Sharing recipes

Recipes are made for sharing: publish one to the Budgie platform and anyone can install it, or install recipes other people have published. Sharing always goes through Budgie's configured gateway — the platform, not the sender, is the trust boundary for retrieval.

The catalogue

Browse the live Budgie recipe catalogue on the web. Each recipe page describes what the recipe does and carries an Add to Budgie link of the exact form budgie://recipe/<id>.

The link contains an id, not a caller-supplied download URL. Echo fetches that id through its configured gateway, validates that the response parses as a recipe, focuses the app, and opens review. The deep link does not install the recipe and does not run it.

If the operating-system handoff is unavailable, copy the id from the recipe page and use the catalogue's Install by ID action in the Recipes window — the successor of the old Settings → Recipes → Install by ID path. This follows the same fetch, parse, and review path inside the window.

Import review

Before persistence, Echo parses the embedded workflow, verifies whether its stored content hash matches, and computes its capability manifest from the executable actions. The current review shows:

• a warning that the recipe was not created by you;
• publisher and source values from the recipe envelope;
• workflow name;
• the complete capability list computed for this review;
• an integrity warning when the content hash does not match.

The current dialog approves the complete listed manifest or cancels; it does not offer per-capability checkboxes. Approve & import rechecks the content hash, installs a new user workflow, and records provenance plus the approved capabilities. Import itself does not execute the workflow.

Do not approve based on the publisher name, source label, recipe title, or a clean hash alone. Read Recipe security, inspect nested and called workflows, and check each sensitive action in the generated Action Reference.

Provenance and the "Yours" label

The left column of the Recipes window splits recipes into two sections. A workflow with no provenance record falls back to the Yours section (labelled À moi in the current build), and a provenance source of self lands in that same section, so Yours does not prove that a workflow was created locally. A default workflow (is_default) with no provenance record is not filtered out either and can also appear under Yours; only system workflows and the hidden autopilot workflow are excluded. The Installed section lists only workflows whose provenance record has a non-self source, and their badge shows that source — Budgie Official or Community. Imported recipes record their source and granted capabilities separately from the workflow body.

Publish, update, and delete

You can publish a recipe you authored from the recipe editor: publishing sends the current workflow to Budgie's configured gateway and returns a shareable recipe id. Update republishes a recipe you own; delete removes a non-default workflow locally behind a confirmation.

No gallery or import screenshot is shown here because only privacy-reviewed captures that accurately match the current interface are published.

Runtime gating

Installing is not the last word: imported third-party recipes are runtime-gated for the exact actions marked for confirmation in the generated Action Reference, with deny, allow-once, or always-allow prompts per action type. Self-authored provenance does not prompt. For recursive analysis of nested workflows and side-effect boundaries, continue to Recipe security.