session-orchestrator 3.16.0

package/scripts/lib/config/events-rotation.mjs

@@ -0,0 +1,74 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * events-rotation.mjs — Parser for the top-level `events-rotation:` YAML block.
+ *
+ * Bounds: max-size-mb 1..1024, max-backups 1..20. Out-of-range values fall
+ * back to defaults (silently; tolerant parser — hard errors would break
+ * session-start, which must never block).
+ */
+
+/**
+ * Parse the top-level `events-rotation:` YAML block from markdown content.
+ * Defaults: enabled=true, max-size-mb=10, max-backups=5.
+ * @param {string} content — full file contents
+ * @returns {{enabled: boolean, "max-size-mb": number, "max-backups": number}}
+ */
+export function _parseEventsRotation(content) {
+  const defaults = { enabled: true, 'max-size-mb': 10, 'max-backups': 5 };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'events-rotation')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let erEnabled = true;
+  let erMaxSize = 10;
+  let erMaxBackups = 5;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        erEnabled = v.toLowerCase() !== 'false';
+        break;
+      case 'max-size-mb': {
+        if (/^\d+$/.test(v)) {
+          const n = parseInt(v, 10);
+          if (n >= 1 && n <= 1024) erMaxSize = n;
+        }
+        break;
+      }
+      case 'max-backups': {
+        if (/^\d+$/.test(v)) {
+          const n = parseInt(v, 10);
+          if (n >= 1 && n <= 20) erMaxBackups = n;
+        }
+        break;
+      }
+    }
+  }
+
+  return { enabled: erEnabled, 'max-size-mb': erMaxSize, 'max-backups': erMaxBackups };
+}

package/scripts/lib/config/evolve.mjs

@@ -0,0 +1,308 @@
+/**
+ * evolve.mjs — Parser for the `evolve:` Session Config block (#638).
+ *
+ * Lets a repo declare opt-in EXTRA learning sources for /evolve: sidecar JSON
+ * files produced OUT-OF-BAND by a domain measurement (e.g. an eval-learn harness
+ * regression report). /evolve READS these sidecars and emits `domain-regression`
+ * learning candidates — it NEVER runs the measurement itself (read-only contract).
+ *
+ * Exports:
+ *   _parseEvolve(content)      — PURE, no side effects beyond a stderr WARN when an
+ *                                entry is dropped for failing schema validation.
+ *                                Returns [] when the block is absent/empty.
+ *   _parseEvolveDecay(content) — PURE memory time-decay tuning parser (#670).
+ *                                Returns `{ enabled, half-life-days, floor-factor }`
+ *                                with conservative defaults; malformed values
+ *                                silently fall back to the default (tolerant).
+ *
+ * Block shape:
+ *   evolve:
+ *     extra-sources:
+ *       - path: eval/learn/reports/latest.json   # required; SAFE_PATH_RE-validated
+ *         kind: regression-flags                  # enum: regression-flags (only value)
+ *         learning-type: domain-regression        # enum: domain-regression (only value)
+ *     decay-enabled: true                          # #670 — gate the recency factor
+ *     decay-half-life-days: 90                      # #670 — half-life (conservative)
+ *     decay-floor-factor: 0.1                       # #670 — catastrophic-loss floor
+ *
+ * Modelled on cross-repo.mjs (column-0 block scan + nested list + per-entry
+ * SAFE_PATH_RE validation, drop-with-warn) and custom-phases.mjs (nested record
+ * list parse). Unknown `kind` / `learning-type` enum values DROP the entry with a
+ * stderr WARN (schema gate — never guess), mirroring custom-phases' security posture
+ * for security-relevant fields the consumer will read.
+ */
+
+import pathModule from 'node:path';
+
+import { matchBlockHeader } from './block-header.mjs';
+
+/** Per-entry defaults (none beyond the required field-set; documented for symmetry). */
+export const EVOLVE_EXTRA_SOURCE_DEFAULTS = Object.freeze({
+  kind: 'regression-flags',
+  'learning-type': 'domain-regression',
+});
+
+// Enum allow-lists. Each currently has a single legal value; unknown values DROP
+// the entry (schema gate) rather than silently defaulting — the consumer reads the
+// `kind` to pick a sidecar schema and the `learning-type` to stamp the candidate,
+// so a guessed value would produce a wrong-shaped learning.
