From 01f81b87833552d5bb3ac827ab2d0c3739b9b7c2 Mon Sep 17 00:00:00 2001 From: Alexgodoroja Date: Thu, 27 Aug 2026 20:33:24 -0700 Subject: [PATCH 1/4] catalogue: align published method lists with shipped bundles; backfill index fields MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Audited all 29 catalogue apps against three published surfaces (catalogue.json, apps//metadata.json, the appstore-meta API) and against ground truth: each bundle's signed manifest `exposes` list, cross-checked with the installed app's own `.help` on a clean Linux node. Twelve apps published a method list that did not match the app they ship. Methods - io.pilot.orthogonal: drop orthogonal.check / .transactions / .usage. The v0.1.1 bundle exposes 7 methods and none of these three. orthogonal is metered, so these were exactly the calls an agent would make to check its own spend — the method that does exist is orthogonal.balance. - Document methods the bundles expose but the listing omitted: agentphone.setup, agentphone.status; bowmark.balance; kinetic.balance; rentahuman.balance; ideon-free.generate, ideon-free.poll; and .help for didit, insforge, mysql, postgres, tldr. Summaries are each app's own runtime help text, not new copy. wallet.hookPreSendMessage / .hookPostRecvMessage are deliberately left undocumented — they are daemon lifecycle hooks, not user-callable methods, and no other app documents its hooks. Names, so the same app is called the same thing everywhere - mysql: "Mysql" -> "MySQL" - tldr: "Tldr" -> "tldr" - ideon-free: "Ideon-free" -> "Ideon (Free)", and the index display_name was empty, so `pilotctl appstore catalogue` printed its whole description paragraph in the name column. Index fields - metadata_sha256 for io.pilot.agentphone was stale, not wrong: the pin said d1b5fea7 while both the repo file and raw.githubusercontent served 452d988a. `pilotctl appstore view io.pilot.agentphone` therefore warned and fell back to the teaser. Re-pinned, along with every metadata.json touched here. - categories were empty for agentphone, miren, orthogonal, otto, plainweb and postgres; filled from each listing. - license was empty for orthogonal; set to MIT to match its listing. - bundle_size was 0 for agentphone, ideon-free, miren, otto, plainweb and postgres, and wrong for sixtyfour (4898153 declared, 5058693 served). All set from the bytes actually served at each bundle_url. - changelog head trailed the released version for agentphone (v0.3.0 vs v0.3.1) and orthogonal (v0.1.0 vs v0.1.1). catalogue.json stays "version": 2 — `loadCatalogue` fail-closes on any other value. io.telepat.ideon-free/metadata.json is emitted by Go, whose < escaping a Python round-trip cannot reproduce, so it was edited textually to keep the diff to the intended lines. Verified: all 28 metadata.json parse; every metadata_sha256 matches its file; zero remaining differences between documented methods and shipped `exposes`. Co-Authored-By: Claude Opus 5 (1M context) --- .../apps/io.pilot.agentphone/metadata.json | 16 +++- catalogue/apps/io.pilot.bowmark/metadata.json | 4 + catalogue/apps/io.pilot.didit/metadata.json | 4 + .../apps/io.pilot.insforge/metadata.json | 4 + catalogue/apps/io.pilot.kinetic/metadata.json | 4 + catalogue/apps/io.pilot.mysql/metadata.json | 6 +- .../apps/io.pilot.orthogonal/metadata.json | 18 ++-- .../apps/io.pilot.postgres/metadata.json | 4 + .../apps/io.pilot.rentahuman/metadata.json | 4 + catalogue/apps/io.pilot.tldr/metadata.json | 6 +- .../apps/io.telepat.ideon-free/metadata.json | 10 ++- catalogue/catalogue.json | 83 ++++++++++++++----- 12 files changed, 125 insertions(+), 38 deletions(-) diff --git a/catalogue/apps/io.pilot.agentphone/metadata.json b/catalogue/apps/io.pilot.agentphone/metadata.json index cdc84d04..46392577 100644 --- a/catalogue/apps/io.pilot.agentphone/metadata.json +++ b/catalogue/apps/io.pilot.agentphone/metadata.json @@ -247,9 +247,23 @@ { "name": "agentphone.help", "summary": "Discovery: every method with params, kind, and latency class." + }, + { + "name": "agentphone.setup", + "summary": "START HERE (managed, no-signup model). One idempotent call that makes you send-ready: reuses or creates your agent, then attaches a number you already own or buys a new one. Buying a number costs $3.00/mo from your $5 budget, so it is gated \u2014 pass confirm_spend:true to authorize it (otherwise setup creates the agent and returns needs_spend:true so you can confirm). Returns {ready, agent_id, number_id, phone_number}. Run this before agentphone.send_message / place_call." + }, + { + "name": "agentphone.status", + "summary": "Are you ready to call/text? Free, read-only: reports whether you own an agent with an attached number, and if not, names the next step (agentphone.setup). Scoped to YOU only \u2014 never reflects other Pilot users. Returns {ready, sendable_agent_id, sendable_number, next_step}." } ], "changelog": [ + { + "version": "0.3.1", + "notes": [ + "Released v0.3.1" + ] + }, { "version": "0.3.0", "notes": [ @@ -471,4 +485,4 @@ } ] } -} \ No newline at end of file +} diff --git a/catalogue/apps/io.pilot.bowmark/metadata.json b/catalogue/apps/io.pilot.bowmark/metadata.json index d75095bd..7b438d12 100644 --- a/catalogue/apps/io.pilot.bowmark/metadata.json +++ b/catalogue/apps/io.pilot.bowmark/metadata.json @@ -53,6 +53,10 @@ { "name": "bowmark.help", "summary": "Discovery: every method with params, latency, and description." + }, + { + "name": "bowmark.balance", + "summary": "Your remaining Pilot budget for this app, read free from the broker's per-user credit ledger — returns {\"balance\":\"$X.XX\",\"credits_remaining\":,\"credits_seed\":,\"unit\":\"micro_usd\",\"scope\":\"per-pilot-user\"}. This is YOUR budget, not the shared account's. No partner API call, no charge, and never a 402. The same figure also rides on the X-Pilot-Credits-Remaining header of every metered response; call this when you just want to check what's left before a spend." } ], "links": [ diff --git a/catalogue/apps/io.pilot.didit/metadata.json b/catalogue/apps/io.pilot.didit/metadata.json index 33daafad..0c92c987 100644 --- a/catalogue/apps/io.pilot.didit/metadata.json +++ b/catalogue/apps/io.pilot.didit/metadata.json @@ -174,6 +174,10 @@ { "name": "didit.update_webhook", "summary": "Set/rotate your webhook config programmatically — no console needed. FREE." + }, + { + "name": "didit.help", + "summary": "This document — methods grouped by plane (local vs cloud), with params, latency, and cost." } ], "changelog": [ diff --git a/catalogue/apps/io.pilot.insforge/metadata.json b/catalogue/apps/io.pilot.insforge/metadata.json index b4bd6130..9a25ae13 100644 --- a/catalogue/apps/io.pilot.insforge/metadata.json +++ b/catalogue/apps/io.pilot.insforge/metadata.json @@ -110,6 +110,10 @@ { "name": "insforge.post", "summary": "Escape hatch: POST any backend API path under /api. Path param is the sub-path; the rest of the payload is sent as the JSON body. Covers endpoints not given a dedicated method. Cost depends on the endpoint." + }, + { + "name": "insforge.help", + "summary": "This document — methods grouped by plane (local vs cloud), with params, latency, and cost." } ], "changelog": [ diff --git a/catalogue/apps/io.pilot.kinetic/metadata.json b/catalogue/apps/io.pilot.kinetic/metadata.json index b0f752cd..a8bddaf8 100644 --- a/catalogue/apps/io.pilot.kinetic/metadata.json +++ b/catalogue/apps/io.pilot.kinetic/metadata.json @@ -150,6 +150,10 @@ { "name": "kinetic.help", "summary": "Discovery: every method with params, latency, and description." + }, + { + "name": "kinetic.balance", + "summary": "Your remaining Pilot budget for this app, read free from the broker's per-user credit ledger — returns {\"balance\":\"$X.XX\",\"credits_remaining\":,\"credits_seed\":,\"unit\":\"micro_usd\",\"scope\":\"per-pilot-user\"}. This