feat(sdk): golden parity harness and query handler CJS alignment (#2302 Track A) (#2341)

* feat(sdk): golden parity harness and query handler CJS alignment (#2302 Track A)

Golden/read-only parity tests and registry alignment, query handler fixes
(check-completion, state-mutation, commit, validate, summary, etc.), and
WAITING.json dual-write for .gsd/.planning readers.

Refs gsd-build/get-shit-done#2341

* fix(sdk): getMilestoneInfo matches GSD ROADMAP (🟡, last bold, STATE fallback)

- Recognize in-flight 🟡 milestone bullets like 🚧.
- Derive from last **vX.Y Title** before ## Phases when emoji absent.
- Fall back to STATE.md milestone when ROADMAP is missing; use last bare vX.Y
  in cleaned text instead of first (avoids v1.0 from shipped list).
- Fixes init.execute-phase milestone_version and buildStateFrontmatter after
  state.begin-phase (syncStateFrontmatter).

* feat(sdk): phase list, plan task structure, requirements extract handlers

- Register phase.list-plans, phase.list-artifacts, plan.task-structure,
  requirements.extract-from-plans (SDK-only; golden-policy exceptions).
- Add unit tests; document in QUERY-HANDLERS.md.
- writeProfile: honor --output, render dimensions, return profile_path and dimensions_scored.

* feat(sdk): centralize getGsdAgentsDir in query helpers

Extract agent directory resolution to helpers (GSD_AGENTS_DIR, primary
~/.claude/agents, legacy path). Use from init and docs-init init bundles.

docs(15): add 15-CONTEXT for autonomous phase-15 run.

* feat(sdk): query CLI CJS fallback and session correlation

- createRegistry(eventStream, sessionId) threads correlation into mutation events
- gsd-sdk query falls back to gsd-tools.cjs when no native handler matches
  (disable with GSD_QUERY_FALLBACK=off); stderr bridge warnings
- Export createRegistry from @gsd-build/sdk; add sdk/README.md
- Update QUERY-HANDLERS.md and registry module docs for fallback + sessionId
- Agents: prefer node dist/cli.js query over cat/grep for STATE and plans

* fix(sdk): init phase_found parity, docs-init agents path, state field extract

- Normalize findPhase not-found to null before roadmap fallback (matches findPhaseInternal)

- docs-init: use detectRuntime + resolveAgentsDir for checkAgentsInstalled

- state.cjs stateExtractField: horizontal whitespace only after colon (YAML progress guard)

- Tests: commit_docs default true; config-get golden uses temp config; golden integration green

Refs: #2302

* refactor(sdk): share SessionJsonlRecord in profile-extract-messages

CodeRabbit nit: dedupe JSONL record shape for isGenuineUserMessage and streamExtractMessages.

* fix(sdk): address CodeRabbit major threads (paths, gates, audit, verify)

- Resolve @file: and CLI JSON indirection relative to projectDir; guard empty normalized query command

- plan.task-structure + intel extract/patch-meta: resolvePathUnderProject containment

- check.config-gates: safe string booleans; plan_checker alias precedence over plan_check default

- state.validate/sync: phaseTokenMatches + comparePhaseNum ordering

- verify.schema-drift: token match phase dirs; files_modified from parsed frontmatter

- audit-open: has_scan_errors, unreadable rows, human report when scans fail

- requirements PLANNED key PLAN for root PLAN.md; gsd-tools timeout note

- ingest-docs: repo-root path containment; classifier output slug-hash

Golden parity test strips has_scan_errors until CJS adds field.

* fix: Resolve CodeRabbit security and quality findings
- Secure intel.ts and cli.ts against path traversal
- Catch and validate git add status in commit.ts
- Expand roadmap milestone marker extraction
- Fix parsing array-of-objects in frontmatter YAML
- Fix unhandled config evaluations
- Improve coverage test parity mapping

* test: raise planner character extraction limit to 48K

* fix(sdk): resolve TS build error in docs-init passing config

sdk/src/gsd-tools.ts

@@ -77,7 +77,7 @@ function formatRegistryRawStdout(matchedCmd: string, data: unknown): string {
 
   if (matchedCmd === 'config-set') {
     const d = data as Record<string, unknown>;
-    if (d.set === true && d.key !== undefined) {
+    if ((d.updated === true || d.set === true) && d.key !== undefined) {
       const v = d.value;
       if (v === null || v === undefined) {
         return `${d.key}=`;
@@ -117,6 +117,8 @@ export class GSDTools {
     workstream?: string;
     /** When set, mutation handlers emit the same events as `gsd-sdk query`. */
     eventStream?: GSDEventStream;
+    /** Correlation id for mutation events when `eventStream` is set. */
+    sessionId?: string;
     /**
      * When true (default), route known commands through the SDK query registry.
      * Set false in tests that substitute a mock `gsdToolsPath` script.
@@ -129,7 +131,7 @@ export class GSDTools {
     this.timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     this.workstream = opts.workstream;
     this.preferNativeQuery = opts.preferNativeQuery ?? true;
-    this.registry = createRegistry(opts.eventStream);
+    this.registry = createRegistry(opts.eventStream, opts.sessionId);
   }
 
   private shouldUseNativeQuery(): boolean {
@@ -188,6 +190,8 @@ export class GSDTools {
       }, this.timeoutMs);
     });
     try {
+      // Promise.race rejects when the timeout fires but does not cancel the handler promise;
+      // native handlers may still run to completion (unlike subprocess + execFile timeout).
       return await Promise.race([work, timeoutPromise]);
     } finally {
       if (timeoutId !== undefined) {
@@ -545,6 +549,34 @@ export class GSDTools {
   }
 }
 
+/**
+ * Run `gsd-sdk query` semantics in-process: normalize argv, resolve registry, dispatch.
+ * Returns handler JSON payload (same as stdout from the `gsd-sdk query` CLI without `--pick`).
+ */
+export async function runGsdToolsQuery(projectDir: string, queryArgv: string[]): Promise<unknown> {
+  const { createRegistry } = await import('./query/index.js');
+  const { resolveQueryArgv } = await import('./query/registry.js');
+  const { normalizeQueryCommand } = await import('./query/normalize-query-command.js');
+  const { GSDError, ErrorClassification } = await import('./errors.js');
+
+  if (queryArgv.length === 0 || !queryArgv[0]) {
+    throw new GSDError('runGsdToolsQuery requires a command', ErrorClassification.Validation);
+  }
+  const queryCommand = queryArgv[0];
+  const [normCmd, normArgs] = normalizeQueryCommand(queryCommand, queryArgv.slice(1));
+  const registry = createRegistry();
+  const tokens = [normCmd, ...normArgs];
+  const matched = resolveQueryArgv(tokens, registry);
+  if (!matched) {
+    throw new GSDError(
+      `Unknown command: "${tokens.join(' ')}". No native handler registered.`,
+      ErrorClassification.Validation,
+    );
+  }
+  const result = await registry.dispatch(matched.cmd, matched.args, projectDir);
+  return result.data;
+}
+
 // ─── Path resolution ────────────────────────────────────────────────────────
 
 /**