chore: bump plugin version 2.41.1 -> 2.42.0; README + CHANGELOG; drift skip sdk/

Releases the bundled-SDK feature from cf4382c. Three changes:

1. Version bump 2.41.1 -> 2.42.0 across package.json, plugin.json,
   marketplace.json, README header. Versioning rule normally is
   plugin_minor = upstream_minor; this is an explicit exception for
   a plugin-only feature release. Documented in the CHANGELOG entry.

2. README updates:
   - Replaced the "Prerequisites: install GSD SDK CLI" section
     (added in v2.41.1 as a stop-gap) with a "No prerequisites"
     notice pointing at the bundled SDK.
   - Migration §2 reverted to recommending `npm uninstall -g
     get-shit-done-cc` -- now genuinely safe on v2.42.0+ -- with a
     "history of this section's wording" callout linking to #4.

3. bin/maintenance/check-file-layout.cjs -- added sdk/ to the
   skipDirs list. The vendored SDK contains literal ref-string
   placeholders in prompt-sanitizer's docstring (`references/foo.md`,
   `workflows/bar.md`) that the drift detector would otherwise flag
   as Category B. sdk/ is upstream-derived vendored source, not
   plugin-authored content the detector is meant to police.

Verified: regression test passes, drift detector PASS (131/131/0
unchanged from baseline).

Author: jnuyens

.claude-plugin/marketplace.json

@@ -11,7 +11,7 @@
       "name": "gsd",
       "source": "./",
       "description": "Get Shit Done -- structured workflow plugin for Claude Code with planning, execution, verification, and MCP-backed project state",
-      "version": "2.41.1",
+      "version": "2.42.0",
       "author": {
         "name": "Jasper Nuyens"
       },

.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd",
-  "version": "2.41.1",
+  "version": "2.42.0",
   "description": "Get Shit Done -- a structured workflow plugin for Claude Code that adds planning, execution, and verification commands with MCP-backed project state",
   "author": {
     "name": "Jasper Nuyens"

CHANGELOG.md

@@ -8,6 +8,39 @@ History before 2.38.2 lives in git + the per-milestone archive (see `.planning/m
 
