repo-audit-tool 1.3.3 → 1.4.1

package/PUBLISHING.md

@@ -10,6 +10,10 @@
 
 ## 版本历史
 
+- **1.4.0** — json_field workspace 递归：monorepo 场景下递归检查所有 workspace 包
+  的 license 字段；findWorkspacePackages（npm workspaces 数组 / pnpm workspaces.packages /
+  常见目录扫描兜底）+ checkJsonFieldContent 提取复用 + DOC-003b 启用；
+  15 用例回归（2026-09-08）
 - **1.3.2** — Issue#4 修复：入口守卫 `pathToFileURL` 归一化，修复 Windows 全形态
   静默不执行（v1.3.1 回归）；守卫 stderr 诊断提示；command 检查器 Git Bash 探测；
   CI 加 windows-latest 矩阵 + npm 安装 smoke 步骤（2026-09-07）

package/docs/AGENT-INDEX.json

@@ -2,12 +2,11 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "repo-audit 文档索引",
   "description": "AI Agent 可读的文档索引 — 包含所有文档的元数据、结构、和调用协议",
-  "version": "1.3.2",
-  "updated": "2026-09-07",
+  "version": "1.4.1",
+  "updated": "2026-09-09",
   "repo": "NinjaSln-labs/repo-audit",
   "npm": "repo-audit-tool",
   "pages": "https://ninjasln-labs.github.io/repo-audit/",
-
   "entry_points": {
     "json_index": "/AGENT-INDEX.json",
     "schema": "/SCHEMA.json",
@@ -15,33 +14,72 @@
     "human_guide": "/repo-audit/HUMAN-GUIDE.md",
     "agent_guide": "/repo-audit/AGENT-GUIDE.md"
   },
-
   "tool": {
     "name": "repo-audit",
     "description": "仓库标准化审计工具 + 工程脚手架生成器（零依赖）",
     "bin": "repo-audit",
-    "version": "1.3.2",
+    "version": "1.4.1",
     "language": "JavaScript (ESM)",
     "runtime": "Node.js >= 18",
     "dependencies": [],
     "license": "MIT",
-
     "invocation": {
       "command": "repo-audit [options]",
       "options": {
-        "--repo": { "type": "string", "default": ".", "description": "目标仓库路径" },
-        "--type": { "type": "string", "description": "强制指定分类（跳过自动检测）" },
-        "--format": { "type": "string", "enum": ["md", "json", "both"], "default": "both", "description": "输出格式" },
-        "--output": { "type": "string", "default": "<repo>/audit-report/", "description": "输出目录" },
-        "--llm-provider": { "type": "string", "description": "LLM 协议：openai/anthropic 或厂商别名" },
-        "--llm-model": { "type": "string", "description": "模型名称" },
-        "--strict": { "type": "boolean", "default": false, "description": "严格模式：Critical/Major 即 exit 1" },
-        "--rules": { "type": "string", "description": "自定义规则 YAML（可多次）" },
-        "--dim": { "type": "string", "description": "只审计指定维度（可多次）" },
-        "--feedback": { "type": "string", "description": "提交反馈（创建 GitHub Issue）" },
-        "--help": { "type": "boolean", "description": "显示帮助" }
+        "--repo": {
+          "type": "string",
+          "default": ".",
+          "description": "目标仓库路径"
+        },
+        "--type": {
+          "type": "string",
+          "description": "强制指定分类（跳过自动检测）"
+        },
+        "--format": {
+          "type": "string",
+          "enum": [
+            "md",
+            "json",
+            "both"
+          ],
+          "default": "both",
+          "description": "输出格式"
+        },
+        "--output": {
+          "type": "string",
+          "default": "<repo>/audit-report/",
+          "description": "输出目录"
+        },
+        "--llm-provider": {
+          "type": "string",
+          "description": "LLM 协议：openai/anthropic 或厂商别名"
+        },
