---
title: Roadmap
description: What's done and what's coming next
---
import { Aside } from '@astrojs/starlight/components'
import RepoFile from '../../../components/RepoFile.astro'


## Current status

jackin' is a functional proof of concept. **`Claude Code`, `Codex`, `Amp`, `Kimi`, and `OpenCode` ship today as built-in agent runtimes**, with namespaced roles, workspace management, per-mount isolation for parallel agents, layered authentication forwarding (including `1Password` references), and an interactive operator console (TUI).

## Completed

- `Claude Code` and `Codex` agent runtimes with full-speed mode (`--dangerously-skip-permissions` / YOLO) inside the container boundary
- Layered authentication forwarding per (workspace × role × agent) — `sync` / `api_key` / `oauth_token` / `ignore` for `Claude Code`, and `sync` / `api_key` / `ignore` for `Codex`, `Amp`, `Kimi`, and `OpenCode` (none supports `oauth_token`)
- `Docker` container isolation with `Docker-in-Docker`
- Interactive operator console (TUI) with workspace, role, and agent selection
- Workspace management (create, edit, remove, prune, list, show, plus `env` and `claude-token` subcommands) — CLI and TUI
- Global mount configuration with role scoping
- Role repository contract validation
- Derived `Dockerfile` generation with UID/GID remapping
- State persistence across sessions
- Agent identity (display names)
- UID/GID host user mapping
- GitHub CLI authentication state persists across container restarts (forwarding host login on launch is tracked separately under [GitHub CLI authentication strategy](/reference/roadmap/github-cli-auth-strategy/))
- Homebrew distribution via [`jackin-project/homebrew-tap`](https://github.com/jackin-project/homebrew-tap)
- Namespaced roles (e.g., `chainargos/frontend-engineer`)
- Last-agent memory per workspace
- Custom `Claude Code` plugin marketplaces in `jackin.role.toml` — see the [role manifest reference](/developing/role-manifest/)
- Sensitive mount path warnings (warn-and-confirm for `~/.ssh`, `~/.aws`, etc.) — see the [Mounts guide](/guides/mounts/) and the [Security model](/guides/security-model/)
- Automatic orphaned DinD cleanup (pre-launch garbage collection)
- [`${env.VAR}` interpolation](/developing/role-manifest/#interpolation) in env var prompts and defaults for dependent variables
- `JACKIN_DIND_HOSTNAME` environment variable for agents to discover the DinD sidecar hostname — see the [Environment variables guide](/guides/environment-variables/#reserved-names)
- Agent source trust model (trust-on-first-use verification for third-party role repos)
- DinD TLS authentication with auto-generated certificates — see the [Security model](/guides/security-model/) and [Architecture](/reference/architecture/)
- `JACKIN_DEBUG` environment variable — verbose tracing for shell commands and jackin internals; documented inline in every command page
- MSRV toolchain pin — `rust-toolchain.toml` enforced in CI
- Worktree cleanup on container removal — orphaned host-side worktrees no longer accumulate
- `jackin eject` — stop and clean per-container state (with `--all` and `--purge`)
- `jackin prune` family — orphaned roles, derived images, cache, and instance state
- `jackin config trust grant | revoke | list` — explicit CLI management of role-source trust beyond the trust-on-first-use prompts
- Per-workspace `git_pull_on_entry` — opt-in host repo refresh at launch via `--git-pull` / `--no-git-pull`
- macOS keep-awake reconciler — `--keep-awake` / `--no-keep-awake` workspace flags hold the system awake while an agent is active
- [Per-mount isolation for parallel agents](/guides/workspaces/#per-mount-isolation) — `shared | worktree | clone` modes implemented in V1
- [Split `config.toml` into per-workspace files](/reference/configuration/#one-file-per-workspace-by-design) — `~/.config/jackin/workspaces/<name>.toml` layout shipped with per-file `version` stamps and migration
- Global mount visibility and editing — workspace views show applicable global mounts separately, and the console has a dedicated global mounts editor for `~/.config/jackin/config.toml`. See the [Mounts guide](/guides/mounts/)
- Settings TUI — the console has a tabbed `Settings` shell covering existing `jackin config` surfaces: global mounts, global/per-role env vars, global auth forwarding modes, and role source trust
- Project structure map refresh — <RepoFile path="PROJECT_STRUCTURE.md" /> now covers the root file/workflow map and delegates detailed source navigation to the [Codebase Map](/reference/codebase-map/)
- Unique container identity and restore — DNS-safe unique container identities, per-instance manifests and rebuildable index, hardline/load/console recovery flows, durable per-instance agent home restore, related-instance recovery/rebuild, moved ad-hoc path recovery, guarded purge, `hardline --new`, and Java Testcontainers DinD smoke coverage have shipped; operator workflow is documented in [Parallel Agents](/guides/parallel-agents/), contributor details live in [Runtime Instance Model](/reference/runtime-instance-model/), and reconnectable named sessions plus persistent lifecycle history are tracked separately
- Role authoring CLI — desktop role creation, validation, and migration are documented in the [`role` command reference](/commands/role/) and [Creating a Role](/developing/creating-roles/); the standalone CI/Renovate-style validator split is documented in [Architecture](/reference/architecture/#role-repository-tooling) and [Schema Versions](/reference/schema-versions/)
- Async Docker API via bollard — `DockerApi` trait, `BollardDockerClient`, `FakeDockerClient`, `ContainerState` (all 9 Docker lifecycle states); typed API for lifecycle, cleanup, inspect, exec, and image operations, replacing CLI stderr string-matching; `docker build`, `docker exec -it`, and `docker run -it` stay on the CLI by design — see [Codebase Map](/reference/codebase-map/) for details

