repo-audit-tool 1.4.0 → 1.4.1

package/docs/AGENT-INDEX.json

@@ -2,12 +2,11 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "title": "repo-audit 文档索引",
   "description": "AI Agent 可读的文档索引 — 包含所有文档的元数据、结构、和调用协议",
-  "version": "1.4.0",
-  "updated": "2026-09-08",
+  "version": "1.4.1",
+  "updated": "2026-09-09",
   "repo": "NinjaSln-labs/repo-audit",
   "npm": "repo-audit-tool",
   "pages": "https://ninjasln-labs.github.io/repo-audit/",
-
   "entry_points": {
     "json_index": "/AGENT-INDEX.json",
     "schema": "/SCHEMA.json",
@@ -15,33 +14,72 @@
     "human_guide": "/repo-audit/HUMAN-GUIDE.md",
     "agent_guide": "/repo-audit/AGENT-GUIDE.md"
   },
-
   "tool": {
     "name": "repo-audit",
     "description": "仓库标准化审计工具 + 工程脚手架生成器（零依赖）",
     "bin": "repo-audit",
-    "version": "1.4.0",
+    "version": "1.4.1",
     "language": "JavaScript (ESM)",
     "runtime": "Node.js >= 18",
     "dependencies": [],
     "license": "MIT",
-
     "invocation": {
       "command": "repo-audit [options]",
       "options": {
-        "--repo": { "type": "string", "default": ".", "description": "目标仓库路径" },
-        "--type": { "type": "string", "description": "强制指定分类（跳过自动检测）" },
-        "--format": { "type": "string", "enum": ["md", "json", "both"], "default": "both", "description": "输出格式" },
-        "--output": { "type": "string", "default": "<repo>/audit-report/", "description": "输出目录" },
-        "--llm-provider": { "type": "string", "description": "LLM 协议：openai/anthropic 或厂商别名" },
-        "--llm-model": { "type": "string", "description": "模型名称" },
-        "--strict": { "type": "boolean", "default": false, "description": "严格模式：Critical/Major 即 exit 1" },
-        "--rules": { "type": "string", "description": "自定义规则 YAML（可多次）" },
-        "--dim": { "type": "string", "description": "只审计指定维度（可多次）" },
-        "--feedback": { "type": "string", "description": "提交反馈（创建 GitHub Issue）" },
-        "--help": { "type": "boolean", "description": "显示帮助" }
+        "--repo": {
+          "type": "string",
+          "default": ".",
+          "description": "目标仓库路径"
+        },
+        "--type": {
+          "type": "string",
+          "description": "强制指定分类（跳过自动检测）"
+        },
+        "--format": {
+          "type": "string",
+          "enum": [
+            "md",
+            "json",
+            "both"
+          ],
+          "default": "both",
+          "description": "输出格式"
+        },
+        "--output": {
+          "type": "string",
+          "default": "<repo>/audit-report/",
+          "description": "输出目录"
+        },
+        "--llm-provider": {
+          "type": "string",
+          "description": "LLM 协议：openai/anthropic 或厂商别名"
+        },
+        "--llm-model": {
+          "type": "string",
+          "description": "模型名称"
+        },
+        "--strict": {
+          "type": "boolean",
+          "default": false,
