universal-dev-standards 6.3.6 → 6.3.7

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.6
-translation_version: 6.3.6
+source_version: 6.3.7
+translation_version: 6.3.7
 last_synced: 2026-08-07
 status: current
 ---
@@ -17,6 +17,13 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.7] - 2026-08-07
+
+### Fixed
+
+- **`uds deps` 只读 root 的 manifest，于是 monorepo 得到一个关于自己一部分的干净答案。** npm workspaces 会把声明放在不只一份 `package.json`，而这个命令只看了其中一份。实测于一个真实项目：回报 34 个依赖，实际声明 47 个——**在 workspace 里的那 13 个是隐形的，而其中一个带着 high 级别的公告**。**一个没有带着自己范围的计数，与一个完整的计数无从分辨**，而那正是这个命令存在要回报的失效。现在会从 `workspaces` 字段展开、检查每一份 manifest，并在报告中打印纳入了哪些 workspace，让分母自己带着范围。每一行漂移都标明它来自哪个 workspace——否则读者知道某个包漂移了，却不知道该去改哪一份 `package.json`。
+- 三个细节决定了「有覆盖 workspaces」与「看起来有覆盖」的差别。lockfile 的条目可能被 hoist 到 root，**也可能**嵌套在 workspace 底下，所以两处都查；只查一处会把另一处回报成「not present in package-lock.json」，而**一个被捏造出来的未知读起来像一个发现**。workspace 依赖于另一个 workspace 时是文件链接而非已发布包，因此跳过而不查询——问 npm 会得到 404 并被记成 unverifiable。以及，比「最后一段结尾一个 `*`」更复杂的 `workspaces` 模式现在会**大声失败**而非匹配一个子集：**静静地覆盖得比作者本意少，是同一个缺陷换个地方发生**。
+
 ## [6.3.6] - 2026-08-07
 
 ### Fixed

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.3.6 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.7 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.6
-translation_version: 6.3.6
+source_version: 6.3.7
+translation_version: 6.3.7
 last_synced: 2026-08-07
 status: current
 ---
@@ -17,6 +17,13 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.7] - 2026-08-07
+
+### Fixed
+
+- **`uds deps` 只讀 root 的 manifest，於是 monorepo 得到一個關於自己一部分的乾淨答案。** npm workspaces 會把宣告放在不只一份 `package.json`，而這個指令只看了其中一份。實測於一個真實專案：回報 34 個相依，實際宣告 47 個——**在 workspace 裡的那 13 個是隱形的，而其中一個帶著 high 等級的公告**。**一個沒有帶著自己範圍的計數，與一個完整的計數無從分辨**，而那正是這個指令存在要回報的失效。現在會從 `workspaces` 欄位展開、檢查每一份 manifest，並在報告中印出納入了哪些 workspace，讓分母自己帶著範圍。每一列漂移都標明它來自哪個 workspace——否則讀者知道某個套件漂移了，卻不知道該去改哪一份 `package.json`。
+- 三個細節決定了「有涵蓋 workspaces」與「看起來有涵蓋」的差別。lockfile 的條目可能被 hoist 到 root，**也可能**巢狀在 workspace 底下，所以兩處都查；只查一處會把另一處回報成「not present in package-lock.json」，而**一個被捏造出來的未知讀起來像一個發現**。workspace 相依於另一個 workspace 時是檔案連結而非已發布套件，因此跳過而不查詢——問 npm 會得到 404 並被記成 unverifiable。以及，比「最後一段結尾一個 `*`」更複雜的 `workspaces` 模式現在會**大聲失敗**而非匹配一個子集：**靜靜地涵蓋得比作者本意少，是同一個缺陷換個地方發生**。
+
 ## [6.3.6] - 2026-08-07
 
 ### Fixed

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.3.6 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.7 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.3.6",
+  "version": "6.3.7",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/deps.js

@@ -37,6 +37,15 @@ export function render(result) {
   lines.push('');
   lines.push(`${label} — ${result.examined} runtime dependenc${result.examined === 1 ? 'y' : 'ies'} checked`);
 
