session-orchestrator 3.23.0 → 4.0.0

package/scripts/lib/config/dispatcher-autonomy-capture.mjs

@@ -39,6 +39,7 @@
 import { readFileSync, writeFileSync } from 'node:fs';
 
 import { hasBlockHeader } from './block-header.mjs';
+import { preprocessBlockLinesNoDash } from './block-preprocess.mjs';
 
 const ALLOWED_AUTONOMY = ['off', 'advisory', 'autonomous-gated'];
 const DEFAULT_CONFIDENCE_FLOOR = 0.5;
@@ -113,6 +114,18 @@ export function getDispatcherAutonomyQuestion() {
  * the shared `matchBlockHeader()` matcher (block-header.mjs). `hasBlockHeader()`
  * splits on `/\r?\n/` and tests each line, so `\r` and trailing whitespace are
  * eaten by the `\s*$` tail and the identical set of inputs matches.
+ *
+ * PARSER PARITY, both halves (#1222): the parser preprocesses its content with
+ * `preprocessBlockLines()` — it STRIPS `<!-- … -->` HTML comments and is
+ * fence-BLIND. This guard therefore preprocesses too, with
+ * `preprocessBlockLinesNoDash()` (comment-strip only; the full
+ * `preprocessBlockLines` additionally de-dashes bold sub-keys, which this
+ * whole-file presence scan has no use for), and stays fence-blind as well. Before
+ * that, a block commented OUT (`<!--\ndispatcher-autonomy:\n  autonomy: off\n-->`)
+ * parsed to DEFAULTS while being reported PRESENT — so the one-time capture AUQ
+ * never fired and the operator was never asked. The two halves must move
+ * together: teach one about comments or fences and the other follows in
+ * lock-step, or the guard and the parser disagree again.
  * Verified-equivalent edge cases:
  *   - CRLF line endings (`dispatcher-autonomy:\r\n`) → PRESENT (`\s*$` eats the `\r`).
  *   - Trailing spaces / tabs on the header line → PRESENT (`\s*$`).
@@ -130,6 +143,15 @@ export function getDispatcherAutonomyQuestion() {
  *   - Header present but BODY malformed (garbage non-yaml lines) → PRESENT. A
  *     malformed block is the operator's to fix, never a re-prompt trigger — the
  *     parser tolerantly falls back to defaults, and capture must not re-ask.
+ *   - Header inside a `<!-- … -->` comment → ABSENT (#1222), matching the parser.
+ *   - Header inside a comment that is never closed (a stray `<!--` with no
+ *     `-->`) → PRESENT. `stripHtmlCommentBlocks()` returns the lines UNFILTERED
+ *     in that case, so nothing silently vanishes, and the parser — which uses the
+ *     same helper — sees the header too. Unlike `_isConfigWeakeningAllowed()` in
+ *     config-protection.mjs, this scan does NOT invert that direction: there the
+ *     scanned line ARMS a bypass, so ambiguity must mean "not armed"; here the
+ *     only cost of a stray PRESENT is one un-asked question, while diverging from
+ *     the parser would re-open exactly the bug this fix closes.
  *
  * No-throw: null / non-string / empty → false.
  *
@@ -138,7 +160,8 @@ export function getDispatcherAutonomyQuestion() {
  */
 export function isDispatcherAutonomyBlockPresent(claudeMdContent) {
   if (typeof claudeMdContent !== 'string' || claudeMdContent.length === 0) return false;
-  return hasBlockHeader(claudeMdContent, 'dispatcher-autonomy');
+  const preprocessed = preprocessBlockLinesNoDash(claudeMdContent).join('\n');
+  return hasBlockHeader(preprocessed, 'dispatcher-autonomy');
 }
 
