omarchy-ui 0.0.3-x86_64-linux → 0.0.4-x86_64-linux

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4f53f63774323d862684e519c9884aed320d675b9391d228354def2b7768f0e4
-  data.tar.gz: 0ed0b927c051f03f6418f737769b51bc16c80114a70e362254daf23832f72196
+  metadata.gz: b39c650e3541f41aea662dccf79373f790cc9fc84466b065ccb7b8836d74739e
+  data.tar.gz: 985d17d6917e19b2fc10996d7f20d8a99e6dd49bb5160a88aa7122220056e025
 SHA512:
-  metadata.gz: 20c6694b5a1641f360402835d44b2eabefd164a373e28f94b878d0e41e1351cb3c40a67db4a19e2d7ff0df5298d1a6ff0ed8316ea7aa89ffe2073ffef2f7dfd0
-  data.tar.gz: 00457faae9811da4e493d35d77b7c0ed514200c16acd51174841e5e3a172f9687a891d44f18c5dca60ad1be1ea47398a4b7128160d66dfd8c37c1ad796dde9df
+  metadata.gz: cfa24ef79ecfdffcb0e00c4243b26600a4df4e2b4cf197aad307bceef54011631c482a15d055b2c88710acda2e8baceba0ebec1106ae2c290850016ea70793b9
+  data.tar.gz: bf1ed984d03aea86c9db37cdd3dc1556faad23d23fef443d81669770a3e7431e87aa8632932794be1ad820117a98181990764c6401cb3de44513b9cc07d8e768

data/ControlNode.qml

@@ -40,6 +40,13 @@ Loader {
     return icons[key] || key
   }
 
+  function escapeAutoText(value) {
+    return String(value === undefined || value === null ? "" : value)
+      .replace(/&/g, "&")
+      .replace(/</g, "&lt;")
+      .replace(/>/g, "&gt;")
+  }
+
   function easingType(name) {
     var easings = {
       linear: Easing.Linear,
@@ -224,6 +231,7 @@ Loader {
 
     Text {
       text: String(root.prop("text", ""))
+      textFormat: Text.PlainText
       color: root.prop("color", root.foreground)
       font.family: root.fontFamily
       font.pixelSize: {
@@ -243,6 +251,7 @@ Loader {
 
     Text {
       text: root.iconGlyph(root.prop("name", root.prop("text", "")))
+      textFormat: Text.PlainText
       color: root.foreground
       font.family: root.fontFamily
       font.pixelSize: Number(root.prop("size", Style.font.icon))
@@ -253,9 +262,9 @@ Loader {
     id: buttonComponent
 
