golem15/msd-core
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
42f8c192a8eafd96a00216e263bed83dc034f708
msd-core/docs/RELEASE-v1.42.1.md
Tom Boucher 334a64168e chore(npm): rebrand packages to @opengsd scope (#127) 
* chore(npm): rebrand packages to @opengsd scope

Rename:
- get-shit-done-redux → @opengsd/get-shit-done-redux
- @gsd-redux/sdk → @opengsd/gsd-sdk

Add publishConfig.access=public for first-time scoped publish.
CLI binary names (get-shit-done-redux, gsd-sdk, gsd-tools) unchanged.

Sweeps install commands, npx invocations, CI publish/version-check
workflows, tests, docs, READMEs (all translations), and the
PACKAGE_NAME constant in check-latest-version.

Bumps qs 6.15.1 → 6.15.2 to clear a moderate advisory surfaced by
the audit-clean test (GHSA-q8mj-m7cp-5q26).

Closes #126

* chore: pin 2.0.0 release + remove canary workflow

- Bump both packages 1.50.0-canary.0 → 2.0.0 for first @opengsd publish
- Remove .github/workflows/canary.yml and canary dist-tag handling in
  release.yml / release-sdk.yml
- Drop canary section from VERSIONING.md

Refs #126

* chore: address review findings + harden tarball-smoke timeout

- .changeset/opengsd-org-rename.md: match project's custom
  parse.cjs frontmatter (type: Changed / pr: 127); the scoped
  @changesets/cli keys were silently rejected.
- CONTEXT.md: drop two canary-stream policy lines and a dangling
  DEFECT.CANARY-VERSION-LEAK.cross-ref now that canary.yml is gone.
- tests/release-tarball-smoke.install.test.cjs: pass
  timeout: 600_000 for npm pack + global install; the 3-minute
  runNpm default was timing out on slower Docker hosts (cartographer).

Refs #126

* fix(sdk): add missing type/runtime devDependencies for build

prepublishOnly invokes tsc which couldn't resolve @types/node,
@types/ws, or synckit. They had been hoisted from root but were
not declared in sdk/'s own package.json — first publish from a
clean SDK tree failed.

Refs #126

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix(ci): use npm pack stdout instead of glob to find tarball

`npm pack --silent` for a scoped package (@opengsd/get-shit-done-redux)
produces `opengsd-get-shit-done-redux-*.tgz`, not `get-shit-done-redux-*.tgz`.
Capture the filename from stdout instead of a hardcoded glob so the step
works regardless of package name format.

Fixes smoke (ubuntu-latest, 22, false) CI failure.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* ci: treat workflow-file changes as test-skip eligible

`.github/workflows/install-smoke.yml` (and other workflow files)
were in neither `test.yml` paths nor `test-skip.yml` paths-ignore,
so neither workflow ran on a workflow-only commit — leaving the
required test-skip check perpetually missing.

Refs #126

* chore: reset version to 1.0.0 for first @opengsd publish

Nothing has been published yet under the @opengsd scope, so the
inaugural release uses 1.0.0 rather than 2.0.0. The "major bump"
in the changeset reflects the breaking install-command change for
users migrating from the prior unscoped `get-shit-done-redux`, not
a numeric continuation from a 1.x line under the new identity.

