luajitos

Run.lua (92310B)

---

 #!/usr/bin/env luajit
 -- Application Runner Module
 -- Handles running applications with sandboxing, permissions, and CLI buffer management
 
 -- Test if osprint is available when module loads
 if osprint then
     osprint("RUN MODULE LOADED: osprint is available!\n")
 end
 
 local run = {}
 
 -- Apps are registered in _G.sys.applications (maintained by Sys.lua)
 -- This provides a unified way to access running apps across the system
 local function get_app_registry()
     return (_G.sys and _G.sys.applications) or {}
 end
 
 -- Scheduler instance (loaded on demand)
 local scheduler = nil
 
 -- Utility functions that are needed for run functionality
 
 -- Utility: Split string by delimiter
 local function split(str, delimiter)
     local result = {}
     local pattern = string.format("([^%s]+)", delimiter)
     for match in string.gmatch(str, pattern) do
         table.insert(result, match)
     end
     return result
 end
 
 -- Utility: Parse command line arguments
 local function parse_args(argStr)
     if not argStr or argStr == "" then
         return { str = "" }
     end
 
     local args = { str = argStr }
     local current = ""
     local in_quote = false
     local raw_args = {}
 
     -- First pass: split into tokens
     for i = 1, #argStr do
         local c = argStr:sub(i, i)
         if c == '"' then
             in_quote = not in_quote
         elseif c == ' ' and not in_quote then
             if current ~= "" then
                 table.insert(raw_args, current)
                 current = ""
             end
         else
             current = current .. c
         end
     end
 
     if current ~= "" then
         table.insert(raw_args, current)
     end
 
     -- Second pass: parse flags and populate args table
     local i = 1
     local positional_index = 1
     while i <= #raw_args do
         local arg = raw_args[i]
 
         -- Check if it's a flag (-X or --X)
         local flag_name = nil
         if arg:match("^%-%-(.+)") then
             -- Long flag: --name
             flag_name = arg:match("^%-%-(.+)")
         elseif arg:match("^%-(.+)") then
             -- Short flag: -n
             flag_name = arg:match("^%-(.+)")
         end
 
         if flag_name then
             -- It's a flag - check if it's "str" or a number (reserved names)
             if flag_name ~= "str" and not tonumber(flag_name) then
                 -- Get the next value if it exists and isn't another flag
                 if i + 1 <= #raw_args and not raw_args[i + 1]:match("^%-") then
                     args[flag_name] = raw_args[i + 1]
                     i = i + 1  -- Skip the value in next iteration
                 else
                     -- Flag without value, set to true
                     args[flag_name] = true
                 end
             end
         else
             -- Not a flag, add as positional argument
             args[positional_index] = arg
             positional_index = positional_index + 1
         end
 
         i = i + 1
     end
 
     return args
 end
 
 -- Utility: Deep copy a table
 local function deep_copy(obj)
     if type(obj) ~= 'table' then
         return obj
     end
 
     local copy = {}
     for k, v in pairs(obj) do
         copy[k] = deep_copy(v)
     end
 
     return copy
 end
 
 -- Utility: Parse manifest (simple Lua code execution)
 -- Parse manifest content as text (no Lua execution for security)
 local function parse_manifest(manifest_code)
     if not manifest_code then
         return {}
     end
 
     -- Remove "return" if present at start
     manifest_code = string.gsub(manifest_code, "^%s*return%s*", "")
 
     -- Remove outer braces only if both opening and closing exist as a pair
     local trimmed = string.gsub(manifest_code, "^%s+", "")
     trimmed = string.gsub(trimmed, "%s+$", "")
     if string.sub(trimmed, 1, 1) == "{" and string.sub(trimmed, -1) == "}" then
         manifest_code = string.sub(trimmed, 2, -2)
     end
 
     -- Extract [[long strings]] before removing comments (to preserve their content)
     local long_strings = {}
     local placeholder_idx = 0
     manifest_code = string.gsub(manifest_code, "%[%[(.-)%]%]", function(content)
         placeholder_idx = placeholder_idx + 1
         local placeholder = "\001LONGSTR" .. placeholder_idx .. "\001"
         long_strings[placeholder] = content
         return placeholder
     end)
 
     -- Remove single-line comments (-- to end of line)
     manifest_code = string.gsub(manifest_code, "%-%-[^\n]*", "")
 
     -- Normalize whitespace: replace newlines/tabs with spaces, collapse multiple spaces
     manifest_code = string.gsub(manifest_code, "[\r\n\t]+", " ")
     manifest_code = string.gsub(manifest_code, " +", " ")
 
     local manifest = {}
 
     -- Helper to parse array content (handles [[strings]] in arrays)
     local function parse_array_item(item)
         item = string.gsub(item, "^%s+", "")
         item = string.gsub(item, "%s+$", "")
         -- Check for long string placeholder
         if long_strings[item] then
             return long_strings[item]
         elseif string.match(item, '^".-"$') then
             return string.sub(item, 2, -2)
         elseif string.match(item, "^'.-'$") then
             return string.sub(item, 2, -2)
         elseif item ~= "" then
             return item
         end
         return nil
     end
 
     -- Match key = value pairs (handles arrays with spaces like { "a", "b" })
     -- Pattern: word = (value until next word= or end)
     local pos = 1
     while pos <= #manifest_code do
         -- Skip whitespace, commas, and semicolons
         local ws_end = string.match(manifest_code, "^[%s,;]*()", pos)
         if ws_end then pos = ws_end end
 
         -- Match key = value
         local key, value_start = string.match(manifest_code, "^([%w_]+)%s*=%s*()", pos)
         if not key then break end
 
         pos = value_start
 
         -- Determine value type and extract it
         local value
         local char = string.sub(manifest_code, pos, pos)
 
         if char == "{" then
             -- Array: find matching } by counting brace depth
             local depth = 1
             local brace_end = pos + 1
             while brace_end <= #manifest_code and depth > 0 do
                 local c = string.sub(manifest_code, brace_end, brace_end)
                 if c == "{" then
                     depth = depth + 1
                 elseif c == "}" then
                     depth = depth - 1
                 end
                 brace_end = brace_end + 1
             end
             brace_end = brace_end - 1  -- Point to the closing }
             if depth == 0 then
                 local arr_content = string.sub(manifest_code, pos + 1, brace_end - 1)
                 local arr = {}
                 for item in string.gmatch(arr_content, '[^,;]+') do
                     local parsed = parse_array_item(item)
                     if parsed then
                         table.insert(arr, parsed)
                     end
                 end
                 value = arr
                 pos = brace_end + 1
             else
                 break
             end
         elseif char == "\001" then
             -- Long string placeholder
             local placeholder = string.match(manifest_code, "^(\001LONGSTR%d+\001)", pos)
             if placeholder and long_strings[placeholder] then
                 value = long_strings[placeholder]
                 pos = pos + #placeholder
             else
                 break
             end
         elseif char == '"' then
             -- Double-quoted string
             local str_end = string.find(manifest_code, '"', pos + 1, true)
             if str_end then
                 value = string.sub(manifest_code, pos + 1, str_end - 1)
                 pos = str_end + 1
             else
                 break
             end
         elseif char == "'" then
             -- Single-quoted string
             local str_end = string.find(manifest_code, "'", pos + 1, true)
             if str_end then
                 value = string.sub(manifest_code, pos + 1, str_end - 1)
                 pos = str_end + 1
             else
                 break
             end
         else
             -- Unquoted value (boolean, number, or identifier)
             local val_str = string.match(manifest_code, "^([^%s,;}]+)", pos)
             if val_str then
                 if val_str == "true" then
                     value = true
                 elseif val_str == "false" then
                     value = false
                 elseif tonumber(val_str) then
                     value = tonumber(val_str)
                 else
                     value = val_str
                 end
                 pos = pos + #val_str
             else
                 break
             end
         end
 
         if key and value ~= nil then
             manifest[key] = value
         end
     end
 
     return manifest
 end
 
 -- Utility: Check if directory exists
 local function dir_exists(path)
     local ok, err, code = os.rename(path, path)
     if not ok then
         if code == 13 then
             return true  -- Permission denied, but exists
         end
     end
     return ok
 end
 
 -- Utility: Read file content
 local function read_file(filepath)
     local file = io.open(filepath, "rb")
     if not file then
         return nil
     end
     local content = file:read("*all")
     file:close()
     return content
 end
 
 -- Helper function to read from ramdisk
 local function read_from_ramdisk(fsRoot, filepath)
     if not fsRoot then
         -- Use CRamdisk functions when no fsRoot available
         if CRamdiskOpen and CRamdiskRead and CRamdiskClose then
             local handle = CRamdiskOpen(filepath, "r")
             if handle then
                 local content = CRamdiskRead(handle)
                 CRamdiskClose(handle)
                 return content
             end
         end
         -- Fallback to regular file reading
         return read_file(filepath)
     end
 
     -- Try fsRoot:traverse first (works with Lua ramdisk implementation)
     local node = fsRoot:traverse(filepath)
     if node and node.type == "file" then
         return node.content
     end
 
     -- Fallback to CRamdiskRead if available (C ramdisk API)
     if CRamdiskRead then
         -- Strip leading slash for CRamdiskRead
         local path = filepath
         if path:sub(1,1) == "/" then
             path = path:sub(2)
         end
         local result = CRamdiskRead(path)
         return result
     end
 
     return nil
 end
 
 -- Find installed apps by name
 local function find_apps(app_name, fsRoot)
     local apps_dir = "/apps"
     local matches = {}
 
     -- Always use CRamdisk functions for finding apps (more reliable than SafeFS)
     if osprint then
         osprint("[find_apps] Looking for '" .. app_name .. "' in " .. apps_dir .. "\n")
     end
 