+          "description": "严格模式：Critical/Major 即 exit 1"
+        },
+        "--rules": {
+          "type": "string",
+          "description": "自定义规则 YAML（可多次）"
+        },
+        "--dim": {
+          "type": "string",
+          "description": "只审计指定维度（可多次）"
+        },
+        "--feedback": {
+          "type": "string",
+          "description": "提交反馈（创建 GitHub Issue）"
+        },
+        "--help": {
+          "type": "boolean",
+          "description": "显示帮助"
+        }
       },
-
       "exit_codes": {
         "0": "审计通过（无 Critical/Major 或 --strict 未启用）",
         "1": "有 Critical/Major 发现且 --strict 启用",
@@ -49,7 +87,6 @@
         "3": "目标不是 git 仓库"
       }
     },
-
     "environment_variables": {
       "LLM_PROVIDER": "LLM 协议（openai/anthropic/none），也可用厂商别名如 deepseek/qwen/glm",
       "LLM_API_KEY": "API Key（必须手动指定）",
@@ -58,35 +95,58 @@
       "REPO_AUDIT_TYPES": "自定义分类列表（JSON 数组）"
     }
   },
-
   "audit": {
     "dimensions": [
       {
         "id": "docs",
         "label": "文档",
-        "rules": ["DOC-001", "DOC-002", "DOC-003", "DOC-003b", "DOC-004", "DOC-005", "DOC-006", "DOC-007"],
+        "rules": [
+          "DOC-001",
+          "DOC-002",
+          "DOC-003",
+          "DOC-003b",
+          "DOC-004",
+          "DOC-005",
+          "DOC-006",
+          "DOC-007"
+        ],
         "description": "README/LICENSE/CONTRIBUTING/SECURITY 等文档完整性"
       },
       {
         "id": "git",
         "label": "Git",
-        "rules": ["GIT-001", "GIT-002", "GIT-003", "GIT-004"],
+        "rules": [
+          "GIT-001",
+          "GIT-002",
+          "GIT-003",
+          "GIT-004"
+        ],
         "description": "commit 规范、分支策略、scaffold 管理"
       },
       {
         "id": "quality",
         "label": "质量",
-        "rules": ["QUA-001", "QUA-002", "QUA-003", "QUA-004", "QUA-005"],
+        "rules": [
+          "QUA-001",
+          "QUA-002",
+          "QUA-003",
+          "QUA-004",
+          "QUA-005"
+        ],
         "description": "构建配置、测试、lint、typecheck"
       },
       {
         "id": "security",
         "label": "安全",
-        "rules": ["SEC-001", "SEC-002", "SEC-003", "SEC-004"],
+        "rules": [
+          "SEC-001",
+          "SEC-002",
+          "SEC-003",
+          "SEC-004"
+        ],
         "description": "密钥泄露、依赖漏洞、权限配置"
       }
     ],
-
     "scoring": {
       "formula": "score = 100 - (critical × 25) - (major × 10) - (minor × 3)",
       "grades": {
@@ -98,14 +158,26 @@
       },
       "note": "score 和 grade 不在 JSON 输出中，Agent 需根据 summary 字段自行计算"
     },
-
     "categories": [
-      "dsh-plugin", "python-app", "go-service", "content", "sandbox",
-      "archive", "product-oss", "javascript", "typescript", "java",
-      "python", "rust", "cpp", "dotnet", "php", "ruby", "unknown"
+      "dsh-plugin",
+      "python-app",
+      "go-service",
+      "content",