## Partially implemented

- [1Password integration](/reference/roadmap/onepassword-integration/) — env references and picker flows are documented in standard docs; roadmap tracks future read-only secret file mounts
- [Multi-runtime support for Codex, Amp, Kimi, and OpenCode](/reference/roadmap/multi-runtime-support/) — built-in runtime launch for all five agent runtimes is documented in standard docs; roadmap tracks deeper runtime parity
- [GitHub CLI authentication strategy](/reference/roadmap/github-cli-auth-strategy/) — shipped GitHub auth forwarding is documented in standard docs; roadmap tracks the CLI subcommand, scope pre-flight, and deeper GHE coverage
- [Workspace Claude token setup](/reference/roadmap/workspace-claude-token-setup/) — shipped token commands are documented in standard docs; roadmap tracks the canonical auth slot, TUI generate action, Apple Keychain backend, validity probe, and bulk migration
- [Config versioning and migration framework](/reference/roadmap/config-versioning-migration/) — shipped per-file schema gates for config, workspace files, and role manifests, plus automatic config/workspace migration, desktop role manifest migration through `jackin role migrate`, and CI migration through `jackin-role migrate`; roadmap tracks deferred `--pr` automation and the Renovate-style auto-migration GitHub Action
- [Console agent session control](/reference/roadmap/console-agent-session-control/) — instance discovery, console workspace tree-view with expandable instance rows and session pane, `hardline --shell`, tmux-backed primary session, secondary agent sessions via `hardline --new`, and console `a`/`x`/`N`/`X`/`P` instance keybindings shipped; Phase 4 (live session reconciliation, agent runtime status, resource panel integration) remains open
- [jackin-container: in-container supervisor binary](/reference/roadmap/jackin-container-binary/) — Phase 1 shipped: improved bash supervisor exits when the last tmux session ends, closing the automatic container teardown gap; Rust binary with inotify, Unix socket status interface, and daemon event streaming remain

## Planned

### Platform expansion

- **Kubernetes platform support** — run agents on Kubernetes clusters instead of local Docker, enabling team-scale deployments and production debug containers. The vision is to use jackin' as a debug container in production environments — safely exploring issues with AI agent assistance inside a controlled Kubernetes pod.

