From be1ae9338ba1756be178dde5098d6d088512abef Mon Sep 17 00:00:00 2001
From: Nicholas Ciechanowski <nicholas@ciech.anow.ski>
Date: Sun, 28 Jun 2026 20:58:13 +1000
Subject: [PATCH] fix(distributed): missing agent NATS permissions (#10571)

Signed-off-by: Nicholas Ciechanowski <nicholas@ciech.anow.ski>
---
 pkg/natsauth/permissions.go | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/pkg/natsauth/permissions.go b/pkg/natsauth/permissions.go
index 03a5a79c8..d44e51990 100644
--- a/pkg/natsauth/permissions.go
+++ b/pkg/natsauth/permissions.go
@@ -20,6 +20,8 @@ func WorkerPermissions(nodeID, nodeType string) (pubAllow, subAllow []string) {
 		subAllow = []string{
 			"agent.execute",
 			"agent.*.cancel",
+			"gallery.*.cancel",
+			"gallery.*.progress",
 			"jobs.*.cancel",
 			"jobs.*.progress",
 			"jobs.*.result",
@@ -27,6 +29,7 @@ func WorkerPermissions(nodeID, nodeType string) (pubAllow, subAllow []string) {
 			"mcp.tools.execute",
 			"mcp.discovery",
 			prefix + ".backend.stop", // stop events drive MCP session cleanup
+			"staging.*.progress",
 			"_INBOX.>",
 		}
 		pubAllow = []string{