scrumrun 2.1.1 → 2.3.0

package/lib/security/secrets.js

@@ -1,6 +1,8 @@
 "use strict";
 
 const crypto = require("node:crypto");
+const fs = require("node:fs");
+const path = require("node:path");
 
 const SECRET_PATTERNS = Object.freeze([
   /\bsk-[A-Za-z0-9_-]{16,}\b/,
@@ -34,4 +36,73 @@ function secretFingerprints(value) {
   return [...found].sort();
 }
 
-module.exports = { SECRET_PATTERNS, assertNoSecret, containsSecret, secretFingerprints };
+function parseFrontmatter(text) {
+  const match = String(text || "").match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match) return { explicit: {}, raw: "" };
+  const body = match[1];
+  const explicit = {};
+  for (const line of body.split(/\r?\n/)) {
+    if (!line.trim() || line.trim().startsWith("#")) continue;
+    const kv = line.match(/^([A-Za-z0-9_.-]+)\s*:\s*(.*)$/);
+    if (!kv) continue;
+    const key = kv[1].trim();
+    let value = kv[2].trim();
+    if (value.startsWith("[") && value.endsWith("]")) {
+      value = value.slice(1, -1).split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean);
+    } else if (/^['"].*['"]$/.test(value)) {
+      value = value.slice(1, -1);
+    } else if (value === "true" || value === "false") {
+      value = value === "true";
+    }
+    explicit[key] = value;
+  }
+  return { explicit, raw: body };
+}
+
+function loadSecretAllowlist(scrumDir) {
+  if (!scrumDir || !fs.existsSync(scrumDir)) return new Set();
+  const configFile = path.join(scrumDir, "config.md");
+  if (!fs.existsSync(configFile) || !fs.lstatSync(configFile).isFile()) return new Set();
+  let text;
+  try {
+    text = fs.readFileSync(configFile, "utf8");
+  } catch {
+    return new Set();
+  }
+  const { explicit } = parseFrontmatter(text);
+  const raw = explicit.allow_secrets_in;
+  if (!raw) return new Set();
+  const list = Array.isArray(raw) ? raw : [String(raw)];
+  return new Set(list.map((p) => String(p).replace(/^\.\//, "").trim()).filter(Boolean));
+}
+
+function isSecretAllowed(relativePath, allowlist) {
+  if (!allowlist || !allowlist.size) return false;
+  if (!relativePath) return false;
+  const normalized = String(relativePath).replace(/^\.\//, "");
+  if (allowlist.has(normalized)) return true;
+  for (const entry of allowlist) {
+    if (entry.endsWith("/") && normalized.startsWith(entry)) return true;
+    if (entry.includes("*")) {
+      const re = new RegExp("^" + entry.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*") + "$");
+      if (re.test(normalized)) return true;
+    }
+  }
+  return false;
+}
+
+function containsSecretWithAllowlist(value, relativePath, allowlist) {
+  if (isSecretAllowed(relativePath, allowlist)) return false;
+  return containsSecret(value);
+}
+
+module.exports = {
+  SECRET_PATTERNS,
+  assertNoSecret,
+  containsSecret,
+  containsSecretWithAllowlist,
+  isSecretAllowed,
+  loadSecretAllowlist,
+  parseFrontmatter,
+  secretFingerprints
+};