     -- Check if direct match (com.dev.appname or com.*.appname)
     if string.match(app_name, "^com%.") then
         local app_path = apps_dir .. "/" .. app_name
         -- Use CRamdiskExists to check if directory exists
         if CRamdiskExists and CRamdiskExists(app_path) then
             if osprint then
                 osprint("[find_apps] Direct match found: " .. app_name .. "\n")
             end
             table.insert(matches, app_name)
         end
         return matches
     end
 
     -- Search for matches using CRamdiskList
     if CRamdiskList then
         if osprint then
             osprint("[find_apps] Using CRamdiskList to search...\n")
         end
         local entries = CRamdiskList(apps_dir)
         if entries then
             if osprint then
                 osprint("[find_apps] Found " .. #entries .. " entries in " .. apps_dir .. "\n")
             end
             for _, entry in ipairs(entries) do
                 if osprint then
                     osprint("[find_apps]   Entry: '" .. entry.name .. "' type=" .. entry.type .. "\n")
                 end
                 local pattern = "%." .. app_name .. "$"
                 if osprint then
                     osprint("[find_apps]   Testing pattern: '" .. pattern .. "' against '" .. entry.name .. "'\n")
                 end
                 if (entry.type == "directory" or entry.type == "dir") and string.match(entry.name, pattern) then
                     if osprint then
                         osprint("[find_apps]   MATCH: " .. entry.name .. "\n")
                     end
                     table.insert(matches, entry.name)
                 end
             end
         else
             if osprint then
                 osprint("[find_apps] CRamdiskList returned nil\n")
             end
         end
     else
         if osprint then
             osprint("[find_apps] CRamdiskList not available\n")
         end
     end
 
     if osprint then
         osprint("[find_apps] Total matches: " .. #matches .. "\n")
     end
 
     return matches
 end
 
 -- Extract embedded manifest from Lua script
 -- Looks for comment block between ----- MANIFEST START and ----- MANIFEST END
 -- Returns manifest table or nil if not found
 local function extract_embedded_manifest(script_content)
     if not script_content then
         return nil
     end
 
     -- Look for --[[ MANIFEST ... --]] block comment format
     local manifest_block = string.match(script_content, "%-%-%[%[%s*MANIFEST%s*(.-)%-%-%]%]")
 
     if not manifest_block then
         return nil
     end
 
     -- Reuse parse_manifest which handles multi-line arrays and text-based parsing
     local manifest = parse_manifest(manifest_block)
 
     -- Return nil if manifest is empty
     local has_keys = false
     for _ in pairs(manifest) do
         has_keys = true
         break
     end
 
     return has_keys and manifest or nil
 end
 
 -- Run an installed app with sandboxing
 function run.execute(app_name, fsRoot)
     -- Use osprint directly in run code (global print doesn't work in bare metal)
     local run_print = osprint or print
 
     if osprint then
         osprint("[RUN.EXECUTE] Called with app_name='" .. tostring(app_name) .. "' fsRoot=" .. tostring(fsRoot) .. "\n")
     end
 
     -- Utility functions are now defined locally in this module (no LPM dependency)
 
     -- Check if this is a direct .lua file execution
     local is_lua_script = string.match(app_name, "%.lua$") ~= nil
     local selected_app, init_content, init_file, app_dir, data_dir
     local permissions = {}
     local manifest = {}
     local app_instance = nil
 
     if is_lua_script then
         -- Direct .lua file execution
         run_print("Running Lua script: " .. app_name .. "\n")
 
         -- If script name has no path separator, look in /scripts/
         if not string.match(app_name, "/") then
             init_file = "/scripts/" .. app_name
             run_print("Looking for script in: " .. init_file .. "\n")
         else
             init_file = app_name
         end
 
         -- Read the script file
         init_content = read_from_ramdisk(fsRoot, init_file)
 
         if not init_content then
             local err_msg = "Script file not found: " .. init_file
             run_print("Error: " .. err_msg .. "\n")
             return false, err_msg
         end
 
         -- Extract embedded manifest
         local extracted_manifest = extract_embedded_manifest(init_content)
 
         if extracted_manifest then
             manifest = extracted_manifest
             run_print("Found embedded manifest\n")
 
             -- Parse permissions from embedded manifest
             if manifest.permission then
                 if type(manifest.permission) == "table" then
                     for _, perm in ipairs(manifest.permission) do
                         if type(perm) == "string" then
                             table.insert(permissions, perm)
                         end
                     end
                 end
             elseif manifest.permissions then
                 if type(manifest.permissions) == "table" then
                     for _, perm in ipairs(manifest.permissions) do
                         if type(perm) == "string" then
                             table.insert(permissions, perm)
                         end
                     end
                 end
             end
         else
             run_print("No embedded manifest found, running with no permissions\n")
             manifest = {}  -- Ensure manifest is an empty table, not nil
         end
 
         -- For standalone scripts, use a simple app name based on the file path
         selected_app = string.gsub(app_name, "%.lua$", "")
         selected_app = string.gsub(selected_app, "^/", "")
         selected_app = string.gsub(selected_app, "/", ".")
 
         -- Create a hash of the script path for consistent proc directory
         local script_hash = 0
         for i = 1, #init_file do
             script_hash = (script_hash * 31 + string.byte(init_file, i)) % 0x7FFFFFFF
         end
 
         -- Use /proc/script_<hash> as the data directory
         app_dir = "/proc/script_" .. string.format("%08x", script_hash)
         data_dir = app_dir
 
     else
         -- Standard app execution from /apps directory
         local matches = find_apps(app_name, fsRoot)
 
         if #matches == 0 then
             local err_msg = "No app found matching '" .. app_name .. "'"
             run_print("Error: " .. err_msg .. "\n")
             return false, err_msg
         end
 
         if #matches > 1 then
             run_print("Multiple apps found:\n")
             for i, app in ipairs(matches) do
                 run_print(i .. ": " .. app .. "\n")
             end
             run_print("Enter selection (1-" .. #matches .. "): \n")
             local choice = tonumber(io.read())
 
             if not choice or choice < 1 or choice > #matches then
                 local err_msg = "Invalid selection"
                 run_print(err_msg .. "\n")
                 return false, err_msg
             end
 
             selected_app = matches[choice]
         else
             selected_app = matches[1]
         end
 
         local apps_dir = "/apps"
         app_dir = apps_dir .. "/" .. selected_app
         data_dir = app_dir .. "/data"
         local manifest_file = app_dir .. "/manifest.lua"
 
         -- Read manifest to get permissions and entry point
         local manifest_content = read_from_ramdisk(fsRoot, manifest_file)
 
         local entry_point = "src/init.lua"  -- Default entry point
 
         if not manifest_content then
             run_print("Warning: manifest.lua not found in " .. manifest_file .. ", running with no permissions\n")
             -- Continue with empty permissions and manifest
         else
             manifest = parse_manifest(manifest_content)
 
             -- Parse permissions into array of strings
             if manifest.permissions then
                 if type(manifest.permissions) == "table" then
                     for _, perm in ipairs(manifest.permissions) do
                         if type(perm) == "string" then
                             table.insert(permissions, perm)
                         end
                     end
                 end
             end
 
             -- Get entry point from manifest (default to src/init.lua)
             -- Entry is always relative to $/src/
             if manifest.entry and type(manifest.entry) == "string" then
                 entry_point = "src/" .. manifest.entry
             end
         end
 
         run_print("Running: " .. selected_app .. "\n")
         run_print("Entry point: " .. entry_point .. "\n")
 
         -- Build full path to entry file
         init_file = app_dir .. "/" .. entry_point
 
         -- Check if entry file exists
         init_content = read_from_ramdisk(fsRoot, init_file)
         if not init_content then
             local err_msg = "Entry file not found: " .. init_file
             run_print("Error: " .. err_msg .. "\n")
             return false, err_msg
         end
     end
 
     -- Common code for both script and app execution
     run_print("Permissions: " .. table.concat(permissions, ", ") .. "\n")
 
     -- Create sandboxed environment
     local sandbox_env = {
         -- Basic Lua functions
         print = nil,  -- Will be set later after app_instance is created
         osprint = osprint,  -- Also expose osprint directly for explicit use
         tonumber = tonumber,
         tostring = tostring,
         type = type,
         pairs = pairs,
         ipairs = ipairs,
         next = next,
         select = select,
         assert = assert,
         error = error,
         pcall = pcall,
         xpcall = xpcall,
         setmetatable = setmetatable,
         getmetatable = getmetatable,
 
         -- Safe standard libraries
         string = string,
         table = table,
         math = math,
         bit = bit,  -- LuaJIT bit operations library
 
         -- Restricted os library (only safe functions)
         os = {
             date = os.date,
             time = os.time,
             difftime = os.difftime,
             clock = os.clock,
         },
 
         -- Pre-define optional items as nil so accessing them doesn't throw
         fs = nil,  -- SafeFS instance (set later if filesystem permission granted)
     }
 
     -- Add optional globals only if they exist (avoid nil values in sandbox)
     if _G.Dialog then
         sandbox_env.Dialog = _G.Dialog
     end
 
     -- Check for crypto permission and add crypto object
     local has_crypto = false
     for _, perm in ipairs(permissions) do
         if perm == "crypto" then
             has_crypto = true
             break
         end
     end
     if has_crypto and _G.crypto then
         sandbox_env.crypto = _G.crypto
         if osprint then
             osprint("Crypto permission granted - crypto object available\n")
         end
     end
 
     -- Check for system-all permission and add sys object
     local has_system_all = false
     for _, perm in ipairs(permissions) do
         if perm == "system-all" then
             has_system_all = true
             break
         end
     end
 
     -- Check for admin permission first
     local has_admin = false
     for _, perm in ipairs(permissions) do
         if perm == "admin" then
             has_admin = true
             break
         end
     end
 
     -- Check for system-hook permission
     local has_system_hook = false
     for _, perm in ipairs(permissions) do
         if perm == "system-hook" then
             has_system_hook = true
             break
         end
     end
 
