sync: stale skill detection, sentry filtering, claim removal, review improvements

Stale Detection: - Detect skills removed/moved from GitHub (3 consecutive 404s threshold) - Hide stale skills from browse/search, show warning banner on detail page - Serve cached files with isStale flag when GitHub returns 404 - Add stale-check crawler command for batch verification - CLI shows warning when installing stale skills from cache Sentry & Error Handling: - Filter browser extension errors and add denyUrls - Anti-inflation measures and sentinel recalibration for curation Claim & Removal: - Enhanced ClaimForm with repo-level removal support - Add repo-removal-request API endpoint with tests - Improved owner page with bilingual content Review Pipeline: - Review version and reviewer tracking in submit API - Source format filter for pending reviews - Updated review tests Other: - Updated i18n strings (en/fa) - BrowseFilters improvements - Dockerfile updates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-12 05:59:26 +03:30
parent 447f9eff59
commit 4212b5ba47
31 changed files with 1590 additions and 58 deletions
--- a/apps/web/app/[locale]/browse/page.tsx
+++ b/apps/web/app/[locale]/browse/page.tsx
@@ -186,7 +186,7 @@ export default async function BrowsePage({ params, searchParams }: BrowsePagePro

  const emptyStateTranslations = {
    noResults: t('noResults') || 'No skills found',
-    noResultsWithQuery: t('noResultsWithQuery') || 'No results for "{query}"',
+    noResultsWithQuery: t('noResultsWithQuery', { query: searchParamsResolved.q || '' }),
    tryDifferent: t('emptyState.tryDifferent') || 'Try different search terms or adjust your filters',
    clearFilters: t('emptyState.clearFilters') || 'Clear filters',
    browseAll: t('emptyState.browseAll') || 'Browse Featured Skills',
--- a/apps/web/app/[locale]/claim/page.tsx
+++ b/apps/web/app/[locale]/claim/page.tsx
@@ -42,6 +42,7 @@ export default async function ClaimPage({
    tabs: {
      remove: t('tabs.remove'),
      add: t('tabs.add'),
+      removeRepo: t('tabs.removeRepo'),
    },
    form: {
      skillId: t('form.skillId'),
@@ -78,6 +79,27 @@ export default async function ClaimPage({
      foundSkillsIn: t('addSuccess.foundSkillsIn'),
      root: t('addSuccess.root'),
      andMore: t.raw('addSuccess.andMore') as string,
+      reEnabledTitle: t('addSuccess.reEnabledTitle'),
+      reEnabledDescription: t('addSuccess.reEnabledDescription'),
+    },
+    removeRepoForm: {
+      repoUrl: t('removeRepoForm.repoUrl'),
+      repoUrlPlaceholder: t('removeRepoForm.repoUrlPlaceholder'),
+      repoUrlHelp: t('removeRepoForm.repoUrlHelp'),
+      reason: t('removeRepoForm.reason'),
+      reasonPlaceholder: t('removeRepoForm.reasonPlaceholder'),
+      submit: t('removeRepoForm.submit'),
+      submitting: t('removeRepoForm.submitting'),
+    },
+    removeRepoSuccess: {
+      title: t('removeRepoSuccess.title'),
+      description: t.raw('removeRepoSuccess.description') as string,
+      descriptionZero: t('removeRepoSuccess.descriptionZero'),
+    },
+    removeRepoError: {
+      notOwner: t('removeRepoError.notOwner'),
+      invalidRepo: t('removeRepoError.invalidRepo'),
+      parseError: t('removeRepoError.parseError'),
    },
    error: {
      notOwner: t('error.notOwner'),
@@ -90,6 +112,7 @@ export default async function ClaimPage({
      rateLimitExceeded: t('error.rateLimitExceeded'),
      networkTimeout: t('error.networkTimeout'),
      generic: t('error.generic'),
+      repoBlockedByOwner: t('error.repoBlockedByOwner'),
    },
    myRequests: {
      title: t('myRequests.title'),
--- a/apps/web/app/[locale]/owner/[username]/page.tsx
+++ b/apps/web/app/[locale]/owner/[username]/page.tsx
@@ -10,6 +10,7 @@ import Link from 'next/link';
 import type { Metadata } from 'next';
 import { getPageAlternates } from '@/lib/seo';
 import { getOrSetCache, cacheKeys, cacheTTL } from '@/lib/cache';
+import { auth } from '@/lib/auth';

 export const dynamic = 'force-dynamic';

