session-orchestrator 3.16.0

package/scripts/lib/config/slopcheck.mjs

@@ -0,0 +1,99 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * slopcheck.mjs — Parser for the top-level `slopcheck:` YAML block
+ * (PRD gsd Pattern Adoption Quick-Wins — Pattern 2 / issues #517, #520).
+ *
+ * Drives the opt-in package-legitimacy gate that defends against LLM-
+ * hallucinated npm/pip/cargo package names ("slopsquatting"). Plugged into
+ * /plan PRD generation and /discovery supply-chain probes.
+ *
+ * Returns `{ enabled, sources }`.
+ * Tolerant parser: malformed values silently fall back to defaults.
+ *
+ * Consumers:
+ *  - `scripts/lib/slopcheck.mjs` (classifyPackages())
+ *  - `skills/discovery/probes/supply-chain-slopcheck.mjs` (discovery probe)
+ */
+
+const ALLOWED_SOURCES = new Set(['plan', 'discovery']);
+const DEFAULT_SOURCES = ['plan', 'discovery'];
+
+/**
+ * Parse the top-level `slopcheck:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * Defaults:
+ *   enabled:  false (opt-in)
+ *   sources:  ['plan', 'discovery']
+ *
+ * @param {string} content — full file contents
+ * @returns {{ enabled: boolean, sources: string[] }}
+ */
+export function _parseSlopcheck(content) {
+  const defaults = {
+    enabled: false,
+    sources: [...DEFAULT_SOURCES],
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'slopcheck')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let scEnabled = false;
+  let scSources = [...DEFAULT_SOURCES];
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        // Default is false → only flip to true on explicit "true"
+        scEnabled = v.toLowerCase() === 'true';
+        break;
+      case 'sources': {
+        // Accept inline array notation: [] or [a, b, c]
+        const stripped = v.replace(/^\s*\[/, '').replace(/\]\s*$/, '').trim();
+        if (stripped === '') {
+          scSources = [];
+        } else {
+          const items = stripped
+            .split(',')
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0)
+            .filter((s) => ALLOWED_SOURCES.has(s));
+          // Only override the default when the parsed list is non-empty after filtering;
+          // a malformed list silently falls back to defaults.
+          if (items.length > 0) scSources = items;
+        }
+        break;
+      }
+    }
+  }
+
+  return {
+    enabled: scEnabled,
+    sources: scSources,
+  };
+}

package/scripts/lib/config/state-md-lock.mjs

@@ -0,0 +1,83 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * state-md-lock.mjs — Parser for the top-level `state-md-lock:` YAML block
+ * (PRD gsd Pattern Adoption Quick-Wins — Pattern 1 / issues #517, #518).
+ *
+ * Drives the mechanical STATE.md write lock that prevents race conditions
+ * between parallel worker sessions writing the same STATE.md.
+ *
+ * Returns `{ enabled, "timeout-ms" }`.
+ * Tolerant parser: malformed values silently fall back to defaults.
+ *
+ * Consumer: `scripts/lib/session-lock.mjs` (Agent A — adds withStateMdLock()).
+ */
+
+/**
+ * Parse the top-level `state-md-lock:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * Defaults:
+ *   enabled:    true
+ *   timeout-ms: 10000 (integer ≥ 0)
+ *
+ * @param {string} content — full file contents
+ * @returns {{ enabled: boolean, "timeout-ms": number }}
+ */
+export function _parseStateMdLock(content) {
+  const defaults = {
+    enabled: true,
+    'timeout-ms': 10000,
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'state-md-lock')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let smlEnabled = true;
+  let smlTimeoutMs = 10000;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        // Default is true → only flip to false on explicit "false"
+        smlEnabled = v.toLowerCase() !== 'false';
+        break;
+      case 'timeout-ms': {
+        if (/^\d+$/.test(v)) {
+          const n = parseInt(v, 10);
+          if (n >= 0) smlTimeoutMs = n;
+        }
+        break;
+      }
+    }
+  }
+
+  return {
+    enabled: smlEnabled,
+    'timeout-ms': smlTimeoutMs,
+  };
+}

