omarchy-ui 0.0.2-x86_64-linux → 0.0.4-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8c832cd4301f1b237ef13b46fea6eed08cafdae66a1411eae88a887a59a5cf0
-  data.tar.gz: 60b933f9795e67a7b6c1ce2d8e90cb15716dbc9821250bbd8e85a4c7e840d1f1
+  metadata.gz: b39c650e3541f41aea662dccf79373f790cc9fc84466b065ccb7b8836d74739e
+  data.tar.gz: 985d17d6917e19b2fc10996d7f20d8a99e6dd49bb5160a88aa7122220056e025
 SHA512:
-  metadata.gz: 415009fe051699cef4821e70e394dec94b883aa86dfd325a8c2e8afd38a7a3076c9ec21df6efea747ae791b715c5a5de92ef837ccef84f458683f49d805e295e
-  data.tar.gz: 3a017f0872adcec2dff15d35f03e7ac40a2d463dcee56a978e2e514aee187c804ecfce9e8573e3cf1b4312fad5364ec0686af3e7e9e6f7f9eab9ea09a45a1eab
+  metadata.gz: cfa24ef79ecfdffcb0e00c4243b26600a4df4e2b4cf197aad307bceef54011631c482a15d055b2c88710acda2e8baceba0ebec1106ae2c290850016ea70793b9
+  data.tar.gz: bf1ed984d03aea86c9db37cdd3dc1556faad23d23fef443d81669770a3e7431e87aa8632932794be1ad820117a98181990764c6401cb3de44513b9cc07d8e768

data/ControlNode.qml

@@ -40,6 +40,13 @@ Loader {
     return icons[key] || key
   }
 
+  function escapeAutoText(value) {
+    return String(value === undefined || value === null ? "" : value)
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+  }
+
   function easingType(name) {
     var easings = {
       linear: Easing.Linear,
@@ -224,6 +231,7 @@ Loader {
 
     Text {
       text: String(root.prop("text", ""))
+      textFormat: Text.PlainText
       color: root.prop("color", root.foreground)
       font.family: root.fontFamily
       font.pixelSize: {
@@ -243,6 +251,7 @@ Loader {
 
     Text {
       text: root.iconGlyph(root.prop("name", root.prop("text", "")))
+      textFormat: Text.PlainText
       color: root.foreground
       font.family: root.fontFamily
       font.pixelSize: Number(root.prop("size", Style.font.icon))
@@ -253,9 +262,9 @@ Loader {
     id: buttonComponent
 
     OmarchyUi.Button {
-      text: String(root.prop("text", ""))
+      text: root.escapeAutoText(root.prop("text", ""))
       iconText: root.iconGlyph(root.prop("icon", ""))
-      tooltipText: String(root.prop("tooltip", ""))
+      tooltipText: root.escapeAutoText(root.prop("tooltip", ""))
       selected: root.prop("selected", false) === true
       active: root.prop("active", false) === true
       hasCursor: root.prop("cursor", false) === true
@@ -461,7 +470,7 @@ Loader {
   Component {
     id: actionButtonComponent
     OmarchyUi.PanelActionButton {
-      iconText: root.iconGlyph(root.prop("icon", "")); tooltipText: String(root.prop("tooltip", ""))
+      iconText: root.iconGlyph(root.prop("icon", "")); tooltipText: root.escapeAutoText(root.prop("tooltip", ""))
       bordered: root.prop("bordered", false) === true; focusable: root.prop("focusable", false) === true
       hasCursor: root.prop("cursor", false) === true
       size: Number(root.prop("size", 28)); foreground: root.prop("foreground", root.foreground)
@@ -475,7 +484,7 @@ Loader {
   Component {
     id: toggleComponent
     OmarchyUi.Toggle {
-      label: String(root.prop("label", "")); description: String(root.prop("description", ""))
+      label: root.escapeAutoText(root.prop("label", "")); description: root.escapeAutoText(root.prop("description", ""))
       checked: root.prop("checked", false) === true; hasCursor: root.prop("cursor", false) === true
       rounded: root.prop("rounded", Style.cornerRadius > 0) === true
       foreground: root.prop("foreground", root.foreground); accent: root.prop("accent", Color.accent)
@@ -522,7 +531,7 @@ Loader {
   Component {
     id: numberFieldComponent
     OmarchyUi.NumberField {
-      label: String(root.prop("label", "")); value: Number(root.prop("value", 0))
+      label: root.escapeAutoText(root.prop("label", "")); value: Number(root.prop("value", 0))
       from: Number(root.prop("from", 0)); to: Number(root.prop("to", 100)); stepSize: Number(root.prop("step", 1))
       foreground: root.prop("foreground", root.foreground); accent: root.prop("accent", Color.accent)
       fontFamily: String(root.prop("font_family", root.fontFamily)); fontSize: Number(root.prop("font_size", Style.font.body))
@@ -551,7 +560,7 @@ Loader {
   Component {
     id: dropdownComponent
     OmarchyUi.Dropdown {
-      label: String(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
+      label: root.escapeAutoText(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
       implicitWidth: Number(root.prop("width", 240)); foreground: root.prop("foreground", root.foreground)
       background: root.prop("background", Color.popups.background); popupBorder: root.prop("popup_border", Color.popups.border)
       accent: root.prop("accent", Color.accent); fontFamily: String(root.prop("font_family", root.fontFamily))
@@ -565,7 +574,7 @@ Loader {
   Component {
     id: multiSelectComponent
     OmarchyUi.MultiSelect {
-      label: String(root.prop("label", "")); values: root.prop("values", []); options: root.prop("options", [])
+      label: root.escapeAutoText(root.prop("label", "")); values: root.prop("values", []); options: root.prop("options", [])
       placeholderText: String(root.prop("placeholder", "Search...")); enabled: root.prop("enabled", true) !== false
       optionsCommand: root.prop("options_command", []); optionsCommandCwd: String(root.prop("options_command_cwd", ""))
       emptyText: String(root.prop("empty_text", "No options")); noSelectionText: String(root.prop("no_selection_text", "None selected"))
@@ -604,12 +613,12 @@ Loader {
   }
 
