release: promote develop to main (v0.18.0 — skill generation modes)

.changeset/audit-transitive-overrides.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/release-notes-20260917.md

@@ -0,0 +1,2 @@
+---
+---

.changeset/skill-generation-modes.md

@@ -0,0 +1,6 @@
+---
+"ornn-api": minor
+"ornn-web": minor
+---
+
+Add caller-chosen, server-enforced generation modes to `POST /api/v1/skills/generate` (#1242). `mode: "simple"` asks for a single `SKILL.md`: the model gets a dedicated prompt and the server rejects any answer that is not a plain, file-less skill (one corrective retry, then a terminal `error`), so `generation_complete.raw` in simple mode never carries scripts, references or assets. `mode: "advanced"` — the default, and the pre-existing behaviour — lets the model emit `scripts[]` and, newly, `references[]` and `assets[]` text files. An unknown value fails with 400 `invalid_mode` before the quota reserve. The generative skill builder in ornn-web gains a Simple | Advanced toggle in the composer row (persisted like the model pick, locked while streaming), builds `references/` and `assets/` folders in the package preview, and now surfaces the server's problem+json detail when a generation request is rejected before the stream opens. The OpenAPI spec and the three agent manuals document the new field, the extended `raw` shape and the simple-mode guarantee.

.github/release-notes-20260917.md

@@ -0,0 +1,17 @@
+## Fixed
+
+- Rejected skill-generation requests now show the server's actual reason
+- Few technical bugs fixed
+
+## New Feature
+
+- Choose Simple or Advanced mode when generating a skill
+- Simple mode returns one SKILL.md, enforced by the server
+- Advanced generation can now include references and assets files
+- Agents can request the generation mode through the API
+
+## Changed
+
+- Generative builder gains a mode toggle beside the model picker
+- API reference and agent manuals describe generation modes
+- Technical enhancement

ornn-api/src/domains/assistant/kb/digest.generated.md

@@ -3,12 +3,12 @@
   Produced by ornn-api/scripts/build-assistant-kb.ts (#970).
   Re-run: `bun run scripts/build-assistant-kb.ts` from ornn-api/.
   budgetTokens: 18000
-  estimatedTokens: 11360
+  estimatedTokens: 11364
   sources:
   - readme: ~2250 tok
   - claude-positioning: ~272 tok
   - architecture: ~219 tok
-  - agent-manual-http: ~5486 tok (clipped)
+  - agent-manual-http: ~5491 tok (clipped)
   - conventions: ~2599 tok (clipped)
   - design-overview: ~487 tok
 -->
@@ -255,8 +255,8 @@ metadata:
     - manual
     - skill-lifecycle
     - http
-version: "1.1"
-lastUpdated: 2026-04-29
+version: "1.2"
+lastUpdated: 2026-09-16
 ---
 
 # Agent Manual (HTTPS variant)
@@ -507,7 +507,7 @@ The response is `{ data: { name, description, metadata, files: { "SKILL.md": "..
 
 **Step 5 — If steps 2–3 yielded nothing after 5 search attempts**, you may decide your own way to perform the task. **And if the task is definitive and potentially repeatable, build a skill and upload it back to Ornn so future you (or other agents) can find it.** Build flow:
 
-1. *(Optional)* **Bootstrap with AI generation** — Ornn's LLM can scaffold a skill from a prompt, source code, or an OpenAPI spec via `POST /api/v1/skills/generate*` (SSE). Useful when you need a starter; the generated skill still needs validation + your edits.
+1. *(Optional)* **Bootstrap with AI generation** — Ornn's LLM can scaffold a skill from a prompt, source code, or an OpenAPI spec via `POST /api/v1/skills/generate*` (SSE). On the prompt endpoint pass `"mode": "simple"` for a single `SKILL.md` (server-enforced — no scripts / references / assets) or leave the default `"advanced"` to let the model add `scripts/`, `references/` and `assets/`. Useful when you need a starter; the generated skill still needs validation + your edits.
 
 2. **Read the skill format spec** so you write a valid one:
 
@@ -600,16 +600,6 @@ curl -X PUT \
   -H "Authorization: Bearer $TOKEN" \
   -H "Content-Type: application/json" \
   -d '{"isPrivate":true,"sharedWithUsers":["user_abc"],"sharedWithOrgs":["org_xyz"]}' \
-  "https://ornn.chrono-ai.fun/api/v1/skills/<id>/permissions"
-```
-
-**Step 3c — Set to private.**
-
-```bash
-curl -X PUT \
-  -H "Authorization: Bearer $TOKEN" \
-  -H "Content-Type: application/json" \
-  -d
 
 ---
 

ornn-api/src/domains/skills/generation/packageContext.ts

@@ -0,0 +1,64 @@
+/**
+ * Turns an uploaded skill package ZIP into the plain-text context block
+ * the multipart branch of `POST /skills/generate` prepends to the prompt.
+ *
+ * Split out of `routes.ts` (#1242). Only `SKILL.md` plus anything under
+ * `scripts/`, `references/` and `assets/` is read — the same folders the
+ * upload validator allows at the package root.
+ *
+ * @module domains/skills/generation/packageContext
+ */
+
+import JSZip from "jszip";
+import { resolveZipRoot } from "../../../shared/utils/zip";
+import { createLogger } from "../../../shared/logger";
+
+const logger = createLogger("skillGenerationPackageContext");
+
+const RELEVANT_FILES = ["SKILL.md"];
+const RELEVANT_DIRS = ["scripts/", "references/", "assets/"];
+
+/**
+ * Read content from a ZIP package for analysis.
+ */
+export async function analyzePackageContent(zipBuffer: Uint8Array): Promise<string> {
+  const zip = await JSZip.loadAsync(zipBuffer);
+  const allPaths = Object.keys(zip.files);
+  resolveZipRoot(zip, allPaths);
+  const parts: string[] = [];
+
+  for (const path of allPaths) {
+    const file = zip.files[path];
+    // allPaths is `Object.keys(zip.files)`, but noUncheckedIndexedAccess
+    // (#450) widens the lookup to `T | undefined`. Defensive skip.
+    if (!file || file.dir) continue;
+
+    // Check if this is a relevant file
+    const segments = path.split("/").filter(Boolean);
+    let relativePath = path;
+    if (segments.length > 1) {
+      const firstEntry = segments[0]!;
+      const folderEntry = zip.files[firstEntry + "/"];
+      if (folderEntry && folderEntry.dir) {
+        relativePath = segments.slice(1).join("/");
+      }
+    }
+
+    const isRelevant = RELEVANT_FILES.includes(relativePath) ||
+      RELEVANT_DIRS.some((d) => relativePath.startsWith(d));
+
+    if (isRelevant) {
+      try {
+        const content = await file.async("string");
+        parts.push(`--- ${relativePath} ---\n${content}`);
+      } catch (err) {
+        // Skip binary or unreadable files. Log so an upload that's
+        // 100% binary doesn't silently produce an empty generation
+        // context (#579).
+        logger.debug({ err, relativePath }, "generation: skipping unreadable file");
+      }
+    }
+  }
+
+  return parts.join("\n\n");
+}