universal-dev-standards 5.17.0 → 6.1.0

package/bundled/skills/testing-guide/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: testing-guide
-scope: uds-specific
+scope: universal
 description: |
   Testing pyramid and test writing standards for UT/IT/ST/E2E.
   Supports ISTQB and Industry Pyramid frameworks.

package/bundled/skills/testing-guide/testing-theory.md

@@ -1,6 +1,6 @@
 # Testing Theory Knowledge Base
 
-> **Language**: English | [繁體中文](../../locales/zh-TW/skills/testing-guide/testing-theory.md)
+> **Language**: English | [繁體中文](../../locales/zh-TW/skills/testing-guide/testing-theory.md) | [简体中文](../../locales/zh-CN/skills/testing-guide/testing-theory.md)
 
 **Version**: 1.0.0
 **Last Updated**: 2026-01-29

package/bundled/skills/workflows/README.md

@@ -1,6 +1,6 @@
 # UDS Workflows
 
-> **Language**: English | [繁體中文](../../locales/zh-TW/skills/workflows/README.md)
+> **Language**: English | [繁體中文](../../locales/zh-TW/skills/workflows/README.md) | [简体中文](../../locales/zh-CN/skills/workflows/README.md)
 
 **Version**: 1.1.0
 **Last Updated**: 2026-01-21
@@ -423,7 +423,7 @@ This prevents context pollution and ensures reproducible agent behavior.
 
 - [Agents Documentation](../agents/README.md)
 - [Skills Documentation](../README.md)
-- [Methodology System](../methodology-system/SKILL.md)
+- [Methodology System](../dev-methodology/SKILL.md)
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "5.17.0",
+  "version": "6.1.0",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",
@@ -61,7 +61,7 @@
   "dependencies": {
     "@inquirer/prompts": "^8.4.2",
     "chalk": "^5.3.0",
-    "commander": "^14.0.0",
+    "commander": "^15.0.0",
     "js-yaml": "^4.1.0",
     "ora": "^9.4.0"
   },
@@ -70,9 +70,9 @@
     "@vitest/coverage-v8": "^4.1.5",
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
-    "eslint": "10.4.1",
+    "eslint": "10.6.0",
     "glob": "^13.0.1",
-    "globals": "17.6.0",
+    "globals": "17.7.0",
     "husky": "^9.1.7",
     "lint-staged": "^17.0.3",
     "vitest": "^4.1.5"

package/src/commands/audit.js

@@ -302,19 +302,40 @@ async function handleReport(auditResult, options, msg) {
     return;
   }
 
-  // Interactive selection
+  // Interactive selection (skipped with --yes: submit all findings)
   let selectedFindings = findings.map(f => f.value);
   let userComments = '';
 
-  if (!isDryRun) {
-    const selected = await checkbox({
-      message: msg.submitPrompt || 'Select findings to submit:',
-      choices: findings
-    });
+  const submitAll = options.yes || false;
+  const nonInteractiveHint = msg.nonInteractiveHint ||
+    'Interactive prompt unavailable in this terminal. Re-run with `uds audit --report --yes` to submit all findings without prompts.';
 
-    const comments = await input({
-      message: msg.userCommentsPrompt || 'Additional comments (optional):'
-    });
+  if (!isDryRun && !submitAll) {
+    // @inquirer/prompts throws ExitPromptError on non-TTY stdin
+    // (CI, piped shells, some Windows consoles) — guard instead of crashing (#125)
+    if (!process.stdin.isTTY) {
+      console.log(chalk.yellow(nonInteractiveHint));
+      return;
+    }
+
+    let selected;
+    let comments;
+    try {
+      selected = await checkbox({
+        message: msg.submitPrompt || 'Select findings to submit:',
+        choices: findings
+      });
+
+      comments = await input({
+        message: msg.userCommentsPrompt || 'Additional comments (optional):'
+      });
+    } catch (err) {
+      if (err && err.name === 'ExitPromptError') {
+        console.log(chalk.yellow(nonInteractiveHint));
+        return;
+      }
+      throw err;
+    }
 
     selectedFindings = selected;
     userComments = comments || '';