 /**

package/scripts/lib/config/dispatcher-autonomy.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * dispatcher-autonomy.mjs — Parser + resolver for the top-level
@@ -40,7 +41,7 @@ export function _parseDispatcherAutonomy(content) {
     'confidence-floor': 0.5,
   };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/docs-orchestrator.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * docs-orchestrator.mjs — Parser for the top-level `docs-orchestrator:` YAML block.
@@ -13,7 +14,7 @@ import { matchBlockHeader } from './block-header.mjs';
 export function _parseDocsOrchestrator(content) {
   const defaults = { enabled: false, audiences: ['user', 'dev', 'vault'], mode: 'warn' };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/docs-staleness.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * docs-staleness.mjs — Parser for the top-level `docs-staleness:` YAML block.
@@ -29,7 +30,7 @@ export function _parseDocsStaleness(content) {
     mode: 'warn',
   };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/drift-check.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * drift-check.mjs — Parser for the top-level `drift-check:` YAML block.
@@ -39,7 +40,7 @@ export function _parseDriftCheck(content) {
     'check-docs-parity': true,
   };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/eval.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * eval.mjs — Parser for the top-level `eval:` YAML block (#809, Epic #803).
@@ -51,7 +52,7 @@ const ALLOWED_REPORT = new Set(['html', 'none']);
 export function _parseEval(content) {
   const defaults = { enabled: false, mode: 'warn', judge: 'off', report: 'html', handle: null };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/events-rotation.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * events-rotation.mjs — Parser for the top-level `events-rotation:` YAML block.
@@ -17,7 +18,7 @@ import { matchBlockHeader } from './block-header.mjs';
 export function _parseEventsRotation(content) {
   const defaults = { enabled: true, 'max-size-mb': 10, 'max-backups': 5 };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/evolve.mjs

@@ -35,6 +35,7 @@
 import pathModule from 'node:path';
 
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines, preprocessBlockLinesNoDash } from './block-preprocess.mjs';
 
 /** Per-entry defaults (none beyond the required field-set; documented for symmetry). */
 export const EVOLVE_EXTRA_SOURCE_DEFAULTS = Object.freeze({
@@ -67,7 +68,9 @@ const SAFE_PATH_RE = /^[A-Za-z0-9._~/-]+$/;
  * @returns {Array<{path: string, kind: string, 'learning-type': string}>}
  */
 export function _parseEvolve(content) {
-  const lines = content.split(/\r?\n/);
+  // NoDash: `- ` is the RECORD boundary under `extra-sources:` — de-dashing the
+  // first key of a record would merge it into the previous one (#1162).
+  const lines = preprocessBlockLinesNoDash(content);
   let inEvolve = false;
   let inExtraSources = false;
   const blockLines = [];
@@ -254,7 +257,10 @@ export function _parseEvolveDecay(content) {
     'floor-factor': EVOLVE_DECAY_DEFAULTS['floor-factor'],
   };
 
-  const lines = content.split(/\r?\n/);
+  // Standard variant: this parser reads only FLAT `decay-*` sub-keys and builds
+  // no records, so bold-subkey normalisation is safe here even though the same
+  // `evolve:` block also carries the `extra-sources:` dash records (#1162).
+  const lines = preprocessBlockLines(content);
   let inEvolve = false;
   const blockLines = [];
 

package/scripts/lib/config/frontend-slop-hook.mjs

@@ -18,8 +18,9 @@
 import { promises as fs } from 'node:fs';
 import path from 'node:path';
 
-import { SO_PROJECT_DIR } from '../platform.mjs';
+import { getProjectDir } from '../platform.mjs';
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * Parse the top-level `frontend-slop-hook:` YAML block from markdown content.
@@ -35,7 +36,7 @@ import { matchBlockHeader } from './block-header.mjs';
 export function _parseFrontendSlopHook(content) {
   const defaults = { enabled: false };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 
@@ -86,7 +87,10 @@ export function _parseFrontendSlopHook(content) {
  * @returns {Promise<{ enabled: boolean }>}
  */
 export async function loadFrontendSlopHookConfig(opts = {}) {
-  const root = opts.repoRoot || SO_PROJECT_DIR;
+  // Called at USE time, never at module load: the deprecated `SO_PROJECT_DIR`
+  // named export is a live binding that stays `undefined` until some getter has
+  // run in the process, so a bare call resolved the root to undefined (#1153 P5).
+  const root = opts.repoRoot || getProjectDir();
   const candidates = [
     path.join(root, 'CLAUDE.md'),
     path.join(root, 'AGENTS.md'),

package/scripts/lib/config/gitlab-portfolio.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * gitlab-portfolio.mjs — Parser for the top-level `gitlab-portfolio:` YAML block.
@@ -66,7 +67,7 @@ export function coerceGitlabPortfolio(raw) {
  * @returns {{ enabled: boolean, mode: 'warn'|'strict'|'off', 'stale-days': number, 'critical-labels': string[] }}
  */
 export function _parseGitlabPortfolio(content) {
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/handover-gate.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * handover-gate.mjs — Parser for the top-level `handover-gate:` YAML block
@@ -43,7 +44,7 @@ export function _parseHandoverGate(content) {
     'max-open-questions': 3,
   };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/health-endpoints.mjs

