herdr-remote

Why it's ranked here

The case rests on how seriously it treats remote control of a terminal. The server binds to loopback by default and refuses to start on any other address without a shared token. A tokenless server only accepts browser connections from localhost origins. Writing to plain shell panes stays off unless an environment switch is set, and every write action lands in a JSONL audit log. Licensing is AGPL-3.0 or later, with a commercial option offered. The narrow audience is the limit: it only matters if you already run herdr.

What's good

The security notes say plainly what access means: anyone connected to the server can do what someone at the keyboard can do, and enabling shell panes equals shell access to every polled host. Transcript reads are confined to a fixed path shape and a strict session id pattern, and clients send only a pane id, never a path. The chat bot scrubs both its own token and the server token from errors before logging, and silences an HTTP library that would print the token in request URLs. Repeated reads edit one live message in place rather than flooding the chat.

Tradeoffs

Exposing it beyond your machine means running a Cloudflare tunnel or similar, and at that point the token is all that stands between the internet and your agents. The chat bot accepts messages from anyone until a chat id is configured, by design for first-run discovery. The Makefile run target names a relay script spelled differently from the one in the tree, and its install target points at a requirements file, while the documented path is uv inline script metadata. Web push to iPhones silently fails unless you set a real contact address, which the code warns about at startup.

How to use it well

Start with the native Mac app if you only want to watch local agents; it needs no server or account. Add the Python server and the chat bot when you step away from the desk and want to approve a blocked agent from your phone. Set a long random token before opening a tunnel, set a real push contact address if you use an iPhone, and leave shell panes off unless you accept shell access over the network. Turn transcript reads off if conversations may contain secrets. It does not run or orchestrate agents itself.

Observed

License

Dual: AGPL-3.0-or-later or commercial (LICENSE)

Language

Python server and bot; JavaScript web client; Swift and C# native clients

Interfaces

WebSocket server, phone web app, Telegram bot, terminal UI, macOS and Windows desktop apps

Platform support

macOS, Linux, Windows (herdr-plugin.toml platforms)

Packaging

uv inline script dependencies for the Python components; herdr plugin manifest

Default network binding

127.0.0.1; token required for non-loopback binds (relay/herdr_relay.py)

Shell pane writes

Off by default, enabled by an environment switch (SECURITY.md)