feat(skills): add skill editors by icecrasher321 · Pull Request #5705 · simstudioai/sim

icecrasher321 · 2026-07-16T08:10:02Z

Summary

Adds way to set skill editors so only certain people can edit skills. Derived access to skills applies (so workspace, org admins are always skill editors for all skills in the workspace.

Type of Change

New feature

Testing

Tested manually

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts: # scripts/check-api-validation-contracts.ts

Same DDL as the dropped 0261 (skill_member table, enums, indexes, skill.workspace_shared) plus the hand-written write-user backfill, renumbered after staging's 0261. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel · 2026-07-16T08:10:11Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 24, 2026 1:15am

# Conflicts: # apps/sim/app/api/mothership/execute/route.ts # apps/sim/executor/handlers/agent/skills-resolver.test.ts # apps/sim/lib/copilot/chat/payload.ts # apps/sim/lib/copilot/chat/process-contents.test.ts # apps/sim/lib/copilot/chat/process-contents.ts # apps/sim/lib/copilot/vfs/workspace-vfs.ts # apps/sim/lib/mothership/inbox/executor.ts # apps/sim/lib/mothership/skills.test.ts # apps/sim/lib/mothership/skills.ts # packages/db/migrations/meta/0262_snapshot.json # packages/db/migrations/meta/_journal.json # scripts/check-api-validation-contracts.ts

Staging claimed 0262 (strong_storm); same DDL plus the hand-written write-user backfill, renumbered on the merged snapshot chain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts: # scripts/check-api-validation-contracts.ts

Staging claimed 0263 (workflow_fork_sync_excluded); same DDL plus the hand-written write-user backfill, renumbered on the merged snapshot chain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

cursor · 2026-07-18T21:13:17Z

PR Summary

Medium Risk
Skill create/update/delete authorization changes affect all workspace skill mutations and member removal now deletes editor grants; behavior is intentional but worth regression-testing non-editor writers and admin member removal.

Overview
Introduces skill editors: workspace members can see and run every skill, but only explicit editors (plus workspace admins) can edit, delete, or manage the editors list. New GET/POST/DELETE on /api/skills/[id]/members handles the roster with audit/analytics; skill POST/DELETE now enforce editor access for updates while creation still needs workspace write, and the creator gets an editor row on insert.

Skills UX moves off the gallery modal onto dedicated routes (/skills/new, /skills/[skillId]) with Share, unsaved-changes guards, and a Skill Editors section. Legacy ?skillId= links redirect to the detail page. Import drops the GitHub fetch API and modal GitHub flow in favor of shared .md/.zip handling; name conflicts surface as 409 inline errors.

Shared permissions chrome (AddPeopleModal, MemberRow, role options) replaces duplicated credential “add people” UI and backs skill sharing. Leaving a workspace (user or admin APIs) now clears skill_member rows via removeWorkspaceSkillMembershipsTx.

Custom tools in workspace settings get a deep-linkable detail sub-view (custom-tool-id) and extracted schema/code editor pieces (wand generation, validation) aligned with the canvas modal. RichMarkdownField grows with content on full pages and only self-scrolls when maxHeight is set.

Docs add Skill Editors, Chat / skills, and updated FAQs. Mothership execute reuses assertActiveWorkspaceAccess for permission instead of a separate lookup.

^{Reviewed by Cursor Bugbot for commit b80502d. Configure here.}

greptile-apps · 2026-07-18T21:15:24Z

Greptile Summary

This PR adds per-skill permissions and a new skill management page. The main changes are:

Admin and Member roles with workspace-derived access and explicit deny markers.
Permission checks across APIs, workflows, Copilot, VFS, and agent execution.
Member-management APIs, hooks, shared controls, and a full-page skill editor.
Database schema changes and an idempotent access backfill.

Confidence Score: 4/5

Agent execution can bypass skill permissions when its enforcement flag is false or absent.

API and membership paths consistently apply the new permission model.
The agent resolver treats a missing enforcement scope as unrestricted access.
Restricted skill content can reach affected non-interactive runs.

apps/sim/executor/handlers/agent/skills-resolver.ts and its execution callers

Security Review

Skill checks fail open when agent execution omits or disables the credential-enforcement flag. Affected runs can load restricted skill metadata and content.

Important Files Changed

Filename	Overview
apps/sim/lib/skills/access.ts	Adds effective role resolution, explicit grants and denies, member listing, update checks, and workspace-removal cleanup.
apps/sim/app/api/skills/[id]/members/route.ts	Adds authenticated member listing, grants, role changes, removals, and transactional last-admin protection.
apps/sim/app/api/skills/route.ts	Adds skill visibility and administrator checks to list, update, and delete operations.
apps/sim/executor/handlers/agent/skills-resolver.ts	Makes skill permission filtering conditional, leaving executions without the enforcement flag unrestricted.
packages/db/migrations/0264_tough_steel_serpent.sql	Adds skill sharing and membership storage with an idempotent access backfill.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Agent execution] --> B{actor.enforce is true}
  B -- Yes --> C[Load user skill access]
  C --> D[Filter skills with canUseSkill]
  B -- No or unset --> E[Return no access context]
  E --> F[Skip skill permission checks]
  F --> G[Restricted skill content can load]

