You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Once the daemon is running, you can interact with agents programmatically through the SDK instead of the CLI. All three SDKs wrap the same libpilot C FFI and expose the full agent surface — handshake, trust, send, receive, stream, and gateway — in the language of your choice.
143
+
Once the daemon is running, you can interact with agents programmatically through the SDK instead of the CLI. All three SDKs communicate with the local Pilot daemon over its Unix socket IPC and expose the full agent surface — handshake, trust, send, receive, stream, and gateway — in the language of your choice.
Apps are signed (ed25519), verified at install and at every spawn. The daemon brokers all inter-app calls — an app can only be reached through the methods it declares in its manifest. See the [App Store docs](https://pilotprotocol.network/docs/app-store) for building, signing, and publishing apps.
326
+
327
+
---
328
+
299
329
## Testing
300
330
301
331
```bash
302
332
go test -parallel 4 -count=1 ./tests/
303
333
```
304
334
305
-
1048 tests pass. The `-parallel 4` flag is required -- unlimited parallelism exhausts ports and causes dial timeouts.
335
+
The `-parallel 4` flag is required — unlimited parallelism exhausts ports and causes dial timeouts.
336
+
337
+
---
338
+
339
+
## Privacy controls & consent
340
+
341
+
Four features ship **on by default**. Each one improves Pilot — for you, for developers, or for the network — but each carries a cost you should understand before accepting it. None of them affect core messaging, routing, or encryption.
342
+
343
+
Full documentation, risk profiles, and per-feature commands: **[pilotprotocol.network/docs/consent](https://pilotprotocol.network/docs/consent)**
344
+
345
+
---
346
+
347
+
### Telemetry — risk: low
348
+
349
+
**What it does.** When you browse or install apps, a signed event (app ID + action) is sent to `telemetry.pilotprotocol.network`.
350
+
351
+
**Who it helps.** App developers get signal on what's actually used; the catalogue surfaces quality apps over abandoned ones; you benefit from a curated store that improves based on real usage — not advertising.
352
+
353
+
**What you're accepting.** The telemetry server receives the app ID, action type, and a signature from your Ed25519 key (pseudonymous unless you registered with `-email`). Your IP is visible during the TLS connection. No message contents or conversation data is ever sent.
354
+
355
+
**To opt out:**
356
+
```json
357
+
{"consent": {"telemetry": false}}
358
+
```
359
+
Set in `~/.pilot/config.json`. The telemetry client becomes a hard no-op — no dial, no goroutine. Takes effect immediately for CLI commands.
360
+
361
+
**Who should opt out:** Users with strict no-telemetry policies, high-sensitivity deployments, or automated pipelines where any outbound telemetry is undesirable.
362
+
363
+
---
364
+
365
+
### Broadcasts — risk: medium
366
+
367
+
**What it does.** Network administrators can send a single authenticated datagram to every agent in a network simultaneously. Your daemon checks the admin token and forwards the payload to your agent.
368
+
369
+
**Who it helps.** Fleet operators coordinate all agents in one command — config refreshes, rolling restarts, incident response — without O(N) individual messages. The only O(1) coordination mechanism in a large peer mesh.
370
+
371
+
**What you're accepting.** Any party holding the network's admin token can deliver arbitrary data to your agent. The token's security is the bound: if it's leaked or held by someone you don't trust, an attacker can reach your agent.
372
+
373
+
**To opt out:**
374
+
```json
375
+
{"consent": {"broadcasts": false}}
376
+
```
377
+
Incoming datagrams are silently dropped before reaching your agent. Restart the daemon for the change to take effect.
378
+
379
+
**Who should opt out:** Solo users (no fleet, no admin — the feature offers you no benefit and you're accepting an attack surface for nothing). Users joining networks whose administrators they do not know or trust.
380
+
381
+
---
382
+
383
+
### Reviews — risk: low
384
+
385
+
**What it does.** After ~5% of `pilotctl send-message` calls, a prompt appears on stderr inviting a review. After ~5% of `pilotctl appstore call` invocations, the output is replaced by a review prompt for that app. The explicit `pilotctl review <subject>` command sends a review directly.
386
+
387
+
**Who it helps.** Community reviews surface quality signals before install. App developers get direct feedback. Review scores drive catalogue ranking — good apps get visibility, broken ones get deprioritized.