     -- Check for system-apps permission
     local has_system_apps = false
     for _, perm in ipairs(permissions) do
         if perm == "system-apps" then
             has_system_apps = true
             break
         end
     end
 
     if has_system_all then
         -- Create a proxy for sys that:
         -- 1. Blocks hook unless system-hook permission
         -- 2. Exposes applications as 'apps' only if system-apps permission
         -- 3. Blocks direct access to 'applications'
         sandbox_env.sys = setmetatable({}, {
             __index = function(t, k)
                 if k == "hook" and not has_system_hook then
                     error("sys.hook requires 'system-hook' permission")
                 end
                 if k == "applications" then
                     error("sys.applications is not accessible, use sys.apps with 'system-apps' permission")
                 end
                 if k == "apps" then
                     if has_system_apps then
                         return _G.sys.applications
                     else
                         error("sys.apps requires 'system-apps' permission")
                     end
                 end
                 return _G.sys[k]
             end,
             __newindex = function(t, k, v)
                 if k == "hook" and not has_system_hook then
                     error("sys.hook requires 'system-hook' permission")
                 end
                 if k == "applications" or k == "apps" then
                     error("Cannot modify sys.apps")
                 end
                 _G.sys[k] = v
             end,
             __pairs = function(t)
                 return function(tbl, k)
                     local nextKey, nextValue = next(_G.sys, k)
                     -- Skip hook if no permission
                     if nextKey == "hook" and not has_system_hook then
                         nextKey, nextValue = next(_G.sys, nextKey)
                     end
                     -- Skip applications (exposed as apps)
                     if nextKey == "applications" then
                         nextKey, nextValue = next(_G.sys, nextKey)
                     end
                     return nextKey, nextValue
                 end, t, nil
             end,
             __ipairs = function(t)
                 return ipairs(_G.sys)
             end,
             __metatable = false  -- Prevent metatable access/modification
         })
         if osprint then
             osprint("System-all permission granted - sys object available\n")
             if has_system_hook then osprint("  - sys.hook available\n") end
             if has_system_apps then osprint("  - sys.apps available\n") end
         end
     end
 
     if has_admin then
         -- Create admin API object with restricted admin functions
         sandbox_env.ADMIN_AppAddPermission = _G.sys.ADMIN_AppAddPermission
         sandbox_env.ADMIN_AppAddPath = _G.sys.ADMIN_AppAddPath
         sandbox_env.ADMIN_StartPrompt = _G.sys.ADMIN_StartPrompt
         sandbox_env.ADMIN_FinishPrompt = _G.sys.ADMIN_FinishPrompt
         if osprint then
             osprint("Admin permission granted - admin functions available\n")
         end
     end
 
     -- Check for filesystem permission and setup SafeFS
     -- Also enable if manifest has allowedPaths (needs SafeFS for path access)
     local has_filesystem = false
     for _, perm in ipairs(permissions) do
         if perm == "filesystem" then
             has_filesystem = true
             break
         end
     end
     -- Enable SafeFS if manifest has allowedPaths defined
     if not has_filesystem and manifest and manifest.allowedPaths and #manifest.allowedPaths > 0 then
         has_filesystem = true
     end
 
     -- Load Application module (always load, not just for filesystem permission)
     local Application = nil
     local app_module_path = "/os/libs/Application.lua"
     local app_module_code = nil
 
     -- Try to load from fsRoot first, then fall back to CRamdisk
     if fsRoot then
         app_module_code = read_from_ramdisk(fsRoot, app_module_path)
     elseif CRamdiskOpen then
         -- Fall back to direct CRamdisk access when fsRoot is nil
         local handle = CRamdiskOpen(app_module_path, "r")
         if handle then
             app_module_code = CRamdiskRead(handle)
             CRamdiskClose(handle)
         end
     end
 
     if app_module_code then
         if osprint then
             osprint("[run] Application.lua loaded, size=" .. #app_module_code .. " bytes\n")
         end
 
         -- Initialize global sys table if it doesn't exist
         if not _G.sys then
                 _G.sys = {
                     used_pids = {},
                     fallback_pid = 1000,
                     app_timestamp = 0
                 }
             end
 
             -- Load Application module in a temporary environment
             local app_env = {
                 sys = _G.sys  -- Explicitly provide sys to Application.lua
             }
             setmetatable(app_env, {__index = _G, __metatable = false})
             local app_func, err = load(app_module_code, app_module_path, "t", app_env)
 
             if app_func then
                 local success, AppModule = pcall(app_func)
                 if success and AppModule then
                     Application = AppModule
                     if osprint then osprint("Application module loaded successfully!\n") end
                 else
                     if osprint then osprint("Warning: Failed to load Application module: " .. tostring(AppModule) .. "\n") end
                 end
             else
                 if osprint then osprint("Warning: Failed to compile Application module: " .. tostring(err) .. "\n") end
             end
     else
         if osprint then osprint("Warning: Application module not found at " .. app_module_path .. "\n") end
     end
 
     -- Create Application instance for this app
     if Application then
         if osprint then
             osprint("[run] Creating Application instance for " .. selected_app .. "\n")
         end
         app_instance = Application.new(app_dir, {
             name = selected_app
         })
         -- Set status to running
         app_instance:setStatus("running")
 
         -- Store permissions and allowed paths in app instance
         app_instance.permissions = permissions
         app_instance.allowedPaths = (manifest and manifest.allowedPaths) or {}
 
         -- Store manifest as read-only deep copy to prevent tampering
         local function deepCopyReadOnly(tbl)
             if type(tbl) ~= "table" then
                 return tbl
             end
 
             local copy = {}
             for k, v in pairs(tbl) do
                 copy[k] = deepCopyReadOnly(v)
             end
 
             -- Make table read-only with metatable
             return setmetatable({}, {
                 __index = copy,
                 __newindex = function()
                     error("Manifest is read-only and cannot be modified")
                 end,
                 __metatable = false  -- Hide metatable
             })
         end
 
         app_instance.manifest = manifest and deepCopyReadOnly(manifest) or {}
 
         -- Load application icon
         local iconLoaded = false
         local defaultIconPath = "/os/res/default.bmp"
 
         -- Try loading app-specific icon (PNG first, then JPEG, then BMP)
         local iconPaths = {
             app_dir .. "/icon.png",
             app_dir .. "/icon.jpg",
             app_dir .. "/icon.jpeg",
             app_dir .. "/icon.bmp"
         }
 
         for _, iconPath in ipairs(iconPaths) do
             if CRamdiskExists and CRamdiskExists(iconPath) then
                 local handle = CRamdiskOpen(iconPath, "r")
                 if handle then
                     local iconData = CRamdiskRead(handle)
                     CRamdiskClose(handle)
 
                     if iconData then
                         local img = nil
                         if iconPath:match("%.png$") and PNGLoad then
                             img = PNGLoad(iconData)
                         elseif (iconPath:match("%.jpg$") or iconPath:match("%.jpeg$")) and JPEGLoad then
                             img = JPEGLoad(iconData)
                         elseif iconPath:match("%.bmp$") and BMPLoad then
                             img = BMPLoad(iconData)
                         end
 
                         if img then
                             local info = ImageGetInfo and ImageGetInfo(img)
                             if info and info.width and info.height then
                                 app_instance.iconBuffer = img
                                 app_instance.iconWidth = info.width
                                 app_instance.iconHeight = info.height
                                 iconLoaded = true
                                 if osprint then
                                     osprint("[run] Loaded icon: " .. iconPath .. " (" .. info.width .. "x" .. info.height .. ")\n")
                                 end
                                 break
                             end
                         end
                     end
                 end
             end
         end
 
         -- Fall back to default icon if app icon not found
         if not iconLoaded and CRamdiskExists and CRamdiskExists(defaultIconPath) then
             local handle = CRamdiskOpen(defaultIconPath, "r")
             if handle then
                 local iconData = CRamdiskRead(handle)
                 CRamdiskClose(handle)
 
                 if iconData and BMPLoad then
                     local img = BMPLoad(iconData)
                     if img then
                         local info = ImageGetInfo and ImageGetInfo(img)
                         if info and info.width and info.height then
                             app_instance.iconBuffer = img
                             app_instance.iconWidth = info.width
                             app_instance.iconHeight = info.height
                             if osprint then
                                 osprint("[run] Loaded default icon for " .. selected_app .. "\n")
                             end
                         end
                     end
                 end
             end
         end
 
         -- Create /proc/$PID directory with process file
         if CRamdiskMkdir and CRamdiskWrite then
             local proc_dir = "/proc/" .. app_instance.pid
             local success, err = CRamdiskMkdir(proc_dir)
 
             if success or (err and err:match("already exists")) then
                 -- Create process file containing the app path
                 local process_file = proc_dir .. "/process"
                 local write_success = CRamdiskWrite(process_file, app_dir)
 
                 if write_success then
                     if osprint then
                         osprint("Created " .. process_file .. " -> " .. app_dir .. "\n")
                     end
                 else
                     if osprint then
                         osprint("WARNING: Failed to create " .. process_file .. "\n")
                     end
                 end
             else
                 if osprint then
                     osprint("WARNING: Failed to create " .. proc_dir .. ": " .. tostring(err) .. "\n")
                 end
             end
         end
 
         -- Register in sys.applications using PID as key
         if osprint then
             osprint("[run] Attempting to register app, _G.sys = " .. tostring(_G.sys) .. "\n")
             if _G.sys then
                 osprint("[run] _G.sys.registerApplication = " .. tostring(_G.sys.registerApplication) .. "\n")
             end
         end
 
         if _G.sys and _G.sys.registerApplication then
             if osprint then
                 osprint("[run] Calling _G.sys.registerApplication for PID " .. app_instance.pid .. "\n")
             end
             _G.sys.registerApplication(app_instance)
         else
             if osprint then
                 osprint("[run] ERROR: Cannot register app - sys or registerApplication missing!\n")
             end
         end
 
