taOS App Runtime — package format, installer, agent tool registry

[jaylfc]

Summary

Build a proper app packaging, installation, and runtime system for taOS. Apps are independently packaged as .taosapp archives containing frontend bundles, backend modules, and agent tool declarations.

Key features

• .taosapp package format — zip with manifest.yaml, agent.yaml, bundle.js, optional backend Python module, icon
• Three app types — native (in-process JS+Python), container (Docker/LXC), web (iframe)
• Agent tool declarations — every app declares MCP-style tools in agent.yaml, agents discover all installed tools automatically
• Installation flow — download from URL → extract → register routes → register agent tools → appears in Launchpad
• Tiered isolation — native trusted in-process, containers fully isolated, web apps iframe-sandboxed
• Permissions system — apps declare needed permissions (advisory enforcement v1)
• Store sections — "by taOS" (first-party) and "for taOS" (community/third-party)

Migration

Extract existing platform apps (Reddit, YouTube, GitHub, X, Browsers) into .taosapp packages. Core apps remain built-in.

Spec

docs/superpowers/specs/2026-04-12-app-runtime-design.md

Supersedes

#194 (Dynamic app registry)

Related

• App Builder System — LLM-driven app creation sandbox #184 (App Builder System)
• Unified task registry — all scheduled jobs visible in Tasks app #193 (Unified task registry)