Hashimoto's Superlogical, Herdr, and us: three bets on the terminal trust spectrum
In late July 2026, Mitchell Hashimoto — HashiCorp co-founder and the author of Ghostty — announced his new company, Superlogical, whose first product is a server-side terminal multiplexer. The same summer, Herdr was gathering momentum at the local end of the terminal, and our OpenAB Connect shipped at the other. All three answer the same question — when AI agents become permanent residents of the terminal, where should a session live, and how far should it be trusted? — and each placed a different bet.
One spectrum, two axes
Sort by where the session lives: Herdr is inside your terminal; Superlogical is a server-side daemon meant to span environments; OpenAB Connect is a remote sandboxed container behind a WireGuard tailnet. Sort by trust assumption instead and the order does not change: Herdr trusts the session fully (it is you); Superlogical has not published a trust model; OpenAB Connect assumes from day one that what is inside cannot be trusted. Two axes, one spectrum — Herdr and OpenAB Connect at the two ends, Superlogical in the middle.
| Herdr | Superlogical | OpenAB Connect | |
|---|---|---|---|
| Where the session lives | a local daemon (plus an SSH remote mode) | a server-side daemon, aiming to span local, remote and production | a remote sandboxed container (k8s pod or ECS task) |
| Trust assumption | full trust — runs your processes as you | unpublished — auth, permission separation and audit all pending | zero trust — assumes what is inside cannot be trusted |
| Isolation | none (keeping your environment is the point) | none (the daemon holds your privileges) | uid 1000, no sudo, read-only rootfs, no SA token |
| Credential model | none (a local socket API) | unannounced | day one: admin and attach planes split; per-session tokens with a TTL and no signing key |
| Agent state semantics | first-class: blocked / working / done, and a socket API for agents to orchestrate each other | planned (stage three of the vision) | none — deliberately out of scope; agent semantics belong to openab |
| Reconnect | survives disconnects (not the host powering off) | screen snapshot, then the raw stream resumes — full terminal state | ring-buffer replay; thinner state semantics |
| Perceived latency | local, so not a question | each client renders with embedded libghostty, decoupled from the server by design (unmeasured) | set by the client; the runtime measures 1.0 ms, 78–82 ms from a laptop over WiFi |
| Maturity | usable today, open source | pre-beta: a waitlist, no benchmarks, no spec | Phase 1, in real use on k3s and ECS Fargate |
| Its bet | orchestration | durability | trust |
| What it gives up | isolation, and persistence beyond the host | the trust model (for now) | environment freedom, and terminal state semantics |
Herdr: orchestration at full depth, zero isolation
Herdr is an agent multiplexer that runs inside your existing terminal (Rust + Ratatui, open source). Agents are first-class runtime objects: a sidebar shows each one as blocked, working or done; a socket API lets agents spawn panes, read each other's output and wait on one another. Sessions survive disconnects in a daemon — though not the host powering off — and an SSH remote mode reaches other machines.
Everything runs as you, on your machine. Zero isolation is the selling point, not a defect: you keep your shell, your SSH setup, your fonts and keybinds. Its bet is orchestration: real-time visibility of agent state is the most valuable thing in a multi-agent world.
Superlogical: durability at full depth, trust left blank
Superlogical pulls the session out of the terminal and into a server-side daemon. The daemon owns the PTY and parses its output into authoritative state with libghostty, while distributing the same raw bytes to every client — each client embeds the same libghostty and parses and renders on its own. On reconnect the daemon pauses the PTY, ships a snapshot of the screen, and resumes the raw stream once the client signals ready. The vision is a “multiplexer for all work” spanning local machines, remote hosts, sandboxes and production.
Its bet is durability: the session itself, as a layer independent of any client, is the most valuable abstraction — the same kind of bet Terraform placed on the state layer. To be plain about what exists: as of this writing there is a waitlist, no benchmark, no protocol spec, and auth, permission separation and audit — the things production requires — are all unannounced. Durability is pushed as far as it goes; trust is left blank.
OpenAB Connect: trust at full depth, the environment pinned down
We bet on the opposite end. The shell Connect attaches to lives in a deliberately unprivileged container: uid 1000, no sudo, a read-only rootfs, no service-account token, and a workspace that is discarded with the session. The credential model is there from day one: the admin plane and the attach plane are separate, and per-session tokens carry a TTL and no signing key — a compromised shell hitting the admin API over loopback gets a 401, an invariant the adversary test asserts explicitly. The whole path runs over a WireGuard tailnet, and the runtime never listens on a routable address (the runtime is MIT-licensed open source).
Our bet is trust: agents will run away and shells will be tricked, so the environment must assume what is inside is hostile. The costs are stated too: the environment is pinned down, and a raw byte pipe leaves perceived latency almost entirely to the client — the runtime measures 1.0 ms of echo latency from its own host, against 78–82 ms from a laptop over WiFi. Superlogical's client-side state rendering attacks exactly the gap our README names as our largest.
Three bets, three layers
The interesting part is that the three do not exclude each other: a Herdr-style agent-state interface, on a Superlogical-style durable session, living in an OpenAB-style sandbox — orchestration, durability and trust each solve one layer. For now, three products are growing toward the middle from their own ends.
The middle also means being squeezed from both sides: for local orchestration it will not match Herdr's immediacy, and its zero-trust story is not yet on the table. Hashimoto is betting the durable-session layer wins outright. We are betting that on the day agents are truly let loose, the first question anyone asks is — what can it reach?