+        "--llm-model": {
+          "type": "string",
+          "description": "模型名称"
+        },
+        "--strict": {
+          "type": "boolean",
+          "default": false,
+          "description": "严格模式：Critical/Major 即 exit 1"
+        },
+        "--rules": {
+          "type": "string",
+          "description": "自定义规则 YAML（可多次）"
+        },
+        "--dim": {
+          "type": "string",
+          "description": "只审计指定维度（可多次）"
+        },
+        "--feedback": {
+          "type": "string",
+          "description": "提交反馈（创建 GitHub Issue）"
+        },
+        "--help": {
+          "type": "boolean",
+          "description": "显示帮助"
+        }
       },
-
       "exit_codes": {
         "0": "审计通过（无 Critical/Major 或 --strict 未启用）",
         "1": "有 Critical/Major 发现且 --strict 启用",
@@ -49,7 +87,6 @@
         "3": "目标不是 git 仓库"
       }
     },
-
     "environment_variables": {
       "LLM_PROVIDER": "LLM 协议（openai/anthropic/none），也可用厂商别名如 deepseek/qwen/glm",
       "LLM_API_KEY": "API Key（必须手动指定）",
@@ -58,35 +95,58 @@
       "REPO_AUDIT_TYPES": "自定义分类列表（JSON 数组）"
     }
   },
-
   "audit": {
     "dimensions": [
       {
         "id": "docs",
         "label": "文档",
-        "rules": ["DOC-001", "DOC-002", "DOC-003", "DOC-003b", "DOC-004", "DOC-005", "DOC-006", "DOC-007"],
+        "rules": [
+          "DOC-001",
+          "DOC-002",
+          "DOC-003",
+          "DOC-003b",
+          "DOC-004",
+          "DOC-005",
+          "DOC-006",
+          "DOC-007"
+        ],
         "description": "README/LICENSE/CONTRIBUTING/SECURITY 等文档完整性"
       },
       {
         "id": "git",
         "label": "Git",
-        "rules": ["GIT-001", "GIT-002", "GIT-003", "GIT-004"],
+        "rules": [
+          "GIT-001",
+          "GIT-002",
+          "GIT-003",
+          "GIT-004"
+        ],
         "description": "commit 规范、分支策略、scaffold 管理"
       },
       {
         "id": "quality",
         "label": "质量",
-        "rules": ["QUA-001", "QUA-002", "QUA-003", "QUA-004", "QUA-005"],
+        "rules": [
+          "QUA-001",
+          "QUA-002",
+          "QUA-003",
+          "QUA-004",
+          "QUA-005"
+        ],
         "description": "构建配置、测试、lint、typecheck"
       },
       {
         "id": "security",
         "label": "安全",
-        "rules": ["SEC-001", "SEC-002", "SEC-003", "SEC-004"],
+        "rules": [
+          "SEC-001",
+          "SEC-002",
+          "SEC-003",
+          "SEC-004"
+        ],
         "description": "密钥泄露、依赖漏洞、权限配置"
       }
     ],
-
     "scoring": {
       "formula": "score = 100 - (critical × 25) - (major × 10) - (minor × 3)",
       "grades": {
@@ -98,14 +158,26 @@
       },
       "note": "score 和 grade 不在 JSON 输出中，Agent 需根据 summary 字段自行计算"
     },
-
     "categories": [
-      "dsh-plugin", "python-app", "go-service", "content", "sandbox",
-      "archive", "product-oss", "javascript", "typescript", "java",
-      "python", "rust", "cpp", "dotnet", "php", "ruby", "unknown"
+      "dsh-plugin",
+      "python-app",
+      "go-service",
+      "content",
+      "sandbox",
+      "archive",
+      "product-oss",
+      "javascript",
+      "typescript",
+      "java",
