Working in the Sidekick Tab

The Sidekick tab is where you work with Sidekick: central command for the workspaces in this window. Its ledger lists those workspaces, and each one has its own lead agent in its Chat tab — your single point of contact for that workspace. Ask it anything about the binary and it answers directly, delegating to specialist agents behind the scenes when the work benefits. You do not start or dig through separate chats, and you do not manage a context window: each workspace's one persistent conversation carries its analysis forward, with the session briefing, tasks, changes, and artifacts in adjacent tabs.

This is the intended home base for AI-first reverse engineering. Open it when you want to talk to Sidekick in the center pane and keep each workspace's lead agent, briefing, tasks, changes, and artifacts together.

The Sidekick tab and the Chats sidebar

The Sidekick tab shows the workspace ledger — a single list of every workspace in scope — beside a panel with the selected workspace's Chat, Memory, Tasks, Changes, and Artifacts. The Chats sidebar includes the same Workspace Chat as a special pinned chat above the other chats. Both live surfaces share the chat and its unsent draft.

There is one Sidekick tab per Binary Ninja window. Binary Ninja's sidebars hide while this tab is visible and return to their previous state when you return to another tab.

Opening Sidekick

• Choose Plugins > Sidekick > Open Sidekick (Ctrl+K / ⌘K on macOS) to open the tab on the workspace ledger with search focused.
• Choose Show in Sidekick from the status-bar workspace menu to open that tab with the current workspace selected.
• Choose All Workspaces… from the status-bar workspace menu to open the workspace ledger.

Sidekick no longer appears in Binary Ninja's view-type selector. Binary tabs keep their usual Linear, Graph, Hex, and IL views.

Note

If you open Sidekick during startup, you may briefly see a "Sidekick is starting…" placeholder. Each detail section loads when first selected.

The workspace ledger

The ledger lists every workspace in this window's scope. In the Activity and Effort views, rows are ordered by how recently each workspace was active. The Next step view puts Needs you first, then Running, then Idle, with the most recently active first in each group. A small status icon shows each workspace's state: a thin grey ring means the workspace is open, a spinning arc on the ring means the agent is working, and an accent-colored dot means it needs you — inside the ring when the workspace is open, on its own when it is closed. A closed workspace with nothing waiting shows no icon. Each row shows the workspace name, a one-line status — for example Needs you: approve rename 38 functions, the running activity, or the briefing's status line when idle — and how long ago it was active.

A workspace needs you when a tool call is waiting for approval or a notebook investigation has an open blocker.

The top row groups Workspaces, Search, and the view switcher, with New Workspace on the right. An additional row appears for search results. The list updates on its own while the tab is visible.

Starting a workspace

Choose New Workspace, or press Ctrl+Shift+K (⌘⇧K on macOS), to open the task editor in the workspace panel. The same action is available as Plugins > Sidekick > Start Sidekick Workspace, including when no binary is open. You can customize its shortcut in Binary Ninja's key bindings.

Use Add Files… and describe the work. Until everything needed is filled in, the line above Start says what is missing. One binary gets Start. With multiple binaries, choose Create Project to analyze them together in a new project, or Run Batch to send the same task independently to each binary's workspace. A project also needs a name and a save location. You can also name its first workspace; left empty, it takes the project's name.

In a project window, the form starts with the new workspace's name. Add Files… opens a selector of files already in that project. Filter by filename or folder and check the files you want. One file creates a new workspace in the current project, named after the file unless you name it. With multiple files, choose One Workspace to analyze them together in a named workspace, or Run Batch to create a separate workspace for each file in the same project, each named after its file.

Draft rows preview the workspaces while you edit: the workspace name (with its new project as [Project] Workspace) or filename on the first line and your task on the second. A batch shows one row per binary. You can browse other workspaces and return through any draft row, New Workspace, or the shortcut. No workspace is created until you start. Cancel discards the draft.

Searching

Type in Search to search every workspace's chats, tasks (investigations and their tasks), changes, artifacts, and findings. The ledger switches to search results: each workspace that matches by name or has hits inside, with a count per type. Click a count to see those matches. The panel on the right shows the selected workspace's Matches with your search text highlighted: grouped by type, then by chat or investigation, with each message labelled by who wrote it. The tabs at the top show how many matches of each type there are, and narrow the list to one type. Click a match to open it in the workspace's tab (the chat at that message, the artifact or finding, the change); Back to matches returns. Exit, or clearing the box, brings back the Activity, Effort, and Next step views.

Functions, types, and strings are not searched yet.

Activity, Effort, and Next step

A view switcher in the toolbar chooses what the row's main column shows. Your choice is remembered between sessions.