is YOUR budget, not the shared account's. No partner API call, no charge, and never a 402. The same figure also rides on the X-Pilot-Credits-Remaining header of every metered response; call this when you just want to check what's left before a spend." } ], "links": [ diff --git a/catalogue/apps/io.pilot.mysql/metadata.json b/catalogue/apps/io.pilot.mysql/metadata.json index f3ec2f70..3364fc2a 100644 --- a/catalogue/apps/io.pilot.mysql/metadata.json +++ b/catalogue/apps/io.pilot.mysql/metadata.json @@ -1,7 +1,7 @@ { "schema_version": 1, "id": "io.pilot.mysql", - "display_name": "Mysql", + "display_name": "MySQL", "tagline": "MySQL 9.7.1 server + client as a native CLI for agents: a full, real client/server SQL database that runs entirely local", "description_md": "MySQL 9.7.1 server + client as a native CLI for agents: a full, real client/server SQL database that runs entirely locally with no cloud account and no provisioning. Initialize a data directory, start a server on 127.0.0.1, create databases, and run SQL — results as an aligned table or TSV — with the actual InnoDB engine (transactions, foreign keys, triggers, JSON, window functions). Lifecycle (initialize/start/stop/ping), createdb, query/query_tsv, databases/tables listing, mysqldump, and the full tool surface via a verbatim-argv passthrough. The transactional server-grade sibling of io.pilot.sqlite and io.pilot.postgres.", "vendor": { @@ -70,6 +70,10 @@ { "name": "mysql.version", "summary": "Print the delivered MySQL version, e.g. \"mysql Ver 9.7.1 for … (conda-forge)\". This is `mysql --version`." + }, + { + "name": "mysql.help", + "summary": "This document — methods grouped by plane (local vs cloud), with params, latency, and cost." } ], "changelog": [ diff --git a/catalogue/apps/io.pilot.orthogonal/metadata.json b/catalogue/apps/io.pilot.orthogonal/metadata.json index 92311091..e741a49b 100644 --- a/catalogue/apps/io.pilot.orthogonal/metadata.json +++ b/catalogue/apps/io.pilot.orthogonal/metadata.json @@ -68,24 +68,18 @@ "name": "orthogonal.balance", "summary": "Orthogonal account credit balance (string '$X.XX'). FREE, read-only. Note: your per-user $5 Pilot budget is metered separately by the broker and is surfaced in the X-Pilot-Credits-Remaining header on every call — that header, not this account balance, is your personal remaining budget." }, - { - "name": "orthogonal.check", - "summary": "Preflight the shared account: does it hold ≥ amountCents credits? (amountCents is in Orthogonal credit units = dollars × 100000, so $5 = 500000). FREE." - }, - { - "name": "orthogonal.transactions", - "summary": "Account transaction ledger — purchases, API charges, bonuses, refunds — with amounts, direction and timestamps, paginated. FREE, read-only. Amounts are in the credits unit (dollars × 100000)." - }, - { - "name": "orthogonal.usage", - "summary": "Per-call spend history plus totalSpent over a window (dollar strings), for the shared account. FREE, read-only." - }, { "name": "orthogonal.help", "summary": "Discovery: every method with params, kind, and latency class." } ], "changelog": [ + { + "version": "0.1.1", + "notes": [ + "Released v0.1.1" + ] + }, { "version": "0.1.0", "notes": [ diff --git a/catalogue/apps/io.pilot.postgres/metadata.json b/catalogue/apps/io.pilot.postgres/metadata.json index 585bfa34..20dbf4f7 100644 --- a/catalogue/apps/io.pilot.postgres/metadata.json +++ b/catalogue/apps/io.pilot.postgres/metadata.json @@ -92,6 +92,10 @@ { "name": "postgres.version", "summary": "Print the delivered client version, e.g" + }, + { + "name": "postgres.help", + "summary": "This document — every method with params, kind, and duration class." } ], "changelog": [ diff --git a/catalogue/apps/io.pilot.rentahuman/metadata.json b/catalogue/apps/io.pilot.rentahuman/metadata.json index c9781ada..685ded78 100644 --- a/catalogue/apps/io.pilot.rentahuman/metadata.json +++ b/catalogue/apps/io.pilot.rentahuman/metadata.json @@ -63,6 +63,10 @@ { "name": "rentahuman.help", "summary": "Discovery: every method with params, latency, and description." + }, + { + "name": "rentahuman.balance", + "summary": "Your remaining Pilot budget for this app, read free from the broker's per-user credit ledger — returns {\"balance\":\"$X.XX\",\"credits_remaining\":,\"credits_seed\":,\"unit\":\"micro_usd\",\"scope\":\"per-pilot-user\"}. This is YOUR budget, not the shared account's. No partner API call, no charge, and never a 402. The same figure also rides on the X-Pilot-Credits-Remaining header of every metered response; call this when you just want to check what's left before a spend." } ], "links": [ diff --git a/catalogue/apps/io.pilot.tldr/metadata.json b/catalogue/apps/io.pilot.tldr/metadata.json index 2534260a..5db63b57 100644 --- a/catalogue/apps/io.pilot.tldr/metadata.json +++ b/catalogue/apps/io.pilot.tldr/metadata.json @@ -1,7 +1,7 @@ { "schema_version": 1, "id": "io.pilot.tldr", - "display_name": "Tldr", + "display_name": "tldr", "tagline": "tldr (tlrc 1.13.1) as native, example-first documentation for agents: simplified, community-driven man pages for ~7,350+", "description_md": "tldr (tlrc 1.13.1) as native, example-first documentation for agents: simplified, community-driven man pages for ~7,350+ command-line tools, delivered to the host and fronted as typed methods. Look up a command's cheat-sheet as clean text or raw Markdown, search the whole catalog by keyword, list the directory of documented tools, refresh or inspect the local cache, render a local page, and reach every client flag (--platform, --language, --list-all, --offline, …) via a verbatim-argv passthrough. Open source — MIT client, CC-BY-4.0 pages — self-contained and offline after the first fetch, on macOS and Linux.", "vendor": { @@ -58,6 +58,10 @@ { "name": "tldr.version", "summary": "Print the delivered client and tldr-client-spec version, e.g. \"tlrc v1.13.1 (implementing the tldr client specification v2.3)\". Needs no cache. This is `tldr --version`." + }, + { + "name": "tldr.help", + "summary": "This document — methods grouped by plane (local vs cloud), with params, latency, and cost." } ], "changelog": [ diff --git a/catalogue/apps/io.telepat.ideon-free/metadata.json b/catalogue/apps/io.telepat.ideon-free/metadata.json index 82dbc378..054ae2ae 100644 --- a/catalogue/apps/io.telepat.ideon-free/metadata.json +++ b/catalogue/apps/io.telepat.ideon-free/metadata.json @@ -1,7 +1,7 @@ { "schema_version": 1, "id": "io.telepat.ideon-free", - "display_name": "Ideon-free", + "display_name": "Ideon (Free)", "description_md": "Free article generation for agents: ideon-free.generate(idea) returns a jobId; ideon-free.poll(jobId) returns the finished markdown article. Thin adapter over Ideon's ideon_write — no payment.", "vendor": { "name": "" @@ -20,6 +20,14 @@ { "name": "ideon-free.help", "summary": "Discovery: every method with params, kind, and latency class." + }, + { + "name": "ideon-free.generate", + "summary": "Start an article generation job from a one-line idea. Returns a jobId to poll. Free \u2014 no payment." + }, + { + "name": "ideon-free.poll", + "summary": "Poll a jobId returned by ideon-free.generate; returns the finished markdown article once ready. Free \u2014 no payment." } ], "changelog": [ diff --git a/catalogue/catalogue.json b/catalogue/catalogue.json index b1ab1abc..f5fa9cf0 100644 --- a/catalogue/catalogue.json +++ b/catalogue/catalogue.json @@ -55,7 +55,7 @@ "enrichment", "sales-intelligence" ], - "bundle_size": 4898153, + "bundle_size": 5058693, "source_url": "https://docs.sixtyfour.ai", "license": "Proprietary", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.sixtyfour/metadata.json", @@ -95,8 +95,10 @@ "bundle_url": "https://github.com/pilot-protocol/catalog/releases/download/ideon-free-v0.3.1/io.telepat.ideon-free-0.3.1.tar.gz", "bundle_sha256": "dd8e37057f33eadefff6b7ff5fc99130667076ea398c10a154c345fd87dd1ad6", "publisher": "ed25519:5cqj+zTVecj8r0YRUShpgFi/g7TxDg1lkDKQzfNyDyc=", - "metadata_sha256": "cbd6adae25a432d33dea9d4a047645b1e6d920a4bae2c4897b9f14fe2c004347", - "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.telepat.ideon-free/metadata.json" + "metadata_sha256": "ed6e77ae5c95a8fc13c6afd8d6430d892d75ae35563ff6a6b08fca265d0365ae", + "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.telepat.ideon-free/metadata.json", + "bundle_size": 5069, + "display_name": "Ideon (Free)" }, { "id": "io.pilot.slipstream", @@ -158,7 +160,13 @@ }, "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.miren/metadata.json", "metadata_sha256": "3fe0a4e6628271b963f4e3ddf9cb7bbcf6bf41377eb2a8d29b7e82e3b7153990", - "publisher": "ed25519:uOzIK15+q/Iy67FASGoOEPg53vZo285/szq9v7PuksU=" + "publisher": "ed25519:uOzIK15+q/Iy67FASGoOEPg53vZo285/szq9v7PuksU=", + "categories": [ + "infrastructure", + "devops", + "platform" + ], + "bundle_size": 5352460 }, { "id": "io.pilot.otto", @@ -190,7 +198,13 @@ }, "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.otto/metadata.json", "metadata_sha256": "d3078d3b7e33720d186d9f0f2967b98ee6de7bd2af7d404b160cf98c0278db59", - "publisher": "ed25519:mTyrd5ZG/tl76CLpdUEaaGvCjrnE6QLHPVm7XrduH/w=" + "publisher": "ed25519:mTyrd5ZG/tl76CLpdUEaaGvCjrnE6QLHPVm7XrduH/w=", + "categories": [ + "automation", + "browser", + "web" + ], + "bundle_size": 5355850 }, { "id": "io.pilot.plainweb", @@ -222,7 +236,13 @@ }, "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.plainweb/metadata.json", "metadata_sha256": "054bdbbda3caf578d9e11c6a80d402d0b113c7619c199b518c5dea8a044c7f0d", - "publisher": "ed25519:9oZGhTSuJJ5xaePW89I9QSOnyp8p83igvGj0jEUuLoE=" + "publisher": "ed25519:9oZGhTSuJJ5xaePW89I9QSOnyp8p83igvGj0jEUuLoE=", + "categories": [ + "web", + "content", + "markdown" + ], + "bundle_size": 5035085 }, { "id": "io.pilot.postgres", @@ -253,8 +273,14 @@ } }, "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.postgres/metadata.json", - "metadata_sha256": "0ab00cf5dd92c9da2920f655b3d4f7bfc1f72aedc2f56489062415fff9534987", - "publisher": "ed25519:N1uQkAJ355xY9RSj5Q8/y9Y+PIIjLzPB47PAl1vdw2U=" + "metadata_sha256": "7025f0ba63c983747ac427344b3b4b2ca364281f11e9c1deb5c10e08b8ac96cc", + "publisher": "ed25519:N1uQkAJ355xY9RSj5Q8/y9Y+PIIjLzPB47PAl1vdw2U=", + "categories": [ + "database", + "data", + "sql" + ], + "bundle_size": 5302666 }, { "id": "io.pilot.duckdb", @@ -460,7 +486,7 @@ "source_url": "https://github.com/bowmark-ai/plugin", "license": "Proprietary", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.bowmark/metadata.json", - "metadata_sha256": "2d979d11d9007b38002c8b609a18c3e8998333c4b31e32ce8b4fe781e7375548", + "metadata_sha256": "7baf0622f6cd7b1074d0d834716be6c9f09db681b9e59feca2c1bece5fc69bfb", "bundles": { "linux/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.bowmark/1.0.1/io.pilot.bowmark-1.0.1-linux-amd64.tar.gz", @@ -548,8 +574,15 @@ } }, "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.agentphone/metadata.json", - "metadata_sha256": "d1b5fea717be1a3c21fc3fcf38c23362b8a727502e822c23dd3c831dab950823", - "publisher": "ed25519:mvVzYABubZwOTzWWQA/TDbRLYkKzmD/x6k/w0nz+zHc=" + "metadata_sha256": "63a1fb66424e594e8cef80c00a52e1c61415a7193768c3ac7507342df5e7f44b", + "publisher": "ed25519:mvVzYABubZwOTzWWQA/TDbRLYkKzmD/x6k/w0nz+zHc=", + "categories": [ + "communication", + "phone", + "voice", + "messaging" + ], + "bundle_size": 2665282 }, { "id": "io.pilot.insforge", @@ -564,7 +597,7 @@ "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.insforge", "license": "", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.insforge/metadata.json", - "metadata_sha256": "0e6be7219bf8172323bbbc8a60742159e8c7e6f1a9de18521a69b53164f11b1c", + "metadata_sha256": "d5a07ebbf6c2a839a088e9934db807bed5a373ea4b4587a16cb03d70f182efd3", "bundles": { "linux/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.insforge/1.0.0/io.pilot.insforge-1.0.0-linux-amd64.tar.gz", @@ -593,12 +626,18 @@ "bundle_sha256": "3f2c9bfc009e41898b36ff2e88a313c0c3bc8bb39500f9673572a1d40b84fac7", "display_name": "Orthogonal", "vendor": "Orthogonal", - "categories": [], + "categories": [ + "data", + "search", + "enrichment", + "scraping", + "ai" + ], "bundle_size": 5073695, "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.orthogonal", - "license": "", + "license": "MIT", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.orthogonal/metadata.json", - "metadata_sha256": "1f75f953e0ee3db5dfc11103dc1c6ba4c70362ee52fa351898a699c88b771b39", + "metadata_sha256": "7404f92e42df6d3c52edf663e995c27a11b6b0d690ca02228f01e4b81e88266a", "bundles": { "linux/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.orthogonal/0.1.1/io.pilot.orthogonal-0.1.1-linux-amd64.tar.gz", @@ -625,14 +664,14 @@ "description": "MySQL 9.7.1 server + client as a native CLI for agents: a full, real client/server SQL database that runs entirely locally with no cloud account and no provisioning. Initialize a data directory, start a server on 127.0.0.1, create databases, and run SQL — results as an aligned table or TSV — with the actual InnoDB engine (transactions, foreign keys, triggers, JSON, window functions). Lifecycle (initialize/start/stop/ping), createdb, query/query_tsv, databases/tables listing, mysqldump, and the full tool surface via a verbatim-argv passthrough. The transactional server-grade sibling of io.pilot.sqlite and io.pilot.postgres.", "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.mysql/9.7.1/io.pilot.mysql-9.7.1-linux-amd64.tar.gz", "bundle_sha256": "74e57bee2b99cbef1cc10a1120894c6872027766509f0d8d4b252b93d1d0a9e1", - "display_name": "Mysql", + "display_name": "MySQL", "vendor": "Pilot Protocol", "categories": [], "bundle_size": 5359647, "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.mysql", "license": "", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.mysql/metadata.json", - "metadata_sha256": "3349fa791d2379ba5b484b96425cf137b1f108382ae6193f62e76c6ffeadfb63", + "metadata_sha256": "eee2c5eb97834631a4d1c72448a6964aa0909e8a395d116c73c3fe3884366f64", "bundles": { "linux/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.mysql/9.7.1/io.pilot.mysql-9.7.1-linux-amd64.tar.gz", @@ -666,7 +705,7 @@ "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.didit", "license": "", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.didit/metadata.json", - "metadata_sha256": "678ca368b4c2ed6f9f526f35d7a3de07f5a196abccdf76247b281afef9e47978", + "metadata_sha256": "c0a063b0cb6a4c712b9dc88451152898bfce6b44b4af0757b2dd48480975df90", "bundles": { "linux/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.didit/1.0.0/io.pilot.didit-1.0.0-linux-amd64.tar.gz", @@ -693,14 +732,14 @@ "description": "tldr (tlrc 1.13.1) as native, example-first documentation for agents: simplified, community-driven man pages for ~7,350+ command-line tools, delivered to the host and fronted as typed methods. Look up a command's cheat-sheet as clean text or raw Markdown, search the whole catalog by keyword, list the directory of documented tools, refresh or inspect the local cache, render a local page, and reach every client flag (--platform, --language, --list-all, --offline, …) via a verbatim-argv passthrough. Open source — MIT client, CC-BY-4.0 pages — self-contained and offline after the first fetch, on macOS and Linux.", "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.tldr/1.13.1/io.pilot.tldr-1.13.1-linux-amd64.tar.gz", "bundle_sha256": "0e73bc90fcf6fd62972cf08171b2c8e56cd2adf43b42e01afdb529f084bc1407", - "display_name": "Tldr", + "display_name": "tldr", "vendor": "Pilot Protocol", "categories": [], "bundle_size": 