     OmarchyUi.Button {
-      text: String(root.prop("text", ""))
+      text: root.escapeAutoText(root.prop("text", ""))
       iconText: root.iconGlyph(root.prop("icon", ""))
-      tooltipText: String(root.prop("tooltip", ""))
+      tooltipText: root.escapeAutoText(root.prop("tooltip", ""))
       selected: root.prop("selected", false) === true
       active: root.prop("active", false) === true
       hasCursor: root.prop("cursor", false) === true
@@ -461,7 +470,7 @@ Loader {
   Component {
     id: actionButtonComponent
     OmarchyUi.PanelActionButton {
-      iconText: root.iconGlyph(root.prop("icon", "")); tooltipText: String(root.prop("tooltip", ""))
+      iconText: root.iconGlyph(root.prop("icon", "")); tooltipText: root.escapeAutoText(root.prop("tooltip", ""))
       bordered: root.prop("bordered", false) === true; focusable: root.prop("focusable", false) === true
       hasCursor: root.prop("cursor", false) === true
       size: Number(root.prop("size", 28)); foreground: root.prop("foreground", root.foreground)
@@ -475,7 +484,7 @@ Loader {
   Component {
     id: toggleComponent
     OmarchyUi.Toggle {
-      label: String(root.prop("label", "")); description: String(root.prop("description", ""))
+      label: root.escapeAutoText(root.prop("label", "")); description: root.escapeAutoText(root.prop("description", ""))
       checked: root.prop("checked", false) === true; hasCursor: root.prop("cursor", false) === true
       rounded: root.prop("rounded", Style.cornerRadius > 0) === true
       foreground: root.prop("foreground", root.foreground); accent: root.prop("accent", Color.accent)
@@ -522,7 +531,7 @@ Loader {
   Component {
     id: numberFieldComponent
     OmarchyUi.NumberField {
-      label: String(root.prop("label", "")); value: Number(root.prop("value", 0))
+      label: root.escapeAutoText(root.prop("label", "")); value: Number(root.prop("value", 0))
       from: Number(root.prop("from", 0)); to: Number(root.prop("to", 100)); stepSize: Number(root.prop("step", 1))
       foreground: root.prop("foreground", root.foreground); accent: root.prop("accent", Color.accent)
       fontFamily: String(root.prop("font_family", root.fontFamily)); fontSize: Number(root.prop("font_size", Style.font.body))
@@ -551,7 +560,7 @@ Loader {
   Component {
     id: dropdownComponent
     OmarchyUi.Dropdown {
-      label: String(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
+      label: root.escapeAutoText(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
       implicitWidth: Number(root.prop("width", 240)); foreground: root.prop("foreground", root.foreground)
       background: root.prop("background", Color.popups.background); popupBorder: root.prop("popup_border", Color.popups.border)
       accent: root.prop("accent", Color.accent); fontFamily: String(root.prop("font_family", root.fontFamily))
@@ -565,7 +574,7 @@ Loader {
   Component {
     id: multiSelectComponent
     OmarchyUi.MultiSelect {
-      label: String(root.prop("label", "")); values: root.prop("values", []); options: root.prop("options", [])
+      label: root.escapeAutoText(root.prop("label", "")); values: root.prop("values", []); options: root.prop("options", [])
       placeholderText: String(root.prop("placeholder", "Search...")); enabled: root.prop("enabled", true) !== false
       optionsCommand: root.prop("options_command", []); optionsCommandCwd: String(root.prop("options_command_cwd", ""))
       emptyText: String(root.prop("empty_text", "No options")); noSelectionText: String(root.prop("no_selection_text", "None selected"))
@@ -604,12 +613,12 @@ Loader {
   }
 
   Component { id: separatorComponent; OmarchyUi.PanelSeparator { foreground: root.foreground; strength: Number(root.prop("strength", 0.12)) } }
-  Component { id: sectionHeaderComponent; OmarchyUi.PanelSectionHeader { text: String(root.prop("text", "")); foreground: root.foreground; fontFamily: root.fontFamily } }
+  Component { id: sectionHeaderComponent; OmarchyUi.PanelSectionHeader { text: root.escapeAutoText(root.prop("text", "")); foreground: root.foreground; fontFamily: root.fontFamily } }
 
