Release: develop → main (GitHub source auto-sync + chrono-bucket downloads)

.changeset/chrono-bucket-download-proxy.md

@@ -0,0 +1,6 @@
+---
+"ornn-api": minor
+"ornn-web": minor
+---
+
+Migrate skill package downloads to chrono-bucket's streaming endpoint (#1196). chrono-bucket (replacing chrono-storage) removed presigned URLs and the object-copy endpoint and now serves downloads via a streaming `GET /objects/download` behind the NyxID proxy. ornn-api's storage client gains a streaming `downloadObject()` (replacing the removed `getPresignedUrl`/`copy`); package reads for diff/json/audit go through it, and a new `GET /skills/:idOrName/versions/:version/download` route streams the ZIP through ornn-api (the route the TS SDK's `downloadPackage()` already targets). The client-facing `presignedPackageUrl` field is dropped from the skill detail response, and the web viewer now pulls packages through that authenticated ornn-api route instead of fetching chrono-bucket / MinIO directly. Also removes the wasted presigned round-trip and dead code in the audit pipeline (#995).

.changeset/fix-manual-cli-frontmatter-yaml.md

@@ -0,0 +1,4 @@
+---
+---
+
+docs(skill): fix `ornn-agent-manual-cli` v1.4 frontmatter — the `description` contained an unquoted `: ` (colon-space) that broke YAML parsing on ingest/refresh, and exceeded the 1024-char cap. Reworded to remove the colon and trimmed to 993 chars; verified against the API's `yaml.parse` + `validateSkillFrontmatter`. Docs-only.

.changeset/gh-source-auth-drift-foundation.md

@@ -0,0 +1,5 @@
+---
+"ornn-api": minor
+---
+
+Add the efficient-read foundation for automatic GitHub source sync (#1175): GitHub source reads can now authenticate with a service-account token (settings section `sourceSync` or `ORNN_SOURCE_SYNC_GITHUB_TOKEN`) and use ETag-conditional requests, a cheap `git/ref` HEAD-SHA drift probe, and a read-only `checkSourceDrift` that records drift state on the skill. No behavior change to existing flows — the manual refresh path simply sends an `Authorization` header when a token is configured.

.changeset/gh-source-auto-publish.md

@@ -0,0 +1,5 @@
+---
+"ornn-api": minor
+---
+
+Add unattended auto-publish for drifted GitHub-sourced skills (#1177): when the `sourceSync.autoPublish` switch is on, the scheduled drift check now automatically re-pulls and publishes a new version of any skill whose upstream moved — no manual trigger. The auto path runs the same validation as a manual refresh, refuses to publish when the `SKILL.md` version wasn't bumped (surfacing "changed but not versioned" instead of clobbering the immutable version), records the new version under a dedicated system actor, and notifies the owner on both success and refusal. Ships off by default.

.changeset/gh-source-auto-sync-ui.md

@@ -0,0 +1,5 @@
+---
+"ornn-web": minor
+---
+
+Surface automatic GitHub source-sync status in the UI (#1178): the skill detail page now shows a passive badge driven by the source's drift state — "Auto-synced", "Update in progress", "Upstream changed — version not bumped" (warning), or "Source unavailable" (error) — next to the existing "Synced from GitHub" chip and in the advanced GitHub-link panel, so owners see what auto-sync did without polling. The `skill.auto_synced` / `skill.auto_sync_failed` / `skill.source_broken` notifications render with proper labels, and opening a skill opportunistically refreshes a stale drift state once (no polling loop). The GET skill response now includes the drift fields that drive this (ornn-api).

.changeset/gh-source-drift-scheduler.md

@@ -0,0 +1,5 @@
+---
+"ornn-api": minor
+---
+
+Add the scheduled GitHub source drift-check job (#1176): a multi-pod-safe Agenda scheduler periodically probes every GitHub-sourced skill's upstream (coalescing skills that share a repo/ref into one request), records whether it has drifted, and notifies the owner when a source repo becomes unreachable. Cadence is driven by the `sourceSync.pollSchedule` setting; the job honors GitHub rate limits and never lets one skill's failure abort the run. It only records drift state — automatic re-publish is a later change.

