Roadmap

Rove runs many AI coding sessions side by side. Each task gets its own git worktree, branch and terminal tabs, and the real engine CLIs (claude, codex and others) run inside them. One daemon per machine owns the tasks, so the terminal UI, rove --web, the iOS and Android apps and rove api all look at the same state. Machines you register with rove machine add show up in the same rail. This page says where that is going.

Each milestone has a goal, what "done" means (something you can see or run), a status, and links to the docs, PRs and code that exist today. Status is one of shipped, in progress or planned. Planned means no work has started and no date is promised. Last checked against Rove 0.9.282 on 2026-11-09.

The order is the order of work: the nearest milestone is first.

1. Web side panel

Status: in progress.

Goal. A panel on the right of the task terminal in rove --web. Buttons along its top switch what it shows: a live web page (a local dev server or any URL), the task's files and diffs, and other artifacts a task produces. The features are borrowed from the Claude desktop app's side panel and from the canvases in Codex, ChatGPT and claude.ai; the layout is Rove's own.

Done means:

• From a task, you open a URL in the panel and use back, forward and reload.
• You switch to Files or a diff and back without losing either: the page keeps its place and the file keeps its scroll.
• On a desktop window the panel sits beside the terminal. On a phone it opens as a full-screen sheet.

What exists.

• A side panel beside the terminal on a desktop window, closed until you open it from the Files, Diff and Browser buttons at the workspace's top right (the one on screen is tinted; pressing it again closes the panel) (side-panel.tsx). Its top row ends with an expand button (the panel takes the terminal's column too, and the same button restores it) and a × that closes the panel, not the tabs. It is resizable and holds several tabs per task: a quiet row of small tabs along its top (Files, a diff per file, a Browser per page), a × on hover, middle-click to close, and a + that opens a new Files, a whole-worktree diff or a Browser. A right-click offers Split down or Move to top/bottom, which stacks a second group under the first with its own tab row and a draggable divider; closing a group's last tab collapses the split. Tabs drag to reorder or to the other group. The panel remembers its width and, per task, the tabs, the split and each Browser tab's own history (panel-model.ts). A view stays mounted while another is up, so the page keeps its place and the diff its scroll; at most three Browser frames stay live at once (the rest keep their address and reload when shown).
• Files, with All and Changes tabs and a working-tree or branch scope (files-view.tsx). Opening a file opens (or focuses) a Diff tab for that path, beside the terminal, in the file and diff reader with line notes you can send to the engine (preview-view.tsx).
• Browser, with an address bar, back, forward, reload and open in a new tab (browser-view.tsx). It frames https pages, and a local dev server when Rove is open on the same machine (browser-url.ts); the page's content security policy allows exactly those frames (web-static.ts), and the page itself still cannot be framed. Anything else shows why and a new-tab button.
• On a narrow window the Terminal / Files switch is Terminal / Files / Diff / Browser, one view full-screen: it shows the latest tab of that kind, and a row of that kind's tabs appears when there is more than one. No split on a phone.
• The panel and its buttons are rows #211 and #212 in web/PARITY.md.

What is missing.

• A dev server runs on the machine that runs the task. For a task on another machine, or from a phone, localhost:3000 in your browser is the wrong machine. The page needs a way through to the right one, and web/MEMO.md says any capability the page needs is a bridge op that the phone apps can use too. Until then the Browser view says such pages are not reachable from here.
• Back and forward only walk the addresses typed in the bar. A cross-origin page's own history cannot be read, so moves inside the frame are not tracked.
• Sites that refuse framing (X-Frame-Options: DENY or CSP frame-ancestors, e.g. github.com, Google, X) can't show in the panel: the browser enforces it on any iframe, and the panel only says so beside the new-tab button. Claude desktop and Codex show them because they are native apps with a webview. A way in for later: a headless Chromium on the Rove machine whose screen streams into the panel (CDP screencast) with input sent back. It would also reach the task machine's localhost from a phone, but it is a browser process per viewer, so it waits. A header-stripping proxy is ruled out: it breaks logins and turns the bridge into an open proxy.
• The frame check reads only the first response, so a site that redirects (https://iana.org, 301) reads as frameable and can still show the browser's refusal page.
• Other artifacts a task produces have no view yet, beyond the file previews the Files pane already renders (markdown, images, SVG, PDF, #1735).

See also. WEB.md, web/PARITY.md, web/MEMO.md.

2. Distributed

Status: core shipped; the rest is in progress.

Goal. One person's tasks run on several machines and are driven from anywhere: from the terminal UI, the web, a phone, or an agent with no UI attached. Code and engine logins stay on the machines they are already on.

Done means:

• You register a machine once. rove api add --machine auto --repo owner/name puts the task on a machine that has the repo, and you watch it, type into its terminal, read its diff and land it from wherever you are.
• A task started by an agent on one machine can report back to its parent on another.
• None of this needs a terminal window open on either machine.

Shipped.