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
  A[Agent execution] --> B{actor.enforce is true}
  B -- Yes --> C[Load user skill access]
  C --> D[Filter skills with canUseSkill]
  B -- No or unset --> E[Return no access context]
  E --> F[Skip skill permission checks]
  F --> G[Restricted skill content can load]

_{Reviews (1): Last reviewed commit: "fix lint" | Re-trigger Greptile}

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts: # apps/sim/executor/handlers/pi/pi-handler.ts # apps/sim/lib/copilot/vfs/workspace-vfs.ts # scripts/check-api-validation-contracts.ts

Staging claimed 0264 (fat_ikaris); same DDL plus the hand-written write-user backfill, renumbered on the merged snapshot chain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

# Conflicts: # apps/sim/executor/handlers/agent/skills-resolver.test.ts # apps/sim/lib/workflows/skills/operations.test.ts # scripts/check-api-validation-contracts.ts

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

…e-check better-auth 1.6.23 and fumadocs-mdx resolve ^4.3.6 to a nested zod 4.4.3, which makes @sim/auth's inferred betterAuth types non-portable (TS2883) and split docs onto a second zod instance. Both ranges accept the repo-wide pinned 4.3.6, so a single hoisted copy satisfies everything. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Moves the rich-markdown and custom-tool editing surfaces out of modals and onto full-page surfaces, and collapses the duplicated chrome behind shared components. Skills - Add /skills/new, a full-page create surface mirroring the skill detail page (CredentialDetailLayout + DetailSection + unsaved-changes guard). "Add to Sim" navigates there instead of opening a modal. - Import moves to a header action (SkillImportButton) backed by a shared readSkillFile helper; the GitHub-URL import and its /api/skills/import route are removed. - Skill name validation is now one shared validateSkillName, replacing three copies of the kebab-case rule and its messages. - The skill editor roster renders through the shared MemberRow instead of re-deriving its identity block, with a locked role control and a lock-reason tooltip explaining inherited workspace-admin access. Custom tools - Extract the canvas modal's schema/code editors into a shared custom-tool-editor module (fields, wand generation, schema helpers), cutting custom-tool-modal.tsx by ~900 lines. - Settings > Custom tools gains a full-page detail sub-view (SettingsPanel + SettingsSection + saveDiscardActions), deep-linkable via ?custom-tool-id. Rows are clickable; delete now lives only in the detail view. - Replace legacy Button/Input/Badge/Label with the chip family, move chip-field chrome into CodeEditor behind an error prop, and delete its dead wand button. Rich markdown field - maxHeight is now opt-in: omit it on a page and the editor grows with its content so the page owns the only scrollbar. Modals pass explicit caps. - The field variant drops to font-weight 400 to match adjacent chip fields.

waleedlatif1 · 2026-07-24T01:16:09Z

@greptile

waleedlatif1 · 2026-07-24T01:16:13Z

@cursor review

cursor

Cursor Bugbot has reviewed your changes using default effort and found 3 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit b80502d. Configure here.}

cursor · 2026-07-24T01:17:17Z

+      if (isSkillNameConflictError(error)) {
+        toast.error(
+          `"${skill.name}" already exists in this workspace but isn't shared with you — ask a skill admin for access`
+        )


Wrong duplicate skill error text

Medium Severity

On HTTP 409 from creating a suggested skill, the toast says the skill exists but is not shared and to ask a skill admin. Workspace members already see and use every skill; 409 only means the name is taken, not missing access.

^{Reviewed by Cursor Bugbot for commit b80502d. Configure here.}

cursor · 2026-07-24T01:17:17Z

+      })
+      setErrors({})
+      const createdId = created[0]?.id
+      router.push(createdId ? `${skillsHref}/${createdId}` : skillsHref)


Create navigates to wrong skill

Medium Severity

After a successful create, navigation uses the first element of the upsert response array. That list prepends built-in template skills, so the user is often routed to a built-in detail page instead of the skill they just created.

^{Reviewed by Cursor Bugbot for commit b80502d. Configure here.}

cursor · 2026-07-24T01:17:17Z

+      description: 'Added skill editor',
+      metadata: { targetUserId: userId },
+      request,
+    })


Duplicate editor add logs audit

Low Severity

When two requests race to add the same editor, onConflictDoNothing can skip the insert while the handler still emits skill_shared and SKILL_MEMBER_ADDED audit, recording an add that did not happen.

