session-orchestrator 3.16.0

package/scripts/lib/config/dispatcher-autonomy.mjs

@@ -0,0 +1,152 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * dispatcher-autonomy.mjs — Parser + resolver for the top-level
+ * `dispatcher-autonomy:` YAML block (Epic #673 / issue #679).
+ *
+ * Returns `{ autonomy, "confidence-floor" }`.
+ * Tolerant parser: malformed values silently fall back to defaults.
+ *
+ * NOTE: `dispatcher-autonomy:` is a DISTINCT top-level sibling block, parsed
+ * independent of the `## Session Config` section boundary (same posture as the
+ * `skill-evolution:` block in skill-evolution.mjs). Do not confuse the two
+ * blocks; this module only touches the `dispatcher-autonomy:` header.
+ *
+ * CAPS: cap keys are intentionally NOT parsed here — they belong to a later
+ * issue (#682). This module owns `autonomy` + `confidence-floor` only.
+ *
+ * Consumers:
+ *  - `scripts/lib/config.mjs` (wired in a later wave — reads parsed object and
+ *    passes loadOwnerConfig() into resolveDispatcherAutonomy)
+ *  - Skills that implement the cross-repo dispatcher autonomy gate
+ */
+
+const ALLOWED_AUTONOMY = ['off', 'advisory', 'autonomous-gated'];
+
+/**
+ * Parse the top-level `dispatcher-autonomy:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * Defaults:
+ *   autonomy:        'off'   (enum: off | advisory | autonomous-gated)
+ *   confidence-floor: 0.5    (float in [0.0, 1.0])
+ *
+ * @param {string} content — full file contents
+ * @returns {{ autonomy: string, "confidence-floor": number }}
+ */
+export function _parseDispatcherAutonomy(content) {
+  const defaults = {
+    autonomy: 'off',
+    'confidence-floor': 0.5,
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'dispatcher-autonomy')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let autonomy = 'off';
+  let confidenceFloor = 0.5;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'autonomy': {
+        const lower = v.toLowerCase();
+        if (ALLOWED_AUTONOMY.includes(lower)) autonomy = lower;
+        // else: silently fall back to default 'off'
+        break;
+      }
+      case 'confidence-floor': {
+        if (/^\d+(\.\d+)?$/.test(v)) {
+          const f = parseFloat(v);
+          if (Number.isFinite(f) && f >= 0.0 && f <= 1.0) confidenceFloor = f;
+          // else: silently fall back to default 0.5
+        }
+        break;
+      }
+    }
+  }
+
+  return {
+    autonomy,
+    'confidence-floor': confidenceFloor,
+  };
+}
+
+/**
+ * Coerce a candidate autonomy value to a valid lowercase enum, or `undefined`
+ * if it is unset/empty/whitespace/invalid (so the caller can fall through to
+ * the next precedence tier — mirrors host-paths' empty-string-is-unset rule).
+ *
+ * @param {unknown} value
+ * @returns {string|undefined}
+ */
+function coerceAutonomy(value) {
+  if (value === null || value === undefined) return undefined;
+  const normalized = String(value).toLowerCase().trim();
+  if (normalized === '') return undefined;
+  return ALLOWED_AUTONOMY.includes(normalized) ? normalized : undefined;
+}
+
+/**
+ * Resolve the EFFECTIVE dispatcher `autonomy` enum with precedence (highest
+ * first). Mirrors the resolveHostPath precedence pattern from host-paths.mjs:
+ * an invalid/empty/whitespace value at any tier is treated as "unset" and falls
+ * through to the next tier.
+ *
+ * Precedence (highest first):
+ *   1. env.SO_DISPATCHER_AUTONOMY  (host-local env-var override)
+ *   2. ownerConfig.dispatcher.autonomy  (host-local owner.yaml — never committed)
+ *   3. committed  (the `autonomy` value from _parseDispatcherAutonomy)
+ *   4. 'off'  (fail-closed floor)
+ *
+ * The CALLER passes `ownerConfig` (config.mjs calls loadOwnerConfig) — this
+ * module imports nothing, so there is zero cycle risk. Never throws.
+ *
+ * @param {{ committed?: unknown, env?: Record<string, string|undefined>, ownerConfig?: object }} [opts]
+ * @returns {string} resolved lowercase enum string
+ */
+export function resolveDispatcherAutonomy({ committed, env = process.env, ownerConfig } = {}) {
+  // Tier 1 — env-var override.
+  const envVal = coerceAutonomy(env?.SO_DISPATCHER_AUTONOMY);
+  if (envVal !== undefined) return envVal;
+
+  // Tier 2 — owner.yaml dispatcher.autonomy (defensive: access may throw).
+  let ownerRaw;
+  try {
+    ownerRaw = ownerConfig?.dispatcher?.autonomy;
+  } catch {
+    ownerRaw = undefined;
+  }
+  const ownerVal = coerceAutonomy(ownerRaw);
+  if (ownerVal !== undefined) return ownerVal;
+
+  // Tier 3 — committed Session Config value.
+  const committedVal = coerceAutonomy(committed);
+  if (committedVal !== undefined) return committedVal;
+
+  // Tier 4 — fail-closed floor.
+  return 'off';
+}

