scrumrun 2.7.3 → 2.7.6

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes follow Semantic Versioning.
 
 ## Unreleased
 
+## 2.7.6 - 2026-08-24
+
+### Added
+
+- **Branch tracking on artifacts.** Task, Feature, Sprint, and Run artifacts now record the active git branch in a `branch` frontmatter field at creation time (`null` outside a git repo). `sc plan task --list` and the generated `map.md` show the branch, giving a human-readable "which branch did this work originate from" reference index to complement the exact commit SHA already captured in each Run's workspace baseline.
+
+## 2.7.5 - 2026-08-22
+
+### Added
+
+- **Project-root discovery.** The `sc` CLI now walks up from the current directory to find the nearest `.scrumrun/method.json`, so commands run from any subdirectory (e.g. `app/front`) operate on the project root instead of failing with a cryptic "Mutation Gateway requires a valid method.json" error. `sc config init` and `sc-init` still initialize in the current directory.
+
+### Fixed
+
+- **Missing-project error.** `sc plan task --add` now reports a clear "ScrumRun project not found" message (with `scrumrun init` / run-from-root guidance) instead of leaking an internal ENOENT, and no longer leaves a stray `.scrumrun/.cache` lock directory behind when the command is run outside a project.
+
+## 2.7.4 - 2026-08-22
+
+### Fixed
+
+- **Approval token truncated in interactive intake.** The pretty terminal renderer was shrinking the approval command to the first 20 characters of the token, so a copy-pasted `sc plan intake --approve …` failed with "Approval token is malformed or was modified." The full token now renders wrapped across lines (copyable, no ellipsis), and `decodeApproval` strips surrounding/interstitial whitespace so pasted tokens with line breaks or spaces still validate.
+
 ## 2.7.3 - 2026-08-22
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@
 
 ScrumRun gives an agent a small command surface and a precise project memory: what should be done, how each attempt happened, which decisions constrain the code, and why the architecture exists in its current form.
 
-**Package:** `2.7.3` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
+**Package:** `2.7.6` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
 
 **New here?** Read the [Quickstart](docs/QUICKSTART.md) — first Run in under 10 minutes, no `SPEC.md` reading required. Full docs map in [`docs/INDEX.md`](docs/INDEX.md).
 

package/bin/scrumrun.js

@@ -1198,6 +1198,25 @@ function v2Project(cwd = process.cwd()) {
   }
 }
 
+function findProjectRoot(startDir = process.cwd()) {
+  let dir = path.resolve(startDir);
+  while (true) {
+    const marker = path.join(dir, ".scrumrun", "method.json");
+    if (fs.existsSync(marker) && !fs.lstatSync(marker).isSymbolicLink() && fs.lstatSync(marker).isFile()) {
+      return dir;
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+function chdirToProjectRoot() {
+  const root = findProjectRoot();
+  if (root && root !== process.cwd()) process.chdir(root);
+  return root;
+}
+
 function optionValues(args, flag) {
   const values = [];
   for (let index = 0; index < args.length; index++) {
@@ -1518,7 +1537,11 @@ function executeRootRoute(route) {
   if (noun === "plan" && ["task", "run", "feature", "sprint"].includes(subject) && ["--list", "--show"].includes(routeArgs[0])) {
     const repository = new ArtifactRepository(projectFile());
     if (routeArgs[0] === "--list") {
-      const artifacts = repository.list(subject).map((artifact) => `${artifact.record.id} | ${artifact.record.status} | ${((artifact.body || "").match(/^# ([^\r\n]+)/m) || [])[1] || artifact.record.id}`);
+      const artifacts = repository.list(subject).map((artifact) => {
+        const title = ((artifact.body || "").match(/^# ([^\r\n]+)/m) || [])[1] || artifact.record.id;
+        const branch = artifact.record.branch ? ` [${artifact.record.branch}]` : "";
+        return `${artifact.record.id} | ${artifact.record.status} | ${title}${branch}`;
+      });
       console.log(artifacts.length ? artifacts.join("\n") : `No ${subject} artifacts.`);
     } else {
       const artifact = repository.read(subject, routeArgs[1]);
@@ -1644,6 +1667,7 @@ function runRoot(parts) {
     process.exitCode = 1;
     return;
   }
+  if (!(route.noun === "config" && route.subject === "init")) chdirToProjectRoot();
   return executeRootRoute(route);
 }
 