@@ -49,6 +50,8 @@ export default async function OwnerPage({ params, searchParams }: OwnerPageProps
  const activeRepo = searchParamsResolved.repo || '';

  const db = createDb();
+  const session = await auth();
+  const isOwner = session?.user?.username?.toLowerCase() === username.toLowerCase();

  // Fetch stats and repo list with caching (30 min TTL), count is dynamic per filter
  const [stats, totalSkills, ownerRepos] = await Promise.all([
@@ -256,16 +259,30 @@ export default async function OwnerPage({ params, searchParams }: OwnerPageProps
            </div>
          </div>

-          {/* Claim CTA - subtle inline hint */}
-          <div className="flex items-center gap-2 mb-6 text-xs text-text-muted">
-            <span>{t('claimCta')}</span>
-            <Link
-              href={`/${locale}/claim`}
-              className="text-primary hover:underline font-medium whitespace-nowrap"
-            >
-              {t('claimButton')}
-            </Link>
-          </div>
+          {/* Claim CTA */}
+          {isOwner ? (
+            <div className="flex items-center gap-3 mb-6 px-4 py-3 bg-primary/5 border border-primary/20 rounded-lg">
+              <div className="flex-1 text-sm text-text-secondary">
+                {t('ownerManageCta')}
+              </div>
+              <Link
+                href={`/${locale}/claim`}
+                className="text-sm text-primary hover:underline font-medium whitespace-nowrap"
+              >
+                {t('ownerManageButton')}
+              </Link>
+            </div>
+          ) : (
+            <div className="flex items-center gap-2 mb-6 text-xs text-text-muted">
+              <span>{t('claimCta')}</span>
+              <Link
+                href={`/${locale}/claim`}
+                className="text-primary hover:underline font-medium whitespace-nowrap"
+              >
+                {t('claimButton')}
+              </Link>
+            </div>
+          )}

          {/* Repos + Skills */}
          {repos.map((repo) => (
--- a/apps/web/app/[locale]/page.tsx
+++ b/apps/web/app/[locale]/page.tsx
@@ -21,7 +21,7 @@ async function getStats() {
      const db = createDb();

      // Browse-ready filter: exclude duplicates (matches browseReadyFilter in queries.ts)
-      const browseReady = sql`${skills.isDuplicate} = false`;
+      const browseReady = sql`${skills.isDuplicate} = false AND ${skills.isStale} = false`;

      // Run all independent count queries in parallel
      const [skillsResult, downloadsResult, categories, contributorsResult, totalIndexedResult] = await Promise.all([
--- a/apps/web/app/[locale]/skill/[...id]/page.tsx
+++ b/apps/web/app/[locale]/skill/[...id]/page.tsx
@@ -339,6 +339,33 @@ export default async function SkillPage({ params }: SkillPageProps) {
          </div>
        )}

+        {/* Stale Skill Warning Banner */}
+        {dbSkill.isStale && (
+          <div className="bg-warning/10 border-b border-warning/20">
+            <div className="container-main py-3">
+              <div className="flex items-start gap-3 text-sm">
+                <span className="text-warning text-lg flex-shrink-0">⚠</span>
+                <div>
+                  <p className="text-warning-foreground dark:text-warning" dir="auto">
+                    {isRTL
+                      ? 'این مهارت ممکن است از مخزن GitHub اصلی حذف یا جابجا شده باشد. فایل‌ها از حافظه پنهان SkillHub ارائه می‌شوند و ممکن است قدیمی باشند.'
+                      : 'This skill may have been removed or moved from its GitHub repository. Files are served from the SkillHub cache and may be outdated.'}
+                  </p>
+                  <a
+                    href={`https://github.com/${skill.author}/${skill.repo}`}
+                    target="_blank"
+                    rel="noopener noreferrer"
+                    className="inline-flex items-center gap-1 mt-1 text-primary-600 hover:text-primary-700 dark:text-primary-400 dark:hover:text-primary-300 font-medium"
+                  >
+                    {isRTL ? 'بررسی مخزن GitHub' : 'Check GitHub repository'}
+                    <ExternalLink className="w-3 h-3" />
+                  </a>
+                </div>
+              </div>
+            </div>
+          </div>
+        )}
+
        {/* Stats Bar */}
        <div className="bg-surface-elevated border-b border-border">
          <div className="container-main">
--- a/apps/web/app/api/review/pending/route.ts
+++ b/apps/web/app/api/review/pending/route.ts
@@ -49,6 +49,9 @@ export async function GET(request: NextRequest) {
      Math.max(parseInt(searchParams.get('owner_limit') ?? '0', 10) || 0, 0),
      10
    );
+    const currentReviewVersion = Math.max(
+      parseInt(searchParams.get('review_version') ?? '0', 10) || 0, 0
+    );

