aurasprout 0.1.1__tar.gz

aurasprout-0.1.1/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 AuraCoreDynamics
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

aurasprout-0.1.1/PKG-INFO

@@ -0,0 +1,74 @@
+Metadata-Version: 2.4
+Name: aurasprout
+Version: 0.1.1
+Summary: User-space zero-privilege AuraGrid cell coordination, application catalog, installer, and supervision layer.
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: auraseed>=1.1.0
+Requires-Dist: auragrid>=4.3.0
+Requires-Dist: pydantic>=2.0.0
+Requires-Dist: httpx>=0.25.0
+Dynamic: license-file
+
+# AuraSprout
+
+Zero-privilege, user-space application distribution, local supervision, and shared-filesystem coordination layer for **AuraCore**.
+
+## Architecture Boundaries
+
+- **`auragrid-api`**: Canonical OpenAPI (`ipc-bridge.openapi.json`, `aurasprout-management.openapi.json`) and JSON Schemas (`app.manifest.schema.json`, `catalog.schema.json`, `lease-collaboration.schema.json`).
+- **`auragrid-py`**: Typed Python SDK consumed by `LocalOnly`, `CellSingleton`, and `Distributed` MAS workloads.
+- **`auraseed`**: Strictly Python discovery & sovereign virtual environment (`mvenv`) management (`aurasprout` composes `auraseed.gui.MvenvManagerPanel`).
+- **`aurasprout`**: Application cataloging & packaging (`.apkg`), HTTP catalog hosting/push, user-space installation/updates/rollback (`active_version.json` + preserved `app_data/`), cleanroom standalone self-install/cleanup, SMB-safe SQLite event bus (`PRAGMA journal_mode = TRUNCATE`), atomic directory mutex & fenced leases/batches (`SproutMutex`), Tier 2 loopback IPC bridge (`X-AuraGrid-IPC-Token`), Tier 3 loopback Management Web UI (`aurasprout_session` + `X-CSRF-Token`), and Tkinter Desktop Hub.
+
+## Quick Start
+
+Both `aurasprout` (installed console script / standalone launcher) and `python -m aurasprout` expose the full CLI (supporting global `--cell-root` and `--user-root` flags):
+
+```powershell
+# Install AuraSprout standalone into %LOCALAPPDATA%\AuraSprout\standalone
+python -m aurasprout self-install --add-to-path --shortcut --json
+
+# Package & publish an app to a static zero-CDN catalog (supports --wheelhouse, --format zip|tar.gz)
+aurasprout package .\my_app --out .\dist --publish .\catalog --channel stable --json
+
+# Push an .apkg or source directory to a running AuraSprout HTTP server
+aurasprout catalog push .\dist\my-app-1.0.0.apkg --server http://127.0.0.1:8765 --token-file ui_daemon.json --json
+
+# Install locally from directory, .apkg, or HTTP/FS catalog (user-space only, zero admin privileges)