   Component { id: separatorComponent; OmarchyUi.PanelSeparator { foreground: root.foreground; strength: Number(root.prop("strength", 0.12)) } }
-  Component { id: sectionHeaderComponent; OmarchyUi.PanelSectionHeader { text: String(root.prop("text", "")); foreground: root.foreground; fontFamily: root.fontFamily } }
+  Component { id: sectionHeaderComponent; OmarchyUi.PanelSectionHeader { text: root.escapeAutoText(root.prop("text", "")); foreground: root.foreground; fontFamily: root.fontFamily } }
 
   Component {
     id: searchableDropdownComponent
     OmarchyUi.SearchableDropdown {
-      label: String(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
+      label: root.escapeAutoText(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
       placeholderText: String(root.prop("placeholder", "Search...")); emptyText: String(root.prop("empty_text", "No matches"))
       triggerLabel: String(root.prop("trigger_label", "")); implicitWidth: Number(root.prop("width", 240))
       foreground: root.prop("foreground", root.foreground); background: root.prop("background", Color.popups.background)
@@ -640,7 +649,7 @@ Loader {
   Component {
     id: panelHeroComponent
     OmarchyUi.PanelHero {
-      title: String(root.prop("title", "")); meta: String(root.prop("meta", "")); detail: String(root.prop("detail", ""))
+      title: root.escapeAutoText(root.prop("title", "")); meta: root.escapeAutoText(root.prop("meta", "")); detail: root.escapeAutoText(root.prop("detail", ""))
       iconSize: Number(root.prop("icon_size", Style.font.display)); iconOpacity: Number(root.prop("icon_opacity", 1))
       metaOpacity: Number(root.prop("meta_opacity", 1)); foreground: root.prop("foreground", root.foreground)
       fontFamily: String(root.prop("font_family", root.fontFamily))
@@ -665,7 +674,7 @@ Loader {
   Component {
     id: widgetButtonComponent
     OmarchyUi.WidgetButton {
-      text: String(root.prop("text", "")); tooltipText: String(root.prop("tooltip", "")); active: root.prop("active", false) === true
+      text: root.escapeAutoText(root.prop("text", "")); tooltipText: root.escapeAutoText(root.prop("tooltip", "")); active: root.prop("active", false) === true
       dimmed: root.prop("dimmed", false) === true; concealed: root.prop("concealed", false) === true
       interactive: root.prop("interactive", true) !== false; pressable: root.prop("pressable", true) !== false
       fontFamily: String(root.prop("font_family", root.fontFamily)); fontSize: Number(root.prop("font_size", Style.font.body))
@@ -720,10 +729,10 @@ Loader {
           id: rowContent
           anchors.centerIn: parent
           spacing: Style.spacing.controlGap
-          Text { visible: text !== ""; text: root.iconGlyph(typeof modelData === "object" ? modelData[listControl.iconField] : ""); color: root.foreground; font.family: root.fontFamily }
+          Text { visible: text !== ""; text: root.iconGlyph(typeof modelData === "object" ? modelData[listControl.iconField] : ""); textFormat: Text.PlainText; color: root.foreground; font.family: root.fontFamily }
           Column {
-            Text { text: String(typeof modelData === "object" ? (modelData[listControl.labelField] ?? value) : modelData); color: root.foreground; font.family: root.fontFamily }
-            Text { visible: text !== ""; text: String(typeof modelData === "object" ? (modelData[listControl.descriptionField] || "") : ""); color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily; font.pixelSize: Style.font.caption }
+            Text { text: String(typeof modelData === "object" ? (modelData[listControl.labelField] ?? value) : modelData); textFormat: Text.PlainText; color: root.foreground; font.family: root.fontFamily }
+            Text { visible: text !== ""; text: String(typeof modelData === "object" ? (modelData[listControl.descriptionField] || "") : ""); textFormat: Text.PlainText; color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily; font.pixelSize: Style.font.caption }
           }
         }
         MouseArea {
@@ -738,7 +747,7 @@ Loader {
 
