{"slug": "herdr-guard-command-policy-for-multi-agent-terminals", "title": "Herdr-guard – Command policy for multi-agent terminals", "summary": "Herdr, a terminal multiplexer, released a plugin called herdr-guard that enforces cross-agent command policy across multi-agent terminals, watching every pane, auditing risky commands, and best-effort interrupting dangerous shell input. The plugin, which requires Herdr 0.7.5+, Node.js 20+, and macOS or Linux, uses a text policy layer with regex or substring matching and supports audit, alert, and interrupt severity levels, but it is advisory against processes that can disable the plugin or use unobserved popups or nested sessions.", "body_md": "Cross-agent command policy for [Herdr](https://herdr.dev): watch every pane,\naudit risky commands, notify you, and best-effort interrupt dangerous shell\ninput.\n\n*Scripted dry-run using the real policy engine; the displayed command is never\nexecuted.*\n\n| Pane | Guard sees | Interrupt guarantee |\n|---|---|---|\n| Interactive zsh/bash | Typed and unsubmitted input | Strong pre-execution cancel via `ctrl+c` |\n| Raw/no-echo shell | Nothing typed | None; `stty -echo` is alerted |\n| Pi/Claude/Codex TUIs | Only rendered terminal text | Incidental; harness hooks remain authoritative |\n| Logs/builds | Printed output | Best-effort while process is running |\n| Herdr popups | Nothing in v1 | Blind spot |\n\nThis is a text policy layer, not intent analysis. Shell obfuscation, detached nested multiplexers, popup panes, and a stopped/disabled guard are documented limitations. Use native agent hooks for authoritative tool-call enforcement.\n\n```\nherdr plugin install StructuPath/herdr-guard\n```\n\nFor local development:\n\n```\nherdr plugin link /path/to/herdr-guard\n```\n\nThe startup hook seeds the per-user rules file and idempotently opens the Guard\npane. You can also focus or reopen it from the plugin action list with\n`structupath.guard.open`\n\n. The pane subscribes to Herdr's\n`pane.output_matched`\n\nevents and maintains a local `pane.read`\n\nsweep backstop.\nIt does not modify other panes during installation.\n\n**Open guard**— launch the dashboard pane.** Pause enforcement**— pause actions for 15 minutes; matches remain audited.** Resume enforcement**— reactivate immediately.** Test a command**— dry-run text against active rules.** Reset guard rules**— back up and reseed defaults.\n\nRules live at `$HERDR_PLUGIN_CONFIG_DIR/rules.json`\n\n; runtime audit files live\nat `$HERDR_PLUGIN_STATE_DIR`\n\n. Both directories are private (`0700`\n\n) and files\nare written `0600`\n\n. The configuration supports `audit`\n\n, `alert`\n\n, and\n`interrupt`\n\nseverity, `regex`\n\nor `substring`\n\nmatching, and `prompt_only`\n\n.\n\nA workspace may add substring rules in `.herdr-guard.json`\n\n. Project rules and\nseverity raises are always capped at `alert`\n\n; repository-controlled regex and\ninterrupt rules are rejected. Workspace rules cannot disable or lower global\nrules unless the user explicitly enables `allow_project_override`\n\nin the\nglobal configuration. Configuration writes are atomic and malformed updates\nkeep the last known-good policy.\n\nThe shipped policy covers destructive filesystem/Git/infrastructure commands,\nsecret-file reads, publishing, data exfiltration, and evasion indicators such\nas `stty -echo`\n\n, detached tmux/screen, `disown`\n\n, base64-to-shell, and eval\nsubshells. Review the defaults before enabling interrupt rules in production.\n\nThis plugin is ordinary local code with the same privileges as Herdr and the user who installs it. Herdr plugins are not sandboxed or reviewed. Inspect the manifest and source before installing. The audit log contains sensitive metadata even after token redaction; protect and rotate it appropriately.\n\nThe guard is advisory against a process that can disable the plugin, kill its pane, stop Herdr, or use an unobserved popup/nested session. The socket API has no plugin-specific read-only ACL in the current Herdr release. Events are reconciled with baseline suppression to avoid replayed scrollback triggering a fresh interrupt, and interrupt matches are intentionally never deduplicated.\n\nRequirements: Herdr 0.7.5+, Node.js 20+, macOS or Linux.\n\n```\nnpm test\nherdr plugin link .\nherdr plugin list\n```\n\nTests use a fake NDJSON socket and temporary config/audit directories; they do not open panes or invoke live actions. The implementation uses plain ESM Node with no runtime dependencies.\n\nThe demo is reproducible with [VHS](https://github.com/charmbracelet/vhs):\n\n```\nvhs assets/demo.tape\n```\n\n- Harness reporters for Pi/Claude Code tool calls.\n- Shell pre-exec approval flow.\n- Popup visibility in Herdr's event/API surface.\n- Per-plugin socket ACLs or read-only tokens.\n- Windows and named-session aggregation.\n\nMIT licensed.", "url": "https://wpnews.pro/news/herdr-guard-command-policy-for-multi-agent-terminals", "canonical_source": "https://github.com/StructuPath/herdr-guard", "published_at": "2026-07-23 03:02:46+00:00", "updated_at": "2026-07-23 03:22:26.970829+00:00", "lang": "en", "topics": ["ai-agents", "developer-tools", "ai-safety"], "entities": ["Herdr", "herdr-guard", "Node.js", "macOS", "Linux", "VHS"], "alternates": {"html": "https://wpnews.pro/news/herdr-guard-command-policy-for-multi-agent-terminals", "markdown": "https://wpnews.pro/news/herdr-guard-command-policy-for-multi-agent-terminals.md", "text": "https://wpnews.pro/news/herdr-guard-command-policy-for-multi-agent-terminals.txt", "jsonld": "https://wpnews.pro/news/herdr-guard-command-policy-for-multi-agent-terminals.jsonld"}}