   Component {
     id: searchableDropdownComponent
     OmarchyUi.SearchableDropdown {
-      label: String(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
+      label: root.escapeAutoText(root.prop("label", "")); value: String(root.prop("value", "")); options: root.prop("options", [])
       placeholderText: String(root.prop("placeholder", "Search...")); emptyText: String(root.prop("empty_text", "No matches"))
       triggerLabel: String(root.prop("trigger_label", "")); implicitWidth: Number(root.prop("width", 240))
       foreground: root.prop("foreground", root.foreground); background: root.prop("background", Color.popups.background)
@@ -640,7 +649,7 @@ Loader {
   Component {
     id: panelHeroComponent
     OmarchyUi.PanelHero {
-      title: String(root.prop("title", "")); meta: String(root.prop("meta", "")); detail: String(root.prop("detail", ""))
+      title: root.escapeAutoText(root.prop("title", "")); meta: root.escapeAutoText(root.prop("meta", "")); detail: root.escapeAutoText(root.prop("detail", ""))
       iconSize: Number(root.prop("icon_size", Style.font.display)); iconOpacity: Number(root.prop("icon_opacity", 1))
       metaOpacity: Number(root.prop("meta_opacity", 1)); foreground: root.prop("foreground", root.foreground)
       fontFamily: String(root.prop("font_family", root.fontFamily))
@@ -665,7 +674,7 @@ Loader {
   Component {
     id: widgetButtonComponent
     OmarchyUi.WidgetButton {
-      text: String(root.prop("text", "")); tooltipText: String(root.prop("tooltip", "")); active: root.prop("active", false) === true
+      text: root.escapeAutoText(root.prop("text", "")); tooltipText: root.escapeAutoText(root.prop("tooltip", "")); active: root.prop("active", false) === true
       dimmed: root.prop("dimmed", false) === true; concealed: root.prop("concealed", false) === true
       interactive: root.prop("interactive", true) !== false; pressable: root.prop("pressable", true) !== false
       fontFamily: String(root.prop("font_family", root.fontFamily)); fontSize: Number(root.prop("font_size", Style.font.body))
@@ -720,10 +729,10 @@ Loader {
           id: rowContent
           anchors.centerIn: parent
           spacing: Style.spacing.controlGap
-          Text { visible: text !== ""; text: root.iconGlyph(typeof modelData === "object" ? modelData[listControl.iconField] : ""); color: root.foreground; font.family: root.fontFamily }
+          Text { visible: text !== ""; text: root.iconGlyph(typeof modelData === "object" ? modelData[listControl.iconField] : ""); textFormat: Text.PlainText; color: root.foreground; font.family: root.fontFamily }
           Column {
-            Text { text: String(typeof modelData === "object" ? (modelData[listControl.labelField] ?? value) : modelData); color: root.foreground; font.family: root.fontFamily }
-            Text { visible: text !== ""; text: String(typeof modelData === "object" ? (modelData[listControl.descriptionField] || "") : ""); color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily; font.pixelSize: Style.font.caption }
+            Text { text: String(typeof modelData === "object" ? (modelData[listControl.labelField] ?? value) : modelData); textFormat: Text.PlainText; color: root.foreground; font.family: root.fontFamily }
+            Text { visible: text !== ""; text: String(typeof modelData === "object" ? (modelData[listControl.descriptionField] || "") : ""); textFormat: Text.PlainText; color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily; font.pixelSize: Style.font.caption }
           }
         }
         MouseArea {
@@ -738,7 +747,7 @@ Loader {
 
       Text {
         anchors.centerIn: parent; visible: listControl.count === 0
-        text: String(root.prop("empty_text", "No items")); color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily
+        text: String(root.prop("empty_text", "No items")); textFormat: Text.PlainText; color: Qt.darker(root.foreground, 1.4); font.family: root.fontFamily
       }
     }
   }

data/README.md

@@ -47,12 +47,16 @@ A new standalone project contains only application-owned files:
 
 ```text
 myapp/
-├── Components/
-│   └── Welcome.qml
+├── components/
+│   └── welcome.rb
 ├── README.md
 └── main.rb
 ```
 
+The generated application UI is entirely Ruby. `main.rb` loads reusable Ruby components from
+`components/`; no QML source is generated into the application project. The framework creates the
+required native bridge files only when launching or bundling the app.
+
 `launch` opens a compositor-managed window. Drag its title bar or use Super+drag, and close it
 with Super+W. For protocol debugging without a window, use `omarchy_ui run main.rb`.
 

data/Service.qml

@@ -24,6 +24,8 @@ Item {
   property int revision: 0
   property int restartDelayMs: 500
   property int eventSequence: 0
+  readonly property int maxStringLength: 16384
+  readonly property int maxCollectionItems: 256
 
   property var allowedTypes: ({})
   property var allowedProperties: ({})
@@ -41,6 +43,26 @@ Item {
     return value !== null && typeof value === "object" && !Array.isArray(value)
   }
 