### Security improvements

- **[Network egress policy](/reference/roadmap/network-egress-policy/)** — outbound policy per role/workspace, with explicit enforcement-quality reporting across DinD, future microVM backends, SSH remotes, and Kubernetes. Inspired by Docker Sandboxes' host-side proxy model, Hazmat's network tiering, and the upstream `anthropics/claude-code` devcontainer allowlist approach (status: open — design proposal)
- **[Process-level sandboxing](/reference/roadmap/process-level-sandboxing/)** — per-operation isolation using OS-native mechanisms (Bubblewrap + Seccomp + Landlock on Linux, Apple Seatbelt on macOS) to restrict individual agent tool calls to only the paths, network hosts, and environment variables they need. Informed by [Zerobox](https://github.com/afshinm/zerobox) (the open-source library powering OpenAI Codex CLI's sandbox mode) and the three-tier isolation model: process sandbox → container → microVM (status: proposed — research captured, no implementation committed)
- **Credential proxy** — proxy-based credential injection to avoid storing tokens inside containers
- **[Agent version pinning](/reference/roadmap/reproducibility-pinning/)** — pin role repos to tagged versions for reproducible builds, with explicit `--update` to advance (status: open — agent brainstorm, not yet reviewed by the operator)
- **[Reliable Claude authentication strategy](/reference/roadmap/claude-auth-strategy/)** — move beyond copied session auth toward clearer, more durable modes for long-lived and concurrent agent runtimes (status: deferred — needs design work)
- **[Alternative isolation tiers](/reference/roadmap/selectable-sandbox-backends/)** — explore stronger backends beyond plain container isolation for users who need them, including [rootless DinD](/reference/roadmap/rootless-dind/) as a lighter-weight option (status: deferred — requires a dedicated design pass)
- **[Devcontainer parity](/reference/roadmap/devcontainer-parity/)** — comparison with the upstream `anthropics/claude-code` devcontainer setup; informs network policy + reproducibility decisions (status: proposed — research captured, no implementation committed)

### Reactive daemon program

- **[jackin daemon — umbrella](/reference/roadmap/jackin-daemon/)** — introduce the long-running per-operator-user host process jackin will use for reactive features. One umbrella item that decides lifecycle, install method, control socket, security posture, and log redaction once so each reactive feature plugs into one daemon shape. The full list of phase-2/phase-3 reactive adapters lives in the program doc and the sidebar under **Reference → Roadmap → Reactive daemon program** (status: open — design proposal)
- **[Jackin Desktop Agent Hub](/reference/roadmap/jackin-desktop-agent-hub/)** — native macOS menu bar and desktop companion for active Jackin workspaces, isolated agent sessions, PR jump links, and Claude/Codex/Amp account state. Keeps the agent TUIs as the primary agent UI while using the daemon as the shared state/event backend (status: open — design proposal)
- **[Live bidirectional auth sync](/reference/roadmap/live-auth-sync/)** — Phase 2 adapter. Keep host and every running container in lock-step on each auth axis (`gh`, Claude, Codex, Amp, …). Subsumes the launch-time `sync` mode's bidirectional follow-up; reconsiders the `sync` name in the process (status: open — design proposal)
- **[Agent attention prompts](/reference/roadmap/agent-attention-prompts/)** — Phase 2 adapter. Host-side OS notifications when an agent inside a jackin' container is waiting on operator input. Auto-registered MCP server inside every agent session, escalation from silent toast to sound after a configurable timeout, click-to-focus the right terminal tab. Targets the biggest operator throughput drag: idle wall-clock waiting on agents that don't surface their waiting state (status: open — design proposal)
- **[Host bridge — secrets and approved host actions](/reference/roadmap/host-bridge/)** — Phase 3 adapter. Operator-mediated channel for agents to request a single secret value or invoke a single host command without tearing down the container. Auto-registered MCP server, TouchID / polkit / password approval per request, per-workspace allowlist / blocklist / disabled policies, audit log. Closes the *"agent needs one thing from the host, mid-session"* gap that today forces full-restart workarounds (status: open — design proposal)
- **[Container credential exposure — beyond env injection](/reference/roadmap/container-credential-exposure/)** — Phase 3 follow-on. Auth tokens jackin forwards into containers today (Claude / Codex / `gh`) land in `docker run -e` env, which is visible via `docker inspect` to anyone with daemon access. Captures the trade-offs across status quo / file-mount / Keychain bridge / daemon-mediated `secret.request` and recommends the trajectory: documented exposure today, file-mount intermediate stop for file-aware consumers, daemon-bridge canonical answer (status: open — design proposal)

