sync: stale skill detection, sentry filtering, claim removal, review improvements

Stale Detection:
- Detect skills removed/moved from GitHub (3 consecutive 404s threshold)
- Hide stale skills from browse/search, show warning banner on detail page
- Serve cached files with isStale flag when GitHub returns 404
- Add stale-check crawler command for batch verification
- CLI shows warning when installing stale skills from cache

Sentry & Error Handling:
- Filter browser extension errors and add denyUrls
- Anti-inflation measures and sentinel recalibration for curation

Claim & Removal:
- Enhanced ClaimForm with repo-level removal support
- Add repo-removal-request API endpoint with tests
- Improved owner page with bilingual content

Review Pipeline:
- Review version and reviewer tracking in submit API
- Source format filter for pending reviews
- Updated review tests

Other:
- Updated i18n strings (en/fa)
- BrowseFilters improvements
- Dockerfile updates

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/app/api/review/pending/route.ts

@@ -49,6 +49,9 @@ export async function GET(request: NextRequest) {
       Math.max(parseInt(searchParams.get('owner_limit') ?? '0', 10) || 0, 0),
       10
     );
+    const currentReviewVersion = Math.max(
+      parseInt(searchParams.get('review_version') ?? '0', 10) || 0, 0
+    );
 
     // Run counts in parallel
     const [totalPending, reReviews] = await Promise.all([
@@ -68,6 +71,7 @@ export async function GET(request: NextRequest) {
         securityPass,
         reReviewAll: true,
         ownerLimit,
+        currentReviewVersion,
       }) as typeof batch;
       batch = [...allBatch].slice(0, batchSize);
     } else {

apps/web/app/api/review/submit/route.ts

@@ -22,6 +22,8 @@ interface ReviewItem {
   i18n_priority?: number;
   content_hash_at_review?: string;
   set_verified?: boolean;
+  review_version?: number;
+  reviewer?: string;
 }
 
 function validateReviews(body: unknown): { reviews: ReviewItem[] } | { error: string } {
@@ -60,6 +62,18 @@ function validateReviews(body: unknown): { reviews: ReviewItem[] } | { error: st
         return { error: `reviews[${i}].i18n_priority must be an integer 0-2` };
       }
     }
+    // Validate review_version (positive integer)
+    if (item.review_version !== undefined && item.review_version !== null) {
+      if (typeof item.review_version !== 'number' || !Number.isInteger(item.review_version) || item.review_version < 1) {
+        return { error: `reviews[${i}].review_version must be a positive integer` };
+      }
+    }
+    // Validate reviewer (non-empty string, max 50 chars)
+    if (item.reviewer !== undefined && item.reviewer !== null) {
+      if (typeof item.reviewer !== 'string' || item.reviewer.length === 0 || item.reviewer.length > 50) {
+        return { error: `reviews[${i}].reviewer must be a non-empty string (max 50 chars)` };
+      }
+    }
   }
 
   return { reviews: reviews as ReviewItem[] };
@@ -106,7 +120,7 @@ export async function POST(request: NextRequest) {
     // Insert review rows
     const dbReviews = reviews.map((r) => ({
       skillId: r.skill_id,
-      reviewer: 'claude-code' as const,
+      reviewer: r.reviewer || 'claude-code',
       aiScore: r.ai_score,
       instructionQuality: r.instruction_quality,
       descriptionPrecision: r.description_precision,
@@ -119,6 +133,7 @@ export async function POST(request: NextRequest) {
       needsImprovement: r.needs_improvement ?? undefined,
       i18nPriority: r.i18n_priority,
       contentHashAtReview: r.content_hash_at_review,
+      reviewVersion: r.review_version,
     }));
 
     await skillReviewQueries.createBatch(db, dbReviews);

apps/web/app/api/skill-files/route.ts

@@ -39,6 +39,7 @@ interface SkillFile {
   content: string;
   size: number;
   isBinary: boolean;
+  fetchFailed?: boolean;
 }
 
 interface CachedFiles {
@@ -136,7 +137,7 @@ export async function GET(request: NextRequest) {
     }
 
