HolyC apps
One file each, drawn with the shared toolkit. They run inside the desktop with no memory protection, so their permissions gate host services only.
Developers
Build on the desktop.
One language, one live compiler, one package format. Write a window, test it in seconds, and ship it with permissions people can read.
Four kinds of app.
Pick by how much isolation you need.
Web apps
A static site in the browser engine, bound by the browser sandbox. Calls to the desktop are checked against grants.
Electron apps
A real process on the Mac, limited to one workspace folder with a minimal environment. Limits, not a wall.
Host services
Python services behind the hub: weather, music, sheets, calendar, wallpapers. They hold the keys; the desktop only asks.
Your first app.
Six steps, from a window to an install.
- Write a window
A HolyC function that draws its body in logical units inside a window. The same code runs at 1x and 2x.
- Run it fast
Reload the desktop from a saved snapshot in about 20 seconds, or run it headless on the native build with a driver script.
- Describe it
A manifest names the app, its version, publisher and the permission words it needs.
- Package it
A .ksapp file is a zip with a manifest, a file list of hashes and your payload.
- Sign it
An Ed25519 signature over the file list. Unsigned packages still install, with a warning.
- Install it
One sheet shows the publisher, the permissions and the verdict. Updates keep the same key.
A manifest, illustrative
{
"id": "com.example.notes",
"name": "Example Notes",
"version": "1.0.0",
"publisher": { "name": "Example Co" },
"description": "A small text editor.",
"license": "MIT",
"icon": { "lucide": "notebook" },
"permissions": ["storage:own"]
}Field names come from the installer note; check it for the exact schema, entry points and limits. The guest side of the installer is written but not yet run in a VM.
Tools.
Fast reload
Boot once, save a snapshot, and reload new code in about 20 seconds.
Benchmarks
Press b in the desktop for twelve scenarios, with the Monitor app showing frame times.
kslint
Catches the dialect traps below: U64 multiplies, continue, zero-assumed locals and stray dollar signs.
Parity gate
Golden scenes compared on x86 and the native build, with a pixel diff.
Headless drivers
Scripted runs on the native build for icons, fonts, browser, sheet and more.
Gotchas, in one table.
The dialect differences that have already cost us time.
| Trap | What to do |
|---|---|
U64 multiply truncates to 32 bits on arm64 | Use I64 for products. |
| Locals are not zeroed on the native build | Initialise every local. |
No continue in either build | Use a goto or restructure. HC+ plans the keyword. |
| Shifts bind tighter than multiply | Parenthesise any expression that mixes them. |
$ starts a DolDoc command | Write $$ in strings and comments. |
| Source is ASCII | Other characters become hyphens. |
PrintF with several arguments fails on the native build | Use Say or StrPrint. |
Trust is part of the product.
More in Security.
Say what you need
Permissions are plain words with one sentence each. Ask for less and installs go smoother.
Sign your releases
A known key makes the install sheet calm. A new key asks the user to trust you.
Be honest about limits
The sheet itself says a HolyC app has no memory protection. Do not claim otherwise.
0seconds to reload your change
0seconds to the native desktop
0benchmark scenarios
0installer tests
Start with the language.
The reference is short, and the compiler is live.