         -- Create a proxy for app that only exposes safe methods
         -- This prevents apps from directly modifying exports, windows, etc.
         local safe_app_methods = {
             "export", "call", "getExport", "listExports", "getInfo",
             "getExportCount", "getHelp", "printExports",
             "writeStdout", "getStdout", "clearStdout",
             "newWindow", "enterFullscreen", "exitFullscreen"
         }
         -- Also expose these read-only properties
         local safe_app_properties = {
             "appName", "pid", "startTime", "status", "path"
         }
         local app_proxy = {}
         for _, method in ipairs(safe_app_methods) do
             if app_instance[method] then
                 app_proxy[method] = function(self, ...)
                     return app_instance[method](app_instance, ...)
                 end
             end
         end
         setmetatable(app_proxy, {
             __index = function(t, k)
                 -- Allow read-only access to safe properties
                 for _, prop in ipairs(safe_app_properties) do
                     if k == prop then
                         return app_instance[k]
                     end
                 end
                 error("app." .. tostring(k) .. " is not accessible", 2)
             end,
             __newindex = function(t, k, v)
                 -- Allow setting path if app has set-path permission
                 if k == "path" and permissions["set-path"] then
                     app_instance.path = v
                     return
                 end
                 error("Cannot modify app." .. tostring(k), 2)
             end,
             __metatable = false
         })
 
         -- Add to sandbox environment
         sandbox_env.app = app_proxy
 
         -- Add Timer API scoped to this app
         if _G.Timer then
             sandbox_env.Timer = _G.Timer.createAPI(selected_app)
         end
 
         -- Create print wrapper that captures output to app stdout
         local sandbox_print = function(...)
             -- Build output string
             local n = select('#', ...)
             local output = ""
 
             if n == 0 then
                 output = "\n"
             else
                 local result = tostring(select(1, ...))
                 for i = 2, n do
                     result = result .. "\t" .. tostring(select(i, ...))
                 end
                 output = result .. "\n"
             end
 
             -- Write to app stdout
             app_instance:writeStdout(output)
 
             -- Also output to osprint if available (for debugging)
             if osprint then
                 osprint(output)
             end
         end
 
         -- Set the print function in sandbox
         sandbox_env.print = sandbox_print
 
         if osprint then
             osprint("Application instance created with PID: " .. app_instance.pid .. "\n")
         end
 
         -- Check if parent CLI was passed (from run() function)
         local parent_cli = _G.parentCli
         local cli
 
         if parent_cli then
             -- Create SafeCLI wrapper that only exposes write methods
             -- DO NOT expose the parent's buffer directly
             if osprint then
                 osprint("Using parent CLI buffer (safe wrapper)\n")
             end
 
             cli = {
                 -- Safe write method - writes to parent buffer
                 write = function(text)
                     if parent_cli and parent_cli.write then
                         parent_cli.write(text)
                     end
                 end,
 
                 -- Safe writeLine alias
                 writeLine = function(text)
                     if parent_cli and parent_cli.write then
                         parent_cli.write(text)
                     end
                 end,
 
                 -- Safe getText method - read-only access to parent's buffer
                 getText = function()
                     if parent_cli and parent_cli.getText then
                         return parent_cli.getText()
                     end
                     return ""
                 end
 
                 -- DO NOT expose: buffer, clear
                 -- buffer - direct access could allow modification
                 -- clear - would clear parent's buffer
             }
         else
             -- Create new CLI buffer table (always available, not just for CLI mode)
             local cli_buffer = {
                 lines = {},
                 max_lines = 100  -- Store last 100 lines
             }
 
             -- Create CLI helper table (always available for all apps)
             cli = {
                 buffer = cli_buffer,
 
                 -- Add line to buffer
                 write = function(text)
                     table.insert(cli_buffer.lines, tostring(text))
                     -- Trim buffer if it exceeds max lines
                     while #cli_buffer.lines > cli_buffer.max_lines do
                         table.remove(cli_buffer.lines, 1)
                     end
                 end,
 
                 -- Clear buffer
                 clear = function()
                     cli_buffer.lines = {}
                 end,
 
                 -- Get all buffer content as string
                 getText = function()
                     return table.concat(cli_buffer.lines, "\n")
                 end
             }
 
             -- Add writeLine as an alias for write
             cli.writeLine = cli.write
         end
 
         -- Add safe cli table to sandbox environment (for all apps)
         sandbox_env.cli = cli
 
         -- Parse command line arguments from _G.args.argStr
         local parsed_args = {}
         if _G.args and _G.args.argStr then
             parsed_args = parse_args(_G.args.argStr)
             if osprint then
                 osprint("Parsed arguments from argStr: " .. _G.args.argStr .. "\n")
             end
         end
 
         -- Add parsed args to sandbox environment
         sandbox_env.args = parsed_args
 
         -- Modify print to also call cli.write
         local original_print = sandbox_print
         local using_parent_cli = (_G.parentCli ~= nil)
 
         sandbox_env.print = function(...)
             -- Only call original print if NOT using parent CLI
             -- (to avoid duplicate output to stdout when running from shell)
             if not using_parent_cli then
                 original_print(...)
             end
 
             -- Write to CLI buffer (either parent's or own)
             local n = select('#', ...)
             if n == 0 then
                 cli.write("")
             else
                 local result = tostring(select(1, ...))
                 for i = 2, n do
                     result = result .. "\t" .. tostring(select(i, ...))
                 end
                 cli.write(result)
             end
         end
 
         -- Check if app is in CLI mode and set up default draw handler
         if manifest and manifest.type == "cli" then
 
             -- If app has draw permission, set up default draw method
             local has_draw = false
             for _, perm in ipairs(permissions) do
                 if perm == "draw" then
                     has_draw = true
                     break
                 end
             end
 
             if has_draw and app_instance then
                 -- Get the window if it exists
                 local window = app_instance.window
                 if window then
                     -- Set up default onDraw handler that draws the CLI buffer
                     window:onDraw(function(gfx)
                         -- Draw black background
                         gfx:fillRect(0, 0, window.width, window.height, 0x000000)
 
                         -- Draw CLI buffer text
                         local text = cli.getText()
                         gfx:drawText(10, 10, text, 0x00FF00)  -- Green text on black
                     end)
 
                     if osprint then
                         osprint("CLI mode enabled with default draw handler\n")
                     end
                 end
             end
         end
     else
         -- No Application module, create basic print wrapper
         local sandbox_print = osprint and function(...)
             local n = select('#', ...)
             if n == 0 then
                 osprint("\n")
                 return
             end
 
             local result = tostring(select(1, ...))
             for i = 2, n do
                 result = result .. "\t" .. tostring(select(i, ...))
             end
             osprint(result .. "\n")
         end or print
 
         sandbox_env.print = sandbox_print
     end
 
     if has_filesystem and fsRoot then
         -- Load SafeFS module
         local safefs_path = "/os/libs/SafeFS.lua"
         local safefs_code = read_from_ramdisk(fsRoot, safefs_path)
 
         if safefs_code then
             -- Load SafeFS in a temporary environment
             local safefs_env = {}
             setmetatable(safefs_env, {__index = _G, __metatable = false})
             local safefs_func, err = load(safefs_code, safefs_path, "t", safefs_env)
 
             if safefs_func then
                 local success, SafeFS = pcall(safefs_func)
 
                 if success and SafeFS then
                     -- Build list of allowed paths
                     local allowed_paths = {data_dir .. "/*"}  -- Always allow data directory
 
                     -- Add additional paths from manifest.allowedPaths
                     if manifest and manifest.allowedPaths and type(manifest.allowedPaths) == "table" then
                         for _, path in ipairs(manifest.allowedPaths) do
                             if type(path) == "string" then
                                 -- Replace $ with app directory
                                 local resolved_path = string.gsub(path, "^%$", app_dir)
                                 table.insert(allowed_paths, resolved_path)
                                 if osprint then osprint("Additional path allowed: " .. resolved_path .. "\n") end
                             end
                         end
                     end
 
                     -- Ensure data directory exists using C ramdisk functions
                     if osprint then osprint("DEBUG: Checking data directory: " .. data_dir .. "\n") end
                     if osprint then osprint("DEBUG: CRamdiskExists=" .. tostring(CRamdiskExists ~= nil) .. ", CRamdiskMkdir=" .. tostring(CRamdiskMkdir ~= nil) .. "\n") end
                     if CRamdiskExists and CRamdiskMkdir then
                         local dir_exists = CRamdiskExists(data_dir)
                         if osprint then osprint("DEBUG: Directory exists: " .. tostring(dir_exists) .. "\n") end
                         if not dir_exists then
                             if osprint then osprint("Creating data directory: " .. data_dir .. "\n") end
                             -- Create directory structure
                             local parts = split(data_dir, "/")
                             local path = ""
                             for _, part in ipairs(parts) do
                                 if part ~= "" then
                                     path = path .. "/" .. part
                                     if not CRamdiskExists(path) then
                                         -- Create this directory
                                         if osprint then osprint("  Creating: " .. path .. "\n") end
                                         local success, err = CRamdiskMkdir(path)
                                         if not success then
                                             if osprint then osprint("  Failed to create directory: " .. tostring(err) .. "\n") end
                                         else
                                             if osprint then osprint("  Directory created successfully\n") end
                                             -- Check if we can now find it
                                             local exists_after = CRamdiskExists(path)
                                             if osprint then osprint("  Exists after creation: " .. tostring(exists_after) .. "\n") end
 
