v1.42.3 Release Notes
Hotfix release. Published to npm under the latest tag.
npx get-shit-done-cc@latestWhat's in this release
1.42.3 is a stability hotfix on top of 1.42.2. The headline is Codex CLI 0.130.0 install routability — after npx get-shit-done-cc@latest --codex, $gsd-* skills now resolve correctly under Codex 0.130.0 and later, where the previous build left users with zero routable entrypoints. The release also ships runtime-aware slash formatting so emitted commands match the install's routing shape (Claude → /gsd-*, Codex → $gsd-*) instead of the deprecated colon form, an argv-based subprocess fix for check.ship-ready that closes a shell-injection class through git refnames, the phase_status field on init.plan-phase that gates /gsd:plan-phase on closed phases, plus correctness fixes for archived-phase warnings, future-phase warnings, canonical Codex hooks, and the SDK bridge load path.
Fixed
Codex CLI 0.130.0 install now materializes routable skills —
bin/install.jswrites~/.codex/skills/gsd-<name>/SKILL.mdfor every shipped command so$gsd-*skills resolve after install. Codex 0.130.0 dropped the extra-skills-roots discovery the previous build relied on, leaving users with a successful-looking install and zero usable commands. Documented minimum Codex CLI version (0.130.0) inline in the Codex sections ofUSER-GUIDE.mdandCONFIGURATION.md. (#3562, #3582)Runtime-aware slash formatter for user-facing emissions —
runtime-slash.cjsproduces/gsd-<cmd>for skills-based runtimes (Claude, Cursor, OpenCode, Kilo, etc.) and$gsd-<cmd>for Codex. The deprecated colon form/gsd:<cmd>is no longer emitted at runtime, so the recommendations frominit,phase,verify,milestone,validate-command-router,workstream,profile-output,drift,gsd2-import, andcommandsnow paste cleanly into the active runtime. (#3584)Argv-based subprocess for
check.ship-ready— every git/gh probe insdk/src/query/check-ship-ready.tsnow usesexecFileSyncwith an argv array instead ofexecSyncwith shell-interpolated strings. Closes a shell-injection class where a malicious branch name (e.g.foo;touch INJ;bar) interpolated intogit config --get branch.<name>.mergetriggered arbitrary code execution. (#3587)init.plan-phasesurfacesphase_status;/gsd:plan-phasegates on closed phases —init.plan-phasepayload now carries the authoritative phase status (Pending/Planned/Executed/Complete) fromdeterminePhaseStatus. The plan-phase workflow short-circuits onComplete(with--forceoverride), and--reviewsagainst a closed phase hard-errors with no override. Prevents accidental re-planning over shipped code. (#3569)Canonical
[features].hooksfor Codex configs, legacy alias recognized — Codex config emission uses the canonicalfeatures.hookskey while still accepting the legacycodex_hooksshape on read. Fixes the install where the previous key drift left Codex unable to find managed hooks. (#3566)SDK bridge loads via the public package export — fixes a stale internal path that broke SDK dispatch after install on some package layouts. (#3567)
W006/W007 health warnings skip archived and future phases —
/gsd:healthno longer flags phases that are intentionally unimplemented (future) or archived as missing-on-disk or missing-from-roadmap. (#3559, #3560)Ultraplan runtime gates on Claude Code markers —
/gsd:ultraplandetects the runtime via Claude Code markers and fails closed when the version is unavailable, instead of running against an unknown runtime. (#3561)Padded phase IDs match unpadded ROADMAP prose — phase routing through
phaseMarkdownRegexSourcehandles02.7↔2.7and similar padding mismatches so/gsd:phase complete 02updates a ROADMAP that uses the short### Phase 2:form. (#3537)W007 ignores archived phase directories — phases under
.planning/milestones/v*/no longer trigger "exists on disk but not in roadmap" warnings against the active roadmap. (#3560)Prompt-user migration actions resolve in non-TTY runs —
installer-migration-authoringflows complete cleanly under CI / non-interactive shells; error grouping clarified. (#3541)Executor agents forbidden from
git stash— execution agents no longer use shared stash storage, which violated worktree isolation when multiple agents ran in parallel. (#3542)Configuration manifests load from the installed payload —
configuration.generated.cjslooks in the installedget-shit-done/bin/shared/path first, then falls back to source-checkoutsdk/shared/. Fixes the install where the manifest loader failed on the runtime layout because the source-tree path doesn't exist after install. (#3571)
What was in 1.42.1
RELEASE-v1.42.1.md — package legitimacy gate against slopsquatting, skill-surface budgeting (--profile=core / standard / full), installer migration framework, configurable /gsd-ship PR body sections, review.default_reviewers, optional fallow structural review, structured --json-errors CLI mode, plus 30+ correctness fixes across project_code phase prefixes, phase completion idempotency, nested git detection, Codex install migration, SDK install readiness, and decimal-phase dependencies.
Installing
# npm (global)
npm install -g get-shit-done-cc@latest
# npx (one-shot)
npx get-shit-done-cc@latest
# Pin to this exact version
npm install -g get-shit-done-cc@1.42.3The installer is idempotent — re-running on an existing install updates in-place, preserving your .planning/ directory and local patches.
Codex CLI requirement
Codex installs (--codex) require Codex CLI 0.130.0 or later. Earlier Codex versions used a discovery mechanism that the current install layout does not target; upgrade Codex first, then re-run the GSD installer.