     // Fetch skill folder contents from GitHub
-    const files = await fetchSkillFiles(
+    const { files, fetchFailureCount } = await fetchSkillFiles(
       githubOwner,
       githubRepo,
       skillPath,
@@ -146,19 +147,22 @@ export async function GET(request: NextRequest) {
       token
     );
 
-    // === SAVE TO CACHE ===
-    // Prepare cached files structure
-    const filesToCache: CachedFiles = {
-      fetchedAt: new Date().toISOString(),
-      commitSha: commitSha || 'unknown',
-      totalSize: files.reduce((sum, f) => sum + f.size, 0),
-      items: files,
-    };
+    // === SAVE TO CACHE (only if all files fetched successfully) ===
+    if (fetchFailureCount > 0) {
+      console.warn(`[skill-files] Skipping cache for ${skillId}: ${fetchFailureCount} file(s) failed to fetch`);
+    } else {
+      const filesToCache: CachedFiles = {
+        fetchedAt: new Date().toISOString(),
+        commitSha: commitSha || 'unknown',
+        totalSize: files.reduce((sum, f) => sum + f.size, 0),
+        items: files.map(({ fetchFailed: _, ...rest }) => rest),
+      };
 
-    // Save to database (async, don't block response)
-    skillQueries.updateCachedFiles(db, skillId, filesToCache).catch((err) => {
-      console.error(`[skill-files] Failed to cache files for ${skillId}:`, err);
-    });
+      // Save to database (async, don't block response)
+      skillQueries.updateCachedFiles(db, skillId, filesToCache).catch((err) => {
+        console.error(`[skill-files] Failed to cache files for ${skillId}:`, err);
+      });
+    }
 
     // Note: Download count is NOT incremented here.
     // It should only be incremented in /api/skills/install after successful download.
@@ -180,6 +184,7 @@ export async function GET(request: NextRequest) {
         downloadUrl: item.isBinary ? `https://raw.githubusercontent.com/${githubOwner}/${githubRepo}/${branch || 'main'}/${skillPath}/${item.path}` : undefined,
       })),
       fromCache: false,
+      ...(fetchFailureCount > 0 ? { fetchFailures: fetchFailureCount } : {}),
     }, {
       headers: createRateLimitHeaders(rateLimitResult),
     });
@@ -204,6 +209,44 @@ export async function GET(request: NextRequest) {
     }
 
     if (errorMessage.includes('404')) {
+      // Increment stale check (non-blocking) — after 3 consecutive 404s, skill is marked stale
+      const skillId404 = request.nextUrl.searchParams.get('id');
+      if (skillId404) {
+        skillQueries.incrementStaleCheck(db, skillId404).catch((err) => {
+          console.error(`[skill-files] Failed to increment stale check for ${skillId404}:`, err);
+        });
+      }
+
+      // If we have cached files in DB, serve them with stale warning instead of 404
+      if (skillId404) {
+        const skill404 = await skillQueries.getById(db, skillId404);
+        if (skill404?.cachedFiles) {
+          const cached = skill404.cachedFiles as CachedFiles;
+          return NextResponse.json({
+            skillId: skillId404,
+            githubOwner: skill404.githubOwner,
+            githubRepo: skill404.githubRepo,
+            skillPath: skill404.skillPath,
+            branch: skill404.branch || 'main',
+            sourceFormat: skill404.sourceFormat || 'skill.md',
+            files: cached.items.map(item => ({
+              name: item.name,
+              path: item.path,
+              type: 'file' as const,
+              size: item.size,
+              content: item.isBinary ? undefined : item.content,
+              downloadUrl: item.isBinary ? `https://raw.githubusercontent.com/${skill404.githubOwner}/${skill404.githubRepo}/${skill404.branch || 'main'}/${skill404.skillPath}/${item.path}` : undefined,
+            })),
+            fromCache: true,
+            cachedAt: cached.fetchedAt,
+            isStale: true,
+            staleWarning: 'This skill may have been removed from GitHub. Files served from cache.',
+          }, {
+            headers: createRateLimitHeaders(rateLimitResult),
+          });
+        }
+      }
+
       return NextResponse.json(
         { error: 'Skill files not found on GitHub', code: 'GITHUB_NOT_FOUND' },
         { status: 404 }
@@ -314,7 +357,7 @@ async function fetchSkillFiles(
   depth: number = 0,
   headers: Record<string, string>,
   token: string | null
-): Promise<SkillFile[]> {
+): Promise<{ files: SkillFile[]; fetchFailureCount: number }> {
   // Phase 1: Collect all file entries from directory tree
   const entries = await collectFileEntries(owner, repo, path, ref, depth, headers, token);
 
