v2.42.4 - Upstream sync to GSD 1.41.2 (state integrity + verifier hardening)

Upstream patch sync to GSD 1.41.2 (released 2026-05-10). Plugin patches in bin/lib/core.cjs and bin/gsd-tools.cjs untouched upstream this cycle. The #PLUGIN-MODEL-CATALOG-PATH patch shape evolved: upstream replaced the single-path require with a 3-candidate resolver, so the plugin's flat-layout path is now folded into upstream's candidate list as entry #0 (cleaner than yesterday's try-fallback shape).

Headline upstream fixes flowing through

State integrity

• State write integrity (#3291) — state record-metric, state add-decision, and state add-blocker no longer silently lose data. Missing target sections auto-created with canonical scaffolds; all three verbs honor --ws <name> workstream routing.

Verifier hardening

• No-pass-with-unresolved-markers (#3343) — phase verification no longer passes with TBD / FIXME / XXX in phase-modified source files. DEF-* IDs and same-line issue/PR refs remain valid formal deferrals.
• Probe scripts execute directly (#3350) — verifier no longer accepts SUMMARY-reported probe PASS markers as evidence.
• Human-needed verification no longer completes phases (#3339) — check.ship-ready only passes on explicit pass states.

Planning & execution

• Executor stall detection (#3329) — safe-resume contracts surface partial-plan drift before dispatching duplicate work.
• phase remove --force renumbering fix (#3367) — integer removal preserves later ROADMAP progress rows.
• detect-custom-files scans skills/ (#3318) — prevents user-added skills from being silently destroyed during /gsd:update.

Install hardening

• Windows gsd-sdk install (#3282) — installer probes persistent Windows Path via PowerShell; filters transient npx PATH entries; replaces stale gsd-sdk.cmd shims pointing at deprecated gsd-tools.cjs.
• Gemini PowerShell hooks + agent conversion (#3368) — managed hook commands use PowerShell's call operator; Gemini agent conversion drops Claude-only AskUserQuestion / ask_user tool metadata.
• Stale gsd-sdk executable detection (#3363) — installer SDK-readiness withholds the ready message and prints diagnostic when on-PATH version differs from expected.

Plugin patches

Patch	Status this cycle
bin/lib/core.cjs — resolveGsdRoot/DataDir/Asset + getAgentsDir	Untouched upstream; regression-grep verified intact
bin/gsd-tools.cjs — migrate/write-phase-memory/checkpoint/hook cases	Untouched upstream; regression-grep verified intact
bin/lib/model-catalog.cjs (#PLUGIN-MODEL-CATALOG-PATH)	Evolved — folded into upstream's new candidate list as entry #0

Verified

• All 50 bin/*.cjs + bin/lib/*.cjs pass node -c
• model-catalog.cjs loads 33 agents in plugin layout (no env vars needed)
• MCP regression test (issue #3) passes
• workspace.json integration test (issue #5/PR #6) 22/22 passes
• Install smoke (fresh debian:trixie) + Check drift both green

Notes

• Second sync this week. Upstream cadence is fast: v1.41.0 GA 2026-05-07, v1.41.1 GA 2026-05-09, v1.41.2 GA 2026-05-10. Three patches in 4 days.
• v1.42.0 GA still pending — rc2 published 2026-05-10 22:10 UTC, 21 min after v1.41.2 GA. Same rolling-hotfix-while-RC pattern.
• Bundled SDK at sdk/dist/cli.js still on v1.50.0-canary.0. Will refresh on the next significant SDK update.

Upgrade

/plugin marketplace update gsd-plugin
/plugin install gsd@gsd-plugin
/reload-plugins

---

Full upstream changelog: https://github.com/gsd-build/get-shit-done/releases/tag/v1.41.2
Plugin changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2424---2026-05-11

v2.42.3 - workspace.json SessionStart integration (#5, #6)

Adds optional agents.workspace.json SessionStart integration. Architectural discussion in #5; implementation in PR #6, authored by @qmarcelle — the project's first external contributor to substantive plugin code.