### Infrastructure improvements

- **[Construct user creation optimization](/reference/roadmap/construct-user-creation/)** — move user creation to the derived layer to eliminate UID/GID remapping (status: deferred — needs design work)
- **[Workspace registry cache](/reference/roadmap/workspace-registry-cache/)** — opt-in workspace-level zot registry that acts as a pull-through cache for Docker Hub and a local push target; shared across all DinD sidecars in a workspace so base image layers are pulled once and reused, and built images persist across sessions (status: open — design proposal)

### Operator surface and fleet operations

- **[Agent Orchestrator Research Program](/reference/roadmap/agent-orchestrator-research/)** — phased research program comparing jackin against `multicode`, Hazmat, Docker Sandboxes, Herdr, and adjacent devcontainer/native-worktree approaches. The fleet track covers live agent observability, per-instance persistent storage, declarative resource limits, autonomous task queue, remote operation, and skill mounts. The containment track adds [session contract and explain mode](/reference/roadmap/session-contract-explain-mode/), [stack integration contracts](/reference/roadmap/stack-integration-contracts/), [network egress policy](/reference/roadmap/network-egress-policy/), and [session snapshot and rollback](/reference/roadmap/session-snapshot-rollback/) so contributors can see the Hazmat/Docker Sandboxes research as actionable roadmap work rather than loose notes. The full leaf list lives in the program doc and the sidebar under **Reference → Roadmap → Agent Orchestrator Research**.

### Codebase health

- **[Codebase readability program](/reference/roadmap/codebase-readability/)** — multi-phase internal-quality work covering documentation/setup, behavioral specs, DRY deduplication, module-contract refactors, and test coverage. Re-analyzed May 2026 against the current codebase (~91K lines of production Rust, 13 files over 1000 lines, pervasive TUI/auth/Docker duplication). The full leaf list lives in the program doc and in the sidebar under **Reference → Roadmap → Codebase health**.
- **[Cargo workspace split](/reference/roadmap/cargo-workspace-split/)** — deferred multi-crate Cargo workspace plan for when LOC, compile time, or external-consumer triggers make crate boundaries worth the overhead (status: deferred to Phase 3 — trigger not yet met, but architecture is ready)
- **[Open review findings catalog](/reference/roadmap/open-review-findings/)** — living backlog of review findings with accepted-exception annotations. Code review and automated scanning consult this catalog (see <RepoFile path="AGENTS.md" /> → "Code review & automated scanning").

### Documentation infrastructure

- **[Markdown linting for docs](/reference/roadmap/docs-markdown-linting/)** — uniform Markdown lint pipeline for the docs site (status: proposed — design captured, no implementation committed)
- **[Move documentation to a separate repository](/reference/roadmap/docs-separate-repository/)** — promote `docs/` out of the CLI repo into its own `jackin-project/jackin-docs` repo so the ecosystem-level docs have an ecosystem-level home; the load-bearing question is how to keep the docs as fresh as same-repo co-location makes them today (status: deferred — needs design pass on the cross-repo freshness story)
- **[Rustdoc → Starlight integration](/reference/roadmap/rustdoc-json-starlight/)** — surface rustdoc JSON inside the Starlight docs site (status: deferred — Phase 3)

<Aside type="tip">
Detailed design documents for individual TODO items are linked from the sidebar under **Roadmap** (each open category — `Agent Orchestrator Research`, `Codebase health`, `Agent runtimes & authentication`, `Isolation & security`, `Infrastructure`, `Documentation tooling`, `Configuration ergonomics`). Fully shipped items are summarized under **Completed** above and documented in the canonical guides, commands, or reference pages instead of remaining as resolved roadmap pages.
</Aside>
## Vision

The user-facing summary of where jackin' is headed lives on the [Why jackin'? → Vision](/getting-started/why/#vision) page so it is visible to operators and role authors, not only to contributors who end up on the roadmap. The longer-term shape of the project, the local-first focus, and the eventual move toward Kubernetes-backed debug workflows are all captured there.

If jackin' works for your use case — or almost works but needs something different — [open an issue](https://github.com/jackin-project/jackin/issues) or submit a pull request.

## Contributing

jackin' is open source under the Apache 2.0 license. To develop and test jackin' itself, use [The Architect](https://github.com/jackin-project/jackin-the-architect) — a dedicated agent with the full Rust toolchain:

```bash
jackin load the-architect
```

The project uses `cargo-nextest` for testing and requires all clippy lints to pass before committing.
