Map

superhq

Toolbox toolboxai-agentssandboxingrustmacoswatchlistRustAGPL-3.0 ↳ show in map Markdown
title
superhq
type
toolbox
summary
macOS app running coding agents in microVMs, with credentials injected host-side, never in the VM
tags
ai-agents, sandboxing, rust, macos, watchlist
repo
https://github.com/superhq-ai/superhq
language
Rust
license
AGPL-3.0
created
2026-04-24
updated
2026-04-24

Desktop app for orchestrating multiple AI coding agents — Claude Code, OpenAI Codex, Pi — each running inside its own sandboxed VM with a separate filesystem, network, and resource limits. macOS-only (Apple Silicon, macOS 14+), built in Rust on top of GPUI — the same GPU-accelerated UI framework that powers Zed.

Three weeks old as of ingest (repo created 2026-04-04), explicitly labeled "very early alpha, not ready for production." Watch-list candidate — see watchlist for the criteria.

What's interesting about it

The auth gateway is the design detail worth remembering. The agent process inside the VM never sees real API keys or OAuth tokens. Instead, a reverse proxy on the host intercepts outgoing API requests and injects the credentials at the wire boundary. For Codex on a ChatGPT Plus/Pro subscription, the gateway also handles OAuth token refresh and rewrites requests to chatgpt.com/backend-api/codex so the subscription works inside the sandbox without exposing the OAuth token.

This pushes credential isolation past the typical "agent has its own scoped key" model — an agent that exfiltrates everything it can see still doesn't get a usable token.

Architecture

  • GPUI — Zed's GPU-accelerated UI framework
  • shuru-sdk — sibling Rust crate (github.com/superhq-ai/shuru, 673 stars, Apache-2.0) that does the actual VM sandboxing: boot, exec, filesystem, networking. Described as "local-first microVM sandbox for running AI agents safely on macOS & Linux." The SDK is older and broader-platform than the SuperHQ desktop shell on top.
  • Auth gateway — host-side reverse proxy injecting credentials into outgoing API calls
  • SQLite — workspace config, port mappings, secrets (AES-256-GCM encrypted)

Features

Multi-workspace + multi-tab UI. Each workspace is a sandbox; each tab in a workspace is an agent session. Bidirectional port forwarding (sandbox → host, host → sandbox). Review panel shows file changes as a unified diff. Keyboard-first navigation (Cmd+1..9 for workspaces, Ctrl+1..9 for tabs).

Where it fits

Within the sandboxing-ai-agents taxonomy, SuperHQ is a Layer-1 (filesystem + process isolation via microVM) plus a credential-isolation layer that the four-layer model didn't explicitly call out — the auth gateway is closer to "Layer 0: don't even let the secret into the box." Adjacent in spirit to:

  • hazmat — macOS user + Seatbelt + pf, a lighter containment model that still passes credentials in
  • crabtrap — Layer 3 HTTP-policy enforcement; complementary, not overlapping
  • botctl — process management for autonomous agents; less about sandboxing, more about lifecycle
  • charlie-daemons — autonomous agent runtime; a daemon-shaped peer

Limitations

  • macOS Apple Silicon only; not notarized (Gatekeeper has to be manually overridden)
  • Three-week-old alpha — expect breaking changes, missing features
  • AGPL-3.0 — affects redistribution and any networked-service use
  • Single-author/small-team repo, no clear sustainability signal yet

Repo

github.com/superhq-ai/superhq — Rust, AGPL-3.0, 194 stars. SDK at github.com/superhq-ai/shuru, 673 stars, Apache-2.0.

Linked from