       Text {
         anchors.centerIn: parent; visible: listControl.count === 0
-        text: String(root.prop("empty_text", "No items")); color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily
+        text: String(root.prop("empty_text", "No items")); textFormat: Text.PlainText; color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily
       }
     }
   }

data/README.md

@@ -25,35 +25,38 @@ end
 
 ## Install
 
-On Omarchy x86-64, install the gem and start building:
+On Omarchy x86-64, install the gem:
 
 ```bash
 gem install omarchy-ui
-omarchy_ui new "My App"
 ```
 
-The gem contains everything required to create, launch, and bundle an application. Developers do
+The gem contains everything required to launch and bundle an application. Developers do
 not need to install a separate runtime or copy framework files. Bundled applications require only
 an Omarchy computer to run.
 
-## Create and run an application
+## Start an application
 
 ```bash
-omarchy_ui new "My App"
-cd my-app
+omarchy_ui new MyApp
+cd myapp
 omarchy_ui launch main.rb
 ```
 
-The standalone generator creates no plugin manifest or copied runtime files:
+A new standalone project contains only application-owned files:
 
 ```text
-my-app/
-├── Components/
-│   └── Welcome.qml
+myapp/
+├── components/
+│   └── welcome.rb
 ├── README.md
 └── main.rb
 ```
 
+The generated application UI is entirely Ruby. `main.rb` loads reusable Ruby components from
+`components/`; no QML source is generated into the application project. The framework creates the
+required native bridge files only when launching or bundling the app.
+
 `launch` opens a compositor-managed window. Drag its title bar or use Super+drag, and close it
 with Super+W. For protocol debugging without a window, use `omarchy_ui run main.rb`.
 
@@ -63,10 +66,10 @@ From an application directory:
 
 ```bash
 omarchy_ui bundle
-./dist/my-app/run
+./dist/myapp/run
 ```
 
-`bundle` creates a self-contained application under `dist/<project-name>/`. The generated `run`
+`bundle` creates a self-contained application under `dist/<project-name>/`. Its `run`
 launcher works on another Omarchy computer without Ruby or the `omarchy-ui` gem.
 
 An Omarchy Shell plugin is a separate packaging mode. It requires `manifest.json` so the shell
@@ -306,15 +309,6 @@ Component names, files, properties, events, IDs, effects, values, message sizes,
 limits are validated. Commands use argv arrays without a shell. Applications and plugins run with
 the current user's permissions, so review third-party code before installing it.
 
-## Omarchy Phone example
-
-`examples/omarchy-phone` demonstrates reactive controls, background discovery, safe commands,
-ADB pairing and connection, scrcpy launching, iPhone discovery, and UxPlay AirPlay mirroring.
-
-```bash
-omarchy_ui launch examples/omarchy-phone/main.rb
-```
-
 ## Development and verification
 
 ```bash
@@ -324,7 +318,7 @@ ruby script/benchmark.rb
 ```
 
 The suite covers state, bindings, repeated structures, event persistence, component schemas,
-animation tracks and sequences, tasks, command safety, standalone project generation, packaging,
+animation tracks and sequences, tasks, command safety, standalone projects, packaging,
 manifests, component contracts, linting, and the phone backend.
 
 ## License

data/Service.qml

@@ -24,6 +24,8 @@ Item {
   property int revision: 0
   property int restartDelayMs: 500
   property int eventSequence: 0
+  readonly property int maxStringLength: 16384
+  readonly property int maxCollectionItems: 256
 
   property var allowedTypes: ({})
   property var allowedProperties: ({})
@@ -41,6 +43,26 @@ Item {
     return value !== null && typeof value === "object" && !Array.isArray(value)
   }
 
+  function boundedValue(value, depth) {
+    if (depth > 8) return false
+    if (value === null || typeof value === "number" || typeof value === "boolean") return true
+    if (typeof value === "string") return value.length <= maxStringLength
+    if (Array.isArray(value)) {
+      if (value.length > maxCollectionItems) return false
+      for (var i = 0; i < value.length; i++) if (!boundedValue(value[i], depth + 1)) return false
+      return true
+    }
+    if (plainObject(value)) {
+      var keys = Object.keys(value)
+      if (keys.length > maxCollectionItems) return false
+      for (var k = 0; k < keys.length; k++) {
+        if (keys[k].length > 128 || !boundedValue(value[keys[k]], depth + 1)) return false
+      }
+      return true
+    }
+    return false
+  }
+
   function validateNode(node, index, depth, count) {
     if (!plainObject(node) || depth > 32 || count.value >= 2000) return false
     if (!allowedTypes[String(node.type || "")] || !validId(node.id)) return false
@@ -52,8 +74,7 @@ Item {
     for (var key in props) {
       if (!whitelist[key]) return false
       var value = props[key]
-      if (value !== null && typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean" && !Array.isArray(value) && !plainObject(value))
-        return false
+      if (!boundedValue(value, 0)) return false
     }
 
