Herdr Adversarial Review

A Claude Code skill that runs an adversarial code review using a second, independent model - GPT‑5.6 Sol - as the reviewer. Claude spawns the reviewer in a live herdr split pane, hands it your diff (or plan) plus the stated intent, waits for it to finish, then interrogates every finding against the actual code before relaying a verdict.

The reviewer runs interactively in its own pane, so you can watch it work or jump in and steer.

How the pieces fit together

Four things need to be set up, in order: herdr, CLIProxyAPI, agent-safehouse, and the safecodex shell function. Then install the skill itself.

Demo

https://github.com/user-attachments/assets/8e2c5227-148f-4f02-83c7-cb973824864d

1. Install herdr

herdr is the agent multiplexer the skill drives - it creates the reviewer pane, sends it input, and waits on its idle/working/blocked status.

curl -fsSL https://herdr.dev/install.sh | sh

Run your terminal sessions inside herdr (see the quick start). The skill assumes the Claude Code session it runs in lives in a herdr pane, so it can split a sibling pane next to it.

2. Install and configure CLIProxyAPI

CLIProxyAPI is a local proxy that exposes an Anthropic-compatible API backed by other providers' logins - here, an OpenAI/Codex login serving GPT‑5.6 Sol. This is what lets the stock claude CLI talk to a non-Anthropic model.

1. Install - download a binary from the releases page (or use Docker; see the guides).

2. Create the config at ~/.config/cli-proxy-api/config.yml:

   port: 8317
   auth-dir: "~/.cli-proxy-api"
   api-keys:
     - "<any-random-string>"   # e.g. output of: openssl rand -hex 24
   

   The API key is just a shared secret between the proxy and the claude CLI - make one up. Save it somewhere; the safecodex function needs it later.

3. Log in with your OpenAI account (Codex OAuth flow):

   cli-proxy-api --config ~/.config/cli-proxy-api/config.yml --codex-login
   

4. Start the server and leave it running:

   cli-proxy-api --config ~/.config/cli-proxy-api/config.yml
   

   The skill expects it on http://localhost:8317.

3. Install agent-safehouse

agent-safehouse provides macOS-native kernel-level sandboxing. The reviewer runs with --dangerously-skip-permissions, so the sandbox is what keeps it confined to the project directory - it can't touch your SSH keys, other repos, or anything outside its workspace.

brew install eugene1g/safehouse/agent-safehouse

Then add the safe wrapper to ~/.zshrc (adjust for your shell):

safe() {
    safehouse --env --add-dirs="/tmp:~/.claude" "$@"
}

Both grants matter for this skill: /tmp is where the handoff files live (the skill writes the review prompt to /tmp/adversarial-review/, the reviewer writes its findings back there, and safecodex keeps its throwaway config dir there - see below), and ~/.claude lets the sandboxed CLI read your global Claude Code config. Without /tmp, the reviewer can't read its prompt or produce output.

4. Define the safecodex function

Add to ~/.zshrc (adjust for your shell):

export CLI_PROXY_API_KEY="<the key from your config.yml>"

safecodex() {
   # Throwaway config dir: keeps reviewer sessions out of ~/.claude session
   # history and pre-accepts the onboarding, bypass-permissions, and
   # project-trust dialogs, so the reviewer starts without manual clicking.
   local cfg
   cfg=$(mktemp -d /tmp/safecodex-cfg.XXXXXX) || return 1
   printf '{"hasCompletedOnboarding": true, "bypassPermissionsModeAccepted": true, "projects": {"%s": {"hasTrustDialogAccepted": true}}}\n' "$PWD" >"$cfg/.claude.json"
   ANTHROPIC_BASE_URL=http://localhost:8317 \
   ANTHROPIC_AUTH_TOKEN="$CLI_PROXY_API_KEY" \
   ANTHROPIC_MODEL=gpt-5.6-sol \
   ANTHROPIC_SMALL_FAST_MODEL=gpt-5.6-sol \
   CLAUDE_CODE_SUBAGENT_MODEL=gpt-5.6-sol \
   CLAUDE_CODE_ALWAYS_ENABLE_EFFORT=1 \
   CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY=3 \
   ENABLE_TOOL_SEARCH=false \
   CLAUDE_CONFIG_DIR="$cfg" \
   safe claude --model 'gpt-5.6-sol[1m]' --dangerously-skip-permissions "$@"
}

Reload your shell (exec zsh) and note that the function must be defined in your interactive shell config - the skill launches it via herdr pane run, which runs an interactive shell precisely so aliases and functions resolve.

5. Install the skill

The repo is a Claude Code plugin marketplace, so you can install it directly from within Claude Code:

/plugin marketplace add overflowy/herdr-adversarial-review
/plugin install adversarial-review@herdr-adversarial-review

Alternatively, copy the skill into your skills directory manually (it ships a scripts/reviewer.sh alongside SKILL.md, so copy the whole directory):

mkdir -p ~/.claude/skills
cp -r skills/adversarial-review ~/.claude/skills/

Usage

From a Claude Code session running inside a herdr pane, in the project you want reviewed:

/adversarial-review

or just ask in natural language - "poke holes in this diff", "red-team this plan", "get a second opinion before I ship". Claude will:

1. State the intent of the work (what the change is trying to achieve) and write it to a file.
2. Run scripts/reviewer.sh start, which drives the whole reviewer lifecycle: it builds the prompt (diff and/or files plus the reviewer charge) under /tmp/adversarial-review/, splits a herdr pane, launches safecodex in it - the reviewer's TUI is live there - submits the task, and waits it out, surfacing any permission prompts for you to approve in the pane.
3. Interrogate every finding against the actual code, pressing the still-open reviewer session on anything disputed (reviewer.sh ask), and report each one as Confirmed, Disputed, or Unverified.

The last step matters: the reviewer is adversarial by instruction and will sometimes overstate or manufacture problems. You get verdicts, not raw output - and "nothing the reviewer found holds up" is a valid outcome.

Smoke test

Before first use, verify each layer:

# Proxy is up and accepting your key
curl -s http://localhost:8317/v1/models -H "x-api-key: $CLI_PROXY_API_KEY"

# safecodex works end to end (one-shot, no TUI)
safecodex -p "Say ok"

Troubleshooting

• Reviewer pane opens but errors immediately - usually the proxy: check it's running on 8317 and that CLI_PROXY_API_KEY matches an entry in config.yml's api-keys.
• Auth errors from the model - the Codex OAuth token may have expired; re-run the --codex-login step.
• safecodex: command not found in the pane - the function isn't in your interactive shell config, or was only exported in one terminal. It must live in ~/.zshrc.
• Sandbox denials - agent-safehouse grants read/write to the project directory only. If the review legitimately needs another path, add it to the safe wrapper's --add-dirs list.
• Different reviewer command - set ADVERSARIAL_REVIEW_CMD to replace the default safecodex --disallowedTools Task,Agent,WebSearch,WebFetch --effort medium --disable-slash-commands invocation, e.g. to point at a different wrapper or model.

License

MIT