feat(daemon): actualize desktop daemon branch

Signed-off-by: Alexey Zhokhov <alexey@zhokhov.com>
Co-authored-by: Codex <codex@openai.com>

Author: donbeave

docs/src/content/docs/reference/roadmap.mdx

@@ -88,11 +88,11 @@ jackin' is a functional proof of concept, not a stable product line. **`Claude C
 
 ### Reactive daemon program
 
-- **[jackin' daemon — umbrella](/reference/roadmap/jackin-daemon/)** — introduce the long-running per-operator-user host process jackin' will use for reactive features. One umbrella item that decides lifecycle, install method, control socket, security posture, and log redaction once so each reactive feature plugs into one daemon shape. The full list of phase-2/phase-3 reactive adapters lives in the program doc and the sidebar under **Reference → Roadmap → Reactive daemon program** (status: open — design proposal)
-- **[jackin' Desktop Agent Hub](/reference/roadmap/jackin-desktop-agent-hub/)** — native macOS menu bar and desktop companion for active jackin' workspaces, isolated agent sessions, PR jump links, and built-in-runtime account state (Claude, Codex, Amp, Kimi, OpenCode), with CodexBar and OpenUsage as scoped references for account quota surfaces. Keeps the agent TUIs as the primary agent UI while using the daemon as the shared state/event backend (status: open — design proposal)
+- **[jackin' daemon — umbrella](/reference/roadmap/jackin-daemon/)** — long-running per-operator-user host process for reactive features. The base lifecycle, socket protocol, Desktop read/action methods, notification bridge, keep-awake reconciliation, and cache warmup are implemented; Capsule-backed live session indexing, real event streaming, live auth sync, quota telemetry, and approved host actions remain open. The full list of remaining reactive adapters lives in the program doc and the sidebar under **Reference → Roadmap → Reactive daemon program** (status: partially implemented)
+- **[jackin' Desktop Agent Hub](/reference/roadmap/jackin-desktop-agent-hub/)** — native macOS menu bar and desktop companion for active jackin' workspaces, isolated agent sessions, PR jump links, and built-in-runtime account state (Claude, Codex, Amp, Kimi, OpenCode), with CodexBar and OpenUsage as scoped references for account quota surfaces. The menu bar foundation consumes the daemon; the full Desktop window, Capsule-backed live state, quota telemetry, and attention routes remain open (status: in progress)
 - **[Live bidirectional auth sync](/reference/roadmap/live-auth-sync/)** — Phase 2 adapter. Keep host and every running container in lock-step on each auth axis (`gh`, Claude, Codex, Amp, …). Subsumes the launch-time `sync` mode's bidirectional follow-up; reconsiders the `sync` name in the process (status: open — design proposal)
 - **[Agent runtime status authority](/reference/roadmap/agent-runtime-status/)** — Phase 2 state source. Herdr-class in-container authority for `working`, `blocked`, derived `done`, `idle`, `unknown`, and stuck diagnostics, informed by multicode, CCManager, Agent Session Manager, WezTerm Agent Deck, ccmux, TUICommander, Codemux, and tmux-agent-status. Uses semantic runtime hooks/APIs, foreground-process ownership, visible-screen signals, shell markers, and cursor/readiness probes instead of treating PTY silence as attention-needed (status: open — design proposal)
-- **[Agent attention prompts](/reference/roadmap/agent-attention-prompts/)** — Phase 2 adapter. Host-side OS notifications when an agent inside a Capsule-managed role container is waiting on operator input or has finished unseen work. Consumes the agent runtime status authority, escalates from silent toast to sound after a configurable timeout, and focuses the right terminal tab where supported. Targets the biggest operator throughput drag: idle wall-clock waiting on agents that don't surface their waiting state (status: open — design proposal)
+- **[Agent attention prompts](/reference/roadmap/agent-attention-prompts/)** — Phase 2 adapter. Host-side OS notifications when an agent inside a Capsule-managed role container is waiting on operator input or has finished unseen work. The daemon notification bridge and in-container `jackin-notify` helper have landed; Capsule status events, MCP enrichment, click-to-focus activation, and policy UI remain open (status: in progress)
 - **[Host bridge — secrets and approved host actions](/reference/roadmap/host-bridge/)** — Phase 3 adapter. Operator-mediated channel for agents to request a single secret value or invoke a single host command without tearing down the container. Auto-registered MCP server, TouchID / polkit / password approval per request, per-workspace allowlist / blocklist / disabled policies, audit log. Closes the *"agent needs one thing from the host, mid-session"* gap that today forces full-restart workarounds (status: open — design proposal)
 - **[Container credential exposure — beyond env injection](/reference/roadmap/container-credential-exposure/)** — Phase 3 follow-on. Auth tokens and operator env values resolved from `op://` references become agent-readable when exported into the container today. Captures the trajectory from documented exposure to file-mount compatibility, command-scoped secret handles, Docker Sandboxes-style credential proxying, and daemon-mediated `secret.request` / `secret.run` grants where the agent gets a handle rather than the raw value (status: open — design proposal)
 

docs/src/content/docs/reference/roadmap/agent-attention-prompts.mdx

@@ -136,7 +136,7 @@ The bet of jackin' is that running many agents safely and conveniently changes h
 
