SkillHub v0.2.19

Review progress and user feedback are now visible in-product, failed security scans are recoverable, and upgrade and agent-install flows are safer.

🌟 Highlights

Authors can track review attempts and resubmit rejected versions, while users can leave text reviews and administrators can moderate them.
Security scanning now bounds unavailable-task recovery and lets authorized users safely retry terminal failed scans.
Skill details provide an install-for-agent prompt, the starter collection adds the pinned HOL Guard plugin scanner, and CLI 0.1.11 adds explicit, source-safe upgrade and namespace-sync behavior.

Add author-facing review progress, durable attempt history, rejected-version resubmission, and persistent light/dark themes by @XiaoSeS in #791.
Add public text reviews to skill ratings, current-user editing, and audited administrator moderation by @XiaoSeS in #793.
Add a permission-checked, idempotent retry flow for terminal SCAN_FAILED versions by @XiaoSeS in #811.
Add a localized install-for-agent prompt that preserves full namespace coordinates by @FenjuFu in #788.
Add the pinned HOL Guard plugin-scanner Skill to the curated starter collection; this does not replace or extend the Server scanner pipeline by @XiaoSeS in #814.
Release CLI 0.1.11 with bounded source-safe Skill upgrades, fingerprint-safe install and sync, explicit namespace pull selection, and accurate asynchronous submission status by @XiaoSeS and @dongmucat in #796, #804, #815, and #816.

Match package allowlisted filenames case-insensitively by @FenjuFu in #773.
Serialize audit detail JSON with Jackson instead of string concatenation by @FenjuFu in #782.
Allow public routes to remain accessible when a browser carries an expired session by @XiaoSeS in #783.
Return deterministic conflicts for concurrent publishes of the same coordinate by @FenjuFu in #784.
Converge concurrent OAuth identity binding and make governance mutations atomic with their audit records by @XiaoSeS in #786 and #787.
Harden session boundaries, scanner recovery, and CLI guidance across platform flows by @XiaoSeS in #801.
Preserve the dashboard return target when opening and closing skill details by @XiaoSeS in #805.
Bound recovery of unavailable scan tasks so expired deliveries become SCAN_FAILED instead of remaining pending indefinitely by @XiaoSeS in #809.
Revalidate the SPA entry document after deployments so browsers do not retain an obsolete asset graph by @FenjuFu in #812.

Paginate promotion review queues instead of loading an unbounded result set by @FenjuFu in #774.

Clarify which ClawHub search, inspect, install, and publish workflows are compatible with SkillHub by @XiaoSeS in #806.

Replace notification SSE delivery with authenticated polling and remove the notification-only stream implementation by @XiaoSeS in #807.
Add regression coverage for downloading a globally promoted Skill after approval by @XiaoSeS in #792.
Patch the open Dependabot alerts in Web and documentation dependencies by @dongmucat in #813.

See the linked pull requests for contributor attribution.

Full Changelog: v0.2.18...v0.2.19