Vigla

Supervise the merge. Not every terminal.

Run Claude Code, Codex CLI, Antigravity, and other agent CLIs as one supervised team — each agent in its own git worktree, every submission audited, every mission reversible in one click.

Watch the replay · Website · How it works · Compare · Build a local DMG · Architecture · FAQ · Roadmap · Contributing

_{Deterministic recorded events · no account or credentials · click to open the interactive replay}

Running one AI coding agent means babysitting one terminal. Running five means five terminals, five diff reviews, and five chances to merge something you never actually read. Vigla turns that into a single operations room:

• Two decisions, not two hundred. You assign the mission and set the authority envelope. A supervisor agent decomposes the work, directs the workers, audits every submission, and escalates to you only when one of four bounds trips: Scope, Reversibility, Risk, or Quality.
• Cross-vendor by design. Claude Code, Codex CLI, Antigravity, and profile-backed agent CLIs can work the same mission side by side — pick the best agent for each task instead of the one you happen to have open. Adapters normalize every vendor's output into one canonical event stream.
• Everything is reversible. Each worker runs in an isolated git worktree; final merge records durable before/merged anchors. Reverting an entire mission creates a normal Git revert commit and preserves later work.
• Local-first. A Rust orchestrator, Tauri shell, and SQLite event store — no cloud control plane, account, or product telemetry. The default build adds no app-originated network traffic beyond the vendor CLIs you launch. An EMBEDDINGS=1 build fetches its public embedding model into a local cache on first use, then performs inference locally.

Vigla supervises the agent CLIs you already have. It does not wrap LLM APIs, run its own models, or add another billing layer.

Launch receipt: 27/27 seeded failure trajectories escalated within the default retry bounds. Reproduce the fixed, credential-free case set with cargo xtask receipt; the method, data, and limitations are public and CI-checked.

Try the no-install replay

Open the read-only browser replay to step through accepted, bound-tripped, and quota-paused missions in the real Operations Room UI. It runs entirely on recorded canonical events: no account, vendor CLI, credentials, or network-backed agent is involved.

Run the credential-free demo locally

Vigla ships with a deterministic mock harness, so you can watch a full mission — decomposition, parallel workers, audit, verdict — without credentials or token spend:

git clone https://github.com/Kilbex/Vigla.git && cd Vigla
pnpm install --frozen-lockfile
./scripts/dev.sh

When the Operations Room window opens, use the Deploy panel and pick a bundled mock script. The deterministic scenarios cover happy paths, blocked work, failures, and quota exhaustion — including the unhappy paths most demos hide.

Prereqs: macOS 12+, Rust 1.95 via rustup, Node 22, pnpm 10, Xcode Command Line Tools. See CONTRIBUTING.md for the full setup.

How it works

1 — Assign a mission inside an envelope. Describe the goal, choose the worker roster and models, and set the authority envelope. In review mode the supervisor proposes a plan first — task graph, file scope, risk fit — and waits for your approval:

2 — The supervisor arbitrates; you stay out of the loop. Workers execute in parallel worktrees while the supervisor reviews each submission and decides Accept / Extend / Scrub / Escalate — inside your envelope, without pinging you. Live state, diffs, tests, cost, and raw terminals are always one click away if you want to watch.

3 — You judge results, not keystrokes. Finished missions land in your inbox with a structured verdict: audit score, test results, files changed, residual-risk band, unresolved issues — and a revert button that undoes the whole mission atomically:

The vocabulary is small and precise — mission, worker, envelope, arbiter, verdict — and defined in docs/lexicon.md.

How it compares

The table is positioning, not a feature checklist. Each cell is backed by a primary source below; cells are re-verified before each release.

Sources verified 2026-07-21. “Not documented” means the linked product documentation does not describe that capability; it is not a claim that an internal implementation is impossible.

Vendor support

Real workers are driven from the in-app Deploy panel; the mock harness covers demos and CI. Integration tests are the authoritative verification path for the fully gated vendors.

Google ended consumer Login with Google access for Gemini CLI on 2026-06-18. Vigla retains the adapter for existing enterprise and legacy configurations, but Gemini CLI is no longer a primary launch path. Google directs affected consumer users to Antigravity in its official deprecation notice.

Mission supervision is Claude-backed today; non-Claude supervisor options should be treated as experimental until their end-to-end tests land. Vigla does not pin vendor CLI versions — the launch path verifies each configured binary, and the (#[ignore]-gated) real-CLI integration tests track adapter compatibility:

cargo test -p vigla-orchestrator --test real_claude_gate -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_codex_run   -- --ignored --nocapture
cargo test -p vigla-orchestrator --test real_antigravity_run -- --ignored --nocapture --test-threads=1
cargo test -p vigla-orchestrator --test supervisor_live  -- --ignored --nocapture

The Claude, Codex, and supervisor gates use tests/samples/sandbox/, a workspace-excluded crate with a deliberately wrong multiply function. The Antigravity gate creates the same kind of isolated failing Rust fixture in a temporary repository. Each gate asserts that the agent fixed the defect.