package/src/commands/config.js

@@ -106,6 +106,30 @@ const VIBE_PRESETS = {
  * @param {string} value - Config value
  * @param {Object} options - Command options
  */
+/**
+ * Schema for known config keys (T12 input validation, XSPEC-292 §9).
+ * Unknown keys are allowed (forward-compatible); known keys are constrained.
+ */
+const CONFIG_SCHEMAS = {
+  'hitl.threshold': { type: 'number', enum: [0, 1, 2, 3, 4] },
+};
+
+/**
+ * Validate a config value against CONFIG_SCHEMAS.
+ * Returns an error message string, or null if valid / no schema.
+ */
+export function validateConfigValue(key, value) {
+  const schema = CONFIG_SCHEMAS[key];
+  if (!schema) return null;
+  if (schema.type === 'number' && typeof value !== 'number') {
+    return `${key} must be a number`;
+  }
+  if (schema.enum && !schema.enum.includes(value)) {
+    return `${key} must be one of: ${schema.enum.join(', ')}`;
+  }
+  return null;
+}
+
 export async function configCommand(action, key, value, options) {
   // Initialize config manager
   const currentConfig = config.init();
@@ -141,6 +165,13 @@ export async function configCommand(action, key, value, options) {
     if (value === 'false') typedValue = false;
     if (!isNaN(Number(value))) typedValue = Number(value);
 
+    // T12 input validation: enforce schema for known config keys
+    const schemaError = validateConfigValue(key, typedValue);
+    if (schemaError) {
+      console.error(chalk.red(`Error: ${schemaError}`));
+      return;
+    }
+
     const scope = options.global ? 'global' : 'project';
     config.set(key, typedValue, scope);
 
@@ -442,8 +473,8 @@ async function initVibeMode(options) {
   console.log('');
   console.log(chalk.gray(t('config.nextSteps', 'Next steps:')));
   console.log(chalk.gray(`  • ${t('config.useSpec', 'Generate specs:')} uds spec create "your idea"`));
-  console.log(chalk.gray(`  • ${t('config.useSweep', 'Clean up code:')} uds sweep`));
-  console.log(chalk.gray(`  • ${t('config.useStart', 'Start a mission:')} uds start greenfield "MyApp"`));
+  console.log(chalk.gray(`  • ${t('config.useSweep', 'Clean up code:')} /sweep (AI assistant skill)`));
+  console.log(chalk.gray(`  • ${t('config.useQuickstart', 'Explore recipes:')} uds quickstart`));
 }
 
 /**

package/src/commands/hitl.js

@@ -1,13 +1,26 @@
 import chalk from 'chalk';
 import { hitl } from '../hitl/manager.js';
 
+// T12 input validation (XSPEC-292 §9): bound operation description length.
+const MAX_OP_LENGTH = 500;
+
 export async function hitlCommand(options) {
   if (!options.op) {
     console.error(chalk.red('Error: --op <operation> is required'));
     return;
   }
 
-  const allowed = await hitl.enforce(options.op, { reason: 'Manual check via CLI' });
+  const op = String(options.op).trim();
+  if (op.length === 0) {
+    console.error(chalk.red('Error: --op must not be empty'));
+    return;
+  }
+  if (op.length > MAX_OP_LENGTH) {
+    console.error(chalk.red(`Error: --op must be ≤ ${MAX_OP_LENGTH} characters (got ${op.length})`));
+    return;
+  }
+
+  const allowed = await hitl.enforce(op, { reason: 'Manual check via CLI' });
 
   if (allowed) {
     console.log(chalk.green('✅ Approved'));

package/src/commands/init.js

@@ -24,6 +24,8 @@ import { displayLanguageToLocale } from '../utils/locale.js';
 import { generateReleaseConfig, RELEASE_MODE_LABELS } from '../utils/release-config.js';
 import { guardAgainstSelfAdoption } from '../utils/detect-self-adoption.js';
 import { readInstallYaml } from '../utils/config-manager.js';
+import { getToolFilePath } from '../utils/integration-generator.js';
+import { withFileTransaction } from '../utils/transaction.js';
 
 /**
  * Init command - initialize standards in current project
@@ -92,69 +94,119 @@ export async function initCommand(options) {
     }
   }
 