What this adds

When .agents/agents.workspace.json (or legacy agents.workspace.json root path) is present in a project, the plugin reads it during SessionStart and surfaces structured codebase intelligence to the model:

• Empirically-fragile files (filtered to fragility ≥ 0.7, with aiModificationCount vs humanModificationCount history) — the genuinely-new signal that's not derivable from human-authored fragility notes
• Detected framework manifest (filtered to confidence ≥ 0.7)
• Human-annotated fragile files and co-change patterns

Spec at https://workspacejson.dev/spec.

Scope (per #5 discussion)

The integration reads only the four agreed buckets:

• generated.frameworkManifest
• generated.fileIndex (for fragility scores)
• manual.fragileFiles
• manual.coChangePatterns

manual.conventions / manual.techStack / manual.description are deliberately NOT read — those overlap with GSD's own .planning/PROJECT.md, which remains canonical. workspace.json is authoritative on net-new content only.

Zero-token-impact convention

This release locks in a design rule for the project: optional integrations must not cost anything to users who haven't opted in. workspace.json adds one existsSync syscall to SessionStart; if the file is absent, the plugin behaves identically to v2.42.2. All future optional integrations follow the same convention.

Safety

• Strict major-version gating: same major loads, different major refuses with clear error (no silent-corruption-via-load-future-version risk)
• Prompt-injection sanitization: every user-controlled string in workspace.json (file paths, framework names, fragility reasons, co-change notes) is stripped of zero-width characters and neutralized for <system> / [INST] / <<SYS>> markers
• DoS guards: input arrays/objects capped before processing (10K index entries, 100 framework entries, 500 fragile files, 200 co-change patterns)
• Fail-soft read path: never throws. Missing, malformed, schema-mismatched, or version-mismatched files all return null with stderr message; SessionStart unaffected

Configurable

• gsd.workspace_json_max_files in .planning/config.json controls how many fragile files surface (default 5)

Files

• bin/lib/workspace-json.cjs (new, 176 lines)
• bin/gsd-tools.cjs (+27 lines wiring into SessionStart)
• tests/workspace-json-integration.test.cjs (new, 538 lines, 22 scenarios)

Verified

• 22/22 local tests pass
• Install smoke (fresh debian:trixie) + Check drift both green
• Carries forward MCP stdio framing fix (#3) and bundled SDK (#4) — no external prereq, MCP server reachable

Credits

@qmarcelle — implementation, test suite, and unsolicited security + DoS hardening passes. Iteratively responsive to review feedback throughout (visible in the PR commit history). First external contributor to land substantive plugin code.

Upgrade

/plugin marketplace update gsd-plugin
/plugin install gsd@gsd-plugin
/reload-plugins

No action required for users without workspace.json — behavior is identical to v2.42.2. Users with workspace.json get the SessionStart context injection on the next session.

---

Full changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2423---2026-05-10
Issue: #5
PR: #6

v2.42.2 - Upstream sync to GSD 1.41.1 (model-catalog convergence + wave-0 fix)

Upstream patch sync to GSD 1.41.1 (released 2026-05-09). Plugin-only patches in bin/lib/core.cjs (CLAUDE_PLUGIN_ROOT path resolution helpers + agent-dir override) and bin/gsd-tools.cjs (migrate / write-phase-memory / checkpoint / hook cases) preserved via 3-way merge. One new plugin patch in bin/lib/model-catalog.cjs for the flat plugin layout — same fallback pattern as getAgentsDir().

Headline upstream fixes (flowing through)

• Wave 0 plans no longer collapse into wave 1 (#3276) — phase-plan-index switched to a Kahn topological sort over depends_on. Real planner correctness fix.
• Shared model catalog as the single source of truth (#3230) — replaces 4 drifting truths (CJS model-profiles, SDK config-query, settings-advanced.md, session-runner) with sdk/shared/model-catalog.json. New bin/lib/model-catalog.cjs module reads it. Now covers all 33 shipped agents; unknown-agent fallback is profile-semantic (quality→opus, budget→haiku, balanced/adaptive→sonnet).
• Code-review pipeline hardened (#3274) — BL- / blocker: accepted as Critical-tier; macOS BSD-grep portability fix.
• state snapshot prefers YAML frontmatter for canonical fields (#3275) — body table cells no longer override frontmatter values.
• CJS dispatcher accepts the canonical dotted command form (#3248) — state.update, roadmap.analyze, etc. resolve correctly.
• /gsd:capture --seed one-shot contract restored (#3250).