    // Run counts in parallel
    const [totalPending, reReviews] = await Promise.all([
@@ -68,6 +71,7 @@ export async function GET(request: NextRequest) {
        securityPass,
        reReviewAll: true,
        ownerLimit,
+        currentReviewVersion,
      }) as typeof batch;
      batch = [...allBatch].slice(0, batchSize);
    } else {
--- a/apps/web/app/api/review/submit/route.ts
+++ b/apps/web/app/api/review/submit/route.ts
@@ -22,6 +22,8 @@ interface ReviewItem {
  i18n_priority?: number;
  content_hash_at_review?: string;
  set_verified?: boolean;
+  review_version?: number;
+  reviewer?: string;
 }

 function validateReviews(body: unknown): { reviews: ReviewItem[] } | { error: string } {
@@ -60,6 +62,18 @@ function validateReviews(body: unknown): { reviews: ReviewItem[] } | { error: st
        return { error: `reviews[${i}].i18n_priority must be an integer 0-2` };
      }
    }
+    // Validate review_version (positive integer)
+    if (item.review_version !== undefined && item.review_version !== null) {
+      if (typeof item.review_version !== 'number' || !Number.isInteger(item.review_version) || item.review_version < 1) {
+        return { error: `reviews[${i}].review_version must be a positive integer` };
+      }
+    }
+    // Validate reviewer (non-empty string, max 50 chars)
+    if (item.reviewer !== undefined && item.reviewer !== null) {
+      if (typeof item.reviewer !== 'string' || item.reviewer.length === 0 || item.reviewer.length > 50) {
+        return { error: `reviews[${i}].reviewer must be a non-empty string (max 50 chars)` };
+      }
+    }
  }

  return { reviews: reviews as ReviewItem[] };
@@ -106,7 +120,7 @@ export async function POST(request: NextRequest) {
    // Insert review rows
    const dbReviews = reviews.map((r) => ({
      skillId: r.skill_id,
-      reviewer: 'claude-code' as const,
+      reviewer: r.reviewer || 'claude-code',
      aiScore: r.ai_score,
      instructionQuality: r.instruction_quality,
      descriptionPrecision: r.description_precision,
@@ -119,6 +133,7 @@ export async function POST(request: NextRequest) {
      needsImprovement: r.needs_improvement ?? undefined,
      i18nPriority: r.i18n_priority,
      contentHashAtReview: r.content_hash_at_review,
+      reviewVersion: r.review_version,
    }));

    await skillReviewQueries.createBatch(db, dbReviews);
--- a/apps/web/app/api/skill-files/route.ts
+++ b/apps/web/app/api/skill-files/route.ts
@@ -39,6 +39,7 @@ interface SkillFile {
  content: string;
  size: number;
  isBinary: boolean;
+  fetchFailed?: boolean;
 }

 interface CachedFiles {
@@ -136,7 +137,7 @@ export async function GET(request: NextRequest) {
    }

    // Fetch skill folder contents from GitHub
-    const files = await fetchSkillFiles(
+    const { files, fetchFailureCount } = await fetchSkillFiles(
      githubOwner,
      githubRepo,
      skillPath,
@@ -146,19 +147,22 @@ export async function GET(request: NextRequest) {
      token
    );

-    // === SAVE TO CACHE ===
-    // Prepare cached files structure
-    const filesToCache: CachedFiles = {
-      fetchedAt: new Date().toISOString(),
-      commitSha: commitSha || 'unknown',
-      totalSize: files.reduce((sum, f) => sum + f.size, 0),
-      items: files,
-    };
+    // === SAVE TO CACHE (only if all files fetched successfully) ===
+    if (fetchFailureCount > 0) {
+      console.warn(`[skill-files] Skipping cache for ${skillId}: ${fetchFailureCount} file(s) failed to fetch`);
+    } else {
+      const filesToCache: CachedFiles = {
+        fetchedAt: new Date().toISOString(),
+        commitSha: commitSha || 'unknown',
+        totalSize: files.reduce((sum, f) => sum + f.size, 0),
+        items: files.map(({ fetchFailed: _, ...rest }) => rest),
+      };

-    // Save to database (async, don't block response)
-    skillQueries.updateCachedFiles(db, skillId, filesToCache).catch((err) => {
-      console.error(`[skill-files] Failed to cache files for ${skillId}:`, err);
-    });
+      // Save to database (async, don't block response)
+      skillQueries.updateCachedFiles(db, skillId, filesToCache).catch((err) => {
+        console.error(`[skill-files] Failed to cache files for ${skillId}:`, err);
+      });
+    }