package/scripts/lib/config/templates-first.mjs

@@ -0,0 +1,94 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * templates-first.mjs — Parser for the top-level `templates-first:` YAML block
+ * (PRD gsd Pattern Adoption Quick-Wins — Pattern 3 / issues #517, #519).
+ *
+ * Drives the pre-bash hook that blocks `gh|glab pr|mr|issue create` calls
+ * unless the matching repo template (.github/PULL_REQUEST_TEMPLATE,
+ * .gitlab/merge_request_templates/*, …) was Read in the current session.
+ *
+ * Returns `{ enabled, hosts }`.
+ * Tolerant parser: malformed values silently fall back to defaults.
+ *
+ * Consumer: `hooks/pre-bash-templates-first.mjs` (Wave 2).
+ */
+
+const ALLOWED_HOSTS = new Set(['github', 'gitlab']);
+const DEFAULT_HOSTS = ['github', 'gitlab'];
+
+/**
+ * Parse the top-level `templates-first:` YAML block from markdown content.
+ * Independent of the `## Session Config` section boundary.
+ *
+ * Defaults:
+ *   enabled: true
+ *   hosts:   ['github', 'gitlab']
+ *
+ * @param {string} content — full file contents
+ * @returns {{ enabled: boolean, hosts: string[] }}
+ */
+export function _parseTemplatesFirst(content) {
+  const defaults = {
+    enabled: true,
+    hosts: [...DEFAULT_HOSTS],
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'templates-first')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let tfEnabled = true;
+  let tfHosts = [...DEFAULT_HOSTS];
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        // Default is true → only flip to false on explicit "false"
+        tfEnabled = v.toLowerCase() !== 'false';
+        break;
+      case 'hosts': {
+        const stripped = v.replace(/^\s*\[/, '').replace(/\]\s*$/, '').trim();
+        if (stripped === '') {
+          tfHosts = [];
+        } else {
+          const items = stripped
+            .split(',')
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0)
+            .filter((s) => ALLOWED_HOSTS.has(s));
+          if (items.length > 0) tfHosts = items;
+        }
+        break;
+      }
+    }
+  }
+
+  return {
+    enabled: tfEnabled,
+    hosts: tfHosts,
+  };
+}

package/scripts/lib/config/test.mjs

@@ -0,0 +1,113 @@
+/**
+ * test.mjs — Parser for the top-level `test:` YAML block.
+ *
+ * Mirrors the docs-orchestrator / events-rotation block-parser pattern.
+ * Promoted from the inline _parseTestBlock in scripts/parse-config.mjs
+ * as part of the /test epic (#378) Track B wiring.
+ */
+
+import { validatePathInsideProject } from '../path-utils.mjs';
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * Parse the top-level `test:` YAML block from markdown content.
+ * Returns defaults when the block is absent.
+ * @param {string} content — full CLAUDE.md / AGENTS.md content
+ * @returns {{enabled: boolean, "default-profile": string, "profiles-path": string, mode: string, "retention-days": number}}
+ *   `profiles-path` is stored as an absolute path (realpath-resolved when the target exists,
+ *   lexically-resolved via `path.resolve(cwd, v)` when the target does not exist yet) —
+ *   defeats post-validation symlink-swap TOCTOU (#405, deep-4 deep-5).
+ */
+export function _parseTest(content) {
+  const defaults = {
+    enabled: false,
+    'default-profile': 'smoke',
+    'profiles-path': '.orchestrator/policy/test-profiles.json',
+    mode: 'warn',
+    'retention-days': 30,
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      // Match top-level `test:` key (not indented, no inline value after colon)
+      if (matchBlockHeader(line, 'test')) {
+        inBlock = true;
+      }
+      continue;
+    }
+    // Any non-empty, non-indented line closes the block
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let tcEnabled = false;
+  let tcDefaultProfile = 'smoke';
+  let tcProfilesPath = '.orchestrator/policy/test-profiles.json';
+  let tcMode = 'warn';
+  let tcRetentionDays = 30;
+
+  const validModes = new Set(['warn', 'strict', 'off']);
+
+  for (const rawLine of blockLines) {
+    // Strip inline YAML comments and trailing whitespace
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    // Strip surrounding quotes
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        tcEnabled = v.toLowerCase() === 'true';
+        break;
+      case 'default-profile':
+        if (v) tcDefaultProfile = v;
+        break;
+      case 'profiles-path':
+        if (v) {
+          // SEC-IR-LOW-2 + SEC-Q2-LOW-1 + #402 + #405:
+          // Delegate two-phase path-traversal + symlink-escape guard to the shared helper.
+          // Store the resolved path (not raw v) to defeat TOCTOU symlink-swap attacks (#405).
+          const projectRoot = process.cwd();
+          const result = validatePathInsideProject(v, projectRoot);
+          if (result.ok) {
+            // Store resolved path, not raw v, to defeat TOCTOU symlink-swap (#405)
+            tcProfilesPath = result.realPath || result.lexicalPath;
+          }
+          // Silent skip on failure — matches the lenient pattern of other case branches
+        }
+        break;
+      case 'mode':
+        if (validModes.has(v.toLowerCase())) tcMode = v.toLowerCase();
+        break;
+      case 'retention-days': {
+        if (/^\d+$/.test(v)) {
+          const n = parseInt(v, 10);
+          if (n >= 0) tcRetentionDays = n;
+        }
+        break;
+      }
+    }
+  }
+
+  return {
+    enabled: tcEnabled,
+    'default-profile': tcDefaultProfile,
+    'profiles-path': tcProfilesPath,
+    mode: tcMode,
+    'retention-days': tcRetentionDays,
+  };
+}

