Cursor apps and contemporary runtimes
A cursor app is not “JavaScript received from the network and immediately run.” It is a signed, content-addressed manifest describing software, its publisher, supported bodies, immutable artifacts, requested capabilities, storage expectations, and upgrade policy. The operator can inspect that record in Open MCT before any body receives authority to execute it.
Lua source is now also a first-class stored artifact. The shipped watch-party profile parses a deliberately tiny Lua-derived call surface into a declarative continuation graph; it never evaluates arbitrary source. Source IDs and compiled program IDs remain separate so compiler upgrades can be compared without granting downloaded source execution authority. See SQLite Body and Lua Programs.
What the catalog means
The Cursor Apps subtree separates four states:
- installed — code is already bundled into the release this body booted;
- source available — a named repository or immutable source exists, but this body has not fetched or executed it;
- local prototype — functionality exists locally without a signed network distribution protocol;
- not connected — the view is reserved for signed catalogs from attached networks, but no carrier or catalog is configured.
Those words are deliberately not “safe” or “trusted.” A manifest signature proves which key signed bytes. A capability grant decides whether that publisher or app may read a mailbox, continue a cursor, open a socket, write a database, or request an effect.
Contemporary JavaScript and WASM
A capable browser body can host modules, Web Workers, service workers, SQLite WASM, DuckDB WASM, and carefully reviewed WASM components. A native Caravan body can additionally expose TCP, µTP, UDP DHT, filesystems, rclone remotes, hardware, and process isolation. Both should consume the same high-level app manifest while using body-specific adapters.
The intended sequence is:
- discover a signed catalog or receive a cryptopointer;
- pin the publisher key and manifest hash;
- inspect requested capabilities and compatible bodies;
- retrieve immutable artifacts from peers first, then authorized HTTPS/webseed fallbacks;
- verify every artifact before loading;
- execute inside the narrowest available body boundary;
- emit cursor records and effect receipts;
- retain or revoke the grant independently of the downloaded bytes.
Arbitrary JavaScript does not run in the cockpit origin. Untrusted apps need a future isolated body or sandbox protocol. WASM is a compilation format, not a security boundary by itself.
Network app catalogs
An attached curve may advertise an app catalog through signed mailbox envelopes or an immutable swarm head. The catalog needs publisher allowlists, anti-rollback sequence rules, content hashes, capability summaries, and explicit local approval. curso.rs may mirror bytes, but it must not become the only discovery or recovery path.
The shipped app-store view is therefore useful and honest today: it shows bundled and source-visible software while marking the remote network catalog not connected.