feat(sdk): golden parity harness and query handler CJS alignment (#2302 Track A) (#2341)

* feat(sdk): golden parity harness and query handler CJS alignment (#2302 Track A)

Golden/read-only parity tests and registry alignment, query handler fixes
(check-completion, state-mutation, commit, validate, summary, etc.), and
WAITING.json dual-write for .gsd/.planning readers.

Refs gsd-build/get-shit-done#2341

* fix(sdk): getMilestoneInfo matches GSD ROADMAP (🟡, last bold, STATE fallback)

- Recognize in-flight 🟡 milestone bullets like 🚧.
- Derive from last **vX.Y Title** before ## Phases when emoji absent.
- Fall back to STATE.md milestone when ROADMAP is missing; use last bare vX.Y
  in cleaned text instead of first (avoids v1.0 from shipped list).
- Fixes init.execute-phase milestone_version and buildStateFrontmatter after
  state.begin-phase (syncStateFrontmatter).

* feat(sdk): phase list, plan task structure, requirements extract handlers

- Register phase.list-plans, phase.list-artifacts, plan.task-structure,
  requirements.extract-from-plans (SDK-only; golden-policy exceptions).
- Add unit tests; document in QUERY-HANDLERS.md.
- writeProfile: honor --output, render dimensions, return profile_path and dimensions_scored.

* feat(sdk): centralize getGsdAgentsDir in query helpers

Extract agent directory resolution to helpers (GSD_AGENTS_DIR, primary
~/.claude/agents, legacy path). Use from init and docs-init init bundles.

docs(15): add 15-CONTEXT for autonomous phase-15 run.

* feat(sdk): query CLI CJS fallback and session correlation

- createRegistry(eventStream, sessionId) threads correlation into mutation events
- gsd-sdk query falls back to gsd-tools.cjs when no native handler matches
  (disable with GSD_QUERY_FALLBACK=off); stderr bridge warnings
- Export createRegistry from @gsd-build/sdk; add sdk/README.md
- Update QUERY-HANDLERS.md and registry module docs for fallback + sessionId
- Agents: prefer node dist/cli.js query over cat/grep for STATE and plans

* fix(sdk): init phase_found parity, docs-init agents path, state field extract

- Normalize findPhase not-found to null before roadmap fallback (matches findPhaseInternal)

- docs-init: use detectRuntime + resolveAgentsDir for checkAgentsInstalled

- state.cjs stateExtractField: horizontal whitespace only after colon (YAML progress guard)

- Tests: commit_docs default true; config-get golden uses temp config; golden integration green

Refs: #2302

* refactor(sdk): share SessionJsonlRecord in profile-extract-messages

CodeRabbit nit: dedupe JSONL record shape for isGenuineUserMessage and streamExtractMessages.

* fix(sdk): address CodeRabbit major threads (paths, gates, audit, verify)

- Resolve @file: and CLI JSON indirection relative to projectDir; guard empty normalized query command

- plan.task-structure + intel extract/patch-meta: resolvePathUnderProject containment

- check.config-gates: safe string booleans; plan_checker alias precedence over plan_check default

- state.validate/sync: phaseTokenMatches + comparePhaseNum ordering

- verify.schema-drift: token match phase dirs; files_modified from parsed frontmatter

- audit-open: has_scan_errors, unreadable rows, human report when scans fail

- requirements PLANNED key PLAN for root PLAN.md; gsd-tools timeout note

- ingest-docs: repo-root path containment; classifier output slug-hash

Golden parity test strips has_scan_errors until CJS adds field.

* fix: Resolve CodeRabbit security and quality findings
- Secure intel.ts and cli.ts against path traversal
- Catch and validate git add status in commit.ts
- Expand roadmap milestone marker extraction
- Fix parsing array-of-objects in frontmatter YAML
- Fix unhandled config evaluations
- Improve coverage test parity mapping

* test: raise planner character extraction limit to 48K

* fix(sdk): resolve TS build error in docs-init passing config

sdk/src/query/commit.ts

@@ -102,10 +102,14 @@ export const commit: QueryHandler = async (args, projectDir) => {
   const hasForce = allArgs.includes('--force');
   const hasAmend = allArgs.includes('--amend');
   const hasNoVerify = allArgs.includes('--no-verify');
-  const nonFlagArgs = allArgs.filter(a => !a.startsWith('--'));
-
-  const message = nonFlagArgs[0];
-  const filePaths = nonFlagArgs.slice(1);
+  const filesIndex = allArgs.indexOf('--files');
+  const endIndex = filesIndex !== -1 ? filesIndex : allArgs.length;
+  // CodeRabbit #6: don't strip arbitrary `--foo` tokens from commit messages
+  const knownFlags = new Set(['--force', '--amend', '--no-verify']);
+  const messageArgs = allArgs.slice(0, endIndex).filter(a => !knownFlags.has(a));
+  const message = messageArgs.join(' ') || undefined;
+  const filePaths =
+    filesIndex !== -1 ? allArgs.slice(filesIndex + 1).filter(a => !a.startsWith('--')) : [];
 
