[ymote]

Adds the AI providers system app to the desktop. main already hosts the system apps (App Hub's Card runner, the Mail host service, runtime Octoscript-Makepad 463e3da8 / makepad cd812acd, opt-in AppCard), so this PR is now a small addition on top of it (rebased onto #46). It was rebuilt from main: the old system-apps wiring, the runtime patch and the App Hub alias are gone.

What changes

• Pins: none. main (App Hub 3e993d4c, System-Apps c0f2199c #46) already pins OctoSense-System-Apps c0f2199c, which carries the AI providers bundle, octosense-llm-service and octosense-llm-config, and App Hub 3e993d4c. That App Hub rev includes the llm capability and is the rev the Mail and llm services pin, so there's still one App Hub and no [patch] alias.
• system-apps.json: adds ai-providers.
• app-hub feature: also links octosense-llm-service and octosense-llm-config.
• register_host_services (src/apps.rs): registers llm next to Mail with these options:
  • the core dir is the AppCard kernel's octos home (OCTOS_APP_CORE_DIR, else ~/octos-home/.octos);
  • image picker: the macOS open panel, filtered to PNG and JPEG;
  • image drops: a screenshot dropped on the AI providers window while the import sheet waits (src/llm_image.rs);
  • OCTOSENSE_LLM_TEST_IMAGE answers a pick in hidden test runs;
  • on_changed restarts the running AppCard module so its kernel reads the new profile. This hook is registered only with --features app-appcard; otherwise there's nothing to restart.
• Start → Settings: becomes Appearance plus AI providers once the build ships the app.
• Scripts: scripts/system_apps_remote.sh and scripts/ai_providers_remote.sh are hidden --remote end-to-end runs. Each uses a temp home, a temp octos dir and file vaults; the AI providers run also uses fake keys only and runs under sandbox-exec with outbound 443 denied.
• README (en/zh): updated to match.

Verification (macOS, runtime at the lock's makepad cd812acd)

• Build checks:
  • cargo check --locked --features mobile-apps passes.
  • cargo tree -i octos-core finds no match (host and aarch64-linux-android), so AppCard stays opt-in.
  • cargo check --locked --workspace --features mobile-apps,app-appcard passes.
  • tools/setup-native.py --check passes, and the graph has one makepad and one App Hub source.
• Tests: 229 pass with default features, 231 with mobile-apps, and 232 with mobile-apps,app-appcard.
• system_apps_remote.sh: 3 green runs out of 4. The one failure was a 439 ms hang in macOS's own theme loading (CoreUI) on the first native event, unrelated to this change. Each green run covers:
  • the launcher lists news, photos, maps, camera, mail and ai-providers;
  • Photos draws;
  • Mail's host sign-in sheet opens;
  • AI providers runs under storage + llm;
  • bundles and jails land in the right places;
  • there are no panics.
  • One change: the Card runner building an app's first Splash VM on the UI thread (~300 ms) is now listed as a known first-open hang, next to the bundle unpack.
• ai_providers_remote.sh: 2 green runs of 14 steps each:
  • the add wizard (DeepSeek, then Z.ai against a local fake endpoint);
  • the model pull-down;
  • paste, drop and picker imports of the QR-A fixture, including a wrong PIN;
  • the phone-QR export, read back from the grab and matching _main.json, with the countdown auto-closing;
  • no key text in the UI tree or the logs; no panic or Splash error.

Depends on (all merged)

• OctoSense-System-Apps#1 and Fix Windows startup stack overflow #10 (c0f2199c, pinned by App Hub 3e993d4c, System-Apps c0f2199c #46)
• OctoSense-App-Hub#11 and appcard: an in-process module that renders an L0 card in a tile (Phase A) #12 (3e993d4c, pinned by App Hub 3e993d4c, System-Apps c0f2199c #46)

Known gaps

• AppCard restart: only in-process AppCard module instances are restarted. An AppCard running as a separate process reads the new providers when it next starts.
• No camera scanner on the desktop: import is from an image, or by pasting the code.

🤖 Generated with Claude Code