Module widget_catalog 

The widget catalog (docs/specs/SPEC_WIDGET_SHARING_2026_10_10.md §4): a public list of sandboxed widgets, built and signed by the agentmuxai/widgets repository’s CI, that Settings → Widgets browses.

The catalog is a convenience and a second check, never an approval. srv checks the index’s signature against a key pinned here, downloads a widget only from the catalog’s own origin, checks the zip’s SHA-256, the package’s content hash and its author’s signature against the index, and installs it as needs_approval, like any widget: the user’s prompt decides.

Structs

CatalogEntry

CatalogIndex 🔒

WidgetCatalogItem

An entry as Settings shows it: the entry, its publisher’s fingerprint, and what is installed here.

Constants

CATALOG_KEYS

The catalog keys AgentMux trusts (base64 Ed25519 public keys). The private half lives only in the catalog repository’s CI (agentmuxai/widgets, secret CATALOG_SIGNING_SEED). More than one, for a rotation.

CATALOG_VERSION 🔒

DEFAULT_CATALOG_URL

Where the official catalog is served.

MAX_INDEX_BYTES 🔒

Functions

check_download

Checks a downloaded zip against its entry: the zip’s SHA-256, then, unpacked, the package’s content hash and its author’s signature. Returns the unpacked package’s folder (in the returned temp dir).

client 🔒

fetch

The catalog at url, checked.

get 🔒

url’s body, at most max bytes: refused as soon as it declares or reaches more, never held in memory whole first.

install

Downloads entry from the catalog, checks it, and copies it into widgets_dir (replacing an installed version), waiting for approval.

items

What Settings lists: each entry with what is installed here.

origin_of 🔒

https://host[:port] of an https URL.

package_root 🔒

The package folder in an unpacked zip: its root, or its one top folder.

verify_index

Checks the index raw against its signature sig_b64 with keys, and each entry against the catalog’s rules.