     var children = node.children === undefined ? [] : node.children
@@ -225,8 +246,7 @@ Item {
     if (message.op !== "set" || typeof message.property !== "string") return reject("invalid patch")
     if (!allowedProperties[node.type][message.property]) return reject("patch target rejected")
     var value = message.value
-    if (value !== null && typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean" && !Array.isArray(value) && !plainObject(value))
-      return reject("patch value rejected")
+    if (!boundedValue(value, 0)) return reject("patch value rejected")
 
     var animation = message.animation
     if (animation !== undefined && !validAnimation(animation)) return reject("patch animation rejected")
@@ -292,14 +312,15 @@ Item {
     } else if (message.type === "ack") {
       // Acknowledgements are consumed by benchmarks and future diagnostics.
     } else if (message.type === "handler_error" || message.type === "runtime_error" || message.type === "protocol_error") {
-      lastError = String(message.message || message.code || "Ruby runtime error")
+      lastError = String(message.message || message.code || "Ruby runtime error").slice(0, 512)
     } else {
       reject("unknown message type")
     }
   }
 
   function handleEffect(message) {
-    if (typeof message.name !== "string" || !plainObject(message.payload || {}))
+    if (typeof message.name !== "string" || message.name.length > 64
+        || !plainObject(message.payload || {}) || !boundedValue(message.payload || {}, 0))
       return reject("invalid effect")
     var payload = message.payload || {}
     effectReceived(message.name, payload)
@@ -313,7 +334,7 @@ Item {
   }
 
   function reject(reason) {
-    lastError = String(reason || "protocol error")
+    lastError = String(reason || "protocol error").slice(0, 512)
     console.warn("omarchy-ui bridge:", lastError)
     return false
   }
@@ -342,7 +363,8 @@ Item {
   }
 
   function sendEvent(surfaceName, controlId, eventName, payload) {
-    if (!rubyProcess.running || !validId(controlId) || !/^[a-z][a-z0-9_]{0,63}$/.test(eventName)) return false
+    if (!rubyProcess.running || !validId(controlId) || !/^[a-z][a-z0-9_]{0,63}$/.test(eventName)
+        || !plainObject(payload || {}) || !boundedValue(payload || {}, 0)) return false
     var target = nodeIndex[String(controlId)]
     var definition = target ? componentDefinitions[String(target.type)] : null
     var subscriptions = target && Array.isArray(target.events) ? target.events : []

data/lib/omarchy_ui/application.rb

@@ -190,16 +190,50 @@ module OmarchyUI
     end
 
     def reconcile_structure(structure)
+      previous_children = structure.last_children
       structure.node.children.dup.each { |child| unregister_subtree(child) }
       structure.node.children.clear
       @builder.rebuild(structure.node, &structure.renderer)
       children = structure.node.children.map(&:to_h)
       return if children == structure.last_children
+      if patchable_trees?(previous_children, children)
+        emit_property_patches(previous_children, children)
+        structure.last_children = children
+        return
+      end
       structure.last_children = children
       emit("v" => PROTOCOL_VERSION, "type" => "patch", "op" => "replace_children",
            "id" => structure.node.id, "children" => children)
     end
 
+    def patchable_trees?(previous, current)
+      return false unless previous.length == current.length
+      previous.zip(current).all? do |before, after|
+        before["id"] == after["id"] && before["type"] == after["type"] &&
+          before.fetch("events", []) == after.fetch("events", []) &&
+          before.fetch("props", {}).keys.sort == after.fetch("props", {}).keys.sort &&
+          patchable_trees?(before.fetch("children", []), after.fetch("children", []))
+      end
+    end
+
+    def emit_property_patches(previous, current)
+      previous.zip(current).each do |before, after|
+        before.fetch("props", {}).each do |property, old_value|
+          value = after.fetch("props", {}).fetch(property)
+          next if value == old_value
+          next if echoed_input_patch?(after.fetch("id"), property, value)
+          emit("v" => PROTOCOL_VERSION, "type" => "patch", "op" => "set",
+               "id" => after.fetch("id"), "property" => property, "value" => value)
+        end
+        emit_property_patches(before.fetch("children", []), after.fetch("children", []))
+      end
+    end
+
+    def echoed_input_patch?(control_id, property, value)
+      @active_event && @active_event["event"] == "input" && @active_event["id"] == control_id &&
+        %w[text value].include?(property) && @active_event.dig("payload", "value") == value
+    end
+
     def unregister_subtree(node)
       node.children.each { |child| unregister_subtree(child) }
       @nodes.delete(node.id)
@@ -212,7 +246,12 @@ module OmarchyUI
       key = [message.fetch("id"), message.fetch("event")]
       handler = @handlers[key]
       raise ProtocolError, "unknown event target: #{key.join('/')}" unless handler
-      @builder.instance_exec(message["payload"] || {}, &handler)
+      begin
+        @active_event = message
+        @builder.instance_exec(message["payload"] || {}, &handler)
+      ensure
+        @active_event = nil
+      end
       acknowledgement = {
         "v" => PROTOCOL_VERSION, "type" => "ack", "seq" => message["seq"],
         "id" => message.fetch("id"), "event" => message.fetch("event")
@@ -259,6 +298,7 @@ module OmarchyUI
     def emit(message)
       return unless @running && @output
       encoded = JSON.generate(message)
+      raise ProtocolError, "outgoing message exceeds #{MAX_MESSAGE_BYTES} bytes" if encoded.bytesize > MAX_MESSAGE_BYTES
       @write_lock.synchronize { @output.puts(encoded) }
     end
 