@@ -326,6 +369,7 @@ async function fetchSkillFiles(
 
   // Phase 2: Fetch file contents in parallel
   let totalSize = 0;
+  let fetchFailureCount = 0;
   const tasks = entries.map((entry) => async (): Promise<SkillFile> => {
     const { item, relativePath } = entry;
     const isBinary = !isTextFile(item.name);
@@ -340,15 +384,18 @@ async function fetchSkillFiles(
           content,
           size: item.size,
           isBinary: false,
+          fetchFailed: false,
         };
       } catch {
-        // Content fetch failed — return as binary with download URL
+        // Content fetch failed — mark as failed so we skip caching
+        fetchFailureCount++;
         return {
           name: item.name,
           path: relativePath,
           content: '',
           size: item.size,
           isBinary: true,
+          fetchFailed: true,
         };
       }
     }
@@ -360,10 +407,12 @@ async function fetchSkillFiles(
       content: '',
       size: item.size,
       isBinary: true,
+      fetchFailed: false,
     };
   });
 
-  return parallelLimit(tasks, PARALLEL_FETCH_LIMIT);
+  const files = await parallelLimit(tasks, PARALLEL_FETCH_LIMIT);
+  return { files, fetchFailureCount };
 }
 
 /**

apps/web/app/api/skills/add-request/route.test.ts

@@ -0,0 +1,229 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+
+// Mock auth
+const mockAuth = vi.fn();
+vi.mock('@/lib/auth', () => ({
+  auth: () => mockAuth(),
+}));
+
+// Mock sanitize
+vi.mock('@/lib/sanitize', () => ({
+  sanitizeReason: (r: string) => r,
+}));
+
+// Mock email
+vi.mock('@/lib/email', () => ({
+  sendClaimSubmittedEmail: vi.fn().mockResolvedValue(undefined),
+}));
+
+// Mock db
+vi.mock('@skillhub/db', () => ({
+  createDb: vi.fn(() => ({})),
+  userQueries: {
+    getByGithubId: vi.fn(),
+    upsertFromGithub: vi.fn(),
+  },
+  skillQueries: {
+    unblockByRepo: vi.fn(),
+  },
+  addRequestQueries: {
+    hasPendingRequest: vi.fn(),
+    create: vi.fn(),
+    updateStatus: vi.fn(),
+  },
+  discoveredRepoQueries: {
+    getById: vi.fn(),
+    upsert: vi.fn(),
+    unblockRepo: vi.fn(),
+  },
+}));
+
+import { POST, GET } from './route';
+import { userQueries, skillQueries, addRequestQueries, discoveredRepoQueries } from '@skillhub/db';
+
+function createMockUser(overrides: Partial<{ id: string; githubId: string; email: string }> = {}) {
+  return {
+    id: 'user-123',
+    githubId: 'gh-12345',
+    username: 'testuser',
+    email: 'test@example.com',
+    preferredLocale: 'en',
+    ...overrides,
+  };
+}
+
+function createRequest(body: unknown) {
+  return new NextRequest('http://localhost:3000/api/skills/add-request', {
+    method: 'POST',
+    body: JSON.stringify(body),
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+describe('/api/skills/add-request', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    // Disable real fetch by default
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  describe('GET', () => {
+    it('should return 401 when not authenticated', async () => {
+      mockAuth.mockResolvedValue(null);
+
+      const response = await GET();
+      const data = await response.json();
+
+      expect(response.status).toBe(401);
+      expect(data.error).toBeDefined();
+    });
+
+    it('should return empty requests for unknown user', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345' } });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(null as any);
+
+      const response = await GET();
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.requests).toEqual([]);
+    });
+  });
+
+  describe('POST', () => {
+    it('should return 401 when not authenticated', async () => {
+      mockAuth.mockResolvedValue(null);
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/owner/repo' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(401);
+      expect(data.code).toBe('AUTH_REQUIRED');
+    });
+
+    it('should return 400 for missing repositoryUrl', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'testuser' } });
+
+      const response = await POST(createRequest({}));
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.code).toBe('INVALID_INPUT');
+    });
+
+    it('should return 400 for invalid GitHub URL', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'testuser' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+
+      // gitlab.com does not contain the substring 'github.com'
+      const response = await POST(createRequest({ repositoryUrl: 'https://gitlab.com/owner/repo' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.code).toBe('INVALID_URL');
