scrumrun 4.1.2 → 4.1.3

package/CHANGELOG.md

@@ -4,6 +4,12 @@ All notable changes follow Semantic Versioning.
 
 ## Unreleased
 
+## 4.1.3 - 2026-09-22
+
+### Fixed
+
+- **`parseFrontmatter` handles multi-line arrays and YAML block lists.** The inline `allow_secrets_in: [a,\nb,\nc]` and the block form `allow_secrets_in:\n  - a\n  - b` used to be parsed as a single truncated string, silently disabling the whitelist. The parser now (a) keeps reading until the closing `]` for multi-line inline arrays, and (b) recognizes `- item` block lists as an array value. Existing single-line inline arrays continue to work.
+
 ## 4.1.2 - 2026-09-22
 
 ### Fixed

package/README.md

@@ -4,7 +4,7 @@
 
 ScrumRun gives an agent a small command surface and a precise project memory: what should be done, how each attempt happened, which decisions constrain the code, and why the architecture exists in its current form.
 
-**Package:** `4.1.2` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
+**Package:** `4.1.3` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
 
 **New here?** Read the [Quickstart](docs/QUICKSTART.md) — first Run in under 10 minutes, no `SPEC.md` reading required. Full docs map in [`docs/INDEX.md`](docs/INDEX.md).
 

package/lib/security/secrets.js

@@ -41,12 +41,42 @@ function parseFrontmatter(text) {
   if (!match) return { explicit: {}, raw: "" };
   const body = match[1];
   const explicit = {};
-  for (const line of body.split(/\r?\n/)) {
-    if (!line.trim() || line.trim().startsWith("#")) continue;
+  const rawLines = body.split(/\r?\n/);
+  let index = 0;
+  while (index < rawLines.length) {
+    const line = rawLines[index];
+    if (!line.trim() || line.trim().startsWith("#")) { index += 1; continue; }
     const kv = line.match(/^([A-Za-z0-9_.-]+)\s*:\s*(.*)$/);
-    if (!kv) continue;
+    if (!kv) { index += 1; continue; }
     const key = kv[1].trim();
     let value = kv[2].trim();
+
+    // Inline array that spans multiple lines: keep reading until we see the closing `]`.
+    if (value.startsWith("[") && !value.endsWith("]")) {
+      let acc = value;
+      let cursor = index + 1;
+      while (cursor < rawLines.length) {
+        acc += " " + rawLines[cursor].trim();
+        if (rawLines[cursor].trim().endsWith("]")) { break; }
+        cursor += 1;
+      }
+      value = acc;
+      index = cursor;
+    }
+
+    // YAML block list: subsequent lines start with `- item`. Consume while indented under this key.
+    if (value === "" && index + 1 < rawLines.length && /^\s*-\s+/.test(rawLines[index + 1])) {
+      const items = [];
+      let cursor = index + 1;
+      while (cursor < rawLines.length && /^\s*-\s+/.test(rawLines[cursor])) {
+        items.push(rawLines[cursor].replace(/^\s*-\s+/, "").trim().replace(/^['"]|['"]$/g, ""));
+        cursor += 1;
+      }
+      explicit[key] = items.filter(Boolean);
+      index = cursor;
+      continue;
+    }
+
     if (value.startsWith("[") && value.endsWith("]")) {
       value = value.slice(1, -1).split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean);
     } else if (/^['"].*['"]$/.test(value)) {
@@ -55,6 +85,7 @@ function parseFrontmatter(text) {
       value = value === "true";
     }
     explicit[key] = value;
+    index += 1;
   }
   return { explicit, raw: body };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "4.1.2",
+  "version": "4.1.3",
   "description": "Markdown-first Agile memory and guardrails for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",