                                             -- Try to get the directory node to see what was created
                                             if CRamdiskList then
                                                 local items = CRamdiskList(path)
                                                 if osprint then
                                                     osprint("  Directory listing: " .. tostring(items ~= nil) .. "\n")
                                                     if items then
                                                         osprint("  Number of items in directory: " .. tostring(#items) .. "\n")
                                                     end
                                                 end
                                             end
                                         end
                                     else
                                         if osprint then osprint("  Already exists: " .. path .. "\n") end
                                     end
                                 end
                             end
                         end
                     end
 
                     -- Create SafeFS instance with all allowed paths
                     -- Pass selected_app as the app ID for file handler registration
                     -- Pass app_dir as the app path for $ expansion
                     local fs_instance = SafeFS.new(fsRoot, allowed_paths, "app", selected_app, app_dir)
 
                     if fs_instance then
                         -- Set default CWD to $/data if it exists in allowed paths
                         local data_path = "/apps/" .. app_name .. "/data"
                         for _, path in ipairs(allowed_paths) do
                             if path == data_path or path == data_path .. "/*" then
                                 fs_instance:setCWD(data_path)
                                 break
                             end
                         end
 
                         -- Mount disk drives if app has /mnt/* access
                         for _, path in ipairs(allowed_paths) do
                             if path == "/mnt/*" or path == "/*" or path:match("^/mnt/hd%d") then
                                 if fs_instance.mountAllDiskDrives then
                                     local ok, msg = fs_instance:mountAllDiskDrives()
                                     if osprint then
                                         osprint("[RUN] Disk mount result: " .. tostring(msg) .. "\n")
                                     end
                                 end
                                 break
                             end
                         end
 
                         -- Create a proxy table that only exposes safe methods
                         -- This prevents apps from accessing internal properties like allowedDirs
                         -- Note: createDiskFSMount and mountAllDiskDrives are NOT exposed - they're internal only
                         local safe_fs_methods = {
                             "resolvePath", "getCWD", "setCWD", "read", "write", "open",
                             "delete", "dirs", "files", "exists", "getType", "mkdir",
                             "fileName", "parentDir", "join", "relativeTo", "copy", "move",
                             "createPseudoFile", "createPseudoDir", "addFileHandler",
                             "removeFileHandler"
                         }
                         local fs_proxy = {}
                         for _, method in ipairs(safe_fs_methods) do
                             if fs_instance[method] then
                                 fs_proxy[method] = function(self, ...)
                                     return fs_instance[method](fs_instance, ...)
                                 end
                             end
                         end
                         setmetatable(fs_proxy, {
                             __index = function(t, k)
                                 error("fs." .. tostring(k) .. " is not accessible", 2)
                             end,
                             __newindex = function(t, k, v)
                                 error("Cannot modify fs object", 2)
                             end,
                             __metatable = false
                         })
 
                         -- Add to sandbox environment
                         sandbox_env.fs = fs_proxy
                         if osprint then
                             osprint("[RUN] Set sandbox_env.fs (proxied) for " .. app_name .. "\n")
                         end
                     else
                         if osprint then
                             osprint("Warning: Failed to create SafeFS instance for " .. app_name .. "\n")
                         end
                     end
 
                     if osprint then
                         osprint("Filesystem access granted to " .. app_name .. ":\n")
                         for _, path in ipairs(allowed_paths) do
                             osprint("  " .. path .. "\n")
                         end
                     end
                 else
                     if osprint then osprint("Warning: Failed to load SafeFS module: " .. tostring(SafeFS) .. "\n") end
                 end
             else
                 if osprint then osprint("Warning: Failed to compile SafeFS: " .. tostring(err) .. "\n") end
             end
         else
             if osprint then osprint("Warning: SafeFS module not found at " .. safefs_path .. "\n") end
         end
     end
 
     -- Check for network permission and setup SafeHTTP
     local has_network = false
     for _, perm in ipairs(permissions) do
         if perm == "network" then
             has_network = true
             break
         end
     end
 
     if has_network and fsRoot then
         -- Load SafeHTTP module
         local safehttp_path = "/os/libs/SafeHTTP.lua"
         local safehttp_code = read_from_ramdisk(fsRoot, safehttp_path)
 
         if safehttp_code then
             local safehttp_func, err = load(safehttp_code, safehttp_path, "t")
 
             if safehttp_func then
                 local success, SafeHTTP = pcall(safehttp_func)
 
                 if success and SafeHTTP then
                     -- Get allowed domains from manifest
                     local allowed_domains = (manifest and manifest.allowedDomains) or {}
 
                     -- If no domains specified but network permission granted, allow all (backwards compat)
                     if #allowed_domains == 0 then
                         if osprint then
                             osprint("Warning: Network permission granted but no allowedDomains specified - blocking all HTTP\n")
                         end
                         -- Don't create SafeHTTP if no domains allowed
                     else
                         -- Get NetworkStack if available
                         if _G.NetworkStack then
                             -- Create SafeHTTP instance with allowed domains
                             local http_instance = SafeHTTP.new(_G.NetworkStack, allowed_domains, {
                                 timeout = 30,
                                 max_size = 10485760,  -- 10MB default
                                 user_agent = (manifest and manifest.name or "Script") .. "/" .. (manifest and manifest.version or "1.0")
                             })
 
                             -- Add to sandbox environment
                             sandbox_env.http = http_instance
 
                             if osprint then
                                 osprint("Network access granted to domains:\n")
                                 for _, domain in ipairs(allowed_domains) do
                                     osprint("  " .. domain .. "\n")
                                 end
                             end
                         else
                             if osprint then
                                 osprint("Warning: NetworkStack not available - network permission ineffective\n")
                             end
                         end
                     end
                 else
                     if osprint then osprint("Warning: Failed to load SafeHTTP module: " .. tostring(SafeHTTP) .. "\n") end
                 end
             else
                 if osprint then osprint("Warning: Failed to compile SafeHTTP: " .. tostring(err) .. "\n") end
             end
         else
             if osprint then osprint("Warning: SafeHTTP module not found at " .. safehttp_path .. "\n") end
         end
     end
 
     -- Check for import permission and setup apps table
     local has_import = false
     for _, perm in ipairs(permissions) do
         if perm == "import" then
             has_import = true
             break
         end
     end
 
     if has_import then
         -- Create apps table that provides access to Application instances
         local apps_table = {}
 
         setmetatable(apps_table, {
             __index = function(t, app_name)
                 -- app_name is like "com.devname.appname"
                 -- Find the Application instance in sys.applications
                 local registry = get_app_registry()
                 for pid, app_instance in pairs(registry) do
                     if app_instance.appPath and app_instance.appPath:find(app_name, 1, true) then
                         -- Return the Application instance (which has :call(), :export(), etc.)
                         rawset(t, app_name, app_instance)
                         return app_instance
                     end
                 end
 
                 -- App not found
                 return nil
             end,
             __metatable = false  -- Prevent metatable access/modification
         })
 
         sandbox_env.apps = apps_table
 
         if osprint then
             osprint("Import permission granted - apps table available\n")
         end
     end
 
     -- Check for scheduling permission and setup os.schedule API
     local has_schedule = false
     for _, perm in ipairs(permissions) do
         if perm == "scheduling" then
             has_schedule = true
             break
         end
     end
 
     if has_schedule then
         -- Load scheduler module if not already loaded
         if not scheduler and fsRoot then
             local scheduler_path = "/os/libs/Scheduler.lua"
             local scheduler_code = read_from_ramdisk(fsRoot, scheduler_path)
 
             if scheduler_code then
                 -- Load scheduler in a temporary environment
                 local scheduler_env = {}
                 setmetatable(scheduler_env, {__index = _G, __metatable = false})
                 local scheduler_func, err = load(scheduler_code, scheduler_path, "t", scheduler_env)
 
                 if scheduler_func then
                     local success, Scheduler = pcall(scheduler_func)
 
                     if success and Scheduler then
                         scheduler = Scheduler
                         -- Initialize scheduler
                         scheduler.init()
                         if osprint then
                             osprint("Scheduler module loaded and initialized\n")
                         end
                     else
                         if osprint then
                             osprint("Warning: Failed to load scheduler module: " .. tostring(Scheduler) .. "\n")
                         end
                     end
                 else
                     if osprint then
                         osprint("Warning: Failed to compile scheduler: " .. tostring(err) .. "\n")
                     end
                 end
             else
                 if osprint then
                     osprint("Warning: Scheduler module not found at " .. scheduler_path .. "\n")
                 end
             end
         end
 
         -- Create os.schedule API if scheduler is available
         if scheduler then
             -- Create app context for scheduler API
             local app_context = {
                 _app_path = selected_app  -- Store the app path for onNextStartUp/onEveryStartUp
             }
 
             -- Parse permissions into a table
             local perm_table = {}
             for _, perm in ipairs(permissions) do
                 perm_table[perm] = true
             end
 
             -- Create the os.schedule API
             local schedule_api = scheduler.create_api(app_context, perm_table)
 
             if schedule_api then
                 -- Create os table if it doesn't exist
                 if not sandbox_env.os then
                     sandbox_env.os = {}
                 end
 
                 -- Add schedule API to os table
                 sandbox_env.os.schedule = schedule_api
 
                 if osprint then
                     osprint("Schedule permission granted - os.schedule API available\n")
                 end
             end
         end
     end
 
     -- Check for ramdisk permission and add ramdisk functions
     local has_ramdisk = false
     for _, perm in ipairs(permissions) do
         if perm == "ramdisk" then
             has_ramdisk = true
             break
         end
     end
 
     if has_ramdisk then
         -- Add ramdisk functions
         sandbox_env.CRamdiskOpen = _G.CRamdiskOpen
         sandbox_env.CRamdiskRead = _G.CRamdiskRead
         sandbox_env.CRamdiskWrite = _G.CRamdiskWrite
         sandbox_env.CRamdiskClose = _G.CRamdiskClose
         sandbox_env.CRamdiskList = _G.CRamdiskList
         sandbox_env.CRamdiskExists = _G.CRamdiskExists
         sandbox_env.CRamdiskMkdir = _G.CRamdiskMkdir
 
