fix(remote): restore CLI capabilities and complete HTML previews

docs/interactive-capabilities/README.md

@@ -27,9 +27,9 @@ OpenBitFun Playbook currently contains **23 features**, **21 settings pages**, a
 - Generated per-item interaction audit: `docs/interactive-capabilities/technical/product-control-open-audit.json`
 - Generated low-level audit map: `docs/interactive-capabilities/technical/tauri-command-map.json`
 
-说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **705** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
+说明书、网站、搜索和智能体只看“功能 + 设置 + 子能力”。每项子能力都必须引用已注册 Tauri Command 或可解析的源码标记；这些证据不会进入公开目录。当前 **706** 个 Tauri 命令只用于实现覆盖审计。产品 UI 交互源码会在生成和检查时扫描并校验，但不会保存成随普通 UI 改动频繁变化的版本化快照。
 
-Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **705** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
+Docs, website, search, and agents see only features, settings, and documented sub-capabilities. Every sub-capability must reference a registered Tauri command or a resolvable source marker; evidence is stripped from public projections. The **706** Tauri commands remain implementation-audit evidence only. Product UI interaction sources are scanned and validated during generation and checks, but are not stored as a versioned snapshot that churns with ordinary UI changes.
 
 ## 控制边界 / Control boundary
 

docs/interactive-capabilities/technical/tauri-command-map.json

@@ -2,12 +2,12 @@
   "schemaVersion": 2,
   "generatedFrom": "src/shared/interactive-capabilities/catalog.json",
   "catalogDigest": "40fada109d5dbcfdbc1b289af574f7ac736da1620d4eee26128a40d3f0f5818c",
-  "commandCount": 705,
+  "commandCount": 706,
   "coverage": {
-    "commandCount": 705,
+    "commandCount": 706,
     "documentedCommandCount": 646,
-    "implementationCommandCount": 59,
-    "implementationDigest": "0bce9fbda3e8b517e409aec124ca0f2c3b36a7954d996400d9ccf405194dc768"
+    "implementationCommandCount": 60,
+    "implementationDigest": "5047b674e890f899e65baf9235e9df4bd912fa28f44eb10a656e079a1b89974d"
   },
   "commands": [
     {
@@ -5011,6 +5011,20 @@
       "signature": "fn html_preview_create( app_state: tauri::State<'_, AppState>, request: HtmlPreviewCreateRequest, ) -> Result<HtmlPreviewCreateResponse, String>",
       "remoteWorkspacePolicy": "RemoteRouted"
     },
+    {
+      "id": "html_preview_read_resource",
+      "moduleId": "html_preview",
+      "capabilityId": "feature.files-editor",
+      "capabilityIds": [
+        "feature.files-editor"
+      ],
+      "documentedItemIds": [],
+      "visibility": "implementation",
+      "rustPath": "api::html_preview_api::html_preview_read_resource",
+      "sourceFile": "src/apps/desktop/src/api/html_preview_api.rs",
+      "signature": "fn html_preview_read_resource( request: HtmlPreviewResourceRequest, ) -> HtmlPreviewResourceReply",
+      "remoteWorkspacePolicy": "RemoteRouted"
+    },
     {
       "id": "html_preview_release",
       "moduleId": "html_preview",

src/apps/cli/AGENTS.md

@@ -158,6 +158,20 @@ For streaming `exec` retry, context recovery, and final-event contracts:
 cargo test --locked -p openbitfun-cli --test cli_command_contracts exec_cli_contracts::stream_json_
 ```
 
+For scheduled-job bootstrap, persisted tasks, and unattended execution after a
+CLI restart (with a mock model and a real CLI process):
+
+```bash
+cargo test --locked -p openbitfun-cli --bin openbitfun bootstrap_profile_tests::
+cargo test --locked -p openbitfun-cli --test terminal_process_contracts scheduled_jobs_
+cargo test --locked -p openbitfun-cli --test cli_command_contracts scheduled_jobs_
+```
+
+Embedded Interactive/Execution bootstrap wires the existing Core Cron service,
+subscribes to turn lifecycle events, and starts scheduling after host setup.
+Shared TUI must not claim the host-wide scheduling lease: its workspace scope and
+last-controller idle shutdown cannot own all persisted jobs.
+
 For ACP stdio session restore, duplicate-load rejection, history replay and close:
 
 ```bash

src/apps/cli/README.md

@@ -94,6 +94,23 @@ is not automatic restart/recovery. Review the saved session and explicitly resum
 after an interruption. Completion still depends on the model verifying the user's
 requirements against real evidence; the runtime does not prove arbitrary tasks.
 