+const VALID_KIND = new Set(['regression-flags']);
+const VALID_LEARNING_TYPE = new Set(['domain-regression']);
+
+// Allowlist: a sidecar `path` is a repo-relative file path — no spaces, no shell
+// metacharacters, and no `..` scope escape. Mirrors cross-repo.mjs /
+// custom-phases.mjs SAFE_PATH_RE for shell-injection filtering, then adds
+// evolve-specific confinement because /evolve resolves sidecars against repo root.
+const SAFE_PATH_RE = /^[A-Za-z0-9._~/-]+$/;
+
+/**
+ * Parse the top-level `evolve:` block and its nested `extra-sources:` YAML list.
+ *
+ * Each list item is a record `{path, kind, learning-type}`. Records are validated
+ * per-entry; a record missing a required `path`, carrying a shell-metacharacter in
+ * `path`, or carrying an unknown `kind`/`learning-type` enum value is DROPPED with a
+ * stderr WARN.
+ *
+ * @param {string} content — full CLAUDE.md / AGENTS.md file content
+ * @returns {Array<{path: string, kind: string, 'learning-type': string}>}
+ */
+export function _parseEvolve(content) {
+  const lines = content.split(/\r?\n/);
+  let inEvolve = false;
+  let inExtraSources = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+
+    if (!inEvolve) {
+      // Detect `evolve:` at column 0 with optional trailing spaces.
+      if (matchBlockHeader(line, 'evolve')) inEvolve = true;
+      continue;
+    }
+
+    // The `evolve:` block terminates at the first non-indented, non-empty line
+    // (next top-level key).
+    if (line.length > 0 && !/^\s/.test(line)) break;
+
+    if (!inExtraSources) {
+      // Detect the `extra-sources:` sub-key (any indent depth ≥ 1).
+      if (/^\s+extra-sources:\s*$/.test(line)) inExtraSources = true;
+      continue;
+    }
+
+    // Within extra-sources: collect list-item lines. A sibling sub-key of evolve:
+    // at the SAME indent as extra-sources: (shallower than the list dash) ends the
+    // sub-block. We detect this by a non-dash key whose indent matches extra-sources'.
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return [];
+
+  /** @type {Array<{path: string, kind: string, 'learning-type': string}>} */
+  const records = [];
+  /** @type {Record<string, string>|null} */
+  let current = null;
+
+  const flush = () => {
+    if (current === null) return;
+    const rec = _validateRecord(current);
+    if (rec !== null) records.push(rec);
+    current = null;
+  };
+
+  for (const rawLine of blockLines) {
+    // Strip inline comments + trailing whitespace, preserve leading indent.
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    // A new list item starts with a dash. The first key may sit on the dash line:
+    //   - path: foo.json
+    const dashMatch = clean.match(/^\s*-\s+(.*)$/);
+    if (dashMatch) {
+      flush();
+      current = {};
+      const inlineKv = dashMatch[1].match(/^([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)$/);
+      if (inlineKv) {
+        _assignKv(current, inlineKv[1], inlineKv[2]);
+      }
+      continue;
+    }
+
+    // Continuation key for the current record (deeper indent, no dash).
+    const kvMatch = clean.match(/^\s+([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)$/);
+    if (kvMatch && current !== null) {
+      _assignKv(current, kvMatch[1], kvMatch[2]);
+    }
+  }
+
+  flush();
+
+  return records;
+}
+
+/**
+ * Assign a raw key/value onto a record being built, stripping surrounding quotes.
+ * Only known keys are stored; unknown keys are silently ignored (additive-friendly).
+ *
+ * @param {Record<string, string>} record
+ * @param {string} key
+ * @param {string} rawValue
+ */
+function _assignKv(record, key, rawValue) {
+  let v = rawValue.trim();
+  if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+  else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+  switch (key) {
+    case 'path':
+    case 'kind':
+    case 'learning-type':
+      record[key] = v;
+      break;
+    default:
+      // Unknown keys are silently ignored — additive-friendly.
+      break;
+  }
+}
+
+/**
+ * Validate + normalise a raw extra-source record. Returns the record, or null
+ * (with a stderr WARN) when `path` is missing / SAFE_PATH_RE-failing, or when
+ * `kind` / `learning-type` carries an unknown enum value.
+ *
+ * @param {Record<string, string>} raw
+ * @returns {{path: string, kind: string, 'learning-type': string}|null}
+ */
+function _validateRecord(raw) {
+  const path = (raw.path ?? '').trim();
+  if (path === '') {
+    process.stderr.write('evolve: dropped extra-source missing required field: path\n');
+    return null;
+  }
+  if (!SAFE_PATH_RE.test(path)) {
+    process.stderr.write(
+      `evolve: dropped extra-source with shell metacharacter in path: ${JSON.stringify(path)}\n`,
+    );
+    return null;
+  }
+  if (pathModule.isAbsolute(path) || path.split('/').includes('..')) {
+    process.stderr.write(
+      `evolve: dropped extra-source outside repo-relative scope: ${JSON.stringify(path)}\n`,
+    );
+    return null;
+  }
+
+  // kind: enum gate — unknown value DROPS the record (never guess).