• Register and check machines over SSH, with guided fixes: rove machine add, doctor, list, remove. Native Windows can be a machine (#1392) and a hub (#1346), and rove machine tunnel reaches machines behind NAT (#1342). See MACHINES.md.
• Every rove api verb takes --machine <alias> or --machine auto (#1348), and a --task-id on another machine goes there by itself. Repos are named by id, not path (#1351, #1339), a base with unpushed commits is refused (#1340), and --clone fetches a repo the machine lacks. See API.md.
• A remote task opens like a local one in the web (#1320) and the TUI (#1344, #1343): its tabs, its live terminal, its files and diffs. land pushes the branch from that machine and opens a PR (#1341).
• A resident daemon (rove daemon start --resident) can be the hub that dispatches to the others (CLI.md).
• Phones and browsers reach a daemon through the bridge: Tailscale or Cloudflare Access presets, a token per device (#1347), password login (#1386), install to the home screen. See WEB.md and IOS.md. The Android app is in ANDROID.md.
• Each machine decides what other hubs may run on it: rove machine inbound (#1345).

Missing.

• The daemon is not yet the only actor. The brief in design/fleet-direction.md lists session launch and prompt delivery as still run by the calling process (the TUI or rove api); terminal tabs have since moved into the daemon (#1353). Until launch moves too, those paths cannot be pointed at another machine.
• Placement reads load only. Each machine reports its system, cores and memory beside its load, but nothing matches a task to them yet, so --machine auto cannot tell a GPU box from a laptop.
• No run with no client attached that decides where work goes (for example CI asking for --machine any). The control plane is the hub inside each client or daemon; the open question is whether it becomes its own resident node (fleet-direction.md, question 2).
• Remote access hardening that is designed but not built: a hub key restricted to Rove's relay, Tailscale SSH detection, a peer check on the local sockets (design/remote-access-auth.md).
• No leader election or failover. Every machine owns its own tasks (MACHINES.md).
• The mobile apps are not in the stores yet. IOS.md lists TestFlight and App Store distribution as not done; the Android release work is #1409.

See also. design/workspace-runner.md (routing and dispatch design), design/fleet-direction.md (the owner brief, still marked Proposed), design/daemon-owned-state.md.

3. Agent API

Status: planned. The first part has shipped.

Goal. The same contract serves people, agents, CI and issue trackers, and it is safe to retry.

Done means:

• A client can resume an event stream after a disconnect and miss nothing.
• Sending the same add, send or land twice does the work once.
• A child task on another machine can report to its parent, because tasks have an address that includes the machine.

Shipped. One verb registry is the contract, run by one executor over the CLI, the daemon socket and the bridge, with one ROVE_API_VERSION on every output (API.md). Delivery reports, should-run checks and decision gates cover unattended runs (design/long-run-controls.md).

Missing. An event stream with sequence numbers and replay: watch carries engine-state changes only and is, in its own words, not a general event bus. Idempotency keys on add, send and land. A machine:taskId address. Per-engine cost in money (token counts exist for claude and codex; there is no price table).

See also. API.md, design/fleet-direction.md (step 3).

4. Cloud

Status: planned. No work has started.

Goal. A hosted Rove: the daemon and engines run on machines Rove or a provider runs, so a person can start work without owning or setting up a machine, and a team can share them.

Done means (a draft, to be confirmed by the owner before work starts):

• Someone with no machine of their own signs in and gets a running Rove, with an engine logged in and a repo cloned.
• Two accounts on one hosted Rove see only what they are allowed to.
• Closing every browser and phone leaves the work running, and reopening shows where it got to.

What exists toward it.

• A daemon that stays up with no UI: rove daemon start --resident.
• Reaching a daemon from a browser or phone: the bridge presets, a token per device, password login with lockout, --public-host behind a tunnel, and the installable page (WEB.md).
• A hub dispatching to other machines by repo id, with --clone and a per-machine inbound policy (MACHINES.md).
• Engine logins stay on the machine they were made on; the hub never ships secrets (design/workspace-runner.md).

What is missing.

• Accounts, teams and permissions. The daemon socket has no authentication of its own: the directory mode is the access control, and design/daemon.md (section 10) rules out a permission model. A bridge token today means a shell on every machine registered with that hub (MACHINES.md).
• Something that starts, stops and bills machines. Today you provide the machines.
• Machines that dial out. Registering a machine needs the hub to reach it over SSH; a cloud machine that sits behind NAT, or comes and goes, needs the opposite direction (design/workspace-runner.md calls this a later transport).
• Engine login on a fresh machine, and how a team's engine accounts and spend are handled.
• Cheap throwaway workspaces. Git worktrees are full checkouts; the design surveys copy-on-write workspaces for cloud runners but has not built the seam (design/workspace-runner.md, phases 0 and 4).

Open decision. design/fleet-direction.md sets the positioning as "your compute, not a vendor's cloud" and says hosted comes later. This milestone needs the owner to say how hosted Rove fits that positioning, and who it is for first (individuals, or teams).

Not scheduled

Designed, but not part of a milestone above:

• Checkpoints at each engine turn, rewind, and forking a task with its uncommitted work (design/workspace-runner.md, phase 1). The daemon and rove api half exists (checkpoint-save, checkpoint-rewind, checkpoint-list); no surface calls it yet.
• Racing several engines on one task with an automatic judge. The race commands exist (add --count, --agents, collect --group); the judge does not (design/fleet-direction.md).
• Freezing rove add --remote in favour of machines (design/remote-projects.md); it is experimental and its engine launch regressed.

Keeping this page current

• When a milestone moves, change its status and its Shipped or Missing lists in the same pull request as the work.
• Link the PR number or the doc, not a date.
• If a design page and this page disagree, the code decides; fix both.