+  function boundedValue(value, depth) {
+    if (depth > 8) return false
+    if (value === null || typeof value === "number" || typeof value === "boolean") return true
+    if (typeof value === "string") return value.length <= maxStringLength
+    if (Array.isArray(value)) {
+      if (value.length > maxCollectionItems) return false
+      for (var i = 0; i < value.length; i++) if (!boundedValue(value[i], depth + 1)) return false
+      return true
+    }
+    if (plainObject(value)) {
+      var keys = Object.keys(value)
+      if (keys.length > maxCollectionItems) return false
+      for (var k = 0; k < keys.length; k++) {
+        if (keys[k].length > 128 || !boundedValue(value[keys[k]], depth + 1)) return false
+      }
+      return true
+    }
+    return false
+  }
+
   function validateNode(node, index, depth, count) {
     if (!plainObject(node) || depth > 32 || count.value >= 2000) return false
     if (!allowedTypes[String(node.type || "")] || !validId(node.id)) return false
@@ -52,8 +74,7 @@ Item {
     for (var key in props) {
       if (!whitelist[key]) return false
       var value = props[key]
-      if (value !== null && typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean" && !Array.isArray(value) && !plainObject(value))
-        return false
+      if (!boundedValue(value, 0)) return false
     }
 
     var children = node.children === undefined ? [] : node.children
@@ -225,8 +246,7 @@ Item {
     if (message.op !== "set" || typeof message.property !== "string") return reject("invalid patch")
     if (!allowedProperties[node.type][message.property]) return reject("patch target rejected")
     var value = message.value
-    if (value !== null && typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean" && !Array.isArray(value) && !plainObject(value))
-      return reject("patch value rejected")
+    if (!boundedValue(value, 0)) return reject("patch value rejected")
 
     var animation = message.animation
     if (animation !== undefined && !validAnimation(animation)) return reject("patch animation rejected")
@@ -292,14 +312,15 @@ Item {
     } else if (message.type === "ack") {
       // Acknowledgements are consumed by benchmarks and future diagnostics.
     } else if (message.type === "handler_error" || message.type === "runtime_error" || message.type === "protocol_error") {
-      lastError = String(message.message || message.code || "Ruby runtime error")
+      lastError = String(message.message || message.code || "Ruby runtime error").slice(0, 512)
     } else {
       reject("unknown message type")
     }
   }
 
   function handleEffect(message) {
-    if (typeof message.name !== "string" || !plainObject(message.payload || {}))
+    if (typeof message.name !== "string" || message.name.length > 64
+        || !plainObject(message.payload || {}) || !boundedValue(message.payload || {}, 0))
       return reject("invalid effect")
     var payload = message.payload || {}
     effectReceived(message.name, payload)
@@ -313,7 +334,7 @@ Item {
   }
 
   function reject(reason) {
-    lastError = String(reason || "protocol error")
+    lastError = String(reason || "protocol error").slice(0, 512)
     console.warn("omarchy-ui bridge:", lastError)
     return false
   }
@@ -342,7 +363,8 @@ Item {
   }
 
   function sendEvent(surfaceName, controlId, eventName, payload) {
-    if (!rubyProcess.running || !validId(controlId) || !/^[a-z][a-z0-9_]{0,63}$/.test(eventName)) return false
+    if (!rubyProcess.running || !validId(controlId) || !/^[a-z][a-z0-9_]{0,63}$/.test(eventName)
+        || !plainObject(payload || {}) || !boundedValue(payload || {}, 0)) return false
     var target = nodeIndex[String(controlId)]
     var definition = target ? componentDefinitions[String(target.type)] : null
     var subscriptions = target && Array.isArray(target.events) ? target.events : []