@@ -0,0 +1,388 @@
+/**
+ * health-endpoints.mjs — Content-scoped parser for the `health-endpoints:`
+ * Session Config key, plus the block-form reading of `ecosystem-health:`.
+ *
+ * WHY THIS EXISTS (#1174): `health-endpoints` was read off the FLAT KV map via
+ * `_coerceList`, which bails to `null` the moment a value contains `{` and
+ * cannot see a nested YAML block at all. The ecosystem wizard
+ * (`scripts/lib/ecosystem-wizard/config-writer.mjs` `_buildEcosystemSnippetLines`)
+ * writes exactly the block form:
+ *
+ *   ecosystem-health:
+ *     health-endpoints:
+ *       - name: API
+ *         url: https://api.example.com/health
+ *
+ * Measured before the fix: the flat KV map ended up with bare `name` / `url`
+ * entries (last one wins → silent data loss), `health-endpoints` resolved to
+ * `null`, and because the header line `ecosystem-health:` carries no value it
+ * never matched the KV regex either — so the whole feature stayed dark while
+ * the wizard reported success. Consumers (`skills/ecosystem-health/SKILL.md`,
+ * `docs/session-config-reference.md`) expect an array of `{ name, url }`.
+ *
+ * ACCEPTED FORMS (contract — every one of these is written by some producer in
+ * this repo today):
+ *
+ *   A) inline object array (docs/USER-GUIDE.md):
+ *      health-endpoints: [{name: "API", url: "https://a/health"}, {name: "W", url: "http://w:8080/z"}]
+ *
+ *   B) nested block, top-level OR one level under `ecosystem-health:`
+ *      (the wizard's output, skills/ecosystem-health/wizard.md):
+ *      health-endpoints:
+ *        - name: API
+ *          url: https://a/health
+ *      Block list items may themselves be inline objects
+ *      (`- { name: API, url: … }`) — the form docs/session-config-template.md
+ *      uses.
+ *
+ *   C) bare list of URLs — each URL becomes its own name
+ *      (`{ name: <url>, url: <url> }`). Both spellings are accepted, because
+ *      an operator extending the wizard's BLOCK by hand writes the block one:
+ *        health-endpoints: [https://a/health, https://b/health]
+ *      and
+ *        health-endpoints:
+ *          - https://a/health
+ *
+ *   Empty list (`[]`) → `[]`. `none` / `null` / key absent → `null`.
+ *
+ * NOT accepted (deliberately): the `name=url` shorthand. An item carrying `=`
+ * is treated verbatim as a Form-C URL, never split.
+ *
+ * Malformed input (an entry missing `name` or `url`, an unmatched brace) →
+ * `null` plus exactly ONE `console.warn` line prefixed `config: health-endpoints:`.
+ * Never throws: a broken config key must not take down every session-start.
+ *
+ * Consumers: `scripts/lib/config.mjs` (`health-endpoints`, `ecosystem-health`).
+ *
+ * The header line itself (indent + optional inline value) is matched via the
+ * shared `matchBlockHeaderDetailed()` (#1185) rather than a private regex —
+ * this was the one parser in `scripts/lib/config/` whose header needed BOTH
+ * arbitrary indent (nested under `ecosystem-health:`) AND an inline value
+ * (Form A/C), which the plain `matchBlockHeader()` contract deliberately
+ * excludes. See `scripts/lib/config/block-header.mjs` for the shared matcher.
+ */
+
+import { matchBlockHeader, matchBlockHeaderDetailed } from './block-header.mjs';
+import { preprocessBlockLines, preprocessBlockLinesNoDash } from './block-preprocess.mjs';
+import { _coerceBoolean } from './coercers.mjs';
+
+/**
+ * A scalar that is a URL: a scheme followed by `//`. Used to tell a Form-C
+ * bare-URL list item (`- https://a/health`) from a `key: value` pair
+ * (`- name: API`) inside a block. `https://…` would otherwise match the
+ * key/value regex with key `https`, which is why the check must come first.
+ */
+const URL_SCALAR_RE = /^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//;
+
+/**
+ * Strip a trailing YAML comment. Only a `#` PRECEDED BY WHITESPACE counts, so a
+ * URL fragment (`https://a/health#frag`) survives untouched.
+ * @param {string} s
+ * @returns {string}
+ */