    // Note: Download count is NOT incremented here.
    // It should only be incremented in /api/skills/install after successful download.
@@ -180,6 +184,7 @@ export async function GET(request: NextRequest) {
        downloadUrl: item.isBinary ? `https://raw.githubusercontent.com/${githubOwner}/${githubRepo}/${branch || 'main'}/${skillPath}/${item.path}` : undefined,
      })),
      fromCache: false,
+      ...(fetchFailureCount > 0 ? { fetchFailures: fetchFailureCount } : {}),
    }, {
      headers: createRateLimitHeaders(rateLimitResult),
    });
@@ -204,6 +209,44 @@ export async function GET(request: NextRequest) {
    }

    if (errorMessage.includes('404')) {
+      // Increment stale check (non-blocking) — after 3 consecutive 404s, skill is marked stale
+      const skillId404 = request.nextUrl.searchParams.get('id');
+      if (skillId404) {
+        skillQueries.incrementStaleCheck(db, skillId404).catch((err) => {
+          console.error(`[skill-files] Failed to increment stale check for ${skillId404}:`, err);
+        });
+      }
+
+      // If we have cached files in DB, serve them with stale warning instead of 404
+      if (skillId404) {
+        const skill404 = await skillQueries.getById(db, skillId404);
+        if (skill404?.cachedFiles) {
+          const cached = skill404.cachedFiles as CachedFiles;
+          return NextResponse.json({
+            skillId: skillId404,
+            githubOwner: skill404.githubOwner,
+            githubRepo: skill404.githubRepo,
+            skillPath: skill404.skillPath,
+            branch: skill404.branch || 'main',
+            sourceFormat: skill404.sourceFormat || 'skill.md',
+            files: cached.items.map(item => ({
+              name: item.name,
+              path: item.path,
+              type: 'file' as const,
+              size: item.size,
+              content: item.isBinary ? undefined : item.content,
+              downloadUrl: item.isBinary ? `https://raw.githubusercontent.com/${skill404.githubOwner}/${skill404.githubRepo}/${skill404.branch || 'main'}/${skill404.skillPath}/${item.path}` : undefined,
+            })),
+            fromCache: true,
+            cachedAt: cached.fetchedAt,
+            isStale: true,
+            staleWarning: 'This skill may have been removed from GitHub. Files served from cache.',
+          }, {
+            headers: createRateLimitHeaders(rateLimitResult),
+          });
+        }
+      }
+
      return NextResponse.json(
        { error: 'Skill files not found on GitHub', code: 'GITHUB_NOT_FOUND' },
        { status: 404 }
@@ -314,7 +357,7 @@ async function fetchSkillFiles(
  depth: number = 0,
  headers: Record<string, string>,
  token: string | null
-): Promise<SkillFile[]> {
+): Promise<{ files: SkillFile[]; fetchFailureCount: number }> {
  // Phase 1: Collect all file entries from directory tree
  const entries = await collectFileEntries(owner, repo, path, ref, depth, headers, token);

@@ -326,6 +369,7 @@ async function fetchSkillFiles(

  // Phase 2: Fetch file contents in parallel
  let totalSize = 0;
+  let fetchFailureCount = 0;
  const tasks = entries.map((entry) => async (): Promise<SkillFile> => {
    const { item, relativePath } = entry;
    const isBinary = !isTextFile(item.name);
@@ -340,15 +384,18 @@ async function fetchSkillFiles(
          content,
          size: item.size,
          isBinary: false,
+          fetchFailed: false,
        };
      } catch {
-        // Content fetch failed — return as binary with download URL
+        // Content fetch failed — mark as failed so we skip caching
+        fetchFailureCount++;
        return {
          name: item.name,
          path: relativePath,
          content: '',
          size: item.size,
          isBinary: true,
+          fetchFailed: true,
        };
      }
    }
@@ -360,10 +407,12 @@ async function fetchSkillFiles(
      content: '',
      size: item.size,
      isBinary: true,
+      fetchFailed: false,
    };
  });

-  return parallelLimit(tasks, PARALLEL_FETCH_LIMIT);
+  const files = await parallelLimit(tasks, PARALLEL_FETCH_LIMIT);
+  return { files, fetchFailureCount };
 }

