scrumrun 4.1.0 → 4.1.2

package/CHANGELOG.md

@@ -4,6 +4,23 @@ All notable changes follow Semantic Versioning.
 
 ## Unreleased
 
+## 4.1.2 - 2026-09-22
+
+### Fixed
+
+- **`doctor --strict` now honors `allow_secrets_in`.** The audit pipeline was calling `containsSecret()` directly, ignoring the allowlist declared in `.scrumrun/config.md` frontmatter. Result: files listed under `allow_secrets_in` still triggered `SECRET_CANONICAL`. The audit now loads the allowlist once per run and calls `containsSecretWithAllowlist(text, relativePath, allowlist)` — a straight wiring bug from 4.0. Common false-positive triggers (`password: null`, `password:string`, `password` inside documentation) are now silenceable by whitelisting the specific file(s).
+
+## 4.1.1 - 2026-09-22
+
+### Added
+
+- **`scrumrun update --repair-legacy`.** New flag runs `repair --apply` after refreshing project guidance, so a single `scrumrun update --project --repair-legacy` upgrades the CLI, refreshes packaged Markdown, and normalizes the local `.scrumrun/` tree in one shot. The repair pass covers status aliases, `feature:` free-text kebab labels, guardrail scopes, missing frontmatter, orphaned Runs/Tasks, and legacy Sprint projections — never touches secrets (they always require human review).
+
+### Changed
+
+- **Broader status aliases in `scrumrun repair`.** `TASK_STATUS_ALIAS` now maps `pending`, `planned`, `skipped`, `canceled`, `wontdo`/`won't do`, `wip`, `doing`, `in-progress`, `review`, `reviewing`, `finished`, `closed` alongside the existing `done`/`todo`/`complete`/`in_progress`/`executing`/`active`. `RUN_STATUS_ALIAS` gains `in-progress`, `wip`, `finished`, `closed`, `canceled`/`cancelled`, `skipped`, `running`. `doctor --strict` remains strict for fresh installs; the aliases only take effect when an owner explicitly runs `repair --apply` (or `update --repair-legacy`).
+- **Guardrail scope parser tolerates parentheses and `+` separators.** `Scope: frontend + backend` and `Scope: frontend (vue templates, docs)` now parse to the intended token(s) instead of splitting on commas inside parens and producing bogus scope names. Unknown scopes still fail conformance in fresh installs — `repair` rewrites them to `all` when normalizing legacy projects.
+
 ## 4.1.0 - 2026-09-22
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@
 
 ScrumRun gives an agent a small command surface and a precise project memory: what should be done, how each attempt happened, which decisions constrain the code, and why the architecture exists in its current form.
 
-**Package:** `4.1.0` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
+**Package:** `4.1.2` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
 
 **New here?** Read the [Quickstart](docs/QUICKSTART.md) — first Run in under 10 minutes, no `SPEC.md` reading required. Full docs map in [`docs/INDEX.md`](docs/INDEX.md).
 

package/bin/scrumrun.js

@@ -61,7 +61,7 @@ Usage:
   scrumrun <noun> <subject> <action> [args]
   scrumrun sc <noun> <subject> <action> [args]  # compatibility alias
   scrumrun install [all|codex|opencode|claude] [--force]
-  scrumrun update  [all|codex|opencode|claude] [--project] [--seal-policy] [--migrate] [--verbose]
+  scrumrun update  [all|codex|opencode|claude] [--project] [--seal-policy] [--migrate] [--repair-legacy] [--verbose]
   scrumrun init [--local|--shared] [--lean] [--no-agent-hint] [--force]
   scrumrun status
   scrumrun core [--path|--prompt]
@@ -398,7 +398,7 @@ function refreshProjectGuidance(cwd = process.cwd()) {
   return results;
 }
 
