Shepherd 2.0

Shepherd 2.0 moves Shepherd beyond the browser tab. You can now drive your herd from a native Mac app, from your terminal, or from your desktop bar. Two built-in plugins turn production errors and red CI into issues that Shepherd fixes on its own. A fast judge makes the calls that used to need a whole agent.

It is a major version because the Herd Rundown is gone. If you never set a SHEPHERD_RUNDOWN_* variable, upgrading is a normal bun run update.

Shepherd for Mac

A native macOS app for Shepherd, built in SwiftUI and not a web view. It covers the whole operator loop:

• Sessions: the herd sidebar, with repo and state filters and usage meters.
• Session detail: activity, diff, files, git and a real terminal.
• Review and merge: plan gates, pull requests, review requests and merge automation.
• Starting work: a new-task composer that starts from an issue, plus held tasks, Up Next and the Done panel.
• Staying informed: native notifications and a command palette.

It connects to the Shepherd server you already run, over Tailscale or HTTPS. It can also install and supervise a local server on the Mac itself. Updates arrive through Sparkle and are signed; the app checks at launch and every hour, and installs on quit.

Try it: the app is in beta, and TestFlight is coming soon. Until then, download the tester build from the Mac releases, or open the gear menu in Shepherd on a Mac and choose Native macOS App → Downloads. It needs macOS 15 or newer. Builds are signed with Developer ID and notarized by Apple. See the Mac app guide.

The shepherd CLI

A fast, single-binary Rust CLI for everything you do in the web UI:

• Sessions: list and inspect sessions, start new ones, and steer, interrupt, resume or archive them.
• Plan gates: approve a plan with shepherd go.
• Pull requests: request reviews, merge, and launch the merge train.
• The backlog: drive the drain, Up Next and held tasks.
• Epics: run and approve epics.
• Setup: edit settings and per-repo config, run shepherd diagnose and apply its fixes.

shepherd events tail streams live events as NDJSON. Output is a table in a terminal and JSON everywhere else, and exit codes are stable, so the CLI is as scriptable as it is interactive.

The installer puts the binary in ~/.local/bin and bun run update keeps it at the server’s version. Prebuilt binaries cover Linux x86_64 and aarch64 and Apple Silicon Macs. Create an access token under Settings → Access, then run shepherd login --token. Tokens have scopes, from read up to full.

Your agents get a read-only slice of the same view. Every session now has MCP tools to list the herd, look up another session, and check its own PR, CI, critic and plan-gate status, without shelling out to gh.

→ shepherd CLI reference

Sentry auto-fix

Production errors now become fixes on their own. The bundled Sentry plugin polls your Sentry organization for new, escalating and regressed high-priority issues. It keeps only the ones whose stack trace points into one of your repos, then has a read-only agent triage each one. The ones it judges fixable, with high confidence, become a PII-scrubbed GitHub issue that asks for a failing reproduction test and a fix.

From there it is ordinary Shepherd work: plan gate, critic and learnings included. The PR carries Fixes <SHORT-ID>, so Sentry resolves the issue when you release. Several limits keep it safe:

• at most 3 issues per repo per day;
• 2 automatic attempts before a regression waits for a person;
• Sentry data is always fenced as untrusted;
• it never merges anything.

It is a drop-in replacement for Sentry’s Seer autofix. Turn Seer off for the projects you map.

Turn it on: Settings → Plugins → Sentry. Paste an internal-integration token, confirm the repo ↔ project mappings, and tick Enabled.

→ Sentry setup

CI Watch

The same idea for your default branch. The bundled CI Watch plugin watches scheduled, push and manually dispatched runs and follows each failing job:

1. It reruns the failed jobs once. A pass means the failure was flaky, so nothing is filed.
2. The judge sorts real failures into regression, flaky, infra, secret/config or eval variance.
3. A read-only triage agent reads the failed-step log.
4. It files an issue that asks for a reproduction and a root-cause fix. It never asks to disable a check.

When the build goes green before anyone started on the issue, CI Watch closes it again. It never merges anything.

Turn it on: Settings → Plugins → CI Watch. Tick Enabled, then add each repo you want watched. It works on GitHub repos.

→ CI Watch setup

Both plugins are built on new plugin APIs: forge issues, default-branch runs, read-only agents and the judge. Your own plugins can use the same APIs. See Plugins.

