Install
This pre-release is published to npm under the next dist-tag.
npm i @opengsd/gsd-core@1.4.0-rc.1
# or
npm i @opengsd/gsd-core@nextWhat's Changed
Feature
- feat(#656): Research module — content-addressed cache + provider seam + registry-API legitimacy by @trek-e in #664
- feat(#717): re-base workflow size budget on bytes + document quality rationale by @trek-e in #719
- feat(#159): auto-use existing RESEARCH.md in /gsd:plan-phase --research-phase by @trek-e in #718
- feat(#703): add --granularity override flag to /gsd:plan-phase by @trek-e in #750
- feat(#25): scope gsd-verifier Step 7b to enumerate-or-single-test; forbid full-suite re-runs by @trek-e in #753
- feat(#52): add agent_skills_security.trusted_global_roots allowlist for global skills by @trek-e in #754
Enhancement
- docs: promote README/branding fixes from next to main by @trek-e in #540
- [codex] docs: promote README version cleanup to main by @jeremymcs in #545
- docs(#546): promote changelog update to main by @jeremymcs in #548
- chore: merge release v1.3.0 to main by @trek-e in #662
- chore: back-merge main into next after v1.3.0 release by @trek-e in #671
- chore(#660): bump next to 1.3.1-dev.0 (-dev stream per ADR 660) by @trek-e in #672
- ci(#660): scoped GSD_BOT_PR_TOKEN for backmerge & release merge-back PR creation by @trek-e in #673
- chore: merge hotfix v1.3.1 back to main by @trek-e in #681
- chore: back-merge main (v1.3.1 hotfix) to next + hono advisory bump by @trek-e in #682
- chore: back-merge main → next (051588f, #690 CHANGELOG fast-track) by @trek-e in #697
- chore: back-merge main → next (3e0578a) by @trek-e in #701
- chore(release): archive 463 shipped changeset fragments before wiring render (#690 follow-up) by @trek-e in #714
- chore(release): wire CHANGELOG render into release finalize job (#690 follow-up) by @trek-e in #715
- docs(#695): document --only and --text flags for /gsd-autonomous by @trek-e in #716
- chore: clean up clear-cut ESLint warnings (#732) by @trek-e in #734
- chore(lint): justify intentional no-control-regex (ANSI strip) + ratchet to error by @trek-e in #737
- chore(lint): eliminate magic-sleep test warnings + ratchet rules to error by @trek-e in #735
- refactor(scripts): replace process.exit() with ExitError + runMain handler (part 1 of #738) by @trek-e in #740
- refactor(bin): replace process.exit() in CLI entrypoints + ratchet n/no-process-exit to error (part 2 of #738) by @trek-e in #741
- refactor(#720): lazy-load MVP-only reference bodies on non-MVP runs by @trek-e in #746
- refactor(#712): replace Codex slash-command denylist lookbehind with positive-boundary match by @trek-e in #747
- refactor(#651): consolidate verification-status routing into one queryable seam by @trek-e in #755
Fix
- fix(#663): resolve open CodeQL/Dependabot security alerts (ReDoS, prototype pollution, workflow perms, qs DoS) by @trek-e in #665
- fix: accept published installer migration checksums by @Solvely-Colin in #674
- fix(#670): tolerate installer-migration checksum drift on upgrade by @trek-e in #675
- fix(#676): consolidate hotfix into release.yml (delete standalone hotfix workflow) by @trek-e in #678
- fix(#676): update tests/docs referencing deleted hotfix.yml by @trek-e in #680
- fix(#690): promote CHANGELOG 1.3.x + gate release-notes promotion by @trek-e in #694
- fix(#690): backfill CHANGELOG 1.3.x on main for /gsd:update preview by @trek-e in #696
- fix(#698): make auto-backmerge main→next actually land (admin-merge via PAT) by @trek-e in #699
- fix(#698): sync main's auto-backmerge.yml to next (hardened admin-merge + scoped PAT) by @trek-e in #700
- fix(#637): route 3 more workflows through gsd_run launcher (hardcoded $HOME sweep) by @jslitzkerttcu in #642
- fix(#705): route hardcoded $HOME gsd-tools invocations in agents/commands through gsd_run by @trek-e in #707
- fix(#685): set windowsHide on all Windows child-process spawns by @trek-e in #688
- fix(#687): cap agy -p with a hard wall-clock timeout (no indefinite hang) by @trek-e in #689
- fix(#669): /gsd-review --cursor actually invokes cursor-agent by @trek-e in #686
- fix(#704): exclude } and ) from Codex path-rewrite lookbehind (no literal $gsd-core in installs) by @trek-e in #710
- fix(#706): skip rescue of already-committed SUMMARY to avoid worktree cleanup merge_failed by @trek-e in #709
- fix(#730): scope current-milestone Phase Details section in roadmap parser by @trek-e in #748
- fix(#683): auto-degrade phase execution to sequential on worktree base mismatch by @trek-e in #749
- fix(#751): recognise config-set prototype-pollution guard in CodeQL + test dynamic-key vectors by @trek-e in #752
Full Changelog: v1.3.1...v1.4.0-rc.1