--- title: A practical guide to Herdr plugins | daily.dev description: A hands-on walkthrough of Herdr's plugin system, covering how to find, inspect, install, configure, and run plugins from GitHub, plus security precautions... canonical: https://daily.dev/posts/a-practical-guide-to-herdr-plugins-4znm34yka twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A practical guide to Herdr plugins | daily.dev og:description: A hands-on walkthrough of Herdr's plugin system, covering how to find, inspect, install, configure, and run plugins from GitHub, plus security precautions... og:url: https://daily.dev/posts/a-practical-guide-to-herdr-plugins-4znm34yka og:image: https://api.daily.dev/og/posts/4zNM34YkA.png og:image:alt: A practical guide to Herdr plugins og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A practical guide to Herdr plugins **[Flavio Copes](https://daily.dev/sources/flaviocopes)** · 7 min read · 2 upvotes · 0 comments ## Summary A hands-on walkthrough of Herdr's plugin system, covering how to find, inspect, install, configure, and run plugins from GitHub, plus security precautions since plugins run unsandboxed as the user. It also shows how to build, link, and test a small local plugin using a manifest with actions, panes, events, and startup hooks, and lists the runtime environment variables Herdr injects into plugin commands. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I install a Herdr plugin from a GitHub repository and pin it to a specific version? Run herdr plugin install owner/repository, adding a subdirectory path if the repo holds multiple plugins. To pin an exact revision, append --ref v1.2.0. Herdr clones the repo with Git, runs the build commands declared in the manifest, and registers the plugin only if the build succeeds; avoid the --yes flag on first install so you see the source and commands before confirming. _daily.dev surfaces practical setup steps like this for developers evaluating new CLI tooling before trusting it._ ### Are Herdr plugins sandboxed when they run? No, Herdr plugins run as the local user, inherit the full environment, and can call the entire Herdr CLI without any sandboxing. They should be treated the same as a shell script or editor extension being run locally: read the herdr-plugin.toml manifest, check build and runtime commands, and inspect the actual scripts before installing. _Security-conscious developers vetting third-party extensions can find similar practical checklists on daily.dev._ ### How do I create and test a local Herdr plugin without publishing it to GitHub? Write a herdr-plugin.toml manifest declaring an action plus the implementation file (for example index.js), then run herdr plugin link /absolute/path/to/plugin-directory to register it from a live checkout. Note that plugin link skips manifest build commands, so you must build the code yourself. Test with herdr plugin action invoke, then run herdr plugin unlink to remove the registration without touching your files. _daily.dev helps developers building CLI extensions and workspace tooling find hands-on guides like this one._ ## Similar posts on daily.dev - [A deep dive into Herdr](https://daily.dev/posts/a-deep-dive-into-herdr-jzkwg8r1e) · Flavio Copes · 5 upvotes · 1 comments - [Herdr is joining Y Combinator. The runtime stays open. — Herdr blog](https://daily.dev/posts/herdr-is-joining-y-combinator-the-runtime-stays-open-herdr-blog-sdm6t48rg) · Hacker News · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#cli](https://daily.dev/tags/cli) [View this post on daily.dev](https://daily.dev/posts/a-practical-guide-to-herdr-plugins-4znm34yka) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A practical guide to Herdr plugins","url":"https://daily.dev/posts/a-practical-guide-to-herdr-plugins-4znm34yka","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-practical-guide-to-herdr-plugins-4znm34yka"},"datePublished":"2026-08-22T07:04:28.485Z","dateModified":"2026-09-14T07:06:37.913Z","description":"A hands-on walkthrough of Herdr's plugin system, covering how to find, inspect, install, configure, and run plugins from GitHub, plus security precautions...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d94dbb832cf310c0ffb797319b37533?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/6d94dbb832cf310c0ffb797319b37533?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Flavio Copes","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Flavio Copes","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/1f2dbd275797411bbd37bfdaaf0951a9","url":"https://daily.dev/sources/flaviocopes"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-practical-guide-to-herdr-plugins-4znm34yka","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,cli","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Flavio Copes","item":"https://daily.dev/sources/flaviocopes"},{"@type":"ListItem","position":3,"name":"A practical guide to Herdr plugins"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-practical-guide-to-herdr-plugins-4znm34yka#faq","mainEntity":[{"@type":"Question","name":"How do I install a Herdr plugin from a GitHub repository and pin it to a specific version?","acceptedAnswer":{"@type":"Answer","text":"Run herdr plugin install owner/repository, adding a subdirectory path if the repo holds multiple plugins. To pin an exact revision, append --ref v1.2.0. Herdr clones the repo with Git, runs the build commands declared in the manifest, and registers the plugin only if the build succeeds; avoid the --yes flag on first install so you see the source and commands before confirming. daily.dev surfaces practical setup steps like this for developers evaluating new CLI tooling before trusting it."}},{"@type":"Question","name":"Are Herdr plugins sandboxed when they run?","acceptedAnswer":{"@type":"Answer","text":"No, Herdr plugins run as the local user, inherit the full environment, and can call the entire Herdr CLI without any sandboxing. They should be treated the same as a shell script or editor extension being run locally: read the herdr-plugin.toml manifest, check build and runtime commands, and inspect the actual scripts before installing. Security-conscious developers vetting third-party extensions can find similar practical checklists on daily.dev."}},{"@type":"Question","name":"How do I create and test a local Herdr plugin without publishing it to GitHub?","acceptedAnswer":{"@type":"Answer","text":"Write a herdr-plugin.toml manifest declaring an action plus the implementation file (for example index.js), then run herdr plugin link /absolute/path/to/plugin-directory to register it from a live checkout. Note that plugin link skips manifest build commands, so you must build the code yourself. Test with herdr plugin action invoke, then run herdr plugin unlink to remove the registration without touching your files. daily.dev helps developers building CLI extensions and workspace tooling find hands-on guides like this one."}}]} ```