package/scripts/lib/config/docs-orchestrator.mjs

@@ -0,0 +1,90 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * docs-orchestrator.mjs — Parser for the top-level `docs-orchestrator:` YAML block.
+ */
+
+/**
+ * Parse the top-level `docs-orchestrator:` YAML block from markdown content.
+ * Defaults: enabled=false, audiences=["user","dev","vault"], mode="warn".
+ * @param {string} content — full file contents
+ * @returns {{enabled: boolean, audiences: string[], mode: string}}
+ */
+export function _parseDocsOrchestrator(content) {
+  const defaults = { enabled: false, audiences: ['user', 'dev', 'vault'], mode: 'warn' };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'docs-orchestrator')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let doEnabled = false;
+  let doMode = 'warn';
+  const doAudiences = [];
+  let inAudiencesList = false;
+  const validAudiences = new Set(['user', 'dev', 'vault']);
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    if (/^\s+-\s+/.test(clean)) {
+      if (inAudiencesList) {
+        let item = clean.replace(/^\s+-\s+/, '').trim();
+        if (item.startsWith('"') && item.endsWith('"')) item = item.slice(1, -1);
+        else if (item.startsWith("'") && item.endsWith("'")) item = item.slice(1, -1);
+        if (item && validAudiences.has(item)) doAudiences.push(item);
+      }
+      continue;
+    }
+
+    inAudiencesList = false;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        doEnabled = v.toLowerCase() === 'true';
+        break;
+      case 'mode':
+        if (['strict', 'warn', 'off'].includes(v)) doMode = v;
+        break;
+      case 'audiences':
+        if (!v) {
+          inAudiencesList = true;
+        } else {
+          // Inline list: audiences: [user, dev, vault]
+          const stripped = v.replace(/^\s*\[/, '').replace(/\]\s*$/, '').trim();
+          if (stripped) {
+            for (const item of stripped.split(',').map(s => s.trim())) {
+              if (item && validAudiences.has(item)) doAudiences.push(item);
+            }
+          }
+        }
+        break;
+    }
+  }
+
+  return {
+    enabled: doEnabled,
+    audiences: doAudiences.length > 0 ? doAudiences : ['user', 'dev', 'vault'],
+    mode: doMode,
+  };
+}

