skillshare v0.30.6 Release Notes

TL;DR

1. check --exit-code fails CI when something is not up to date. check --all now really checks agents as well as skills, and check --json stays valid JSON when a name does not match.
2. Provider tokens go only to their own hosts. GitHub Enterprise, self-hosted GitLab and self-hosted Gitea/CNB need a small configuration change; see the migration note below.
3. Project config.yaml matches what is installed. Uninstall, reinstall from a new source and installs on a fresh clone keep the shared config true.
4. Skills installed with -s from GitLab, Bitbucket or file:// install again, and older records are repaired on their next update.
5. Running skillshare from a Git hook no longer touches the hook's repository.
6. The Herdr panel ships as a standalone mod that keeps your current layout, and loads its lists as they arrive.

CLI: check for CI

check used to exit 1 only when an item could not be checked, so a CI job that wanted to fail on pending updates had to parse --json. Pass --exit-code to also exit 1 when a check ran cleanly but finds an available update, a stale or locally modified skill, or a tracked repository that is behind, has uncommitted changes or is missing. Items with nothing to compare (status local) are left out. The default exit status is unchanged. --exit-code works with --json and check agents, and cannot be combined with --diff. (#865)

skillshare check --all --exit-code               # Skills and agents in one CI step
skillshare check --exit-code --json > check.json

check --all was documented as checking skills and agents but ran only the skills check, so check --all --exit-code passed while an agent had drifted. It now prints a Skills and an Agents section, and --json adds an agents array beside tracked_repos and skills. --all is now rejected together with names or --group instead of being ignored. (#867)

check <name> --json printed warnings before the JSON, and when no name or group matched it printed an empty result and exited 0, so a mistyped name passed a CI gate. With --json, a run where nothing matches now exits 1 with an {"error": "..."} object, skipped names go in a warnings array, and other failures such as an invalid flag combination use the same error object. Text mode is unchanged. (#868)

Security: credential and filesystem boundaries

GITHUB_TOKEN, GITLAB_TOKEN, BITBUCKET_TOKEN, AZURE_DEVOPS_TOKEN, GITEA_TOKEN and CNB_TOKEN are now sent only over HTTPS on the default port (or 443) to github.com, gitlab.com, bitbucket.org, dev.azure.com, *.visualstudio.com, gitea.com and cnb.cool. A host whose name merely contains a provider name no longer receives that provider's token. GitHub API credentials stay on api.github.com and raw.githubusercontent.com and are dropped on cross-origin redirects. The web dashboard's remote search and install preview now refuse cross-site browser requests, as its other actions already did.

A repository's .agents/skills/ fallback is used only when .agents and skills are real folders, not symlinks or junctions, even with follow_source_links: true. Installing or updating discovered agents refuses a destination reached through a link, and an audit that blocks the update leaves the existing agent files unchanged. (#861)

Migration: self-hosted servers

• Self-hosted Gitea or CNB: add the server's exact hostname to gitea_hosts or cnb_hosts in config.yaml, even when the name contains gitea. Without it, GITEA_TOKEN or CNB_TOKEN is not sent.
• GitHub Enterprise, self-hosted GitLab and other hosts: GITHUB_TOKEN and GITLAB_TOKEN are no longer sent there. Use a host-scoped Git credential helper, or set SKILLSHARE_GIT_TOKEN only for that command, because it is sent to any HTTPS source.

gitea_hosts:
  - git.company.com

Project mode: config.yaml stays true

In project mode, the committed .skillshare/config.yaml is what teammates install from, but it could disagree with what a machine had (#858, #860):

• uninstall -p and removing a skill or tracked repository in the dashboard left its entry in config.yaml, so the next install -p brought it back. They now remove the entry and its lock pin.
• Reinstalling a skill from another source or branch updated only local records, so teammates kept installing the old source. The config entry now follows the skills the command actually reinstalled.
• On a fresh clone, install <source> -p deleted the other declared skills that were not installed yet. It no longer does.

Install and update: per-skill sources on every host

install <repo> -s <skill> recorded a source that GitLab, Bitbucket and file:// parsed as a different repository, so install -p on a fresh clone tried to clone one that does not exist. New installs record a source every host can install from, and the dashboard still marks those skills as installed. (#859, #863)

Skills recorded the old way failed update, install <name> --update and the dashboard update. Those now rebuild the source from the stored repository and path and write the record back in the form that installs, and in project mode the config.yaml entry follows unless a teammate changed it. hub draft and hub index now publish the installable source. (#862, #866)

Git hooks

Git exports GIT_DIR, GIT_WORK_TREE and related variables to hooks in a linked worktree, and skillshare's Git commands inherited them. Run from a post-checkout or post-merge hook, an install could turn on sparse checkout in your repository (a later merge then removed files outside the skill's path), and push could commit into it. skillshare's Git commands now ignore those variables; GIT_CONFIG_COUNT and GIT_CONFIG_PARAMETERS still apply. (#852, #854)

Herdr panel

• The panel now also ships as a standalone Mod package that adds only the skillshare toggle and panel to your current layout, keeping your status bar, usage meters, theme and other customizations. The complete layout is still available, and the update instructions for both tell your agent to replace only the installed skillshare mod. See Herdr. (#857)
• A slow plugin inventory no longer holds up the whole panel. Each list appears when its read finishes, and rows that needed attention stay visible as unconfirmed while a refresh is pending or has failed. (#855)

Dashboard

In Settings → General → Updates, the version row now shows the installed CLI and skill versions, the result of a manual check with its time, and the next action (Update now, Check again or Retry) together. (#849)

Contributors

@ErykJakubik @tomerzcod7