dff176bfd2
Mirror of code, issues, and PRs from the upstream gsd-build/get-shit-done, which appears compromised or abandoned (maintainer unreachable since 2026-04-01; $GSD token linked to rug-pull). - Adds rebrand notice block at top of English README - Removes $GSD token badge and @gsd_foundation X badge (keeps Discord) - Renames npm packages: get-shit-done-cc -> get-shit-done-redux, @gsd-build/sdk -> @gsd-redux/sdk - Updates all repo URLs across docs, workflows, package.json, bin/ - Updates ci@gsd-build -> ci@gsd-redux in workflow git identities - Leaves CHANGELOG and .changeset/* alone (historical, time-stamped)
101 lines
7.0 KiB
Markdown
101 lines
7.0 KiB
Markdown
# v1.42.0-rc.1 Release Notes
|
|
|
|
First release candidate for the **1.42.0** train. Published to npm under the `next` dist-tag.
|
|
|
|
```bash
|
|
npx get-shit-done-redux@next
|
|
# or pin exact:
|
|
npm install -g get-shit-done-redux@1.42.0-rc1
|
|
```
|
|
|
|
> **Release-candidate stream caveat.** RCs come from `main` and are the staging stream for the next stable `latest`. They are stable enough for everyday use but may carry bake items resolved before the matching `vX.Y.0` is published. See [CANARY.md](CANARY.md) for the stream policy.
|
|
|
|
---
|
|
|
|
## What's in this release
|
|
|
|
1.42.0-rc.1 is the first cut of the 1.42 train. The headline addition is a **package legitimacy gate against slopsquatting** — a three-layer defense across the research → plan → execute pipeline that prevents AI-hallucinated package names from flowing undetected into `npm install`. Underneath that, two structural refactors deepen the **SDK package seam** and the **phase lifecycle seams** so future work has cleaner module boundaries.
|
|
|
|
This RC also rolls up every fix that shipped in [v1.41.1](https://github.com/GSD-redux/get-shit-done-redux/releases/tag/v1.41.1). Those fixes are listed in the v1.41.1 notes and on the GitHub release page; this document is scoped to the **new features** in 1.42.0.
|
|
|
|
---
|
|
|
|
## Added
|
|
|
|
### Security
|
|
|
|
#### Package legitimacy gate against slopsquatting ([#3215](https://github.com/GSD-redux/get-shit-done-redux/pull/3215))
|
|
|
|
A three-layer defense across the research → plan → execute pipeline. Before this release, a hallucinated package name that passed `npm view` could flow undetected into `gsd-executor` running `npm install <malicious-pkg>` with no human gate. The gate closes that path:
|
|
|
|
- **Layer 1 — Researcher (`agents/gsd-phase-researcher.md`).** A new `<package_legitimacy_protocol>` block runs `slopcheck install <pkgs> --json` over every recommended package, performs ecosystem-specific verification (`pip index versions` / `npm view` / `cargo search`), and emits a `## Package Legitimacy Audit` table to `RESEARCH.md` with Package, Registry, Age, Downloads, Source Repo, slopcheck, and Disposition columns. Packages discovered solely through WebSearch are tagged `[ASSUMED]` — never `[VERIFIED]`. `[SLOP]` packages are removed from RESEARCH.md and listed under "Packages removed due to slopcheck."
|
|
- **Layer 2 — Planner (`agents/gsd-planner.md`).** Reads the Audit table and inserts a `checkpoint:human-verify` task before any install whose package is tagged `[ASSUMED]` or `[SUS]`. Plans that introduce installs gain a `T-{phase}-SC` Tampering / supply-chain row in their `<threat_model>` template.
|
|
- **Layer 3 — Executor (`agents/gsd-executor.md`).** RULE 3 amended: package installs (`npm`/`pip`/`cargo`) are excluded from auto-fix scope. Failed installs become `checkpoint:human-verify` with a slopsquatting-risk rationale instead of being silently retried.
|
|
|
|
**Hardening.** Every `npx --yes <pkg>@latest` invocation across the three agent files is replaced with a `command -v <bin>` guard pattern — this closes the same fetch-and-execute hole `npx --yes` opens.
|
|
|
|
**Graceful degradation.** When `slopcheck` is unavailable at research time, every recommended package is tagged `[ASSUMED]` and gated with a checkpoint, so the protective behavior degrades safely instead of bypassing the gate.