+      "python",
+      "rust",
+      "cpp",
+      "dotnet",
+      "php",
+      "ruby",
+      "unknown"
     ]
   },
-
   "documents": [
     {
       "id": "human-guide",
@@ -189,12 +261,10 @@
       "description": "JSON Schema 定义，用于验证审计报告输出"
     }
   ],
-
   "feedback": {
     "description": "反馈通道 — Agent 可通过 GitHub Issues API 检测和处理用户反馈",
     "label": "audit-feedback",
     "repo": "NinjaSln-labs/repo-audit",
-
     "detect": {
       "command": "gh issue list --repo NinjaSln-labs/repo-audit --label audit-feedback --state open --json number,title,createdAt,body",
       "description": "列出未处理的反馈"
@@ -211,15 +281,29 @@
       "command": "node repo-audit.mjs --feedback '<反馈内容>'",
       "description": "通过 CLI 创建反馈 Issue（自动预填环境信息）"
     },
-
     "priorities": [
-      { "level": "critical", "sla": "24h", "description": "工具崩溃/数据损坏" },
-      { "level": "major", "sla": "72h", "description": "功能严重受损" },
-      { "level": "minor", "sla": "1周", "description": "功能部分受损" },
-      { "level": "info", "sla": "排期", "description": "建议改进" }
+      {
+        "level": "critical",
+        "sla": "24h",
+        "description": "工具崩溃/数据损坏"
+      },
+      {
+        "level": "major",
+        "sla": "72h",
+        "description": "功能严重受损"
+      },
+      {
+        "level": "minor",
+        "sla": "1周",
+        "description": "功能部分受损"
+      },
+      {
+        "level": "info",
+        "sla": "排期",
+        "description": "建议改进"
+      }
     ]
   },
-
   "quick_start": {
     "install": "npm install -g repo-audit-tool",
     "audit": "repo-audit --repo /path/to/repo",
@@ -229,14 +313,16 @@
     "custom_rules": "repo-audit --repo /path/to/repo --rules my-rules.yaml",
     "llm_enhanced": "LLM_API_KEY=sk-xxx repo-audit --repo . --llm-provider deepseek"
   },
-
   "changelog": {
+    "1.4.0": "json_field workspace 递归——monorepo 场景下递归检查所有 workspace 包的 license 字段；findWorkspacePackages 发现 npm/pnpm workspaces + 常见目录；checkJsonFieldContent 提取为可复用函数；DOC-003b 启用；15 用例回归",
+    "1.3.3": "Issue#5 修复：.auditrc.yaml since 字段 YAML 引号剥离——loadAuditrc 中 since: 分支补 .replace(/['\"]/g, '')，与 reason 分支对称，修复 waived_since 输出含字面引号的 bug；5 用例回归（test/auditrc-since.test.mjs）",
     "1.3.2": "Issue#4 修复：入口守卫 pathToFileURL 归一化——修复 Windows 全形态静默不执行（v1.3.1 回归）；守卫不命中时 stderr 诊断提示；command 检查器 Git Bash 探测；CI 双平台矩阵 + npm 安装 smoke",
     "1.3.1": "入口守卫 realpath 归一化——修复 npm bin symlink 下主流程不执行；1.3.0 反馈修复：注释剥离/SEC-004/AGENTS 声明/QUA-004/--update 动线",
     "1.3.0": "反馈修复：yaml_field 行内注释剥离 + fallback_field 通配（SEC-004 兼容 job 级权限）；AGENTS-core 来源声明二选一；QUA-004 锁文件消费意图；手册补 --update 存量补齐动线",
     "1.2.3": "package.json 补充 repository 字段，修复 npm provenance E422；完成 Trusted Publisher tag 自动发布",
     "1.2.2": "publish CI 改用 node 22 + 条件升级 npm，修复 EBADENGINE（tag 发布因 1.2.1 已存在未出包）",
     "1.2.1": "README 链接改为绝对 URL（修复 npm 页面 404）",
-    "1.2.0": "开源就绪：AGENTS.md、CI/publish workflow、json_field monorepo、fallback_field 数组、英文 README、参数类型校验、占位符扫描"
+    "1.2.0": "开源就绪：AGENTS.md、CI/publish workflow、json_field monorepo、fallback_field 数组、英文 README、参数类型校验、占位符扫描",
+    "1.4.1": "yaml_field 解析健壮性——CRLF 行尾剥离 + 引号键名识别 + 子层缩进以首个子键为准（SEC-004 job 级 id-token 误判 fail，Issue#6）；6 用例回归"
   }
 }