+    });
+
+    it('should return 403 REPO_BLOCKED_BY_OWNER when non-owner tries to add blocked repo', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'non-owner' } });
+      const mockUser = createMockUser({ githubId: 'gh-12345' });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(discoveredRepoQueries.getById).mockResolvedValue({
+        id: 'rawveg/skillsforge-marketplace',
+        isBlocked: true,
+      } as any);
+      // GitHub API says the owner is 'rawveg', not 'non-owner'
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' }, default_branch: 'main', private: false }),
+      } as any));
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(403);
+      expect(data.code).toBe('REPO_BLOCKED_BY_OWNER');
+    });
+
+    it('should re-enable repo when owner re-adds their blocked repo', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser({ githubId: 'gh-12345' });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(discoveredRepoQueries.getById).mockResolvedValue({
+        id: 'rawveg/skillsforge-marketplace',
+        isBlocked: true,
+      } as any);
+      vi.mocked(skillQueries.unblockByRepo).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.unblockRepo).mockResolvedValue(undefined);
+      vi.mocked(addRequestQueries.hasPendingRequest).mockResolvedValue(false as any);
+      vi.mocked(addRequestQueries.create).mockResolvedValue('req-123' as any);
+      vi.mocked(addRequestQueries.updateStatus).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.upsert).mockResolvedValue(undefined as any);
+
+      // First fetch: ownership check (inside blocked-repo logic)
+      // Second fetch: repo validation (validateGitHubRepo → repoResponse)
+      // Third fetch: tree scan (findSkillMdFiles)
+      vi.stubGlobal('fetch', vi.fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({ owner: { login: 'rawveg' }, default_branch: 'main', private: false }),
+        } as any)
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({ owner: { login: 'rawveg' }, default_branch: 'main', private: false }),
+        } as any)
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            tree: [
+              { path: 'SKILL.md', type: 'blob' },
+            ],
+            truncated: false,
+          }),
+        } as any)
+      );
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.reEnabled).toBe(true);
+      expect(skillQueries.unblockByRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg', 'skillsforge-marketplace');
+      expect(discoveredRepoQueries.unblockRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg/skillsforge-marketplace');
+    });
+
+    it('should proceed normally when repo is not blocked (Case C)', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'newuser' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(discoveredRepoQueries.getById).mockResolvedValue(null as any);
+      vi.mocked(addRequestQueries.hasPendingRequest).mockResolvedValue(false as any);
+      vi.mocked(addRequestQueries.create).mockResolvedValue('req-456' as any);
+      vi.mocked(addRequestQueries.updateStatus).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.upsert).mockResolvedValue(undefined as any);
+
+      vi.stubGlobal('fetch', vi.fn()
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({ owner: { login: 'someowner' }, default_branch: 'main', private: false }),
+        } as any)
+        .mockResolvedValueOnce({
+          ok: true,
+          json: async () => ({
+            tree: [{ path: 'SKILL.md', type: 'blob' }],
+            truncated: false,
+          }),
+        } as any)
+      );
+
+      const response = await POST(createRequest({ repositoryUrl: 'https://github.com/someowner/newrepo' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.reEnabled).toBeUndefined();
+    });
+  });
+});

apps/web/app/api/skills/add-request/route.ts

@@ -1,7 +1,7 @@
 import type { NextRequest } from 'next/server';
 import { NextResponse } from 'next/server';
 import { auth } from '@/lib/auth';
-import { createDb, addRequestQueries, discoveredRepoQueries, userQueries } from '@skillhub/db';
+import { createDb, addRequestQueries, discoveredRepoQueries, skillQueries, userQueries } from '@skillhub/db';
 import { sanitizeReason } from '@/lib/sanitize';
 import { sendClaimSubmittedEmail } from '@/lib/email';
 
@@ -337,6 +337,52 @@ export async function POST(request: NextRequest) {
       );
     }
 