package/scripts/lib/config/docs-staleness.mjs

@@ -0,0 +1,96 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * docs-staleness.mjs — Parser for the top-level `docs-staleness:` YAML block.
+ *
+ * Config block shape (see docs/session-config-template.md):
+ *   docs-staleness:
+ *     enabled: false
+ *     mode: warn
+ *     thresholds:
+ *       living: 90
+ *
+ * Mirrors the vault-staleness.mjs parser design (issue #781, Epic #774), but
+ * with a single "living" tier instead of top/active/archived — living docs
+ * (docs/*.md root-level + docs/examples/*.md) have one staleness threshold,
+ * not a per-tier map.
+ */
+
+/**
+ * Parse the top-level `docs-staleness:` YAML block from markdown content.
+ * Defaults: enabled=false, thresholds={living:90}, mode="warn".
+ * @param {string} content — full file contents
+ * @returns {{enabled: boolean, thresholds: {living: number}, mode: string}}
+ */
+export function _parseDocsStaleness(content) {
+  const defaults = {
+    enabled: false,
+    thresholds: { living: 90 },
+    mode: 'warn',
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'docs-staleness')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let dsEnabled = false;
+  let dsMode = 'warn';
+  const dsThresholds = { living: 90 };
+  let inThresholdsBlock = false;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    // Deeper indented key (thresholds sub-keys)
+    const deepMatch = clean.match(/^\s{4,}([a-zA-Z_-]+):\s*(.*)/);
+    if (deepMatch && inThresholdsBlock) {
+      const k = deepMatch[1];
+      let v = deepMatch[2].trim();
+      if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+      else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+      if (k === 'living') {
+        const n = parseFloat(v);
+        if (Number.isFinite(n) && n > 0) dsThresholds[k] = n;
+      }
+      continue;
+    }
+
+    // Top-level key under docs-staleness (2-space indent)
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    inThresholdsBlock = false;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        dsEnabled = v.toLowerCase() === 'true';
+        break;
+      case 'mode':
+        if (['strict', 'warn', 'off'].includes(v)) dsMode = v;
+        break;
+      case 'thresholds':
+        inThresholdsBlock = true;
+        break;
+    }
+  }
+
+  return { enabled: dsEnabled, thresholds: dsThresholds, mode: dsMode };
+}

