-
Notifications
You must be signed in to change notification settings - Fork 0
Guard
Cross-agent command policy for Herdr: watches every pane, audits risky commands, notifies you, and best-effort interrupts dangerous shell input. Runs in the background — mostly hands-off.
Repo: StructuPath/herdr-guard · Full reference: the repo README
| Action | What |
|---|---|
open |
Open the guard dashboard pane (policy / activity) |
test |
Dry-run a command against the live policy (allow/deny, nothing executes) |
pause / resume
|
Pause enforcement for 15 minutes (matches stay audited) / reactivate |
reset-rules |
Back up + reseed the default ruleset |
Everyday: leave it running. Use test when unsure whether a command would be blocked, pause/resume to override temporarily.
| Pane | Guard sees | Interrupt guarantee |
|---|---|---|
| Interactive zsh/bash | Typed and unsubmitted input | Strong pre-execution cancel via ctrl+c
|
| Raw/no-echo shell | Nothing typed | None; stty -echo is itself alerted |
| Agent TUIs (Pi/Claude/Codex) | Only rendered terminal text | Incidental; harness hooks remain authoritative |
| Logs/builds | Printed output | Best-effort while the process runs |
| Herdr popups | Nothing in v1 | Blind spot |
This is a text policy layer, not intent analysis — advisory against a process that can disable the plugin or use an unobserved popup. Use native agent hooks for authoritative tool-call enforcement.
Rules live at $HERDR_PLUGIN_CONFIG_DIR/rules.json (severity audit / alert / interrupt; regex or substring matching; prompt_only). The shipped defaults cover destructive filesystem/Git/infra commands, secret-file reads, publishing, data exfiltration, and evasion indicators (stty -echo, detached tmux/screen, disown, base64-to-shell, eval subshells).
A workspace may add substring rules in .herdr-guard.json, but project rules are capped at alert — repository-controlled regex and interrupt rules are rejected, and workspace rules can't lower global ones unless you explicitly enable allow_project_override. Review the defaults before enabling interrupt rules in production.