data/lib/omarchy_ui/application.rb

@@ -298,6 +298,7 @@ module OmarchyUI
     def emit(message)
       return unless @running && @output
       encoded = JSON.generate(message)
+      raise ProtocolError, "outgoing message exceeds #{MAX_MESSAGE_BYTES} bytes" if encoded.bytesize > MAX_MESSAGE_BYTES
       @write_lock.synchronize { @output.puts(encoded) }
     end
 

data/lib/omarchy_ui/cli.rb

@@ -53,6 +53,8 @@ module OmarchyUI
 
       project_dir = File.dirname(file)
       Dir.mktmpdir("omarchy-ui-app-") do |runtime_dir|
+        runtime_program = File.join(runtime_dir, "main.rb")
+        File.write(runtime_program, SourceBundle.new(file, root: project_dir).call)
         Project::RUNTIME_FILES.each do |name|
           source = File.file?(File.join(project_dir, name)) ? File.join(project_dir, name) : File.join(FRAMEWORK_ROOT, name)
           FileUtils.cp(source, runtime_dir)
@@ -65,7 +67,7 @@ module OmarchyUI
 
         environment = ENV.to_h.merge(
           "OMARCHY_UI_PROJECT_DIR" => project_dir,
-          "OMARCHY_UI_RUBY_PROGRAM" => file,
+          "OMARCHY_UI_RUBY_PROGRAM" => runtime_program,
           "OMARCHY_UI_RUNTIME" => Runtime.executable,
           "QT_LOGGING_RULES" => qt_logging_rules
         )
@@ -105,6 +107,7 @@ module OmarchyUI
       FileUtils.mkdir_p(destination)
       entries = application_entries(source)
       FileUtils.cp_r(entries.map { |entry| File.join(source, entry) }, destination)
+      bundle_ruby_entrypoint(source, destination)
       Project.install_runtime(destination)
       if File.file?(File.join(destination, "manifest.json"))
         raise ArgumentError, "bundled plugin validation failed" unless system("omarchy", "plugin", "validate", destination)
@@ -139,7 +142,7 @@ module OmarchyUI
     end
 
     def application_entries(source)
-      generated = Project::RUNTIME_FILES + %w[omarchy-ui-runtime run Commons Ui]
+      generated = Project::RUNTIME_FILES + Project::RUNTIME_AUDIT_FILES + %w[omarchy-ui-runtime run Commons Ui]
       Dir.children(source).reject { |entry| %w[.git dist].include?(entry) || generated.include?(entry) }
     end
 
@@ -194,13 +197,21 @@ module OmarchyUI
       staging = parent ? Dir.mktmpdir(prefix, parent) : Dir.mktmpdir(prefix)
       entries = application_entries(source)
       FileUtils.cp_r(entries.map { |entry| File.join(source, entry) }, staging) unless entries.empty?
-      Project.install_runtime(staging) if File.file?(File.join(staging, "main.rb"))
+      if File.file?(File.join(staging, "main.rb"))
+        bundle_ruby_entrypoint(source, staging)
+        Project.install_runtime(staging)
+      end
       staging
     rescue StandardError
       FileUtils.remove_entry(staging) if staging && File.exist?(staging)
       raise
     end
 
+    def bundle_ruby_entrypoint(source, destination)
+      entrypoint = File.join(source, "main.rb")
+      File.write(File.join(destination, "main.rb"), SourceBundle.new(entrypoint, root: source).call)
+    end
+
     def activate_plugin(plugin_id)
       return if system("omarchy", "plugin", "enable", plugin_id)
       system("omarchy-shell", "shell", "rescanPlugins")

data/lib/omarchy_ui/command.rb

@@ -5,6 +5,7 @@ require "timeout"
 
 module OmarchyUI
   class CommandTimeout < StandardError; end
+  class CommandOutputLimit < StandardError; end
 
   CommandResult = Struct.new(:stdout, :stderr, :status, keyword_init: true) do
     def success? = status.success?
@@ -14,8 +15,12 @@ module OmarchyUI
   module Command
     module_function
 