         -- Add GetManifest helper function (requires ramdisk access)
         sandbox_env.GetManifest = function(appId)
             if type(appId) ~= "string" or appId == "" then
                 return nil, "Invalid app ID"
             end
 
             local manifestPath = "/apps/" .. appId .. "/manifest.lua"
 
             if not _G.CRamdiskExists or not _G.CRamdiskExists(manifestPath) then
                 return nil, "Manifest not found"
             end
 
             local handle = _G.CRamdiskOpen(manifestPath, "r")
             if not handle then
                 return nil, "Failed to open manifest"
             end
 
             local manifestCode = _G.CRamdiskRead(handle)
             _G.CRamdiskClose(handle)
 
             if not manifestCode or manifestCode == "" then
                 return nil, "Failed to read manifest"
             end
 
             -- Load and execute manifest using loadstring (available in Run.lua context)
             local loadFunc = loadstring or load
             if not loadFunc then
                 return nil, "No load function available"
             end
 
             local manifestFunc, loadErr = loadFunc(manifestCode, "manifest_" .. appId)
             if not manifestFunc then
                 return nil, "Failed to load manifest"
             end
 
             local success, manifest = pcall(manifestFunc)
             if not success then
                 return nil, "Failed to execute manifest"
             end
 
             if type(manifest) ~= "table" then
                 return nil, "Manifest did not return a table"
             end
 
             return manifest
         end
 
         if osprint then
             osprint("Ramdisk permission granted - ramdisk functions available\n")
         end
     end
 
     -- Check for draw permission and add graphics/image functions
     local has_draw = false
     for _, perm in ipairs(permissions) do
         if perm == "draw" then
             has_draw = true
             break
         end
     end
 
     if has_draw then
         -- Add VESA graphics functions
         sandbox_env.VESAInit = _G.VESAInit
         sandbox_env.VESASetMode = _G.VESASetMode
         sandbox_env.VESAClearScreen = _G.VESAClearScreen
         sandbox_env.VESADrawPixel = _G.VESADrawPixel
         sandbox_env.VESAFillRect = _G.VESAFillRect
         sandbox_env.VESADrawRect = _G.VESADrawRect
         sandbox_env.VESADrawChar = _G.VESADrawChar
         sandbox_env.VESADrawString = _G.VESADrawString
         sandbox_env.VESAGetInfo = _G.VESAGetInfo
         sandbox_env.VESAInspectBuffer = _G.VESAInspectBuffer
         sandbox_env.VESASetRenderTarget = _G.VESASetRenderTarget
         sandbox_env.VESAProcessBufferedDrawOps = _G.VESAProcessBufferedDrawOps
         sandbox_env.VESABlitWindowBufferRegion = _G.VESABlitWindowBufferRegion
 
         -- Add image loading/drawing functions
         sandbox_env.PNGLoad = _G.PNGLoad
         sandbox_env.BMPLoad = _G.BMPLoad
         sandbox_env.JPEGLoad = _G.JPEGLoad
         sandbox_env.ImageDraw = _G.ImageDraw
         sandbox_env.ImageDrawScaled = _G.ImageDrawScaled
         sandbox_env.ImageGetInfo = _G.ImageGetInfo
         sandbox_env.ImageGetWidth = _G.ImageGetWidth
         sandbox_env.ImageGetHeight = _G.ImageGetHeight
         sandbox_env.ImageGetPixel = _G.ImageGetPixel
         sandbox_env.ImageGetBufferBGRA = _G.ImageGetBufferBGRA
         sandbox_env.ImageDestroy = _G.ImageDestroy
 
         -- Add partial window update function for efficient drawing (e.g., paint apps)
         sandbox_env.updateWindowRegion = _G.updateWindowRegion
 
         if osprint then
             osprint("Draw permission granted - graphics functions available\n")
             osprint("  BMPLoad in _G: " .. tostring(_G.BMPLoad ~= nil) .. "\n")
             osprint("  BMPLoad in sandbox: " .. tostring(sandbox_env.BMPLoad ~= nil) .. "\n")
             osprint("  JPEGLoad in _G: " .. tostring(_G.JPEGLoad ~= nil) .. "\n")
             osprint("  JPEGLoad in sandbox: " .. tostring(sandbox_env.JPEGLoad ~= nil) .. "\n")
             osprint("  ImageGetWidth in _G: " .. tostring(_G.ImageGetWidth ~= nil) .. "\n")
             osprint("  ImageGetHeight in _G: " .. tostring(_G.ImageGetHeight ~= nil) .. "\n")
         end
     end
 
     -- Check for imaging permission and add Image library
     local has_imaging = false
     for _, perm in ipairs(permissions) do
         if perm == "imaging" then
             has_imaging = true
             break
         end
     end
 
     if has_imaging and _G.Image then
         sandbox_env.Image = _G.Image
         if osprint then
             osprint("Imaging permission granted - Image library available\n")
         end
     end
 
     -- Check for run permission and setup run function
     local has_run = false
     for _, perm in ipairs(permissions) do
         if perm == "run" then
             has_run = true
             break
         end
     end
 
     if has_run then
         -- Create run function that accepts app name and arguments
         -- Supports both: run("progname", "arg1 -v") and run("progname", "arg1", "-v")
         sandbox_env.run = function(prog_name, ...)
             local args = {...}
             local argStr = ""
 
             -- Build argument string
             if #args == 0 then
                 argStr = ""
             elseif #args == 1 and type(args[1]) == "string" then
                 -- Single string argument: run("prog", "arg1 -v")
                 argStr = args[1]
             else
                 -- Multiple arguments: run("prog", "arg1", "-v")
                 local parts = {}
                 for i, arg in ipairs(args) do
                     table.insert(parts, tostring(arg))
                 end
                 argStr = table.concat(parts, " ")
             end
 
             -- Set global args for the program being run
             if not _G.args then
                 _G.args = {}
             end
             _G.args.argStr = argStr
 
             -- Pass parent's CLI buffer to child process
             _G.parentCli = sandbox_env.cli
 
             -- Run the program - use _G.fsRoot to ensure we have the correct filesystem root
             local success, app = run.execute(prog_name, _G.fsRoot or fsRoot)
 
             -- Clear args and parentCli after running
             _G.args.argStr = nil
             _G.parentCli = nil
 
             return success, app
         end
 
         if osprint then
             osprint("Run permission granted - run() function available\n")
         end
     end
 
     -- Check for load permission and add load function
     local has_load = false
     for _, perm in ipairs(permissions) do
         if perm == "load" then
             has_load = true
             break
         end
     end
 
     if has_load then
         -- Grant access to load() function for Lua interpreter
         -- Create a safe loadstring wrapper that sets the environment
         -- Optionally accepts a custom environment table as third parameter
         sandbox_env.loadstring = function(code, chunkname, env)
             local func, err = _G.loadstring(code, chunkname)
             if func then
                 -- Use provided environment or default to sandbox_env
                 local ok, setenv_err = pcall(_G.setfenv, func, env or sandbox_env)
                 if not ok then
                     return nil, "setfenv failed: " .. tostring(setenv_err)
                 end
             end
             return func, err
         end
 
         if osprint then
             osprint("Load permission granted - loadstring() function available\n")
         end
     end
 
     -- Check for setfenv permission
     local has_setfenv = false
     for _, perm in ipairs(permissions) do
         if perm == "setfenv" then
             has_setfenv = true
             break
         end
     end
 
     if has_setfenv then
         -- Grant access to setfenv for environment manipulation
         -- Use direct reference (available in Run.lua context) rather than _G
         sandbox_env.setfenv = setfenv
         sandbox_env.getfenv = getfenv
 
         if osprint then
             osprint("Setfenv permission granted - setfenv/getfenv functions available\n")
         end
     end
 
     -- Check for system permission and setup system information API
     local has_system = false
     for _, perm in ipairs(permissions) do
         if perm == "system" then
             has_system = true
             break
         end
     end
 
     if has_system then
         -- Create system API with read-only access to system information
         sandbox_env.system = {
             -- Get list of running applications
             getApplications = function()
                 if _G.sys and _G.sys.getAllApplications then
                     return _G.sys.getAllApplications()
                 end
                 return {}
             end
         }
 
         if osprint then
             osprint("System permission granted - system information API available\n")
         end
     end
 
     -- Check for global-environment permission (gives full _G access)
     local has_global_env = false
     for _, perm in ipairs(permissions) do
         if perm == "global-environment" then
             has_global_env = true
             break
         end
     end
 
     -- SECURITY: Scan and remove dangerous globals that should never be in sandbox
     local dangerous_globals = {
         "_G",           -- Global environment access
         "fsRoot",       -- Direct filesystem access
         "gfx",          -- Raw graphics access
         "gfx_api",      -- Raw graphics API
         "run",          -- Run module internals (except run() function if granted)
         "sys",          -- System internals (except system permission API)
         "ADMIN_AppAddPermission",  -- Admin-only functions
         "ADMIN_AppAddPath",
         "ADMIN_StartPrompt",
         "ADMIN_FinishPrompt",
         "VESAInit",     -- Raw VESA (only if draw permission not granted)
         "VESASetMode",
         "VESAClearScreen",
         "VESADrawPixel",
         "VESADrawRect",
         "VESADrawText",
         "VESASetPixel",
         "VESAGetInfo",
         "CRamdiskOpen", -- Raw ramdisk (only if ramdisk permission not granted)
         "CRamdiskRead",
         "CRamdiskWrite",
         "CRamdiskClose",
         "CRamdiskList",
         "CRamdiskExists",
         "CRamdiskMkdir",
         "getfenv",      -- Environment manipulation
         "setfenv",
         "rawget",       -- Raw access functions (keep rawset for sandbox internals)
         "rawequal",
         "dofile",       -- File execution
         "loadfile",
         "load"          -- Dynamic code loading (unless explicitly added)
     }
 