data/lib/omarchy_ui/builder.rb

@@ -16,11 +16,12 @@ module OmarchyUI
     def initialize(application)
       @application = application
       @stack = []
+      @dynamic_scopes = []
     end
 
     def component(type, id: nil, **props, &block)
       definition = @application.components.fetch(type)
-      node = @application.build_node(type, explicit_id: id, props:)
+      node = @application.build_node(type, explicit_id: id || scoped_id(type), props:)
       append(node)
       if block
         raise ArgumentError, "#{type} is not a container" unless definition.container
@@ -64,7 +65,8 @@ module OmarchyUI
       definition = @application.components.fetch(type)
       raise ArgumentError, "dynamic component must be a container: #{type}" unless definition.container
 
-      node = component(type, id:, **props, &renderer)
+      node = component(type, id:, **props)
+      within_dynamic(node, &renderer)
       @application.register_structure(node, renderer)
       node
     end
@@ -166,7 +168,7 @@ module OmarchyUI
     def every(seconds, immediate: false, &block) = @application.schedule(:every, interval: seconds, immediate:, &block)
     def async(&block) = @application.schedule(:async, &block)
     def run_command(argv, **options) = Command.run(argv, **options)
-    def rebuild(node, &renderer) = within(node, &renderer)
+    def rebuild(node, &renderer) = within_dynamic(node, &renderer)
     def open_panel(name) = @application.emit_effect("open_panel", "surface" => name.to_s)
 
     def close_panel(name = nil)
@@ -175,6 +177,20 @@ module OmarchyUI
 
     private
 
+    def scoped_id(type)
+      return nil if @dynamic_scopes.empty?
+      scope = @dynamic_scopes.last
+      scope[:sequence] += 1
+      "#{scope.fetch(:id)}.#{type}.#{scope.fetch(:sequence)}"
+    end
+
+    def within_dynamic(node, &block)
+      @dynamic_scopes.push({ id: node.id, sequence: 0 })
+      within(node, &block)
+    ensure
+      @dynamic_scopes.pop
+    end
+
     def surface(name, id:, options: {}, &block)
       raise ArgumentError, "surface requires a block" unless block
       node = @application.build_node(:container, explicit_id: id)
@@ -192,7 +208,8 @@ module OmarchyUI
     def input_component(type, property, value, id:, props:, handler: nil)
       props = props.merge(property => value) unless value.equal?(UNSET)
       node = component(type, id:, **props)
-      @application.register_handler(node.id, :change, handler) if handler
+      event = type == :text_field ? :input : :change
+      @application.register_handler(node.id, event, handler) if handler
       node
     end
 

data/lib/omarchy_ui/cli.rb

@@ -53,6 +53,8 @@ module OmarchyUI
 
       project_dir = File.dirname(file)
       Dir.mktmpdir("omarchy-ui-app-") do |runtime_dir|
+        runtime_program = File.join(runtime_dir, "main.rb")
+        File.write(runtime_program, SourceBundle.new(file, root: project_dir).call)
         Project::RUNTIME_FILES.each do |name|
           source = File.file?(File.join(project_dir, name)) ? File.join(project_dir, name) : File.join(FRAMEWORK_ROOT, name)
           FileUtils.cp(source, runtime_dir)
@@ -65,7 +67,7 @@ module OmarchyUI
 
         environment = ENV.to_h.merge(
           "OMARCHY_UI_PROJECT_DIR" => project_dir,
-          "OMARCHY_UI_RUBY_PROGRAM" => file,
+          "OMARCHY_UI_RUBY_PROGRAM" => runtime_program,
           "OMARCHY_UI_RUNTIME" => Runtime.executable,
           "QT_LOGGING_RULES" => qt_logging_rules
         )
@@ -103,12 +105,16 @@ module OmarchyUI
       destination = File.join(source, "dist", File.basename(source))
       raise ArgumentError, "bundle destination already exists: #{destination}" if File.exist?(destination)
       FileUtils.mkdir_p(destination)
-      entries = Dir.children(source).reject { |entry| %w[.git dist].include?(entry) }
+      entries = application_entries(source)
       FileUtils.cp_r(entries.map { |entry| File.join(source, entry) }, destination)
+      bundle_ruby_entrypoint(source, destination)
       Project.install_runtime(destination)
-      runtime = File.join(destination, "omarchy-ui-runtime")
-      FileUtils.cp(Runtime::BUNDLED, runtime)
-      FileUtils.chmod(0o755, runtime)
+      if File.file?(File.join(destination, "manifest.json"))
+        raise ArgumentError, "bundled plugin validation failed" unless system("omarchy", "plugin", "validate", destination)
+        @out.puts("Bundled plugin in #{destination}")
+        return 0
+      end
+
       %w[Commons Ui].each do |module_name|
         FileUtils.ln_s(File.join("/usr/share/omarchy/shell", module_name), File.join(destination, module_name))
       end
@@ -135,11 +141,15 @@ module OmarchyUI
       [ENV["QT_LOGGING_RULES"], "qt.qpa.services.warning=false"].compact.reject(&:empty?).join(";")
     end
 