.changeset/ornn-manual-cli-skillset-refresh.md

@@ -0,0 +1,10 @@
+---
+---
+
+docs(skill): refresh the `ornn-agent-manual-cli` skill to v1.4.
+
+- Trigger-oriented frontmatter `description` so Claude Code reliably auto-invokes the skill (covers skills **and** skillsets, plugin export, ownership transfer, etc.).
+- Full skillset lifecycle across `SKILL.md` §2.16 and `api-reference.md` §5a: remove the phantom `PUT /skillsets/:id/permissions`, add plugin-export + transfer-ownership, document derived visibility, auto-revision, the real response/closure shapes, and the error-code table.
+- Broader api-reference drift fixed against current `ornn-api`: skill transfer-ownership + dist-tags, assistant SSE, manifest JSON Schema, public/admin `github/repo` mirror coords, launch-promo, the per-model `assistant` surface flags, and the phantom `ornn:quota:admin` scope (real scope is `ornn:admin:skill`).
+
+Docs-only: no `ornn-api` / `ornn-web` runtime change (the skill is registry-sourced, not bundled into either package image). The skill's own registry version bumps 1.3 → 1.4; publishing the refreshed content to the live registry is a separate operational step.

.changeset/raise-skill-description-cap.md

@@ -0,0 +1,6 @@
+---
+"ornn-api": patch
+"ornn-web": patch
+---
+
+Raise the skill frontmatter `description` cap from 1024 to 1536 characters, aligned with Claude Code's skill-listing truncation limit (`skillListingMaxDescChars`, default 1536) — so an author can write a description as rich as the runtime actually uses for auto-invocation routing, instead of relying on `skip_validation` to smuggle a longer one past the schema. Skillset descriptions are unchanged (still 1024).

.changeset/release-notes-20260707.md

@@ -0,0 +1,2 @@
+---
+---

.github/release-notes-20260707.md

@@ -0,0 +1,14 @@
+## Fixed
+
+- Few technical bugs fixed.
+
+## New Feature
+
+- GitHub-sourced skills detect upstream changes and can auto-publish.
+- Skill detail page shows GitHub source sync status.
+- Technical enhancement.
+
+## Changed
+
+- Skill package downloads move to a streaming API route.
+- Skill description limit raised from 1024 to 1536 characters.

docs/ARCHITECTURE.md

@@ -46,6 +46,8 @@ so dashboards can disambiguate from frontend events of the same name):
 | `skill.visibility_changed` / `.permissions_changed` | visibility + sharing flips | `skillId`, `isPrivate`, `sharedWithUsers`, `sharedWithOrgs`, `writeGrants` (count of `write` grants, #1123) |
 | `skill.ownership_transferred` | ownership handed to another user (#1123) | `skillId`, `skillName`, `priorOwnerId`, `newOwnerId` |
 | `skill.refresh` / `.source_linked` / `.source_unlinked` | source-pointer ops | `skillId`, `repo`, `ref`, `commit` |
+| `skill.source_drift_detected` | scheduled drift check found upstream moved (#1176/#1177) | `skillId`, `repo`, `ref`, `upstreamHeadSha` |
+| `skill.auto_synced` / `.auto_sync_failed` | unattended auto-publish outcome (#1177) | `skillId`, `fromVersion`, `toVersion` / `reason` |
 | `skill.nyxid_service_tied` / `.agentseal_rescanned` | tie + admin-rescan | `skillId`, `isSystemSkill`, `score` |
 | `settings.exported` / `.imported` | settings IO | `schemaVersion`, `aggregateStatus`, `dryRun`, `sections` |
 

ornn-api/src/bootstrap.ts

@@ -109,6 +109,11 @@ import {
   createMirrorScheduler,
   type MirrorScheduler,
 } from "./domains/skills/mirror/scheduler";
+import {
+  createSourceSyncScheduler,
+  type SourceSyncScheduler,
+} from "./domains/skills/crud/sourceSyncScheduler";
+import { runSourceDriftJob } from "./domains/skills/crud/sourceDriftJob";
 
 // Domain: Me (caller-scoped endpoints)
 import { createMeRoutes } from "./domains/me/routes";
@@ -487,6 +492,10 @@ export async function bootstrap(
     maxEntryUncompressedBytes: config.maxEntryUncompressedBytes,
     maxPackageFileCount: config.maxPackageFileCount,
     maxCompressionRatio: config.maxCompressionRatio,
+    // Source-sync (#1175): authenticate GitHub source reads. The settings
+    // token wins; the env token is the fallback.
+    sourceSyncSettings: settingsService,
+    sourceSyncGithubTokenFallback: config.sourceSyncGithubToken,
   });
 