 /**
--- a/apps/web/app/api/skills/add-request/route.test.ts
+++ b/apps/web/app/api/skills/add-request/route.test.ts
@@ -0,0 +1,229 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+
+// Mock auth
+const mockAuth = vi.fn();
+vi.mock('@/lib/auth', () => ({
+  auth: () => mockAuth(),
+}));
+
+// Mock sanitize
+vi.mock('@/lib/sanitize', () => ({
+  sanitizeReason: (r: string) => r,
+}));
+
+// Mock email
+vi.mock('@/lib/email', () => ({
+  sendClaimSubmittedEmail: vi.fn().mockResolvedValue(undefined),
+}));
+
+// Mock db
+vi.mock('@skillhub/db', () => ({
+  createDb: vi.fn(() => ({})),
+  userQueries: {
+    getByGithubId: vi.fn(),
+    upsertFromGithub: vi.fn(),
+  },
+  skillQueries: {
+    unblockByRepo: vi.fn(),
+  },
+  addRequestQueries: {
+    hasPendingRequest: vi.fn(),
+    create: vi.fn(),
+    updateStatus: vi.fn(),
+  },
+  discoveredRepoQueries: {
+    getById: vi.fn(),
+    upsert: vi.fn(),
+    unblockRepo: vi.fn(),
+  },
+}));
+
+import { POST, GET } from './route';
+import { userQueries, skillQueries, addRequestQueries, discoveredRepoQueries } from '@skillhub/db';
+
+function createMockUser(overrides: Partial<{ id: string; githubId: string; email: string }> = {}) {
+  return {
+    id: 'user-123',
+    githubId: 'gh-12345',
+    username: 'testuser',
+    email: 'test@example.com',
+    preferredLocale: 'en',
+    ...overrides,
+  };
+}
+
+function createRequest(body: unknown) {
+  return new NextRequest('http://localhost:3000/api/skills/add-request', {
+    method: 'POST',
+    body: JSON.stringify(body),
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+describe('/api/skills/add-request', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // Disable real fetch by default
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  describe('GET', () => {
+    it('should return 401 when not authenticated', async () => {
+      mockAuth.mockResolvedValue(null);
+
+      const response = await GET();
+      const data = await response.json();
+
+      expect(response.status).toBe(401);
+      expect(data.error).toBeDefined();
+    });
+
+    it('should return empty requests for unknown user', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(null as any);
+
+      const response = await GET();
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.requests).toEqual([]);
+    });
+  });
+
+  describe('POST', () => {
+    it('should return 401 when not authenticated', async () => {
+      mockAuth.mockResolvedValue(null);
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/owner/repo' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(401);
+      expect(data.code).toBe('AUTH_REQUIRED');
+    });
+
+    it('should return 400 for missing repositoryUrl', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'testuser' } });
+
+      const response = await POST(createRequest({}));
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.code).toBe('INVALID_INPUT');
+    });
+
+    it('should return 400 for invalid GitHub URL', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'testuser' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+
+      // gitlab.com does not contain the substring 'github.com'
+      const response = await POST(createRequest({ repositoryUrl: 'https://gitlab.com/owner/repo' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.code).toBe('INVALID_URL');
+    });
+
+    it('should return 403 REPO_BLOCKED_BY_OWNER when non-owner tries to add blocked repo', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'non-owner' } });
+      const mockUser = createMockUser({ githubId: 'gh-12345' });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(discoveredRepoQueries.getById).mockResolvedValue({
+        id: 'rawveg/skillsforge-marketplace',
+        isBlocked: true,
+      } as any);
+      // GitHub API says the owner is 'rawveg', not 'non-owner'
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' }, default_branch: 'main', private: false }),
+      } as any));
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(403);
+      expect(data.code).toBe('REPO_BLOCKED_BY_OWNER');
+    });
+
+    it('should re-enable repo when owner re-adds their blocked repo', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser({ githubId: 'gh-12345' });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(discoveredRepoQueries.getById).mockResolvedValue({
+        id: 'rawveg/skillsforge-marketplace',
+        isBlocked: true,
+      } as any);
+      vi.mocked(skillQueries.unblockByRepo).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.unblockRepo).mockResolvedValue(undefined);
+      vi.mocked(addRequestQueries.hasPendingRequest).mockResolvedValue(false as any);
+      vi.mocked(addRequestQueries.create).mockResolvedValue('req-123' as any);
+      vi.mocked(addRequestQueries.updateStatus).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.upsert).mockResolvedValue(undefined as any);
+
+      // First fetch: ownership check (inside blocked-repo logic)
+      // Second fetch: repo validation (validateGitHubRepo → repoResponse)
+      // Third fetch: tree scan (findSkillMdFiles)
+      vi.stubGlobal('fetch', vi.fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({ owner: { login: 'rawveg' }, default_branch: 'main', private: false }),
+        } as any)
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({ owner: { login: 'rawveg' }, default_branch: 'main', private: false }),
+        } as any)
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            tree: [
+              { path: 'SKILL.md', type: 'blob' },
+            ],
+            truncated: false,
+          }),
+        } as any)
+      );
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.reEnabled).toBe(true);
+      expect(skillQueries.unblockByRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg', 'skillsforge-marketplace');
+      expect(discoveredRepoQueries.unblockRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg/skillsforge-marketplace');
+    });
+
+    it('should proceed normally when repo is not blocked (Case C)', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'newuser' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(discoveredRepoQueries.getById).mockResolvedValue(null as any);
+      vi.mocked(addRequestQueries.hasPendingRequest).mockResolvedValue(false as any);
+      vi.mocked(addRequestQueries.create).mockResolvedValue('req-456' as any);
+      vi.mocked(addRequestQueries.updateStatus).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.upsert).mockResolvedValue(undefined as any);
+
+      vi.stubGlobal('fetch', vi.fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({ owner: { login: 'someowner' }, default_branch: 'main', private: false }),
+        } as any)
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            tree: [{ path: 'SKILL.md', type: 'blob' }],
+            truncated: false,
+          }),
+        } as any)
+      );
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/someowner/newrepo' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.reEnabled).toBeUndefined();
+    });
+  });
+});
--- a/apps/web/app/api/skills/add-request/route.ts
+++ b/apps/web/app/api/skills/add-request/route.ts
@@ -1,7 +1,7 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { auth } from '@/lib/auth';
-import { createDb, addRequestQueries, discoveredRepoQueries, userQueries } from '@skillhub/db';
+import { createDb, addRequestQueries, discoveredRepoQueries, skillQueries, userQueries } from '@skillhub/db';
 import { sanitizeReason } from '@/lib/sanitize';
 import { sendClaimSubmittedEmail } from '@/lib/email';