-  // ===== Execute Installation =====
+  // ===== Execute Installation (transactional — T11 / XSPEC-292 §9.2) =====
   console.log();
-  
-  // 1. Install Standards
-  const standardsResults = await installStandards(config, projectPath);
-  config.installedStandards = standardsResults.standards.map(s => basename(s));
-
-  // 1.5. Generate release-config.yaml if non-default mode selected
-  if (config.releaseMode && config.releaseMode !== 'ci-cd') {
-    const releaseConfigData = generateReleaseConfig(config.releaseMode);
-    const releaseConfigPath = join(projectPath, '.standards', 'release-config.yaml');
-    const yaml = (await import('js-yaml')).default;
-    mkdirSync(join(projectPath, '.standards'), { recursive: true });
-    writeFileSync(releaseConfigPath, yaml.dump(releaseConfigData), 'utf-8');
-    console.log(chalk.green(`  ✓ release-config.yaml (${config.releaseMode})`));
-  }
 
-  // 2. Install Integrations
-  const integrationResults = await installIntegrations(config, projectPath);
-
-  // 2.5. Generate universal AGENTS.md if requested
-  const agentsMdResult = await generateUniversalAgentsMd(config, integrationResults, projectPath);
-  if (agentsMdResult.path) {
-    integrationResults.integrations.push(agentsMdResult.path);
-    if (agentsMdResult.blockHashInfo) {
-      integrationResults.integrationBlockHashes[agentsMdResult.path] = {
-        ...agentsMdResult.blockHashInfo,
-        installedAt: new Date().toISOString()
-      };
+  // Files/dirs `init` owns and must tear down if the install fails partway.
+  // `.standards/` (and release-config.yaml beneath it) plus the per-tool
+  // integration files at the project root. Skills/commands install into shared
+  // agent dirs (e.g. ~/.claude/skills, .opencode/) that may already hold
+  // unrelated content, so they are intentionally NOT tracked here — re-running
+  // `uds init` re-installs them idempotently.
+  const ownedPaths = [join(projectPath, '.standards')];
+  for (const tool of (config.integrations || config.aiTools || [])) {
+    const file = getToolFilePath(tool);
+    if (file) ownedPaths.push(join(projectPath, file));
+  }
+  if (config.generateAgentsMd) ownedPaths.push(join(projectPath, 'AGENTS.md'));
+
+  let combinedResults;
+  // Captured inside apply() so the catch block can report which installers
+  // failed even though the verification error itself is generic.
+  let installErrors = [];
+  try {
+    const tx = await withFileTransaction(
+      ownedPaths,
+      {
+        apply: async () => {
+          // 1. Install Standards
+          const standardsResults = await installStandards(config, projectPath);
+          config.installedStandards = standardsResults.standards.map(s => basename(s));
+
+          // 1.5. Generate release-config.yaml if non-default mode selected
+          if (config.releaseMode && config.releaseMode !== 'ci-cd') {
+            const releaseConfigData = generateReleaseConfig(config.releaseMode);
+            const releaseConfigPath = join(projectPath, '.standards', 'release-config.yaml');
+            const yaml = (await import('js-yaml')).default;
+            mkdirSync(join(projectPath, '.standards'), { recursive: true });
+            writeFileSync(releaseConfigPath, yaml.dump(releaseConfigData), 'utf-8');
+            console.log(chalk.green(`  ✓ release-config.yaml (${config.releaseMode})`));
+          }
+
+          // 2. Install Integrations
+          const integrationResults = await installIntegrations(config, projectPath);
+
+          // 2.5. Generate universal AGENTS.md if requested
+          const agentsMdResult = await generateUniversalAgentsMd(config, integrationResults, projectPath);
+          if (agentsMdResult.path) {
+            integrationResults.integrations.push(agentsMdResult.path);
+            if (agentsMdResult.blockHashInfo) {
+              integrationResults.integrationBlockHashes[agentsMdResult.path] = {
+                ...agentsMdResult.blockHashInfo,
+                installedAt: new Date().toISOString()
+              };
+            }
+          }
+
+          // 3. Install Skills & Commands
+          const skillsResults = {
+            skills: [],
+            commands: [],
+            errors: [],
+            skillHashes: {},
+            commandHashes: {}
+          };
+          await installSkills(config.skillsConfig, projectPath, msg, skillsResults);
+          await installCommands(config.skillsConfig, projectPath, msg, skillsResults);
+
+          // Combine results
+          installErrors = [
+            ...standardsResults.errors,
+            ...integrationResults.errors,
+            ...skillsResults.errors
+          ];
+          return {
+            standards: standardsResults.standards,
+            extensions: standardsResults.extensions,
+            integrations: integrationResults.integrations,
+            skills: skillsResults.skills,
+            commands: skillsResults.commands,
+            errors: installErrors,
+            fileHashes: standardsResults.fileHashes,
+            skillHashes: skillsResults.skillHashes,
+            commandHashes: skillsResults.commandHashes,
+            integrationBlockHashes: integrationResults.integrationBlockHashes,
+            manifestIntegrationConfigs: integrationResults.manifestIntegrationConfigs
+          };
+        },
+        // A half-installed project must never be committed: if any installer
+        // reported an error, fail verification → roll back → no manifest written.
+        verify: (results) => results.errors.length === 0
+      },
+      { label: 'uds init' }
+    );
+    combinedResults = tx.result;
+  } catch (err) {
+    console.log();
+    console.log(chalk.red(
+      (msg.installFailed || 'Installation failed and was rolled back: {error}')
+        .replace('{error}', err.message)
+    ));
+    for (const e of installErrors) {
+      console.log(chalk.gray(`    ${e}`));
     }
+    if (err.rolledBack === false) {
+      console.log(chalk.yellow(
+        (msg.rollbackFailed || 'Rollback also failed: {error}. Manual cleanup may be required.')
+          .replace('{error}', err.rollbackError?.message || 'unknown')
+      ));
+    }
+    process.exit(1);
+    return;
   }
 