+aurasprout install my-app --from-catalog http://127.0.0.1:8765/catalog --channel stable --shortcut --json
+
+# Manage catalog entries & attached sources
+aurasprout catalog list --installed --json
+aurasprout catalog sources --json
+aurasprout catalog add-source https://example.internal/catalog --default
+aurasprout catalog remove-source https://example.internal/catalog
+aurasprout catalog delete my-app --json
+
+# Rollback, uninstall, or clean up user state completely
+aurasprout rollback my-app --json
+aurasprout uninstall my-app --remove-mvenv --json
+aurasprout self-uninstall --yes --json
+
+# Inspect or opt in to cell volunteering (opt-in default: false) & resolve conflicts
+aurasprout volunteer status --json
+aurasprout volunteer enable my-service --mode CellSingleton --json
+aurasprout volunteer disable my-service --json
+aurasprout conflicts list --json
+aurasprout conflicts resolve <conflictId> TakeOverStaleLock --json
+
+# Start Tier 3 loopback Management Web UI (plus /catalog hosting), Tier 2 IPC bridge, or Desktop Hub
+aurasprout ui --port 8765 --token-file ui_daemon.json --json
+aurasprout ipc --port 8766
+aurasprout desktop
+```
+
+## HTTP Endpoints & Storage
+
+- **Tier 3 Management UI & Hosted Catalog (`aurasprout ui`)**:
+  - Public: `GET /`, `GET /api/health`, `GET /api/v1/health`, `GET /catalog/`, `GET /catalog/index.html`, `GET /catalog/catalog.json`, `GET /catalog/apps/<path>`, `GET /catalog/channels/<path>`.
+  - Auth & CSRF (`POST /api/v1/auth/session`): `/api/v1/apps`, `/api/v1/apps/install`, `/api/v1/apps/{appId}`, `/api/v1/apps/{appId}/launch`, `/api/v1/catalog`, `/api/v1/catalog/sources`, `POST /api/v1/catalog/publish` (binary/multipart/base64/path), `/api/v1/catalog/apps/{appId}/download`, `/api/v1/volunteer*`, `/api/v1/conflicts*`, `/api/v1/runtimes`.
+- **Tier 2 IPC Bridge (`aurasprout ipc`)**: Loopback `X-AuraGrid-IPC-Token` endpoints under `/health`, `/ready`, `/cell/config*`, `/cell/members*`, `/cell/governance*`, `/cell/events*`, `/cell/lease*`, `/cell/collaboration*`, `/cell/registry*`, `/cell/storage*`, `/cell/tattle`, and `/cell/chaos*`.
+- **User Data Roots**: Resolved via `AURASPROUT_HOME` -> `%LOCALAPPDATA%\AuraSprout` (Windows), `~/Library/Application Support/aurasprout` (macOS), or `$XDG_DATA_HOME/aurasprout` / `~/.local/share/aurasprout` (Linux).
+- **Environment Variables**: `AURASPROUT_HOME`, `AURASPROUT_CELL_ROOT`, `AURAGRID_CELL_ROOT`, `AURASPROUT_STANDALONE_DIR`, `AURASPROUT_UI_HOST`, `AURASPROUT_UI_PORT`, `AURASPROUT_UI_TOKEN`, `AURASPROUT_DEFAULT_CATALOG`, `AURAGRID_IPC_TOKEN`, `AURAGRID_NODE_ID`.