@@ -337,6 +337,52 @@ export async function POST(request: NextRequest) {
      );
    }

+    // Check if repo was previously blocked by its owner
+    let reEnabled = false;
+    const existingRepo = await discoveredRepoQueries.getById(db, `${parsed.owner}/${parsed.repo}`);
+    if (existingRepo?.isBlocked) {
+      // Verify whether the current requester is the repo owner
+      let requesterIsOwner = false;
+      try {
+        const ownerCheckRes = await fetch(
+          `https://api.github.com/repos/${parsed.owner}/${parsed.repo}`,
+          {
+            headers: {
+              Accept: 'application/vnd.github.v3+json',
+              'User-Agent': 'SkillHub',
+              ...(process.env.GITHUB_TOKEN && {
+                Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
+              }),
+            },
+            signal: AbortSignal.timeout(10000),
+          }
+        );
+        if (ownerCheckRes.ok) {
+          const repoData = await ownerCheckRes.json() as { owner?: { login?: string } };
+          requesterIsOwner =
+            repoData.owner?.login?.toLowerCase() === session.user.username.toLowerCase();
+        }
+      } catch {
+        // If we can't reach GitHub, treat as non-owner (safe default)
+      }
+
+      if (!requesterIsOwner) {
+        // Case B: repo blocked by its owner, non-owner trying to re-add
+        return NextResponse.json(
+          {
+            error: 'This repository was removed by its owner and cannot be re-added.',
+            code: 'REPO_BLOCKED_BY_OWNER',
+          },
+          { status: 403 }
+        );
+      }
+
+      // Case A: owner is re-enabling their previously blocked repo
+      await skillQueries.unblockByRepo(db, parsed.owner, parsed.repo);
+      await discoveredRepoQueries.unblockRepo(db, `${parsed.owner}/${parsed.repo}`);
+      reEnabled = true;
+    }
+
    // Check if user already has a pending request for this repository + path combination
    const hasPending = await addRequestQueries.hasPendingRequest(
      db,
@@ -438,6 +484,7 @@ export async function POST(request: NextRequest) {
      skillCount: validation.skillPaths.length,
      skillPaths: validation.skillPaths,
      message,
+      ...(reEnabled && { reEnabled: true }),
    });
  } catch (error) {
    console.error('Error creating add request:', error);
--- a/apps/web/app/api/skills/repo-removal-request/route.test.ts
+++ b/apps/web/app/api/skills/repo-removal-request/route.test.ts
@@ -0,0 +1,163 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+
+// Mock auth
+const mockAuth = vi.fn();
+vi.mock('@/lib/auth', () => ({
+  auth: () => mockAuth(),
+}));
+
+// Mock sanitize
+vi.mock('@/lib/sanitize', () => ({
+  sanitizeReason: (r: string) => r,
+}));
+
+// Mock db
+vi.mock('@skillhub/db', () => ({
+  createDb: vi.fn(() => ({})),
+  userQueries: {
+    getByGithubId: vi.fn(),
+    upsertFromGithub: vi.fn(),
+  },
+  skillQueries: {
+    countByRepo: vi.fn(),
+    blockByRepo: vi.fn(),
+  },
+  discoveredRepoQueries: {
+    blockRepo: vi.fn(),
+  },
+}));
+
+import { POST } from './route';
+import { userQueries, skillQueries, discoveredRepoQueries } from '@skillhub/db';
+
+function createMockUser(overrides: Partial<{ id: string; githubId: string }> = {}) {
+  return {
+    id: 'user-123',
+    githubId: 'gh-12345',
+    username: 'rawveg',
+    ...overrides,
+  };
+}
+
+function createRequest(body: unknown) {
+  return new NextRequest('http://localhost:3000/api/skills/repo-removal-request', {
+    method: 'POST',
+    body: JSON.stringify(body),
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+describe('/api/skills/repo-removal-request', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  describe('POST', () => {
+    it('should return 401 when not authenticated', async () => {
+      mockAuth.mockResolvedValue(null);
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(401);
+      expect(data.code).toBe('AUTH_REQUIRED');
+    });
+
+    it('should return 400 for missing repoUrl', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+
