# superhq

Desktop app for orchestrating multiple AI coding agents — Claude Code, OpenAI Codex, Pi — each running inside its own sandboxed VM with a separate filesystem, network, and resource limits. macOS-only (Apple Silicon, macOS 14+), built in Rust on top of [GPUI](https://gpui.rs) — the same GPU-accelerated UI framework that powers Zed.

Three weeks old as of ingest (repo created 2026-04-04), explicitly labeled "very early alpha, not ready for production." Watch-list candidate — see [[toolbox/watchlist]] for the criteria.

## What's interesting about it

The **auth gateway** is the design detail worth remembering. The agent process inside the VM never sees real API keys or OAuth tokens. Instead, a reverse proxy on the host intercepts outgoing API requests and injects the credentials at the wire boundary. For Codex on a ChatGPT Plus/Pro subscription, the gateway also handles OAuth token refresh and rewrites requests to `chatgpt.com/backend-api/codex` so the subscription works inside the sandbox without exposing the OAuth token.

This pushes credential isolation past the typical "agent has its own scoped key" model — an agent that exfiltrates everything it can see still doesn't get a usable token.

## Architecture

- **GPUI** — Zed's GPU-accelerated UI framework
- **shuru-sdk** — sibling Rust crate ([github.com/superhq-ai/shuru](https://github.com/superhq-ai/shuru), 673 stars, Apache-2.0) that does the actual VM sandboxing: boot, exec, filesystem, networking. Described as "local-first microVM sandbox for running AI agents safely on macOS & Linux." The SDK is older and broader-platform than the SuperHQ desktop shell on top.
- **Auth gateway** — host-side reverse proxy injecting credentials into outgoing API calls
- **SQLite** — workspace config, port mappings, secrets (AES-256-GCM encrypted)

## Features

Multi-workspace + multi-tab UI. Each workspace is a sandbox; each tab in a workspace is an agent session. Bidirectional port forwarding (sandbox → host, host → sandbox). Review panel shows file changes as a unified diff. Keyboard-first navigation (Cmd+1..9 for workspaces, Ctrl+1..9 for tabs).

## Where it fits

Within the [[sandboxing-ai-agents]] taxonomy, SuperHQ is a Layer-1 (filesystem + process isolation via microVM) plus a credential-isolation layer that the four-layer model didn't explicitly call out — the auth gateway is closer to "Layer 0: don't even let the secret into the box." Adjacent in spirit to:

- [[hazmat]] — macOS user + Seatbelt + pf, a lighter containment model that still passes credentials in
- [[crabtrap]] — Layer 3 HTTP-policy enforcement; complementary, not overlapping
- [[botctl]] — process management for autonomous agents; less about sandboxing, more about lifecycle
- [[charlie-daemons]] — autonomous agent runtime; a daemon-shaped peer

## Limitations

- macOS Apple Silicon only; not notarized (Gatekeeper has to be manually overridden)
- Three-week-old alpha — expect breaking changes, missing features
- AGPL-3.0 — affects redistribution and any networked-service use
- Single-author/small-team repo, no clear sustainability signal yet

## Repo

[github.com/superhq-ai/superhq](https://github.com/superhq-ai/superhq) — Rust, AGPL-3.0, 194 stars. SDK at [github.com/superhq-ai/shuru](https://github.com/superhq-ai/shuru), 673 stars, Apache-2.0.