aurasprout-0.1.1/README.md

@@ -0,0 +1,61 @@
+# AuraSprout
+
+Zero-privilege, user-space application distribution, local supervision, and shared-filesystem coordination layer for **AuraCore**.
+
+## Architecture Boundaries
+
+- **`auragrid-api`**: Canonical OpenAPI (`ipc-bridge.openapi.json`, `aurasprout-management.openapi.json`) and JSON Schemas (`app.manifest.schema.json`, `catalog.schema.json`, `lease-collaboration.schema.json`).
+- **`auragrid-py`**: Typed Python SDK consumed by `LocalOnly`, `CellSingleton`, and `Distributed` MAS workloads.
+- **`auraseed`**: Strictly Python discovery & sovereign virtual environment (`mvenv`) management (`aurasprout` composes `auraseed.gui.MvenvManagerPanel`).
+- **`aurasprout`**: Application cataloging & packaging (`.apkg`), HTTP catalog hosting/push, user-space installation/updates/rollback (`active_version.json` + preserved `app_data/`), cleanroom standalone self-install/cleanup, SMB-safe SQLite event bus (`PRAGMA journal_mode = TRUNCATE`), atomic directory mutex & fenced leases/batches (`SproutMutex`), Tier 2 loopback IPC bridge (`X-AuraGrid-IPC-Token`), Tier 3 loopback Management Web UI (`aurasprout_session` + `X-CSRF-Token`), and Tkinter Desktop Hub.
+
+## Quick Start
+
+Both `aurasprout` (installed console script / standalone launcher) and `python -m aurasprout` expose the full CLI (supporting global `--cell-root` and `--user-root` flags):
+
+```powershell
+# Install AuraSprout standalone into %LOCALAPPDATA%\AuraSprout\standalone
+python -m aurasprout self-install --add-to-path --shortcut --json
+
+# Package & publish an app to a static zero-CDN catalog (supports --wheelhouse, --format zip|tar.gz)
+aurasprout package .\my_app --out .\dist --publish .\catalog --channel stable --json
+
+# Push an .apkg or source directory to a running AuraSprout HTTP server
+aurasprout catalog push .\dist\my-app-1.0.0.apkg --server http://127.0.0.1:8765 --token-file ui_daemon.json --json
+
+# Install locally from directory, .apkg, or HTTP/FS catalog (user-space only, zero admin privileges)
+aurasprout install my-app --from-catalog http://127.0.0.1:8765/catalog --channel stable --shortcut --json
+
+# Manage catalog entries & attached sources
+aurasprout catalog list --installed --json
+aurasprout catalog sources --json
+aurasprout catalog add-source https://example.internal/catalog --default
+aurasprout catalog remove-source https://example.internal/catalog
+aurasprout catalog delete my-app --json
+
+# Rollback, uninstall, or clean up user state completely
+aurasprout rollback my-app --json
+aurasprout uninstall my-app --remove-mvenv --json
+aurasprout self-uninstall --yes --json
+
+# Inspect or opt in to cell volunteering (opt-in default: false) & resolve conflicts
+aurasprout volunteer status --json
+aurasprout volunteer enable my-service --mode CellSingleton --json
+aurasprout volunteer disable my-service --json
+aurasprout conflicts list --json
+aurasprout conflicts resolve <conflictId> TakeOverStaleLock --json
+
+# Start Tier 3 loopback Management Web UI (plus /catalog hosting), Tier 2 IPC bridge, or Desktop Hub
+aurasprout ui --port 8765 --token-file ui_daemon.json --json
+aurasprout ipc --port 8766
+aurasprout desktop
+```
+
+## HTTP Endpoints & Storage
+
+- **Tier 3 Management UI & Hosted Catalog (`aurasprout ui`)**:
+  - Public: `GET /`, `GET /api/health`, `GET /api/v1/health`, `GET /catalog/`, `GET /catalog/index.html`, `GET /catalog/catalog.json`, `GET /catalog/apps/<path>`, `GET /catalog/channels/<path>`.
+  - Auth & CSRF (`POST /api/v1/auth/session`): `/api/v1/apps`, `/api/v1/apps/install`, `/api/v1/apps/{appId}`, `/api/v1/apps/{appId}/launch`, `/api/v1/catalog`, `/api/v1/catalog/sources`, `POST /api/v1/catalog/publish` (binary/multipart/base64/path), `/api/v1/catalog/apps/{appId}/download`, `/api/v1/volunteer*`, `/api/v1/conflicts*`, `/api/v1/runtimes`.
+- **Tier 2 IPC Bridge (`aurasprout ipc`)**: Loopback `X-AuraGrid-IPC-Token` endpoints under `/health`, `/ready`, `/cell/config*`, `/cell/members*`, `/cell/governance*`, `/cell/events*`, `/cell/lease*`, `/cell/collaboration*`, `/cell/registry*`, `/cell/storage*`, `/cell/tattle`, and `/cell/chaos*`.
+- **User Data Roots**: Resolved via `AURASPROUT_HOME` -> `%LOCALAPPDATA%\AuraSprout` (Windows), `~/Library/Application Support/aurasprout` (macOS), or `$XDG_DATA_HOME/aurasprout` / `~/.local/share/aurasprout` (Linux).
+- **Environment Variables**: `AURASPROUT_HOME`, `AURASPROUT_CELL_ROOT`, `AURAGRID_CELL_ROOT`, `AURASPROUT_STANDALONE_DIR`, `AURASPROUT_UI_HOST`, `AURASPROUT_UI_PORT`, `AURASPROUT_UI_TOKEN`, `AURASPROUT_DEFAULT_CATALOG`, `AURAGRID_IPC_TOKEN`, `AURAGRID_NODE_ID`.

