scrumrun 4.1.2 → 4.1.4

package/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes follow Semantic Versioning.
 
 ## Unreleased
 
+## 4.1.4 - 2026-09-22
+
+### Added
+
+- **`scrumrun view`.** New command that spins up a temporary HTTP server on `127.0.0.1:8080` (falls back to the next free port up to 8100), serves `.scrumrun/` as static files with `Cache-Control: no-store` and `X-Content-Type-Options: nosniff`, and opens the browser at `view.html`. Removes the friction of `file://` fetch restrictions in Brave/Chrome/Safari and eliminates the need for `python3 -m http.server`. Flags: `--port <n>`, `--host <ip>` (default `127.0.0.1` — never bind to `0.0.0.0` unless explicit), `--no-open` (headless). Cross-platform browser open via `open` (macOS), `xdg-open` (Linux), `start` (Windows). Ctrl+C to stop.
+
+## 4.1.3 - 2026-09-22
+
+### Fixed
+
+- **`parseFrontmatter` handles multi-line arrays and YAML block lists.** The inline `allow_secrets_in: [a,\nb,\nc]` and the block form `allow_secrets_in:\n  - a\n  - b` used to be parsed as a single truncated string, silently disabling the whitelist. The parser now (a) keeps reading until the closing `]` for multi-line inline arrays, and (b) recognizes `- item` block lists as an array value. Existing single-line inline arrays continue to work.
+
 ## 4.1.2 - 2026-09-22
 
 ### Fixed

package/README.md

@@ -4,7 +4,7 @@
 
 ScrumRun gives an agent a small command surface and a precise project memory: what should be done, how each attempt happened, which decisions constrain the code, and why the architecture exists in its current form.
 
-**Package:** `4.1.2` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
+**Package:** `4.1.4` · **Method target:** `2.0.0` · **Runtime:** Node.js `>=22.13.0` · **License:** MIT
 
 **New here?** Read the [Quickstart](docs/QUICKSTART.md) — first Run in under 10 minutes, no `SPEC.md` reading required. Full docs map in [`docs/INDEX.md`](docs/INDEX.md).
 

package/bin/scrumrun.js

@@ -64,6 +64,7 @@ Usage:
   scrumrun update  [all|codex|opencode|claude] [--project] [--seal-policy] [--migrate] [--repair-legacy] [--verbose]
   scrumrun init [--local|--shared] [--lean] [--no-agent-hint] [--force]
   scrumrun status
+  scrumrun view [--port 8080] [--host 127.0.0.1] [--no-open]
   scrumrun core [--path|--prompt]
   scrumrun commands
   scrumrun migrate --to 2 --dry-run
@@ -2749,6 +2750,24 @@ if (!command || command === "--help" || command === "-h") {
   } else {
     initProject({ force, mode: shared ? "shared" : "local", agentHint: shared || !noAgentHint, lean });
   }
+} else if (command === "view") {
+  (async () => {
+    try {
+      const { view } = require(path.join(root, "lib", "view", "server"));
+      const portArg = args.indexOf("--port");
+      const hostArg = args.indexOf("--host");
+      const port = portArg !== -1 && args[portArg + 1] ? Number(args[portArg + 1]) : 8080;
+      const host = hostArg !== -1 && args[hostArg + 1] ? args[hostArg + 1] : "127.0.0.1";
+      const autoOpen = !args.includes("--no-open");
+      const { server } = await view(process.cwd(), { port, host, autoOpen });
+      const stop = () => { server.close(() => process.exit(0)); };
+      process.on("SIGINT", stop);
+      process.on("SIGTERM", stop);
+    } catch (error) {
+      console.error(`view failed: ${error.message}`);
+      process.exitCode = 1;
+    }
+  })();
 } else if (command === "repair") {
   const scrumDir = path.join(process.cwd(), ".scrumrun");
   try {

package/lib/security/secrets.js

@@ -41,12 +41,42 @@ function parseFrontmatter(text) {
   if (!match) return { explicit: {}, raw: "" };
   const body = match[1];
   const explicit = {};
-  for (const line of body.split(/\r?\n/)) {
-    if (!line.trim() || line.trim().startsWith("#")) continue;
+  const rawLines = body.split(/\r?\n/);
+  let index = 0;
+  while (index < rawLines.length) {
+    const line = rawLines[index];
+    if (!line.trim() || line.trim().startsWith("#")) { index += 1; continue; }
     const kv = line.match(/^([A-Za-z0-9_.-]+)\s*:\s*(.*)$/);
-    if (!kv) continue;
+    if (!kv) { index += 1; continue; }
     const key = kv[1].trim();
     let value = kv[2].trim();
+
+    // Inline array that spans multiple lines: keep reading until we see the closing `]`.
+    if (value.startsWith("[") && !value.endsWith("]")) {
+      let acc = value;
+      let cursor = index + 1;
+      while (cursor < rawLines.length) {
+        acc += " " + rawLines[cursor].trim();
+        if (rawLines[cursor].trim().endsWith("]")) { break; }
+        cursor += 1;
+      }
+      value = acc;
+      index = cursor;
+    }
+
+    // YAML block list: subsequent lines start with `- item`. Consume while indented under this key.
+    if (value === "" && index + 1 < rawLines.length && /^\s*-\s+/.test(rawLines[index + 1])) {
+      const items = [];
+      let cursor = index + 1;
+      while (cursor < rawLines.length && /^\s*-\s+/.test(rawLines[cursor])) {
+        items.push(rawLines[cursor].replace(/^\s*-\s+/, "").trim().replace(/^['"]|['"]$/g, ""));
+        cursor += 1;
+      }
+      explicit[key] = items.filter(Boolean);
+      index = cursor;
+      continue;
+    }
+
     if (value.startsWith("[") && value.endsWith("]")) {
       value = value.slice(1, -1).split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean);
     } else if (/^['"].*['"]$/.test(value)) {
@@ -55,6 +85,7 @@ function parseFrontmatter(text) {
       value = value === "true";
     }
     explicit[key] = value;
+    index += 1;
   }
   return { explicit, raw: body };
 }

