pilots 0.3.0 → 0.4.0

package/README.md

@@ -28,8 +28,14 @@ install time, so it works with `--ignore-scripts` and behind a registry mirror.
 There is no Windows build. Under WSL, which is Linux, this package works
 unchanged; on Windows itself the command says so and points there.
 
-Every version is published from GitHub Actions with npm provenance, so the
-package page links the exact commit and workflow run that built it.
+Every version is published from GitHub Actions, and nothing signs it by hand:
+the job exchanges its own short-lived credential with the registry, so there
+is no long-lived publish token to steal. npm's registry signature covers the
+tarball, and `npm audit signatures` checks it.
+
+To verify a binary yourself, the same builds are on the
+[releases page](https://github.com/pilotsrun/pilots-cli/releases) with a
+`checksums.txt` beside them.
 
 ## Upgrading and removing
 

package/package.json

@@ -1,14 +1,13 @@
 {
   "name": "pilots",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "The pilot CLI and terminal dashboard for Pilots (https://pilots.run): instant sandboxes for AI agents and production services on Firecracker microVMs.",
   "homepage": "https://pilots.run/install",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/pilotsrun/pilots.git",
-    "directory": "apps/pilot/npm"
+    "url": "git+https://github.com/pilotsrun/pilots-cli.git"
   },
-  "bugs": "https://github.com/pilotsrun/pilots/issues",
+  "bugs": "https://pilots.run",
   "license": "Apache-2.0",
   "author": "Vivek <vivek7405@gmail.com>",
   "keywords": [