package/scripts/lib/config/drift-check.mjs

@@ -0,0 +1,155 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * drift-check.mjs — Parser for the top-level `drift-check:` YAML block.
+ *
+ * Ported from config-yaml-parser.sh (v2).
+ */
+
+/**
+ * Parse the top-level `drift-check:` YAML block from markdown content.
+ * Mirrors the shell parse_drift_check() in config-yaml-parser.sh.
+ * Defaults: enabled=false, mode="warn",
+ * include-paths=["CLAUDE.md","AGENTS.md","_meta/**\/*.md"] (CLAUDE.md and
+ * AGENTS.md are transparent aliases per
+ * skills/_shared/instruction-file-resolution.md),
+ * all ten per-check flags default to true.
+ * @param {string} content — full file contents
+ * @returns {{enabled: boolean, mode: string, "include-paths": string[], "check-path-resolver": boolean, "check-project-count-sync": boolean, "check-issue-reference-freshness": boolean, "check-session-file-existence": boolean, "check-command-count": boolean, "check-session-config-parity": boolean, "check-vault-dir-parity": boolean, "check-generated-rule-staleness": boolean, "check-rule-scoping": boolean, "check-docs-parity": boolean}}
+ */
+export function _parseDriftCheck(content) {
+  // CLAUDE.md and AGENTS.md are transparent aliases per
+  // skills/_shared/instruction-file-resolution.md. Both are included so
+  // drift-check covers the project-instruction file regardless of which
+  // platform created it.
+  const DEFAULT_INCLUDE_PATHS = ['CLAUDE.md', 'AGENTS.md', '_meta/**/*.md'];
+  const defaults = {
+    enabled: false,
+    mode: 'warn',
+    'include-paths': DEFAULT_INCLUDE_PATHS,
+    'check-path-resolver': true,
+    'check-project-count-sync': true,
+    'check-issue-reference-freshness': true,
+    'check-session-file-existence': true,
+    'check-command-count': true,
+    'check-session-config-parity': true,
+    'check-vault-dir-parity': true,
+    'check-generated-rule-staleness': true,
+    'check-rule-scoping': true,
+    'check-docs-parity': true,
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'drift-check')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let dcEnabled = false;
+  let dcMode = 'warn';
+  let dcChkPath = true;
+  let dcChkCount = true;
+  let dcChkIssue = true;
+  let dcChkSess = true;
+  let dcChkCommandCount = true;
+  let dcChkSessionConfigParity = true;
+  let dcChkVaultDirParity = true;
+  let dcChkGeneratedRuleStaleness = true;
+  let dcChkRuleScoping = true;
+  let dcChkDocsParity = true;
+  const dcInclude = [];
+  let inIncludeList = false;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    if (/^\s+-\s+/.test(clean)) {
+      if (inIncludeList) {
+        let item = clean.replace(/^\s+-\s+/, '').trim();
+        if (item.startsWith('"') && item.endsWith('"')) item = item.slice(1, -1);
+        else if (item.startsWith("'") && item.endsWith("'")) item = item.slice(1, -1);
+        if (item) dcInclude.push(item);
+      }
+      continue;
+    }
+
+    inIncludeList = false;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        dcEnabled = v.toLowerCase() === 'true';
+        break;
+      case 'mode':
+        if (['hard', 'warn', 'off'].includes(v)) dcMode = v;
+        break;
+      case 'include-paths':
+        if (!v) inIncludeList = true;
+        break;
+      case 'check-path-resolver':
+        dcChkPath = v.toLowerCase() !== 'false';
+        break;
+      case 'check-project-count-sync':
+        dcChkCount = v.toLowerCase() !== 'false';
+        break;
+      case 'check-issue-reference-freshness':
+        dcChkIssue = v.toLowerCase() !== 'false';
+        break;
+      case 'check-session-file-existence':
+        dcChkSess = v.toLowerCase() !== 'false';
+        break;
+      case 'check-command-count':
+        dcChkCommandCount = v.toLowerCase() !== 'false';
+        break;
+      case 'check-session-config-parity':
+        dcChkSessionConfigParity = v.toLowerCase() !== 'false';
+        break;
+      case 'check-vault-dir-parity':
+        dcChkVaultDirParity = v.toLowerCase() !== 'false';
+        break;
+      case 'check-generated-rule-staleness':
+        dcChkGeneratedRuleStaleness = v.toLowerCase() !== 'false';
+        break;
+      case 'check-rule-scoping':
+        dcChkRuleScoping = v.toLowerCase() !== 'false';
+        break;
+      case 'check-docs-parity':
+        dcChkDocsParity = v.toLowerCase() !== 'false';
+        break;
+    }
+  }
+
+  return {
+    enabled: dcEnabled,
+    mode: dcMode,
+    'include-paths': dcInclude.length > 0 ? dcInclude : DEFAULT_INCLUDE_PATHS,
+    'check-path-resolver': dcChkPath,
+    'check-project-count-sync': dcChkCount,
+    'check-issue-reference-freshness': dcChkIssue,
+    'check-session-file-existence': dcChkSess,
+    'check-command-count': dcChkCommandCount,
+    'check-session-config-parity': dcChkSessionConfigParity,
+    'check-vault-dir-parity': dcChkVaultDirParity,
+    'check-generated-rule-staleness': dcChkGeneratedRuleStaleness,
+    'check-rule-scoping': dcChkRuleScoping,
+    'check-docs-parity': dcChkDocsParity,
+  };
+}