aurasprout-0.1.1/pyproject.toml

@@ -0,0 +1,31 @@
+[build-system]
+requires = ["setuptools>=61.0"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "aurasprout"
+version = "0.1.1"
+description = "User-space zero-privilege AuraGrid cell coordination, application catalog, installer, and supervision layer."
+readme = "README.md"
+requires-python = ">=3.10"
+dependencies = [
+    "auraseed>=1.1.0",
+    "auragrid>=4.3.0",
+    "pydantic>=2.0.0",
+    "httpx>=0.25.0",
+]
+
+[project.scripts]
+aurasprout = "aurasprout.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+include = ["aurasprout*"]
+
+[tool.setuptools.package-data]
+aurasprout = ["ui/static/*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+pythonpath = ["src"]
+

aurasprout-0.1.1/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

aurasprout-0.1.1/src/aurasprout/__init__.py

@@ -0,0 +1,4 @@
+"""AuraSprout canonical package."""
+
+__version__ = "0.1.1"
+

aurasprout-0.1.1/src/aurasprout/__main__.py

@@ -0,0 +1,8 @@
+"""AuraSprout main entrypoint wrapper."""
+
+import sys
+from aurasprout.cli import main
+
+if __name__ == "__main__":
+    sys.exit(main())
+

aurasprout-0.1.1/src/aurasprout/catalog/__init__.py

@@ -0,0 +1,2 @@
+"""Merged Application Catalog & Distribution Engine for AuraSprout."""
+

aurasprout-0.1.1/src/aurasprout/catalog/crypto.py

@@ -0,0 +1,101 @@
+"""Cryptographic SHA-256 verification and traversal-safe archive extraction."""
+
+from __future__ import annotations
+
+import hashlib
+import stat
+import tarfile
+import zipfile
+from pathlib import Path
+from typing import List
+
+from aurasprout.contracts.paths import validate_within_root
+
+
+def compute_sha256_bytes(data: bytes) -> str:
+    return hashlib.sha256(data).hexdigest()
+
+
+def compute_sha256(file_path: Path) -> str:
+    target = Path(file_path).resolve()
+    h = hashlib.sha256()
+    with open(target, "rb") as handle:
+        while True:
+            chunk = handle.read(65536)
+            if not chunk:
+                break
+            h.update(chunk)
+    return h.hexdigest()
+
+
+def verify_sha256(file_path: Path, expected_sha256: str) -> str:
+    """Compute SHA-256 of ``file_path`` and raise ValueError on mismatch."""
+    expected = (expected_sha256 or "").strip().lower()
+    if len(expected) != 64:
+        raise ValueError(f"Invalid SHA-256 checksum format: {expected_sha256!r}")
+    actual = compute_sha256(file_path).lower()
+    if actual != expected:
+        raise ValueError(f"SHA-256 mismatch for {file_path}: expected {expected}, got {actual}")
+    return actual
+
+
+def _validate_archive_member_name(name: str) -> None:
+    if not name or "\x00" in name:
+        raise ValueError(f"Invalid archive member name: {name!r}")
+    normalized = name.replace("\\", "/")
+    if normalized.startswith("/") or (len(normalized) >= 2 and normalized[1] == ":"):
+        raise ValueError(f"Absolute member path rejected in archive: {name!r}")
+    parts = [p for p in normalized.split("/") if p]
+    if ".." in parts:
+        raise ValueError(f"Path traversal member rejected in archive: {name!r}")
+
+
+def extract_archive_safely(archive_path: Path, dest_dir: Path) -> List[Path]:
+    """Safely extract a `.apkg` / `.zip` / `.tar.gz` archive into ``dest_dir``.
+
+    Rejects Zip-Slip, Tar-Slip (`..`, rooted paths, Windows drive letters),
+    symlinks, hardlinks, and device nodes BEFORE writing any files to ``dest_dir``.
+    """
+    src = Path(archive_path).resolve()
+    dst = Path(dest_dir).resolve()
+    dst.mkdir(parents=True, exist_ok=True)
+    extracted: List[Path] = []
+
+    if zipfile.is_zipfile(src):
+        with zipfile.ZipFile(src, "r") as zf:
+            members = zf.infolist()
+            for info in members:
+                _validate_archive_member_name(info.filename)
+                mode = (info.external_attr >> 16) & 0o170000
+                if stat.S_ISLNK(mode):
+                    raise ValueError(f"ZIP symlink member rejected: {info.filename!r}")
+                validate_within_root(dst, info.filename)
+
+            for info in members:
+                target = validate_within_root(dst, info.filename)
+                if info.is_dir():
+                    target.mkdir(parents=True, exist_ok=True)
+                else:
+                    target.parent.mkdir(parents=True, exist_ok=True)
+                    with zf.open(info, "r") as reader, open(target, "wb") as writer:
+                        writer.write(reader.read())
+                    extracted.append(target)
+        return extracted
+
+    if tarfile.is_tarfile(src):
+        with tarfile.open(src, "r:*") as tf:
+            members = tf.getmembers()
+            for member in members:
+                _validate_archive_member_name(member.name)
+                if member.issym() or member.islnk() or member.isdev() or member.isfifo():
+                    raise ValueError(f"Unsafe tar member type rejected: {member.name!r}")
+                validate_within_root(dst, member.name)
+
+            tf.extractall(path=dst, members=members, filter="data")
+            for member in members:
+                if member.isfile():
+                    extracted.append(validate_within_root(dst, member.name))
+        return extracted
+
+    raise ValueError(f"Unsupported package archive format: {src}")
+

