agent-skillboard 0.2.5 → 0.2.6

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## Unreleased
 
+## 0.2.6 — 2026-07-03
+
+### Fixed
+
+- Reviewed runtime/plugin skills with `status: blocked` no longer receive
+  activation action cards or apply through `apply-action`; only reviewed
+  quarantined blocked-invocation skills can be activated as manual-only.
+
 ## 0.2.5 — 2026-07-03
 
 ### Fixed

package/docs/versioning.md

@@ -8,7 +8,7 @@ source profiles, and the generated lockfile.
 
 ## Status
 
-Current package version: `0.2.5`
+Current package version: `0.2.6`
 
 Current config schema version:
 
@@ -59,7 +59,7 @@ must call them out clearly.
 Suggested tags:
 
 - `v0.1.0-alpha`: first public GitHub alpha.
-- `v0.2.5`: one-time runtime source review before manual activation, ask-after
+- `v0.2.6`: one-time runtime source review before manual activation, ask-after
   skill routing, purge uninstall, README benefit-first positioning,
   source inventory refresh, doctor/status, source pin refresh,
   installer/config detection, resilient detector warnings, and richer dry-run
@@ -194,8 +194,8 @@ Before tagging a public release:
   provenance with GitHub Actions OIDC, so keep `permissions.id-token: write`,
   the npm registry URL in `setup-node`, and
   `NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` on the publish step.
-- Push a version tag that exactly matches `package.json`, for example `v0.2.5`
-  for package version `0.2.5`.
+- Push a version tag that exactly matches `package.json`, for example `v0.2.6`
+  for package version `0.2.6`.
 - Let `.github/workflows/publish.yml` publish from the tag. The workflow runs
   the full check suite, validates that the tag matches the package version, and
   skips `npm publish` only when that exact version already exists on npm.
@@ -229,6 +229,11 @@ completion notes:
 - update README quick-start to verify the installed version before running
   policy commands.
 
+## 0.2.6 Completion Notes
+
+- keep reviewed `status: blocked` runtime/plugin skills non-activatable while
+  preserving the reviewed quarantined runtime/plugin manual activation path.
+
 ## 0.2.5 Completion Notes
 
 - align reset-cleanup action-card preview and apply internals with the full

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-skillboard",
-  "version": "0.2.5",
+  "version": "0.2.6",
   "description": "Let AI agents pick and use allowed skills in each workflow.",
   "keywords": [
     "ai-agent",

package/src/advisor/actions.mjs

@@ -12,7 +12,7 @@ import { buildSetupGuidanceActions } from "./setup-actions.mjs";
 import { trustRecommendationAction } from "./trust-policy.mjs";
 
 const WRITABLE_MODES = new Set(["manual-only", "router-only", "workflow-auto"]);
-const NON_ACTIVATABLE_STATUSES = new Set(["deprecated", "archived", "removed"]);
+const NON_ACTIVATABLE_STATUSES = new Set(["blocked", "deprecated", "archived", "removed"]);
 
 export function buildInitActions(paths) {
   return [makeAction({
@@ -246,7 +246,8 @@ function activationMode(skill) {
   if (
     skill.advanced.owner_install_unit !== undefined
     && skill.advanced.owner_install_unit !== null
-    && (skill.advanced.status === "quarantined" || skill.advanced.invocation === "blocked")
+    && skill.advanced.status === "quarantined"
+    && skill.advanced.invocation === "blocked"
   ) {
     return "manual-only";
   }