package/scripts/lib/config/vault-integration.mjs

@@ -0,0 +1,201 @@
+/**
+ * vault-integration.mjs — Parsers for vault-integration and resource-thresholds
+ * sub-keys.
+ *
+ * `_parseVaultIntegration(content)` reads its block scoped from the raw markdown
+ * content (cold-start.mjs style), matching the pattern used by every other
+ * block-scoped parser in `scripts/lib/config/`. Pre-#593 this parser took a
+ * flat KV map shared with all other blocks — a name-collision time bomb
+ * because `enabled:` is also used by 15+ other blocks (`docs-orchestrator`,
+ * `vault-staleness`, `slopcheck`, etc.). The last `enabled:` line in the file
+ * silently overwrote `vault-integration.enabled: true`.
+ *
+ * `_parseResourceThresholds(kv)` is unchanged: its sub-keys
+ * (`ram-free-min-gb`, `ram-free-critical-gb`, `cpu-load-max-pct`,
+ * `concurrent-sessions-warn`, `ssh-no-docker`) are unique across all blocks,
+ * so a shared KV map has no collision risk.
+ *
+ * Issue #497 inline-object form is preserved on the content-based path —
+ * a `vault-integration: { ... }` line takes precedence over a same-named
+ * block form when both are present.
+ */
+
+import { _coerceBoolean, _coerceInteger } from './coercers.mjs';
+import { matchBlockHeader } from './block-header.mjs';
+
+// ---------------------------------------------------------------------------
+// vault-integration
+// ---------------------------------------------------------------------------
+
+const MODE_ALLOWED = ['warn', 'strict', 'off'];
+
+/**
+ * Parse the top-level `vault-integration:` YAML block (or inline-object literal)
+ * from the markdown content. Independent of the `## Session Config` section
+ * boundary so a baseline using either CLAUDE.md / AGENTS.md baseline-list-item form
+ * (`- vault-integration: { ... }`) or block form is handled identically.
+ *
+ * Supports two source shapes:
+ *   1. Inline object literal on a single line (issue #497):
+ *      `vault-integration: { enabled: true, vault-dir: ~/Projects/vault, mode: warn }`
+ *      (with or without a leading `- ` list-item dash)
+ *   2. Block form with indented sub-keys (default):
+ *      ```
+ *      vault-integration:
+ *        enabled: true
+ *        vault-dir: ~/Projects/vault
+ *        mode: warn
+ *      ```
+ *
+ * The inline form takes precedence when both are present.
+ *
+ * Accepted forms: the bold-bullet markdown rendering of either shape above —
+ * `- **vault-integration:** { ... }` or a `- **vault-integration:**` header
+ * followed by an indented block — is also accepted (#823). The optional `**`
+ * is stripped only immediately around the `key:` token at line start; the
+ * value portion (including any literal `**` inside it) is untouched.
+ *
+ * Defaults:
+ *   enabled:    false
+ *   vault-dir:  null
+ *   mode:       "warn" (invalid values silently fall back to "warn")
+ *   vault-name: null   (absent = downstream callers use deriveRepo() default)
+ *
+ * @param {string} content — full file contents
+ * @returns {{enabled: boolean, "vault-dir": string|null, mode: string, "vault-name": string|null}}
+ */
+export function _parseVaultIntegration(content) {
+  const defaults = { enabled: false, 'vault-dir': null, mode: 'warn', 'vault-name': null };
+  if (typeof content !== 'string' || content === '') return defaults;
+
+  const lines = content.split(/\r?\n/);
+
+  // Pass 1: inline-object form. Matches `vault-integration: { ... }` with or
+  // without a leading `- ` (baseline list-item form per #497).
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    const inlineMatch = line.match(/^(?:-\s+)?(?:\*\*)?vault-integration:(?:\*\*)?\s*(\{[^}]*\})\s*(?:#.*)?$/);
+    if (inlineMatch) {
+      return _parseInlineObject(inlineMatch[1]);
+    }
+  }
+
+  // Pass 2: block form. Find `^vault-integration:\s*$` (header-only line) and
+  // accumulate indented continuation lines until a non-indented line breaks
+  // out of the block.
+  let inBlock = false;
+  const blockLines = [];