package/lib/view/server.js

@@ -0,0 +1,110 @@
+"use strict";
+
+const fs = require("node:fs");
+const http = require("node:http");
+const path = require("node:path");
+const { execFile, spawn } = require("node:child_process");
+
+const MIME = Object.freeze({
+  ".html": "text/html; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".js": "application/javascript; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  ".md": "text/markdown; charset=utf-8",
+  ".jsonl": "application/x-ndjson; charset=utf-8",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".ico": "image/x-icon",
+  ".txt": "text/plain; charset=utf-8"
+});
+
+function contentType(filePath) {
+  return MIME[path.extname(filePath).toLowerCase()] || "application/octet-stream";
+}
+
+function safeResolve(root, urlPath) {
+  const decoded = decodeURIComponent(urlPath.split("?")[0]).replace(/^\/+/, "");
+  const target = path.resolve(root, decoded || "view.html");
+  const rootResolved = path.resolve(root);
+  if (target !== rootResolved && !target.startsWith(rootResolved + path.sep)) return null;
+  return target;
+}
+
+function requestHandler(root) {
+  return (req, res) => {
+    if (req.method !== "GET" && req.method !== "HEAD") {
+      res.writeHead(405, { "Allow": "GET, HEAD" });
+      return res.end("Method Not Allowed");
+    }
+    const target = safeResolve(root, req.url || "/");
+    if (!target) {
+      res.writeHead(400);
+      return res.end("Bad path");
+    }
+    let filePath = target;
+    if (fs.existsSync(filePath) && fs.statSync(filePath).isDirectory()) {
+      filePath = path.join(filePath, "view.html");
+    }
+    if (!fs.existsSync(filePath) || !fs.statSync(filePath).isFile()) {
+      res.writeHead(404, { "Content-Type": "text/plain; charset=utf-8" });
+      return res.end("Not found");
+    }
+    res.writeHead(200, {
+      "Content-Type": contentType(filePath),
+      "Cache-Control": "no-store",
+      "X-Content-Type-Options": "nosniff"
+    });
+    if (req.method === "HEAD") return res.end();
+    fs.createReadStream(filePath).pipe(res);
+  };
+}
+
+function listen(root, { host = "127.0.0.1", port = 8080 } = {}) {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer(requestHandler(root));
+    let attempts = 0;
+    const tryPort = (p) => {
+      server.once("error", (err) => {
+        if (err.code === "EADDRINUSE" && attempts < 20) {
+          attempts += 1;
+          setImmediate(() => tryPort(p + 1));
+        } else {
+          reject(err);
+        }
+      });
+      server.listen(p, host, () => {
+        const addr = server.address();
+        resolve({ server, port: (addr && addr.port) || p, host });
+      });
+    };
+    tryPort(port);
+  });
+}
+
+function openInBrowser(url) {
+  const platform = process.platform;
+  if (platform === "darwin") return spawn("open", [url], { stdio: "ignore", detached: true }).unref();
+  if (platform === "win32") return spawn("cmd", ["/c", "start", "", url], { stdio: "ignore", detached: true }).unref();
+  return spawn("xdg-open", [url], { stdio: "ignore", detached: true }).unref();
+}
+
+async function view(projectRoot, { port = 8080, host = "127.0.0.1", autoOpen = true, logger = console } = {}) {
+  const root = path.join(projectRoot, ".scrumrun");
+  if (!fs.existsSync(root) || !fs.statSync(root).isDirectory()) {
+    throw new Error(`ScrumRun project not found at ${root}. Run \`scrumrun init\` first.`);
+  }
+  const viewFile = path.join(root, "view.html");
+  if (!fs.existsSync(viewFile)) {
+    throw new Error(`view.html is missing at ${viewFile}. Run \`scrumrun update --project\` to copy the latest template.`);
+  }
+  const { server, port: boundPort } = await listen(root, { host, port });
+  const url = `http://${host}:${boundPort}/view.html`;
+  logger.log(`ScrumRun view running at ${url}`);
+  logger.log("Press Ctrl+C to stop.");
+  if (autoOpen) {
+    try { openInBrowser(url); } catch { /* non-fatal */ }
+  }
+  return { server, url, port: boundPort, host };
+}
+
+module.exports = { view, listen, requestHandler, safeResolve, openInBrowser };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "scrumrun",
-  "version": "4.1.2",
+  "version": "4.1.4",
   "description": "Markdown-first Agile memory and guardrails for AI coding agents.",
   "bin": {
     "scrumrun": "bin/scrumrun.js",