Refs #126

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-05-22 16:22:41 -04:00

179 lines
8.8 KiB
Markdown
Raw Blame History

# v1.42.1 Release Notes
Stable release. Published to npm under the `latest` tag.
```bash
npx @opengsd/get-shit-done-redux@latest
```
---
## What's in this release
1.42.1 is a safety and control-surface release. The headline additions are the
**package legitimacy gate**, **skill-surface budgeting**, and the **installer migration
framework** — three changes that make GSD safer to install, safer to update, and easier
to run in constrained contexts. The release also ships configurable `/gsd-ship` PR body
sections, `/gsd-review` reviewer defaults, optional fallow structural review, and
quota-aware execution recovery. Underneath that, 30+ correctness fixes cover
`project_code` phase directories, phase completion, nested git detection, Codex
install migration, SDK readiness, and decimal-phase dependencies.
### Added
- **Package legitimacy gate against slopsquatting** — researchers audit external
packages with `slopcheck`, planners add human verification for unverified packages,
and executors stop on package install failures instead of trying similarly named
alternatives. This closes the path where AI-hallucinated package names could flow
from research into `npm install` / `pip install` / `cargo add`.
([#3215](https://github.com/GSD-redux/get-shit-done-redux/pull/3215))
- **Skill surface budgeting** — install with `--profile=core`, `--profile=standard`,
or the default `full`; profiles persist in `.gsd-profile`. Use `/gsd:surface` to
list, enable, disable, reset, or switch skill clusters without reinstalling.
`--minimal` and `--core-only` remain aliases for `--profile=core`.
([#3408](https://github.com/GSD-redux/get-shit-done-redux/pull/3456))
- **Installer migration framework** — install now has explicit migration records,
baseline scanning, legacy cleanup, user-owned artifact preservation, dry-run
reporting, rollback protection, and ambiguous stale-file guardrails.
([#3398](https://github.com/GSD-redux/get-shit-done-redux/pull/3398),
[#3399](https://github.com/GSD-redux/get-shit-done-redux/pull/3399),
[#3400](https://github.com/GSD-redux/get-shit-done-redux/pull/3400),
[#3402](https://github.com/GSD-redux/get-shit-done-redux/pull/3402),
[#3404](https://github.com/GSD-redux/get-shit-done-redux/pull/3404))
- **Configurable `/gsd-ship` PR body sections** — `ship.pr_body_sections` appends
project-specific PRD-style sections while preserving the required `Summary`,
`Changes`, `Requirements Addressed`, `Verification`, and `Key Decisions` sections.
([#3391](https://github.com/GSD-redux/get-shit-done-redux/pull/3391))
- **`review.default_reviewers`** — no-flag `/gsd-review` can default to a configured
reviewer subset. Explicit reviewer flags and `--all` still take precedence.
([#3464](https://github.com/GSD-redux/get-shit-done-redux/pull/3464))
- **Optional fallow structural review pre-pass** — `code_quality.fallow.*` runs a
structural pass before `/gsd-code-review`, writes `FALLOW.json`, and embeds
structural findings in `REVIEW.md`.
([#3424](https://github.com/GSD-redux/get-shit-done-redux/pull/3486))
- **Structured CLI error mode** — `gsd-tools --json-errors` returns machine-readable
error envelopes for automation and SDK callers while preserving human-readable output
by default.
([#3255](https://github.com/GSD-redux/get-shit-done-redux/pull/3304))
### Changed
- **Human verification defaults to end-of-phase** — `workflow.human_verify_mode:
"end-of-phase"` keeps human checks in verification blocks instead of scattering
mid-flight checkpoint tasks. Set `"mid-flight"` to restore the previous blocking
checkpoint behavior.
([#3309](https://github.com/GSD-redux/get-shit-done-redux/pull/3325))
- **Quota and rate-limit failures get a distinct recovery path** — execute-phase
classifies provider quota failures (`429`, `rate limit`, `usage limit`,
`RESOURCE_EXHAUSTED`, etc.) and guides wait-and-resume instead of retry-now.
([#3095](https://github.com/GSD-redux/get-shit-done-redux/pull/3490))
- **Milestone tags can be disabled** — `git.create_tag: false` lets projects with
external release automation complete milestones without creating local tags.
Existing tag collisions now fail clearly instead of overwriting tags.
([#3086](https://github.com/GSD-redux/get-shit-done-redux/pull/3508))
- **Statusline context meter can move to the front** — `statusline.context_position:
