Sidecar is a terminal-based workspace for running AI coding agents alongside file trees, task issues, Git diffs, and Jira or GitHub resources in split panes. Developers use it to monitor agent sessions, inspect files and changes, manage workspaces, and handle tasks without leaving one shell. The catalogue entries extend or guide coding-agent workflows used with Sidecar.
Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/marcus/sidecarnpx agentmods add skills/marcus/sidecar/release-sidecarWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/marcus/sidecar/release-sidecar)<a href="https://agentmods.dev/skills/marcus/sidecar/release-sidecar"><img src="https://agentmods.dev/badge/skills/marcus/sidecar/release-sidecar/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/marcus/sidecar/release-sidecar"><img src="https://agentmods.dev/badge/skills/marcus/sidecar/release-sidecar.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.01474 |
| Opus 5.5 | $0.00021 | $0.00590 |
| Sonnet 5.5 | $0.00011 | $0.00295 |
| Haiku 4.5 | $0.00005 | $0.00147 |
Grade A, and why
release-sidecar scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 157 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Releasing a New Version
Operator contract: docs/guides/active/releasing.md. Enforcement lives in scripts/ and
BUMP=minor make release (or RELEASE_VERSION=vX.Y.Z make release for an explicit
version). Prefer the one-shot command over replaying this checklist by hand.
Prerequisites
- Go matching
go.mod - Clean working tree;
mainidentical to liveorigin/main - Tests and Go CI green on the commit you will tag (tests and lint) —
check-release-state.shnow checks this itself viagh run list --workflow=go-ci.ymland fails closed if it's red/running/missing, so you don't have to remember to look - GitHub CLI authenticated with push access to
marcus/homebrew-tap - No
replacedirectives ingo.mod HOMEBREW_TAP_TOKENsecret present in the GitHub repo (CI tap job)
Beware of go.work: always use GOWORK=off when updating dependencies and
when validating install paths.
Local lint must match CI's golangci-lint v2.12.2, or trust CI:
gh run list --workflow=go-ci.yml --limit=1
Prepare (sidecar-specific)
1. Version
git tag -l 'v*' | sort -V | tail -1
SemVer: major / minor / patch as usual.
2. Sibling dependencies (td, tasks)
make sync-deps # pins every github.com/marcus/* requirement to its latest tag
check-release-state.sh enforces this and refuses to tag when one is behind.
go.work resolves those imports to the local checkouts, so drift is invisible
locally — both the gate and sync-deps use GOWORK=off. If a sibling jumped
several minors, decide deliberately (pin for a focused release vs take latest
and note it under Dependencies) and smoke its tab in the app.
3. CHANGELOG
## [Unreleased]
### Features
- …
### Bug Fixes
- …
### Dependencies
- …
Commit the changelog (and any dependency bump) on main, then push so
HEAD == origin/main. Leave the heading as ## [Unreleased] — make release
stamps it to ## [vX.Y.Z] - YYYY-MM-DD for you.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines 163d347e89fe
- 1mo ago First seen · 156 lines · 53 tokens per session scan A 0d658cba8d98
release-sidecar is a skill published in the GitHub repository marcus/sidecar (1,091 stars, last pushed 11d ago), licensed MIT. It adds 53 tokens to every session and 1,474 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
merge
The ship gate — the only skill that pushes a feature branch, opens its PR and merges. --staging checks that pre-merge passed on the branch tip, pushes, opens the feature→staging PR, waits for green CI, merges, deploys, verifies, emits a human test script and stamps the staging sign-off on approval. --production ships…
release-announcement
Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.
agent-release-manager
Agent skill for release-manager - invoke with $agent-release-manager.
agent-release-swarm
Agent skill for release-swarm - invoke with $agent-release-swarm.
agent-github-modes
Agent skill for github-modes - invoke with $agent-github-modes.
github-automation
GitHub workflow automation, PR management, issue tracking, and code review coordination. Integrates with GitHub Actions and repository management. Use when: PR creation, code review, issue management, release automation, workflow setup. Skip when: local-only changes, non-GitHub repositories.