Super Agent Console

super-agent-ceo turns any machine — a laptop, a server, a CI box — into a node your organization's AI agents can drive. The /super-agent console is the visual control surface: an "octopus" graph of your operators (the org's agents) and operands (your self-hosted nodes), live status, active runs, and controls.

graph LR
    subgraph Operators["Operators (your agents)"]
        CEO((CEO))
        CTO((CTO))
    end
    subgraph Operands["Operands (your machines)"]
        N1{{"my-laptop · online"}}
        N2{{"build-box · online"}}
        N3{{"old-vm · offline"}}
    end
    CTO -. can drive .- N1
    CTO == "running" ==> N2
    CEO -. can drive .- N1

Who sees what

/super-agent is auth-aware:

Signed out → the marketing overview.
Signed in → the operator/operand console, scoped to your organization.

Everything is org-scoped on the server: a member of org A never sees org B's nodes. A node's host/IP is shown to org admins only, and is labelled self-reported, unverified (the platform only ever sees the load-balancer IP, never the node's).

Connect a node

# 1. Install the CLI
curl -sSL https://install.agent.ceo/super-agent-ceo | sh

# 2. Authenticate with an org-scoped API key (ahk_…)
super-agent-ceo login --api-key ahk_…

# 3. Connect — it appears in the console within a few seconds
super-agent-ceo connect --name my-laptop

By default a node is locked down: filesystem access is sandboxed to ~/super-agent-ceo/<name>/, bash_run is disabled, and the node refuses operator prompts. Opt in explicitly:

Flag	Effect
`--allow-fs <path>`	additionally permit a path outside the sandbox root
`--allow-bash`	expose the `bash_run` tool to in-org agents
`--prompt-command "claude -p"`	accept operator prompts, run via this command
`--disable-fs-sandbox`	⚠ turn the filesystem boundary off entirely

The console's node panel reflects exactly what each node authorized.

What the console shows

Graph — operators in the centre, operands as tentacle-tips. Online nodes pulse green; stale (last_seen > 90s) turn amber; offline are grey. A faint edge from every operator to every operand means can drive; a bold, animated edge means a run is active right now.
Node panel (click a node) — id, status, last-seen, mode, sandbox config, recent runs, and admin-only host. Controls: Stop (clean-disconnect + revoke the node's token) and Copy connect command.

How a run reaches a node

sequenceDiagram
    participant Op as Operator (CTO agent)
    participant GW as Gateway / NATS
    participant Nd as Operand (my-laptop)
    Op->>GW: invoke_super_agent_ceo("run the tests")
    GW->>Nd: prompt over NATS (org-scoped subject)
    Nd->>Nd: run inside the sandbox
    Nd-->>GW: result
    GW-->>Op: result

Each invocation is recorded as a run, which is what powers the active/recent edges and the per-node runs list.

CLI reference: cmd/super-agent-ceo/README.md
Design + API: docs/product/super-agent-ceo-console-design.md (agent-hub)

Super Agent Console (self-hosted nodes)

Super Agent Console

Who sees what

Connect a node

What the console shows

How a run reaches a node

Related