@@ -1652,6 +1676,7 @@ function runCompatibilityAlias(alias, parts) {
   console.warn(`Deprecated: ${alias} now executes /sc ${route.noun} ${route.subject}.`);
   if (route.note) console.warn(route.note);
   if (alias === "sc-backlog") return runBacklog(parts);
+  if (alias !== "sc-init") chdirToProjectRoot();
   return executeRootRoute({ type: "route", noun: route.noun, subject: route.subject, args: route.args });
 }
 

package/lib/commands/pretty-intake.js

@@ -89,6 +89,15 @@ function wrap(text, width) {
   return lines.length ? lines : [""];
 }
 
+function hardWrap(text, width) {
+  const source = String(text || "");
+  const lines = [];
+  for (let index = 0; index < source.length; index += width) {
+    lines.push(source.slice(index, index + width));
+  }
+  return lines.length ? lines : [""];
+}
+
 function boxTop(width, title) {
   const label = ` ${title} `;
   const remaining = width - visibleLength(label) - 4;
@@ -154,16 +163,6 @@ function fieldLine(label, value, width, valueColor = FG.white, labelColor = FG.g
   return rendered;
 }
 
-function commandBox(interiorWidth, command) {
-  const inside = ` $ ${command} `;
-  const boxWidth = Math.min(interiorWidth, visibleLength(inside) + 4);
-  const top = paint(DIM_ACID_FG, `┌${"─".repeat(boxWidth - 2)}┐`);
-  const bottom = paint(DIM_ACID_FG, `└${"─".repeat(boxWidth - 2)}┘`);
-  const content = padEnd(inside, boxWidth - 2);
-  const middle = `${paint(DIM_ACID_FG, "│")}${paint(ACID_FG, content)}${paint(DIM_ACID_FG, "│")}`;
-  return [top, middle, bottom];
-}
-
 function pipelineDetail(stage, plan) {
   if (stage === "POLICY") {
     return `${plan.policy.checked.length} checked · ${plan.policy.deferred.length} deferred`;
@@ -240,16 +239,15 @@ function renderIntake(plan) {
       }
     }
   } else if (plan.approvalToken) {
-    const command = `scrumrun sc plan intake --approve ${plan.approvalToken}`;
-    const truncated = command.length > width - 8 ? `scrumrun sc plan intake --approve ${plan.approvalToken.slice(0, 20)}…` : command;
-    for (const boxRow of commandBox(width - 6, truncated)) {
-      lines.push(boxLine(width, `  ${boxRow}`));
+    const command = "scrumrun sc plan intake --approve";
+    const tokenWidth = Math.max(16, width - 8);
+    lines.push(boxLine(width, `  ${paint(FG.gray, "APPROVE · copy the command below to create Task + Run")}`));
+    lines.push(boxLine(width, `  ${paint(ACID_FG, "$")} ${paint(FG.white, command)}`));
+    for (const chunk of hardWrap(plan.approvalToken, tokenWidth)) {
+      lines.push(boxLine(width, `    ${paint(DIM_ACID_FG, chunk)}`));
     }
     lines.push(boxBlank(width));
     lines.push(boxLine(width, `  ${paint(FG.gray, "[ awaiting owner approval ]")}`));
-    if (command.length !== truncated.length) {
-      lines.push(boxLine(width, `  ${paint(FG.gray, "(full token above is truncated for display; copy from --json if needed)")}`));
-    }
   }
   lines.push(boxBlank(width));
   lines.push(boxBottom(width));

package/lib/memory/index.js

@@ -12,7 +12,7 @@ const { containsSecret } = require("../security/secrets");
 const { canonicalWatchSnapshot, fileWatchSnapshot } = require("../runtime/canonical-snapshot");
 
