
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
Sidecar metadata file management for developers who work in frenzies.
tagsidecar is a CLI tool that helps you manage metadata for your experimental projects using special Greek-character-prefixed markdown files:
Perfect for developers who create multiple experimental folders and need to track, tag, and organize them.
npm install -g tagsidecar
cd my-project
tagsidecar ship init
This creates a ∑ship.md file with metadata.
tagsidecar add nodejs cli experimental
tagsidecar fleet ai-experiments --rank 5 --star "⭐"
cd ~/projects
tagsidecar discover
# Initialize ship
tagsidecar ship init
# Add tags (shortcut: tagsidecar add <tags...>)
tagsidecar ship add-tag nodejs cli experimental
# Remove tags (shortcut: tagsidecar remove <tags...>)
tagsidecar ship remove-tag experimental
# Add to fleet
tagsidecar ship fleet-add ai-experiments --rank 5 --star "⭐" --role leader
# Shortcut: tagsidecar fleet <fleet> --rank 5 --star "⭐"
# Remove from fleet
tagsidecar ship fleet-remove ai-experiments
# Update ship info
tagsidecar ship update --shipname "uss-enterprise" --purpose "Production API" --status active
# Initialize captain's log
tagsidecar captainslog init
# Add log entry
tagsidecar captainslog add "Discovered ripgrep performance fix" --type breakthrough --impact high
# Types: breakthrough, discovery, fix, refactor, learning
# Impact: critical, high, medium, low
# Initialize terminal session
tagsidecar terminal init
# Add room with command
tagsidecar terminal add dev --command "npm run dev"
tagsidecar terminal add test --command "npm test" --folder ./tests
# Restore terminal session (shows commands to run)
tagsidecar terminal restore
# Search across all Greek-char .md files
tagsidecar search nodejs
tagsidecar search "performance fix"
# Discover all ships in subdirectories
tagsidecar discover
---
shipname: my-project
purpose: Experimental API wrapper
tech_stack: [nodejs, express]
status: active
created: '2025-10-07'
tags:
- api
- experimental
fleets:
- name: ai-fleet
rank: 5
star: ⭐
role: member
commands: {}
---
# my-project
Project documentation here.
---
ship: my-project
topics: [performance, optimization]
entries:
- date: '2025-10-07'
stardate: '2025.279'
type: breakthrough
impact: high
title: Discovered ripgrep fix
---
## 2025-10-07 - Discovered ripgrep fix [HIGH IMPACT]
**Type:** breakthrough
Details about the discovery...
---
# Captain's Log: my-project
---
session_name: default
last_active: '2025-10-07T01:27:59.147Z'
rooms:
- name: dev
description: ''
folder: .
command: npm run dev
autostart: true
- name: test
description: ''
folder: ./tests
command: npm test
autostart: true
---
# Terminal Session: default
You create 5 experimental folders trying different approaches. Use tagsidecar to:
You have a project with multiple terminal tabs:
tagsidecar terminal inittagsidecar terminal add dev --command "npm run dev"tagsidecar terminal add api --command "npm run api" --folder ./apitagsidecar terminal restoreYou discover something important while coding:
tagsidecar captainslog add "Ripgrep needs --glob=!Pictures/ to avoid macOS errors" \
--type breakthrough --impact high
Later, search for it:
tagsidecar search ripgrep
Ships can belong to multiple fleets with different ranks.
The tool uses Greek characters to make metadata files visually distinct:
Type them with:
You can also import tagsidecar as a library:
const { shipInit, shipAddTag, searchAll } = require('tagsidecar');
// Initialize ship
await shipInit({ shipname: 'my-project', purpose: 'Testing' });
// Add tags
await shipAddTag(['nodejs', 'cli']);
// Search
const results = await searchAll('nodejs');
MIT
starshipagentic
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.