[harlan-zw]

❓ Type of change

• 👌 Enhancement

📚 Description

Two things took data public with no way to close them. Both now have a switch. Both switches are on by default, because skilld.dev is early and the registry grows on indexed Skills.

• Repository indexing. Sign-in still scans the account's public repositories for SKILL.md and indexes what it finds. Those files are already public on GitHub, and indexing them is how the catalog grows. The onboarding step now says so, and "Add Skills from your public repositories" in /me turns it off. POST /api/me/repos/scan refuses with a 403 when it is off, so one switch decides for both paths.
• Liked Skills. /@login/liked stays public, which is how it already worked, so no shared link breaks. "Show liked Skills on your profile" in /me closes it. A closed list answers 404 to everyone except its owner, the same answer as a missing account, so a visitor cannot learn which accounts closed theirs. The profile shows the Liked link only to viewers who can open it, and the owner of a closed list sees "Only you can see your liked Skills".

Migration 0121 adds both columns with a default of 1, so no existing account changes behaviour when it lands.

flowchart TD
  A["GitHub sign-in"] -->|"first sign-in"| B{"users.repo_indexing"}
  B -->|"1, the default"| C["scanOwnedRepos in waitUntil"]
  B -->|"0"| D["no scan"]
  E["POST /api/me/repos/scan"] --> B
  F["/@login/liked"] --> G{"users.likes_public"}
  G -->|"1, the default"| H["public list"]
  G -->|"0, viewer is owner"| I["owner-only list"]
  G -->|"0, anyone else"| J["404, same as a missing account"]
  K["/me privacy switches"] -->|"PATCH /api/me/privacy"| B
  K --> G

Loading

Notes for a reviewer:

• The privacy patch takes one switch or both, and an empty body is a 400. Turning one off cannot silently reset the other.
• A /me scan runs in the request, not in waitUntil, so an account with many Skill repositories waits on a spinner with a note that the check can take a minute. Sign-in still scans in the background.
• Turning indexing off stops future scans. Skills already indexed stay, because GitHub is their source and discovery would find them again. The prompt says that.
• Merge order: chore(analytics): keep anonymous usage aggregates, drop the visitor trail #240 takes migration 0119 and feat(identity): count email clicks as daily aggregates #243 takes 0120, so this one is 0121. Renumber if it lands first.

🤖 AI disclosure: Harlan Agent Kit modified this description. My AI open-source policy.

[harlan-zw]

Checked by hand in the running dev app, since CI cannot cover it:

• Onboarding shows the prompt, and nothing runs until the click. The local account has no GitHub token, so the scan returned 401, and the prompt offered a new sign-in.
• The switch in /me saved both ways. The owner saw the Liked link, the private note on the profile, and the note on /liked.
• A signed-out curl got 404 from /api/likes/by-user/:login, /visibility, and /@login/liked. The profile HTML had no /liked link.

Onboarding prompt	After click (no local token)

Settings: off	Settings: on

Profile, owner of private list	/liked, owner of private list

[harlan-github-agent]

🤖 MERGED

Harlan Agent Kit posted this automated review. It is not Harlan's personal review or approval. AI open source policy. Last updated: 2026-09-22 07:10 UTC.

GitHub merged this pull request.

No material findings were recorded.

9ec9cc3b-ffcd-451f-9c9a-b57433c52c92