package/scripts/lib/config/eval.mjs

@@ -0,0 +1,130 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * eval.mjs — Parser for the top-level `eval:` YAML block (#809, Epic #803).
+ *
+ * Drives the /eval skill (Session-Prozess-Eval, Standard v1 evaluation harness —
+ * PRD docs/prd/2026-07-16-aiat-llm-eval.md §S6). The /eval skill itself lands in
+ * a later wave; this parser only surfaces the opt-in config the skill will read.
+ *
+ * Returns { enabled, mode, judge, report, handle }.
+ * Fail-fast ONLY on unknown mode/judge/report enum values (mirrors
+ * dialectic.mjs's `model` handling). `enabled` silently defaults to/collapses
+ * to false on any non-"true" value (docs-orchestrator.mjs precedent — no
+ * throw, no warn). `handle` trims and collapses an empty string to null.
+ *
+ * PARSER GOTCHA (learning conf 0.9 — mirrors custom-phases.mjs / dialectic.mjs):
+ * the `eval:` key-line itself MUST NOT carry an inline comment. The block-open
+ * matcher is the shared `matchBlockHeader(line, 'eval')` (block-header.mjs) — it
+ * tolerates the bold-bullet `- **eval:**` rendering (#830) but a trailing
+ * `# comment` on the header line STILL fails the match, so the block is never
+ * entered and ALL defaults apply
+ * silently (no error, no warning surfaced anywhere). Sub-key lines tolerate
+ * inline comments fine (stripped via `replace(/\s*#.*$/, '')` below, same as
+ * every other block parser in this directory).
+ *
+ * Consumer: skills/eval/SKILL.md (follow-up wave), scripts/lib/config.mjs.
+ */
+
+const ALLOWED_MODE = new Set(['warn', 'off']);
+// opus intentionally omitted: deliberate cost ceiling for an advisory judge (judge.mjs::ALLOWED_MODELS still permits opus for direct module use).
+const ALLOWED_JUDGE = new Set(['off', 'haiku', 'sonnet']);
+const ALLOWED_REPORT = new Set(['html', 'none']);
+
+/**
+ * Parse the top-level `eval:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * Defaults:
+ *   enabled: false
+ *   mode:    'warn'   (warn | off)
+ *   judge:   'off'    (off | haiku | sonnet)
+ *   report:  'html'   (html | none)
+ *   handle:  null     (optional string; absent/empty → null)
+ *
+ * Throws if `mode`, `judge`, or `report` is present but not one of its
+ * documented enum values.
+ *
+ * @param {string} content — full file contents
+ * @returns {{ enabled: boolean, mode: string, judge: string, report: string, handle: string|null }}
+ */
+export function _parseEval(content) {
+  const defaults = { enabled: false, mode: 'warn', judge: 'off', report: 'html', handle: null };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'eval')) inBlock = true;
+      continue;
+    }
+    // Stop at next column-0 non-empty line (sibling top-level key or heading)
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let enabled = false;
+  let mode = 'warn';
+  let judge = 'off';
+  let report = 'html';
+  let handle = null;
+
+  for (const rawLine of blockLines) {
+    // Strip inline comments and trailing whitespace (sub-key lines only —
+    // the key-line's own comment restriction is enforced by the regex above).
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        enabled = v.toLowerCase() === 'true';
+        break;
+
+      case 'mode': {
+        const lower = v.toLowerCase();
+        if (!ALLOWED_MODE.has(lower)) {
+          throw new Error(`eval.mode must be warn|off, got '${v}'`);
+        }
+        mode = lower;
+        break;
+      }
+
+      case 'judge': {
+        const lower = v.toLowerCase();
+        if (!ALLOWED_JUDGE.has(lower)) {
+          throw new Error(`eval.judge must be off|haiku|sonnet, got '${v}'`);
+        }
+        judge = lower;
+        break;
+      }
+
+      case 'report': {
+        const lower = v.toLowerCase();
+        if (!ALLOWED_REPORT.has(lower)) {
+          throw new Error(`eval.report must be html|none, got '${v}'`);
+        }
+        report = lower;
+        break;
+      }
+
+      case 'handle':
+        handle = v.trim() === '' ? null : v.trim();
+        break;
+    }
+  }
+
+  return { enabled, mode, judge, report, handle };
+}