-function updateInstallation(target, { migrate = false, project = false, sealPolicy = false, verbose = false } = {}) {
+function updateInstallation(target, { migrate = false, project = false, sealPolicy = false, verbose = false, repairLegacy = false } = {}) {
   installVerbose = verbose;
   installSummary.cleaned = 0;
   installSummary.written = 0;
@@ -414,6 +414,18 @@ function updateInstallation(target, { migrate = false, project = false, sealPoli
     const sealed = writeFile(marker, sealPolicyIntegrity(scrumDir, { includeGuardrails: true }), { backup: true });
     projectResults.push({ status: sealed.changed ? "updated" : "skipped", dest: marker, backup: sealed.backup });
   }
+  let repairSummary = "";
+  if (repairLegacy && v2Project()) {
+    try {
+      const { repair } = require(path.join(root, "lib", "commands", "repair"));
+      const scrumDir = path.join(process.cwd(), ".scrumrun");
+      const result = repair(scrumDir, { apply: true, recoverOrphanTasks: true });
+      const applied = (result.plan && result.plan.entries && result.plan.entries.length) || 0;
+      repairSummary = ` Legacy repair: ${applied} entry(ies) normalized.`;
+    } catch (error) {
+      repairSummary = ` Legacy repair skipped: ${error.message}.`;
+    }
+  }
   if (migrate && v2Project()) {
     try {
       refreshState(path.join(process.cwd(), ".scrumrun"));
@@ -425,7 +437,7 @@ function updateInstallation(target, { migrate = false, project = false, sealPoli
   if (!verbose) {
     const targetSummary = installSummary.targets.join(", ") || "no clients";
     const projectSummary = projectResults.length ? ` Project guidance: ${projectResults.filter((item) => item.status === "updated").length} file(s) refreshed.` : "";
-    console.log(`Updated ${targetSummary} — ${installSummary.written} files written, ${installSummary.cleaned} legacy removed.${projectSummary} Run with --verbose to see file paths.`);
+    console.log(`Updated ${targetSummary} — ${installSummary.written} files written, ${installSummary.cleaned} legacy removed.${projectSummary}${repairSummary} Run with --verbose to see file paths.`);
   }
   return migration;
 }
@@ -2696,7 +2708,7 @@ if (!command || command === "--help" || command === "-h") {
   console.log(`ScrumRun ${version}`);
 } else if (command === "install" || command === "update") {
   const target = ["all", "codex", "opencode", "claude"].includes(args[1]) ? args[1] : "all";
-  if (command === "update") updateInstallation(target, { migrate: args.includes("--migrate"), project: args.includes("--project"), sealPolicy: args.includes("--seal-policy"), verbose: args.includes("--verbose") });
+  if (command === "update") updateInstallation(target, { migrate: args.includes("--migrate"), project: args.includes("--project"), sealPolicy: args.includes("--seal-policy"), verbose: args.includes("--verbose"), repairLegacy: args.includes("--repair-legacy") });
   else install(target, true, { compatibility: false });
 } else if (command === "sc") {
   runRoot(args.slice(1));

package/lib/commands/repair.js

@@ -51,17 +51,38 @@ const VALID_RUN_STATUS = new Set(["executing", "validating", "learning", "partia
 const TASK_STATUS_ALIAS = {
   done: "completed",
   todo: "backlog",
+  pending: "backlog",
+  planned: "backlog",
   complete: "completed",
+  finished: "completed",
+  closed: "completed",
+  skipped: "cancelled",
+  canceled: "cancelled",
+  wontdo: "cancelled",
+  "won't do": "cancelled",
   in_progress: "running",
-  executing: "running",   // Task uses "running", Run uses "executing"
-  active: "running"
+  "in-progress": "running",
+  wip: "running",
+  doing: "running",
+  executing: "running",
+  active: "running",
+  review: "validating",
+  reviewing: "validating"
 };
 
 const RUN_STATUS_ALIAS = {
   complete: "completed",
   in_progress: "executing",
+  "in-progress": "executing",
+  running: "executing",
+  wip: "executing",
   done: "completed",
-  partial: "failed"
+  finished: "completed",
+  closed: "completed",
+  partial: "failed",
+  canceled: "blocked",
+  cancelled: "blocked",
+  skipped: "blocked"
 };
 
 // When syncing Task.status from latest Run.status, translate Run vocabulary

package/lib/runtime/policy-engine.js

@@ -72,7 +72,8 @@ function parseGuardrails(content) {
     const rule = capped(fields.rule || proseRule(block) || title);
     const status = normalized(fields.status || "active").replace(/[._-]+$/, "");
     const enforcement = normalized(fields.enforcement || inferEnforcement(title, rule));
-    const scope = (fields.scope || "all").split(/\s*,\s*/).map((value) => normalized(value)).filter(Boolean);
+    const rawScope = String(fields.scope || "all").replace(/\([^)]*\)/g, "");
+    const scope = rawScope.split(/\s*[,+]\s*/).map((value) => normalized(value)).filter(Boolean);
     const declarative = enforcementBlock(block, heading[1]);
     return {
       id: heading[1],

package/lib/v2/conformance.js

@@ -132,6 +132,7 @@ function auditProject(projectRoot, options = {}) {
   const counts = {};
   const ids = new Set();
   const records = {};
+  const secretAllowlist = loadSecretAllowlist(scrumDir);
   for (const kind of Object.keys(ARTIFACT_TYPES)) {
     try {
       const artifacts = repository.list(kind);
@@ -140,7 +141,9 @@ function auditProject(projectRoot, options = {}) {
       for (const artifact of artifacts) {
         for (const error of artifact.errors) findings.push(finding("high", "ARTIFACT_INVALID", `${path.basename(artifact.file)}: ${error}`, artifact.file));
         const relativeArtifact = path.relative(scrumDir, artifact.file);
-        if (containsSecret(fs.readFileSync(artifact.file, "utf8"))) findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
+        if (containsSecretWithAllowlist(fs.readFileSync(artifact.file, "utf8"), relativeArtifact, secretAllowlist)) {
+          findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
+        }
         if (artifact.record && ids.has(artifact.record.id)) findings.push(finding("critical", "ID_DUPLICATE", `Duplicate artifact id: ${artifact.record.id}`));
         if (artifact.record) ids.add(artifact.record.id);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "4.1.0",
+  "version": "4.1.2",
   "description": "Markdown-first Agile memory and guardrails for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",