   // ---- Domain: Notifications + Broadcasts ----
@@ -544,9 +553,6 @@ export async function bootstrap(
   const auditService = new AuditService({
     auditRepo,
     skillService,
-    storageClient,
-    storageBucketResolver: async () =>
-      (await settingsService.getNyxid()).chronoStorageBucket,
     llmClient: nyxLlmClient,
     defaultsResolver: async () => resolveAuditDefaults(),
     // Audits are re-run automatically when the cached record ages past
@@ -780,6 +786,43 @@ export async function bootstrap(
     mirrorScheduler,
   });
 
+  // In-process source-drift scheduler (#1176/#1177). Same multi-pod-safe
+  // Agenda pattern as the mirror scheduler; cadence driven by
+  // `settings.sourceSync.pollSchedule`. Detects when a GitHub-sourced skill's
+  // upstream moved, records drift state, and — when `sourceSync.autoPublish`
+  // is on — auto-publishes the new version. A start failure logs and leaves
+  // this pod without the scheduled scan rather than crashing boot.
+  let sourceSyncScheduler: SourceSyncScheduler | null = null;
+  try {
+    sourceSyncScheduler = createSourceSyncScheduler({
+      db,
+      logger,
+      settingsService,
+      runDriftJob: () =>
+        runSourceDriftJob({
+          skillRepo,
+          settingsService,
+          envTokenFallback: config.sourceSyncGithubToken,
+          notifier: notificationService,
+          analyticsEmitter,
+          // #1177 — unattended auto-publish of drifted skills when the
+          // sourceSync.autoPublish switch is on.
+          autoPublish: (guid) => skillService.autoPublishFromSource(guid),
+          logger,
+          // Small per-group jitter so a large catalogue spreads its probes
+          // across the tick instead of bursting one egress IP.
+          jitterMs: 250,
+        }),
+    });
+    await sourceSyncScheduler.start();
+  } catch (err) {
+    logger.error(
+      { err: err instanceof Error ? err.message : String(err) },
+      "source-sync scheduler failed to start — scheduled drift checks will not run on this pod",
+    );
+    sourceSyncScheduler = null;
+  }
+
   // Skill routes — sharing is now a direct PUT /permissions write; the
   // audit signal is surfaced as a per-version label, not a gate.
   // #1136 — forward reference: the skill routes fire a reactive skillset
@@ -1130,9 +1173,16 @@ export async function bootstrap(
   // ---- Shutdown ----
   async function shutdown(): Promise<void> {
     logger.info("Shutting down ornn-api...");
-    // Stop the scheduler first so no new mirror reconciles start while
-    // we're tearing the Mongo connection down. `stop()` is idempotent +
-    // already swallows its own errors.
+    // Stop the schedulers first so no new reconciles / drift checks start
+    // while we're tearing the Mongo connection down. `stop()` is idempotent +
+    // already swallows its own errors. Source-sync first, then mirror.
+    if (sourceSyncScheduler) {
+      try {
+        await sourceSyncScheduler.stop();
+      } catch (err) {
+        logger.warn({ err }, "Source-sync scheduler stop failed — continuing");
+      }
+    }
     if (mirrorScheduler) {
       try {
         await mirrorScheduler.stop();

ornn-api/src/clients/storageClient.test.ts

@@ -75,23 +75,40 @@ describe("StorageClient SSRF preflight (#811)", () => {
     expect(fetchCalls).toHaveLength(0);
   });
 
-  it("getPresignedUrl() refuses a rebound host before issuing the request", async () => {
-    await expect(makeClient().getPresignedUrl("b", "k")).rejects.toBeInstanceOf(
+  it("downloadObject() refuses a rebound host before issuing the request", async () => {
+    await expect(makeClient().downloadObject("b", "k")).rejects.toBeInstanceOf(
       SsrfRefusalError,
     );
     expect(fetchCalls).toHaveLength(0);
   });
 