     -- Remove dangerous globals (except those explicitly granted by permissions)
     -- Skip this for global-environment permission (full _G access)
     if not has_global_env then
         for _, key in ipairs(dangerous_globals) do
             -- Only remove if it wasn't explicitly set by permission system above
             -- Check if it exists and wasn't added intentionally
             if sandbox_env[key] ~= nil then
                 -- Special cases: these are OK if granted by permissions
                 local is_permitted = false
 
                 -- Check if it's a permitted VESA function (draw permission)
                 if key:match("^VESA") and has_draw then
                     is_permitted = true
                 end
 
                 -- Check if it's a permitted ramdisk function (ramdisk permission)
                 if key:match("^CRamdisk") and has_ramdisk then
                     is_permitted = true
                 end
 
                 -- Check if it's the run() function (run permission)
                 if key == "run" and has_run then
                     is_permitted = true
                 end
 
                 -- Check if it's the load() function (load permission)
                 if key == "load" and has_load then
                     is_permitted = true
                 end
 
                 -- Check if it's the sys object (system-all permission)
                 if key == "sys" and has_system_all then
                     is_permitted = true
                 end
 
                 -- Check if it's an admin function (admin permission)
                 if (key == "ADMIN_AppAddPermission" or key == "ADMIN_AppAddPath" or
                     key == "ADMIN_StartPrompt" or key == "ADMIN_FinishPrompt") and has_admin then
                     is_permitted = true
                 end
 
                 -- Check if it's setfenv/getfenv (setfenv permission)
                 if (key == "setfenv" or key == "getfenv") and has_setfenv then
                     is_permitted = true
                 end
 
                 -- Remove if not permitted
                 if not is_permitted then
                     sandbox_env[key] = nil
                     if osprint then
                         osprint("SECURITY: Removed dangerous global from sandbox: " .. key .. "\n")
                     end
                 end
             end
         end
     else
         if osprint then
             osprint("SECURITY: Skipping dangerous globals removal (global-environment permission)\n")
         end
     end
 
     -- Add _G reference to sandbox itself (or real _G for global-environment)
     if has_global_env then
         sandbox_env._G = _G  -- Full global access
     else
         sandbox_env._G = sandbox_env
     end
 
     -- Create require function that searches app's src directory first
     local app_src_dir = app_dir .. "/src"
     local require_cache = {}
 
     -- Track modules currently being loaded to detect circular requires
     local loading_modules = {}
 
     sandbox_env.require = function(module_name, use_bytecode)
         if type(module_name) ~= "string" or module_name == "" then
             error("require: module name must be a non-empty string", 2)
         end
 
         if osprint then
             osprint("[require] Loading: " .. module_name .. (use_bytecode and " (bytecode)" or "") .. "\n")
         end
 
         -- Check cache first
         if require_cache[module_name] then
             if osprint then
                 osprint("[require] Cache hit: " .. module_name .. "\n")
             end
             return require_cache[module_name]
         end
 
         -- Check if module is pre-loaded in sandbox (e.g., Dialog, Application)
         -- Use rawget to avoid metatable strict checking
         local preloaded = rawget(sandbox_env, module_name)
         if preloaded ~= nil then
             if osprint then
                 osprint("[require] Using pre-loaded module: " .. module_name .. "\n")
             end
             require_cache[module_name] = preloaded
             return preloaded
         end
 
         -- Check for circular require
         if loading_modules[module_name] then
             error("require: circular dependency detected for '" .. module_name .. "'", 2)
         end
 
         -- Mark as loading
         loading_modules[module_name] = true
 
         -- Convert module name to path (replace . with /)
         local module_path = module_name:gsub("%.", "/")
 
         -- Search paths in order:
         -- If use_bytecode is true, check .luac first
         -- Otherwise only check .lua files
         local search_paths
         if use_bytecode then
             search_paths = {
                 app_src_dir .. "/" .. module_path .. ".luac",
                 app_src_dir .. "/" .. module_path .. ".lua",
                 "/os/libs/" .. module_path .. ".luac",
                 "/os/libs/" .. module_path .. ".lua",
             }
         else
             search_paths = {
                 app_src_dir .. "/" .. module_path .. ".lua",
                 "/os/libs/" .. module_path .. ".lua",
             }
         end
 
         local module_content = nil
         local found_path = nil
 
         for _, path in ipairs(search_paths) do
             if osprint then
                 osprint("[require] Trying: " .. path .. "\n")
             end
             module_content = read_from_ramdisk(fsRoot, path)
             if module_content then
                 found_path = path
                 if osprint then
                     osprint("[require] Found: " .. path .. " (" .. #module_content .. " bytes)\n")
                 end
                 break
             end
         end
 
         if not module_content then
             loading_modules[module_name] = nil
             error("require: module '" .. module_name .. "' not found\n  searched:\n    " ..
                   table.concat(search_paths, "\n    "), 2)
         end
 
         -- Load the module in sandbox environment
         local loadFunc = loadstring or load
         local module_func, load_err
 
         if osprint then
             osprint("[require] Compiling: " .. module_name .. " (" .. #module_content .. " bytes)\n")
         end
 
         if loadFunc == loadstring then
             if osprint then
                 osprint("[require] Calling loadstring...\n")
             end
             local compile_ok, compile_result, compile_err = pcall(function()
                 return loadFunc(module_content, found_path)
             end)
             if osprint then
                 osprint("[require] loadstring pcall returned: " .. tostring(compile_ok) .. "\n")
             end
             if compile_ok then
                 module_func = compile_result
                 load_err = compile_err
             else
                 module_func = nil
                 load_err = compile_result
             end
             if module_func then
                 if osprint then
                     osprint("[require] Setting environment...\n")
                 end
                 setfenv(module_func, sandbox_env)
                 if osprint then
                     osprint("[require] Environment set\n")
                 end
             end
         else
             module_func, load_err = loadFunc(module_content, found_path, "t", sandbox_env)
         end
 
         if not module_func then
             loading_modules[module_name] = nil
             error("require: failed to load module '" .. module_name .. "': " .. tostring(load_err), 2)
         end
 
         if osprint then
             osprint("[require] Executing: " .. module_name .. "\n")
         end
 
         -- Execute the module
         local success, result = pcall(module_func)
 
         -- Clear loading flag
         loading_modules[module_name] = nil
 
         if not success then
             error("require: failed to execute module '" .. module_name .. "': " .. tostring(result), 2)
         end
 
         if osprint then
             osprint("[require] Completed: " .. module_name .. "\n")
         end
 
         -- Cache the result (use true if module returns nil)
         local cached_value = result
         if cached_value == nil then
             cached_value = true
         end
         require_cache[module_name] = cached_value
 
         return result
     end
 
     if osprint then
         osprint("require() function available (searches " .. app_src_dir .. " first)\n")
     end
 
     -- Set up metatable based on permissions
     if has_global_env then
         -- Global environment permission: give direct access to _G
         -- This is for system-level apps like the installer that need full access
         setmetatable(sandbox_env, {
             __index = _G,
             __newindex = function(t, k, v)
                 rawset(t, k, v)  -- Allow setting new globals within sandbox
             end,
             __metatable = _G  -- As requested, metatable = _G
         })
         if osprint then
             osprint("Global-environment permission granted - full _G access available\n")
         end
     else
         -- Standard sandbox: prevent access to undefined globals
         -- Track which keys are allowed (even if nil) vs truly undefined
         local allowed_keys = {}
         for k, _ in pairs(sandbox_env) do
             allowed_keys[k] = true
         end
         -- Also allow keys that were explicitly set to nil or may be nil
         allowed_keys.fs = true
         allowed_keys.crypto = true
         allowed_keys.sys = true
         allowed_keys.window = true
         allowed_keys.JPEGLoad = true
         allowed_keys.PNGLoad = true
         allowed_keys.BMPLoad = true
         allowed_keys.ImageGetWidth = true
         allowed_keys.ImageGetHeight = true
         allowed_keys.ImageGetPixel = true
         allowed_keys.ImageGetBufferBGRA = true
         allowed_keys.ImageDraw = true
         allowed_keys.ImageDrawScaled = true
         allowed_keys.ImageDestroy = true
         allowed_keys.ImageGetInfo = true
         allowed_keys.setfenv = true
         allowed_keys.getfenv = true
         allowed_keys.loadstring = true
 
         setmetatable(sandbox_env, {
             __index = function(t, k)
                 if allowed_keys[k] then
                     return nil  -- Key is allowed but not set, return nil
                 end
                 error("Attempt to access undefined global: " .. tostring(k), 2)
             end,
             __newindex = function(t, k, v)
                 allowed_keys[k] = true  -- Mark as allowed when set
                 rawset(t, k, v)
             end,
             __metatable = false  -- Prevent metatable access/modification
         })
     end
 
     -- Register sandbox environment with sys (after sandbox is fully set up)
     -- Note: app_instance is already defined above, don't redefine it from the proxy
     if app_instance and app_instance.pid and _G.sys and _G.sys.registerEnvironment then
         if osprint then
             osprint("[run] Registering sandbox environment for PID " .. app_instance.pid .. "\n")
         end
         _G.sys.registerEnvironment(app_instance.pid, sandbox_env)
     end
 
     -- Initialize global proc table if needed
     if not _G.proc then
         _G.proc = {}
     end
 
     -- Populate global proc table with sandbox instances
     local app = rawget(sandbox_env, "app")
     if app and app.pid then
         local pid = app.pid
         _G.proc[pid] = {
             id = pid,
             fs = rawget(sandbox_env, "fs"),      -- SafeFS instance (may be nil)
             gfx = rawget(sandbox_env, "gfx"),    -- SafeGfx instance (may be nil)
             http = rawget(sandbox_env, "http"),  -- SafeHTTP instance (may be nil)
             app = app                            -- Application instance
         }
 
         if osprint then
             osprint("Registered process " .. pid .. " in global proc table\n")
             osprint("[DEBUG] About to load app code with load()...\n")
         end
     end
 