+    def application_entries(source)
+      generated = Project::RUNTIME_FILES + Project::RUNTIME_AUDIT_FILES + %w[omarchy-ui-runtime run Commons Ui]
+      Dir.children(source).reject { |entry| %w[.git dist].include?(entry) || generated.include?(entry) }
+    end
+
     def push(arguments)
       enable = !arguments.delete("--no-enable")
       restart = !arguments.delete("--no-restart")
       source = File.expand_path(arguments.shift || Dir.pwd)
-      Runtime.install_shared
       manifest_path = File.join(source, "manifest.json")
       manifest = JSON.parse(File.read(manifest_path))
       plugin_id = manifest.fetch("id")
@@ -185,15 +195,23 @@ module OmarchyUI
     def stage_project(source, parent: nil, prefix: ".omarchy-ui-staging-")
       raise ArgumentError, "project directory not found: #{source}" unless File.directory?(source)
       staging = parent ? Dir.mktmpdir(prefix, parent) : Dir.mktmpdir(prefix)
-      entries = Dir.children(source).reject { |entry| entry == ".git" }
+      entries = application_entries(source)
       FileUtils.cp_r(entries.map { |entry| File.join(source, entry) }, staging) unless entries.empty?
-      Project.install_runtime(staging) if File.file?(File.join(staging, "main.rb"))
+      if File.file?(File.join(staging, "main.rb"))
+        bundle_ruby_entrypoint(source, staging)
+        Project.install_runtime(staging)
+      end
       staging
     rescue StandardError
       FileUtils.remove_entry(staging) if staging && File.exist?(staging)
       raise
     end
 
+    def bundle_ruby_entrypoint(source, destination)
+      entrypoint = File.join(source, "main.rb")
+      File.write(File.join(destination, "main.rb"), SourceBundle.new(entrypoint, root: source).call)
+    end
+
     def activate_plugin(plugin_id)
       return if system("omarchy", "plugin", "enable", plugin_id)
       system("omarchy-shell", "shell", "rescanPlugins")

data/lib/omarchy_ui/command.rb

@@ -5,6 +5,7 @@ require "timeout"
 
 module OmarchyUI
   class CommandTimeout < StandardError; end
+  class CommandOutputLimit < StandardError; end
 
   CommandResult = Struct.new(:stdout, :stderr, :status, keyword_init: true) do
     def success? = status.success?
@@ -14,8 +15,12 @@ module OmarchyUI
   module Command
     module_function
 
-    def run(argv, env: {}, chdir: nil, input: "", timeout: nil)
+    DEFAULT_MAX_OUTPUT_BYTES = 1_048_576
+
+    def run(argv, env: {}, chdir: nil, input: "", timeout: nil, max_output_bytes: DEFAULT_MAX_OUTPUT_BYTES)
       arguments = normalize_argv(argv)
+      output_limit = Integer(max_output_bytes)
+      raise ArgumentError, "max_output_bytes must be positive" unless output_limit.positive?
       options = {}
       options[:chdir] = File.expand_path(chdir) if chdir
       stdin = stdout = stderr = wait_thread = nil
@@ -23,10 +28,15 @@ module OmarchyUI
         stdin, stdout, stderr, wait_thread = child_stdin, child_stdout, child_stderr, child_wait
         stdin.write(input.to_s)
         stdin.close
-        stdout_reader = Thread.new { stdout.read }
-        stderr_reader = Thread.new { stderr.read }
+        stdout_reader = Thread.new { bounded_read(stdout, output_limit) }
+        stderr_reader = Thread.new { bounded_read(stderr, output_limit) }
         status = timeout ? Timeout.timeout(Float(timeout)) { wait_thread.value } : wait_thread.value
-        return CommandResult.new(stdout: stdout_reader.value, stderr: stderr_reader.value, status:)
+        stdout_value, stdout_limited = stdout_reader.value
+        stderr_value, stderr_limited = stderr_reader.value
+        if stdout_limited || stderr_limited
+          raise CommandOutputLimit, "command output exceeded #{output_limit} bytes: #{arguments.first}"
+        end
+        return CommandResult.new(stdout: stdout_value, stderr: stderr_value, status:)
       rescue Timeout::Error
         terminate(wait_thread)
         stdout_reader&.join(1)
@@ -37,6 +47,24 @@ module OmarchyUI
       [stdin, stdout, stderr].each { |stream| stream&.close unless stream&.closed? }
     end
 