+      "sandbox",
+      "archive",
+      "product-oss",
+      "javascript",
+      "typescript",
+      "java",
+      "python",
+      "rust",
+      "cpp",
+      "dotnet",
+      "php",
+      "ruby",
+      "unknown"
     ]
   },
-
   "documents": [
     {
       "id": "human-guide",
@@ -189,12 +261,10 @@
       "description": "JSON Schema 定义，用于验证审计报告输出"
     }
   ],
-
   "feedback": {
     "description": "反馈通道 — Agent 可通过 GitHub Issues API 检测和处理用户反馈",
     "label": "audit-feedback",
     "repo": "NinjaSln-labs/repo-audit",
-
     "detect": {
       "command": "gh issue list --repo NinjaSln-labs/repo-audit --label audit-feedback --state open --json number,title,createdAt,body",
       "description": "列出未处理的反馈"
@@ -211,15 +281,29 @@
       "command": "node repo-audit.mjs --feedback '<反馈内容>'",
       "description": "通过 CLI 创建反馈 Issue（自动预填环境信息）"
     },
-
     "priorities": [
-      { "level": "critical", "sla": "24h", "description": "工具崩溃/数据损坏" },
-      { "level": "major", "sla": "72h", "description": "功能严重受损" },
-      { "level": "minor", "sla": "1周", "description": "功能部分受损" },
-      { "level": "info", "sla": "排期", "description": "建议改进" }
+      {
+        "level": "critical",
+        "sla": "24h",
+        "description": "工具崩溃/数据损坏"
+      },
+      {
+        "level": "major",
+        "sla": "72h",
+        "description": "功能严重受损"
+      },
+      {
+        "level": "minor",
+        "sla": "1周",
+        "description": "功能部分受损"
+      },
+      {
+        "level": "info",
+        "sla": "排期",
+        "description": "建议改进"
+      }
     ]
   },
-
   "quick_start": {
     "install": "npm install -g repo-audit-tool",
     "audit": "repo-audit --repo /path/to/repo",
@@ -229,7 +313,6 @@
     "custom_rules": "repo-audit --repo /path/to/repo --rules my-rules.yaml",
     "llm_enhanced": "LLM_API_KEY=sk-xxx repo-audit --repo . --llm-provider deepseek"
   },
-
   "changelog": {
     "1.4.0": "json_field workspace 递归——monorepo 场景下递归检查所有 workspace 包的 license 字段；findWorkspacePackages 发现 npm/pnpm workspaces + 常见目录；checkJsonFieldContent 提取为可复用函数；DOC-003b 启用；15 用例回归",
     "1.3.3": "Issue#5 修复：.auditrc.yaml since 字段 YAML 引号剥离——loadAuditrc 中 since: 分支补 .replace(/['\"]/g, '')，与 reason 分支对称，修复 waived_since 输出含字面引号的 bug；5 用例回归（test/auditrc-since.test.mjs）",
@@ -239,6 +322,7 @@
     "1.2.3": "package.json 补充 repository 字段，修复 npm provenance E422；完成 Trusted Publisher tag 自动发布",
     "1.2.2": "publish CI 改用 node 22 + 条件升级 npm，修复 EBADENGINE（tag 发布因 1.2.1 已存在未出包）",
     "1.2.1": "README 链接改为绝对 URL（修复 npm 页面 404）",
-    "1.2.0": "开源就绪：AGENTS.md、CI/publish workflow、json_field monorepo、fallback_field 数组、英文 README、参数类型校验、占位符扫描"
+    "1.2.0": "开源就绪：AGENTS.md、CI/publish workflow、json_field monorepo、fallback_field 数组、英文 README、参数类型校验、占位符扫描",
+    "1.4.1": "yaml_field 解析健壮性——CRLF 行尾剥离 + 引号键名识别 + 子层缩进以首个子键为准（SEC-004 job 级 id-token 误判 fail，Issue#6）；6 用例回归"
   }
 }