-  it("copy() refuses a rebound host before issuing the request", async () => {
-    await expect(makeClient().copy("b", "s", "d")).rejects.toBeInstanceOf(SsrfRefusalError);
-    expect(fetchCalls).toHaveLength(0);
-  });
-
   it("allowlisted host passes the preflight and reaches fetch", async () => {
     process.env[ALLOWLIST_ENV] = "rebind.test";
     const out = await makeClient().upload("b", "k", new Uint8Array([1]), "text/plain");
     expect(out).toEqual({ url: "x" });
     expect(fetchCalls).toHaveLength(1);
     expect(fetchCalls[0]).toContain("http://rebind.test/api/buckets/b/objects");
   });
+
+  it("downloadObject() streams raw bytes from the /objects/download endpoint", async () => {
+    process.env[ALLOWLIST_ENV] = "rebind.test";
+    // The default beforeEach stub returns a JSON envelope; downloadObject reads
+    // the body as raw bytes, so this test serves a binary Response instead.
+    globalThis.fetch = (async (input: RequestInfo | URL) => {
+      const url =
+        typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url;
+      fetchCalls.push(url);
+      return new Response(new Uint8Array([1, 2, 3]), {
+        status: 200,
+        headers: { "Content-Type": "application/zip", "Content-Length": "3" },
+      });
+    }) as typeof fetch;
+
+    const out = await makeClient().downloadObject("b", "skills/g/1.0.zip");
+    expect(Array.from(out.bytes)).toEqual([1, 2, 3]);
+    expect(out.contentType).toBe("application/zip");
+    expect(out.contentLength).toBe(3);
+    expect(fetchCalls).toHaveLength(1);
+    expect(fetchCalls[0]).toContain("/api/buckets/b/objects/download?key=");
+  });
 });

ornn-api/src/clients/storageClient.ts

@@ -11,8 +11,17 @@ const logger = createLogger("storageClient");
 export interface IStorageClient {
   upload(bucket: string, key: string, data: Uint8Array, contentType: string): Promise<{ url: string }>;
   delete(bucket: string, key: string): Promise<void>;
-  getPresignedUrl(bucket: string, key: string, expiresIn?: number): Promise<{ presignedUrl: string; expiresAt: string }>;
-  copy(bucket: string, sourceKey: string, destKey: string): Promise<void>;
+  /**
+   * Stream an object's raw bytes from chrono-bucket's
+   * `GET /api/buckets/:bucket/objects/download?key=` endpoint. Replaces the
+   * removed presigned-URL flow (#1196): chrono-bucket no longer hands out
+   * direct S3 URLs, so every read is proxied through this client instead of a
+   * client fetching MinIO directly.
+   */
+  downloadObject(
+    bucket: string,
+    key: string,
+  ): Promise<{ bytes: Uint8Array; contentType: string; contentLength?: number }>;
 }
 
 /**
@@ -102,48 +111,33 @@ export class StorageClient implements IStorageClient {
     logger.debug({ bucket, key }, "File deleted from storage");
   }
 
-  async getPresignedUrl(
+  async downloadObject(
     bucket: string,
     key: string,
-    expiresIn?: number,
-  ): Promise<{ presignedUrl: string; expiresAt: string }> {
+  ): Promise<{ bytes: Uint8Array; contentType: string; contentLength?: number }> {
     const baseUrl = await this.resolveBaseUrl();
     const params = new URLSearchParams({ key });
-    if (expiresIn !== undefined) {
-      params.set("expiresIn", String(expiresIn));
-    }
-    const url = `${baseUrl}/api/buckets/${bucket}/presigned-url?${params.toString()}`;
+    const url = `${baseUrl}/api/buckets/${bucket}/objects/download?${params.toString()}`;
 
     const auth = await this.authHeaders();
     const res = await safeFetch(url, { method: "GET", headers: auth });
 
     if (!res.ok) {
       const text = await res.text().catch(() => "");
-      logger.error({ status: res.status, bucket, key }, "Storage presigned URL failed");
-      throw new Error(`Storage presigned URL failed (${res.status}): ${text}`);
-    }
-
-    const json = (await res.json()) as { data: { presignedUrl: string; expiresAt: string } };
-    return json.data;
-  }
-
-  async copy(bucket: string, sourceKey: string, destKey: string): Promise<void> {
-    const baseUrl = await this.resolveBaseUrl();
-    const url = `${baseUrl}/api/buckets/${bucket}/objects/copy`;
-
-    const auth = await this.authHeaders();
-    const res = await safeFetch(url, {
-      method: "POST",
-      headers: { "Content-Type": "application/json", ...auth },
-      body: JSON.stringify({ sourceKey, destKey }),
-    });
-
-    if (!res.ok) {
-      const text = await res.text().catch(() => "");
-      logger.error({ status: res.status, bucket, sourceKey, destKey }, "Storage copy failed");
-      throw new Error(`Storage copy failed (${res.status}): ${text}`);
+      logger.error({ status: res.status, bucket, key }, "Storage download failed");
+      throw new Error(`Storage download failed (${res.status}): ${text}`);
     }
 
