Ronne AI Marketplace 0.6.0

What it added

• Root can have each submission scanned by NVIDIA's SkillSpector, an open-source scanner for skills and other items. By default the scan is static, with pattern and code checks that run on your server, so the item's content doesn't leave it. Root can add a semantic scan that asks an LLM provider of their choice, and then the files go to that provider. It is off until root turns it on, and it covers the item types root picks, Skill by default.
• Root sets the scan up in Admin › Settings › Security scan, in the browser: the scanner, the LLM provider (OpenAI, Anthropic, NVIDIA Build, Azure OpenAI, any OpenAI-compatible endpoint or Ollama), the model, the timeout and the API key. The key can only be written, never read back, and it is stored encrypted. Test connection says whether the provider answers.
• The review page now has tabs, as a pull request does: Overview, Files, Conversation and Security scan. The scan shows a recommendation (Looks safe, Look closely, Likely unsafe), a score out of 100 and every finding with its rule and a link to the file and line. A reviewer can mark a finding as a false positive or accept the risk, with a reason, or send findings back to the author with Request changes. Root can set a score that blocks approval, and override it with a reason. Authors see their own scan, read-only.
• On a Docker install the scanner runs in containers beside Ronne, so Ronne needs no access to the Docker socket. install.sh asks whether to add the security scanner, or takes --scanner no|yes|semantic. The static scanner's network has no way out, and the semantic one reaches the internet only for the provider. Root can also type the scanner's address in Settings.
• Home is rebuilt around the person: a search box for the catalogue, Waiting for you (your drafts, your submissions that need changes and, for reviewers, what waits for review), Recently published and Most used. Root can show a message under the header of every page, an instance notice, with an Information or Warning tone, that each person can dismiss.
• A star on every item keeps a private list of favorites that only you see, on Home and as a filter in the catalogue. Root pins up to 12 items as Start here for everyone, and a workspace's admins pin up to 12 for their workspace, in the order they choose.
• New people see a short Getting started row on Home with three steps, create an access token, connect rmk and install their first item, and the commands for this instance. The first two tick themselves; they press a button to say they installed an item. It goes away when they are done, and item cards have a more compact view.
• Send feedback, in the sidebar, lets anyone tell the people who run the instance about a problem, an idea, a question or some praise, from the page they are on. Root reads it in Admin › Feedback, marks it handled and sees a count of what is new. It goes to this instance's administrators only.
• When root creates an account or resets a password, the person can be asked to choose their own new password the first time they sign in, so only they know it. The box is checked by default.
• Every screen of the web app now comes in English, Brazilian Portuguese and Canadian French: browsing, writing and reviewing, Admin and the setup wizard. People choose in Account › Language, or leave it on Automatic to follow the browser. Item names and descriptions, rmk and the API stay in English.
• An item can move to another scope of its workspace. Root and a workspace's moderators and admins move it at once, and other members ask. Its versions don't change, and the old name keeps working as an alias, so lockfiles and dependencies keep working. The item shows its earlier names as its history.
• rmk-server runs in a Windows terminal again, without a service. Dependency versions published together are ordered by number, and a redirect now goes to the address your browser used.