 const CACHE_RELATIVE = path.join(".cache", "semantic-index.sqlite");
-const INDEX_SCHEMA_VERSION = 4;
+const INDEX_SCHEMA_VERSION = 5;
 const INACTIVE = new Set(["rejected", "invalidated", "deprecated", "archived"]);
 const SEARCH_BACKENDS = new Set(["auto", "fts5", "like"]);
 const MAX_SEARCH_TOKENS = 32;
@@ -124,6 +124,7 @@ function createSchema(database, { searchBackend = "auto" } = {}) {
       path TEXT NOT NULL UNIQUE,
       hash TEXT NOT NULL,
       content TEXT NOT NULL,
+      branch TEXT,
       valid_from TEXT,
       valid_until TEXT,
       last_verified_commit TEXT,
@@ -380,7 +381,7 @@ function rebuildIndex(projectRoot, { searchBackend = "auto" } = {}) {
   try {
     database = new DatabaseSync(temp);
     selectedSearchBackend = createSchema(database, { searchBackend });
-    const insertArtifact = database.prepare("INSERT INTO artifacts(id, kind, status, title, path, hash, content, valid_from, valid_until, last_verified_commit, review_trigger, search_text, active) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
+    const insertArtifact = database.prepare("INSERT INTO artifacts(id, kind, status, title, path, hash, content, branch, valid_from, valid_until, last_verified_commit, review_trigger, search_text, active) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)");
     const insertFts = selectedSearchBackend === "fts5"
       ? database.prepare("INSERT INTO artifacts_fts(id, title, content) VALUES (?, ?, ?)")
       : null;
@@ -400,6 +401,7 @@ function rebuildIndex(projectRoot, { searchBackend = "auto" } = {}) {
           artifact.path,
           sha256(artifact.content),
           artifact.content,
+          artifact.record.branch || null,
           artifact.record.valid_from || null,
           artifact.record.valid_until || null,
           artifact.record.last_verified_commit || null,
@@ -690,7 +692,7 @@ function graphIndex(projectRoot, { rebuild = true } = {}) {
   else if (status.stale) throw new Error("Semantic index is missing or stale; rebuild it first.");
   const database = new DatabaseSync(indexPath(projectRoot), { readOnly: true });
   try {
-    const artifacts = database.prepare("SELECT id, kind, status, title, path, 'artifact' AS node_type FROM artifacts ORDER BY id").all();
+    const artifacts = database.prepare("SELECT id, kind, status, title, path, branch, 'artifact' AS node_type FROM artifacts ORDER BY id").all();
     const code = database.prepare("SELECT id, kind, status, name AS title, path, 'code' AS node_type, fingerprint, remapped_from FROM code_nodes ORDER BY id").all();
     return {
       nodes: [...artifacts, ...code],
@@ -725,7 +727,10 @@ function writeMap(projectRoot, { nodeLimit = 200, edgeLimit = 400 } = {}) {
     "",
     "## Nodes",
     "",
-    ...(nodes.length ? nodes.map((node) => `- ${node.id} | ${node.node_type} | ${node.kind} | ${node.status} | ${node.title} | ${node.path}`) : ["- None."]),
+    ...(nodes.length ? nodes.map((node) => {
+      const branch = node.branch ? ` | branch:${node.branch}` : "";
+      return `- ${node.id} | ${node.node_type} | ${node.kind} | ${node.status} | ${node.title} | ${node.path}${branch}`;
+    }) : ["- None."]),
     ...(graph.nodes.length > nodes.length ? [`- … ${graph.nodes.length - nodes.length} more nodes in the semantic index.`] : []),
     "",
     "## Relations",