-    logger.debug({ bucket, sourceKey, destKey }, "File copied in storage");
+    const bytes = new Uint8Array(await res.arrayBuffer());
+    const contentType = res.headers.get("content-type") ?? "application/octet-stream";
+    const lenHeader = res.headers.get("content-length");
+    const contentLength = lenHeader !== null ? Number(lenHeader) : NaN;
+    logger.debug({ bucket, key, bytes: bytes.byteLength }, "File downloaded from storage");
+
+    // exactOptionalPropertyTypes (#657): only attach contentLength when the
+    // header was present and numeric — never assign an explicit `undefined`.
+    return Number.isFinite(contentLength)
+      ? { bytes, contentType, contentLength }
+      : { bytes, contentType };
   }
 }

ornn-api/src/domains/analytics/routes.test.ts

@@ -57,7 +57,6 @@ function skill(overrides: Partial<SkillDetailResponse> = {}): SkillDetailRespons
     metadata: {},
     tags: [],
     skillHash: "hash-1",
-    presignedPackageUrl: "https://storage.test/skill.zip",
     isPrivate: false,
     createdBy: OWNER_ID,
     createdOn: "2026-01-01T00:00:00Z",

ornn-api/src/domains/notifications/service.ts

@@ -442,6 +442,79 @@ export class NotificationService {
     });
   }
 
+  /**
+   * Owner-side notification (#1176) fired when an automatic drift check finds
+   * a GitHub-sourced skill's upstream repo/ref can no longer be resolved
+   * (deleted, made private, or the branch/tag was removed). Lets the owner
+   * re-link or fix the source. Deep-links to the skill detail page.
+   */
+  async notifySourceBroken(params: {
+    ownerId: string;
+    skillGuid: string;
+    repo: string;
+    ref: string;
+  }): Promise<void> {
+    const title = `The GitHub source for one of your skills is unavailable`;
+    const body =
+      `Ornn could not reach the upstream source (${params.repo}@${params.ref}) during an ` +
+      `automatic sync check — it may have been deleted, made private, or the branch/tag ` +
+      `was removed. Re-link the skill to a valid GitHub folder to resume automatic syncing.`;
+    await this.emit(params.ownerId, {
+      category: "skill.source_broken",
+      title,
+      body,
+      link: `/skills/${encodeURIComponent(params.skillGuid)}`,
+      data: { skillGuid: params.skillGuid, repo: params.repo, ref: params.ref },
+    });
+  }
+
+  /**
+   * Owner notification (#1177) fired when a GitHub-sourced skill was
+   * automatically re-published from upstream — so the owner knows a new
+   * version shipped without their action, and to what.
+   */
+  async notifyAutoSynced(params: {
+    ownerId: string;
+    skillGuid: string;
+    fromVersion: string;
+    toVersion: string;
+  }): Promise<void> {
+    await this.emit(params.ownerId, {
+      category: "skill.auto_synced",
+      title: `A skill of yours auto-synced from GitHub to v${params.toVersion}`,
+      body:
+        `Ornn detected an upstream change and automatically published a new version ` +
+        `(v${params.fromVersion} → v${params.toVersion}) from the linked GitHub source.`,
+      link: `/skills/${encodeURIComponent(params.skillGuid)}`,
+      data: {
+        skillGuid: params.skillGuid,
+        fromVersion: params.fromVersion,
+        toVersion: params.toVersion,
+      },
+    });
+  }
+
+  /**
+   * Owner notification (#1177) fired when an automatic re-publish was
+   * refused — the upstream changed but the SKILL.md version wasn't bumped,
+   * or the pulled package failed validation. The owner must fix upstream.
+   */
+  async notifyAutoSyncFailed(params: {
+    ownerId: string;
+    skillGuid: string;
+    reason: string;
+  }): Promise<void> {
+    await this.emit(params.ownerId, {
+      category: "skill.auto_sync_failed",
+      title: `Auto-sync could not publish a new version of one of your skills`,
+      body:
+        `Ornn detected an upstream change but did not publish it: ${params.reason}. ` +
+        `Your current published version is unchanged — fix the issue upstream to resume auto-syncing.`,
+      link: `/skills/${encodeURIComponent(params.skillGuid)}`,
+      data: { skillGuid: params.skillGuid, reason: params.reason },
+    });
+  }
+
   private async emit(
     userId: string,
     payload: {