-    def run(argv, env: {}, chdir: nil, input: "", timeout: nil)
+    DEFAULT_MAX_OUTPUT_BYTES = 1_048_576
+
+    def run(argv, env: {}, chdir: nil, input: "", timeout: nil, max_output_bytes: DEFAULT_MAX_OUTPUT_BYTES)
       arguments = normalize_argv(argv)
+      output_limit = Integer(max_output_bytes)
+      raise ArgumentError, "max_output_bytes must be positive" unless output_limit.positive?
       options = {}
       options[:chdir] = File.expand_path(chdir) if chdir
       stdin = stdout = stderr = wait_thread = nil
@@ -23,10 +28,15 @@ module OmarchyUI
         stdin, stdout, stderr, wait_thread = child_stdin, child_stdout, child_stderr, child_wait
         stdin.write(input.to_s)
         stdin.close
-        stdout_reader = Thread.new { stdout.read }
-        stderr_reader = Thread.new { stderr.read }
+        stdout_reader = Thread.new { bounded_read(stdout, output_limit) }
+        stderr_reader = Thread.new { bounded_read(stderr, output_limit) }
         status = timeout ? Timeout.timeout(Float(timeout)) { wait_thread.value } : wait_thread.value
-        return CommandResult.new(stdout: stdout_reader.value, stderr: stderr_reader.value, status:)
+        stdout_value, stdout_limited = stdout_reader.value
+        stderr_value, stderr_limited = stderr_reader.value
+        if stdout_limited || stderr_limited
+          raise CommandOutputLimit, "command output exceeded #{output_limit} bytes: #{arguments.first}"
+        end
+        return CommandResult.new(stdout: stdout_value, stderr: stderr_value, status:)
       rescue Timeout::Error
         terminate(wait_thread)
         stdout_reader&.join(1)
@@ -37,6 +47,24 @@ module OmarchyUI
       [stdin, stdout, stderr].each { |stream| stream&.close unless stream&.closed? }
     end
 
+    def bounded_read(stream, limit)
+      output = +""
+      exceeded = false
+      loop do
+        chunk = stream.readpartial(16_384)
+        remaining = limit - output.bytesize
+        if remaining.positive?
+          output << chunk.byteslice(0, remaining)
+          exceeded = true if chunk.bytesize > remaining
+        else
+          exceeded = true
+        end
+      end
+    rescue EOFError
+      [output, exceeded]
+    end
+    private_class_method :bounded_read
+
     def normalize_argv(argv)
       raise ArgumentError, "command must be an argv array" unless argv.is_a?(Array) && !argv.empty?
       argv.map do |argument|

data/lib/omarchy_ui/project.rb

@@ -5,6 +5,7 @@ require "fileutils"
 module OmarchyUI
   class Project
     RUNTIME_FILES = %w[Service.qml ControlNode.qml Panel.qml BarWidget.qml App.qml].freeze
+    RUNTIME_AUDIT_FILES = %w[omarchy-ui-runtime.sha256 RUNTIME_PROVENANCE.md].freeze
 
     def initialize(path:, name: nil, framework_root: FRAMEWORK_ROOT)
       @path = File.expand_path(path)
@@ -15,9 +16,9 @@ module OmarchyUI
     def create
       raise ArgumentError, "destination already exists: #{@path}" if File.exist?(@path)
       created = true
-      FileUtils.mkdir_p(File.join(@path, "Components"))
+      FileUtils.mkdir_p(File.join(@path, "components"))
       File.write(File.join(@path, "main.rb"), main_program)
-      File.write(File.join(@path, "Components", "Welcome.qml"), welcome_component)
+      File.write(File.join(@path, "components", "welcome.rb"), welcome_component)
       File.write(File.join(@path, "README.md"), readme)
       @path
     rescue StandardError
@@ -36,6 +37,10 @@ module OmarchyUI
         FileUtils.cp(bundled_runtime, destination)
         FileUtils.chmod(0o755, destination)
       end
+      RUNTIME_AUDIT_FILES.each do |file|
+        source = File.join(framework_root, "vendor", "runtime", "x86_64-linux", file)
+        FileUtils.cp(source, File.join(path, file)) if File.file?(source)
+      end
       FileUtils.mkdir_p(File.join(path, "Components"))
     end
 
