scrumrun 4.1.1 → 4.1.2

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes follow Semantic Versioning.
 
 ## Unreleased
 
+## 4.1.2 - 2026-09-22
+
+### Fixed
+
+- **`doctor --strict` now honors `allow_secrets_in`.** The audit pipeline was calling `containsSecret()` directly, ignoring the allowlist declared in `.scrumrun/config.md` frontmatter. Result: files listed under `allow_secrets_in` still triggered `SECRET_CANONICAL`. The audit now loads the allowlist once per run and calls `containsSecretWithAllowlist(text, relativePath, allowlist)` — a straight wiring bug from 4.0. Common false-positive triggers (`password: null`, `password:string`, `password` inside documentation) are now silenceable by whitelisting the specific file(s).
+
 ## 4.1.1 - 2026-09-22
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@
 
 ScrumRun gives an agent a small command surface and a precise project memory: what should be done, how each attempt happened, which decisions constrain the code, and why the architecture exists in its current form.
 
-**Package:** `4.1.1` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
+**Package:** `4.1.2` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
 
 **New here?** Read the [Quickstart](docs/QUICKSTART.md) — first Run in under 10 minutes, no `SPEC.md` reading required. Full docs map in [`docs/INDEX.md`](docs/INDEX.md).
 

package/lib/v2/conformance.js

@@ -132,6 +132,7 @@ function auditProject(projectRoot, options = {}) {
   const counts = {};
   const ids = new Set();
   const records = {};
+  const secretAllowlist = loadSecretAllowlist(scrumDir);
   for (const kind of Object.keys(ARTIFACT_TYPES)) {
     try {
       const artifacts = repository.list(kind);
@@ -140,7 +141,9 @@ function auditProject(projectRoot, options = {}) {
       for (const artifact of artifacts) {
         for (const error of artifact.errors) findings.push(finding("high", "ARTIFACT_INVALID", `${path.basename(artifact.file)}: ${error}`, artifact.file));
         const relativeArtifact = path.relative(scrumDir, artifact.file);
-        if (containsSecret(fs.readFileSync(artifact.file, "utf8"))) findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
+        if (containsSecretWithAllowlist(fs.readFileSync(artifact.file, "utf8"), relativeArtifact, secretAllowlist)) {
+          findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
+        }
         if (artifact.record && ids.has(artifact.record.id)) findings.push(finding("critical", "ID_DUPLICATE", `Duplicate artifact id: ${artifact.record.id}`));
         if (artifact.record) ids.add(artifact.record.id);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "4.1.1",
+  "version": "4.1.2",
   "description": "Markdown-first Agile memory and guardrails for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",