+### Scheduled tasks
+
+The Agent can create, list, edit, remove, and run scheduled tasks through the
+`Cron` tool in ordinary interactive CLI sessions and Peer Device sessions hosted
+by that CLI, including the always-on `daemon run` host. The executing host owns
+the schedule; a remote controller does not need to stay connected. Existing
+workspace and permission rules still apply.
+
+Keep the CLI host running until tasks are due. Schedules survive process restarts,
+and due tasks resume when a scheduling host starts again. `exec` also exposes
+`Cron`, but exits after its turn; it does not stay alive to wait for future tasks.
+Shared TUI (`--shared`), ACP, and the stdio `server` host do not start a scheduler.
+
+Only one process schedules tasks for a shared user data directory. If another
+CLI or Desktop instance already owns scheduling, this instance can list tasks
+but cannot edit or manually run them. It takes over after the owner exits.
+
 ### Prompt continuity
 
 Unsent drafts stay with their session while the TUI remains open. Switching,

src/apps/cli/src/main.rs

@@ -616,6 +616,19 @@ impl BootstrapProfile {
         matches!(self, Self::Interactive | Self::Execution)
     }
 
+    const fn starts_scheduled_jobs(
+        self,
+        deployment: openbitfun_services_core::runtime_ownership::RuntimeDeployment,
+    ) -> bool {
+        // Shared TUI owns one workspace and exits after the last controller
+        // disconnects. It cannot own the host-wide durable scheduler lease.
+        matches!(self, Self::Interactive | Self::Execution)
+            && matches!(
+                deployment,
+                openbitfun_services_core::runtime_ownership::RuntimeDeployment::Embedded
+            )
+    }
+
     const fn starts_plugin_host(self) -> bool {
         matches!(
             PLUGIN_HOST_LAUNCH_POLICY,
@@ -960,6 +973,19 @@ async fn initialize_core_services_for_deployment(
     tracing::info!("Agentic system initialized");
 
     let workspace = create_cli_local_workspace(workspace_root).await?;
+    let scheduled_jobs = if bootstrap_profile.starts_scheduled_jobs(deployment) {
+        match runtime::initialize_scheduled_jobs(&agentic_system).await {
+            Ok(service) => Some(service),
+            Err(error) => {
+                tracing::warn!(
+                    "Scheduled jobs are unavailable; persisted jobs were preserved: {error:#}"
+                );
+                None
+            }
+        }
+    } else {
+        None
+    };
     let runtime = std::sync::Arc::new(runtime::CliRuntimeContext::build(
         agentic_system,
         workspace,
@@ -998,6 +1024,11 @@ async fn initialize_core_services_for_deployment(
         }
     }
 
+    if let Some(scheduled_jobs) = scheduled_jobs {
+        scheduled_jobs.start();
+        tracing::info!("CLI scheduled-job service started");
+    }
+
     Ok(runtime)
 }
 
@@ -1973,6 +2004,12 @@ mod bootstrap_profile_tests {
             );
             assert_eq!(profile.starts_mcp(), starts_mcp);
             assert_eq!(profile.starts_plugin_host(), starts_plugin_host);
+            use openbitfun_services_core::runtime_ownership::RuntimeDeployment;
+            assert_eq!(
+                profile.starts_scheduled_jobs(RuntimeDeployment::Embedded),
+                starts_mcp
+            );
+            assert!(!profile.starts_scheduled_jobs(RuntimeDeployment::Shared));
         }
     }