package/docs/repo-audit/AGENT-GUIDE.md

@@ -275,6 +275,10 @@ EOF
 node repo-audit.mjs --repo /path/to/repo --rules /tmp/my-rules.yaml --format json
 ```
 
+### 4.7 yaml_field fallback_field 与解析健壮性（Issue#6）
+
+`yaml_field` 支持 `fallback_field`（数组）：主字段不匹配时逐个尝试备选路径，段内 `*` 为通配展开（如 `jobs.*.permissions.id-token`——任一 job 级命中即 pass，覆盖 PyPA 最小化权限模式）。解析层（v1.4.1）统一剥离 CRLF 行尾 `\r`、识别引号键名、按首个子键实际缩进确定子层（2/4 空格风格均支持）。误判排查时优先确认 workflow 文件是否踩过这三类形态。
+
 ---
 
 ## 五、错误处理协议

package/docs/repo-audit/HUMAN-GUIDE.md

@@ -688,6 +688,15 @@ params:
   fallback_field: "scripts.test"
 ```
 
+### 12.4b yaml_field fallback_field 与解析健壮性（Issue#6）
+
+`yaml_field` 支持 `fallback_field`（数组）：主字段不匹配时逐个尝试备选路径，段内 `*` 为通配（如 `jobs.*.permissions.id-token`——顶层无 `permissions.id-token` 时，任一 job 级命中即 pass，覆盖 PyPA 最小化权限模式）。
+
+解析健壮性（v1.4.1 修复，Issue#6）：
+- **CRLF 行尾**：行解析前统一剥离 `\r`，Windows 编辑的 workflow 不再标量失配
+- **引号键名**：`"publish":` / `'publish':` 与裸键等价识别
+- **缩进风格**：子层缩进以首个子键实际缩进为准（2/4 空格等风格均支持，不再硬编码 +2）
+
 ### 12.5 toml_field expect_table
 
 检查 TOML 表头存在性（而非表内键值）：

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repo-audit-tool",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "description": "仓库标准化审计工具 + 工程脚手架生成器（零依赖）",
   "type": "module",
   "main": "repo-audit.mjs",

package/repo-audit.mjs

@@ -325,30 +325,49 @@ function countNonHiddenFiles(path) {
   return count
 }
 
-// Issue#2 fix: 定位指定缩进层级下的具名子键（返回行号与缩进；未找到返回 null）
+// Issue#6 fix: 规范化 YAML 行——剥离行尾 \r（CRLF 文件在 Linux 审计时 (.*)$ 不吞 \r，
+// 标量值带尾 \r 导致与 expected 比较全部失配）；行内键名引号在匹配处单独处理
+function normalizeYamlLines(content) {
+  return String(content).split('\n').map(l => l.replace(/\r$/, ''))
+}
+// Issue#6 fix: YAML 键名匹配——兼容裸键与引号键（"publish": / 'publish':），
+// 返回 [key, valueRest]；非键行返回 null
+function matchYamlKey(l) {
+  const m = l.match(/^(\s*)(?:"([^"]+)"|'([^']+)'|(\w[\w\-]*))\s*:\s*(.*)$/)
+  if (!m) return null
+  return [m[2] ?? m[3] ?? m[4], m[5]]
+}
+
+// Issue#6 fix: 定位指定缩进层级下的具名子键（返回行号与缩进；未找到返回 null）
+// 子层缩进以本层首个子键的实际缩进为准（兼容 2/4 空格等缩进风格），不再硬编码 +2
 function findNestedYamlKey(lines, startIdx, baseIndent, key) {
+  let childIndent = -1
   for (let i = startIdx + 1; i < lines.length; i++) {
     const l = lines[i]
     if (!l.trim() || l.trim().startsWith('#')) continue
     const ind = l.length - l.trimStart().length
     if (ind <= baseIndent) return null
-    if (ind !== baseIndent + 2) continue // 只看直接子层（YAML 常规 2 空格缩进）
-    const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-    if (m && m[1] === key) return { idx: i, indent: ind }
+    if (childIndent === -1) childIndent = ind // 本层首个子键确定子层缩进
+    if (ind !== childIndent) continue // 只看直接子层
+    const km = matchYamlKey(l)
+    if (km && km[0] === key) return { idx: i, indent: ind }
   }
   return null
 }
 // Issue#2 fix: 列出指定父键下一层的所有子键名（通配 * 展开用）
+// 子层缩进同样以首个子键实际缩进为准（与 findNestedYamlKey 对称）
 function listChildKeys(lines, startIdx, baseIndent) {
   const keys = []
+  let childIndent = -1
   for (let i = startIdx + 1; i < lines.length; i++) {
     const l = lines[i]
     if (!l.trim() || l.trim().startsWith('#')) continue
     const ind = l.length - l.trimStart().length
     if (ind <= baseIndent) break
-    if (ind !== baseIndent + 2) continue
-    const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-    if (m) keys.push(m[1])
+    if (childIndent === -1) childIndent = ind
+    if (ind !== childIndent) continue
+    const km = matchYamlKey(l)
+    if (km) keys.push(km[0])
   }
   return keys
 }
@@ -374,10 +393,10 @@ function findNestedYaml(lines, startIdx, baseIndent, segments) {
     if (!l.trim() || l.trim().startsWith('#')) continue
     const ind = l.length - l.trimStart().length
     if (ind <= currentIndent) break // 退出当前层级
-    const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-    if (m) {
-      const key = m[1]
-      const valStr = stripYamlComment(m[2])
+    const km = matchYamlKey(l)
+    if (km) {
+      const key = km[0]
+      const valStr = stripYamlComment(km[1])
       const seg = segments[0]
       if (key === seg) {
         if (valStr && valStr !== '' && valStr !== '{}') {
@@ -902,6 +921,11 @@ function hasEquivalentDocs(repoPath) {
 // 规则检查引擎
 // ============================================================
 
