feat: add jackin daemon and Desktop Agent Hub

[donbeave]

Summary

This consolidates the jackin' daemon and Desktop Agent Hub work into one reviewable PR. It introduces the per-user host daemon with a private Unix socket, versioned daemon/hello handshake, lifecycle/status/log/warm commands, keep-awake/cache/notification foundations, daemon-backed workspace and running-session discovery, per-session repository/branch/linked-PR correlation, GitHub PR lookup endpoints with DiffsHub URLs, Ghostty/browser action endpoints, account credential-source reporting for Claude/Codex/Amp/Kimi/OpenCode, the first event-route contract, and a native macOS SwiftUI/AppKit Desktop shell that consumes those daemon APIs for menu bar health, active project grouping, workspace counts, PR inboxes, account cards, filtered Desktop views, workspace launch/reconnect actions, and branch/PR visibility in Workspaces and Running Agents.

Hard rule / impact callout

The daemon preserves the host-mutation rule: it reads host-side state where needed, but daemon-managed smoothing and command execution stay explicit, scoped, and surfaced through daemon/Desktop contracts. This PR adds host-side daemon lifecycle commands and macOS Desktop code, so reviewers should pay particular attention to socket permissions, launch/control surfaces, and any code path that could mutate host state without an operator-visible action.

What's deferred

• Real streaming event delivery, jackin-attention MCP enrichment, waiting/blocked attention state, and native Notification Center click activation remain open; event/subscribe currently returns a documented poll/click-route contract.
• macOS app packaging, signing, notarization, and daemon/app version negotiation beyond daemon/hello remain follow-up work.
• Account status reports credential-source presence, not provider quota/live usage, reset windows, confidence labels, provider refresh backoff, or repair/login actions; those remain with live auth sync and token/cost telemetry.
• Capsule-backed live session state remains open; session/list is still label-backed, now enriched with daemon-owned GitHub PR correlation when repository and branch labels are available.
• Host bridge approval UI and audit timeline remain open with the host bridge roadmap item.

Consolidated PR trail

This PR replaces the narrower stacked PRs so the whole feature can be reviewed and validated together: #283, #306, #307, #308, #310, #311, #312, #313, #314, #315, and #316. Those PRs should stay closed as superseded by this consolidated PR.

Verify locally

Checkout

Paste this first to bypass the tirith paste scanner for the rest of the session:

export TIRITH=0

Then paste the checkout block:

mkdir -p "$HOME/Projects/jackin-project/test/pr-317"
cd "$HOME/Projects/jackin-project/test/pr-317"

if [ ! -d jackin/.git ]; then
  git clone https://github.com/jackin-project/jackin.git
fi

cd jackin
mise trust
git fetch -f origin jackin/desktop-attention-routing:refs/remotes/origin/jackin/desktop-attention-routing
git checkout -B jackin/desktop-attention-routing refs/remotes/origin/jackin/desktop-attention-routing
mise install
cargo build --bin jackin
export PATH="$PWD/target/debug:$PATH"
which jackin

Isolation

export JACKIN_CONFIG_DIR="$HOME/.config/jackin-pr-317"
export JACKIN_HOME_DIR="$HOME/.jackin-pr-317"
rm -rf "$JACKIN_CONFIG_DIR" "$JACKIN_HOME_DIR"
mkdir -p "$JACKIN_CONFIG_DIR" "$JACKIN_HOME_DIR"

Static checks

cargo fmt --check
cargo clippy --lib -- -D warnings

Rust tests

cargo test --lib daemon::tests
cargo test --lib workspace_repo_labels_reads_mounted_workdir_git_state
cargo test --lib load_agent_sets_display_name_label

These tests cover daemon protocol negotiation, Desktop capability exposure, workspace/session discovery, repository branch label derivation from the mounted workspace repo, GitHub PR parsing/filtering, DiffsHub URL derivation, per-session branch-to-PR correlation, Ghostty/browser action contracts, account status caching, event route contracts, macOS notification/script validation, and Docker label stamping.

Docs checks

(
  cd docs
  bun install --frozen-lockfile
  bun run build
  bun run check:repo-links
  bunx tsc --noEmit
  bun test
)

User smoke

jackin daemon restart
jackin daemon status
jackin daemon warm
jackin daemon logs -n 100
jackin console --debug

Expected behavior: daemon status reports version, pid, socket path, capabilities, keep-awake/cache/notification adapter state, and the existing console flow still launches workspaces while new launches stamp workspace repository and branch labels for daemon discovery.

macOS Desktop smoke

cd desktop/macos
swift run JackinDesktop

Expected behavior on macOS with Swift installed: the menu bar item appears, Refresh calls daemon/hello, Desktop shows daemon-backed health/workspace/session/PR/account data, PR rows expose separate GitHub and DiffsHub actions, Projects includes PR-backed and running-session-backed repositories, Workspaces and Running Agents show repository/branch/linked-PR state when detected, Accounts shows daemon-provided credential-source presence and cache freshness for Claude/Codex/Amp/Kimi/OpenCode, and browser/Ghostty actions route through daemon endpoints. Swift validation is host-dependent and may need to run outside Linux CI/agent environments.

Documentation

cd docs
bun install --frozen-lockfile
bun run dev

Astro serves at http://localhost:4321/. Pages to walk:

http://localhost:4321/reference/roadmap/jackin-daemon/
UPDATED roadmap page. Check daemon lifecycle, protocol capabilities, security/host-side effects, session/PR contract, event contract, and phase status against the implemented feature.

http://localhost:4321/reference/roadmap/jackin-desktop-agent-hub/
UPDATED roadmap page. Check the Desktop Agent Hub daemon dependency, menu bar/window slices, filters, workspace/session/account actions, branch/PR visibility, and attention routing notes.

http://localhost:4321/reference/goals/jackin-desktop-agent-hub/
UPDATED goal page. Check that the consolidated implementation path matches the current goal framing.

http://localhost:4321/reference/roadmap/
UPDATED roadmap overview. Check that daemon/Desktop items appear in the correct status sections.

Verification performed on this head

• PASS: cargo fmt --check
• PASS: cargo clippy --lib -- -D warnings
• PASS: cargo test --lib daemon::tests — 26 daemon tests passed.
• PASS: cargo test --lib workspace_repo_labels_reads_mounted_workdir_git_state — 1 runtime launch-label test passed.
• PASS: cargo test --lib load_agent_sets_display_name_label — 1 runtime launch-label test passed.
• PASS: cd docs && bun install --frozen-lockfile
• PASS: cd docs && bun run build
• PASS: cd docs && bun run check:repo-links
• PASS: cd docs && bunx tsc --noEmit
• PASS: cd docs && bun test — 5 tests passed.
• BLOCKED: cd desktop/macos && swift --version failed with zsh:1: command not found: swift, so swift run JackinDesktop could not be executed in this environment.

Migration notes

None. The new daemon/Desktop surfaces are additive for pre-release jackin'. New Docker labels are additive on future launches, and existing running containers without those labels still appear through fallback fields.