[bobleer]

Summary

Mac Desktop controlling a Linux CLI host now opens unsupported PR/MR links in the controller's default browser, can browse the peer's file tree, and can preview complete HTML pages from the peer's workspace. HTML previews also resolve CSS/JS/images correctly for nested build output in local and SSH workspaces. Ordinary CLI and daemon hosts now start the existing Cron service instead of exposing a tool that fails with cron service not initialized.

Type and Areas

Type: bug fix

Areas: Peer Device, Web UI, CLI bootstrap, workspace filesystem, HTML preview, scheduled jobs

Behavior

• Gate PR links, overview requests, tool-card actions and restored panels by the peer's review capability. Preserve supported Desktop behavior and legacy Desktop compatibility. Scope cached review data, remembered Git remotes and asynchronous results to the selected device, retaining migration of local preferences.
• Route current explorer_get_* and legacy directory/tree commands to the CLI's existing workspace-aware filesystem service. Keep registry declarations and dispatch handlers in sync. Legacy read/write/rename requests use their actual filePath/oldPath for connection resolution instead of requiring an unrelated path field.
• Keep HTML HTTP listeners and native browser views on the controller. Share workspace-confined resource reads between Desktop and CLI, including each host's SSH workspaces; negotiate workspace_html_preview_v1 before using the peer channel. Old peers get an explicit upgrade message. No read falls back to the controller filesystem.
• Resolve /assets/... beside the selected HTML before falling back to the workspace root; retain workspace-relative document URLs for relative and parent-relative imports. Use distinct preview cookies, bounded 256 KiB chunks, source/revision checks, and cancellation on close/device switch. Offline resource reads fail explicitly and can be retried after reconnect.
• Embedded interactive, daemon and execution CLI hosts initialize the existing Cron service, subscribe to lifecycle events and start scheduling after setup. Persisted tasks survive restarts and run without a live controller. Shared TUI, ACP and stdio server remain explicitly unsupported; exec does not wait for future timers. Unreadable or future-version task stores remain unchanged and do not prevent normal CLI turns.
• Include minimal fixes for CI test fixtures and model-selector lint failures encountered while validating the PR. Upstream's default-stack cold-start fix is retained; no global test-stack increase remains.

Verification

Passed locally:

• PR routing, overview, restored-panel, preference migration, device-switch, tool-card and model-selector focused frontend regressions (commands and test cases are in the Web UI owner guide).
• HTML preview frontend tests: 10 passed; focused lint, pnpm run check:web, pnpm run build:web passed.
• CLI Peer Host: 105 passed, including real directory listing, pagination and nested tree results.
• Desktop HTML preview: 7 passed, including real loopback HTTP and an encrypted loopback Relay transfer larger than one resource chunk.
• HTML workspace binding: 2 passed; resource service: 5 passed; remote-surface contracts: 20 passed; minimal HTML request round trip: 1 passed.
• Real OpenSSH SFTP over loopback SSH: nested root-relative and parent-relative assets, binary resources, multi-chunk content and traversal rejection passed using openssh_html_preview_reads_nested_site_resources -- --ignored.
• Native macOS browser: node tests/e2e/scripts/run-html-preview.mjs passed with a freshly built Desktop and Web UI. It verified applied CSS, module execution, dynamic imports, images, encoded filenames and reloading the first of two concurrent previews, using isolated storage.
• Real CLI subprocess/PTY scheduled-job create, list, restart, unattended due execution and completion persistence tests passed with a mock model. Future-version stores remain unchanged; 37 Cron/legacy/remote-workspace contract tests passed.
• Subscription authentication (137 passed) and health checks (8 passed); i18n audit and full frontend lint passed before the HTML changes, which add no locale keys.
• Capability generation/check, core boundaries, repository hygiene, Rust formatting, diff checks and Git object size checks passed.

Final head 1dcc09437d250ad845357c8875e3521cb16f0d46 passed the complete three-platform CLI and Rust checks, frontend build/tests, and aggregate validation in CI run 40632850257. The two impact-gated packaging/contract jobs were skipped by the existing workflow rules.

Remote evidence: SSH was exercised through a real loopback SSH/SFTP transport; peer resource transfer used the actual encrypted Relay/HTTP transport with a fixture host; native browser execution ran on macOS. A physical Mac-to-Linux session, mobile/bot Remote Control, and Detached Dispatch were not exercised. These tests do not claim a full live multi-machine UI acceptance run.

Reviewer Notes

AI-assisted change. No new runtime dependencies or destructive persisted-data migration. New request fields default when omitted; peer functionality is explicitly negotiated. The preview resource limit remains 64 MiB. Remote symlink resources remain explicitly rejected.

Checklist

• Changes contain no secrets, temporary prompts, generated scratch files or unrelated artifacts.
• Relevant verification and its limits are recorded above.
• Owning docs and generated capability/operation contracts are updated.