test: virt monitor e2e on sbm_virt's contracts - #1658

…re an app in a window

Snippets run in the terminal they open; terminal notices before a session and no toolbar over the shell; Files opens on tap and Enter, keeps its history on a failed step; Access needs an agent that names the caller; process names never collapse and show the command; Virt's New goes to guests; modals scroll inside their window; split views fold out of the keyboard's way and scroll once; Status refreshes in place.

…ts in the apps

Opaque windows and panels with hairlines and soft shadows, frosted menubar
and dock, berry accent by default, neutral app tiles, panels over the dock
with an eyebrow and title, a split sign-in screen, SVG wallpapers. Inside
the desk the shared kit's tokens follow the desk's palette and accent;
Button and IconButton take tokens whose defaults keep the website as is.
New ui pieces: Section, Segmented, StatusPill, boxed SourceGroup. An empty
app toolbar draws nothing. The desk's rules file is now tracked.

Tokens, base and lk-* component styles scoped to .lk, dark via data-theme on
<html>; Svelte components for every part of the system (desk/lk); Figtree,
JetBrains Mono and Material Symbols Rounded bundled, the Google Fonts link
dropped. The shell is rebuilt on it: full-width glass menubar, dock of
berry app icons with launch bounce, windows with traffic lights in an inset
glass sidebar and the app's title and tools in the title bar (registered
through useWindow().chrome), full-screen launchpad, Spotlight, control
centre tiles, notifications, lock screen. Old ui pieces are TODO-remove shims
on lk classes until the apps move over.

…7px inset

Apps, shared components (charts, terminal, VNC, disclosure, OS icon) and
dialogs use desk/lk only: Material Symbols glyphs, flat cards, badges,
segmented controls, sidebars in the window's inset sidebar, two-word empty
states. lk gains Textarea and Spinner; glyphs are drawn by CSS so their
names never join an accessible text; a clickable Card can announce its
selection as current. The accent picker is gone (one seed); the stored
value is kept. Unused translation keys removed; the new ones in every
locale. The dev server can proxy to another agent (SBM_DEV_AGENT).

Apps register by manifest (apps/<id>/manifest.ts, defineApp) and reach the
desk only through sys: window state, app name/icon/badge, menubar menus
with shortcuts, lifecycle with suspension when background running is off
(Settings > Apps, stored as desk preference background, migration 019,
feature desk_background). Lint keeps apps off the shell and each other.
Design and phases: docs/dev/desk-sys.md.

…k rows

Settings > Apps gains a background switch per app (background_denied,
migration 020); Control Centre lists apps running hidden. Apps post
notifications that bring their window forward, keep JSON per account
(/desk/apps/{app}/storage, migration 021, feature desk_storage) and add
rows to their dock menu. Pins the checksums of migrations 019-021.

An app opens another with an intent delivered once to the new window
(useIntents); Snippets hands its steps to Terminal that way instead of a
shared module slot. Manifests say what they open; Files lists them under
Open with. A manifest's settings page shows in Settings > Apps, run as
its app.

Admins upload .sbapp packages (checked whole: regular files, plain paths,
bounded while inflating), approve their permissions with a password, and
the UI is served under an HMAC launch ticket with a sandbox CSP and no
network. Web apps only until the agent runs backends.

The desk registers the agent's approved apps and runs each in an iframe
with an opaque origin, answering its bridge messages within its approved
permissions; intents carry their sender so Terminal types only for
Snippets. Settings > Apps installs, approves and removes packages with the
admin's password. Adds an example app.

A wasm package's backend.wasm runs in wasmi on the agent, one instance
per call, bounded by fuel, wall time and memory. Its host functions (kv,
status, fs.list/read, exec) need the app's approved permission and the
calling account's grant. The bridge reaches it with backend.call. Adds a
Rust example.

@lollipopkit/desk-sys is the frame side of the app bridge and holds the
one copy of its protocol; a vite template packs a .sbapp. The SDK is
tested against the desk's bridge. Not published.

- A guest re-entering sbm.host traps instead of overflowing the stack.
- Inflating a package is bounded headers included, off the worker.
- The bridge talks over a MessagePort given to the frame's first page;
  a frame that navigates away is dropped.
- Approvals and launch tickets name the package's SHA-256: new code
  always waits for approval.
- Backend calls are limited per agent and account; the clock is checked
  per host call; fs.read takes regular files only; logs drop controls.
- appState is capped at 16 KiB and opens are rate limited in the bridge.
- Built-in ids are reserved; removing an app removes its storage; app
  storage is capped per account.