Plugin patches preserved + 1 new

• bin/lib/core.cjs — resolveGsdRoot / resolveGsdDataDir / resolveGsdAsset + the patched getAgentsDir reading GSD_AGENTS_DIR. Reapplied via 3-way merge (upstream's core.cjs got 87 lines smaller; a chunk migrated into model-catalog.cjs).
• bin/gsd-tools.cjs — 4 plugin cases (migrate / write-phase-memory / checkpoint / hook) reapplied. Upstream's only change was the dotted-command-form shim near the dispatcher entry, far from the plugin patch zone.
• bin/lib/model-catalog.cjs (NEW patch — #PLUGIN-MODEL-CATALOG-PATH) — upstream's ../../../sdk/shared/model-catalog.json traversal lands one level too high in the plugin's flat layout. Patched to try ../../sdk/shared/ first, fall back to upstream path. No env vars required.

Verified

• All 49 bin/*.cjs + bin/lib/*.cjs pass node -c
• Bundled SDK still resolves (gsd-sdk v1.50.0-canary.0)
• model-catalog.cjs runtime: 33 agents loaded, 5 valid profiles
• MCP regression test (issue #3) still passes
• File-layout drift baseline matches (131/131/0)
• Install-smoke CI passes in debian:trixie container

Notes

• Bundled SDK at sdk/dist/cli.js still on v1.50.0-canary.0. Will refresh when upstream v1.50.0 stabilises.
• v1.42.0 GA expected within 3-5 days (rc1 published 2026-05-09 04:32, one minute after v1.41.1 GA). Next sync will be 2.42.2 → 2.43.0.

Upgrade

/plugin marketplace update gsd-plugin
/plugin install gsd@gsd-plugin
/reload-plugins

---

Full upstream changelog: https://github.com/gsd-build/get-shit-done/releases/tag/v1.41.1
Plugin changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2422---2026-05-10

v2.42.1 - Bundle SDK runtime deps (fixes broken v2.42.0)

Hotfix completing v2.42.0's "no external prereq" promise.

v2.42.0 shipped sdk/dist/cli.js as a ~3 KB tsc shim that imported ws, @anthropic-ai/claude-agent-sdk, and friends from node_modules/ — but node_modules/ wasn't shipped, and Claude Code doesn't run npm install for plugins. On a truly fresh box (no prior npx get-shit-done-cc) every /gsd:* command would have failed with Cannot find package 'ws'.

Caught by smoke-testing v2.42.0 on a fresh Debian 13 box. Existing macOS/laptop installs had an external gsd-sdk already on PATH so the bug was invisible there.

Fixed

• sdk/dist/cli.js — switched the SDK build from plain tsc to tsc && esbuild --bundle --platform=node --format=esm --outfile=dist/cli.js --allow-overwrite, with a createRequire shim banner so CJS deps (ws's transitive require() calls) work inside the ESM output. Result: dist/cli.js is now a single 1.5 MB self-contained file with all runtime deps inlined. No node_modules needed at plugin runtime.
• sdk/package.json — added a bundle script and updated build to chain it after tsc. Added esbuild ^0.28.0 as devDependency (build-time only, not shipped).

Verified end-to-end on Debian 13 (no prior GSD install)

1. gsd-sdk --version → v1.50.0-canary.0 ✓
2. PATH-based resolution (simulating CC plugin loader) → ✓
3. gsd-sdk query state.load → returns valid project config ✓
4. gsd-sdk query commands → returns full command list ✓
5. MCP regression test from v2.40.2 → ✓ (8 tools)
6. Workflow-style callsite (gsd-sdk query commands with PATH including plugin/bin) → ✓

Notes

• Plugin tree size grew by ~+1.5 MB. Net cost is still ~80 MB less than committing node_modules/ would have been.
• v2.42.0 is being superseded same-day rather than left in the wild. If you pulled v2.42.0, run /plugin marketplace update gsd-plugin to get this fix.