 ## Related work
 
-- [jackin' daemon](/reference/roadmap/jackin-daemon/) — host-side process this feature plugs into. Phase 1 daemon must ship before this adapter can.
+- [jackin' daemon](/reference/roadmap/jackin-daemon/) — host-side process this feature plugs into. The base notification bridge exists; the real Capsule-backed event stream remains open.
 - [Live bidirectional auth sync](/reference/roadmap/live-auth-sync/) — sibling feature plugging into the same daemon; sets the precedent for per-axis adapters.
 - [jackin' Desktop Agent Hub](/reference/roadmap/jackin-desktop-agent-hub/) — native macOS surface that should display attention/ready-for-review state and owns the first Ghostty click-to-focus UX.
 - [Agent runtime status authority](/reference/roadmap/agent-runtime-status/) — canonical source for `blocked`, derived `done`, `idle`, `working`, `unknown`, and stuck diagnostics. Attention prompts consume this stream; they do not infer state independently.

docs/src/content/docs/reference/roadmap/jackin-daemon.mdx

@@ -5,7 +5,7 @@ import { Aside } from '@astrojs/starlight/components'
 import RepoFile from '../../../../components/RepoFile.astro'
 
 
-**Status**: Implemented — phase 1 base daemon landed
+**Status**: Partially implemented — base host daemon, first Desktop API surface, and notification bridge implemented; real event streaming, Capsule aggregation, live auth sync, and provider quota telemetry remain open.
 
 ## Problem
 
@@ -18,9 +18,11 @@ A handful of these features have already accumulated:
 - **Container event watcher (future).** Surface launch failures, OOM kills, agent process exits to the operator without requiring an open `jackin console` session. Today these only surface when the operator next runs `jackin console` or `gh pr checks`-style polling on the CLI.
 - **Cross-session notifications (future).** Ping the operator when an agent in a backgrounded session needs attention (sensitive-mount confirmation, auth re-prompt, network-policy violation).
 
-The pattern: each new feature that wants to **react to events instead of waiting for the next command** independently invents its own "what if jackin had a daemon" workaround. That doesn't scale.
+The pattern: each new feature that wants to **react to events instead of waiting for the next command** independently invents its own "what if jackin' had a daemon" workaround. That doesn't scale.
 
-This roadmap item introduced **the jackin' daemon** as a first-class concept the rest of the project can compose on. The initial implementation ships the daemon bones and the first host adapters:
+This roadmap item introduced **the jackin' daemon** as a first-class concept the rest of the project can compose on. The implementation now restores the host-daemon plan on top of the newer jackin' architecture: the Capsule is the in-container session authority, the runtime instance model owns durable identity, and the host daemon is the per-user aggregator / action surface rather than a host-side PTY scraper.
+
+Current shipped pieces in this implementation:
 
 - `jackin daemon serve` / `start` / `stop` / `restart` / `status` / `logs` / `install` / `uninstall`.
 - A per-user Unix domain socket at `~/.jackin/run/jackin-daemon.sock`.
@@ -30,13 +32,23 @@ This roadmap item introduced **the jackin' daemon** as a first-class concept the
 - Periodic cache warmup for the construct image, `docker:dind`, and any cached role manifest `published_image`.
 - macOS Notification Center notifications through the daemon via `jackin daemon notify` and the in-container `jackin-notify` helper. High urgency requests the native `Glass` sound.
 - A container bridge: running roles receive `JACKIN_DAEMON_SOCKET=/jackin/daemon.sock` and the host daemon socket bind-mounted at that path when the daemon is available.
+- Desktop-facing read/action methods for `daemon/hello`, saved workspace summaries, running session labels, GitHub PR lists, Ghostty/browser open actions, credential-source presence, and the first attention-route polling contract.
+
+## Architecture reset after Capsule
+
+The original daemon roadmap predates the shipped `jackin-capsule` multiplexer. That changes the daemon boundary:
+
+- The Capsule owns PTYs, panes, session lifecycle, snapshots, and future runtime state authority inside each role container.
+- The host daemon should subscribe to Capsule control sockets and maintain a cross-instance index. It should not infer agent state by scraping rendered terminal text or shelling into containers for tmux state.
+- Docker labels remain useful for cheap discovery (`workspace/list`, `session/list`) and stale/fallback state, but the authoritative live session tree comes from Capsule snapshots/events.
+- Desktop Agent Hub should treat the daemon as its API, and the daemon should treat Capsule/runtime modules as sources. Desktop should not parse jackin' TOML files, Docker output, or Capsule socket frames directly.
 
