Repository navigation
🧩 feat: Add Skill Creation and File Deletion to Management API - #16878
Conversation
There was a problem hiding this comment.
🟡 Changes recommended
File deletion can return success before storage cleanup completes or fails.
1 open finding
What changed in this PR
Completes machine-authenticated Skill CRUD by adding creation and deletion operations while reusing existing validation, authorization, and cleanup handlers.
Changes:
- Adds create, Skill-delete, and file-delete management endpoints.
- Extends OpenAPI schemas and documentation.
- Adds authorization, validation, persistence, and contract tests.
| File | Description |
|---|---|
packages/api/src/skills/management.ts |
Implements management adapters and authorization. |
packages/api/src/skills/management.spec.ts |
Tests CRUD behavior and permissions. |
packages/api/src/openapi/skills.ts |
Defines new endpoint contracts. |
packages/api/openapi/agents.openapi.json |
Updates generated OpenAPI output. |
docs/skills-management-api.md |
Documents the completed CRUD surface. |
api/server/routes/agents/skills.js |
Registers the new routes. |
api/server/routes/agents/__tests__/skills.spec.js |
Updates route wiring fixtures. |
api/server/routes/agents/__tests__/openapi.contract.spec.js |
Adds end-to-end contract coverage. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
|
@codex review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 58f1d675d1
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 04a030bbb8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
04a030b to
5d5c222
Compare
dustinhealy
changed the title
|
@codex review |
|
Codex Review: Didn't find any major issues. You're on a roll. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
codegraph-librechat
Bot
added
the
🗺️ Skills UI
5d5c222 to
db60050
Compare
|
@codex review |
|
Codex Review: Didn't find any major issues. Chef's kiss. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
db60050 to
66deb8c
Compare
Summary
The machine-authenticated Skill management API supports reading and updating Skills and creating or replacing text files, but it cannot create Skills or delete obsolete files.
This PR adds Skill creation and Skill-file deletion to the versioned management API. The endpoints retain the existing tenant, role, capability, ACL, content-source, and cleanup boundaries. Whole-Skill deletion is intentionally out of scope until it has a durable cleanup design that protects all writers and supports retries after partial failure.
How it works
The management adapters validate and project the versioned wire contract, then reuse the existing browser Skill handlers for creation, permission grants, rollback, and file cleanup. Mutating operations uniformly require the Skills USE/CREATE role permissions; file deletion checks EDIT access. Git-synchronized and deployment-provided Skills remain read-only.
Type of change
Testing
Tested environments/configuration:
Automated tests:
npm exec --workspace=packages/api -- jest --runInBand --coverage=false src/skills/management.spec.ts(41 passing)npm exec --workspace=packages/api -- jest --runInBand --coverage=false src/skills/handlers.spec.ts src/storage/local-delete.spec.ts src/storage/ownedBlobDelete.spec.ts(21 passing)npm exec --workspace=packages/data-schemas -- jest --runInBand --coverage=false src/methods/skill.spec.ts(125 passing)npm exec --workspace=api -- jest --runInBand --coverage=false server/routes/agents/__tests__/openapi.contract.spec.js server/routes/skills.test.js server/services/Files/Azure/crud.spec.js server/services/Files/Local/__tests__/crud-traversal.spec.js server/services/Files/Local/__tests__/cache-bust.spec.js(75 passing)npm exec --workspace=packages/api -- tsc --noEmitnpm exec --workspace=packages/data-schemas -- tsc --noEmitnpm run openapi:check --workspace=packages/apigit diff --checkScreenshots / recordings
No user-facing change.
Risk / compatibility
The API additions are backward-compatible. File deletion now waits for storage cleanup before removing metadata, which can increase request latency; a storage failure leaves the metadata available for retry, and revision matching preserves a concurrently replaced file. Local, Azure, and Firebase deletion use the persisted file owner rather than the acting manager while retaining strict owner-namespace validation. The existing JSON PUT contract remains limited to UTF-8 text files up to 1 MiB; this PR does not add multipart or raw binary transfer. All writes remain limited to inline Skills in the authenticated tenant.
Checklist