package/docs/repo-audit/AGENT-GUIDE.md

@@ -275,6 +275,10 @@ EOF
 node repo-audit.mjs --repo /path/to/repo --rules /tmp/my-rules.yaml --format json
 ```
 
+### 4.7 yaml_field fallback_field 与解析健壮性（Issue#6）
+
+`yaml_field` 支持 `fallback_field`（数组）：主字段不匹配时逐个尝试备选路径，段内 `*` 为通配展开（如 `jobs.*.permissions.id-token`——任一 job 级命中即 pass，覆盖 PyPA 最小化权限模式）。解析层（v1.4.1）统一剥离 CRLF 行尾 `\r`、识别引号键名、按首个子键实际缩进确定子层（2/4 空格风格均支持）。误判排查时优先确认 workflow 文件是否踩过这三类形态。
+
 ---
 
 ## 五、错误处理协议

package/docs/repo-audit/HUMAN-GUIDE.md

@@ -688,6 +688,15 @@ params:
   fallback_field: "scripts.test"
 ```
 
+### 12.4b yaml_field fallback_field 与解析健壮性（Issue#6）
+
+`yaml_field` 支持 `fallback_field`（数组）：主字段不匹配时逐个尝试备选路径，段内 `*` 为通配（如 `jobs.*.permissions.id-token`——顶层无 `permissions.id-token` 时，任一 job 级命中即 pass，覆盖 PyPA 最小化权限模式）。
+
+解析健壮性（v1.4.1 修复，Issue#6）：
+- **CRLF 行尾**：行解析前统一剥离 `\r`，Windows 编辑的 workflow 不再标量失配
+- **引号键名**：`"publish":` / `'publish':` 与裸键等价识别
+- **缩进风格**：子层缩进以首个子键实际缩进为准（2/4 空格等风格均支持，不再硬编码 +2）
+
 ### 12.5 toml_field expect_table
 
 检查 TOML 表头存在性（而非表内键值）：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-audit-tool",
-  "version": "1.3.3",
+  "version": "1.4.1",
   "description": "仓库标准化审计工具 + 工程脚手架生成器（零依赖）",
   "type": "module",
   "main": "repo-audit.mjs",