---

Full changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2421---2026-05-07
Issue: #4

v2.42.0 - Bundled SDK: no more gsd-sdk prerequisite (#4)

No more gsd-sdk prerequisite. The plugin now bundles its own copy of the GSD SDK, so /plugin install gsd@gsd-plugin is genuinely the only install step for new users. Closes the architectural side of #4 (v2.41.1's README fix corrected the documentation; this release removes the prereq the documentation was trying to describe).

Highlights

• 🎁 Bundled SDK — plugin ships sdk/dist/cli.js plus a bin/gsd-sdk wrapper that Claude Code automatically resolves on PATH for plugin Bash calls.
• 🔁 Zero callsite rewrite — Claude Code already adds each plugin's bin/ to PATH, so the existing 500+ gsd-sdk invocations across workflows/ and skills/ resolve to the bundled wrapper unchanged.
• 🔄 Backwards-compatible — users with an external gsd-sdk already on PATH (e.g. /opt/homebrew/bin from a prior npx get-shit-done-cc install) keep using their external one. Plugin bin/ is appended, not prepended.
• 📦 Migration §2 of the README is now correct again: npm uninstall -g get-shit-done-cc is genuinely safe on v2.42.0+.

Added

• sdk/ — full SDK source synced from upstream gsd-build/get-shit-done@v1.41.0 (src/, prompts/, scripts/, package.json, tsconfig.json).
• sdk/dist/ — pre-built TypeScript output committed (override of upstream's dist/ gitignore — plugin users won't run npm install).
• bin/gsd-sdk — POSIX shell wrapper.
• bin/gsd-sdk.cmd — Windows batch wrapper with the same logic.

Plugin patches

Two SDK source patches for the plugin's flat directory layout (tagged [PLUGIN PATCH] inline):

• sdk/src/query/state-project-load.ts — adds ${CLAUDE_PLUGIN_ROOT}/bin/lib/core.cjs as the first probe candidate.
• sdk/src/query-gsd-tools-path.ts — same for gsd-tools.cjs.

Verified

• gsd-sdk --version → v1.50.0-canary.0 (bundled, was the npm-published 0.1.0 previously)
• gsd-sdk query state.load returns valid project config block
• gsd-sdk query roadmap.analyze returns project milestones
• gsd-sdk query commands returns full command list
• MCP regression test from v2.40.2 still passes (tests/mcp-stdio-framing.test.cjs)

Versioning note

Bumping minor (2.41.x → 2.42.0) for a plugin-only feature even though upstream is still at 1.41.0. Standard rule (plugin_minor = upstream_minor) resumes when the next upstream sync lands; if upstream then ships 1.42.0, that sync goes out as 2.43.0 to avoid collision.

Credits

Reported by @ThomasHezard (#4, 2026-04-28) with line-precise investigation. Confirmed by @herman925 (2026-05-06).

Upgrade

/plugin marketplace update gsd-plugin
/plugin install gsd@gsd-plugin
/reload-plugins

After upgrade, if you'd previously kept get-shit-done-cc installed for the plugin's sake, you can now safely:

npm uninstall -g get-shit-done-cc

…and the bundled gsd-sdk will take over. Verify with which gsd-sdk (should resolve to the plugin cache bin/) and gsd-sdk --version (should print 1.50.0-canary.0 or later).

---

Full changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2420---2026-05-07
Issue: #4

v2.41.1 - README fix: keep get-shit-done-cc installed (#4)

Documentation hotfix. Corrects a README instruction that broke /gsd:* commands for migrating users (and that left fresh installs without the prerequisite they need).

Fixed

• README.md — Manual migration §2 (#4) — earlier versions told users to npm uninstall -g get-shit-done-cc. That package ships the gsd-sdk binary the plugin's workflows shell out to in 500+ places, so removing it broke every /gsd:* command. §2 now tells users to keep the package installed, with a "this README used to be wrong" callout that links to the issue.
• README.md — new Prerequisites subsection — added before Installation Step 1, with the exact npm install -g get-shit-done-cc command and a which gsd-sdk / gsd-sdk --version verification snippet. Closes the same gap for fresh installs.