-  // 3. Install Skills & Commands
-  const skillsResults = {
-    skills: [],
-    commands: [],
-    errors: [],
-    skillHashes: {},
-    commandHashes: {}
-  };
-  await installSkills(config.skillsConfig, projectPath, msg, skillsResults);
-  await installCommands(config.skillsConfig, projectPath, msg, skillsResults);
-
-  // Combine results
-  const combinedResults = {
-    standards: standardsResults.standards,
-    extensions: standardsResults.extensions,
-    integrations: integrationResults.integrations,
-    skills: skillsResults.skills,
-    commands: skillsResults.commands,
-    errors: [
-      ...standardsResults.errors,
-      ...integrationResults.errors,
-      ...skillsResults.errors
-    ],
-    fileHashes: standardsResults.fileHashes,
-    skillHashes: skillsResults.skillHashes,
-    commandHashes: skillsResults.commandHashes,
-    integrationBlockHashes: integrationResults.integrationBlockHashes,
-    manifestIntegrationConfigs: integrationResults.manifestIntegrationConfigs
-  };
-
-  // 4. Write Manifest & Display Summary
+  // 4. Write Manifest & Display Summary (commit point — only reached when the
+  //    install verified clean; this is the "initialized" marker for the project)
   writeFinalManifest(config, combinedResults, projectPath);
 
   // 4.5. Generate layered CLAUDE.md (if --content-layout layered)
@@ -188,7 +240,7 @@ export async function initCommand(options) {
  * - Node.js projects: use husky
  * - Non-Node.js projects: write native .git/hooks/pre-commit
  */
-async function setupHuskyHook(projectPath) {
+export async function setupHuskyHook(projectPath) {
   const hasGit = existsSync(join(projectPath, '.git'));
   if (!hasGit) return;
 
@@ -197,6 +249,11 @@ async function setupHuskyHook(projectPath) {
   if (isNodeProject) {
     console.log(chalk.cyan('Configuring Pre-commit Hook (Husky)...'));
 
+    // Every edit we make to the adopter's package.json, reported at the end.
+    // `uds init` writes ~70 files; a one-line change to package.json is invisible
+    // in that diff unless we say it out loud (XSPEC-341 R1).
+    const pkgChanges = [];
+
     // 1. Install husky if needed
     try {
       const pkgPath = join(projectPath, 'package.json');
@@ -205,25 +262,54 @@ async function setupHuskyHook(projectPath) {
 
       if (!hasHusky) {
         console.log(chalk.gray('  Installing husky...'));
-        execSync('npm install --save-dev husky', { stdio: 'ignore', cwd: projectPath });
+        // stdio: 'pipe' rather than 'ignore' — the error text belongs in the
+        // message below, not in /dev/null.
+        execSync('npm install --save-dev husky', { stdio: 'pipe', cwd: projectPath });
+        pkgChanges.push('devDependencies.husky — added');
       }
     } catch (e) {
       console.log(chalk.yellow(`  ⚠ Failed to check/install husky: ${e.message}`));
       return;
     }
 
