📢 Welcome to GSD-Core — why the fork, what changed, what's next

[trek-e]

📢 Welcome to GSD-Core — why the fork, what changed, what's next

This repository (open-gsd/gsd-core) is a community-maintained continuation of the work originally published at [gsd-build/get-shit-done`](https://github.com/gsd-build/get-shit-done) by TÂCHES.

Why the fork exists

The upstream repo appears compromised or abandoned. I have no inside information beyond what's publicly visible — I'm stating what I can confirm and what I can't, deliberately, so you can evaluate yourself.

What I can confirm:

• 🔇 No contact with the original maintainer (TÂCHES) since 2026-04-01 (~7 weeks of silence as of this writing).
• 🚫 TÂCHES social accounts appear deleted or unreachable.
• 💸 The $GSD token associated with the project has been publicly linked to a rug-pull.
• ⚠️ The upstream repo at gsd-build/get-shit-done continues to exist, but with the maintainer unreachable.

What I cannot confirm:

• Whether the original maintainer is safe.
• Whether the TÂCHES GitHub account itself is under their control.
• Whether the rug-pull was the maintainer's action, a co-founder exit, or an account takeover.

Absence of news is not evidence either way. That's why this notice exists.

What I did

In a single migration pass on 2026-05-22:

	Count	Status
Code: branches mirrored	394	✓
Code: tags mirrored	229	✓
Labels replicated	84	✓
Open milestones replicated	1	✓
Open issues recreated (with link back)	77	✓
Open PRs recreated (with link back)	17	✓
Fork-origin PRs filed as tracking issues	9	✓
Original repo: items closed + locked with redirect	103	✓
Original repo: README banner + auto-close enforcement	live	✓

The original repo now has a top-of-README warning, a redirect on the New Issue picker, and an Actions workflow that auto-closes + locks anything filed there going forward.

What changed (for users)

	Before	After
GitHub	gsd-build/get-shit-done	open-gsd/gsd-core
npm (main)	get-shit-done-cc	get-shit-done-redux
npm (sdk)	@gsd-build/sdk	@gsd-redux/sdk
Issue / PR numbers	source numbering	renumbered; each item links back to original via [from gsd-build/get-shit-done#N]
$GSD token references	in README badges	removed — the token is a rug-pull, not a project asset
@gsd_foundation social	in README badges	removed — accounts gone
Discord	in README badges	kept (may still be valid; community-run)

What did NOT change

• The code itself — every commit, branch, and tag is preserved bit-for-bit.
• The MIT license.
• The contributors — every commit attribution is intact.
• CHANGELOG.md and .changeset/* — historical entries point at original issue/PR numbers on the old repo, since renumbering would silently corrupt those links.

What I want from you

• If you maintain a downstream fork or integration: plan a cut-over to the new npm package names. Old packages won't get updates.
• If you can reach the original maintainer: please do, and CC me on an issue here.
• If you have technical evidence (on-chain, social, infrastructure) that materially changes the picture above, please open an issue here so others can evaluate.
• If you had an open PR against the upstream from your own fork (we couldn't auto-recreate those — branches live in your fork, not ours): see the tracking issues #96–#104 and re-file when you're ready.
• If you want to keep using GSD as a tool: install the new packages and continue. Aside from the package names and the missing $GSD token badge, it's the same project.

What I will do

• Maintain the code here, accept contributions, and continue publishing releases under the new package names.
• Keep this announcement updated if material new information surfaces about the original project, the maintainer, or the $GSD token.
• If the original maintainer resurfaces and the upstream repo + npm tokens are demonstrably under safe control, I'll reconsider how to converge — but until that happens, this is the active home.

— trek-e, fork maintainer (not the original author)

[jnuyens]

Plugin maintainer here. jnuyens/gsd-plugin (the Claude Code plugin packaging of GSD) just shipped v2.43.6 with upstream pointers retargeted to open-gsd/get-shit-done-redux. Thanks for the careful migration setup: bit-for-bit mirror, honest "what I can / cannot confirm" framing, full PR/issue carry-over with cross-references, and even an immediate independent take on #3785 with collision detection. Appreciate the work, glad to be aboard.

(The plugin still ships on top of v1.42.3, so the upstream switch is currently pointer-only; the first redux-based sync will bring in #88 natively.)

[nabki]

Thanks for the thorough answer, that makes sense. It's an interesting plugin, and I'd love to see it get more usage!

[rpgdev]

Bro your plugin sounds like a GODSEND. Didn't know about it. Did you publicize it anywhere (subreddit etc)? Please link me to it.

