Borrowing it
Nothing to install: this file belongs to vincentvella/devloop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vincentvella/devloop/main/.claude/skills/release/SKILL.mdgit clone --depth 1 https://github.com/vincentvella/devloopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vincentvella/devloop/release)<a href="https://agentmods.dev/skills/vincentvella/devloop/release"><img src="https://agentmods.dev/badge/skills/vincentvella/devloop/release/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vincentvella/devloop/release"><img src="https://agentmods.dev/badge/skills/vincentvella/devloop/release.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.01148 |
| Opus 5.5 | $0.00023 | $0.00459 |
| Sonnet 5.5 | $0.00012 | $0.00230 |
| Haiku 4.5 | $0.00006 | $0.00115 |
Grade A, and why
release scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cut a devloop release
Releases are tag-triggered: pushing a vX.Y.Z tag fires .github/workflows/release.yml,
which builds the cross-platform installers, publishes to npm (GitHub OIDC — no token), and
publishes to the MCP Registry. A verify-version guard fails the release if the tag does
not exactly match package.json version, so the bump must land before the tag.
0. Preconditions (don't skip)
- Latest
mainCI is green (gh run list --workflow ci.yml --branch main --limit 1). - Run the heavy suites locally if the changes touched the cockpit/renderer:
bun run app:gui— the GUI click-through suite (Playwright + Electron).bun run app:selftest— offscreen cockpit selftest.- (
bun test,bun run test-smoke.ts,bun run test:daemon,bun run test:mcporterare CI-gated.)
- Working tree clean; you're on
mainand up to date (git pull --rebase origin main).
1. Pick the version (SemVer, project is 0.x)
- patch (
0.6.2 → 0.6.3): fixes, deps, docs, internal tooling only. - minor (
0.6.2 → 0.7.0): any new user-facing feature (e.g. a new cockpit affordance or MCP tool), or a notable batch of dependency bumps. - major: reserved; not used pre-1.0.
2. Bump the version in ALL FOUR places
These must stay in lockstep — the registry/Docker/guard all read them:
package.json— top-level"version".server.json— two spots: top-level"version"ANDpackages[0].version.Dockerfile—RUN npm install -g [email protected].
Verify they match:
node -e "const p=require('./package.json'),s=require('./server.json');console.log(p.version,s.version,s.packages[0].version)"
grep -oE 'devloop-mcp@[0-9.]+' Dockerfile
3. Update CHANGELOG.md
Keep-a-Changelog format. In CHANGELOG.md:
- Replace the
## [Unreleased]body with a new dated section, then leave a fresh empty Unreleased above it:
Use today's date. Synthesize user-facing bullets from## [Unreleased] - _Nothing yet._ ## [X.Y.Z] - YYYY-MM-DD ### Added / Changed / Fixed / Tooling / Docs - …git log --oneline vPREV..HEAD— don't paste raw commits. - Update the link refs at the bottom:
[Unreleased]: https://github.com/vincentvella/devloop/compare/vX.Y.Z...HEAD [X.Y.Z]: https://github.com/vincentvella/devloop/compare/vPREV...vX.Y.Z
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 97 lines · 58 tokens per session scan A d3092fa84df8
release is a skill published in the GitHub repository vincentvella/devloop (2 stars, last pushed 3d ago), licensed MIT. It adds 58 tokens to every session and 1,148 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github
Drive GitHub via the official gh CLI — repos, issues, pull requests, releases, gists, Actions runs, and raw REST through gh api. Use when the user asks to inspect or manage GitHub.
upgrade
Use this when you receive an [Upgrade Event: x.y.z→a.b.c] lick — fired on boot whenever the bundled SLICC version differs from the previous run. The lick renders a binary action card: lickconfirm to Update workspace files (three-way merge of bundled vfs-root files against the user's local edits) or lickdismiss to…
versioning-by-impact
Use when completing a task and deciding whether repository changes require a semantic version bump and changelog entry before commit/push.
release
A repository-specific procedure for preparing or publishing a software release, meaning a checked and versioned update made available to users.
bitbottle
Reference for the bitbottle CLI — a gh-style tool for Bitbucket Server/DC and Cloud. Load when the user asks about bitbottle commands, auth setup, PRs, repos, branches, tags, commits, pipelines, or why a command failed. Load even if the user just says "bitbottle", mentions "Bitbucket", or pastes a bitbottle error…
repo-audit
Audit a repository or prepare it for an open-source release. Audit mode reports whether the README matches the code and whether stated rules are actually enforced; launch mode walks a repo to release-ready with opt-in checklist packs and README templates. Use when asked to "audit this repo," "is this repo ready to go…