+  // The scope of the count, printed whenever it is more than the root. A
+  // denominator without its scope is what let this command report "34
+  // dependencies checked" for a repository that declared 47 across two
+  // manifests — the reader has no way to tell a complete answer from a subset.
+  const wsCount = result.workspaces?.length ?? 0;
+  if (wsCount > 0) {
+    lines.push(chalk.dim(`  across the root and ${wsCount} workspace${wsCount === 1 ? '' : 's'}: ${result.workspaces.join(', ')}`));
+  }
+
   if (!result.hasLockfile) {
     lines.push(chalk.yellow('  no package-lock.json — nothing to compare the registry against'));
   }
@@ -52,9 +61,12 @@ export function render(result) {
     // underneath it" shape that R4 rewrote the supply-chain standard to stop.
     lines.push(chalk.yellow(`  ${result.drifted.length} tested ≠ resolves:`));
     for (const d of result.drifted) {
+      // The workspace is part of the finding, not decoration: without it the
+      // reader knows a package drifted but not which package.json to edit.
+      const where = d.workspaceDir ? chalk.dim(`  [${d.workspaceDir}]`) : '';
       lines.push(
         `    ${chalk.bold(d.name)}  ${chalk.dim(d.range)}` +
-          `  tested=${chalk.cyan(d.locked)}  resolves=${chalk.yellow(d.resolved)}`
+          `  tested=${chalk.cyan(d.locked)}  resolves=${chalk.yellow(d.resolved)}${where}`
       );
     }
     lines.push('');

package/src/utils/dependency-resolution.js

@@ -66,7 +66,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { readFileSync, existsSync } from 'node:fs';
+import { readFileSync, existsSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import semver from 'semver';
 
@@ -200,6 +200,66 @@ function spawnNpm(cwd) {
     });
 }
 
+/**
+ * Expand npm's `workspaces` field into directories that contain a
+ * package.json. // implements XSPEC-366 R1 (workspaces)
+ *
+ * Accepts both spellings — an array, or `{ packages: [...] }` — and supports a
+ * trailing `*` in the last segment, which is what `packages/*` needs and is the
+ * shape npm's own docs use. A pattern that matches nothing is returned as
+ * nothing rather than as an error: an empty `packages/*` is a normal state for
+ * a repository that has not added one yet.
+ */
+function expandWorkspaces(root, field) {
+  const patterns = Array.isArray(field) ? field : Array.isArray(field?.packages) ? field.packages : [];
+  const dirs = [];
+  for (const pattern of patterns) {
+    if (typeof pattern !== 'string' || pattern.length === 0) continue;
+    const star = pattern.indexOf('*');
+    if (star === -1) {
+      if (existsSync(join(root, pattern, 'package.json'))) dirs.push(pattern);
+      continue;
+    }
+    // Only a trailing `*` in the final segment is supported. Anything more
+    // exotic is rejected loudly rather than silently matching less than the
+    // author meant — a workspace quietly outside the denominator is the defect
+    // this module exists to report.
+    const prefix = pattern.slice(0, star);
+    if (!pattern.endsWith('*') || prefix.includes('*') || (prefix.length > 0 && !prefix.endsWith('/'))) {
+      throw new Error(
+        `unsupported workspaces pattern ${JSON.stringify(pattern)} — only a trailing "*" in the last segment is understood`
+      );
+    }
+    const parent = join(root, prefix);
+    if (!existsSync(parent)) continue;
+    for (const entry of readdirSync(parent, { withFileTypes: true })) {
+      if (!entry.isDirectory()) continue;
+      const rel = `${prefix}${entry.name}`;
+      if (existsSync(join(root, rel, 'package.json'))) dirs.push(rel);
+    }
+  }
+  return dirs;
+}
+
+/**
+ * Where the lockfile records this dependency.
+ *
+ * npm hoists what it can to the root `node_modules` and nests the rest under
+ * the workspace, so both have to be tried; checking only one under-reports and
+ * calls the miss "unverifiable", which is noise that trains people to ignore
+ * the report.
+ */
+function lockedVersionFor(lock, workspaceDir, name) {
+  const candidates = workspaceDir
+    ? [`${workspaceDir}/node_modules/${name}`, `node_modules/${name}`]
+    : [`node_modules/${name}`];
+  for (const key of candidates) {
+    const entry = lock?.packages?.[key];
+    if (entry?.version) return entry.version;
+  }
+  return null;
+}
+
 /** Map over `items` with a bounded number of concurrent workers. */
 async function mapWithConcurrency(items, limit, worker) {
   const results = new Array(items.length);
@@ -238,16 +298,37 @@ export async function measureResolutionDrift(root, options = {}) {
   const lockPath = join(root, 'package-lock.json');
   const lock = existsSync(lockPath) ? JSON.parse(readFileSync(lockPath, 'utf8')) : null;
 