+  const kind = (raw.kind ?? EVOLVE_EXTRA_SOURCE_DEFAULTS.kind).trim();
+  if (!VALID_KIND.has(kind)) {
+    process.stderr.write(
+      `evolve: dropped extra-source '${path}' with unknown kind: ${JSON.stringify(kind)} ` +
+        `(allowed: ${[...VALID_KIND].join(', ')})\n`,
+    );
+    return null;
+  }
+
+  // learning-type: enum gate — unknown value DROPS the record (never guess).
+  const learningType = (raw['learning-type'] ?? EVOLVE_EXTRA_SOURCE_DEFAULTS['learning-type']).trim();
+  if (!VALID_LEARNING_TYPE.has(learningType)) {
+    process.stderr.write(
+      `evolve: dropped extra-source '${path}' with unknown learning-type: ${JSON.stringify(learningType)} ` +
+        `(allowed: ${[...VALID_LEARNING_TYPE].join(', ')})\n`,
+    );
+    return null;
+  }
+
+  return { path, kind, 'learning-type': learningType };
+}
+
+// ---------------------------------------------------------------------------
+// Memory time-decay tuning (#670)
+// ---------------------------------------------------------------------------
+
+/**
+ * Conservative decay defaults — nested UNDER the existing `evolve:` block so they
+ * do NOT add a new top-level Session Config key (claude-md-drift-check Check 6
+ * parity is unaffected). Floor means nothing vanishes; long half-life means decay
+ * is a tiebreaker, not a cliff. See #670.
+ */
+export const EVOLVE_DECAY_DEFAULTS = Object.freeze({
+  enabled: true,
+  'half-life-days': 90,
+  'floor-factor': 0.1,
+});
+
+/**
+ * Parse the memory time-decay tuning keys nested under the `evolve:` block.
+ *
+ * Scans the same column-0 `evolve:` block as `_parseEvolve` but reads three flat
+ * sub-keys (siblings of `extra-sources:`):
+ *   - `decay-enabled`        (boolean; default true)
+ *   - `decay-half-life-days` (positive number; default 90)
+ *   - `decay-floor-factor`   (float in [0,1]; default 0.1)
+ *
+ * Tolerant: malformed/out-of-range values silently fall back to the default
+ * (mirrors auto-dream.mjs). Returns the defaults when the block is absent.
+ *
+ * @param {string} content — full CLAUDE.md / AGENTS.md file content
+ * @returns {{enabled: boolean, 'half-life-days': number, 'floor-factor': number}}
+ */
+export function _parseEvolveDecay(content) {
+  const result = {
+    enabled: EVOLVE_DECAY_DEFAULTS.enabled,
+    'half-life-days': EVOLVE_DECAY_DEFAULTS['half-life-days'],
+    'floor-factor': EVOLVE_DECAY_DEFAULTS['floor-factor'],
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inEvolve = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inEvolve) {
+      if (matchBlockHeader(line, 'evolve')) inEvolve = true;
+      continue;
+    }
+    // Terminate at the first non-indented, non-empty line (next top-level key).
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return result;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    // Flat `  key: value` sub-key (skip list-item dash lines under extra-sources:).
+    const kvMatch = clean.match(/^\s+([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)$/);
+    if (!kvMatch) continue;
+
+    const key = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    if (key === 'decay-enabled') {
+      const lower = v.toLowerCase();
+      if (lower === 'true') result.enabled = true;
+      else if (lower === 'false') result.enabled = false;
+      // any other value → keep default (tolerant)
+    } else if (key === 'decay-half-life-days') {
+      // Positive number; reject 0/negative/non-numeric → keep default.
+      if (/^\d+(\.\d+)?$/.test(v)) {
+        const f = parseFloat(v);
+        if (Number.isFinite(f) && f > 0) result['half-life-days'] = f;
+      }
+    } else if (key === 'decay-floor-factor') {
+      // Float in [0,1] → keep default otherwise.