package/lib/runtime/orchestrator.js

@@ -19,6 +19,7 @@ const { agentIdentity, evaluatePolicy } = require("./policy-engine");
 const { artifactSnapshot, canonicalFingerprint, canonicalWatchSnapshot } = require("./canonical-snapshot");
 const { decodeApproval } = require("./request-engine");
 const { containsSecret } = require("../security/secrets");
+const { currentBranch } = require("./workspace-state");
 const { extractLearningCandidates } = require("../code-intel/learning");
 const { appendRunEvent, appendTechnicalSummary, createRunBody, instant } = require("./run-ledger");
 const { generateBriefing } = require("./briefing");
@@ -103,6 +104,7 @@ function approveRequestUnlocked(projectRoot, token, { failurePoint = null, inter
   const created = date();
   const enforceablePolicy = policyState(projectRoot);
   const baseline = publicWorkspace(workspace);
+  const branch = currentBranch(projectRoot);
   const taskId = nextId(repository, "task");
   const runId = nextId(repository, "run");
   const task = {
@@ -115,6 +117,7 @@ function approveRequestUnlocked(projectRoot, token, { failurePoint = null, inter
     method: METHOD_VERSION,
     feature: null,
     sprint: null,
+    branch,
     assignee: agentIdentity(scrumDir) || "agent",
     approval_id: approvalId,
     context_fingerprint: payload.fingerprint,
@@ -129,6 +132,7 @@ function approveRequestUnlocked(projectRoot, token, { failurePoint = null, inter
     method: METHOD_VERSION,
     task: taskId,
     sprint: null,
+    branch,
     attempt: 1,
     ledger: 1,
     guardrails: 1,
@@ -304,6 +308,7 @@ function retryTaskUnlocked(projectRoot, taskId, { note = "Retry explicitly appro
     method: METHOD_VERSION,
     task: taskId,
     sprint: taskArtifact.record.sprint || null,
+    branch: currentBranch(projectRoot),
     attempt: attempts.length ? Math.max(...attempts) + 1 : 1,
     ledger: 1,
     guardrails: 1,
@@ -374,6 +379,7 @@ function startBacklogTaskUnlocked(projectRoot, taskId, { note = "Backlog Task st
     method: METHOD_VERSION,
     task: taskId,
     sprint: taskArtifact.record.sprint || null,
+    branch: currentBranch(projectRoot),
     attempt: 1,
     ledger: 1,
     guardrails: 1,
@@ -504,7 +510,8 @@ function addPlanArtifactUnlocked(projectRoot, kind, label, { type = null, status
     status: chosenStatus,
     created,
     updated: created,
-    method: METHOD_VERSION
+    method: METHOD_VERSION,
+    branch: currentBranch(projectRoot)
   };
   if (kind === "task") {
     record.type = chosenType;
@@ -521,6 +528,10 @@ function addPlanArtifactUnlocked(projectRoot, kind, label, { type = null, status
 
 function addPlanArtifact(projectRoot, kind, label, options = {}) {
   const scrumDir = path.join(projectRoot, ".scrumrun");
+  const methodFile = path.join(scrumDir, "method.json");
+  if (!fs.existsSync(methodFile) || !fs.lstatSync(methodFile).isFile()) {
+    throw new Error(`ScrumRun project not found in ${projectRoot}. Run \`scrumrun init\` there, or run this command from inside the project.`);
+  }
   return withArtifactLock(scrumDir, "create", () => addPlanArtifactUnlocked(projectRoot, kind, label, options));
 }
 

package/lib/runtime/request-engine.js

@@ -82,7 +82,8 @@ function encodeApproval(plan) {
 }
 
 function decodeApproval(token) {
-  const [encoded, checksum, extra] = String(token || "").split(".");
+  const cleaned = String(token || "").replace(/\s+/g, "");
+  const [encoded, checksum, extra] = cleaned.split(".");
   if (!encoded || !checksum || extra || sha256(`scrumrun-v2-approval\0${encoded}`) !== checksum) {
     throw new Error("Approval token is malformed or was modified.");
   }

package/lib/runtime/workspace-state.js

@@ -110,6 +110,16 @@ function workspaceState(projectRoot) {
   return { ...state, fingerprint: sha256(stable(canonical)) };
 }
 
+function currentBranch(projectRoot) {
+  try {
+    const branch = gitOutput(projectRoot, ["rev-parse", "--abbrev-ref", "HEAD"]).toString("utf8").trim();
+    if (!branch || branch === "HEAD") return null;
+    return branch;
+  } catch {
+    return null;
+  }
+}
+
 function changesBetween(before, after) {
   if (!before || !after || before.mode !== after.mode || before.head !== after.head) throw new Error("Workspace baseline mode or Git HEAD changed during the Run.");
   const left = new Map(before.files.map((item) => [item.path, item]));
@@ -139,6 +149,7 @@ function pathAuthorized(relative, allowed) {
 
 module.exports = {
   changesBetween,
+  currentBranch,
   normalizedRelative,
   pathAuthorized,
   stable,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "2.7.3",
+  "version": "2.7.6",
   "description": "Evidence-driven Agile runtime and semantic project memory for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",