skillshare v0.28.2 Release Notes

TL;DR

Plugins: shared config keeps only intent. Sources, refs and selected targets stay in the shared config; native IDs, reviewed commits and pending operations move to machine-local state. Upgrade every machine that writes a shared config before editing plugins — see below.
mcp serve --http-allow-insecure. Serve skills over plain HTTP on a trusted private network, such as a container next to an MCP gateway. The token is still required.
Dashboard: copy an MCP server from another project. A project's Add server dialog has a From another project tab.
Dashboard: see where an enabled global server loads. A project's MCP tab shows the Agents for each enabled global server.
Trash restore keeps the source. A restored skill, tracked repo or agent can be updated and checked again.

Changed: plugin state is split between shared and local

Before, a shared config carried each machine's native paths, reviewed snapshots and pending failures, so one machine could overwrite another machine's target selection with its own progress.

Now the config stores only what you want installed (plugins.version: 2): source, ref, plugin and the targets it goes to. What a machine actually installed lives under <StateDir>/plugins/<config-path-hash>/state.json on that machine. Sync, update and retries never write the shared config.

plugins:
  version: 2
  packages:
    router:
      source: https://github.com/acme/router.git
      plugin: router
      bindings:
        pi: {source: https://github.com/acme/router.git, plugin: router}
        omp: {imported: true}

On a new machine, skillshare plugin sync installs what the config declares. A native-only plugin shows Import required on this machine; install it in the Agent, then run skillshare plugin import LOCAL-ID --from TARGET --name NAME there. skillshare plugin unimport NAME --target TARGET removes a machine's imported binding and keeps the shared declaration.

Upgrading a shared config

Old configs still read fine, and reads and sync leave them unchanged. The first real edit (add, import, remove, change a ref) writes version 2, which older binaries cannot safely write. So, before anyone edits plugins:

Upgrade skillshare on every machine that writes the shared config.
On each machine, while the config is still the old format, run:
```
skillshare plugin list
```
This saves that machine's install records locally, so they are still known after the format changes.

Notes:

Branch refs resolve per machine, so two machines may install different commits. Set source_ref to a commit SHA to pin them all.
Plugin state is keyed by the config's absolute path. Moving or renaming a project folder starts fresh there; remove old installs first, or import them again.
Legacy npm entries stay native-only. Run plugin add npm:PACKAGE again to share an install recipe.

Details: plugin state and migration. Thanks to @salmonumbrella (#651, #660).

New: plain HTTP for `mcp serve` on a private network

skillshare mcp serve --http refuses plain HTTP off loopback unless you give it a TLS certificate. A gateway in another container on the same private Docker network had no way in without a TLS terminator.

--http-allow-insecure allows plain HTTP for that case and logs a warning at startup:

# Set SKILLSHARE_MCP_TOKEN in the server environment and the gateway's bearer config.
skillshare mcp serve --http 0.0.0.0:8765 --http-allow-insecure

The bearer token is still required off loopback, and it travels in plain text, so use this only on a network you trust. The flag works only with --http, and only on the command line, so a repository's config cannot turn it on. Loopback and HTTPS behave as before.

Thanks to @salmonumbrella for the proposal and the implementation (#674, #675).

New: dashboard MCP in projects

Copy a server from another project. In a project's MCP tab, Add server → From another project lists the servers your other projects already have. Pick one and the form fills in: command or URL, environment, headers, tools and Agent settings. Review it and save. The copy uses this project's Agents, not the other project's. (#678, #681)
Where an enabled global server loads. Each enabled global server in a project's MCP tab now shows the Agents it is written to. A row replaced by a project server of the same name shows none. (#677)

Thanks to @chung1912 for both suggestions.

Fixed

Trash restore keeps install metadata. Uninstalling used to drop a skill's, tracked repo's or agent's source record and keep only the files, so a restore came back as a local install that update and check could not follow. Uninstall now saves the record with the trash entry, and every restore (CLI, trash TUI, dashboard) puts it back. Items trashed before this release still restore as local. (#679, #680)
Plugin notes in the dashboard. A skipped or running plugin no longer shows an empty note, and the Blocked fallback appears again.

Contributors

@chung1912, @salmonumbrella

runkids/skillshare v0.28.2 on GitHub