+// Issue#6 回归需要进程内直调（win32 下 spawnSync node 走 PATHEXT 解析不可靠，P-007 同族坑）
+export function runCheckForTest(rule, repoPath, mpj = null) {
+  return runCheck(rule, repoPath, mpj)
+}
+
 function runCheck(rule, repoPath, mpj = null) {
   const { check, params } = rule
   let passed = false
@@ -1187,7 +1211,7 @@ function runCheck(rule, repoPath, mpj = null) {
       let val = null
       let found = false
       try {
-        const lines = content.split('\n')
+        const lines = normalizeYamlLines(content)
         let currentIndent = -1
         let currentObj = null
         // 第一遍：找到顶层键
@@ -1195,10 +1219,10 @@ function runCheck(rule, repoPath, mpj = null) {
           const l = lines[i]
           if (!l.trim() || l.trim().startsWith('#')) continue
           const ind = l.length - l.trimStart().length
-          const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-          if (m && m[1] === segments[0]) {
+          const km = matchYamlKey(l)
+          if (km && km[0] === segments[0]) {
             currentIndent = ind
-            const valStr = stripYamlComment(m[2])
+            const valStr = stripYamlComment(km[1])
             if (valStr && valStr !== '' && valStr !== '{}') {
               // 标量值（非嵌套）
               val = valStr
@@ -1233,7 +1257,7 @@ function runCheck(rule, repoPath, mpj = null) {
             const wIdx = segs.indexOf('*')
             if (wIdx === -1) { candidates.push({ segments: segs }); return }
             // 找通配段父级的所有子键：先定位父级前缀（逐段下钻收集行号）
-            const lines = content.split('\n')
+            const lines = normalizeYamlLines(content)
             const prefix = segs.slice(0, wIdx)
             const suffix = segs.slice(wIdx + 1)
             // 顶层段
@@ -1241,8 +1265,8 @@ function runCheck(rule, repoPath, mpj = null) {
             for (let i = 0; i < lines.length; i++) {
               const l = lines[i]
               if (!l.trim() || l.trim().startsWith('#')) continue
-              const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-              if (!m || m[1] !== prefix[0]) continue
+              const km = matchYamlKey(l)
+              if (!km || km[0] !== prefix[0]) continue
               // 沿 prefix 下钻
               let curIdx = i, curIndent = l.length - l.trimStart().length
               let ok = true
@@ -1263,14 +1287,14 @@ function runCheck(rule, repoPath, mpj = null) {
             let fbVal = null
             let fbFound = false
             try {
-              const lines = content.split('\n')
+              const lines = normalizeYamlLines(content)
               for (let i = 0; i < lines.length; i++) {
                 const l = lines[i]
                 if (!l.trim() || l.trim().startsWith('#')) continue
                 const ind = l.length - l.trimStart().length
-                const m = l.match(/^\s*(\w[\w\-]*)\s*:\s*(.*)$/)
-                if (m && m[1] === cand.segments[0]) {
-                  const v = stripYamlComment(m[2])
+                const km = matchYamlKey(l)
+                if (km && km[0] === cand.segments[0]) {
+                  const v = stripYamlComment(km[1])
                   if (v && v !== '' && v !== '{}') { fbVal = v; fbFound = true }
                   else {
                     const sub = findNestedYaml(lines, i, ind, cand.segments.slice(1))