^{Reviewed by Cursor Bugbot for commit b80502d. Configure here.}

icecrasher321 and others added 4 commits July 16, 2026 00:50

feat(skills): permissions layer

ec7058f

chore(db): drop skill_member migration 0261 for regeneration on lates…

df45ee4

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/staging' into staging-v2

4fd444b

# Conflicts: # scripts/check-api-validation-contracts.ts

icecrasher321 and others added 2 commits July 16, 2026 12:12

feat(db): regenerate skill_member migration as 0263 after staging merge

144fab1

Staging claimed 0262 (strong_storm); same DDL plus the hand-written write-user backfill, renumbered on the merged snapshot chain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview July 16, 2026 19:26 View deployment

icecrasher321 and others added 5 commits July 17, 2026 22:26

chore(db): drop skill_member migration 0263 for regeneration on lates…

66eae4b

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/staging' into staging-v2

f59d801

# Conflicts: # scripts/check-api-validation-contracts.ts

feat(db): regenerate skill_member migration as 0264 after staging merge

5c3066a

Staging claimed 0263 (workflow_fork_sync_excluded); same DDL plus the hand-written write-user backfill, renumbered on the merged snapshot chain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

make editing skills full page

d7c6b52

fix disclaimer

8ea35db

vercel Bot temporarily deployed to Preview July 18, 2026 21:06 Inactive

edit access msg

5eb4ce8

vercel Bot temporarily deployed to Preview July 18, 2026 21:08 Inactive

fix lint

6bd6c8f

icecrasher321 marked this pull request as ready for review July 18, 2026 21:13

cursor Bot reviewed Jul 18, 2026

View reviewed changes

Comment thread apps/sim/app/api/skills/[id]/members/route.ts Outdated

greptile-apps Bot reviewed Jul 18, 2026

View reviewed changes

Comment thread apps/sim/executor/handlers/agent/skills-resolver.ts Outdated

vercel Bot deployed to Preview July 18, 2026 21:17 View deployment

icecrasher321 and others added 3 commits July 22, 2026 10:30

chore(db): drop skill_member migration 0264 for regeneration on lates…

0973bf2

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/staging' into staging-v2

3f6f939

# Conflicts: # apps/sim/executor/handlers/pi/pi-handler.ts # apps/sim/lib/copilot/vfs/workspace-vfs.ts # scripts/check-api-validation-contracts.ts

feat(db): regenerate skill_member migration as 0265 after staging merge

e13b7fc

Staging claimed 0264 (fat_ikaris); same DDL plus the hand-written write-user backfill, renumbered on the merged snapshot chain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

icecrasher321 requested a review from a team as a code owner July 22, 2026 17:35

vercel Bot deployed to Preview July 22, 2026 17:40 View deployment

icecrasher321 added 2 commits July 22, 2026 10:50

fix tests

029fa18

simplify system

0ca5549

vercel Bot deployed to Preview July 22, 2026 20:42 View deployment

icecrasher321 added 2 commits July 22, 2026 13:48

fix

ef9ad17

fix lint

5ce3561

icecrasher321 changed the title ~~feat(skills): permissions layer~~ feat(skills): add skill editors Jul 22, 2026

vercel Bot deployed to Preview July 22, 2026 20:54 View deployment

add mship skills docs

6172523

vercel Bot deployed to Preview July 22, 2026 21:00 View deployment

icecrasher321 and others added 4 commits July 23, 2026 00:11

chore(db): drop skill_member migration 0265 for regeneration on lates…

dbbd02d

…t staging Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Merge remote-tracking branch 'origin/staging' into staging-v2

7e51179

# Conflicts: # apps/sim/executor/handlers/agent/skills-resolver.test.ts # apps/sim/lib/workflows/skills/operations.test.ts # scripts/check-api-validation-contracts.ts

feat(db): regenerate skill_member migration as 0266 after staging merge

14d93ca

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

vercel Bot deployed to Preview July 23, 2026 17:14 View deployment

fix lint

ebc2d13

vercel Bot deployed to Preview July 23, 2026 17:32 View deployment

vercel Bot temporarily deployed to Preview July 24, 2026 01:15 Inactive

cursor Bot reviewed Jul 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(skills): add skill editors #5705

feat(skills): add skill editors #5705
icecrasher321 wants to merge 27 commits into
stagingfrom
staging-v2

icecrasher321 commented Jul 16, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 16, 2026 •

edited

Loading

Uh oh!

cursor Bot commented Jul 18, 2026 •

edited

Loading

Uh oh!

greptile-apps Bot commented Jul 18, 2026

Security Review

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 24, 2026

Uh oh!

waleedlatif1 commented Jul 24, 2026

Uh oh!

cursor Bot left a comment

Uh oh!

cursor Bot Jul 24, 2026

Uh oh!

cursor Bot Jul 24, 2026

Uh oh!

cursor Bot Jul 24, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

icecrasher321 commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

greptile-apps Bot commented Jul 18, 2026

Greptile Summary

Confidence Score: 4/5

Security Review

Important Files Changed

Flowchart

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Jul 24, 2026

Uh oh!

waleedlatif1 commented Jul 24, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

cursor Bot Jul 24, 2026

Choose a reason for hiding this comment

Wrong duplicate skill error text

Uh oh!

cursor Bot Jul 24, 2026

Choose a reason for hiding this comment

Create navigates to wrong skill

Uh oh!

cursor Bot Jul 24, 2026

Choose a reason for hiding this comment

Duplicate editor add logs audit

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

icecrasher321 commented Jul 16, 2026 •

edited

Loading

vercel Bot commented Jul 16, 2026 •

edited

Loading

cursor Bot commented Jul 18, 2026 •

edited

Loading