scrumrun 4.1.1 → 4.1.3

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes follow Semantic Versioning.
 
 ## Unreleased
 
+## 4.1.3 - 2026-09-22
+
+### Fixed
+
+- **`parseFrontmatter` handles multi-line arrays and YAML block lists.** The inline `allow_secrets_in: [a,\nb,\nc]` and the block form `allow_secrets_in:\n  - a\n  - b` used to be parsed as a single truncated string, silently disabling the whitelist. The parser now (a) keeps reading until the closing `]` for multi-line inline arrays, and (b) recognizes `- item` block lists as an array value. Existing single-line inline arrays continue to work.
+
+## 4.1.2 - 2026-09-22
+
+### Fixed
+
+- **`doctor --strict` now honors `allow_secrets_in`.** The audit pipeline was calling `containsSecret()` directly, ignoring the allowlist declared in `.scrumrun/config.md` frontmatter. Result: files listed under `allow_secrets_in` still triggered `SECRET_CANONICAL`. The audit now loads the allowlist once per run and calls `containsSecretWithAllowlist(text, relativePath, allowlist)` — a straight wiring bug from 4.0. Common false-positive triggers (`password: null`, `password:string`, `password` inside documentation) are now silenceable by whitelisting the specific file(s).
+
 ## 4.1.1 - 2026-09-22
 
 ### Added

package/README.md

@@ -4,7 +4,7 @@
 
 ScrumRun gives an agent a small command surface and a precise project memory: what should be done, how each attempt happened, which decisions constrain the code, and why the architecture exists in its current form.
 
-**Package:** `4.1.1` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
+**Package:** `4.1.3` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
 
 **New here?** Read the [Quickstart](docs/QUICKSTART.md) — first Run in under 10 minutes, no `SPEC.md` reading required. Full docs map in [`docs/INDEX.md`](docs/INDEX.md).
 

package/lib/security/secrets.js

@@ -41,12 +41,42 @@ function parseFrontmatter(text) {
   if (!match) return { explicit: {}, raw: "" };
   const body = match[1];
   const explicit = {};
-  for (const line of body.split(/\r?\n/)) {
-    if (!line.trim() || line.trim().startsWith("#")) continue;
+  const rawLines = body.split(/\r?\n/);
+  let index = 0;
+  while (index < rawLines.length) {
+    const line = rawLines[index];
+    if (!line.trim() || line.trim().startsWith("#")) { index += 1; continue; }
     const kv = line.match(/^([A-Za-z0-9_.-]+)\s*:\s*(.*)$/);
-    if (!kv) continue;
+    if (!kv) { index += 1; continue; }
     const key = kv[1].trim();
     let value = kv[2].trim();
+
+    // Inline array that spans multiple lines: keep reading until we see the closing `]`.
+    if (value.startsWith("[") && !value.endsWith("]")) {
+      let acc = value;
+      let cursor = index + 1;
+      while (cursor < rawLines.length) {
+        acc += " " + rawLines[cursor].trim();
+        if (rawLines[cursor].trim().endsWith("]")) { break; }
+        cursor += 1;
+      }
+      value = acc;
+      index = cursor;
+    }
+
+    // YAML block list: subsequent lines start with `- item`. Consume while indented under this key.
+    if (value === "" && index + 1 < rawLines.length && /^\s*-\s+/.test(rawLines[index + 1])) {
+      const items = [];
+      let cursor = index + 1;
+      while (cursor < rawLines.length && /^\s*-\s+/.test(rawLines[cursor])) {
+        items.push(rawLines[cursor].replace(/^\s*-\s+/, "").trim().replace(/^['"]|['"]$/g, ""));
+        cursor += 1;
+      }
+      explicit[key] = items.filter(Boolean);
+      index = cursor;
+      continue;
+    }
+
     if (value.startsWith("[") && value.endsWith("]")) {
       value = value.slice(1, -1).split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean);
     } else if (/^['"].*['"]$/.test(value)) {
@@ -55,6 +85,7 @@ function parseFrontmatter(text) {
       value = value === "true";
     }
     explicit[key] = value;
+    index += 1;
   }
   return { explicit, raw: body };
 }

package/lib/v2/conformance.js

@@ -132,6 +132,7 @@ function auditProject(projectRoot, options = {}) {
   const counts = {};
   const ids = new Set();
   const records = {};
+  const secretAllowlist = loadSecretAllowlist(scrumDir);
   for (const kind of Object.keys(ARTIFACT_TYPES)) {
     try {
       const artifacts = repository.list(kind);
@@ -140,7 +141,9 @@ function auditProject(projectRoot, options = {}) {
       for (const artifact of artifacts) {
         for (const error of artifact.errors) findings.push(finding("high", "ARTIFACT_INVALID", `${path.basename(artifact.file)}: ${error}`, artifact.file));
         const relativeArtifact = path.relative(scrumDir, artifact.file);
-        if (containsSecret(fs.readFileSync(artifact.file, "utf8"))) findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
+        if (containsSecretWithAllowlist(fs.readFileSync(artifact.file, "utf8"), relativeArtifact, secretAllowlist)) {
+          findings.push(finding("critical", "SECRET_CANONICAL", `Secret-like content detected in ${relativeArtifact}.`, artifact.file));
+        }
         if (artifact.record && ids.has(artifact.record.id)) findings.push(finding("critical", "ID_DUPLICATE", `Duplicate artifact id: ${artifact.record.id}`));
         if (artifact.record) ids.add(artifact.record.id);
       }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "4.1.1",
+  "version": "4.1.3",
   "description": "Markdown-first Agile memory and guardrails for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",