Do not roll out Claude Code and Codex as six unmanaged terminals
Company-wide Claude Code and OpenAI Codex rollouts are landing on mid-market IT calendars this fall. The mandate is usually productivity. The missing piece is usually a shared control surface for state, spend, and secrets.
The workable answer is not another governance slide. It is an agent-aware runtime where heterogeneous agents already live together. Herdr (herdr.dev) is that class of tool: a terminal multiplexer for coding agents, with real panes, session persistence, and a sidebar that marks each agent idle, working, blocked, or done. A socket API and agent skill let agents spawn panes, wait on each other, and read output without pretending keystrokes are orchestration.
If you expand seats before that layer exists, you are distributing unmetered agent sessions across unmanaged terminals. Audit the AI tool stack before the seat push, not after the first incident.
What broke when agents left the laptop
Claude Code and Codex read repos, call tools, hit MCP servers, and can commit or propose changes. Three desks share one problem.
The CTO cares about cost attribution by team, repo, model, and pane. The CIO cares which agents are live, blocked, or stuck in personal terminals. The CISO cares whether a secrets-file read or destructive shell command would show up in an hour, or only at the next audit.
Six Terminal.app windows do not answer those questions. You need one place that holds state, spend, and policy hooks for the agents you already chose.
What Herdr actually is (and is not)
Herdr is not a new coding agent. It does not replace Claude Code or Codex. It owns their terminals.
Run Claude Code in one pane and Codex in another. Herdr keeps the layout, survives detach and laptop sleep, and shows agent lifecycle in the sidebar. Install the Claude Code and Codex integrations for native session restore. Install the Herdr agent skill so agents can split panes, start peers, wait until another agent is blocked, then read the result.
The failure mode is not “we bought the wrong model.” It is “we cannot see the herd.” Peer review loops, a worker blocked on permission, a pane still burning tokens after the human left: those facts belong on one surface.
Herdr is not a full enterprise DLP product, and it does not replace provider billing, SSO, or network egress controls. Community plugins extend spend visibility and command policy. Treat them as local tooling with access to sensitive session metadata.
Spend visibility across Claude Code and Codex panes
Finance will not fund a second wave of seats on anecdotes. You need token and cost visibility per agent session, not a monthly invoice dump.
The pattern that matches a Herdr fleet is a token dashboard plugin in the herdr-token-dashboard style. It reads live or on-disk session data across panes and surfaces estimated spend when an agent finishes. Claude Code typically comes from local session transcripts (often estimated cost from a pricing table, not Anthropic billing). Codex typically comes from rollout JSONL under the Codex sessions directory. The operator win is the same: one keybinding, every pane, attributed burn.
That answers the weekly packet: developer, agent, model, and rough cost. If you cannot produce it, stop expanding seats. Same discipline as evaluating AI workflows: start from measurable control points.
PII, secrets, and honest limits on guardrails
Spend is the easy half. Secrets and PII are where teams overclaim.
A Herdr-style guard plugin (herdr-guard and related redact or policy plugins) watches pane output, matches risky commands against local rules, audits hits, notifies, and can best-effort interrupt dangerous shell input. Defaults usually cover destructive filesystem or git commands, secret-file reads, publish or exfil patterns, and evasion indicators. Useful. Not magic.
Be honest about authority. Pane watching sees rendered terminal text. Interrupt is strong for interactive shell input that has not executed yet, and incidental for agent TUIs. Native agent hooks remain authoritative for tool calls inside Claude Code and Codex. Wire Claude Code PreToolUse (and equivalent Codex or harness reporters when available) so the same policy can deny or warn before a tool runs. Herdr is visibility, orchestration, and plugin policy around those agents, not a network DLP appliance that redacts every prompt before egress.
That honesty is the sell. “Full enterprise DLP in the terminal” gets rejected. “One place to see the herd, attribute spend, and attach command policy while native hooks stay authoritative” can clear a pilot. Herdr still does not replace controlled API keys, least-privilege repo access, secrets scanning on commits, or a named exception owner.