package/repo-audit.mjs

@@ -170,6 +170,129 @@ function findPackageJson(repoPath) {
   return null
 }
 
+// ============================================================
+// workspace 递归 — 发现所有 workspace 包（根 + workspace globs + 常见目录）
+// ============================================================
+
+export function findWorkspacePackages(repoPath) {
+  const results = []
+  const seen = new Set()
+
+  const tryAdd = (pkgPath) => {
+    const resolved = resolve(pkgPath)
+    if (seen.has(resolved)) return
+    seen.add(resolved)
+    // 跳过 node_modules 和隐藏目录
+    const parts = resolved.split('/').join('\/')
+    if (parts.includes('node_modules')) return
+    const pkg = readJsonSafe(pkgPath)
+    if (pkg) {
+      results.push({ path: pkgPath, pkg, dir: dirname(pkgPath) })
+    }
+  }
+
+  // 1. 根 package.json
+  const rootPkgPath = join(repoPath, 'package.json')
+  tryAdd(rootPkgPath)
+
+  // 2. 根 package.json 的 workspaces 字段（npm: 数组 / pnpm: {packages:[...]}）
+  const rootPkg = readJsonSafe(rootPkgPath)
+  if (rootPkg?.workspaces) {
+    const globs = Array.isArray(rootPkg.workspaces)
+      ? rootPkg.workspaces
+      : (rootPkg.workspaces.packages || [])
+    for (const glob of globs) {
+      expandWorkspaceGlob(repoPath, glob, tryAdd)
+    }
+  }
+
+  // 3. 常见 workspace 目录扫描（无 workspaces 字段时的兜底）
+  const patterns = ['apps', 'packages', 'workspaces', 'components', 'modules', 'libs', 'projects']
+  for (const pattern of patterns) {
+    const patternDir = join(repoPath, pattern)
+    if (!existsSync(patternDir)) continue
+    try {
+      for (const entry of readdirSync(patternDir, { withFileTypes: true })) {
+        if (!entry.isDirectory() || entry.name.startsWith('.') || entry.name === 'node_modules') continue
+        tryAdd(join(patternDir, entry.name, 'package.json'))
+      }
+    } catch {}
+  }
+
+  return results
+}
+
+function expandWorkspaceGlob(repoPath, glob, tryAdd) {
+  // 直接路径（无 glob 字符）
+  if (!glob.includes('*')) {
+    tryAdd(join(repoPath, glob, 'package.json'))
+    return
+  }
+  // 常见 glob 模式：base/* 或 base/**/*
+  const baseDir = join(repoPath, glob.split('*')[0].replace(/\/$/, ''))
+  if (!existsSync(baseDir)) return
+  try {
+    for (const entry of readdirSync(baseDir, { withFileTypes: true })) {
+      if (!entry.isDirectory() || entry.name.startsWith('.') || entry.name === 'node_modules') continue
+      tryAdd(join(baseDir, entry.name, 'package.json'))
+    }
+  } catch {}
+}
+
+// ============================================================
+// json_field 核心检查逻辑（供 workspace 递归复用）
+// ============================================================
+
+export function checkJsonFieldContent(content, params) {
+  const result = { passed: false, evidence: '', value: undefined }
+  try {
+    const obj = JSON.parse(content)
+    const fields = (params?.field || '').split('.')
+    let val = obj
+    let missing = false
+    let missingField = null
+    for (const f of fields) {
+      if (val === undefined || val === null) { missing = true; missingField = f; break }
+      val = val[f]
+    }
+    if (missing) {
+      result.evidence = `字段 ${missingField} 不存在`
+    } else if (val !== undefined && val !== null) {
+      result.passed = true
+      result.value = val
+      result.evidence = `字段 ${params.field} = ${JSON.stringify(val)?.slice(0, 100)}`
+    } else {
+      result.evidence = `字段 ${params.field} = ${JSON.stringify(val)?.slice(0, 100)}`
+    }
+    // fallback_field（如 peerDeps 不存在时检查 devDeps）
+    if (!result.passed && params?.fallback_field) {
+      const fbFields = Array.isArray(params.fallback_field)
+        ? params.fallback_field
+        : params.fallback_field.split('.')
+      for (const candidate of fbFields) {
+        const segs = Array.isArray(candidate) ? candidate : candidate.split('.')
+        let fbVal = obj
+        for (const f of segs) {
+          if (fbVal === undefined || fbVal === null) break
+          fbVal = fbVal[f]
+        }
+        if (fbVal !== undefined && fbVal !== null) {
+          result.passed = true
+          result.value = fbVal
+          const matchedField = Array.isArray(params.fallback_field)
+            ? String(candidate)
+            : params.fallback_field
+          result.evidence = `字段 ${params.field} 不存在，但 ${matchedField} = ${JSON.stringify(fbVal)?.slice(0, 100)}`
+          break
+        }
+      }
+    }
+  } catch (e) {
+    result.evidence = `JSON 解析失败: ${e.message}`
+  }
+  return result
+}
+
 function readFileSafe(path) {
 
   try { return readFileSync(path, 'utf-8') } catch { return null }
@@ -202,30 +325,49 @@ function countNonHiddenFiles(path) {
   return count
 }
 