+function stripComment(s) {
+  return s.replace(/\s+#.*$/, '');
+}
+
+/**
+ * Strip one layer of matching surrounding quotes.
+ * @param {string} v
+ * @returns {string}
+ */
+function unquote(v) {
+  if (v.length >= 2 && ((v.startsWith('"') && v.endsWith('"')) || (v.startsWith("'") && v.endsWith("'")))) {
+    return v.slice(1, -1);
+  }
+  return v;
+}
+
+/**
+ * Split on commas that sit at brace/bracket depth 0 and outside quotes — so a
+ * comma inside a quoted URL never splits an entry.
+ * @param {string} s
+ * @returns {string[]}
+ */
+function splitTopLevel(s) {
+  const out = [];
+  let depth = 0;
+  let quote = null;
+  let cur = '';
+  for (const ch of s) {
+    if (quote) {
+      cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") { quote = ch; cur += ch; continue; }
+    if (ch === '{' || ch === '[') depth++;
+    else if (ch === '}' || ch === ']') depth--;
+    if (ch === ',' && depth === 0) { out.push(cur); cur = ''; continue; }
+    cur += ch;
+  }
+  out.push(cur);
+  return out;
+}
+
+/**
+ * Split `{…}, {…}` into the inner text of each object. Quote-aware, so a `}`
+ * inside a quoted value does not close an object.
+ * @param {string} s
+ * @returns {string[]|null} null on an unmatched brace.
+ */
+function splitObjects(s) {
+  const out = [];
+  let depth = 0;
+  let quote = null;
+  let cur = '';
+  for (const ch of s) {
+    if (quote) {
+      if (depth > 0) cur += ch;
+      if (ch === quote) quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'") {
+      quote = ch;
+      if (depth > 0) cur += ch;
+      continue;
+    }
+    if (ch === '{') {
+      depth++;
+      if (depth === 1) { cur = ''; continue; }
+    } else if (ch === '}') {
+      depth--;
+      if (depth < 0) return null;
+      if (depth === 0) { out.push(cur); cur = ''; continue; }
+    }
+    if (depth > 0) cur += ch;
+  }
+  if (depth !== 0 || quote) return null;
+  return out;
+}
+
+/**
+ * Parse the inner text of one `{ name: X, url: Y }` object.
+ * @param {string} inner
+ * @returns {{name: string, url: string}|null} null when name or url is missing.
+ */
+function parseObjectBody(inner) {
+  let name = null;
+  let url = null;
+  for (const pair of splitTopLevel(inner)) {
+    const colonIdx = pair.indexOf(':');
+    if (colonIdx === -1) continue;
+    const k = pair.slice(0, colonIdx).trim().toLowerCase();
+    const v = unquote(pair.slice(colonIdx + 1).trim());
+    if (k === 'name') name = v;
+    else if (k === 'url') url = v;
+  }
+  if (!name || !url) return null;
+  return { name, url };
+}
+
+/**
+ * Parse an inline value (everything right of `health-endpoints:` on one line).
+ * @param {string} raw
+ * @returns {{ok: true, value: {name: string, url: string}[]|null} | {ok: false}}
+ */
+function parseInlineValue(raw) {
+  let v = raw.trim();
+  // A trailing comment is only stripped when the value ends with `]` — that
+  // keeps `#` inside an unbracketed value (a URL fragment) intact.
+  const bracketed = v.match(/^(\[.*\])\s*(?:#.*)?$/s);
+  if (bracketed) v = bracketed[1];
+
+  if (v === '' || v === 'none' || v === 'null') return { ok: true, value: null };
+
+  const stripped = v.replace(/^\[/, '').replace(/\]$/, '').trim();
+  if (stripped === '') return { ok: true, value: [] };
+
+  if (stripped.includes('{')) {
+    const bodies = splitObjects(stripped);
+    if (bodies === null) return { ok: false };
+    const entries = [];
+    for (const body of bodies) {
+      const entry = parseObjectBody(body);
+      if (entry === null) return { ok: false };
+      entries.push(entry);
+    }
+    return entries.length === 0 ? { ok: false } : { ok: true, value: entries };
+  }
+
+  // Form C — bare list of URLs; the URL is its own name.
+  const urls = splitTopLevel(stripped).map((s) => unquote(s.trim())).filter((s) => s.length > 0);
+  if (urls.length === 0) return { ok: true, value: [] };
+  return { ok: true, value: urls.map((u) => ({ name: u, url: u })) };
+}
+
+/**