"front"` renders the context meter after the model name so it stays visible in narrow
terminals.
([#2937](https://github.com/GSD-redux/get-shit-done-redux/pull/3515))
- **Reasoning effort is transported with resolved model IDs** — runtime-aware model
resolution now carries `reasoning_effort` where supported, including Codex config
output and SDK query paths.
([#3474](https://github.com/GSD-redux/get-shit-done-redux/pull/3483))
- **Shell command projection and SDK architecture seams deepened** — hook commands,
path actions, subprocess execution, platform file I/O, SDK compatibility policy, and
runtime skill policy now flow through narrower typed modules.
([#3238](https://github.com/GSD-redux/get-shit-done-redux/pull/3238),
[#3316](https://github.com/GSD-redux/get-shit-done-redux/pull/3316),
[#3470](https://github.com/GSD-redux/get-shit-done-redux/pull/3470),
[#3476](https://github.com/GSD-redux/get-shit-done-redux/pull/3476),
[#3481](https://github.com/GSD-redux/get-shit-done-redux/pull/3481),
[#3484](https://github.com/GSD-redux/get-shit-done-redux/pull/3484))
### Fixed
- **`project_code` phase directory prefixes apply consistently** — first-touch
`/gsd-discuss-phase`, `/gsd-plan-phase`, import, gap-planning, and backlog creation
paths now create prefixed phase directories consistently.
([#3287](https://github.com/GSD-redux/get-shit-done-redux/pull/3292),
[#3298](https://github.com/GSD-redux/get-shit-done-redux/pull/3306))
- **Phase completion is idempotent and refreshes state** — `state complete-phase` and
`phase.complete` no longer leave stale `STATE.md` progress, focus, or body
frontmatter fields behind.
([#3489](https://github.com/GSD-redux/get-shit-done-redux/pull/3499),
[#3517](https://github.com/GSD-redux/get-shit-done-redux/pull/3520))
- **Nested git worktrees are detected** — `/gsd-new-project` and ingest flows avoid
creating nested `.git` directories when run inside an existing repository or
worktree.
([#3491](https://github.com/GSD-redux/get-shit-done-redux/pull/3502))
- **Codex install and hook migration are safer** — AoT hooks use event-name leaf keys,
duplicate legacy `hooks.json` entries are removed, user hooks are preserved, and
unsupported execute-phase worktrees are blocked.
([#3346](https://github.com/GSD-redux/get-shit-done-redux/pull/3505),
[#3357](https://github.com/GSD-redux/get-shit-done-redux/pull/3380),
[#3360](https://github.com/GSD-redux/get-shit-done-redux/pull/3380))
- **SDK install readiness is durable** — `--sdk` now forces SDK deployment, stale shims
are detected, Windows PATH probing is hardened, and "GSD SDK ready" only prints when
the shim is reachable.
([#3033](https://github.com/GSD-redux/get-shit-done-redux/issues/3033),
[#3211](https://github.com/GSD-redux/get-shit-done-redux/pull/3282),
[#3231](https://github.com/GSD-redux/get-shit-done-redux/pull/3249),
[#3359](https://github.com/GSD-redux/get-shit-done-redux/pull/3380))
- **User custom skills are preserved during update detection** — `detect-custom-files`
now scans `skills/`, preventing user-added skill files from being missed during
patch preservation.
([#3317](https://github.com/GSD-redux/get-shit-done-redux/pull/3318))
- **Decimal-phase `depends_on` references resolve correctly** — SDK phase indexing now
expands same-phase short forms such as `depends_on: [01]` and warns on unresolved
references.
([#3488](https://github.com/GSD-redux/get-shit-done-redux/pull/3501))
- **`gsd-sdk query commit --files --respect-staged` preserves interactive staging** —
respect-staged mode now avoids restaging pathspecs and commits only the already
staged hunks within the requested file scope.
([#3522](https://github.com/GSD-redux/get-shit-done-redux/pull/3528))
---
## What was in 1.41.0
[`RELEASE-v1.41.0.md`](RELEASE-v1.41.0.md) — per-phase-type model selection,
dynamic routing with failure-tier escalation, the optional update banner,
issue-driven orchestration, MVP mode SDK query verbs, graphify commit-based
staleness, and 25+ correctness fixes across Homebrew node paths, milestone archives,
secure-phase audits, cross-runtime installs, and statusline parsing.
---
## Installing
```bash
# npm (global)
npm install -g @opengsd/get-shit-done-redux@latest
# npx (one-shot)
npx @opengsd/get-shit-done-redux@latest
# Pin to this exact version
npm install -g @opengsd/get-shit-done-redux@1.42.1
```
The installer is idempotent — re-running on an existing install updates in-place,
preserving your `.planning/` directory and local patches.
Reference in New Issue View Git Blame Copy Permalink