5355931, "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.tldr", "license": "", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.tldr/metadata.json", - "metadata_sha256": "548e514a25962da0dcced8ead25c7ceb3690c31784a9ab31f061d185dcbd1662", + "metadata_sha256": "97d948f1ec27ddd7f05c4a785100ff4cb9a82adc1648c42533d49fbeb38083fd", "bundles": { "linux/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.tldr/1.13.1/io.pilot.tldr-1.13.1-linux-amd64.tar.gz", @@ -850,7 +889,7 @@ "source_url": "https://kineticpricing.com", "license": "Proprietary", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.kinetic/metadata.json", - "metadata_sha256": "0a471b165f5b54f1ca36065e978206ffa5d8bb4acf12eec61683781b675936f0", + "metadata_sha256": "413fa3c1a41bcf2520e156cedc6b7d36c66e69fe2ea6a7a349a1fcbb219f6593", "bundles": { "darwin/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.kinetic/1.0.0/io.pilot.kinetic-1.0.0-darwin-amd64.tar.gz", @@ -888,7 +927,7 @@ "source_url": "https://rentahuman.ai/docs/partners", "license": "Proprietary", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.rentahuman/metadata.json", - "metadata_sha256": "caef5d6bee521e47033c634930efde9ca61a7455acb7cb2e4f8fac36681efded", + "metadata_sha256": "619e189a77049c7d874764ae4ec02a167d15a541ed802be0d770c250157119f9", "bundles": { "darwin/amd64": { "bundle_url": "https://pub-f09f9a4ea848491198d48e329ba030e3.r2.dev/bundles/io.pilot.rentahuman/0.2.0/io.pilot.rentahuman-0.2.0-darwin-amd64.tar.gz", From 70dffd6a397198d4ed1c753c72a08288d5e5799b Mon Sep 17 00:00:00 2001 From: Alexgodoroja Date: Thu, 27 Aug 2026 20:36:14 -0700 Subject: [PATCH 2/4] catalogue: backfill license and categories from each app's submission listing MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Four more index entries had both fields empty on every surface, so the earlier catalogue-vs-listing drift check could not see them — nothing disagreed because nothing was set anywhere. Values come from the `listing` block of submissions//submission.json in pilot-protocol/app-template, which is what the publish pipeline reads: io.pilot.insforge Apache-2.0 developer-tools, data, storage io.pilot.mysql GPL-2.0 database, data, sql io.pilot.didit Proprietary identity, verification, compliance, security, kyc io.pilot.tldr MIT developer-tools, documentation, cli insforge's submission spells its categories "Developer Tools" / "Data & Storage"; normalised here to the catalogue's existing all-lowercase vocabulary, which already contains developer-tools, data and storage. io.telepat.ideon-free is left as-is: it is third-party, has no submissions/ directory in app-template, and its licence is not ours to assert. Co-Authored-By: Claude Opus 5 (1M context) --- catalogue/catalogue.json | 34 ++++++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/catalogue/catalogue.json b/catalogue/catalogue.json index f5fa9cf0..0c91e0da 100644 --- a/catalogue/catalogue.json +++ b/catalogue/catalogue.json @@ -592,10 +592,14 @@ "bundle_sha256": "9e1d05248b99dd66e1482aeda23ece61b2b110601c7848e3fb716f4a79ba47b6", "display_name": "Insforge", "vendor": "InsForge", - "categories": [], + "categories": [ + "developer-tools", + "data", + "storage" + ], "bundle_size": 5113957, "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.insforge", - "license": "", + "license": "Apache-2.0", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.insforge/metadata.json", "metadata_sha256": "d5a07ebbf6c2a839a088e9934db807bed5a373ea4b4587a16cb03d70f182efd3", "bundles": { @@ -666,10 +670,14 @@ "bundle_sha256": "74e57bee2b99cbef1cc10a1120894c6872027766509f0d8d4b252b93d1d0a9e1", "display_name": "MySQL", "vendor": "Pilot Protocol", - "categories": [], + "categories": [ + "database", + "data", + "sql" + ], "bundle_size": 5359647, "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.mysql", - "license": "", + "license": "GPL-2.0", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.mysql/metadata.json", "metadata_sha256": "eee2c5eb97834631a4d1c72448a6964aa0909e8a395d116c73c3fe3884366f64", "bundles": { @@ -700,10 +708,16 @@ "bundle_sha256": "57c63cf5c51c10871273126b408dae17e2c4cffc5330342d96c648ca95aa29d5", "display_name": "Didit", "vendor": "Didit", - "categories": [], + "categories": [ + "identity", + "verification", + "compliance", + "security", + "kyc" + ], "bundle_size": 5130067, "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.didit", - "license": "", + "license": "Proprietary", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.didit/metadata.json", "metadata_sha256": "c0a063b0cb6a4c712b9dc88451152898bfce6b44b4af0757b2dd48480975df90", "bundles": { @@ -734,10 +748,14 @@ "bundle_sha256": "0e73bc90fcf6fd62972cf08171b2c8e56cd2adf43b42e01afdb529f084bc1407", "display_name": "tldr", "vendor": "Pilot Protocol", - "categories": [], + "categories": [ + "developer-tools", + "documentation", + "cli" + ], "bundle_size": 5355931, "source_url": "https://github.com/pilot-protocol/app-template/tree/main/submissions/io.pilot.tldr", - "license": "", + "license": "MIT", "metadata_url": "https://raw.githubusercontent.com/pilot-protocol/pilotprotocol/main/catalogue/apps/io.pilot.tldr/metadata.json", "metadata_sha256": "97d948f1ec27ddd7f05c4a785100ff4cb9a82adc1648c42533d49fbeb38083fd", "bundles": { From f4ec8bd4a277700c9c4a402352922eae6854a736 Mon Sep 17 00:00:00 2001 From: Alexgodoroja Date: Fri, 28 Aug 2026 22:42:40 -0700 Subject: [PATCH 3/4] catalogue: re-sign catalogue.json MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The signature is over the exact bytes of catalogue.json, so the listing and index changes on this branch invalidated it. pilotctl fail-closes on a bad signature — it rejects the whole catalogue rather than one entry — so the detached signature has to travel with the data, the same way #447 did it. Signed with the catalogue key; sign-catalogue refuses any key that does not match the public key embedded in internal/catalogtrust, so acceptance is itself proof the right key was used. Verified: cmd/pilotctl TestLoadCatalogue_VerifiesSignedRepoCatalogue passes again, along with FailsClosedWithoutSignature and FailsOnTamper; and a released v1.13.9 pilotctl loads the re-signed catalogue from disk and lists all 29 apps. Co-Authored-By: Claude Opus 5 (1M context) --- catalogue/catalogue.json.sig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/catalogue/catalogue.json.sig b/catalogue/catalogue.json.sig index e2a028ce..1989c4b7 100644 --- a/catalogue/catalogue.json.sig +++ b/catalogue/catalogue.json.sig @@ -1 +1 @@ -KLt7Jn54mZdUx3DDQQ8UI7acesz0gq3EBHvQGr5g7b1jBsbhoXbDTaxyWDY7QtKrKnhzDXG4cvccM0nUFBCdBQ== +NrQJoa/s0HqIYI7VQydkvVuzzKz600/56G871l4omGbbTlhZAGdzH64+4pkW7th5neBGX1Trai6ISRJcetN7Bw== From 24aafde80f141cea1b26104238b4a902a5d8d654 Mon Sep 17 00:00:00 2001 From: Alexgodoroja Date: Fri, 28 Aug 2026 22:47:48 -0700 Subject: [PATCH 4/4] go.mod: bump to 1.25.13 for the August stdlib security fixes govulncheck resolves the toolchain from go-version-file: go.mod, so the 1.25.12 pin meant CI scanned against a stdlib with five disclosed vulnerabilities and failed every PR opened against the repo today, whether or not it touched Go: GO-2026-6218 net/url GO-2026-6090 crypto/tls GO-2026-6088 encoding/xml GO-2026-5972 encoding/asn1 GO-2026-5026 net/http All five are standard-library only and all five are fixed in go1.25.13, so the patch bump clears the whole set. main has not been scanned since 2026-08-09, before these were published, which is why it still shows green. This is separable from the catalogue work in the rest of the branch and can be cherry-picked out or landed on its own; it is here because the branch cannot go green without it. Co-Authored-By: Claude Opus 5 (1M context) --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 1fc6c6dc..19bdfcae 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/pilot-protocol/pilotprotocol -go 1.25.12 +go 1.25.13 require ( github.com/coder/websocket v1.8.15