+ * Parse the indented block that follows a valueless `health-endpoints:` header.
+ * Terminates at the first non-blank line indented no deeper than the header —
+ * the same rule `issue-budget.mjs` uses, generalised so a header nested under
+ * `ecosystem-health:` terminates correctly too.
+ *
+ * @param {string[]} lines — all document lines
+ * @param {number} start — index of the first line after the header
+ * @param {number} headerIndent — indent width of the header line
+ * @returns {{ok: true, value: {name: string, url: string}[]|null} | {ok: false}}
+ */
+function parseBlock(lines, start, headerIndent) {
+  /** @type {{name: string|null, url: string|null}[]} */
+  const entries = [];
+  let cur = null;
+
+  for (let i = start; i < lines.length; i++) {
+    const line = lines[i].replace(/\r$/, '');
+    if (line.trim() === '') continue;
+    const indent = line.match(/^[ \t]*/)[0].length;
+    if (indent <= headerIndent) break;
+
+    const clean = stripComment(line).replace(/\s+$/, '');
+    if (clean.trim() === '') continue;
+
+    const itemMatch = clean.match(/^[ \t]*-\s*(.*)$/);
+    if (itemMatch) {
+      const rest = itemMatch[1].trim();
+      if (rest.startsWith('{')) {
+        const bodies = splitObjects(rest);
+        if (bodies === null || bodies.length === 0) return { ok: false };
+        for (const body of bodies) {
+          const entry = parseObjectBody(body);
+          if (entry === null) return { ok: false };
+          entries.push(entry);
+        }
+        cur = null;
+        continue;
+      }
+      // Form C inside a block: a bare URL item is its own name — the same rule
+      // the inline form applies. Without this, `- https://a/health` fell into
+      // assignKV, matched as key `https`, and the whole key WARNed to null
+      // while the identical inline list parsed fine.
+      const scalar = unquote(rest);
+      if (URL_SCALAR_RE.test(scalar)) {
+        entries.push({ name: scalar, url: scalar });
+        cur = null;
+        continue;
+      }
+      cur = { name: null, url: null };
+      entries.push(cur);
+      if (rest === '') continue;
+      if (!assignKV(cur, rest)) return { ok: false };
+      continue;
+    }
+
+    const kvMatch = clean.match(/^[ \t]*[a-zA-Z][a-zA-Z0-9_-]*:\s*/);
+    if (!kvMatch) return { ok: false };
+    if (cur === null) return { ok: false };
+    if (!assignKV(cur, clean.trim())) return { ok: false };
+  }
+
+  if (entries.length === 0) return { ok: true, value: null };
+  for (const e of entries) {
+    if (!e.name || !e.url) return { ok: false };
+  }
+  return { ok: true, value: entries.map((e) => ({ name: e.name, url: e.url })) };
+}
+
+/**
+ * Assign one `key: value` line into an in-progress entry. Unknown keys are
+ * ignored (forward-compatible with a future `timeout:` sub-key); a line that
+ * is not a `key: value` pair at all is a parse failure.
+ *
+ * @param {{name: string|null, url: string|null}} entry
+ * @param {string} text
+ * @returns {boolean} false when the line is not a key/value pair.
+ */
+function assignKV(entry, text) {
+  const m = text.match(/^([a-zA-Z][a-zA-Z0-9_-]*):\s*(.*)$/);
+  if (!m) return false;
+  const k = m[1].toLowerCase();
+  const v = unquote(m[2].trim());
+  if (k === 'name') entry.name = v;
+  else if (k === 'url') entry.url = v;
+  return true;
+}
+
+/**
+ * Parse `health-endpoints` from the raw markdown content.
+ *
+ * Scans the FULL document (not just the `## Session Config` fence), matching
+ * every sibling block parser in this directory, and takes the FIRST
+ * `health-endpoints:` occurrence — top-level or nested under `ecosystem-health:`.
+ *
+ * @param {string} content — full file contents
+ * @returns {{name: string, url: string}[]|null} `null` when absent, explicitly
+ *   `none`/`null`, or malformed (malformed additionally emits one WARN).
+ */
+export function _parseHealthEndpoints(content) {
+  if (typeof content !== 'string' || content === '') return null;
+
