agentmods.dev

deploy

A deployment and release guide for publishing the Godpowers npm package and its extension packs. npm is the package registry and tool used to distribute JavaScript packages.

In plain words
What is it for?
Use it to understand CI checks, tag-triggered releases, npm publishing, provenance, package entry points, and manual tarball publishing.
Why use it?
It documents which automated checks and workflows must pass before publishing, and clarifies when manual publishing is only a fallback.

Agent

5 13d ago A scan 0 tokens original MIT
View the source file hannsxpeter/godpowers
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/hannsxpeter/godpowers/deploy
Clone the repo
git clone --depth 1 https://github.com/hannsxpeter/godpowers
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,179 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00000 $0.01179
Opus 5 $0.00000 $0.00589
Sonnet 5 $0.00000 $0.00236
Haiku 4.5 $0.00000 $0.00118

Measured yesterday against content hash 49952b3358de, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/deploy.md · 82 lines

How it starts

The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Scope

  • [DECISION] This pillar captures deployment and release context for Godpowers.

Context

Release Surface

  • [DECISION] Godpowers deploys as an npm package published from tag-triggered GitHub Actions when provenance is available.
  • [DECISION] .github/workflows/ci.yml runs the full matrix test suite and the Node 20 release gate on pushes and pull requests to main.
  • [DECISION] .github/workflows/publish.yml runs npm run release:check before publishing tagged releases to npm with provenance.
  • [DECISION] .github/workflows/publish-pack.yml runs npm run release:check before publishing first-party extension packs.
  • [DECISION] package.json exposes bin.godpowers at ./bin/install.js.
  • [DECISION] Manual tarball publish is a fallback only when the tag-triggered workflow cannot run, and provenance is unavailable for that publish.
  • [DECISION] Source version 6.3.0 published with npm provenance through identity-bound workflows 32272150358 and 32272475321 from merged main commit c45d0473ad946fcd7c02a5706b02f51a40ed0d25.
  • [DECISION] npm [email protected], @godpowers/[email protected], and @godpowers/[email protected] are the latest versions; their exact registry integrity values and shasums are recorded in RELEASE.md.
  • [DECISION] The 6.3.0 workflows passed release identity, full release, fresh prepublication, exact packed-pair, and extension publishability gates before publication.
  • [DECISION] Isolated published-install verification passes for the exact root, MCP, and operations-pack set, Quick Proof, read-only project inspection, status, next route, Claude, Codex, and MCP --help.
  • [DECISION] The isolated dependency audit reports zero vulnerabilities, and registry signature verification covers all 6 installed packages and their attestations.
  • [DECISION] The published v6.2.0 tag is the rollback reference for the published 6.3.0 release.
  • [DECISION] The 6.3.0 release retains the tag-triggered root and MCP provenance workflow and publishes operations-pack through the explicit first-party pack selector.
  • [DECISION] The root and MCP workflow publishes exact packed tarballs and verifies registry integrity plus shasum before any recovery run can promote an existing version.
  • [DECISION] The first-party pack workflow passes dispatch inputs through environment variables, allowlists pack names, and validates strict SemVer before identity or publication steps.
  • [DECISION] The 6.3.0 public surface contains 124 slash commands, 41 specialist agents, 13 workflows, and 45 recipes.
  • [DECISION] The 6.3.0 core package contains 117 runtime library modules and its package-content check reports 659 files while keeping zero root production dependencies.

Read the full file on GitHub · 82 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 82 lines · 0 tokens per session scan A 49952b3358de

Subscribe to this mod's changes

deploy is an agent published in the GitHub repository hannsxpeter/godpowers (5 stars, last pushed 13d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,179 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

DevOps and cloudGit and workflowLanguagesagent-orchestrationai-codingclaude-codecodexcursordeveloper-tools
Related

Other agents, from other repositories

ap-framework-generator

L3 executor - FRAMEWORK GENERATE. When the SELECTOR returns MISS, generates a one-off custom framework for the exact task shape - classifies the orthogonal axes, composes the gate sequence from the GATE-LIBRARY with the correct axis-specific gate, emits the gen- leaf with the BLOCKED invariant verbatim, binds an…

Spielewoy/autoprompt-skill · 93 tokens

ap-juror

L4 terminal leaf - G7 SIGN-OFF. One independent sign-off panel seat that saw none of the intermediate work. Binary PASS/FAIL on opened evidence; default-FAIL. A FAIL naming a P0/P1 blocker is NOT arbitrable into PASS.

Spielewoy/autoprompt-skill · 58 tokens

ap-verifier

L3 independent G6 verifier - proves behavior with real before/after runs, regression checks, adversarial inputs, and >=95% changed-line coverage.

Spielewoy/autoprompt-skill · 35 tokens

ap-re-anchor

L4 terminal leaf - RE-ANCHOR. Confirms mission and roadmap frontier alignment after resume or compaction using the three-file governance state.

Spielewoy/autoprompt-skill · 33 tokens

domain

How the engineering skills should consume this repo's domain documentation when exploring the codebase. This is a single-context repo.

h0x91b/dev-3.0 · 0 tokens

ijfw-extract-learnings

Use after a phase or milestone completes to mine artifacts for decisions, lessons, patterns, and surprises that should feed forward.

FerroxLabs/ijfw · 31 tokens