aurasprout-0.1.1/src/aurasprout/catalog/html_generator.py

@@ -0,0 +1,202 @@
+"""Zero-CDN self-contained static HTML5 Application Catalog Portal generator."""
+
+from __future__ import annotations
+
+import html
+import json
+from typing import Optional
+
+from aurasprout.catalog.models import CatalogManifest
+
+
+def generate_catalog_html(manifest: CatalogManifest, catalog_url: Optional[str] = None) -> str:
+    """Render a completely offline, zero-CDN HTML5 portal for a CatalogManifest."""
+    title = html.escape(manifest.catalog_name)
+    desc = html.escape(manifest.description or "Unified Zero-Privilege Application Catalog")
+    updated = html.escape(manifest.updated_at[:19].replace("T", " ") + " UTC")
+    effective_catalog_url = html.escape(catalog_url or manifest.base_url or "./catalog.json")
+
+    all_tags = sorted({tag for app in manifest.apps.values() for tag in app.tags})
+    cards_html = []
+    for app in sorted(manifest.apps.values(), key=lambda a: a.app_id):
+        v_info = app.get_version(app.latest_version)
+        v_str = html.escape(v_info.version if v_info else app.latest_version)
+        ch_str = html.escape(v_info.channel if v_info else app.channel)
+        app_disp = html.escape(app.display_name or app.name)
+        app_id_esc = html.escape(app.app_id)
+        desc_esc = html.escape(app.description or "No description provided.")
+        tags_html = " ".join(f'<span class="pill">{html.escape(t)}</span>' for t in app.tags)
+        sha_str = html.escape(v_info.bundle_sha256 if v_info else "")
+        sha_short = f"{sha_str[:16]}..." if sha_str else "none"
+        letter = html.escape((app.display_name or app.app_id)[:1].upper() or "A")
+        bundle_url = html.escape(
+            (v_info.bundle_url if v_info and v_info.bundle_url else f"apps/{app_id_esc}/{app_id_esc}-{v_str}.apkg")
+        )
+        ver_options = "".join(
+            f'<option value="{html.escape(ver_k)}">v{html.escape(ver_k)} ({html.escape(ver_obj.channel)})</option>'
+            for ver_k, ver_obj in sorted(app.versions.items(), reverse=True)
+        )
+
+        cards_html.append(
+            f"""
+        <div class="app-card" data-app-id="{app_id_esc}" data-channel="{ch_str}">
+          <div>
+            <div class="card-header">
+              <div class="app-avatar">{letter}</div>
+              <div class="header-text">
+                <div class="app-title" title="{app_disp}">{app_disp}</div>
+                <div class="app-meta">
+                  <span class="app-slug">{app_id_esc}</span>
+                  <span class="version-badge">v{v_str}</span>
+                  <span class="channel-badge">{ch_str}</span>
+                </div>
+              </div>
+            </div>
+            <p class="app-desc">{desc_esc}</p>
+            <div class="tags-list">{tags_html}</div>
+          </div>
+          <div class="card-actions">
+            <select class="ver-select" aria-label="Available versions">{ver_options}</select>
+            <div class="checksum-bar" title="SHA-256: {sha_str}">
+              <span>SHA-256:</span>
+              <span class="checksum-hash">{sha_short}</span>
+              <button class="copy-btn" type="button" onclick="copyText('{sha_str}', this)">Copy</button>
+            </div>
+            <div class="buttons-row">
+              <button class="btn-install" type="button" onclick="openInstallModal('{app_id_esc}', '{v_str}')">
+                Install CLI Command
+              </button>
+              <a href="{bundle_url}" class="btn-download" download>Download .apkg</a>
+            </div>
+          </div>
+        </div>"""
+        )
+
