v2.42.1 - Bundle SDK runtime deps (fixes broken v2.42.0)

Hotfix completing v2.42.0's "no external prereq" promise.

v2.42.0 shipped sdk/dist/cli.js as a ~3 KB tsc shim that imported ws, @anthropic-ai/claude-agent-sdk, and friends from node_modules/ — but node_modules/ wasn't shipped, and Claude Code doesn't run npm install for plugins. On a truly fresh box (no prior npx get-shit-done-cc) every /gsd:* command would have failed with Cannot find package 'ws'.

Caught by smoke-testing v2.42.0 on a fresh Debian 13 box. Existing macOS/laptop installs had an external gsd-sdk already on PATH so the bug was invisible there.

Fixed

• sdk/dist/cli.js — switched the SDK build from plain tsc to tsc && esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js --allow-overwrite, with a createRequire shim banner so CJS deps (ws's transitive require() calls) work inside the ESM output. Result: dist/cli.js is now a single 1.5 MB self-contained file with all runtime deps inlined. No node_modules needed at plugin runtime.
• sdk/package.json — added a bundle script and updated build to chain it after tsc. Added esbuild ^0.28.0 as devDependency (build-time only, not shipped).

Verified end-to-end on Debian 13 (no prior GSD install)

1. gsd-sdk --version → v1.50.0-canary.0 ✓
2. PATH-based resolution (simulating CC plugin loader) → ✓
3. gsd-sdk query state.load → returns valid project config ✓
4. gsd-sdk query commands → returns full command list ✓
5. MCP regression test from v2.40.2 → ✓ (8 tools)
6. Workflow-style callsite (gsd-sdk query commands with PATH including plugin/bin) → ✓

Notes

• Plugin tree size grew by ~+1.5 MB. Net cost is still ~80 MB less than committing node_modules/ would have been.
• v2.42.0 is being superseded same-day rather than left in the wild. If you pulled v2.42.0, run /plugin marketplace update gsd-plugin to get this fix.

---

Full changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2421---2026-05-07
Issue: #4