• Activity — what happened in each workspace since you last looked. Findings counts the findings shown in the panel's Memory tab, Changes counts what the agent committed to the analysis, and Artifacts counts the deliverables shown in the panel's Artifacts tab. In each column, the first number is what you have already seen and the highlighted +n beside it is what is new; zeros are left blank, so rows with something to look at stand out. Tasks shows completed / total notebook tasks, dimmed once every task is done, so workspaces with open tasks stand out. "Since you looked" resets per workspace when you select a different row after viewing it, or when it becomes or stops being the current workspace — opening the list does not clear it.
• Effort — a bar of total agent time, split by notebook investigation in shades of one color, with a gray tail for general chat. Bars use a log scale (the column reads Agent time · log), so a few minutes of work still shows; time ticks such as 10m, 1h and 5h are labeled on a ruler under the header, with faint lines through the rows, and cover the range of the listed workspaces. Hover a segment to see the investigation and hours; the Total column reports exact hours. 24 hours shows agent time in each of the last 24 hours, ending with the current hour; a full bar is a whole hour of work, so rows can be compared, and a tick under the bars marks midnight. Workspaces with no agent time in that window leave it blank.
• Next step — the workspaces that have something to do or answer: Blocked on you — tool approval or — input needed, Doing: <task> (<investigation>), or Next: <task> (<investigation>). Open workspaces are listed too, even with no next step, unless all of their investigations are closed. Closed workspaces appear only when they are blocked on you or have a task to do or continue. The selected workspace stays listed until you select another. Open counts unfinished notebook tasks.

The workspace panel

Click a row to show that workspace in the panel on the right; double-click it to follow the header's navigation action. Click a workspace's name to show its Chat tab, or click a count to open the tab that lists those items: Findings opens Memory, Changes opens Changes, Artifacts opens Artifacts, and Tasks or Open opens Tasks. Names and counts are highlighted when you point at them. Use the arrow keys to move between rows, and drag the divider to resize the panel. The first time the tab loads, the top row is selected.

The panel's header shows the workspace name and an action named for its destination:

• Open File or Open Project opens an input that is closed.
• Go to Tab switches to an existing binary tab in this window.
• Go to Window brings forward the window containing the file or project.
• Set Current Workspace makes a project workspace current when no binary tab is open.

These actions also make the workspace current. Hover over the button for destination details.

To manage the Workspace Chat, select it in the Chats sidebar and use the hamburger menu for Tool Permissions…, Inspect Chat…, or Start Fresh Chat….

When the workspace needs you, a banner below the header shows what it is waiting on — the most urgent question, with a count of any others. For a tool approval, Allow or Reject answers it right there, and Reply… lets you answer in the chat instead; for a question from the agent, Reply… switches to the Chat tab with the composer ready. If the workspace isn't open, Allow or Reject opens it first, without leaving the Sidekick tab.

Below the header are the workspace's tabs, each described below:

• Chat: the Workspace Chat, including inline tool approvals (Allow / Reject), and the message composer. Answering an approval or replying resumes the agent, and the selected row keeps its place in the list while you work.
• Memory: the session briefing, what the agent keeps in mind about this workspace, with the workspace's findings below it.
• Tasks: notebook investigations grouped by status, with their tasks and agent hours.
• Changes: the workspace's history of changes, the same list as the Transaction Log sidebar.
• Artifacts: the workspace's final output — its artifacts, newest first.

The tab you pick stays selected as you move between rows. Saved workspaces show their content read-only until you open them, but you can still send a message: Sidekick asks to open the workspace first, opens it without leaving the Sidekick tab (a project workspace listed outside its project opens in the project's own window), and sends the message once the workspace is ready. Following a link that needs the open workspace, such as a link to an index or code map, opens it for you.

The row menu

Right-click a row (or press the Menu key or Shift+F10 on the focused row) for actions on that workspace. The menu acts on the row you clicked without selecting it.

• Mark as Seen (Activity view only) clears the row's highlighted "since you looked" counts.
• The navigation action has the same label and behavior as the panel's header button.
• Set Current Workspace (project workspaces) makes the workspace current in this window and stays on the Sidekick tab. It is left out when the navigation action already does the same.
• Rename… changes a project workspace's name.
• Export Workspace… saves the workspace's stored chats, resources, and history as a .sidekick-workspace.json file. Copy Workspace ID copies its ID to the clipboard.
• Delete Workspace… permanently deletes a workspace's chats, notebook, artifacts, change history, and semantic index after you confirm. In a project it is unavailable for a workspace that is current in a project window or has running work; for a standalone file, close the file first. A project always keeps at least one workspace.

File actions appear together in a separate section for standalone workspaces:

• Show File in Finder reveals the raw binary or saved BNDB, and Copy File Path copies its path.
• On Windows and Linux, the reveal action names Explorer or File Manager instead.

Activating a workspace

The panel shows the selected row; the sidebars show the window's current workspace. Browsing leaves the current workspace unchanged. Use the panel's navigation action, or Set Current Workspace in the row menu, to make it current.