 ## [Unreleased]
 
+## [2.42.0] - 2026-05-07
+
+**No more `gsd-sdk` prerequisite.** The plugin now bundles the GSD SDK inside its own tree, so `/plugin install gsd@gsd-plugin` is genuinely the only install step. Closes [#4](https://github.com/jnuyens/gsd-plugin/issues/4) at the architectural level (v2.41.1's README fix corrected the documentation; this release removes the requirement that documentation was trying to describe).
+
+### Added
+- **`sdk/`** — full GSD SDK source tree synced from upstream `gsd-build/get-shit-done@v1.41.0` (`src/`, `prompts/`, `scripts/`, `package.json`, `tsconfig.json`, `package-lock.json`).
+- **`sdk/dist/`** — pre-built TypeScript output (`tsc` against the committed `src/`). Plugin commits `dist/` even though upstream gitignores it: plugin users won't run `npm install` / `npm run build`, so the binary needs to be ready immediately after `/plugin install`.
+- **`bin/gsd-sdk`** — POSIX shell wrapper that `exec`s `node ${CLAUDE_PLUGIN_ROOT}/sdk/dist/cli.js`. Falls back to script-relative resolution if `CLAUDE_PLUGIN_ROOT` is unset, and to an external `gsd-sdk` on `PATH` if the bundled one is somehow missing (preserves legacy install path as a safety net).
+- **`bin/gsd-sdk.cmd`** — Windows batch wrapper with the same logic.
+
+### Changed
+- **README** — replaced the "Prerequisites: install the GSD SDK CLI" subsection (added in v2.41.1 as a stop-gap) with a "No prerequisites" notice. Migration §2 now correctly tells users it's safe to `npm uninstall -g get-shit-done-cc` after upgrading to v2.42.0+.
+- **Versioning rule exception** — bumping minor (`2.41.x → 2.42.0`) for a plugin-only feature even though upstream is still at `1.41.0`. Standard rule (`plugin_minor = upstream_minor`) resumes when the next upstream sync lands; if upstream then ships `1.42.0`, that sync goes out as `2.43.0` to avoid collision.
+
+### Plugin patches
+Two SDK source patches were needed for the plugin's flat directory layout:
+- **`sdk/src/query/state-project-load.ts`** — adds `${CLAUDE_PLUGIN_ROOT}/bin/lib/core.cjs` as the first probe candidate. Upstream's resolver expects `<root>/get-shit-done/bin/lib/core.cjs`; the plugin's flat layout is `<plugin_root>/bin/lib/core.cjs`. Tagged `[PLUGIN PATCH]` inline.
+- **`sdk/src/query-gsd-tools-path.ts`** — same patch for `gsd-tools.cjs`. Tagged `[PLUGIN PATCH]` inline.
+
+### How resolution works (no callsite rewrite was needed)
+Claude Code automatically prepends each plugin's `bin/` directory to `PATH` for every `Bash` tool call. Existing `gsd-sdk query ...` invocations across all 500+ workflow and skill callsites resolve to the bundled wrapper for plugin-only users, with **zero rewrite** required. Users with an external `gsd-sdk` already on `PATH` (e.g. `/opt/homebrew/bin` from a prior `npx get-shit-done-cc` install) keep using their external one because plugin `bin/` is appended (not prepended) by Claude Code — no behavior change for legacy users.
+
+### Verified
+- `gsd-sdk --version` → `v1.50.0-canary.0` (bundled, was the npm-published `0.1.0`)
+- `gsd-sdk query state.load` returns valid project config block
+- `gsd-sdk query roadmap.analyze` returns project milestones
+- `gsd-sdk query commands` returns full command list
+- `node tests/mcp-stdio-framing.test.cjs` still passes (regression fence from v2.40.2 unaffected)
+
+### Notes
+- Bundle adds ~6.8 MB to the plugin tree (`sdk/dist/` 3.9 MB + `sdk/src/` 2.8 MB + prompts/scripts). Plugin total still well under typical Claude Code plugin sizes.
+- Long-term: route workflow scripts through the plugin's own MCP server instead of shelling out at all. Tracked separately; this release is the architectural prerequisite that makes the routing achievable.
+
 ## [2.41.1] - 2026-05-07
 
 Documentation hotfix — corrects a README instruction that left migrating users (and any new user without a prior `npx get-shit-done-cc` install) with broken `/gsd:*` commands.

README.md

@@ -2,7 +2,7 @@
 
 **Based on:** [GSD 1.41.0](https://github.com/gsd-build/get-shit-done/releases/tag/v1.41.0) base tree by **TACHES** (Lex Christopherson)
 
-**Plugin version:** `2.41.0`
+**Plugin version:** `2.42.0`
 
 **GSD Plugin for Claude Code** ensures your coding work gets done in a systematic, structured way. It prompts you only for the important design and architectural decisions that actually need your judgment, and it splits each step into its own focused subcontext so token use stays optimised across long projects.
 
@@ -12,24 +12,11 @@ Under the hood, a performance-optimized plugin packaging of [GSD](https://github
 
 GSD Plugin installs *inside* a Claude Code session, not from your host shell. If you have never used Claude Code plugins before, follow these steps in order.
 
-### Prerequisites: install the GSD SDK CLI (`gsd-sdk`)
+### No prerequisites
 
-The plugin's workflow scripts shell out to the `gsd-sdk` binary in 500+ places. Without it, every `/gsd:*` command fails with `command not found: gsd-sdk`. Install it once globally before installing the plugin:
+As of **v2.42.0** the plugin bundles its own copy of the GSD SDK at `sdk/dist/cli.js` and ships a `bin/gsd-sdk` wrapper that Claude Code automatically puts on `PATH` for plugin Bash calls. You no longer need to `npm install -g get-shit-done-cc`. Closes [#4](https://github.com/jnuyens/gsd-plugin/issues/4).
 