+    def bounded_read(stream, limit)
+      output = +""
+      exceeded = false
+      loop do
+        chunk = stream.readpartial(16_384)
+        remaining = limit - output.bytesize
+        if remaining.positive?
+          output << chunk.byteslice(0, remaining)
+          exceeded = true if chunk.bytesize > remaining
+        else
+          exceeded = true
+        end
+      end
+    rescue EOFError
+      [output, exceeded]
+    end
+    private_class_method :bounded_read
+
     def normalize_argv(argv)
       raise ArgumentError, "command must be an argv array" unless argv.is_a?(Array) && !argv.empty?
       argv.map do |argument|

data/lib/omarchy_ui/project.rb

@@ -5,6 +5,7 @@ require "fileutils"
 module OmarchyUI
   class Project
     RUNTIME_FILES = %w[Service.qml ControlNode.qml Panel.qml BarWidget.qml App.qml].freeze
+    RUNTIME_AUDIT_FILES = %w[omarchy-ui-runtime.sha256 RUNTIME_PROVENANCE.md].freeze
 
     def initialize(path:, name: nil, framework_root: FRAMEWORK_ROOT)
       @path = File.expand_path(path)
@@ -15,9 +16,9 @@ module OmarchyUI
     def create
       raise ArgumentError, "destination already exists: #{@path}" if File.exist?(@path)
       created = true
-      FileUtils.mkdir_p(File.join(@path, "Components"))
+      FileUtils.mkdir_p(File.join(@path, "components"))
       File.write(File.join(@path, "main.rb"), main_program)
-      File.write(File.join(@path, "Components", "Welcome.qml"), welcome_component)
+      File.write(File.join(@path, "components", "welcome.rb"), welcome_component)
       File.write(File.join(@path, "README.md"), readme)
       @path
     rescue StandardError
@@ -28,7 +29,7 @@ module OmarchyUI
     def self.install_runtime(path, framework_root: FRAMEWORK_ROOT)
       RUNTIME_FILES.each do |file|
         destination = File.join(path, file)
-        FileUtils.cp(File.join(framework_root, file), destination) unless File.exist?(destination)
+        FileUtils.cp(File.join(framework_root, file), destination)
       end
       bundled_runtime = File.join(framework_root, "vendor", "runtime", "x86_64-linux", "omarchy-ui-runtime")
       if File.file?(bundled_runtime)
@@ -36,6 +37,10 @@ module OmarchyUI
         FileUtils.cp(bundled_runtime, destination)
         FileUtils.chmod(0o755, destination)
       end
+      RUNTIME_AUDIT_FILES.each do |file|
+        source = File.join(framework_root, "vendor", "runtime", "x86_64-linux", file)
+        FileUtils.cp(source, File.join(path, file)) if File.file?(source)
+      end
       FileUtils.mkdir_p(File.join(path, "Components"))
     end
 
@@ -45,63 +50,37 @@ module OmarchyUI
       <<~RUBY
         # frozen_string_literal: true
 
-        require "omarchy_ui" unless Object.const_defined?(:OmarchyUI)
+        require "omarchy_ui"
+        require_relative "components/welcome"
 
         OmarchyUI.plugin do
-          register_component :welcome,
-            qml: "Welcome.qml",
-            properties: %i[title message]
-
           app :main, title: "#{@name}", width: 760, height: 520 do
-            component :welcome,
+            welcome_card(
               title: "Welcome to #{@name}",
               message: "This is the official Omarchy UI framework."
+            )
           end
         end
       RUBY
     end
 
     def welcome_component
-      <<~QML
-        import QtQuick
-        import qs.Commons
-        import qs.Ui
-
-        BorderSurface {
-          id: root
-
-          property string title: "Welcome"
-          property string message: "This is the official Omarchy UI framework."
-
-          implicitWidth: 520
-          implicitHeight: 220
-          color: Color.popups.background
-          radius: Style.cornerRadius
-          borderSpec: Border.controlSpec("normal", Color.foreground, Color.accent)
-
-          Column {
-            anchors.centerIn: parent
-            spacing: Style.spacing.lg
-
-            Text {
-              anchors.horizontalCenter: parent.horizontalCenter
-              text: root.title
-              color: Color.foreground
-              font.family: Style.font.family
-              font.pixelSize: Style.font.heading
-              font.bold: true
-            }
-
-            Text {
-              anchors.horizontalCenter: parent.horizontalCenter
-              text: root.message
-              color: Color.foreground
-              font.family: Style.font.family
-              font.pixelSize: Style.font.body
-            }
-          }
-        }
-      QML
+      <<~RUBY
+        # frozen_string_literal: true
+
+        module WelcomeComponent
+          def welcome_card(title:, message:)
+            container padding: 24, bordered: true do
+              column spacing: 12 do
+                text title, style: :heading
+                text message, wrap: true
+              end
+            end
+          end
+        end
+
+        OmarchyUI::Builder.include(WelcomeComponent)
+      RUBY
     end
 
     def readme
@@ -119,8 +98,10 @@ module OmarchyUI
         The shared `omarchy-ui-runtime` must be installed on `PATH`. No system Ruby,
         application manifest, or copied framework QML files are required.
 
