Release assets reference

Agent Adversary uses GitHub releases for distribution. It does not publish to npm.

Asset names

The public v0.1.0 release produces these files:

• agent-adversary-0.1.0.tar.gz
• agent-adversary-0.1.0.zip
• agent-adversary-0.1.0.sha256

Archive contents

Each archive contains:

• dist/index.js
• dist/index.d.ts
• dist/node.js
• dist/node.d.ts
• dist/cli.js
• dist/agent_adversary.wasm
• docs/
• docs/version.json
• examples/
• README.md
• LICENSE
• SECURITY.md
• package.json

Checksum file

The checksum file lists one SHA-256 line for the .tar.gz archive and one SHA-256 line for the .zip archive.

Use it to confirm that the downloaded archive matches the exact file that the release workflow verified and uploaded.

Local release gate

Run this command before you cut the public v0.1.0 release:

AGENT_ADVERSARY_RELEASE_TAG=v0.1.0 bun run release:verify

The command runs package checks, docs checks, privacy checks, docs version checks, release tag checks, deterministic local release archive builds, direct text and binary privacy scans, checksum validation, reproducibility checks, workflow checks, and extracted runtime checks under Node and Bun without Rust.

GitHub workflows

The release workflow lives at .github/workflows/release-assets.yml.

It uploads the archives that release:verify produced as workflow artifacts. On a published GitHub release, it downloads those verified files and attaches the exact same files to the release.

The docs publication workflow lives at .github/workflows/docs-site.yml.

It deploys only reviewed main commits and published release tags. After deploy it runs bun run docs:verify-live and fails if the live site headers, redirects, 404 page, or exact version.json body drift from the reviewed source.