@@ -45,63 +50,37 @@ module OmarchyUI
       <<~RUBY
         # frozen_string_literal: true
 
-        require "omarchy_ui" unless Object.const_defined?(:OmarchyUI)
+        require "omarchy_ui"
+        require_relative "components/welcome"
 
         OmarchyUI.plugin do
-          register_component :welcome,
-            qml: "Welcome.qml",
-            properties: %i[title message]
-
           app :main, title: "#{@name}", width: 760, height: 520 do
-            component :welcome,
+            welcome_card(
               title: "Welcome to #{@name}",
               message: "This is the official Omarchy UI framework."
+            )
           end
         end
       RUBY
     end
 
     def welcome_component
-      <<~QML
-        import QtQuick
-        import qs.Commons
-        import qs.Ui
-
-        BorderSurface {
-          id: root
-
-          property string title: "Welcome"
-          property string message: "This is the official Omarchy UI framework."
-
-          implicitWidth: 520
-          implicitHeight: 220
-          color: Color.popups.background
-          radius: Style.cornerRadius
-          borderSpec: Border.controlSpec("normal", Color.foreground, Color.accent)
-
-          Column {
-            anchors.centerIn: parent
-            spacing: Style.spacing.lg
-
-            Text {
-              anchors.horizontalCenter: parent.horizontalCenter
-              text: root.title
-              color: Color.foreground
-              font.family: Style.font.family
-              font.pixelSize: Style.font.heading
-              font.bold: true
-            }
-
-            Text {
-              anchors.horizontalCenter: parent.horizontalCenter
-              text: root.message
-              color: Color.foreground
-              font.family: Style.font.family
-              font.pixelSize: Style.font.body
-            }
-          }
-        }
-      QML
+      <<~RUBY
+        # frozen_string_literal: true
+
+        module WelcomeComponent
+          def welcome_card(title:, message:)
+            container padding: 24, bordered: true do
+              column spacing: 12 do
+                text title, style: :heading
+                text message, wrap: true
+              end
+            end
+          end
+        end
+
+        OmarchyUI::Builder.include(WelcomeComponent)
+      RUBY
     end
 
     def readme
@@ -119,8 +98,10 @@ module OmarchyUI
         The shared `omarchy-ui-runtime` must be installed on `PATH`. No system Ruby,
         application manifest, or copied framework QML files are required.
 
-        Edit `main.rb` for application state and behavior. Custom QML adapters live in
-        `Components/`; `Welcome.qml` is included as a working example.
+        Edit `main.rb` for application state and behavior. Reusable Ruby UI components live in
+        `components/` and load with ordinary Ruby `require_relative`; `welcome.rb` is included as a
+        working example. `omarchy_ui bundle` generates
+        the native QML bridge and embeds the runtime for distribution.
       MARKDOWN
     end
   end