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'vault-integration')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+  if (blockLines.length === 0) return defaults;
+
+  let enabled = false;
+  let vaultDir = null;
+  let mode = 'warn';
+  let vaultName = null;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    // Only first-level sub-keys (single indent). Skip deeper nested keys like
+    // `gitlab-groups:` list items (handled as a no-op — they aren't in this
+    // parser's return shape).
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)$/);
+    if (!kvMatch) continue;
+
+    const k = kvMatch[1];
+    let v = kvMatch[2].trim();
+    if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+    else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+    switch (k) {
+      case 'enabled':
+        // Strict booleans only. Anything other than "true"/"false" stays at default (false).
+        if (v.toLowerCase() === 'true') enabled = true;
+        else if (v.toLowerCase() === 'false') enabled = false;
+        break;
+      case 'vault-dir':
+        if (v === '' || v === 'none' || v === 'null') vaultDir = null;
+        else vaultDir = v;
+        break;
+      case 'mode':
+        if (MODE_ALLOWED.includes(v.toLowerCase())) mode = v.toLowerCase();
+        else mode = 'warn'; // silent fallback (parity with pre-#593 behaviour)
+        break;
+      case 'vault-name':
+        if (v === '' || v === 'none' || v === 'null') vaultName = null;
+        else vaultName = v;
+        break;
+    }
+  }
+
+  return { enabled, 'vault-dir': vaultDir, mode, 'vault-name': vaultName };
+}
+
+/**
+ * Parse an inline YAML object literal `{ key: val, key: val }` into the
+ * vault-integration return shape. Supports unquoted values including `~/` paths.
+ *
+ * @param {string} raw — full literal including braces
+ * @returns {{enabled: boolean, "vault-dir": string|null, mode: string}}
+ */
+function _parseInlineObject(raw) {
+  const stripped = raw.replace(/^\s*\{/, '').replace(/\}\s*$/, '').trim();
+  const kv = new Map();
+  if (stripped !== '') {
+    for (const pair of stripped.split(',')) {
+      const colonIdx = pair.indexOf(':');
+      if (colonIdx === -1) continue;
+      const k = pair.slice(0, colonIdx).trim();
+      const v = pair.slice(colonIdx + 1).trim();
+      if (k) kv.set(k, v);
+    }
+  }
+
+  const enabledRaw = kv.get('enabled');
+  const enabled = enabledRaw === 'true' ? true : false;
+  const vaultDirRaw = kv.get('vault-dir');
+  const vaultDir =
+    vaultDirRaw === undefined || vaultDirRaw === '' || vaultDirRaw === 'none' || vaultDirRaw === 'null'
+      ? null
+      : vaultDirRaw;
+  const modeRaw = kv.get('mode') ?? 'warn';
+  const mode = MODE_ALLOWED.includes(modeRaw.toLowerCase()) ? modeRaw.toLowerCase() : 'warn';
+  const vaultNameRaw = kv.get('vault-name');
+  const vaultName =
+    vaultNameRaw === undefined || vaultNameRaw === '' || vaultNameRaw === 'none' || vaultNameRaw === 'null'
+      ? null
+      : vaultNameRaw;
+  return { enabled, 'vault-dir': vaultDir, mode, 'vault-name': vaultName };
+}
+
+// ---------------------------------------------------------------------------
+// resource-thresholds
+// ---------------------------------------------------------------------------
+
+// Sub-key names are deliberately unique across all blocks (no collision with
+// vault-integration / vault-sync / others) because they are flattened into the
+// same KV map by the Session Config parser. See the A5 note in parse-config.sh.
+
+/**
+ * Extract resource-thresholds sub-keys from the Session Config KV map.
+ * @param {Map<string, string>} kv
+ * @returns {{[key: string]: number|boolean}}
+ */
+export function _parseResourceThresholds(kv) {
+  return {
+    'ram-free-min-gb': _coerceInteger(kv, 'ram-free-min-gb', 4),
+    'ram-free-critical-gb': _coerceInteger(kv, 'ram-free-critical-gb', 2),
+    'cpu-load-max-pct': _coerceInteger(kv, 'cpu-load-max-pct', 80),
+    'concurrent-sessions-warn': _coerceInteger(kv, 'concurrent-sessions-warn', 5),
+    'ssh-no-docker': _coerceBoolean(kv, 'ssh-no-docker', true),
+  };
+}

