One binary runs a daemon called the shepherd. It restarts your processes when they die, captures what they print, and says plainly when something is wrong.
The CPU column prints - rather than 0.0% when a reading is unavailable. A confident zero is worse than an obvious blank.
Unknown fields are a parse error rather than a shrug, and sizes are strict on purpose: 512M and 30s parse;512MB and 1.5G do not.
A dog is a plugin the shepherd supervises for its own sake: it watches the flock rather than being part of it.
Early days, and pre-1.0 means anything can still change. Install with cargo install shep and it runs on macOS, Linux and Windows. The Windows tier is the newest of the three, and it refuses three things out loud rather than papering over them: a gracefulstop for an app that has not opted into the shepherd channel, shep startup, and dropping privilege withuser/group.
The sheep are a mnemonic, not a costume. Where the joke would cost clarity, it gets dropped. Every themed verb keeps a straight alias that works forever.
Same feature list as pm2. Different opinions about what a supervisor owes you at 3am.
Daemonizing means the shep binary re-execs itself with a hidden subcommand, detaches, and reports readiness back over a pipe once its socket is bound.
Exponential backoff, a restart budget, and min_uptime so a process that dies immediately is never mistaken for one that came up fine.
Every command answers under a versioned envelope with a schema_version, so you can pipe it somewhere instead of scraping columns out of a table.
shep binds no sockets, so an overlap only works if your app sets SO_REUSEPORT itself. Measured on Linux: an app that drains its listener loses nothing.
By a dedicated tracing phase whose only output was behavior specs. Implementation never opens that source. It's a rule written into the repo's contributor instructions.
It starts nothing, names every clustered app on stderr, and refuses to silently swallow env keys it cannot place.
Two kinds of missing. The first row is work the spec names and nobody has written yet. The second is what was cut from the first release on purpose. Windows is the biggest of those: ruled out entirely rather than left half done. The workspace cross-compiles for it and that check runs on every change, but no test has ever executed there, only a compile.
Rust 1.88 or newer, edition 2024. Over a thousand tests, and every task ends with a mutation pass: break a line on purpose, confirm a test goes red, put it back.