     -- Check if this is an HTML type app
     if manifest and manifest.type == "html" then
         if osprint then
             osprint("[DEBUG] HTML type app detected, creating HTML window\n")
         end
 
         -- Extract window dimensions from HTML meta tags
         -- Supports: <meta name="window-width" content="500"> or value="500"
         local html_width = manifest.width or 800
         local html_height = manifest.height or 600
         -- Try content= first, then value=
         local meta_width = string.match(init_content, '<meta[^>]+name=["\']window%-width["\'][^>]+content=["\'](%d+)["\']')
             or string.match(init_content, '<meta[^>]+name=["\']window%-width["\'][^>]+value=["\'](%d+)["\']')
         local meta_height = string.match(init_content, '<meta[^>]+name=["\']window%-height["\'][^>]+content=["\'](%d+)["\']')
             or string.match(init_content, '<meta[^>]+name=["\']window%-height["\'][^>]+value=["\'](%d+)["\']')
         if meta_width then html_width = tonumber(meta_width) or html_width end
         if meta_height then html_height = tonumber(meta_height) or html_height end
 
         -- For HTML apps, init_content is HTML, not Lua
         local htmlWindow, htmlErr
 
         if _G.sys and _G.sys.browser then
             htmlWindow, htmlErr = _G.sys.browser:newHTMLWindow({
                 app = sandbox_env.app,
                 html = init_content,
                 file = init_file,
                 fs = rawget(sandbox_env, "fs"),  -- Use rawget to avoid metatable errors
                 width = html_width,
                 height = html_height,
                 title = manifest.name or "HTML App",
                 Dialog = rawget(sandbox_env, "Dialog"),
                 loadstring = rawget(sandbox_env, "loadstring"),
                 showStatusBar = manifest.showStatusBar or false,
                 onSubmit = function(formData)
                     if osprint then
                         osprint("Form submitted: " .. tostring(formData) .. "\n")
                     end
                 end,
             })
         else
             htmlErr = "sys.browser not available"
         end
 
         if not htmlWindow then
             if osprint then
                 osprint("ERROR: Failed to create HTML window: " .. tostring(htmlErr) .. "\n")
             end
             local err_msg = "Failed to create HTML window: " .. tostring(htmlErr)
             print("Error: " .. err_msg)
             return false, err_msg
         end
 
         if osprint then
             osprint("HTML window created successfully\n")
         end
 
         -- Store HTML window reference
         sandbox_env._htmlWindow = htmlWindow
 
         -- Trigger ApplicationStart hook
         if _G.sys and _G.sys.hook and sandbox_env.app then
             _G.sys.hook:run("ApplicationStart", sandbox_env.app)
         end
 
         -- Attach CLI buffer to app instance for proper output handling
         if app_instance and app_instance.attachCLI then
             app_instance:attachCLI(cli)
             if osprint then
                 osprint("[run] Attached CLI to HTML app instance\n")
             end
         end
 
         return true, app_instance
     end
 
     -- Load and execute the app in the sandbox (Lua apps)
     if osprint then
         osprint("[DEBUG] Calling load() on init file: " .. init_file .. "\n")
         osprint("[DEBUG] init_content length: " .. #init_content .. " bytes\n")
         osprint("[DEBUG] sandbox_env type: " .. type(sandbox_env) .. "\n")
         osprint("[DEBUG] Testing with small chunk first...\n")
     end
 
     -- Test: Try loading a simple string first to verify loadstring works
     local testFunc = loadstring("return 1")
     if osprint then
         if testFunc then
             osprint("[DEBUG] Test loadstring succeeded\n")
         else
             osprint("[DEBUG] Test loadstring FAILED\n")
         end
     end
 
     if osprint then
         osprint("[DEBUG] About to call loadstring on actual content...\n")
         osprint("[DEBUG] First 100 chars: " .. init_content:sub(1, 100) .. "\n")
         osprint("[DEBUG] Last 100 chars: " .. init_content:sub(-100) .. "\n")
     end
 
     -- Try loadstring first (LuaJIT), fallback to load
     local loadFunc = loadstring or load
     local app_func, err
 
     if loadFunc == loadstring then
         if osprint then
             osprint("[DEBUG] Using loadstring (LuaJIT)\n")
             osprint("[DEBUG] Calling loadstring on full content...\n")
         end
 
         -- LuaJIT loadstring doesn't take mode parameter
         -- Wrap in pcall to catch any crashes
         local success, result1, result2 = pcall(function()
             return loadFunc(init_content, init_file)
         end)
 
         if osprint then
             osprint("[DEBUG] pcall returned, success=" .. tostring(success) .. "\n")
         end
 
         if success then
             app_func = result1
             err = result2
             if osprint then
                 if app_func then
                     osprint("[DEBUG] loadstring succeeded, app_func=" .. type(app_func) .. "\n")
                 else
                     osprint("[DEBUG] loadstring FAILED: " .. tostring(err) .. "\n")
                 end
             end
         else
             if osprint then
                 osprint("[DEBUG] loadstring CRASHED: " .. tostring(result1) .. "\n")
             end
             err = "loadstring crashed: " .. tostring(result1)
         end
         if app_func then
             -- Set environment after loading
             if osprint then
                 osprint("[DEBUG] Setting environment with setfenv...\n")
             end
             setfenv(app_func, sandbox_env)
             if osprint then
                 osprint("[DEBUG] setfenv completed\n")
             end
         end
     else
         if osprint then
             osprint("[DEBUG] Using load (Lua 5.2+)\n")
         end
         -- Standard Lua 5.2+ load function
         app_func, err = loadFunc(init_content, init_file, "t", sandbox_env)
     end
 
     if osprint then
         osprint("[DEBUG] load/loadstring phase completed\n")
     end
 
     if not app_func then
         if osprint then
             osprint("ERROR: Failed to load app: " .. err .. "\n")
         end
         print("Error: " .. tostring(err))
         return false, tostring(err)
     end
 
     if osprint then
         osprint("[DEBUG] load() succeeded, app_func created\n")
         osprint("[run] Executing app code...\n")
     end
 
     local success, result = pcall(app_func)
 
     if osprint then
         osprint("[DEBUG] pcall completed, success=" .. tostring(success) .. "\n")
     end
 
     -- Trigger ApplicationStart hook (requires admin permission)
     if success and sys and sys.hook and sandbox_env.app then
         sys.hook:run("ApplicationStart", sandbox_env.app)
     end
 
     if not success then
         if osprint then
             osprint("[run] ERROR: App execution failed: " .. tostring(result) .. "\n")
         end
         print("Error: App execution failed: " .. result)
 
         -- Mark app as stopped if it exists
         if Application and app_instance then
             app_instance:setStatus("stopped", "execution_error: " .. tostring(result))
 
             -- Clean up /proc/$PID directory
             local pid = app_instance.pid
             if pid and CRamdiskRemove then
                 local proc_dir = "/proc/" .. pid
                 CRamdiskRemove(proc_dir .. "/process")
                 CRamdiskRemove(proc_dir)
                 if osprint then
                     osprint("Cleaned up " .. proc_dir .. "\n")
                 end
             end
 
             -- Clean up global proc table
             if pid and _G.proc then
                 _G.proc[pid] = nil
                 if osprint then
                     osprint("Removed process " .. pid .. " from proc table\n")
                 end
             end
 
             -- Unregister from sys.applications
             if _G.sys and _G.sys.unregisterApplication then
                 _G.sys.unregisterApplication(pid)
             end
         end
 
         return false, tostring(result)
     end
 
     print("App completed successfully")
 
     -- Check if app should keep running (has windows or callbacks)
     local keepRunning = false
     if Application and app_instance then
         if app_instance.windows and #app_instance.windows > 0 then
             keepRunning = true
             if osprint then
                 osprint("App has " .. #app_instance.windows .. " windows, keeping it running\n")
             end
         end
     end
 
     -- Only mark app as stopped and clean up if it has no windows
     if not keepRunning and Application and app_instance then
         app_instance:setStatus("stopped", "no_windows")
 
         -- Clean up /proc/$PID directory
         local pid = app_instance.pid
         if pid and CRamdiskRemove then
             local proc_dir = "/proc/" .. pid
             CRamdiskRemove(proc_dir .. "/process")
             CRamdiskRemove(proc_dir)
             if osprint then
                 osprint("Cleaned up " .. proc_dir .. "\n")
             end
         end
 
         -- Clean up global proc table
         if pid and _G.proc then
             _G.proc[pid] = nil
             if osprint then
                 osprint("Removed process " .. pid .. " from proc table\n")
             end
         end
 
         -- Unregister from sys.applications
         if _G.sys and _G.sys.unregisterApplication then
             _G.sys.unregisterApplication(pid)
         end
     end
 
     -- Attach CLI buffer to app instance for easy access
     if app_instance and sandbox_env.cli then
         app_instance.cli = sandbox_env.cli
         if osprint then
             osprint("[run] Attached CLI to app instance\n")
             osprint("[run] CLI has getText: " .. tostring(sandbox_env.cli.getText ~= nil) .. "\n")
             osprint("[run] CLI has buffer: " .. tostring(sandbox_env.cli.buffer ~= nil) .. "\n")
             if sandbox_env.cli.getText then
                 local text = sandbox_env.cli.getText()
                 osprint("[run] CLI getText() returns: " .. tostring(text) .. "\n")
             end
         end
     end
 
     -- Return success and the app instance (so caller can get PID, stdout, etc)
     return true, app_instance
 end
 
 -- Export to global namespace for easy access
 _G.run = run
 
 -- Export module functions
 return run