off for this entry point — admin users see every
                             // sub-tab. Tenant-level access is already gated by the
                             // sidebar footer visibility rules.
-                            hasUserTabPermission: true, hasGroupsTabPermission: true, hasRolesTabPermission: true, hasPoliciesTabPermission: true, hasTeamsTabPermission: true, hasAlertsTabPermission: true, hasInviteUserPermission: true, hasCreateTeamPermission: true, enableRbac: false, rbacPermissions: {}, showGradebookTab: showGradebookTab })), tab === 'integrations' && jsx(IntegrationsTab, { tenantKey: tenantKey, username: username }), tab === 'billing' && (jsx(BillingTab, { tenant: tenantKey, username: username, mainPlatformKey: mainPlatformKey, currentUserEmail: email })), tab === 'monetization' && jsx(MonetizationTab, { platformKey: tenantKey, authURL: authUrl }), tab === 'advanced' && (jsx(AdvancedTab, { platformKey: tenantKey, username: username, currentSPA: currentSpa, authURL: authUrl, currentPlatformBaseDomain: platformBaseDomain }))] })] }) }));
+                            hasUserTabPermission: true, hasGroupsTabPermission: true, hasRolesTabPermission: true, hasPoliciesTabPermission: true, hasTeamsTabPermission: true, hasAlertsTabPermission: true, hasInviteUserPermission: true, hasCreateTeamPermission: true, enableRbac: false, rbacPermissions: rbacPermissions, currentSpa: currentSpa, showGradebookTab: showGradebookTab, authSpaUrl: authUrl })), tab === 'integrations' && jsx(IntegrationsTab, { tenantKey: tenantKey, username: username }), tab === 'billing' && (jsx(BillingTab, { tenant: tenantKey, username: username, mainPlatformKey: mainPlatformKey, currentUserEmail: email })), tab === 'monetization' && jsx(MonetizationTab, { platformKey: tenantKey, authURL: authUrl }), tab === 'advanced' && (jsx(AdvancedTab, { platformKey: tenantKey, username: username, currentSPA: currentSpa, authURL: authUrl, currentPlatformBaseDomain: platformBaseDomain }))] })] }) }));
 }
 
 /**
@@ -275151,7 +275191,7 @@ function AgentSkillsTab({ labels: labelsOverride, tenantKey: tenantKeyProp, ment
     return (jsxs(Fragment$1, { children: [jsx("div", { className: "hidden h-[73px] flex-shrink-0 items-center border-b border-gray-200 bg-white p-4 lg:block", children: jsxs("div", { children: [jsx("h3", { className: "mb-1 text-base font-medium text-gray-900", children: labels.header.title }), jsx("p", { className: "text-xs text-gray-700", children: labels.header.description })] }) }), jsx("div", { className: "flex-1 space-y-4 p-3", style: {
                     overflowY: 'auto',
                     overflowX: 'hidden',
-                }, children: isSettingsLoading || !mentorUniqueId ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: labels.loading })] })) : knownNotBaseAgent ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: labels.notBaseAgent }) })) : (jsx(AgentSkills, { platformKey: tenantKey, mentorUniqueId: mentorUniqueId })) })] }));
+                }, children: isSettingsLoading || !mentorUniqueId ? (jsxs("div", { className: "flex items-center gap-2 p-4", role: "status", children: [jsx(LoaderCircle, { className: "h-4 w-4 animate-spin text-blue-500" }), jsx("span", { className: "text-sm text-gray-500", children: labels.loading })] })) : knownNotBaseAgent ? (jsx("div", { className: "flex items-center justify-center rounded-lg border p-6", children: jsx("p", { className: "text-sm text-gray-500", children: labels.notBaseAgent }) })) : (jsx(AgentSkills, { platformKey: tenantKey, mentorUniqueId: mentorUniqueId, mentorDbId: settings === null || settings === void 0 ? void 0 : settings.mentor_id })) })] }));
 }
 
 const AGENT_GRADER_TAB_LABELS = {

package/dist/web-utils/playwright/agent-skills-helpers.d.ts

@@ -55,15 +55,17 @@ export declare function addSkillToAgent(page: Page, skillName: string): Promise<
  */
 export declare function verifySkillAdded(page: Page, skillName: string): Promise<void>;
 /**
- * Open the three-dots actions menu for a skill row on the active sub-tab.
- * Agent-tab rows offer "Remove from Agent" only; catalog rows offer
- * Edit/Delete (for editable skills). The menu content portals to
- * document.body, so the returned locator is page-level by design.
+ * Open the three-dots actions menu for a CATALOG skill row (Edit/Delete on
+ * editable skills). Agent-tab rows have no menu — detaching is a direct
+ * "Remove" button there (see `removeSkillFromAgent`). The menu content
+ * portals to document.body, so the returned locator is page-level by design.
  */
 export declare function openSkillActionsMenu(page: Page, skillName: string): Promise<Locator>;
 /**
- * Detach a skill from the agent via its row menu ("Remove from Agent") on the
- * "Agent Skills" sub-tab. Waits for the toast and for the row to disappear.
+ * Detach a skill from the agent via its row's direct "Remove" button on the
+ * "Agent Skills" sub-tab (the visible text is just "Remove"; the button's
+ * accessible name carries the skill, mirroring the catalog's Add button).
+ * Waits for the toast confirming the detach.
  */
 export declare function removeSkillFromAgent(page: Page, skillName: string): Promise<void>;
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iblai/iblai-js",
-  "version": "2.7.4",
+  "version": "2.7.6",
   "description": "Unified JavaScript SDK for IBL.ai — re-exports data-layer, web-containers, and web-utils under a single package",
   "type": "module",
   "engines": {
@@ -77,8 +77,8 @@
     "dotenv": "16.6.1",
     "winston": "3.19.0",
     "@iblai/data-layer": "1.13.0",
-    "@iblai/mcp": "1.12.1",
-    "@iblai/web-containers": "1.19.2",
+    "@iblai/mcp": "1.12.2",
+    "@iblai/web-containers": "1.19.4",
     "@iblai/web-utils": "2.2.2"
   },
   "peerDependencies": {