+  // NoDash: `- name:` / `- url:` / `- {name, url}` list items are RECORD
+  // boundaries here — de-dashing would merge two endpoints into one (#1162).
+  const lines = preprocessBlockLinesNoDash(content);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i].replace(/\r$/, '');
+    const m = matchBlockHeaderDetailed(line, 'health-endpoints');
+    if (!m) continue;
+
+    const headerIndent = m.indent;
+    const inline = m.value ?? '';
+    const result = inline !== ''
+      ? parseInlineValue(inline)
+      : parseBlock(lines, i + 1, headerIndent);
+
+    if (!result.ok) {
+      console.warn(
+        `config: health-endpoints: malformed value at line ${i + 1} — expected a list of {name, url} entries; ignoring.`
+      );
+      return null;
+    }
+    return result.value;
+  }
+  return null;
+}
+
+/**
+ * Read `ecosystem-health` in its BLOCK form (`ecosystem-health:` with no value,
+ * followed by an indented body — what the wizard writes). The scalar form
+ * (`ecosystem-health: true`) is read by the caller off the KV map and takes
+ * precedence; this function only answers the case the KV map cannot see.
+ *
+ * A non-empty block means the feature is configured, hence enabled — unless the
+ * block carries an explicit `enabled: false`.
+ *
+ * @param {string} content — full file contents
+ * @returns {boolean|null} `null` when no block form is present (caller keeps its default).
+ */
+export function _parseEcosystemHealthBlockEnabled(content) {
+  if (typeof content !== 'string' || content === '') return null;
+
+  // Standard variant: this parser reads only the flat `enabled:` sub-key and
+  // builds no records (#1162).
+  const lines = preprocessBlockLines(content);
+  let inBlock = false;
+  const blockLines = [];
+  for (const rawLine of lines) {
+    const line = rawLine.replace(/\r$/, '');
+    if (!inBlock) {
+      if (matchBlockHeader(line, 'ecosystem-health')) inBlock = true;
+      continue;
+    }
+    if (line.length > 0 && !/^\s/.test(line)) break;
+    blockLines.push(line);
+  }
+
+  const meaningful = blockLines.filter((l) => stripComment(l).trim() !== '');
+  if (!inBlock || meaningful.length === 0) return null;
+
+  for (const l of meaningful) {
+    const m = stripComment(l).trim().match(/^enabled:\s*(\S+)$/i);
+    // Same truth table as the scalar path — `_coerceBoolean` accepts only
+    // true/false (case-insensitively) and THROWS on anything else. A local
+    // `=== 'true'` comparison silently mapped `yes` to false, so the block form
+    // disagreed with `ecosystem-health: yes` on the very same document.
+    // NB: `_coerceBoolean` uses its `key` argument for BOTH the map lookup and
+    // the error text, so the synthetic map must be keyed by that same string.
+    if (m) return _coerceBoolean(new Map([['ecosystem-health.enabled', m[1]]]), 'ecosystem-health.enabled', false);
+  }
+  return true;
+}

package/scripts/lib/config/issue-budget.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * issue-budget.mjs — Parser for the `issue-budget:` block-style Session Config key.
@@ -65,7 +66,7 @@ export function _parseIssueBudget(content) {
 
   if (typeof content !== 'string' || content === '') return { ...defaults };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/loop-guard.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * loop-guard.mjs — Parser for the top-level `loop-guard:` YAML block
@@ -57,7 +58,7 @@ export function _parseLoopGuard(content) {
     window: DEFAULT_WINDOW,
   };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];
 

package/scripts/lib/config/memory.mjs

@@ -1,4 +1,5 @@
 import { matchBlockHeader } from './block-header.mjs';
+import { preprocessBlockLines } from './block-preprocess.mjs';
 
 /**
  * memory.mjs — Parser for the top-level `memory:` YAML block.
@@ -55,7 +56,7 @@ export function _parseMemory(content) {
     },
   };
 
-  const lines = content.split(/\r?\n/);
+  const lines = preprocessBlockLines(content);
   let inBlock = false;
   const blockLines = [];