[JohnieLee]

I would encourage that we move the plugin into open-gsd. With the amount of access granted to this, we need to ensure that it is maintained by a group of people to give it more credibility.

GSD and GSD Plugins are being used by large enterprises. I will imagine that internal security teams will start locking these down because of this incident.

[Omee11]

Agree with Johnie here. +1 for the plugin to be merged into this repo. Yes they are seperate scopes but plenty of other projects have multiple install methods, cli, plugin etc.

[JohnieLee]

Note: It doesn't need to be in THIS repo. You can have it as a separate repo under the open-gsd account to give it more credibility.
If you go down this route, I'd suggest you do it quickly as I'm sure multiple enterprise security teams are reviewing this right now and it would be better to do it all at once rather than piecemeal.

[jnuyens]

Quick follow-up data point from the downstream side. Did a structured comparison of redux main vs the v1.42.3 commit the plugin currently tracks, just to scope the next sync cycle. Findings: docs/upstream-sync/260522-redux-comparison.md.

Two observations that may be useful for the migration:

1. Tag preservation: redux currently has only one tag ref (v1.0.0) despite the announcement table line saying "229 tags mirrored". The underlying commit objects survive (e.g. the v1.42.3 commit 7dfeb7ad still resolves by SHA in the redux repo) but tag refs don't. Plausibly intentional (clean break from gsd-build's 1.42.x numbering), but flagging in case downstream tooling that pins to upstream tags will need different anchors.
2. behind_by: 41 explained: anyone running gh api .../compare/v1.42.3-sha...main will see this stat and might worry. We checked, and those 41 commits are orphaned objects from the pre-rebase post-v1.42.3 chain (e.g. 2fd93736 "chore: bump version to 1.42.3 for hotfix"). Same content, rebased onto a clean line. Not a fidelity problem, just unintuitive.

Nothing actionable from our side, just sharing data in case it's useful. Plugin sync timing is open-ended; we'll likely wait for the first real redux release before cutting over.

[trek-e]

honestly, a lot of today was 'oh shit, think fast' reaction to what happened. We decided to revert to 1.0 since it is a new project. I don't know if you want to create the plugin as a new 'v1.0' connection and abandon the other project or what, we're still trying to figure it out. a lot of frantic typing and coding and 'hey what do we call it'. I may end up renaming the project and drop the redux name because that was the early morning pre-coffee just woke up to find world on fire reaction until we came up with open-gsd.

Still have a lot to figure out.

[jnuyens]

I understand. Good time to reflect, reassess and decide. I use gsd-plugin every day, so I plan on keeping maintaining it. I still see possible improvements ahead too. But I understand that there are also considerations like: is the 'gsd name' now burned or not. The old project had +65k stars and massive media attention. I still like the name, but on the other hand what matters most is the functionality. I don't know if you noticed that I made a logo for the GSD plugin? Feel free to reach out when panic mode is over :)

[Niraj-Kamdar]

Are upstream packages on npm safe or any release compromised?

[jnuyens]

No. The fork was made to ensure that wouldn't happen seen the shady actions by the original maintainer (crypto rug pull and no communication for over a month).

[j2h4u]

@trek-e thanks Tom!

[rpgdev]

How can I fully remove the old one? The readme has been changed and I can't find the reference now.

[trek-e]

if installed with npm

npm uninstall -g get-shit-done-cc
npm uninstall -g @/gsd-build/sdk

if installed with npx (as folke user _FreeThinker mentioned here)

npx get-shit-done-cc --uninstall --global

Or, depending on your installation (local installation):
npx get-shit-done-cc --uninstall --local

Also, I recommend checking the ~/.npm/_npx/ directory and clearing it out. You should also look inside your .claude folder and delete any gsd folders that aren't Markdown files.

[bxw91]

I have used Gemini CLI, pointed to this url and said to remove GSD from system. then prompted to do system sweep again to find all traces of GSD (there were some because I had GSD in other tools too).

[jonvickers]

I think we need to write a real prompt with steps in my other thread to be more clear to people

[sjnims]

@trek-e Thank you!

[DivineStudio]

In-depth guide for uninstalling the obsolete, original GSD and how to install the new Open-GSD projects:
#433

[marcfargas]

The pinned top post references github org gsd-redux which aparently is now open-gsd, if so please edit to avoid confusion :)

[apklein]

if I uninstalled gsd v1... installed gsd redux. Do I have to uninstall redux and then install gsd-core?

[trek-e]

I have deprecated the original package, no need to uninstall, can just install the new version over it.