agent-skillboard 0.2.4 → 0.2.6

package/CHANGELOG.md

@@ -2,6 +2,21 @@
 
 ## Unreleased
 
+## 0.2.6 — 2026-07-03
+
+### Fixed
+
+- Reviewed runtime/plugin skills with `status: blocked` no longer receive
+  activation action cards or apply through `apply-action`; only reviewed
+  quarantined blocked-invocation skills can be activated as manual-only.
+
+## 0.2.5 — 2026-07-03
+
+### Fixed
+
+- Reset-cleanup action cards now use the same full `.skillboard/` purge
+  semantics as `skillboard uninstall --purge` for both preview and apply.
+
 ## 0.2.4 — 2026-07-03
 
 ### Changed

package/docs/versioning.md

@@ -8,7 +8,7 @@ source profiles, and the generated lockfile.
 
 ## Status
 
-Current package version: `0.2.4`
+Current package version: `0.2.6`
 
 Current config schema version:
 
@@ -59,7 +59,7 @@ must call them out clearly.
 Suggested tags:
 
 - `v0.1.0-alpha`: first public GitHub alpha.
-- `v0.2.4`: one-time runtime source review before manual activation, ask-after
+- `v0.2.6`: one-time runtime source review before manual activation, ask-after
   skill routing, purge uninstall, README benefit-first positioning,
   source inventory refresh, doctor/status, source pin refresh,
   installer/config detection, resilient detector warnings, and richer dry-run
@@ -194,8 +194,8 @@ Before tagging a public release:
   provenance with GitHub Actions OIDC, so keep `permissions.id-token: write`,
   the npm registry URL in `setup-node`, and
   `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` on the publish step.
-- Push a version tag that exactly matches `package.json`, for example `v0.2.4`
-  for package version `0.2.4`.
+- Push a version tag that exactly matches `package.json`, for example `v0.2.6`
+  for package version `0.2.6`.
 - Let `.github/workflows/publish.yml` publish from the tag. The workflow runs
   the full check suite, validates that the tag matches the package version, and
   skips `npm publish` only when that exact version already exists on npm.
@@ -229,6 +229,16 @@ completion notes:
 - update README quick-start to verify the installed version before running
   policy commands.
 
+## 0.2.6 Completion Notes
+
+- keep reviewed `status: blocked` runtime/plugin skills non-activatable while
+  preserving the reviewed quarantined runtime/plugin manual activation path.
+
+## 0.2.5 Completion Notes
+
+- align reset-cleanup action-card preview and apply internals with the full
+  `.skillboard/` purge semantics used by `skillboard uninstall --purge`.
+
 ## 0.2.4 Completion Notes
 
 - broaden `skillboard uninstall --purge` from reports/hooks cleanup to removal
@@ -243,7 +253,7 @@ completion notes:
 - document the lifecycle split between conservative bridge cleanup and full
   SkillBoard policy-footprint removal;
 - show purge in cleanup action cards so users do not need to remember the
-  equivalent `--reset-config --remove-reports --remove-hooks` sequence.
+  older `--reset-config --remove-reports --remove-hooks` sequence.
 
 ## 0.2.2 Completion Notes
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-skillboard",
-  "version": "0.2.4",
+  "version": "0.2.6",
   "description": "Let AI agents pick and use allowed skills in each workflow.",
   "keywords": [
     "ai-agent",

package/src/advisor/actions.mjs

@@ -12,7 +12,7 @@ import { buildSetupGuidanceActions } from "./setup-actions.mjs";
 import { trustRecommendationAction } from "./trust-policy.mjs";
 
 const WRITABLE_MODES = new Set(["manual-only", "router-only", "workflow-auto"]);
-const NON_ACTIVATABLE_STATUSES = new Set(["deprecated", "archived", "removed"]);
+const NON_ACTIVATABLE_STATUSES = new Set(["blocked", "deprecated", "archived", "removed"]);
 
 export function buildInitActions(paths) {
   return [makeAction({
@@ -246,7 +246,8 @@ function activationMode(skill) {
   if (
     skill.advanced.owner_install_unit !== undefined
     && skill.advanced.owner_install_unit !== null
-    && (skill.advanced.status === "quarantined" || skill.advanced.invocation === "blocked")
+    && skill.advanced.status === "quarantined"
+    && skill.advanced.invocation === "blocked"
   ) {
     return "manual-only";
   }

package/src/advisor/apply-action.mjs

@@ -165,7 +165,8 @@ async function dispatchAction(action, options) {
       dryRun: false,
       resetConfig: true,
       removeReports: true,
-      removeHooks: true
+      removeHooks: true,
+      removeProjectState: true
     });
   }
 

package/src/advisor/schema.mjs

@@ -56,6 +56,7 @@ export async function buildCleanup(root) {
     resetConfig: true,
     removeReports: true,
     removeHooks: true,
+    removeProjectState: true,
     removeEmptyDirs: true
   });
   return {