Claude Code alone vs Codex alone vs both under Herdr
| Capability | Claude Code alone | Codex alone | Both under Herdr |
|---|---|---|---|
| Agent runtime | Anthropic coding agent in its own terminal | OpenAI coding agent in its own terminal | Same agents, real panes, shared layout, detach without killing work |
| Fleet state (idle / working / blocked / done) | Local session; human pane-hopping | Local session; human pane-hopping | Sidebar across heterogeneous agents in one place |
| Agent-to-agent orchestration | Manual copy/paste or custom scripts | Manual copy/paste or custom scripts | Socket API + agent skill: spawn, wait, read peers |
| Spend attribution across agents | Per-product billing or transcript digging | Per-product billing or rollout digging | Token dashboard view across Claude Code + Codex panes |
| Command / secrets policy layer | Native hooks if wired | Native hooks if wired | Native hooks still authoritative; Herdr guard/redact plugins add cross-pane audit and interrupt |
| Fit for company-wide rollout | Fine for a pilot | Fine for a pilot | Required before a fleet: one control surface, not six unmanaged terminals |
Prefer Claude Code for one workflow and Codex for another if you want. The comparison is whether the company can operate both without inventing a private monitoring stack per developer.
Put the control surface in before the seat explosion
Ask first: where does every Claude Code and Codex session live today? If the answer is personal terminals with no shared state view, stop.
Ask second: can finance see estimated spend by developer, agent, model, and day without waiting for a vendor invoice? If not, install the dashboard before licenses go out.
Ask third: are native PreToolUse (or equivalent) hooks wired for high-risk tools, with Herdr guard rules as the cross-pane backstop? Alert-only is a diary.
Ask fourth: who owns exceptions? Name a human. Weekly review. Expired exceptions die. Permanent ones need written risk acceptance. Someone owns the blocked-action queue the same way someone owns an AP exception queue. That is hire before automation applied to coding agents.
Ask fifth: what share of company-repo agent work runs under the Herdr-style surface versus rogue terminals? Climb that share before seat count. Pick tools that fit how operators work, then instrument them, as in a practical AI stack.
A 30-day install sequence that will not brick developers
Day 1 to 3. Inventory who already runs Claude Code, Codex, or both. Freeze new personal API key sprawl for company repos where you can.
Day 4 to 10. Stand up Herdr for one pilot team. Install Claude Code and Codex integrations. Confirm sidebar state. Detach and reattach once so persistence is real.
Day 11 to 20. Install a token dashboard plugin and prove spend attribution across Claude Code and Codex panes. Soft alerts before hard caps. Publish a one-page pilot packet.
Day 21 to 25. Install herdr-guard. Start in audit and alert. Wire Claude Code PreToolUse to the same policy where you can. Enable interrupt only for high-confidence destructive or secret-file patterns after a rules review.
Day 26 to 30. Present the scoreboard to engineering, finance, and security: active developers, spend by agent and model, blocks by reason, open exceptions, share of work under Herdr. Expand seats only when that board is boring.
Failure modes I see in diligence
Rolling out Claude Code company-wide on personal terminals because it was faster. Faster until the first uncapped invoice or the first secrets scrape nobody saw until Friday.
Treating Herdr as enterprise DLP. It is visibility, orchestration, and plugin policy. Native hooks remain authoritative for tool calls.
Buying spend dashboards without an owner. A toast nobody reads is not a control.
Policy so coarse that every shell call becomes an ask. Prefer audit for gray cases and interrupt for clear destructive or secret-file matches.
Measuring seats activated instead of cost per merged PR. Seats measure shopping. Output-linked cost measures operations.
Ignoring agent-to-agent sprawl. Once Claude Code can spawn Codex through a skill, the blast radius is a herd. That is why the control surface comes first.
FAQ
Is Herdr required, or is any agent-aware multiplexer enough? The requirement is the control surface shape: shared state, cross-agent visibility, spend attribution, and a place to attach policy. Herdr is the concrete product that matches that shape today for Claude Code and Codex.
Will this slow developers down? Allow paths should be invisible. The dashboard should be one keybinding. Interrupt should be rare. If every call becomes a prompt, fix the rules.
Does Herdr replace Claude Code or Codex hooks for secrets? No. Native hooks remain authoritative for tool calls. Herdr guard plugins add cross-pane watching, audit, and best-effort interrupt. Use both. Do not market pane watching as PreToolUse.
What if we only standardize on Claude Code? Still put it under a Herdr-style surface before company-wide seats. State, spend, and guardrails matter for one agent at fleet scale, and you keep the option to add Codex later.
Bottom line
Before a company-wide Claude Code and Codex rollout, put the fleet under a Herdr-style control surface so you can see state, attribute spend across agents, and attach guardrails. Use Herdr for the herd, a token dashboard for cost visibility, and herdr-guard plus native hooks for command and secrets policy, without pretending you bought full enterprise DLP. Expand seats only when last week’s spend, blocks, and exceptions are boring.