package/lib/v2/conformance.js

@@ -9,7 +9,7 @@ const { validateRunLedger } = require("../runtime/run-ledger");
 const { indexStatus, mapStatus } = require("../memory/index");
 const { extractEvidence } = require("../memory/markdown");
 const { resolveEvidence } = require("../memory/service");
-const { containsSecret } = require("../security/secrets");
+const { containsSecret, containsSecretWithAllowlist, loadSecretAllowlist } = require("../security/secrets");
 const { pendingTransactionStatus } = require("./transaction");
 const { configWeakeningAttempts, validateGuardrailDocument } = require("../runtime/policy-engine");
 const { auditActiveWorkspace } = require("../runtime/mutation-gateway");
@@ -35,7 +35,8 @@ const INVARIANTS = Object.freeze([
   { id: "I-18", summary: "unsafe and partial writes fail safely", tests: ["canonical writes reject traversal and symlink paths", "repository refuses conflicting overwrite", "interrupted kernel transaction is recovered"] },
   { id: "I-19", summary: "code intelligence is derived and fingerprinted", tests: ["language adapters are replaceable", "moves remap by fingerprint"] },
   { id: "I-20", summary: "learning candidates never block execution", tests: ["post-validation extraction creates candidate insights"] },
-  { id: "I-21", summary: "material mutations are scoped, policy-bound, and fail closed", tests: ["Mutation Gateway rejects bypass and out-of-scope writes", "Run completion rejects unresolved Guardrail obligations"] }
+  { id: "I-21", summary: "material mutations are scoped, policy-bound, and fail closed", tests: ["Mutation Gateway rejects bypass and out-of-scope writes", "Run completion rejects unresolved Guardrail obligations"] },
+  { id: "I-22", summary: "declared search backend matches observed runtime capabilities", tests: ["conformance detects a semantic index that declares fts5 when the runtime does not provide it"] }
 ]);
 
 function finding(severity, code, message, file = null) {
@@ -91,7 +92,8 @@ function auditProject(projectRoot) {
       counts[kind] = artifacts.length;
       for (const artifact of artifacts) {
         for (const error of artifact.errors) findings.push(finding("high", "ARTIFACT_INVALID", `${path.basename(artifact.file)}: ${error}`, artifact.file));
-        if (containsSecret(fs.readFileSync(artifact.file, "utf8"))) findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${path.relative(scrumDir, artifact.file)}.`, artifact.file));
+        const relativeArtifact = path.relative(scrumDir, artifact.file);
+        if (containsSecret(fs.readFileSync(artifact.file, "utf8"))) findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
         if (artifact.record && ids.has(artifact.record.id)) findings.push(finding("critical", "ID_DUPLICATE", `Duplicate artifact id: ${artifact.record.id}`));
         if (artifact.record) ids.add(artifact.record.id);
       }
@@ -212,7 +214,11 @@ function auditProject(projectRoot) {
   }
   try {
     const semantic = indexStatus(projectRoot);
-    if (semantic.exists && semantic.stale) findings.push(finding("warning", "INDEX_STALE", "semantic-index.sqlite is stale and will be rebuilt on query."));
+    if (semantic.exists && semantic.backendMismatch) {
+      findings.push(finding("high", "SEARCH_BACKEND_MISMATCH", `semantic index declares search_backend=${semantic.searchBackend} but the current Node.js runtime does not provide it; delete .scrumrun/.cache/semantic-index.sqlite to rebuild against the observed capabilities.`));
+    } else if (semantic.exists && semantic.stale) {
+      findings.push(finding("warning", "INDEX_STALE", "semantic-index.sqlite is stale and will be rebuilt on query."));
+    }
     const map = mapStatus(projectRoot, { semanticStatus: semantic });
     if (semantic.exists && map.stale) findings.push(finding("warning", "MAP_STALE", `map.md is stale: ${map.reason || map.error || "unknown reason"}.`));
   } catch (error) {

package/lib/v2/migration.js

@@ -3,7 +3,7 @@
 const fs = require("node:fs");
 const path = require("node:path");
 const { extractEvidence } = require("../memory/markdown");
-const { containsSecret } = require("../security/secrets");
+const { containsSecret, containsSecretWithAllowlist, loadSecretAllowlist } = require("../security/secrets");
 const {
   ARTIFACT_TYPES,
   ArtifactRepository,
@@ -297,10 +297,11 @@ function migrationPlan(projectRoot) {
   }));
   const warnings = [];
   const errors = inventory.symlinks.map((entry) => `Symbolic link is not migrated automatically: ${entry.path}`);
+  const secretAllowlist = loadSecretAllowlist(scrumDir);
   for (const entry of inventory.files) {
     if (/(^|\/)vault(?:\.local)?\.md$/i.test(entry.path) || !/\.(?:md|json|txt)$/i.test(entry.path)) continue;
     const content = fs.readFileSync(path.join(scrumDir, entry.path), "utf8");
-    if (containsSecret(content)) errors.push(`Secret-like content detected outside the local vault: ${entry.path}`);
+    if (containsSecretWithAllowlist(content, entry.path, secretAllowlist)) errors.push(`Secret-like content detected outside the local vault: ${entry.path}`);
   }
   const allocator = new IdAllocator(scrumDir);
   const existingArtifacts = Object.fromEntries(Object.keys(ARTIFACT_TYPES).map((kind) => [kind, []]));