+      const response = await POST(createRequest({}));
+
+      expect(response.status).toBe(400);
+    });
+
+    it('should return 400 PARSE_ERROR for invalid repo format', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+
+      const response = await POST(createRequest({ repoUrl: 'not-a-valid-format' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.code).toBe('PARSE_ERROR');
+    });
+
+    it('should return 404 INVALID_REPO when repo not found on GitHub', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: false,
+        status: 404,
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(404);
+      expect(data.code).toBe('INVALID_REPO');
+    });
+
+    it('should return 403 NOT_OWNER when requester is not repo owner', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'other-user' } });
+      const mockUser = createMockUser({ githubId: 'gh-12345' });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' } }),
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(403);
+      expect(data.code).toBe('NOT_OWNER');
+    });
+
+    it('should block all skills and return success when owner removes repo', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(skillQueries.countByRepo).mockResolvedValue(16 as any);
+      vi.mocked(skillQueries.blockByRepo).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.blockRepo).mockResolvedValue(undefined);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' } }),
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace', reason: 'I want my skills removed' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.blockedCount).toBe(16);
+      expect(data.repo).toBe('rawveg/skillsforge-marketplace');
+      expect(skillQueries.blockByRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg', 'skillsforge-marketplace');
+      expect(discoveredRepoQueries.blockRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg/skillsforge-marketplace');
+    });
+
+    it('should accept full GitHub URL format', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(skillQueries.countByRepo).mockResolvedValue(0 as any);
+      vi.mocked(skillQueries.blockByRepo).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.blockRepo).mockResolvedValue(undefined);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' } }),
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'https://github.com/rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.repo).toBe('rawveg/skillsforge-marketplace');
+    });
+  });
+});
--- a/apps/web/app/api/skills/repo-removal-request/route.ts
+++ b/apps/web/app/api/skills/repo-removal-request/route.ts
@@ -0,0 +1,158 @@
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { auth } from '@/lib/auth';
+import { createDb, skillQueries, discoveredRepoQueries, userQueries } from '@skillhub/db';
+import { sanitizeReason } from '@/lib/sanitize';
+
+export const dynamic = 'force-dynamic';
+
+const db = createDb();
+
+function parseOwnerRepo(input: string): { owner: string; repo: string } | null {
+  try {
+    if (input.startsWith('https://') || input.startsWith('http://')) {
+      const url = new URL(input);
+      if (!url.hostname.includes('github.com')) return null;
+      const parts = url.pathname.split('/').filter(Boolean);
+      if (parts.length < 2) return null;
+      return { owner: parts[0], repo: parts[1] };
+    }
+    const parts = input.split('/').filter(Boolean);
+    if (parts.length < 2) return null;
+    return { owner: parts[0], repo: parts[1] };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * POST /api/skills/repo-removal-request
+ * Block all skills from a GitHub repository at once.
+ * Verifies the authenticated user owns the repo, then blocks all skills and
+ * prevents the repo from being re-indexed.
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const session = await auth();
+
+    if (!session?.user?.githubId || !session.user.username) {
+      return NextResponse.json(
+        { error: 'Authentication required', code: 'AUTH_REQUIRED' },
+        { status: 401 }
+      );
+    }
+
+    const body = await request.json();