Credits

• Reported by @ThomasHezard (#4, 2026-04-28) with a Claude-on-behalf-of-user investigation that pinpointed the contradicting line numbers and counted the gsd-sdk ref footprint.
• Confirmed independently by @herman925 (2026-05-06).

Long-term plan

Route the workflow scripts through the plugin's own MCP server (or a bundled SDK shim) so gsd-sdk is no longer a separate prerequisite. Tracked at #4 and remains open.

Upgrade

Pull master or wait for /plugin marketplace update gsd-plugin to surface 2.41.1, then run /reload-plugins. No behavior change vs 2.41.0 — only README wording changes — but if you'd previously run the bad npm uninstall step, run npm install -g get-shit-done-cc to put gsd-sdk back on PATH.

v2.41.0 - Upstream sync + MVP-phase workflow

Upstream minor sync to GSD 1.41.0 (released 2026-05-07). Plugin-only patches in bin/lib/core.cjs (CLAUDE_PLUGIN_ROOT path resolution helpers resolveGsdRoot / resolveGsdDataDir / resolveGsdAsset + agent-dir override getAgentsDir reading GSD_AGENTS_DIR) preserved via 3-way merge. bin/gsd-tools.cjs untouched upstream this cycle.

Headline

/gsd:mvp-phase — new MVP-mode phase command. Vertical-slice planning: prompts for an "As a / I want to / So that" user story, runs SPIDR splitting, writes the result to ROADMAP.md, then delegates to /gsd:plan-phase. Plan-phase auto-detects MVP via the new mode: roadmap field and routes to TDD execution + UAT verification.

Added

• /gsd:mvp-phase workflow — vertical-slice MVP planning + TDD execution + UAT verification.
• 8 new references powering MVP/SPIDR/user-story/worktree-path-safety guidance: mvp-concepts, planner-mvp-mode, execute-mvp-tdd, verify-mvp-mode, spidr-splitting, skeleton-template, user-story-template, worktree-path-safety.
• 3 new workflow bodies for existing skills: workflows/add-backlog.md, workflows/debug.md, workflows/thread.md.
• bin/lib/runtime-homes.cjs — runtime-aware globalSkillsBase resolution (replaces hardcoded path, upstream #3126).
• 7 agent-prompt updates: gsd-codebase-mapper, gsd-debug-session-manager, gsd-executor, gsd-plan-checker, gsd-planner, gsd-roadmapper, gsd-verifier.

Changed

• Version bump — plugin 2.40.2 → 2.41.0 per plugin_minor = upstream_minor versioning.
• workflows/extract_learnings.md renamed to workflows/extract-learnings.md (snake → kebab; git history preserved via git mv).
• 33 top-level workflows refreshed + 3 nested workflow files. Notable: quick.md (history-based resurrection guard), plan-phase.md (removed stale OpenCode agent: directive #3156), execute-phase.md + sub-step files (cwd-drift sentinel + absolute-path guard #3097/#3099).
• 12 bin/lib/ modules refreshed wholesale.
• templates/README.md updated.

Fixed

• Upstream bug fixes flowing through automatically: milestone version-resolution (#3109), STATE narrative-tail normalization (#3122), roadmap.cjs plan-count for nested layout (#3128), state.begin-phase idempotency (#3127), workflow contract validation (#3151), and statusline numeric-100 / next_phases parsing (#3154).

Plugin patches preserved

• bin/lib/core.cjs — resolveGsdRoot / resolveGsdDataDir / resolveGsdAsset + the patched getAgentsDir reading GSD_AGENTS_DIR (carried into 1.41.0 for the first time).
• bin/gsd-tools.cjs — migrate / write-phase-memory / checkpoint / hook cases (upstream untouched this cycle, plugin patches verified intact).