+    tag_buttons = '<button class="tag-btn active" type="button" data-tag="all">All</button>\n' + "\n".join(
+        f'<button class="tag-btn" type="button" data-tag="{html.escape(t)}">{html.escape(t)}</button>'
+        for t in all_tags
+    )
+    manifest_json_escaped = json.dumps(manifest.to_dict()).replace("</script>", "<\\/script>")
+    rendered_cards = "\n".join(cards_html) or "<p class='empty'>No applications published yet.</p>"
+
+    return f"""<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>{title}</title>
+  <style>
+    :root {{
+      --bg: #0d1117;
+      --card-bg: #161b22;
+      --card-border: #30363d;
+      --text: #e6edf3;
+      --muted: #8b949e;
+      --accent: #58a6ff;
+      --green: #238636;
+      --font: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
+    }}
+    * {{ box-sizing: border-box; margin: 0; padding: 0; }}
+    body {{ font-family: var(--font); background: var(--bg); color: var(--text); padding: 1.5rem; }}
+    header {{ max-width: 1200px; margin: 0 auto 1.5rem auto; border-bottom: 1px solid var(--card-border); padding-bottom: 1rem; }}
+    h1 {{ font-size: 1.75rem; margin-bottom: 0.25rem; }}
+    .sub {{ color: var(--muted); font-size: 0.9rem; }}
+    .controls {{ max-width: 1200px; margin: 0 auto 1.25rem auto; display: flex; gap: 0.75rem; flex-wrap: wrap; align-items: center; }}
+    input, select {{ background: var(--card-bg); color: var(--text); border: 1px solid var(--card-border); border-radius: 6px; padding: 0.45rem 0.75rem; }}
+    .tags-bar {{ display: flex; gap: 0.4rem; flex-wrap: wrap; }}
+    .tag-btn {{ background: var(--card-bg); color: var(--text); border: 1px solid var(--card-border); border-radius: 999px; padding: 0.3rem 0.75rem; cursor: pointer; }}
+    .tag-btn.active {{ border-color: var(--accent); color: var(--accent); }}
+    .grid {{ max-width: 1200px; margin: 0 auto; display: grid; grid-template-columns: repeat(auto-fill, minmax(300px, 1fr)); gap: 1rem; }}
+    .app-card {{ background: var(--card-bg); border: 1px solid var(--card-border); border-radius: 10px; padding: 1rem; display: flex; flex-direction: column; justify-content: space-between; gap: 0.85rem; }}
+    .card-header {{ display: flex; align-items: center; gap: 0.75rem; }}
+    .app-avatar {{ width: 38px; height: 38px; border-radius: 8px; background: #1f6feb; display: grid; place-items: center; font-weight: 700; }}
+    .app-title {{ font-weight: 600; font-size: 1.05rem; }}
+    .app-meta {{ font-size: 0.8rem; color: var(--muted); display: flex; gap: 0.4rem; margin-top: 0.15rem; }}
+    .version-badge, .channel-badge, .pill {{ background: #21262d; padding: 0.1rem 0.45rem; border-radius: 6px; font-size: 0.75rem; }}
+    .app-desc {{ color: var(--muted); font-size: 0.88rem; margin-top: 0.6rem; }}
+    .tags-list {{ display: flex; gap: 0.3rem; flex-wrap: wrap; margin-top: 0.5rem; }}
+    .checksum-bar {{ font-size: 0.75rem; color: var(--muted); display: flex; align-items: center; justify-content: space-between; margin: 0.4rem 0; }}
+    .copy-btn {{ background: #21262d; color: var(--text); border: 1px solid var(--card-border); border-radius: 5px; padding: 0.15rem 0.45rem; cursor: pointer; }}
+    .buttons-row {{ display: flex; gap: 0.5rem; }}
+    .btn-install {{ flex: 1; background: var(--green); color: #fff; border: none; border-radius: 6px; padding: 0.45rem; cursor: pointer; font-weight: 600; }}
+    .btn-download {{ background: #21262d; color: var(--text); border: 1px solid var(--card-border); border-radius: 6px; padding: 0.45rem 0.75rem; text-decoration: none; font-size: 0.85rem; }}
+    .modal {{ position: fixed; inset: 0; background: rgba(0, 0, 0, 0.7); display: none; align-items: center; justify-content: center; }}