data/lib/omarchy_ui/source_bundle.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module OmarchyUI
+  class SourceBundle
+    REQUIRE_RELATIVE = /\A\s*require_relative\s*(?:\(\s*)?["']([^"']+)["']\s*\)?\s*(?:#.*)?\z/
+    EMBEDDED_FRAMEWORK_REQUIRE = /\A\s*require\s*(?:\(\s*)?["']omarchy_ui["']\s*\)?\s*(?:#.*)?\z/
+
+    def initialize(entrypoint, root: File.dirname(entrypoint))
+      @entrypoint = File.expand_path(entrypoint)
+      @root = File.expand_path(root)
+      @loaded = {}
+      @loading = []
+    end
+
+    def call
+      expand(@entrypoint)
+    end
+
+    private
+
+    def expand(path)
+      path = ruby_path(File.expand_path(path))
+      ensure_inside_root!(path)
+      return "" if @loaded[path]
+      raise ArgumentError, "circular require_relative: #{relative(path)}" if @loading.include?(path)
+      raise ArgumentError, "required Ruby file not found: #{relative(path)}" unless File.file?(path)
+
+      @loading << path
+      source = File.readlines(path, chomp: true).map do |line|
+        match = REQUIRE_RELATIVE.match(line)
+        if match
+          expand(File.expand_path(match[1], File.dirname(path)))
+        elsif EMBEDDED_FRAMEWORK_REQUIRE.match?(line)
+          ""
+        else
+          line
+        end
+      end.join("\n")
+      @loaded[path] = true
+      "# source: #{relative(path)}\n#{source}\n"
+    ensure
+      @loading.pop if @loading.last == path
+    end
+
+    def ruby_path(path)
+      File.extname(path).empty? ? "#{path}.rb" : path
+    end
+
+    def ensure_inside_root!(path)
+      return if path == @root || path.start_with?("#{@root}#{File::SEPARATOR}")
+
+      raise ArgumentError, "require_relative escapes the application directory: #{path}"
+    end
+
+    def relative(path)
+      path.delete_prefix("#{@root}#{File::SEPARATOR}")
+    end
+  end
+end

data/lib/omarchy_ui.rb

@@ -11,11 +11,12 @@ require_relative "omarchy_ui/component_registry"
 require_relative "omarchy_ui/components"
 require_relative "omarchy_ui/builder"
 require_relative "omarchy_ui/application"
+require_relative "omarchy_ui/source_bundle"
 require_relative "omarchy_ui/project"
 require_relative "omarchy_ui/runtime"
 
 module OmarchyUI
-  VERSION = "0.0.3"
+  VERSION = "0.0.4"
   FRAMEWORK_ROOT = File.expand_path("..", __dir__)
 
   def self.plugin(&definition)

data/vendor/runtime/x86_64-linux/RUNTIME_PROVENANCE.md

@@ -0,0 +1,10 @@
+# Omarchy UI runtime provenance
+
+- Omarchy UI source: https://github.com/AdamMusa/omarchy-ui
+- Omarchy UI source revision: `1a516ce535156c15b90d685b030443257e79fe57`
+- mruby source revision: `831da26b9021de0369d17b71b5667e2941a1a32d`
+- Target: x86-64 Linux
+- SHA-256: `65214c89ca9ba4787d574e48b17b774cf59bb589712bc5565d2e3794877b9e47`
+
+Rebuild and verification instructions are committed at
+[`docs/runtime-build.md`](https://github.com/AdamMusa/omarchy-ui/blob/1a516ce535156c15b90d685b030443257e79fe57/docs/runtime-build.md).

data/vendor/runtime/x86_64-linux/omarchy-ui-runtime.sha256

@@ -0,0 +1 @@
+65214c89ca9ba4787d574e48b17b774cf59bb589712bc5565d2e3794877b9e47  omarchy-ui-runtime

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: omarchy-ui
 version: !ruby/object:Gem::Version
-  version: 0.0.3
+  version: 0.0.4
 platform: x86_64-linux
 authors:
 - Adam Moussa Ali
@@ -38,10 +38,13 @@ files:
 - lib/omarchy_ui/protocol.rb
 - lib/omarchy_ui/runtime.rb
 - lib/omarchy_ui/scheduler.rb
+- lib/omarchy_ui/source_bundle.rb
 - lib/omarchy_ui/state_store.rb
 - lib/omarchy_ui/value.rb
 - manifest.json
+- vendor/runtime/x86_64-linux/RUNTIME_PROVENANCE.md
 - vendor/runtime/x86_64-linux/omarchy-ui-runtime
+- vendor/runtime/x86_64-linux/omarchy-ui-runtime.sha256
 homepage: https://github.com/AdamMusa/omarchy-ui
 licenses:
 - MIT