Feature tour

Built in public

_{A visual interpretation of the public roadmap. The linked document is the source of truth.}

Priorities move with operator evidence and focused contributions. See the full roadmap for acceptance boundaries and the work Vigla deliberately will not take on.

Tech stack

The only abstraction Vigla permits is the event boundary: vendor CLI bytes → canonical events. Adapters live in crates/adapters/{vendor}, one crate per vendor, pure translation — no I/O, no process spawning, no git.

vigla/
├── app/                  # Tauri 2 + React 19 + Vite + TS
│   ├── src/              # React UI, Zustand stores, hotkeys
│   └── src-tauri/        # Tauri host (Rust): IPC, event forwarding
├── crates/               # All Rust library/bin crates (Cargo workspace)
│   ├── orchestrator/     # Rust supervision crate (business logic)
│   │   ├── src/memory/               # Memory Kernel (event-sourced)
│   │   ├── src/mission_runtime/      # Mission state machine + replay
│   │   ├── src/mission_supervisor_run/ # Supervisor turns + review loop
│   │   ├── src/supervisor/           # Worker process lifecycle + resume
│   │   ├── src/arbiter/              # Bound-based escalation decisions
│   │   └── resources/                # Bundled at compile time:
│   │       ├── vendor_profiles/      #   per-vendor command-rendering policy
│   │       └── skills/               #   worker skill set (embedded)
│   ├── adapters/         # One pure crate per vendor CLI + supervisor
│   ├── event-schema/     # Canonical typed event contract
│   ├── mock-harness/     # Mock vendor CLI (credential-free demos)
│   └── xtask/            # Workspace task runner (cargo xtask)
├── tests/                # Playwright e2e specs + real-CLI sample targets
├── docs/                 # Lexicon, good-first-issues, media
└── scripts/              # dev.sh, build.sh, capture-readme-media.cjs

Deep dive: ARCHITECTURE.md covers the orchestrator, memory kernel, mission lifecycle, arbiter / audit / recovery, event schema, and per-vendor adapters.

Requirements

• macOS 12+. Linux and Windows are on the roadmap — the non-host Rust workspace is built, linted, and tested on Linux in CI; desktop packaging and platform UX are scoped on the roadmap.
• Development: Rust 1.95 (pinned via rust-toolchain.toml), Node 22.x, pnpm 10.x, Xcode Command Line Tools.
• Vendor CLIs are optional and only needed for real (non-mock) workers.

Build a local DMG

Vigla does not publish maintainer-built binaries. On a Mac, clone the source and run one command:

./scripts/build.sh

The script installs the locked frontend dependencies, builds the application, ad-hoc signs it without an Apple account or personal signing identity, verifies the app and disk image, and prints the DMG path and SHA-256 checksum. The local artifact remains under target/release/bundle/dmg/; no workflow uploads it.

Keep the printed checksum with the artifact. SECURITY.md documents the independent shasum, hdiutil, and codesign checks.

Prerequisites are the development tools listed in Requirements. Set EMBEDDINGS=1 when running the command to include the optional embeddings feature. Its first use downloads the public FastEmbed model into the per-user cache; if that download is unavailable, retrieval falls back to local BM25.

Known limitations

Design trade-offs in the current build, not bugs:

• Real supervisor execution is Claude-gated. The production mission-supervisor path and its end-to-end verification are Claude-backed today.
• Memory retrieval is local and best-effort. Alias-expanded BM25 with optional embedding / hybrid re-ranking; degrades to lexical retrieval instead of blocking workers.
• The supervisor sees typed mission events, not raw worker dialogue. By design — escalation is bounded on outcomes, not chain-of-thought.
• Session resume requires vendor session-ID support. CLIs that don't expose a session ID can't be continued across app restarts.

Why "Vigla"?

Vigla (Byzantine Greek βίγλα, "watchpost" — from Latin vigilia, the root of vigilance) was the imperial guard regiment that kept the night watch on campaign: it posted the sentries, held the watchword, and ran the signal line so the emperor could actually sleep. That is this app's entire job — a supervisor that keeps trained watch over a fleet of powerful agents and wakes you only when something crosses a bound.

In category terms: Vigla is an open-source control plane for supervised agent operations — coordinating fleets of AI coding agents instead of babysitting them one terminal at a time.

Contributing

Start with CONTRIBUTING.md and ARCHITECTURE.md; project authority and maintainer succession are explicit in GOVERNANCE.md. Newcomer-friendly tasks live in docs/GOOD_FIRST_ISSUES.md — adapter fixture work is the recommended first PR and is designed to land in under two hours.

Questions and bug-report routing: SUPPORT.md. Security reports: see SECURITY.md. Reviewing or recording Vigla? The public creator kit provides a 10-minute script, credential-free inputs, media, evidence, and exact claim boundaries. Operators coming from vibe-kanban can use the concept-by-concept migration guide; it does not claim a database importer or kanban-board parity.

License

Apache 2.0, with the project NOTICE. Bundled component attribution and retained licenses are in THIRD_PARTY_NOTICES.md; the generated, self-contained THIRD_PARTY_NOTICES.txt covers the locked production Rust and JavaScript dependency graphs.