-// Issue#2 fix: 定位指定缩进层级下的具名子键（返回行号与缩进；未找到返回 null）
+// Issue#6 fix: 规范化 YAML 行——剥离行尾 \r（CRLF 文件在 Linux 审计时 (.*)$ 不吞 \r，
+// 标量值带尾 \r 导致与 expected 比较全部失配）；行内键名引号在匹配处单独处理
+function normalizeYamlLines(content) {
+  return String(content).split('\n').map(l => l.replace(/\r$/, ''))
+}
+// Issue#6 fix: YAML 键名匹配——兼容裸键与引号键（"publish": / 'publish':），
+// 返回 [key, valueRest]；非键行返回 null
+function matchYamlKey(l) {
+  const m = l.match(/^(\s*)(?:"([^"]+)"|'([^']+)'|(\w[\w\-]*))\s*:\s*(.*)$/)
+  if (!m) return null
+  return [m[2] ?? m[3] ?? m[4], m[5]]
+}
+
+// Issue#6 fix: 定位指定缩进层级下的具名子键（返回行号与缩进；未找到返回 null）
+// 子层缩进以本层首个子键的实际缩进为准（兼容 2/4 空格等缩进风格），不再硬编码 +2
 function findNestedYamlKey(lines, startIdx, baseIndent, key) {
+  let childIndent = -1
   for (let i = startIdx + 1; i < lines.length; i++) {
     const l = lines[i]
     if (!l.trim() || l.trim().startsWith('#')) continue
     const ind = l.length - l.trimStart().length
     if (ind <= baseIndent) return null
-    if (ind !== baseIndent + 2) continue // 只看直接子层（YAML 常规 2 空格缩进）
-    const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-    if (m && m[1] === key) return { idx: i, indent: ind }
+    if (childIndent === -1) childIndent = ind // 本层首个子键确定子层缩进
+    if (ind !== childIndent) continue // 只看直接子层
+    const km = matchYamlKey(l)
+    if (km && km[0] === key) return { idx: i, indent: ind }
   }
   return null
 }
 // Issue#2 fix: 列出指定父键下一层的所有子键名（通配 * 展开用）
+// 子层缩进同样以首个子键实际缩进为准（与 findNestedYamlKey 对称）
 function listChildKeys(lines, startIdx, baseIndent) {
   const keys = []
+  let childIndent = -1
   for (let i = startIdx + 1; i < lines.length; i++) {
     const l = lines[i]
     if (!l.trim() || l.trim().startsWith('#')) continue
     const ind = l.length - l.trimStart().length
     if (ind <= baseIndent) break
-    if (ind !== baseIndent + 2) continue
-    const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-    if (m) keys.push(m[1])
+    if (childIndent === -1) childIndent = ind
+    if (ind !== childIndent) continue
+    const km = matchYamlKey(l)
+    if (km) keys.push(km[0])
   }
   return keys
 }
@@ -251,10 +393,10 @@ function findNestedYaml(lines, startIdx, baseIndent, segments) {
     if (!l.trim() || l.trim().startsWith('#')) continue
     const ind = l.length - l.trimStart().length
     if (ind <= currentIndent) break // 退出当前层级
-    const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-    if (m) {
-      const key = m[1]
-      const valStr = stripYamlComment(m[2])
+    const km = matchYamlKey(l)
+    if (km) {
+      const key = km[0]
+      const valStr = stripYamlComment(km[1])
       const seg = segments[0]
       if (key === seg) {
         if (valStr && valStr !== '' && valStr !== '{}') {
@@ -724,7 +866,7 @@ function loadRules(type, customPaths = [], repoPath = null) {
     file_header:    { path: ['string'], pattern: ['string'] },
     regex:          { path: ['string'], pattern: ['string'] },
     grep:           { pattern: ['string'] },
-    json_field:     { path: ['string'], field: ['string'], fallback_field: ['array', 'string'] },
+    json_field:     { path: ['string'], field: ['string'], fallback_field: ['array', 'string'], workspace_recursive: ['boolean'] },
     toml_field:     { path: ['string'], field: ['string'] },
     yaml_field:     { path: ['string'], field: ['string'], fallback_field: ['array', 'string'] },
     directory_exists: { paths: ['array', 'string'] },
@@ -779,6 +921,11 @@ function hasEquivalentDocs(repoPath) {
 // 规则检查引擎
 // ============================================================
 