-```bash
-npm install -g get-shit-done-cc
-```
-
-The `get-shit-done-cc` package ships the `gsd-sdk` binary on your `PATH`. (`npm install -g @gsd-build/sdk` is *not* sufficient yet — its npm-published `0.1.0` lacks the `query` subcommand the plugin needs; tracked at [gsd-build/get-shit-done#2685](https://github.com/gsd-build/get-shit-done/issues/2685).)
-
-Verify:
-
-```bash
-which gsd-sdk    # should print a path
-gsd-sdk --version
-```
-
-If you've used GSD before via `npx get-shit-done-cc`, you already have this and can skip ahead.
+If you already have an external `gsd-sdk` from a prior `npx get-shit-done-cc` install, it stays on your `PATH` ahead of the bundled one and keeps working — no breakage.
 
 ### Step 1: Trust GitHub's SSH host key (first time only on a new machine)
 
@@ -213,19 +200,15 @@ Type these at the Claude Code prompt:
 /reload-plugins
 ```
 
-#### 2. Keep `get-shit-done-cc` installed -- the plugin needs its `gsd-sdk` binary
-
-> **Earlier versions of this README (≤ v2.41.0) told you to `npm uninstall -g get-shit-done-cc` here. That was wrong and has been corrected** ([#4](https://github.com/jnuyens/gsd-plugin/issues/4), reported by @ThomasHezard and confirmed by @herman925).
-
-The plugin's `workflows/*.md` and `skills/*/SKILL.md` files shell out to `gsd-sdk` (provided by `get-shit-done-cc`) in 500+ places, so the package must stay installed even after migrating to the plugin. If you already removed it, reinstall:
+#### 2. Uninstall `get-shit-done-cc` npm package (now safe -- v2.42.0+)
 
 ```bash
-npm install -g get-shit-done-cc
+npm uninstall -g get-shit-done-cc
 ```
 
-The legacy *config directory* (`~/.claude/get-shit-done/`) is still safe to remove if the auto-migration didn't already do so -- only the npm package needs to remain. The plugin self-contains its own copy of all workflow / skill / agent / reference content; it just needs the `gsd-sdk` binary as a runtime helper.
+> **History:** this step's wording has changed twice. Versions ≤ v2.41.0 told users to uninstall while the plugin still needed the package's `gsd-sdk` binary, which silently broke every `/gsd:*` command ([#4](https://github.com/jnuyens/gsd-plugin/issues/4)). v2.41.1 corrected the README to "keep installed". v2.42.0 bundles the SDK inside the plugin, making the uninstall genuinely safe again. Thanks to @ThomasHezard for catching the original bug and @herman925 for confirming.
 
-> **Long-term plan:** route the workflows through the plugin's own MCP server (or a bundled SDK shim) so `gsd-sdk` is no longer a separate prerequisite. Tracked at [#4](https://github.com/jnuyens/gsd-plugin/issues/4).
+If you're on **v2.42.0 or newer** the plugin's `bin/gsd-sdk` wrapper takes over once the global one is gone; nothing breaks. If you're on an older plugin version, leave the global package alone until you've upgraded the plugin first.
 
 #### 3. Stop using `/gsd:update`
 

bin/maintenance/check-file-layout.cjs

@@ -48,6 +48,9 @@ if (!fs.existsSync('.git') || !fs.existsSync('skills')) {
 const skipDirs = [
   /^_research\//,
   /^\.planning\//,  // all planning artifacts (plans, summaries, research, quick tasks, archives)
+  /^sdk\//,         // vendored SDK source/dist (v2.42.0+) — refs inside are upstream's docstrings
+                    // (e.g. literal `references/foo.md` placeholders in prompt-sanitizer comments),
+                    // not plugin-authored content the layout detector is meant to police.
 ];
 const textExt = /\.(md|json|cjs|js|ts|tsx|txt|yml|yaml|sh|html)$/i;
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "gsd-plugin",
-  "version": "2.41.1",
+  "version": "2.42.0",
   "description": "Performance-optimized plugin packaging of GSD (Get Shit Done) for Claude Code",
   "private": true,
   "scripts": {