From 90b1e4df27266f2376f39935bad8a51afc3e1e43 Mon Sep 17 00:00:00 2001
From: Nicholas Ciechanowski <nicholas@ciech.anow.ski>
Date: Sun, 28 Jun 2026 15:03:36 +1000
Subject: [PATCH] fix(distributed): missing agent NATS permissions

Signed-off-by: Nicholas Ciechanowski <nicholas@ciech.anow.ski>
---
 pkg/natsauth/permissions.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/natsauth/permissions.go b/pkg/natsauth/permissions.go
index 03a5a79c8d3b..d44e51990480 100644
--- a/pkg/natsauth/permissions.go
+++ b/pkg/natsauth/permissions.go
@@ -20,6 +20,8 @@ func WorkerPermissions(nodeID, nodeType string) (pubAllow, subAllow []string) {
 		subAllow = []string{
 			"agent.execute",
 			"agent.*.cancel",
+			"gallery.*.cancel",
+			"gallery.*.progress",
 			"jobs.*.cancel",
 			"jobs.*.progress",
 			"jobs.*.result",
@@ -27,6 +29,7 @@ func WorkerPermissions(nodeID, nodeType string) (pubAllow, subAllow []string) {
 			"mcp.tools.execute",
 			"mcp.discovery",
 			prefix + ".backend.stop", // stop events drive MCP session cleanup
+			"staging.*.progress",
 			"_INBOX.>",
 		}
 		pubAllow = []string{