|
|
|
|
**Documentation.** `docs/USER-GUIDE.md` has a new "Package Legitimacy Gate" subsection in the Security section; `docs/COMMANDS.md` notes the gate on `/gsd-plan-phase`; `docs/ARCHITECTURE.md` documents the gate before the Security Hooks section and updates the plan-phase pipeline diagram with the gate steps.
|
|
|
|
Closes [#2827](https://github.com/GSD-redux/get-shit-done-redux/issues/2827).
|
|
|
|
---
|
|
|
|
## Changed
|
|
|
|
### Architecture
|
|
|
|
#### SDK package seam deepened; runtime-global skills policy converged ([#3238](https://github.com/GSD-redux/get-shit-done-redux/pull/3238))
|
|
|
|
Concentrates two areas that were previously scattered across the codebase:
|
|
|
|
- **SDK Package Seam Module.** Legacy package and install-layout compatibility — previously leaked across `state-project-load`, `verify`, `roadmap`, prompt-loading paths, `agent-skills`, `skill-manifest`, and `generateDevPreferences` — is now centralized behind a single Module. Callers consume legacy-asset discovery and install-layout probing through a thin Adapter; transition-only error messaging lives in one place.
|
|
- **Runtime-Global Skills Policy Module.** A single runtime-aware global-skills directory policy is now shared by SDK and CJS callers. Resolves runtime-global skills bases and skill paths from the runtime + env precedence chain, renders display paths for warnings/manifests, and reports unsupported runtimes that lack a skills directory.
|
|
|
|
The CONTEXT.md domain glossary is updated with both Module entries so future work points at the canonical seams instead of re-deriving the boundaries.
|
|
|
|
Closes [#3237](https://github.com/GSD-redux/get-shit-done-redux/issues/3237). Refs [#3234](https://github.com/GSD-redux/get-shit-done-redux/issues/3234).
|
|
|
|
#### Phase lifecycle seams deepened ([#3267](https://github.com/GSD-redux/get-shit-done-redux/pull/3267))
|
|
|
|
`phase-lifecycle.ts` becomes a thin public orchestrator. Three new modules are extracted:
|
|
|
|
- **Phase Numbering Policy Module.** Phase-name and project-code validation, slug/ID generation, sequential and decimal phase progression, and roadmap-entry construction.
|
|
- **Phase Filesystem Adapter Module.** Directory listing, gitkeep creation, and archive operations for phase directories.
|
|
- **Phase Roadmap Mutation Module.** `replaceInCurrentMilestone` and atomic ROADMAP.md read-modify-write under planning lock.
|
|
|
|
Backward-compatible re-exports are preserved on `phase-lifecycle.ts` so existing callers continue to work; new callers should import from the dedicated modules.
|
|
|
|
Closes [#3270](https://github.com/GSD-redux/get-shit-done-redux/issues/3270).
|
|
|
|
---
|
|
|
|
## What was in 1.41.x
|
|
|
|
- **[v1.41.1](https://github.com/GSD-redux/get-shit-done-redux/releases/tag/v1.41.1)** — 14-fix hotfix: phase-plan-index DAG correctness, state-snapshot YAML frontmatter precedence, code-review SUMMARY parser hardening (`BL-` / `blocker:` accepted as Critical-tier), Codex install TOML floats + idempotent rollback, persistent SDK reachability probe, shared model-catalog source of truth (ADR-0003), and more.
|
|
- **[v1.41.0](https://github.com/GSD-redux/get-shit-done-redux/releases/tag/v1.41.0)** — six namespace meta-skills, `/gsd-health --context` utilization guard, `--minimal` install flag, `/gsd-edit-phase`, post-merge build & test gate, manual canary release workflow, and 25+ correctness fixes. See [`RELEASE-v1.41.0.md`](RELEASE-v1.41.0.md).
|
|
|
|
---
|
|
|
|
## Installing
|
|
|
|
```bash
|
|
# npm (global, RC channel)
|
|
npm install -g get-shit-done-redux@next
|
|
|
|
# npx (one-shot)
|
|
npx get-shit-done-redux@next
|
|
|
|
# Pin to this exact RC
|
|
npm install -g get-shit-done-redux@1.42.0-rc1
|
|
```
|
|
|
|
The installer is idempotent — re-running on an existing install updates in-place, preserving your `.planning/` directory and local patches.
|
|
|
|
To roll back to the latest stable, install with `@latest`:
|
|
|
|
```bash
|
|
npx get-shit-done-redux@latest
|
|
```
|