+    // Check if repo was previously blocked by its owner
+    let reEnabled = false;
+    const existingRepo = await discoveredRepoQueries.getById(db, `${parsed.owner}/${parsed.repo}`);
+    if (existingRepo?.isBlocked) {
+      // Verify whether the current requester is the repo owner
+      let requesterIsOwner = false;
+      try {
+        const ownerCheckRes = await fetch(
+          `https://api.github.com/repos/${parsed.owner}/${parsed.repo}`,
+          {
+            headers: {
+              Accept: 'application/vnd.github.v3+json',
+              'User-Agent': 'SkillHub',
+              ...(process.env.GITHUB_TOKEN && {
+                Authorization: `Bearer ${process.env.GITHUB_TOKEN}`,
+              }),
+            },
+            signal: AbortSignal.timeout(10000),
+          }
+        );
+        if (ownerCheckRes.ok) {
+          const repoData = await ownerCheckRes.json() as { owner?: { login?: string } };
+          requesterIsOwner =
+            repoData.owner?.login?.toLowerCase() === session.user.username.toLowerCase();
+        }
+      } catch {
+        // If we can't reach GitHub, treat as non-owner (safe default)
+      }
+
+      if (!requesterIsOwner) {
+        // Case B: repo blocked by its owner, non-owner trying to re-add
+        return NextResponse.json(
+          {
+            error: 'This repository was removed by its owner and cannot be re-added.',
+            code: 'REPO_BLOCKED_BY_OWNER',
+          },
+          { status: 403 }
+        );
+      }
+
+      // Case A: owner is re-enabling their previously blocked repo
+      await skillQueries.unblockByRepo(db, parsed.owner, parsed.repo);
+      await discoveredRepoQueries.unblockRepo(db, `${parsed.owner}/${parsed.repo}`);
+      reEnabled = true;
+    }
+
     // Check if user already has a pending request for this repository + path combination
     const hasPending = await addRequestQueries.hasPendingRequest(
       db,
@@ -438,6 +484,7 @@ export async function POST(request: NextRequest) {
       skillCount: validation.skillPaths.length,
       skillPaths: validation.skillPaths,
       message,
+      ...(reEnabled && { reEnabled: true }),
     });
   } catch (error) {
     console.error('Error creating add request:', error);

