get-shit-done

mirror of https://github.com/glittercowboy/get-shit-done synced 2026-04-25 17:25:23 +02:00

Files

Tom Boucher 259c1d07d3 fix(#2647 ): guard tarball ships sdk/dist so gsd-sdk query works (#2671 )

v1.38.3 shipped without sdk/dist/ because the outer `files` whitelist
and `prepublishOnly` chain had drifted. The `gsd-sdk` bin shim then
fell through to a stale @gsd-build/sdk@0.1.0 (pre-`query`), breaking
every workflow that called `gsd-sdk query <noun>` on fresh installs.

Current package.json already restores `sdk/dist` + `build:sdk`
prepublish; this PR locks the fix in with:

- tests/bug-2647-outer-tarball-sdk-dist.test.cjs — asserts `files`
  includes `sdk/dist`, `prepublishOnly` invokes `build:sdk`, the
  shim resolves sdk/dist/cli.js, `npm pack --dry-run` lists
  sdk/dist/cli.js, and the built CLI exposes a `query` subcommand.
- scripts/verify-tarball-sdk-dist.sh — packs, extracts, installs
  prod deps, and runs `node sdk/dist/cli.js query --help` against
  the real tarball output.
- .github/workflows/release.yml — runs the verify script in both
  next and stable release jobs before `npm publish`.

Partial fix for #2649 (same root cause on the sibling sdk package).

Fixes #2647

2026-04-24 18:05:18 -04:00

base64-scan.sh

ci(security): add prompt injection, base64, and secret scanning

2026-03-24 13:23:51 -04:00

build-hooks.js

fix(build): include gsd-read-injection-scanner in hooks/dist (#2406 )

2026-04-18 08:42:36 -05:00

fix-slash-commands.cjs

fix(#2543 ): replace legacy /gsd-<cmd> syntax with /gsd:<cmd> across all source files (#2595 )

2026-04-22 12:04:25 -04:00

gen-inventory-manifest.cjs

docs: close doc drift vectors — bidirectional parity, manifest, schema-driven config (#2479 )