Carries forward from v2.40.2

• MCP stdio framing fix (#3) — claude mcp list reports gsd: ✓ Connected. Fix authored by @Sovereigntymind, confirmed by @jesse-smith.
• CI regression test for the MCP transport at tests/mcp-stdio-framing.test.cjs, wired into the Check drift GitHub Actions workflow.

Upgrade

Pull master or wait for /gsd:update to surface 2.41.0, then run /reload-plugins inside Claude Code.

---

Full upstream changelog: https://github.com/gsd-build/get-shit-done/releases/tag/v1.41.0
Plugin changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2410---2026-05-07

v2.40.2 - MCP stdio framing hotfix

Hotfix restoring the bundled MCP server's stdio transport so claude mcp list reports gsd: ✓ Connected and the eight gsd_* MCP tools become reachable.

Fixed

• mcp/server.cjs (#3) — switched the stdio transport to newline-delimited JSON, which is what the MCP spec and current Claude Code MCP clients send and expect. The previous LSP-style Content-Length: framing silently dropped every request: the reader required \r\n\r\n that ndjson never produces, and the writer emitted headers ndjson clients won't parse as a response boundary. Reader now tries ndjson first and falls back to Content-Length framing only when a complete LSP header block arrives before the next newline (safe for any legacy transport still emitting it).

Verified locally: initialize returns 176 bytes, tools/list returns all 8 tools.

Credits

Reported and patched by @Sovereigntymind — the project's first external contributor! — and confirmed on macOS / 2.40.1 by @jesse-smith. The fix is the contributor's tested patch applied verbatim, with the LSP path kept as a fallback rather than removed.

Notes

Slash commands were unaffected by this bug because they read `.planning/` files directly and don't go through the MCP server.

Upgrade

Pull `master` or wait for `/gsd:update` to surface 2.40.2, then run `/reload-plugins` inside Claude Code.

---

Full changelog: https://github.com/jnuyens/gsd-plugin/blob/master/CHANGELOG.md#2402---2026-05-07
Commit: 5dec8d2

v2.40.1 — agents-dir false-positive fix

Hotfix release. Suppresses a false-positive GSD subagents are not installed warning that appeared after `/gsd:new-project` and `/gsd:new-milestone` for plugin users.

What broke

`gsd-sdk` reported `agents_installed: false` even though the plugin bundles all 18 expected agents. The workflow templates in `new-project.md` / `new-milestone.md` then surfaced an install-instruction warning recommending `npx get-shit-done-cc@latest --global` — which the plugin's `migrations/legacy-cleanup.cjs::autoMigrate` would just undo on the next session start. Confusing and circular.

Root cause

`bin/lib/core.cjs::getAgentsDir()` uses `__dirname/../../../agents` traversal that assumes upstream's `/get-shit-done/bin/lib/` layout. The plugin flattens that — its `bin/lib/` is one level shallower, so the traversal lands one level too high and `checkAgentsInstalled()` returns false-negative.

Fixes

1. `bin/lib/core.cjs:getAgentsDir()` — patched to prefer `path.join(resolveGsdRoot(), 'agents')` when that directory exists. Joins the existing `resolveGsdRoot` / `resolveGsdDataDir` / `resolveGsdAsset` plugin-patch family.
2. `workflows/new-project.md` + `workflows/new-milestone.md` — warning gate now overrides `agents_installed=true` when `$CLAUDE_PLUGIN_ROOT/agents/gsd-planner.md` exists. Fallback warning text amended to clarify plugin users can ignore it.
3. `workflows/quick.md` — exports `GSD_AGENTS_DIR=$CLAUDE_PLUGIN_ROOT/agents` before the `gsd-sdk query init.quick` call so the SDK's bundled (un-patched) `core.cjs` finds the plugin's agents.

All four patches tagged inline with `[PLUGIN PATCH]` / `#PLUGIN-AGENTS-DIR` markers.

Caveat

Standalone `gsd-sdk` invocations outside the plugin's workflows still report the false-negative, because the SDK ships its own bundled `core.cjs` from the npx cache. The proper fix is upstream — to land in a future `get-shit-done-cc` release.

Full Changelog: v2.40.0...v2.40.1

v2.39.1

Full Changelog: v2.39.0...v2.39.1