+// Issue#6 回归需要进程内直调（win32 下 spawnSync node 走 PATHEXT 解析不可靠，P-007 同族坑）
+export function runCheckForTest(rule, repoPath, mpj = null) {
+  return runCheck(rule, repoPath, mpj)
+}
+
 function runCheck(rule, repoPath, mpj = null) {
   const { check, params } = rule
   let passed = false
@@ -962,53 +1109,45 @@ function runCheck(rule, repoPath, mpj = null) {
     }
 
     case 'json_field': {
+      const pathParam = params?.path
+      const workspaceRecursive = params?.workspace_recursive === true
+
+      // workspace 递归：检查所有 workspace 包
+      if (workspaceRecursive && pathParam === 'package.json') {
+        const allPkgs = findWorkspacePackages(repoPath)
+        if (allPkgs.length === 0) {
+          passed = false; evidence = '未找到任何 package.json'; break
+        }
+        const results = []
+        let allPassed = true
+        for (const wp of allPkgs) {
+          const content = readFileSafe(wp.path)
+          if (!content) {
+            results.push(`${wp.dir === repoPath ? '根' : relative(repoPath, wp.dir)}: 文件不可读 ✗`)
+            allPassed = false; continue
+          }
+          const r = checkJsonFieldContent(content, params)
+          const relPath = wp.dir === repoPath ? '根' : relative(repoPath, wp.dir)
+          results.push(`${relPath}: ${r.evidence} ${r.passed ? '✓' : '✗'}`)
+          if (!r.passed) allPassed = false
+        }
+        passed = allPassed
+        evidence = results.join(' | ')
+        break
+      }
+
       // P6: monorepo 感知 — package.json 不在根时 fallback 到 workspace 目录
-      let actualPath = join(repoPath, params?.path)
+      let actualPath = join(repoPath, pathParam)
       let workspaceHint = ''
-      if (!readFileSafe(actualPath) && params?.path === 'package.json' && mpj) {
+      if (!readFileSafe(actualPath) && pathParam === 'package.json' && mpj) {
         actualPath = mpj.path
         workspaceHint = `（workspace: ${mpj.dir}）`
       }
       const content = readFileSafe(actualPath)
       if (!content) { passed = false; evidence = '文件不存在'; break }
-      try {
-        const obj = JSON.parse(content)
-        const fields = (params?.field || '').split('.')
-        let val = obj
-        let missing = false
-        for (const f of fields) {
-          if (val === undefined || val === null) { passed = false; evidence = `字段 ${f} 不存在`; missing = true; break }
-          val = val[f]
-        }
-        if (!missing) {
-          passed = val !== undefined && val !== null
-          evidence = `字段 ${params.field} = ${JSON.stringify(val)?.slice(0, 100)}${workspaceHint}`
-        }
-        // P1-2 fix: 支持 fallback_field（如 peerDeps 不存在时检查 devDeps）
-        // 支持两种格式：数组 ["deps", "peerDeps", "devDeps"] 或字符串 "deps"（点路径）
-        if (!passed && params?.fallback_field) {
-          const fbFields = Array.isArray(params.fallback_field)
-            ? params.fallback_field
-            : params.fallback_field.split('.')
-          // 对每个候选字段，尝试在 obj 中查找
-          for (const candidate of fbFields) {
-            const segs = Array.isArray(candidate) ? candidate : candidate.split('.')
-            let fbVal = obj
-            for (const f of segs) {
-              if (fbVal === undefined || fbVal === null) break
-              fbVal = fbVal[f]
-            }
-            if (fbVal !== undefined && fbVal !== null) {
-              passed = true
-              const matchedField = Array.isArray(params.fallback_field)
-                ? String(candidate)
-                : params.fallback_field
-              evidence = `字段 ${params.field} 不存在，但 ${matchedField} = ${JSON.stringify(fbVal)?.slice(0, 100)}${workspaceHint}`
-              break
-            }
-          }
-        }
-      } catch (e) { passed = false; evidence = `JSON 解析失败: ${e.message}` }
+      const r = checkJsonFieldContent(content, params)
+      passed = r.passed
+      evidence = r.evidence + (workspaceHint || '')
       break
     }
 