The judge

Shepherd makes a lot of small decisions:

• Did the agent stop because it is done, or because it has a question?
• Is that a real menu on screen, or text that looks like one?
• Is this house rule relevant to this task?

Until now, most of them spawned a Claude agent. 2.0 can route them to Jev, TypeSafe’s fast decision model. Every call is a single typed API request that returns in about a second, costs a fraction of a cent, and uses no subscription quota. Any failure falls back to the old path.

What it powers:

• Fast stop classifier: decides why an agent stopped, so autopilot reacts faster. It passed our evaluation against the Claude classifier it replaces.
• Blocked-pane double check: confirms a detected menu or yes/no prompt before it becomes a card. It can delay a card, but never answers one.
• House rules for this task only: leaves out house rules the task isn’t about, and retires trial learnings that never turn out relevant.
• Up Next readiness: the Recommended sort puts issues an agent can likely finish in one PR first.
• CI Watch classification, and ctx.judge for plugins.

Turn it on: put JEV_API_KEY in ~/.shepherd/env and set SHEPHERD_JUDGE=1 (the value must be 1), or switch the toggles in Settings → Session. Each use has its own switch, and SHEPHERD_JUDGE_DAILY_USD caps spend (default $1 a day).

→ Configuration: the judge

Shepherd in your Omarchy bar

A community plugin for Omarchy puts your herd on the desktop bar. The bar shows how many sessions are waiting on you, stays empty until one is, and takes you to the session in one click. It uses a read token only, so it can see your herd but never steer it.

→ Shepherd on the Omarchy plugin marketplace

Also new

Models and capacity

• New models: Claude Opus 5.5 and Sonnet 5.5; Codex GPT-6 Astra, Sol and Luna. GPT-5.6 Sol is the new Codex default, and Codex now offers Max and Ultra reasoning.
• Capacity: when one coding CLI is about to run out of weekly capacity, the usage popover offers to switch the default to the other. You can also redeem Codex earned resets, by hand or automatically.
• Usage breakdowns: by model and by role (critic, recap, classifier and so on), for Claude and Codex alike.
• Delivery lens: a new Usage tab with first-pass rate, rework cycles, time to first review, lead time and the first-push CI green rate.
• Cold-resume warning: a chip marks parked sessions that would be expensive to resume.

Reviews and merging

• Critic severity: findings are marked Important or Nit. Nits never block a PR.
• REVIEW.md: the critic reads per-repo review rules from REVIEW.md, taken from the base branch so a PR can’t rewrite them.
• Plan drift: reported against the approved plan, and shown in the Delivery lens.
• Merge confirmation: every manual merge names the PR, target branch and method before it runs, and respects a repo’s reviewer and merger roles.
• Green means mergeable: a PR that is behind, conflicting or blocked shows amber, not green.
• Epic conflicts: an agent is started automatically to resolve conflicts on epic landing PRs.

Starting and steering work

• Shape: an optional round of clarifying questions in New Task before a session starts.
• Plain mode: runs an agent without plan gate, autopilot or PR instructions. /design selects it.
• Amend task: changes a running task’s brief. The critic, plan reviewer and recap all see the amendment.
• Request reviewers: ask upstream people for a review straight from the PR badge.
• Auto-archive: sessions that have provably settled for 7 days are archived.

Everywhere else

• Phone layout: reworked for thumb reach.
• herdr: support up to 0.9.1.
• Watchdog: a frozen server now writes a stall report and is restarted by systemd.

For the full list, see the v2.0.0 changelog.

Upgrading

bun run update

• Herd Rundown removed. The daily digest had no users, so it is gone:
  • Delete SHEPHERD_RUNDOWN_CLI, SHEPHERD_RUNDOWN_MODEL and SHEPHERD_RUNDOWN_EFFORT from your environment. They are ignored now.
  • Drop any script that calls /api/herd/digest, which now returns 404.
  • The herd_digests table is dropped on first boot. Past rundown spend stays visible under Usage → Overhead.
• systemd unit. bun run update syncs shepherd.service, which gains WatchdogSec=60 for the freeze watchdog. If you run a hand-edited unit, add WatchdogSec=60 and NotifyAccess=all yourself.
• The CLI is installed on the next update. Set SHEPHERD_NO_CLI=1 to skip it.