   if (!message && !hasAmend) {
     return { data: { committed: false, reason: 'commit message required' } };
@@ -131,7 +135,10 @@ export const commit: QueryHandler = async (args, projectDir) => {
   // Stage files
   const filesToStage = filePaths.length > 0 ? filePaths : ['.planning/'];
   for (const file of filesToStage) {
-    execGit(projectDir, ['add', file]);
+    const addResult = execGit(projectDir, ['add', file]);
+    if (addResult.exitCode !== 0) {
+      return { data: { committed: false, reason: addResult.stderr || `failed to stage ${file}`, exitCode: addResult.exitCode } };
+    }
   }
 
   // Check if anything is staged
@@ -142,9 +149,9 @@ export const commit: QueryHandler = async (args, projectDir) => {
   }
 
   // Build commit command
-  const commitArgs = hasAmend
+  const commitArgs: string[] = hasAmend
     ? ['commit', '--amend', '--no-edit']
-    : ['commit', '-m', sanitized];
+    : ['commit', '-m', sanitized ?? ''];
   if (hasNoVerify) commitArgs.push('--no-verify');
 
   const commitResult = execGit(projectDir, commitArgs);
@@ -197,6 +204,7 @@ export const checkCommit: QueryHandler = async (_args, projectDir) => {
     if (planningFiles.length > 0) {
       return {
         data: {
+          allowed: false,
           can_commit: false,
           reason: `commit_docs is false but ${planningFiles.length} .planning/ file(s) are staged`,
           commit_docs: false,
@@ -208,6 +216,7 @@ export const checkCommit: QueryHandler = async (_args, projectDir) => {
 
   return {
     data: {
+      allowed: true,
       can_commit: true,
       reason: commitDocs ? 'commit_docs_enabled' : 'no_planning_files_staged',
       commit_docs: commitDocs,
@@ -219,14 +228,36 @@ export const checkCommit: QueryHandler = async (_args, projectDir) => {
 // ─── commitToSubrepo ─────────────────────────────────────────────────────
 
 export const commitToSubrepo: QueryHandler = async (args, projectDir) => {
-  const message = args[0];
   const filesIdx = args.indexOf('--files');
-  const files = filesIdx >= 0 ? args.slice(filesIdx + 1) : [];
+  const endIdx = filesIdx >= 0 ? filesIdx : args.length;
+  const knownFlags = new Set(['--force', '--amend', '--no-verify']);
+  const messageArgs = args.slice(0, endIdx).filter(a => !knownFlags.has(a));
+  const message = messageArgs.join(' ') || undefined;
+  const files = filesIdx >= 0 ? args.slice(filesIdx + 1).filter(a => !a.startsWith('--')) : [];
 
   if (!message) {
     return { data: { committed: false, reason: 'commit message required' } };
   }
 
+  const paths = planningPaths(projectDir);
+  let config: Record<string, unknown> = {};
+  try {
+    const raw = await readFile(paths.config, 'utf-8');
+    config = JSON.parse(raw) as Record<string, unknown>;
+  } catch {
+    /* no config */
+  }
+  const subRepos = config.sub_repos as string[] | undefined;
+  if (!subRepos || subRepos.length === 0) {
+    return {
+      data: { committed: false, reason: 'no sub_repos configured in .planning/config.json' },
+    };
+  }
+
+  if (files.length === 0) {
+    return { data: { committed: false, reason: '--files required for commit-to-subrepo' } };
+  }
+
   const sanitized = sanitizeCommitMessage(message);
   if (!sanitized && message) {
     return { data: { committed: false, reason: 'commit message empty after sanitization' } };
@@ -245,7 +276,10 @@ export const commitToSubrepo: QueryHandler = async (args, projectDir) => {
     }
 
     const fileArgs = files.length > 0 ? files : ['.'];
-    spawnSync('git', ['-C', projectDir, 'add', ...fileArgs], { stdio: 'pipe' });
+    const addResult = spawnSync('git', ['-C', projectDir, 'add', ...fileArgs], { stdio: 'pipe', encoding: 'utf-8' });
+    if (addResult.status !== 0) {
+      return { data: { committed: false, reason: addResult.stderr || 'git add failed' } };
+    }
 
     const commitResult = spawnSync(
       'git', ['-C', projectDir, 'commit', '-m', sanitized],