-  const declared = [
-    ...Object.entries(pkg.dependencies ?? {}).map(([name, range]) => ({ name, range, kind: 'dependencies' })),
-    ...Object.entries(pkg.optionalDependencies ?? {}).map(([name, range]) => ({ name, range, kind: 'optionalDependencies' })),
-  ];
+  // Workspaces are examined too. A monorepo that declares its shipped
+  // front-end in a workspace and its server at the root has two manifests, and
+  // reading only the root reports a clean subset as if it were the whole — the
+  // failure this module exists to catch, performed by the tool itself.
+  const workspaceDirs = expandWorkspaces(root, pkg.workspaces);
+  const manifests = [{ dir: null, name: pkg.name ?? null, pkg }];
+  for (const dir of workspaceDirs) {
+    const wsPkg = JSON.parse(readFileSync(join(root, dir, 'package.json'), 'utf8'));
+    manifests.push({ dir, name: wsPkg.name ?? dir, pkg: wsPkg });
+  }
+  // A workspace depending on a sibling workspace is a file link, not a
+  // registry package. Querying npm for it returns 404, which would be recorded
+  // as unverifiable — a fabricated unknown, which is worse than a missing one
+  // because it looks like a finding.
+  const localNames = new Set(manifests.map((m) => m.pkg.name).filter(Boolean));
+
+  const declared = [];
+  for (const { dir, name: workspace, pkg: manifest } of manifests) {
+    for (const kind of ['dependencies', 'optionalDependencies']) {
+      for (const [name, range] of Object.entries(manifest[kind] ?? {})) {
+        if (localNames.has(name)) continue;
+        declared.push({ name, range, kind, workspace, workspaceDir: dir });
+      }
+    }
+  }
 
   const run = options.run ?? spawnNpm(root);
   const concurrency = options.concurrency ?? DEFAULT_CONCURRENCY;
 
   const rows = await mapWithConcurrency(declared, concurrency, async (dep) => {
-    const locked = lock?.packages?.[`node_modules/${dep.name}`]?.version ?? null;
+    const locked = lockedVersionFor(lock, dep.workspaceDir, dep.name);
     let resolved;
     try {
       resolved = await resolveViaNpm(dep.name, dep.range, run);
@@ -282,6 +363,13 @@ export async function measureResolutionDrift(root, options = {}) {
     root,
     packageName: pkg.name ?? null,
     hasLockfile: lock !== null,
+    /**
+     * Workspace directories examined alongside the root, so a reader can tell
+     * "no workspaces here" from "workspaces were not looked at". The count
+     * printed by the report is the denominator, and a denominator without its
+     * scope is the shape this module was written to refuse.
+     */
+    workspaces: workspaceDirs,
     examined: rows.length,
     consistent,
     drifted,

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.3.6",
+  "version": "6.3.7",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.3.6"
+      "version": "6.3.7"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.3.6",
+      "version": "6.3.7",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.3.6",
+      "version": "6.3.7",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.3.6",
+      "version": "6.3.7",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.3.6",
+      "version": "6.3.7",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.3.6",
+      "version": "6.3.7",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"