@@ -1072,7 +1211,7 @@ function runCheck(rule, repoPath, mpj = null) {
       let val = null
       let found = false
       try {
-        const lines = content.split('\n')
+        const lines = normalizeYamlLines(content)
         let currentIndent = -1
         let currentObj = null
         // 第一遍：找到顶层键
@@ -1080,10 +1219,10 @@ function runCheck(rule, repoPath, mpj = null) {
           const l = lines[i]
           if (!l.trim() || l.trim().startsWith('#')) continue
           const ind = l.length - l.trimStart().length
-          const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-          if (m && m[1] === segments[0]) {
+          const km = matchYamlKey(l)
+          if (km && km[0] === segments[0]) {
             currentIndent = ind
-            const valStr = stripYamlComment(m[2])
+            const valStr = stripYamlComment(km[1])
             if (valStr && valStr !== '' && valStr !== '{}') {
               // 标量值（非嵌套）
               val = valStr
@@ -1118,7 +1257,7 @@ function runCheck(rule, repoPath, mpj = null) {
             const wIdx = segs.indexOf('*')
             if (wIdx === -1) { candidates.push({ segments: segs }); return }
             // 找通配段父级的所有子键：先定位父级前缀（逐段下钻收集行号）
-            const lines = content.split('\n')
+            const lines = normalizeYamlLines(content)
             const prefix = segs.slice(0, wIdx)
             const suffix = segs.slice(wIdx + 1)
             // 顶层段
@@ -1126,8 +1265,8 @@ function runCheck(rule, repoPath, mpj = null) {
             for (let i = 0; i < lines.length; i++) {
               const l = lines[i]
               if (!l.trim() || l.trim().startsWith('#')) continue
-              const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-              if (!m || m[1] !== prefix[0]) continue
+              const km = matchYamlKey(l)
+              if (!km || km[0] !== prefix[0]) continue
               // 沿 prefix 下钻
               let curIdx = i, curIndent = l.length - l.trimStart().length
               let ok = true
@@ -1148,14 +1287,14 @@ function runCheck(rule, repoPath, mpj = null) {
             let fbVal = null
             let fbFound = false
             try {
-              const lines = content.split('\n')
+              const lines = normalizeYamlLines(content)
               for (let i = 0; i < lines.length; i++) {
                 const l = lines[i]
                 if (!l.trim() || l.trim().startsWith('#')) continue
                 const ind = l.length - l.trimStart().length
-                const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-                if (m && m[1] === cand.segments[0]) {
-                  const v = stripYamlComment(m[2])
+                const km = matchYamlKey(l)
+                if (km && km[0] === cand.segments[0]) {
+                  const v = stripYamlComment(km[1])
                   if (v && v !== '' && v !== '{}') { fbVal = v; fbFound = true }
                   else {
                     const sub = findNestedYaml(lines, i, ind, cand.segments.slice(1))

package/rules/domains/docs.yaml

@@ -43,7 +43,8 @@ rules:
       path: "package.json"
       field: "license"
       fallback_field: ["dependencies", "peerDependencies", "devDependencies"]
-    description: "package.json 应有 license 字段（SPDX 标识）"
+      workspace_recursive: true
+    description: "package.json 应有 license 字段（SPDX 标识）；monorepo 需所有 workspace 包均声明 license 字段"
     note: "仅对含 package.json 的 JS 项目检查"
 
   - id: DOC-004