• Standalone windows show standalone workspaces, including saved workspaces whose files are closed, and the workspaces of every project, named [Project] Workspace. The navigation action opens or switches to a standalone workspace's binary tab; for a project workspace it opens (or brings forward) the project's window, makes the workspace current there, and shows its Sidekick tab. Selecting a binary tab makes that file's workspace current.
• Project windows show only workspaces belonging to that project. The navigation action makes the workspace current without opening any files, then switches to one of the project's open binary tabs, if any. Selecting a different project binary tab keeps the current workspace.

Selecting a row never makes it current. The Workspace control in the status bar continues to show and switch the current workspace. See project workspace management for creating, renaming, exporting, and deleting project workspaces.

Each workspace retains its draft and detail navigation while the Sidekick tab is open. Code references open the relevant binary tab at their target. Closing the Sidekick tab releases its previews; it does not close files or stop live workspaces.

The Sidekick tab stays with its original window. Dragging it into another window returns it to its owner, preserving its content.

Chat Tab

The Chat tab holds a single, persistent conversation for the current workspace — a thread named Workspace Chat — rather than the full thread list you see in the Chat sidebar. Until you send your first message in it, the tab shows a home state instead of an empty transcript: a summary of the binary you're analyzing (architecture, platform, size, entry point) and a handful of suggested questions you can click to send immediately.

An open blocker is not listed in the conversation itself: it appears in the banner below the workspace header and under Blocked in the Tasks tab.

For everything else about chatting with Sidekick — the message composer, @-mentions, tool approvals, and the full multi-thread list — see Analyzing Binaries with Chat.

Memory Tab

The Memory tab shows the Session Briefing for the current workspace. For a single-binary workspace, a compact binary-context summary sits above it. The briefing renders as a read-only document — you cannot type edits directly into it. Sidekick keeps it current automatically as your notebook activity accumulates, and you can ask for specific changes in chat if something needs correcting.

See Session Briefing for what each of the briefing's sections (up to seven; empty ones are hidden) contains.

Below the briefing, a Findings section lists the workspace's findings, newest first: the reusable, anchored facts the agent records along the way. They explain why an artifact exists or where the agent is headed. Each finding is a card; click one to expand it, and expanding another collapses the first. Following a link to a finding opens the Memory tab with that finding expanded. Only draft and verified findings appear, and the section is hidden until the workspace has one.

Tasks Tab

The Tasks tab groups the workspace's notebook investigations by status: Blocked (waiting on your answer, shown under the title), In progress, Not started, and Closed. Each group header shows how many investigations it holds and their agent time; click a header to collapse or expand it. Closed starts collapsed.

Each investigation shows its agent time and a row of dots, one per task: done, in progress (highlighted), and still to do. Open investigations (all but Closed) also list their tasks as checkboxes. An investigation's full notebook entry is in the Resources sidebar.

Changes Tab

The Changes tab lists the workspace's transactions, newest first, the same history as the Transaction Log sidebar: database edits, index changes, and code map changes, with their status. Double-click a transaction to see its details and a diff of what changed; double-click a line in the diff to jump to that address. For a saved workspace the history is read-only; Revert and Delete Transaction are available once you open the workspace.

Artifacts Tab

The Artifacts tab lists the workspace's artifacts — concrete deliverables like YARA signatures, reports, and generated scripts — drawn from every notebook entry, newest first.

The button in a card's upper-right corner runs the most likely action for the file, and its arrow lists the others:

• Open (the button on documents and Python scripts) opens a document (Markdown, text, JSON, YAML, CSV, HTML, PDF, or an image) in your default application for its type. A Python script opens in your default text editor instead (on Windows, its Edit action or Notepad), because the default application for a script can be Python itself, which would run it. Other file types never open this way, because a carved payload could run instead of opening.
• Run in Terminal… (in the menu on Python scripts) runs the script with your own python3 (py -3 on Windows) in a new terminal window, after you confirm. The window stays open at a shell in the artifact's folder, so you can read the output, run the script again with arguments, or inspect any files it wrote.
• Export… (the button on everything else) saves the file wherever you choose.
• Show in Sidekick opens the workspace if it isn't open, then shows the file in the Resources sidebar under its notebook entry's Artifacts repository, read-only and at the version the agent recorded.
• Show in Finder (Show in Explorer on Windows, Show in File Manager on Linux) reveals the file, for anything you'd rather open with a tool of your choice.

Open, Run, and Show work on a read-only copy that Sidekick keeps in its cache folder, one folder per artifact version. Changes you make to that copy don't reach Sidekick; use Export… for a copy you plan to edit.

Click a card to expand it. Sidekick doesn't preview the file's content: the description says what it holds, and the card lists the file's name, type, size (with a line count for text), and SHA-256 hash. Below them, CHATS links to the chats that created and validated the artifact, and REFERENCES links to the code it refers to.

Only draft and verified outcomes appear; rejected outcomes are excluded.

Cards here don't show an outcome's status; the notebook detail view does. See Working with Outcomes for how outcomes move through their status lifecycle.