 ## What the daemon owns
 
 The daemon is the long-running, per-operator-user, per-host process that holds anything jackin' needs to:
 
-1. **Watch host state.** Filesystem inotify, macOS Keychain notifications, periodic polls — for any host source jackin reacts to.
-2. **Watch container state.** Docker events stream (`docker events`) for launch failures, exits, OOM kills.
+1. **Watch host state.** Filesystem inotify, macOS Keychain notifications, periodic polls — for any host source jackin' reacts to.
+2. **Watch container state.** Docker labels/events for process-level lifecycle, plus Capsule sockets for live session/pane inventory and future agent-state events.
 3. **Push reactive updates** into running containers via the existing bind-mount channels (no new container-side privilege).
 4. **Hold cross-process locks** that have to outlive any one CLI invocation (the live-auth-sync shared store flock, future "only one `jackin load` at a time per role class" mutex, etc.).
 5. **Reconcile per-host singleton state.** Today's keep-awake `caffeinate` lock is the obvious example — only one caffeinate process per host, regardless of how many `jackin` invocations want it alive.
@@ -70,6 +82,16 @@ To keep the surface manageable and the security posture reviewable:
 - **Fallback for systems without launchd / systemd.** `jackin daemon start` backgrounds `jackin daemon serve`, writes a pid file, and logs to `~/.jackin/run/jackin-daemon.log`.
 - **Container / CI environments.** The daemon is per-user and host-scoped. CI can avoid `load`/`console` or explicitly stop it; future CI detection can make this silent.
 
+### Host-side effects
+
+The daemon follows the host-mutation rule by keeping writes scoped and operator-visible:
+
+- `jackin daemon start` / auto-start creates `~/.jackin/run/`, `jackin-daemon.sock`, `jackin-daemon.lock`, `jackin-daemon.pid`, and `jackin-daemon.log`.
+- `jackin daemon install` is explicit; it writes a per-user launchd or systemd unit and starts it.
+- `jackin daemon uninstall` is explicit; it stops and removes that unit.
+- `jackin daemon notify`, `notification/send`, `workspace/launch`, and `desktop/open` perform visible host actions: Notification Center toast, Ghostty launch/focus, or browser open.
+- The daemon reads host credential/config state for status, but it does not write provider config, Keychain entries, browser profiles, Git config, or user repositories.
+
 ### CLI surface
 
 Implemented subcommands under `jackin daemon`:
@@ -109,15 +131,15 @@ Initial protocol capabilities:
 | `github/repository_prs` | Return open pull requests for one repository, sorted newest first. |
 | `workspace/launch` | Open Ghostty and run `jackin load` against a saved workspace, with optional role and agent override. |
 | `desktop/open` | Open a browser URL through macOS `open`, or open Ghostty and run `jackin hardline` for a running session. |
-| `account/status` | Return cached Claude, Codex, and Amp credential-source presence without exposing token values; `refresh` bypasses the daemon cache. |
+| `account/status` | Return cached Claude, Codex, Amp, Kimi, and OpenCode credential-source presence without exposing token values; `refresh` bypasses the daemon cache. |
 | `event/subscribe` | Return the first Desktop event contract. Streaming is explicitly disabled for now; the response names the poll methods and click-route target fields Desktop should use for attention and ready-for-review routing. |
 | `notification/send` | Dispatch a host macOS Notification Center notification. |
 
 Most Desktop-specific methods are deliberately absent until their slices land. The next phase turns the event subscription placeholder into a real stream.
 