apps/web/app/api/skills/repo-removal-request/route.test.ts

@@ -0,0 +1,163 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest';
+import { NextRequest } from 'next/server';
+
+// Mock auth
+const mockAuth = vi.fn();
+vi.mock('@/lib/auth', () => ({
+  auth: () => mockAuth(),
+}));
+
+// Mock sanitize
+vi.mock('@/lib/sanitize', () => ({
+  sanitizeReason: (r: string) => r,
+}));
+
+// Mock db
+vi.mock('@skillhub/db', () => ({
+  createDb: vi.fn(() => ({})),
+  userQueries: {
+    getByGithubId: vi.fn(),
+    upsertFromGithub: vi.fn(),
+  },
+  skillQueries: {
+    countByRepo: vi.fn(),
+    blockByRepo: vi.fn(),
+  },
+  discoveredRepoQueries: {
+    blockRepo: vi.fn(),
+  },
+}));
+
+import { POST } from './route';
+import { userQueries, skillQueries, discoveredRepoQueries } from '@skillhub/db';
+
+function createMockUser(overrides: Partial<{ id: string; githubId: string }> = {}) {
+  return {
+    id: 'user-123',
+    githubId: 'gh-12345',
+    username: 'rawveg',
+    ...overrides,
+  };
+}
+
+function createRequest(body: unknown) {
+  return new NextRequest('http://localhost:3000/api/skills/repo-removal-request', {
+    method: 'POST',
+    body: JSON.stringify(body),
+    headers: { 'Content-Type': 'application/json' },
+  });
+}
+
+describe('/api/skills/repo-removal-request', () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    vi.stubGlobal('fetch', vi.fn());
+  });
+
+  describe('POST', () => {
+    it('should return 401 when not authenticated', async () => {
+      mockAuth.mockResolvedValue(null);
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(401);
+      expect(data.code).toBe('AUTH_REQUIRED');
+    });
+
+    it('should return 400 for missing repoUrl', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+
+      const response = await POST(createRequest({}));
+
+      expect(response.status).toBe(400);
+    });
+
+    it('should return 400 PARSE_ERROR for invalid repo format', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+
+      const response = await POST(createRequest({ repoUrl: 'not-a-valid-format' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(data.code).toBe('PARSE_ERROR');
+    });
+
+    it('should return 404 INVALID_REPO when repo not found on GitHub', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: false,
+        status: 404,
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(404);
+      expect(data.code).toBe('INVALID_REPO');
+    });
+
+    it('should return 403 NOT_OWNER when requester is not repo owner', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'other-user' } });
+      const mockUser = createMockUser({ githubId: 'gh-12345' });
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' } }),
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(403);
+      expect(data.code).toBe('NOT_OWNER');
+    });
+
+    it('should block all skills and return success when owner removes repo', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(skillQueries.countByRepo).mockResolvedValue(16 as any);
+      vi.mocked(skillQueries.blockByRepo).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.blockRepo).mockResolvedValue(undefined);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' } }),
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'rawveg/skillsforge-marketplace', reason: 'I want my skills removed' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.blockedCount).toBe(16);
+      expect(data.repo).toBe('rawveg/skillsforge-marketplace');
+      expect(skillQueries.blockByRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg', 'skillsforge-marketplace');
+      expect(discoveredRepoQueries.blockRepo).toHaveBeenCalledWith(expect.anything(), 'rawveg/skillsforge-marketplace');
+    });
+
+    it('should accept full GitHub URL format', async () => {
+      mockAuth.mockResolvedValue({ user: { githubId: 'gh-12345', username: 'rawveg' } });
+      const mockUser = createMockUser();
+      vi.mocked(userQueries.getByGithubId).mockResolvedValue(mockUser as any);
+      vi.mocked(skillQueries.countByRepo).mockResolvedValue(0 as any);
+      vi.mocked(skillQueries.blockByRepo).mockResolvedValue(undefined);
+      vi.mocked(discoveredRepoQueries.blockRepo).mockResolvedValue(undefined);
+      vi.stubGlobal('fetch', vi.fn().mockResolvedValue({
+        ok: true,
+        json: async () => ({ owner: { login: 'rawveg' } }),
+      } as any));
+
+      const response = await POST(createRequest({ repoUrl: 'https://github.com/rawveg/skillsforge-marketplace' }));
+      const data = await response.json();
+
+      expect(response.status).toBe(200);
+      expect(data.success).toBe(true);
+      expect(data.repo).toBe('rawveg/skillsforge-marketplace');
+    });
+  });
+});