+    const { repoUrl, reason } = body;
+
+    if (!repoUrl) {
+      return NextResponse.json(
+        { error: 'repoUrl is required', code: 'INVALID_INPUT' },
+        { status: 400 }
+      );
+    }
+
+    const parsed = parseOwnerRepo(String(repoUrl).trim());
+    if (!parsed) {
+      return NextResponse.json(
+        { error: 'Invalid format. Use https://github.com/owner/repo or owner/repo', code: 'PARSE_ERROR' },
+        { status: 400 }
+      );
+    }
+
+    const { owner, repo } = parsed;
+    const username = session.user.username;
+
+    // Get or create user
+    let dbUser = await userQueries.getByGithubId(db, session.user.githubId);
+    if (!dbUser) {
+      dbUser = await userQueries.upsertFromGithub(db, {
+        githubId: session.user.githubId,
+        username: session.user.username,
+        displayName: session.user.name || undefined,
+        email: session.user.email || undefined,
+        avatarUrl: session.user.image || undefined,
+      });
+    }
+    if (!dbUser) {
+      return NextResponse.json(
+        { error: 'Failed to create user record', code: 'USER_CREATE_FAILED' },
+        { status: 500 }
+      );
+    }
+
+    // Verify repo ownership via GitHub API
+    let isOwner = false;
+    let githubError: string | null = null;
+
+    try {
+      const repoResponse = await fetch(
+        `https://api.github.com/repos/${owner}/${repo}`,
+        {
+          headers: {
+            Accept: 'application/vnd.github.v3+json',
+            'User-Agent': 'SkillHub',
+          },
+          signal: AbortSignal.timeout(10000),
+        }
+      );
+
+      if (repoResponse.ok) {
+        const repoData = await repoResponse.json();
+        if (repoData.owner?.login?.toLowerCase() === username.toLowerCase()) {
+          isOwner = true;
+        }
+      } else if (repoResponse.status === 404) {
+        return NextResponse.json(
+          { error: 'Repository not found on GitHub', code: 'INVALID_REPO' },
+          { status: 404 }
+        );
+      } else if (repoResponse.status === 403) {
+        githubError = 'GitHub API rate limit exceeded. Please try again later.';
+      }
+    } catch (fetchError) {
+      console.error('GitHub API fetch error:', fetchError);
+      githubError = 'Failed to verify repository ownership';
+    }
+
+    if (githubError) {
+      return NextResponse.json(
+        { error: githubError, code: 'GITHUB_ERROR' },
+        { status: 502 }
+      );
+    }
+
+    if (!isOwner) {
+      return NextResponse.json(
+        { error: 'You are not the owner of this repository', code: 'NOT_OWNER' },
+        { status: 403 }
+      );
+    }
+
+    // Count skills before blocking (for response message)
+    const blockedCount = await skillQueries.countByRepo(db, owner, repo);
+
+    // Block all skills from the repo
+    await skillQueries.blockByRepo(db, owner, repo);
+
+    // Block the discovered_repo entry to prevent re-indexing
+    await discoveredRepoQueries.blockRepo(db, `${owner}/${repo}`);
+
+    const sanitizedReason = reason ? sanitizeReason(String(reason)) : undefined;
+    console.log(
+      `[RepoRemoval] ${username} removed ${owner}/${repo} (${blockedCount} skills blocked)${sanitizedReason ? ` — ${sanitizedReason}` : ''}`
+    );
+
+    return NextResponse.json({
+      success: true,
+      blockedCount,
+      repo: `${owner}/${repo}`,
+    });
+  } catch (error) {
+    console.error('Error processing repo removal request:', error);
+    return NextResponse.json(
+      { error: 'Internal server error', code: 'SERVER_ERROR' },
+      { status: 500 }
+    );
+  }
+}
--- a/apps/web/app/api/stats/route.ts
+++ b/apps/web/app/api/stats/route.ts
@@ -35,7 +35,7 @@ export async function GET(request: NextRequest) {
    }

    // Browse-ready filter: exclude duplicates (matches browseReadyFilter in queries.ts)
-    const browseReady = sql`${skills.isDuplicate} = false`;
+    const browseReady = sql`${skills.isDuplicate} = false AND ${skills.isStale} = false`;

    // Browse-ready skill stats (skills count + contributors)
    const statsResult = await db