 ### Security posture
 
-- **Credential lifetime in memory.** Live auth sync requires the daemon to hold tokens in memory while watching for changes. Document the threat model: any process running as the operator can already read those tokens from the host's stores — the daemon does not widen the attack surface, but it does centralise it.
+- **Credential lifetime in memory.** Today `account/status` reports credential-source presence only, not raw token values. Live auth sync will require the daemon to hold tokens in memory while watching for changes. Document the threat model before that lands: any process running as the operator can already read those tokens from the host's stores, but the daemon centralizes that access.
 - **Secret-redacted logs.** Daemon log output must redact tokens the same way `tracing::debug!` already does for `GithubAuthContext` and `GithubProvisionOutcome` (manual `Debug` impls; see <RepoFile path="src/instance/mod.rs" />).
 - **Crash dumps and panic backtraces.** Tokens in memory can leak through coredumps. Either disable coredumps for the daemon process (`prctl(PR_SET_DUMPABLE, 0)` on Linux, equivalent on macOS) or redact tokens before any panic-backtrace path can format them.
 - **Fork-safety.** Daemon does not exec subprocesses with token env vars set; `gh auth token` shellouts use a clean env.
@@ -148,15 +170,19 @@ Rough order of operations — not committed; to be confirmed during the design p
 1. **Phase 0 — design.** Complete.
 2. **Phase 1 — daemon base.** Complete: lifecycle, install, singleton, socket protocol, logs, version skew restart.
 3. **Phase 2 — first adapters.** Started: keep-awake reconciliation, cache warmup, and host notification dispatch are daemon-owned.
-4. **Phase 3 — Desktop-ready daemon API.** Started: `daemon/hello` now provides a versioned capability handshake; read-only workspace/session discovery is available through `workspace/list` and `session/list`; initial GitHub PR lookup is available through `github/my_open_prs`, `github/project_inbox`, and `github/repository_prs`; Ghostty/browser actions are available through `workspace/launch` and `desktop/open`; Claude/Codex/Amp credential-source presence is available through `account/status`; the first `event/subscribe` response publishes the poll and click-routing contract. Next, replace the placeholder with a real event stream.
-5. **Phase 4 — live auth sync.** Not started. Add per-axis host watchers and shared-store flocks on top of this daemon.
-6. **Phase 5+ — container event watcher and beyond.** Add Docker event subscriptions, attention prompt MCP integration, click-to-focus, and richer host actions.
+4. **Phase 3 — Desktop-ready daemon API.** Started: `daemon/hello` now provides a versioned capability handshake; read-only workspace/session discovery is available through `workspace/list` and `session/list`; initial GitHub PR lookup is available through `github/my_open_prs`, `github/project_inbox`, and `github/repository_prs`; Ghostty/browser actions are available through `workspace/launch` and `desktop/open`; Claude/Codex/Amp/Kimi/OpenCode credential-source presence is available through `account/status`; the first `event/subscribe` response publishes the poll and click-routing contract.
+5. **Phase 4 — Capsule-backed live index.** Open: replace Docker-label-only session state with a daemon-owned cross-instance cache fed by Capsule snapshots/events, including pane/session IDs, branch/PR context, runtime status, and stale/disconnected diagnostics.
+6. **Phase 5 — real event stream and attention routing.** Open: replace the `event/subscribe` placeholder with streaming daemon events, then connect `blocked`, derived `done`, notification click routes, and Desktop attention surfaces.
+7. **Phase 6 — live auth sync and account telemetry.** Open: add per-axis host watchers/shared-store flocks, then replace credential-source presence with the account quota snapshots and usage endpoints described by Token & Cost Telemetry.
+8. **Phase 7+ — host bridge and approved host actions.** Open: add operator-approved `secret.*` / `host.*` flows against the same daemon policy/audit surface.
 
 ## Related work
 
 - [Live bidirectional auth sync](/reference/roadmap/live-auth-sync/) — the first reactive feature this daemon hosts.
 - [Agent attention prompts](/reference/roadmap/agent-attention-prompts/) — host-side OS notifications when an agent waits on operator input. Plugs into this daemon.
 - [Host bridge — secrets and approved host actions](/reference/roadmap/host-bridge/) — operator-mediated channel for agents to request secrets or invoke host commands. Plugs into this daemon and uses the same approval surface (TouchID / polkit / password) the daemon hosts.
+- [Agent runtime status authority](/reference/roadmap/agent-runtime-status/) — Capsule-side source for `blocked`, derived `done`, `working`, `idle`, and `unknown` state. The daemon consumes this; it does not reimplement the detector.
+- [Token & Cost Telemetry](/reference/roadmap/token-cost-telemetry/) — account quota and workspace/session spend model that should replace the current credential-source-only `account/status` placeholder.
 - [jackin' Desktop Agent Hub](/reference/roadmap/jackin-desktop-agent-hub/) — native macOS status bar and desktop companion that consumes daemon state for workspaces, sessions, GitHub PRs, account status, notifications, and approved host actions.
 - <RepoFile path="src/runtime/caffeinate.rs" /> — today's per-command keep-awake reconciler; first migration target in Phase 2.
 - [Reliable Claude authentication strategy](/reference/roadmap/claude-auth-strategy/) — concurrent-session token-drift concerns the live-auth-sync feature ultimately answers, so the daemon hosts the answer.