Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add narumiruna/pi-extensions --skill herdrgit clone --depth 1 https://github.com/narumiruna/pi-extensionsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/narumiruna/pi-extensions/herdr)<a href="https://agentmods.dev/skills/narumiruna/pi-extensions/herdr"><img src="https://agentmods.dev/badge/skills/narumiruna/pi-extensions/herdr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/narumiruna/pi-extensions/herdr"><img src="https://agentmods.dev/badge/skills/narumiruna/pi-extensions/herdr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.00579 |
| Opus 5.5 | $0.00030 | $0.00232 |
| Sonnet 5.5 | $0.00015 | $0.00116 |
| Haiku 4.5 | $0.00007 | $0.00058 |
Grade A, and why
herdr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
97% identical to herdr — 222 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
Herdr
Before the first Herdr control command in a session, check whether the complete output of herdr --skill is already present in the current context.
If it is present, reuse it and do not load it again.
Otherwise run this single shell call:
test "${HERDR_ENV:-}" = 1 || {
printf '%s\n' "Not running inside Herdr." >&2
exit 1
}
herdr --skill
If the environment check or command fails, report the error and stop. Read the returned skill completely and follow it as the authoritative operating instructions for the installed Herdr version. Run it again only after compaction removes those instructions or when the user explicitly asks to refresh them.
Apply this cleanup policy in addition to those version-specific instructions:
- Maintain an in-context cleanup ledger with each pane ID you create, its intended lifetime, and every stable pane-generation, terminal, and shell identity that Herdr exposes; for an agent pane, also record the assigned agent and stable agent-session or occupant-process identity.
- Mark a pane as retained only when the user explicitly asks it to remain open after the task for later inspection or use, or when its continued existence is itself part of the requested result, and never close a retained pane automatically.
- For a temporary pane, collect the required output, decide that no follow-up is needed, and attempt cleanup as soon as its work is no longer needed.
- Automatically close a pane only through an operation documented by the loaded instructions that atomically checks the recorded pane and occupant identity together with an acceptable live state at mutation time.
- For an agent pane, the atomic guard must match the assigned agent and every recorded stable identity and require
idleordone; for a returned shell, it must match the recorded pane-generation, terminal, and shell identities and require no replacement occupant or foreground process. - A separate state read followed by an unconditional close is unsafe; if the installed Herdr version provides no suitable guarded close, leave the pane open and report that limitation.
- Keep unresolved temporary entries after cancellation or interruption while the current model context survives, retry guarded cleanup at the next recovery boundary before further Herdr work, and sweep them again before the final response.
- Never close the calling pane, a pre-existing pane, or a pane created by the user or another agent.
- If guarded closure fails, keep the ledger entry and report the pane ID and reason.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +12 lines 76ec3b565d5b
- 1mo ago Changed · -173 lines 8d29de08b1c8
- 1mo ago First seen · 196 lines · 74 tokens per session scan A 0786182f02eb
herdr is a skill published in the GitHub repository narumiruna/pi-extensions (693 stars, last pushed today), licensed MIT. It adds 74 tokens to every session and 579 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 97% identical to herdr, differing in 222 lines, and is treated as a copy.
Other skills, from other repositories
migrate-to-shoehorn
Migrate test files from as type assertions to @total-typescript/shoehorn. Use when user mentions shoehorn, wants to replace as in tests, or needs partial test data.
pi-tui-design
Create distinctive, crafted TUI components for pi using @mariozechner/pi-tui and @mariozechner/pi-coding-agent. Use when building interactive terminal UIs — custom components, overlays, dialogs, dashboards, widgets, data visualizations, animated elements, game-like interfaces, or any visual TUI work inside pi…
session-search
Search and verify Joel's Pi, Claude, Codex, Cursor, Grok, and OpenCode session history. Use when asked to recover prior context, find exact transcript evidence, inspect session receipts, continue old work, or verify capture health. Prefer flowing recall before raw transcript search when the question is about prior…
linear-tracker
Resolve project-local issue tracker routing and publish Linear issues safely. Use before creating Linear issues, PRDs, phase breakdown issues, or when deciding whether Linear/GitHub/local docs is the configured tracker. Enforces capability ≠ routing: Linear requires project-local policy, team association, auth, and…
shortlink-qr
Create joel.dev shortlinks and QR assets. Use when Joel asks for a QR code, stage/demo shortlink, joel.dev redirect, link label that looks good in phone camera UI, or a copyable QR asset.
session-capture
Historical pointer for the retired Codex-to-Central capture plugin. Use only to inspect legacy state during migration; current capture belongs to the joelclaw flowing-memory host adapter.