apps/web/app/api/skills/repo-removal-request/route.ts

@@ -0,0 +1,158 @@
+import type { NextRequest } from 'next/server';
+import { NextResponse } from 'next/server';
+import { auth } from '@/lib/auth';
+import { createDb, skillQueries, discoveredRepoQueries, userQueries } from '@skillhub/db';
+import { sanitizeReason } from '@/lib/sanitize';
+
+export const dynamic = 'force-dynamic';
+
+const db = createDb();
+
+function parseOwnerRepo(input: string): { owner: string; repo: string } | null {
+  try {
+    if (input.startsWith('https://') || input.startsWith('http://')) {
+      const url = new URL(input);
+      if (!url.hostname.includes('github.com')) return null;
+      const parts = url.pathname.split('/').filter(Boolean);
+      if (parts.length < 2) return null;
+      return { owner: parts[0], repo: parts[1] };
+    }
+    const parts = input.split('/').filter(Boolean);
+    if (parts.length < 2) return null;
+    return { owner: parts[0], repo: parts[1] };
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * POST /api/skills/repo-removal-request
+ * Block all skills from a GitHub repository at once.
+ * Verifies the authenticated user owns the repo, then blocks all skills and
+ * prevents the repo from being re-indexed.
+ */
+export async function POST(request: NextRequest) {
+  try {
+    const session = await auth();
+
+    if (!session?.user?.githubId || !session.user.username) {
+      return NextResponse.json(
+        { error: 'Authentication required', code: 'AUTH_REQUIRED' },
+        { status: 401 }
+      );
+    }
+
+    const body = await request.json();
+    const { repoUrl, reason } = body;
+
+    if (!repoUrl) {
+      return NextResponse.json(
+        { error: 'repoUrl is required', code: 'INVALID_INPUT' },
+        { status: 400 }
+      );
+    }
+
+    const parsed = parseOwnerRepo(String(repoUrl).trim());
+    if (!parsed) {
+      return NextResponse.json(
+        { error: 'Invalid format. Use https://github.com/owner/repo or owner/repo', code: 'PARSE_ERROR' },
+        { status: 400 }
+      );
+    }
+
+    const { owner, repo } = parsed;
+    const username = session.user.username;
+
+    // Get or create user
+    let dbUser = await userQueries.getByGithubId(db, session.user.githubId);
+    if (!dbUser) {
+      dbUser = await userQueries.upsertFromGithub(db, {
+        githubId: session.user.githubId,
+        username: session.user.username,
+        displayName: session.user.name || undefined,
+        email: session.user.email || undefined,
+        avatarUrl: session.user.image || undefined,
+      });
+    }
+    if (!dbUser) {
+      return NextResponse.json(
+        { error: 'Failed to create user record', code: 'USER_CREATE_FAILED' },
+        { status: 500 }
+      );
+    }
+
+    // Verify repo ownership via GitHub API
+    let isOwner = false;
+    let githubError: string | null = null;
+
+    try {
+      const repoResponse = await fetch(
+        `https://api.github.com/repos/${owner}/${repo}`,
+        {
+          headers: {
+            Accept: 'application/vnd.github.v3+json',
+            'User-Agent': 'SkillHub',
+          },
+          signal: AbortSignal.timeout(10000),
+        }
+      );
+
+      if (repoResponse.ok) {
+        const repoData = await repoResponse.json();
+        if (repoData.owner?.login?.toLowerCase() === username.toLowerCase()) {
+          isOwner = true;
+        }
+      } else if (repoResponse.status === 404) {
+        return NextResponse.json(
+          { error: 'Repository not found on GitHub', code: 'INVALID_REPO' },
+          { status: 404 }
+        );
+      } else if (repoResponse.status === 403) {
+        githubError = 'GitHub API rate limit exceeded. Please try again later.';
+      }
+    } catch (fetchError) {
+      console.error('GitHub API fetch error:', fetchError);
+      githubError = 'Failed to verify repository ownership';
+    }
+
+    if (githubError) {
+      return NextResponse.json(
+        { error: githubError, code: 'GITHUB_ERROR' },
+        { status: 502 }
+      );
+    }
+
+    if (!isOwner) {
+      return NextResponse.json(
+        { error: 'You are not the owner of this repository', code: 'NOT_OWNER' },
+        { status: 403 }
+      );
+    }
+
+    // Count skills before blocking (for response message)
+    const blockedCount = await skillQueries.countByRepo(db, owner, repo);
+
+    // Block all skills from the repo
+    await skillQueries.blockByRepo(db, owner, repo);
+
+    // Block the discovered_repo entry to prevent re-indexing
+    await discoveredRepoQueries.blockRepo(db, `${owner}/${repo}`);
+
+    const sanitizedReason = reason ? sanitizeReason(String(reason)) : undefined;
+    console.log(
+      `[RepoRemoval] ${username} removed ${owner}/${repo} (${blockedCount} skills blocked)${sanitizedReason ? ` — ${sanitizedReason}` : ''}`
+    );
+
+    return NextResponse.json({
+      success: true,
+      blockedCount,
+      repo: `${owner}/${repo}`,
+    });
+  } catch (error) {
+    console.error('Error processing repo removal request:', error);
+    return NextResponse.json(
+      { error: 'Internal server error', code: 'SERVER_ERROR' },
+      { status: 500 }
+    );
+  }
+}

apps/web/app/api/stats/route.ts

@@ -35,7 +35,7 @@ export async function GET(request: NextRequest) {
     }
 
     // Browse-ready filter: exclude duplicates (matches browseReadyFilter in queries.ts)
-    const browseReady = sql`${skills.isDuplicate} = false`;
+    const browseReady = sql`${skills.isDuplicate} = false AND ${skills.isStale} = false`;
 
     // Browse-ready skill stats (skills count + contributors)
     const statsResult = await db