+    .modal-box {{ background: var(--card-bg); border: 1px solid var(--card-border); border-radius: 10px; max-width: 600px; width: 92%; padding: 1.25rem; }}
+    pre {{ background: #0d1117; border: 1px solid var(--card-border); padding: 0.75rem; border-radius: 6px; overflow-x: auto; margin: 0.75rem 0; }}
+  </style>
+</head>
+<body>
+  <header>
+    <h1>{title}</h1>
+    <p class="sub">{desc} | Updated: {updated} | Apps: {len(manifest.apps)}</p>
+  </header>
+  <div class="controls">
+    <input id="search-input" type="search" placeholder="Filter applications...">
+    <select id="channel-filter">
+      <option value="all">All channels</option>
+      <option value="stable">stable</option>
+      <option value="preview">preview</option>
+      <option value="canary">canary</option>
+      <option value="nightly">nightly</option>
+    </select>
+    <div class="tags-bar">{tag_buttons}</div>
+  </div>
+  <div id="app-grid" class="grid">{rendered_cards}</div>
+  <div id="install-modal" class="modal">
+    <div class="modal-box">
+      <h2 id="modal-app-title">Deploy Application</h2>
+      <pre id="modal-code"></pre>
+      <button id="modal-copy-btn" class="btn-install" type="button" onclick="copyModalCode()">Copy Command</button>
+      <button class="copy-btn" type="button" onclick="closeModal()">Close</button>
+    </div>
+  </div>
+  <script>
+    const CATALOG_URL = {json.dumps(effective_catalog_url)};
+    const MANIFEST = {manifest_json_escaped};
+    let activeTag = "all";
+    function filterCards() {{
+      const q = (document.getElementById("search-input").value || "").toLowerCase();
+      const ch = document.getElementById("channel-filter").value;
+      document.querySelectorAll(".app-card").forEach((card) => {{
+        const appId = card.dataset.appId;
+        const entry = (MANIFEST.apps || {{}})[appId] || {{}};
+        const text = (appId + " " + (entry.displayName || "") + " " + (entry.description || "")).toLowerCase();
+        const tags = entry.tags || [];
+        const matchQ = !q || text.includes(q);
+        const matchCh = ch === "all" || card.dataset.channel === ch;
+        const matchTag = activeTag === "all" || tags.includes(activeTag);
+        card.style.display = (matchQ && matchCh && matchTag) ? "flex" : "none";
+      }});
+    }}
+    document.getElementById("search-input").addEventListener("input", filterCards);
+    document.getElementById("channel-filter").addEventListener("change", filterCards);
+    document.querySelectorAll(".tag-btn").forEach((btn) => {{
+      btn.addEventListener("click", () => {{
+        document.querySelectorAll(".tag-btn").forEach((b) => b.classList.remove("active"));
+        btn.classList.add("active");
+        activeTag = btn.dataset.tag;
+        filterCards();
+      }});
+    }});
+    function copyText(text, btn) {{
+      if (navigator.clipboard) navigator.clipboard.writeText(text);
+      const orig = btn.textContent;
+      btn.textContent = "Copied";
+      setTimeout(() => {{ btn.textContent = orig; }}, 1200);
+    }}
+    function openInstallModal(appId, version) {{
+      document.getElementById("modal-app-title").textContent = "Install " + appId + " v" + version;
+      document.getElementById("modal-code").textContent =
+        'aurasprout install ' + appId + ' --version ' + version + ' --from-catalog "' + CATALOG_URL + '"';
+      document.getElementById("install-modal").style.display = "flex";
+    }}
+    function closeModal() {{ document.getElementById("install-modal").style.display = "none"; }}
+    function copyModalCode() {{
+      const code = document.getElementById("modal-code").textContent;
+      copyText(code, document.getElementById("modal-copy-btn"));
+    }}
+  </script>
+</body>
+</html>
+"""
+