+      if (/^\d+(\.\d+)?$/.test(v)) {
+        const f = parseFloat(v);
+        if (Number.isFinite(f) && f >= 0 && f <= 1) result['floor-factor'] = f;
+      }
+    }
+  }
+
+  return result;
+}

package/scripts/lib/config/frontend-slop-hook.mjs

@@ -0,0 +1,104 @@
+/**
+ * frontend-slop-hook.mjs — Parser + loader for the top-level
+ * `frontend-slop-hook:` YAML block (#684, Track 2 / item B).
+ *
+ * Drives the OPT-IN, NON-BLOCKING PostToolUse hook that runs the deterministic
+ * frontend-slop detector (scripts/lib/frontend-detect/detect.mjs) on a UI file
+ * right after it is edited and surfaces findings as an `additionalContext`
+ * roll-up. Warn-only / never blocks; profile-gate also applies.
+ *
+ * Returns `{ enabled }`. DEFAULT OFF (`enabled: false`) — opt-in by design,
+ * unlike loop-guard which defaults on. The flag only flips to `true` on an
+ * explicit `enabled: true` line under a column-0 `frontend-slop-hook:` block.
+ * Tolerant parser: any other value (or an absent block) resolves to disabled.
+ *
+ * Consumer: `hooks/post-tooluse-frontend-slop.mjs`.
+ */
+
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+
+import { SO_PROJECT_DIR } from '../platform.mjs';
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * Parse the top-level `frontend-slop-hook:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary (mirrors
+ * `_parseLoopGuard`).
+ *
+ * Default:
+ *   enabled: false   (OPT-IN — only an explicit `enabled: true` enables it)
+ *
+ * @param {string} content — full file contents
+ * @returns {{ enabled: boolean }}
+ */
+export function _parseFrontendSlopHook(content) {
+  const defaults = { enabled: false };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'frontend-slop-hook')) inBlock = true;
+      continue;
+    }
+    // A column-0 (non-indented) non-blank line ends the block.
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let fshEnabled = false;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    if (k === 'enabled') {
+      // Default is false → only flip to true on explicit "true".
+      fshEnabled = v.toLowerCase() === 'true';
+    }
+  }
+
+  return { enabled: fshEnabled };
+}
+
+/**
+ * Load `frontend-slop-hook.*` from CLAUDE.md (or AGENTS.md) at the project root.
+ * Cheap inline read — avoids importing the full config orchestrator from a hot
+ * hook path. Default OFF: a read failure (no instruction file) resolves to the
+ * parser defaults (`enabled: false`). Mirrors `loadConfig()` in
+ * hooks/loop-guard.mjs.
+ *
+ * @param {{ repoRoot?: string }} [opts]
+ * @returns {Promise<{ enabled: boolean }>}
+ */
+export async function loadFrontendSlopHookConfig(opts = {}) {
+  const root = opts.repoRoot || SO_PROJECT_DIR;
+  const candidates = [
+    path.join(root, 'CLAUDE.md'),
+    path.join(root, 'AGENTS.md'),
+  ];
+  for (const file of candidates) {
+    try {
+      const content = await fs.readFile(file, 'utf8');
+      return _parseFrontendSlopHook(content);
+    } catch {
+      // missing or unreadable — try next candidate
+    }
+  }
+  // No CLAUDE.md/AGENTS.md → parser defaults (enabled:false).
+  return _parseFrontendSlopHook('');
+}

package/scripts/lib/config/gitlab-portfolio.mjs

@@ -0,0 +1,150 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * gitlab-portfolio.mjs — Parser for the top-level `gitlab-portfolio:` YAML block.
+ */
+
+/** Default values for the gitlab-portfolio block. */
+export const GITLAB_PORTFOLIO_DEFAULTS = {
+  enabled: false,
+  mode: 'warn',
+  'stale-days': 30,
+  'critical-labels': ['priority:critical', 'priority:high'],
+};
+
+const VALID_MODES = new Set(['warn', 'strict', 'off']);
+
+/**
+ * Coerce a raw `gitlab-portfolio` block (already parsed as a plain object) into a
+ * normalized, fully-defaulted config object.
+ *
+ * Unknown keys are dropped silently. Invalid types fall back to defaults.
+ * Returns the defaults object when input is missing or not a plain object.