…design

The window's title bar floats over the content and turns to glass once it
scrolls (or always, a per-browser choice); the sidebar floats inset; an
app may give the bar a heading, make it flush over a table, and add a
footer (sys.WindowFooter). lk gains DataTable, StatTile, LegendChip,
SearchField, ToolbarGroup, StatusBar and NotificationCenter; Group/Row
use the settings group styles. The window area keeps room for a dock on
the left, bottom or right.

…w design

The menubar leads with the server and its live dot, then the front app
(icon and name), its menus, Window and Help; on the right a CPU reading
with the machine at a glance, search, Control Centre, notifications and
the clock. The dock sits left (default), at the bottom or right, can
hide itself and has three icon sizes; with the title bar style these are
per browser (Settings > Appearance). Notifications open as the design's
notification centre with Do Not Disturb.

Other locales get the new keys in a later pass.

Processes: one DataTable of the columns the machine printed, sorted by
the header (the agent's orders), search and kernel threads in the bar,
reading again every 5 s while shown unless paused; a stop is asked in
the status bar, the root retry in a dialog.

Services: state and type in the sidebar, a table with state dots, the
selected unit's facts and actions over the status bar, its log in a
dialog; the listing's notice opens from the status bar.

The machine's name and state lead; stat tiles (CPU and memory open
Processes in that order, the rest their detail) keep the shared card
order; one usage chart with legend chips over a 1 h / 24 h / 7 d range
and a reading under the pointer; network, the busiest processes, system
information and custom commands in cards below. Refresh pauses from the
bar; terminal, files, iperf, power and every reading's detail move to
the View and Go menus. Processes opens in the order it was asked for.

The runtime and version head the sidebar (containers, images with
counts); each list is a table, the selection's actions and logs sit
over the status bar, which carries the store's usage and the second
prune. Run and pull lead the bar; File holds every prune.

Back/forward as a capsule beside the path in the title bar (the folder
in bold), list or grid and new folder/upload at the right; the list is
a sortable table (folders first), the grid big glyph tiles; the sidebar
adds the disk's free space; the status bar counts the folder and names
the selection, with its menu for pointers that cannot right-click. A
tap on a touch screen opens a table row.

Settings' column sits left under the title, groups in the design's
settings cards; the theme moves to Appearance with the title bar and the
dock; sidebar glyphs as designed. Processes, Services and Containers
take the design's icons.

…icon

44 keys no code reads any more (the old page layout's, and those the
redesigned apps dropped) go from every locale. Virtualization and
Containers no longer share a glyph.

Showing it scheduled its own hiding at once; it now stays out while the
pointer is on the dock or the edge strip, and goes 500 ms after it
leaves (or after a menu it opened closes elsewhere).

…ner backups

- catalog: shipped, the store's repositories (cached), [stacks] local_apps
- test web app and a real-Docker e2e (install, proxy, settings, ports,
  health, backup and restore, purge)
- health watch with desk notifications; update notices; [compose] jobs
- apps by host ([stacks] apps_url), Partitioned cookies, entry origin
- container backups of volumes and bound folders in the Containers app
- panel build id and reload notice; make monitor-deploy
- WSL GPU processes from /dev/dxg holders
- i18n for the new keys in every locale

… and retention for container backups

Also: localized agent notifications, Docker e2e in CI, user docs for monitor apps, icon font core subset.

…lapping devices and backups to a missing disk, stop StackProgress polling after a job ends

… growing arrays and pools, Sharing app (SMB/NFS), storage and sharing e2e

… details, Sharing connections/Time Machine/recycle, firewall hand-off, storage and shares over FFI

- storage: one view read (`view_command`/`parse_view`) and `check` shared by the agent and FFI; LUKS2 format/unlock/lock with a 0600 key file; grow a partition; ZFS replace, attach, spares, online, remove; SMART attributes and self-tests
- shares: Time Machine (fruit) and recycle bin, who is connected (SMB, NFS), opening the firewall from Sharing
- sbm_ffi: storage and shares APIs for the app
- e2e: RAID5 grow, LUKS, partition grow, ZFS ops, watch alerts; password fields filled without focus (macOS Secure Input)
- icons.py writes fonts without a timestamp