package/scripts/lib/config/vault-mirror-quality.mjs

@@ -0,0 +1,99 @@
+import { matchBlockHeader } from './block-header.mjs';
+
+/**
+ * vault-mirror-quality.mjs — Parser for the top-level `vault-mirror:` YAML block,
+ * extracting the nested `quality:` sub-block (PRD F1.2 / issue #504).
+ *
+ * Returns the consumer-facing shape `{ quality: { "min-narrative-chars": int, "min-confidence": float } }`.
+ * Tolerant parser: malformed values silently fall back to defaults.
+ *
+ * Consumer: `scripts/vault-mirror.mjs` (I4's code).
+ */
+
+/**
+ * Parse the top-level `vault-mirror:` YAML block from markdown content, extracting
+ * the nested `quality:` sub-block. Independent of the `## Session Config` section
+ * boundary (mirrors `_parseEventsRotation` / `_parseVaultStaleness` design).
+ *
+ * Defaults:
+ *   quality.min-narrative-chars: 400 (integer ≥ 0)
+ *   quality.min-confidence:      0.5 (float in [0.0, 1.0])
+ *
+ * @param {string} content — full file contents
+ * @returns {{ quality: { "min-narrative-chars": number, "min-confidence": number } }}
+ */
+export function _parseVaultMirrorQuality(content) {
+  const defaults = {
+    quality: {
+      'min-narrative-chars': 400,
+      'min-confidence': 0.5,
+    },
+  };
+
+  const lines = content.split(/\r?\n/);
+  let inBlock = false;
+  const blockLines = [];
+
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'vault-mirror')) inBlock = true;
+      continue;
+    }
+    // Stop at next top-level (non-indented, non-empty) key
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  if (blockLines.length === 0) return defaults;
+
+  let qMinChars = 400;
+  let qMinConfidence = 0.5;
+  let inQualityBlock = false;
+
+  for (const rawLine of blockLines) {
+    const clean = rawLine.replace(/\s*#.*$/, '').replace(/\s+$/, '');
+    if (!clean.trim()) continue;
+
+    // Deeper-indented key (4+ spaces) → quality sub-key
+    const deepMatch = clean.match(/^\s{4,}([a-zA-Z_-]+):\s*(.*)/);
+    if (deepMatch && inQualityBlock) {
+      const k = deepMatch[1];
+      let v = deepMatch[2].trim();
+      if (v.startsWith('"') && v.endsWith('"') && v.length >= 2) v = v.slice(1, -1);
+      else if (v.startsWith("'") && v.endsWith("'") && v.length >= 2) v = v.slice(1, -1);
+
+      if (k === 'min-narrative-chars') {
+        if (/^\d+$/.test(v)) {
+          const n = parseInt(v, 10);
+          if (n >= 0) qMinChars = n;
+        }
+      } else if (k === 'min-confidence') {
+        if (/^\d+(\.\d+)?$/.test(v)) {
+          const f = parseFloat(v);
+          if (Number.isFinite(f) && f >= 0.0 && f <= 1.0) qMinConfidence = f;
+        }
+      }
+      continue;
+    }
+
+    // Top-level key inside vault-mirror (2-space indent) — looking for `quality:`
+    const kvMatch = clean.match(/^\s+([a-zA-Z_-]+):\s*(.*)/);
+    if (!kvMatch) continue;
+
+    inQualityBlock = false;
+    const k = kvMatch[1];
+    const v = kvMatch[2].trim();
+
+    if (k === 'quality' && v === '') {
+      inQualityBlock = true;
+    }
+  }
+
+  return {
+    quality: {
+      'min-narrative-chars': qMinChars,
+      'min-confidence': qMinConfidence,
+    },
+  };
+}