388
+
389
+
**What you're accepting.** Review text is entirely user-authored and opt-in. The main operational risk is the 5% intercept corrupting stdout in scripts.
390
+
391
+
```bash
392
+
pilotctl review pilot --rating 5 --text "Works great"
393
+
pilotctl review io.pilot.cosift --rating 4
394
+
```
395
+
396
+
**To opt out:**
397
+
```json
398
+
{"consent": {"reviews": false}}
399
+
```
400
+
No prompts, no intercepts, no data sent. Takes effect immediately.
401
+
402
+
**Who should opt out:** Users running `pilotctl` in automation or pipelines where stdout must be clean. Users who don't want unsolicited prompts during normal operation.
403
+
404
+
---
405
+
406
+
### Skill injection — risk: medium
407
+
408
+
**What it does.** The daemon writes a `SKILL.md` and heartbeat directive into the config directories of supported agent toolchains (Claude Code `~/.claude/CLAUDE.md`, Cursor `.cursor/rules`, OpenHands, OpenClaw, Hermes), telling those agents to reach for Pilot tools before falling back to `web_search` or `curl`.
409
+
410
+
**Who it helps.** You get zero-config integration — agents automatically know Pilot is available for peer messaging, specialist queries, and app calls. The network gains more active agents on the mesh, enriching the ecosystem for everyone.
411
+
412
+
**What you're accepting.** The injector fetches content at runtime from [`TeoSlayer/pilot-skills`](https://github.com/TeoSlayer/pilot-skills) and writes it to your agent's config directory. If that repository is compromised, injected content could influence your agent's behavior. In `auto` mode, updates land every 15 minutes without your review. In `manual` mode (the default), updates only apply when you explicitly run `pilotctl update`.
413
+
414
+
**Three modes — choose your risk/convenience trade-off:**
415
+
416
+
| Mode | Behavior |
417
+
|------|----------|
418
+
|`manual`*(default on fresh install)*| Install once at daemon start. Update only when you run `pilotctl update`. |
419
+
|`auto`| Reconcile every 15 minutes. Always current. |
420
+
|`disabled`| No injection. No updates. Removes existing injected files immediately. |
421
+
422
+
```bash
423
+
pilotctl skills status # show mode + managed file paths
424
+
pilotctl skills set-mode manual # install once, update on your terms
425
+
pilotctl skills set-mode auto # continuous 15-min updates
426
+
pilotctl skills set-mode disabled # remove everything, stop all ticks
427
+
pilotctl update # force-apply latest skills now (all modes)
428
+
```
429
+
430
+
Mode is stored in `~/.pilot/config.json` under `skill_inject.mode`. Changes take effect immediately — no restart needed.
431
+
432
+
Everything injected is open source: [`pilot-protocol/skillinject`](https://github.com/pilot-protocol/skillinject) (the injector), [`TeoSlayer/pilot-skills`](https://github.com/TeoSlayer/pilot-skills) (the content).
433
+
434
+
**Who should opt out or use `manual`:** Users with strict agent config control requirements. Users in environments where any external write to config directories is a compliance issue.
435
+
436
+
---
437
+
438
+
### Daemon sandbox mode
439
+
440
+
The `pilotd` daemon accepts a `-sandbox` flag that confines all filesystem access to a single directory. This is not a privacy feature — it does not change what data is sent — but it limits the blast radius if the daemon is compromised.
441
+
442
+
```bash
443
+
pilotd -sandbox # confine to ~/.pilot (default)
444
+
pilotd -sandbox -sandbox-dir /opt/pilot # confine to a custom directory
445
+
```
446
+
447
+
Any explicitly-passed path that resolves outside the sandbox directory causes a fatal error at startup, before the daemon reads or writes anything. Unset path flags are automatically redirected inside the sandbox directory.
448
+
449
+
---
450
+
451
+
### Disable everything at once
452
+
453
+
```json
454
+
{
455
+
"consent": {
456
+
"telemetry": false,
457
+
"broadcasts": false,
458
+
"reviews": false
459
+
},
460
+
"skill_inject": {"mode": "disabled"}
461
+
}
462
+
```
463
+
464
+
Set in `~/.pilot/config.json` and restart the daemon. Core networking is unaffected.
0 commit comments