package/lib/v2/transaction.js

@@ -236,6 +236,64 @@ function runKernelTransaction(scrumDir, name, changes, options = {}) {
   });
 }
 
+function previewPendingRecovery(scrumDir) {
+  const preview = { plans: [], errors: [] };
+  let entries;
+  try {
+    entries = pendingTransactions(scrumDir);
+  } catch (error) {
+    preview.errors.push(error.message);
+    return preview;
+  }
+  for (const { file, transaction } of entries) {
+    const plan = { id: transaction.id, name: transaction.name || null, journal: path.basename(file), status: transaction.status, action: null, files: [], warnings: [] };
+    const journalErrors = validateJournal(transaction);
+    if (journalErrors.length) {
+      plan.action = "blocked";
+      plan.warnings.push(`journal validation failed: ${journalErrors.join("; ")}`);
+      preview.plans.push(plan);
+      continue;
+    }
+    let unsafePath = null;
+    for (const change of transaction.changes) {
+      const target = relativeTarget(scrumDir, path.join(scrumDir, change.relative));
+      if (target.relative !== change.relative) {
+        unsafePath = change.relative;
+        break;
+      }
+    }
+    if (unsafePath) {
+      plan.action = "blocked";
+      plan.warnings.push(`unsafe transaction target: ${unsafePath}`);
+      preview.plans.push(plan);
+      continue;
+    }
+    const current = transaction.changes.map((change) => ({ change, value: fileSnapshot(scrumDir, change.relative) }));
+    const unexpected = current.filter(({ change, value }) => !sameSnapshot(value, change.before) && !sameSnapshot(value, change.after));
+    if (unexpected.length) {
+      plan.action = "blocked";
+      plan.warnings.push(`would overwrite owner changes at: ${unexpected.map(({ change }) => change.relative).join(", ")}`);
+      preview.plans.push(plan);
+      continue;
+    }
+    if (transaction.status === "prepared") {
+      plan.action = "rollback";
+      plan.files = transaction.changes.map((change) => ({ relative: change.relative, from: "current", to: "pre-transaction" }));
+    } else {
+      const incomplete = current.filter(({ change, value }) => !sameSnapshot(value, change.after));
+      if (incomplete.length) {
+        plan.action = "blocked";
+        plan.warnings.push(`committed transaction is incomplete: ${incomplete.map(({ change }) => change.relative).join(", ")}`);
+      } else {
+        plan.action = "verify-commit";
+        plan.files = transaction.changes.map((change) => ({ relative: change.relative, from: "current", to: "verified-commit" }));
+      }
+    }
+    preview.plans.push(plan);
+  }
+  return preview;
+}
+
 function pendingTransactionStatus(scrumDir) {
   try {
     return { pending: pendingTransactions(scrumDir).map(({ transaction }) => ({ id: transaction.id, name: transaction.name, status: transaction.status })) };
@@ -247,6 +305,7 @@ function pendingTransactionStatus(scrumDir) {
 module.exports = {
   TRANSACTION_SCHEMA,
   pendingTransactionStatus,
+  previewPendingRecovery,
   recoverPendingTransactions,
   recoverPendingTransactionsUnlocked,
   runKernelTransaction,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "2.1.1",
+  "version": "2.3.0",
   "description": "Evidence-driven Agile runtime and semantic project memory for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",
@@ -55,4 +55,4 @@
   "engines": {
     "node": ">=22.13.0"
   }
-}
+}