… build; pack the theme store from the working tree

# Conflicts:
#	crates/sbm_ffi/src/frb_generated.rs
#	crates/sbm_native/src/lib.rs
#	crates/sbm_native/src/linux.rs
#	monitor/CLAUDE.md
#	monitor/frontend/src/pages/ServerSettings.svelte
#	monitor/src/monitoring/monitoring.rs

…ition; testparm case; results kept per suite

# Conflicts:
#	Cargo.lock
#	docs/astro.config.mjs
#	docs/src/content/docs/changelog.mdx
#	docs/src/content/docs/development/monitor-agent.md
#	docs/src/content/docs/zh/changelog.mdx
#	docs/src/content/docs/zh/development/monitor-agent.md
#	lib/generated/l10n/l10n.dart
#	lib/generated/l10n/l10n_az.dart
#	lib/generated/l10n/l10n_de.dart
#	lib/generated/l10n/l10n_en.dart
#	lib/generated/l10n/l10n_es.dart
#	lib/generated/l10n/l10n_fr.dart
#	lib/generated/l10n/l10n_id.dart
#	lib/generated/l10n/l10n_it.dart
#	lib/generated/l10n/l10n_ja.dart
#	lib/generated/l10n/l10n_ko.dart
#	lib/generated/l10n/l10n_nl.dart
#	lib/generated/l10n/l10n_pt.dart
#	lib/generated/l10n/l10n_ru.dart
#	lib/generated/l10n/l10n_tr.dart
#	lib/generated/l10n/l10n_uk.dart
#	lib/generated/l10n/l10n_zh.dart
#	lib/l10n/app_az.arb
#	lib/l10n/app_de.arb
#	lib/l10n/app_en.arb
#	lib/l10n/app_es.arb
#	lib/l10n/app_fr.arb
#	lib/l10n/app_id.arb
#	lib/l10n/app_it.arb
#	lib/l10n/app_ja.arb
#	lib/l10n/app_ko.arb
#	lib/l10n/app_nl.arb
#	lib/l10n/app_pt.arb
#	lib/l10n/app_ru.arb
#	lib/l10n/app_tr.arb
#	lib/l10n/app_uk.arb
#	lib/l10n/app_zh.arb
#	lib/l10n/app_zh_tw.arb
#	monitor/Cargo.toml
#	monitor/frontend/package-lock.json
#	monitor/frontend/package.json
#	packages/fl_lib

…archable list

- recover() cleans chats/<id>/ (sessions/ kept for the move, TODO remove)
- piSessions (migration 029, off by default): each task also written as a v3
  session file in pi's directory for the agent's account, so pi -r lists it
- GET /agent/flows: limit/before cursor and q (title or line); no limit is all
- panel: the switch in Settings > Agent, 15 locales

The history lists each agent's tasks beside this device's chats, filtered by
source, paged as it scrolls, searched on the agents; a task opens in the pane,
followed live, with its pending answers (confirm, danger, sudo, clarify) and
replies. fl_pi_llm on pi-durable.

agent_flow.model/thinking_level (migration 030), NULL is the machine's.
POST /agent/flows and /reply take them, checked against GET /agent/choices
(the models whose provider has a key, the thinking levels; never a key).
Panel: model and thinking menus in both composers.

…r agent's task

…d skills

- store/apps: AdGuard Home, Syncthing, OpenList, qBittorrent, Transmission,
  AriaNg, Jellyfin, Calibre-Web, Komga, Navidrome, Uptime Kuma, Nextcloud,
  Vaultwarden, Home Assistant, Memos, FreshRSS, Stirling-PDF, code-server;
  titles are the projects' own names (Immich too)
- stacks: shared folder, SBM_UID/GID/TZ/RENDER_GID, UDP and low ports,
  [login] revealed to an admin, compose `build:` from a package Dockerfile,
  proxy-side basic auth, a window for every deployed app
- agent mode: MCP servers and GitHub skills (fl_pi_llm host), deployed apps
  in the system prompt, compose reads counted as reads

…s and MCP via fl_pi_llm Rust

…xts for wasm apps