msd-core/docs/RELEASE-v1.42.3.md

v1.42.3 Release Notes

Hotfix release. Published to npm under the latest tag.

npx @opengsd/get-shit-done-redux@latest

---

What's in this release

1.42.3 is a stability hotfix on top of 1.42.2. The headline is Codex CLI 0.130.0 install routability — after npx @opengsd/get-shit-done-redux@latest --codex, $gsd-* skills now resolve correctly under Codex 0.130.0 and later, where the previous build left users with zero routable entrypoints. The release also ships runtime-aware slash formatting so emitted commands match the install's routing shape (Claude → /gsd-*, Codex → $gsd-*) instead of the deprecated colon form, an argv-based subprocess fix for check.ship-ready that closes a shell-injection class through git refnames, the phase_status field on init.plan-phase that gates /gsd:plan-phase on closed phases, plus correctness fixes for archived-phase warnings, future-phase warnings, canonical Codex hooks, and the SDK bridge load path.

Fixed

• Codex CLI 0.130.0 install now materializes routable skills — bin/install.js writes ~/.codex/skills/gsd-<name>/SKILL.md for every shipped command so $gsd-* skills resolve after install. Codex 0.130.0 dropped the extra-skills-roots discovery the previous build relied on, leaving users with a successful-looking install and zero usable commands. Documented minimum Codex CLI version (0.130.0) inline in the Codex sections of USER-GUIDE.md and CONFIGURATION.md. (#3562, #3582)

• Runtime-aware slash formatter for user-facing emissions — runtime-slash.cjs produces /gsd-<cmd> for skills-based runtimes (Claude, Cursor, OpenCode, Kilo, etc.) and $gsd-<cmd> for Codex. The deprecated colon form /gsd:<cmd> is no longer emitted at runtime, so the recommendations from init, phase, verify, milestone, validate-command-router, workstream, profile-output, drift, gsd2-import, and commands now paste cleanly into the active runtime. (#3584)

• Argv-based subprocess for check.ship-ready — every git/gh probe in sdk/src/query/check-ship-ready.ts now uses execFileSync with an argv array instead of execSync with shell-interpolated strings. Closes a shell-injection class where a malicious branch name (e.g. foo;touch INJ;bar) interpolated into git config --get branch.<name>.merge triggered arbitrary code execution. (#3587)

• init.plan-phase surfaces phase_status; /gsd:plan-phase gates on closed phases — init.plan-phase payload now carries the authoritative phase status (Pending / Planned / Executed / Complete) from determinePhaseStatus. The plan-phase workflow short-circuits on Complete (with --force override), and --reviews against a closed phase hard-errors with no override. Prevents accidental re-planning over shipped code. (#3569)

• Canonical [features].hooks for Codex configs, legacy alias recognized — Codex config emission uses the canonical features.hooks key while still accepting the legacy codex_hooks shape on read. Fixes the install where the previous key drift left Codex unable to find managed hooks. (#3566)

• SDK bridge loads via the public package export — fixes a stale internal path that broke SDK dispatch after install on some package layouts. (#3567)

• W006/W007 health warnings skip archived and future phases — /gsd:health no longer flags phases that are intentionally unimplemented (future) or archived as missing-on-disk or missing-from-roadmap. (#3559, #3560)

• Ultraplan runtime gates on Claude Code markers — /gsd:ultraplan detects the runtime via Claude Code markers and fails closed when the version is unavailable, instead of running against an unknown runtime. (#3561)

• Padded phase IDs match unpadded ROADMAP prose — phase routing through phaseMarkdownRegexSource handles 02.7 ↔ 2.7 and similar padding mismatches so /gsd:phase complete 02 updates a ROADMAP that uses the short ### Phase 2: form. (#3537)

• W007 ignores archived phase directories — phases under .planning/milestones/v*/ no longer trigger "exists on disk but not in roadmap" warnings against the active roadmap. (#3560)

• Prompt-user migration actions resolve in non-TTY runs — installer-migration-authoring flows complete cleanly under CI / non-interactive shells; error grouping clarified. (#3541)

• Executor agents forbidden from git stash — execution agents no longer use shared stash storage, which violated worktree isolation when multiple agents ran in parallel. (#3542)

• Configuration manifests load from the installed payload — configuration.generated.cjs looks in the installed gsd-core/bin/shared/ path first, then falls back to source-checkout sdk/shared/. Fixes the install where the manifest loader failed on the runtime layout because the source-tree path doesn't exist after install. (#3571)

---

What was in 1.42.1

RELEASE-v1.42.1.md — package legitimacy gate against slopsquatting, skill-surface budgeting (--profile=core / standard / full), installer migration framework, configurable /gsd-ship PR body sections, review.default_reviewers, optional fallow structural review, structured --json-errors CLI mode, plus 30+ correctness fixes across project_code phase prefixes, phase completion idempotency, nested git detection, Codex install migration, SDK install readiness, and decimal-phase dependencies.

---

Installing

# npm (global)
npm install -g @opengsd/get-shit-done-redux@latest

# npx (one-shot)
npx @opengsd/get-shit-done-redux@latest

# Pin to this exact version
npm install -g @opengsd/get-shit-done-redux@1.42.3

The installer is idempotent — re-running on an existing install updates in-place, preserving your .planning/ directory and local patches.

Codex CLI requirement

Codex installs (--codex) require Codex CLI 0.130.0 or later. Earlier Codex versions used a discovery mechanism that the current install layout does not target; upgrade Codex first, then re-run the GSD installer.