+ *
+ * @param {unknown} raw
+ * @returns {{ enabled: boolean, mode: 'warn'|'strict'|'off', 'stale-days': number, 'critical-labels': string[] }}
+ */
+export function coerceGitlabPortfolio(raw) {
+  if (raw === null || raw === undefined || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { ...GITLAB_PORTFOLIO_DEFAULTS, 'critical-labels': [...GITLAB_PORTFOLIO_DEFAULTS['critical-labels']] };
+  }
+
+  // enabled: only strict true is coerced to true
+  const enabled = raw['enabled'] === true;
+
+  // mode: must be one of warn | strict | off, otherwise default
+  const mode = VALID_MODES.has(raw['mode']) ? /** @type {'warn'|'strict'|'off'} */ (raw['mode']) : 'warn';
+
+  // stale-days: finite integer >= 1, otherwise default
+  const rawStaleDays = raw['stale-days'];
+  const staleDays =
+    typeof rawStaleDays === 'number' &&
+    Number.isFinite(rawStaleDays) &&
+    Number.isInteger(rawStaleDays) &&
+    rawStaleDays >= 1
+      ? rawStaleDays
+      : GITLAB_PORTFOLIO_DEFAULTS['stale-days'];
+
+  // critical-labels: array of non-empty strings; filter out invalid entries, fall back to defaults if result is empty or invalid
+  const rawLabels = raw['critical-labels'];
+  let criticalLabels;
+  if (Array.isArray(rawLabels)) {
+    const filtered = rawLabels.filter((l) => typeof l === 'string' && l.length > 0);
+    criticalLabels = filtered.length > 0 ? filtered : [...GITLAB_PORTFOLIO_DEFAULTS['critical-labels']];
+  } else {
+    criticalLabels = [...GITLAB_PORTFOLIO_DEFAULTS['critical-labels']];
+  }
+
+  return { enabled, mode, 'stale-days': staleDays, 'critical-labels': criticalLabels };
+}
+
+/**
+ * Parse the top-level `gitlab-portfolio:` YAML block from markdown content.
+ * Returns fully-defaulted values when the block is absent or malformed.
+ *
+ * @param {string} content — full file contents (CLAUDE.md or AGENTS.md)
+ * @returns {{ enabled: boolean, mode: 'warn'|'strict'|'off', 'stale-days': number, 'critical-labels': string[] }}
+ */
+export function _parseGitlabPortfolio(content) {
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'gitlab-portfolio')) inBlock = true;
+      continue;
+    }
+    // A non-empty line without leading whitespace signals end of block
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) {
+    return { ...GITLAB_PORTFOLIO_DEFAULTS, 'critical-labels': [...GITLAB_PORTFOLIO_DEFAULTS['critical-labels']] };
+  }
+
+  let gpEnabled = false;
+  let gpMode = /** @type {'warn'|'strict'|'off'} */ ('warn');
+  let gpStaleDays = GITLAB_PORTFOLIO_DEFAULTS['stale-days'];
+  let gpCriticalLabels = /** @type {string[]|null} */ (null);
+  let inCriticalLabelsBlock = false;
+
+  for (const rawLine of blockLines) {
+    // Strip inline comments and trailing whitespace
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    // List item under critical-labels (deeper indent with leading `- `)
+    if (inCriticalLabelsBlock) {
+      const listMatch = clean.match(/^\s{3,}-\s+(.*)/);
+      if (listMatch) {
+        let val = listMatch[1].trim();
+        if (val.startsWith('"') && val.endsWith('"') && val.length >= 2) val = val.slice(1, -1);
+        else if (val.startsWith("'") && val.endsWith("'") && val.length >= 2) val = val.slice(1, -1);
+        if (val.length > 0) {
+          if (gpCriticalLabels === null) gpCriticalLabels = [];
+          gpCriticalLabels.push(val);
+        }
+        continue;
+      }
+    }
+
+    // Top-level key under gitlab-portfolio (2-space indent)
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    inCriticalLabelsBlock = false;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        gpEnabled = v.toLowerCase() === 'true';
+        break;
+      case 'mode':
+        if (VALID_MODES.has(v)) gpMode = /** @type {'warn'|'strict'|'off'} */ (v);
+        break;
+      case 'stale-days': {
+        const n = parseFloat(v);
+        if (Number.isFinite(n) && Number.isInteger(n) && n >= 1) gpStaleDays = n;
+        break;
+      }
+      case 'critical-labels':
+        // Value is empty (block style) — switch to list-collection mode
+        inCriticalLabelsBlock = true;
+        break;
+    }
+  }
+
+  const criticalLabels =
+    gpCriticalLabels !== null && gpCriticalLabels.length > 0
+      ? gpCriticalLabels
+      : [...GITLAB_PORTFOLIO_DEFAULTS['critical-labels']];
+
+  return { enabled: gpEnabled, mode: gpMode, 'stale-days': gpStaleDays, 'critical-labels': criticalLabels };
+}