-        Edit `main.rb` for application state and behavior. Custom QML adapters live in
-        `Components/`; `Welcome.qml` is included as a working example.
+        Edit `main.rb` for application state and behavior. Reusable Ruby UI components live in
+        `components/` and load with ordinary Ruby `require_relative`; `welcome.rb` is included as a
+        working example. `omarchy_ui bundle` generates
+        the native QML bridge and embeds the runtime for distribution.
       MARKDOWN
     end
   end

data/lib/omarchy_ui/source_bundle.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module OmarchyUI
+  class SourceBundle
+    REQUIRE_RELATIVE = /\A\s*require_relative\s*(?:\(\s*)?["']([^"']+)["']\s*\)?\s*(?:#.*)?\z/
+    EMBEDDED_FRAMEWORK_REQUIRE = /\A\s*require\s*(?:\(\s*)?["']omarchy_ui["']\s*\)?\s*(?:#.*)?\z/
+
+    def initialize(entrypoint, root: File.dirname(entrypoint))
+      @entrypoint = File.expand_path(entrypoint)
+      @root = File.expand_path(root)
+      @loaded = {}
+      @loading = []
+    end
+
+    def call
+      expand(@entrypoint)
+    end
+
+    private
+
+    def expand(path)
+      path = ruby_path(File.expand_path(path))
+      ensure_inside_root!(path)
+      return "" if @loaded[path]
+      raise ArgumentError, "circular require_relative: #{relative(path)}" if @loading.include?(path)
+      raise ArgumentError, "required Ruby file not found: #{relative(path)}" unless File.file?(path)
+
+      @loading << path
+      source = File.readlines(path, chomp: true).map do |line|
+        match = REQUIRE_RELATIVE.match(line)
+        if match
+          expand(File.expand_path(match[1], File.dirname(path)))
+        elsif EMBEDDED_FRAMEWORK_REQUIRE.match?(line)
+          ""
+        else
+          line
+        end
+      end.join("\n")
+      @loaded[path] = true
+      "# source: #{relative(path)}\n#{source}\n"
+    ensure
+      @loading.pop if @loading.last == path
+    end
+
+    def ruby_path(path)
+      File.extname(path).empty? ? "#{path}.rb" : path
+    end
+
+    def ensure_inside_root!(path)
+      return if path == @root || path.start_with?("#{@root}#{File::SEPARATOR}")
+
+      raise ArgumentError, "require_relative escapes the application directory: #{path}"
+    end
+
+    def relative(path)
+      path.delete_prefix("#{@root}#{File::SEPARATOR}")
+    end
+  end
+end

data/lib/omarchy_ui.rb

@@ -11,11 +11,12 @@ require_relative "omarchy_ui/component_registry"
 require_relative "omarchy_ui/components"
 require_relative "omarchy_ui/builder"
 require_relative "omarchy_ui/application"
+require_relative "omarchy_ui/source_bundle"
 require_relative "omarchy_ui/project"
 require_relative "omarchy_ui/runtime"
 
 module OmarchyUI
-  VERSION = "0.0.2"
+  VERSION = "0.0.4"
   FRAMEWORK_ROOT = File.expand_path("..", __dir__)
 
   def self.plugin(&definition)

data/vendor/runtime/x86_64-linux/RUNTIME_PROVENANCE.md

@@ -0,0 +1,10 @@
+# Omarchy UI runtime provenance
+
+- Omarchy UI source: https://github.com/AdamMusa/omarchy-ui
+- Omarchy UI source revision: `1a516ce535156c15b90d685b030443257e79fe57`
+- mruby source revision: `831da26b9021de0369d17b71b5667e2941a1a32d`
+- Target: x86-64 Linux
+- SHA-256: `65214c89ca9ba4787d574e48b17b774cf59bb589712bc5565d2e3794877b9e47`
+
+Rebuild and verification instructions are committed at
+[`docs/runtime-build.md`](https://github.com/AdamMusa/omarchy-ui/blob/1a516ce535156c15b90d685b030443257e79fe57/docs/runtime-build.md).

data/vendor/runtime/x86_64-linux/omarchy-ui-runtime.sha256

@@ -0,0 +1 @@
+65214c89ca9ba4787d574e48b17b774cf59bb589712bc5565d2e3794877b9e47  omarchy-ui-runtime

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omarchy-ui
 version: !ruby/object:Gem::Version
-  version: 0.0.2
+  version: 0.0.4
 platform: x86_64-linux
 authors:
 - Adam Moussa Ali
@@ -38,10 +38,13 @@ files:
 - lib/omarchy_ui/protocol.rb
 - lib/omarchy_ui/runtime.rb
 - lib/omarchy_ui/scheduler.rb
+- lib/omarchy_ui/source_bundle.rb
 - lib/omarchy_ui/state_store.rb
 - lib/omarchy_ui/value.rb
 - manifest.json
+- vendor/runtime/x86_64-linux/RUNTIME_PROVENANCE.md
 - vendor/runtime/x86_64-linux/omarchy-ui-runtime
+- vendor/runtime/x86_64-linux/omarchy-ui-runtime.sha256
 homepage: https://github.com/AdamMusa/omarchy-ui
 licenses:
 - MIT