-    // 2. Initialize husky
+    // 2. Wire husky's `prepare` script ourselves.
+    //
+    // We deliberately do NOT run `npx husky init` (XSPEC-341 R1). That command is a
+    // one-time bootstrap for a NEW project, not an idempotent operation: it sets
+    // `"prepare": "husky"` unconditionally, destroying whatever was there. For a
+    // published package whose `prepare` is its build step — `"prepare": "tsup"` with
+    // no prepack/prepublishOnly and `files: ["dist"]` — that silently breaks the next
+    // `npm publish`, and the failure surfaces at release time, far from this command.
+    // (It also seeds .husky/pre-commit with `npm test`, a gate the adopter never asked
+    // for.) Adopting a standards library must never rewrite the adopter's build.
     const huskyDir = join(projectPath, '.husky');
     try {
-      if (!existsSync(huskyDir)) {
-        console.log(chalk.gray('  Initializing husky...'));
-        execSync('npx husky init', { stdio: 'ignore', cwd: projectPath });
+      const pkgPath = join(projectPath, 'package.json');
+      const raw = readFileSync(pkgPath, 'utf-8');
+      const pkg = JSON.parse(raw);
+      pkg.scripts = pkg.scripts || {};
+      const existing = pkg.scripts.prepare;
+
+      if (!existing) {
+        pkg.scripts.prepare = 'husky';
+        pkgChanges.push('scripts.prepare — added: "husky"');
+      } else if (!/\bhusky\b/.test(existing)) {
+        // Chain, never clobber. The adopter's command runs first and keeps its
+        // exit code meaningful.
+        pkg.scripts.prepare = `${existing} && husky`;
+        pkgChanges.push(`scripts.prepare — "${existing}" → "${pkg.scripts.prepare}"`);
+      }
+
+      if (pkg.scripts.prepare !== existing) {
+        // Preserve the file's trailing newline convention.
+        const indent = raw.match(/^\{\n(\s+)"/)?.[1]?.length ?? 2;
+        writeFileSync(pkgPath, JSON.stringify(pkg, null, indent) + (raw.endsWith('\n') ? '\n' : ''), 'utf-8');
       }
-    } catch {
-      // Ignore, might already be init
+    } catch (e) {
+      console.log(chalk.yellow(`  ⚠ Failed to configure the prepare script: ${e.message}`));
     }
 
-    // 3. Ensure .husky directory exists (fallback if husky init failed)
+    // 3. Ensure .husky directory exists
     if (!existsSync(huskyDir)) {
       try {
         mkdirSync(huskyDir, { recursive: true });
@@ -238,16 +324,15 @@ async function setupHuskyHook(projectPath) {
     const udsCmd = 'npx uds check';
 
     try {
-      let content = '';
-      if (existsSync(preCommitPath)) {
-        content = readFileSync(preCommitPath, 'utf-8');
-      } else {
-        // Create if not exists (husky init usually creates it, but just in case)
-        content = '#!/usr/bin/env sh\n. "$(dirname -- "$0")/_/husky.sh"\n';
-      }
+      // husky v9 hooks are plain shell scripts: no shebang, no `_/husky.sh` sourcing
+      // (that is v8 syntax, deprecated in v9 and removed in v10). We install husky
+      // ^9, so a fresh hook must be v9-shaped. Existing files are appended to, never
+      // rewritten — their contents are the adopter's, not ours.
+      const content = existsSync(preCommitPath) ? readFileSync(preCommitPath, 'utf-8') : '';
 
       if (!content.includes('uds check')) {
-        writeFileSync(preCommitPath, content + `\n# UDS Standard Check\n${udsCmd}\n`, 'utf-8');
+        const sep = content && !content.endsWith('\n') ? '\n' : '';
+        writeFileSync(preCommitPath, `${content}${sep}\n# UDS Standard Check\n${udsCmd}\n`, 'utf-8');
         try {
           execSync(`chmod +x ${preCommitPath}`);
         } catch {
@@ -260,6 +345,14 @@ async function setupHuskyHook(projectPath) {
     } catch (e) {
       console.log(chalk.red(`  ✗ Failed to configure pre-commit hook: ${e.message}`));
     }
+
+    // 5. Say what we changed in their package.json.
+    if (pkgChanges.length > 0) {
+      console.log(chalk.cyan('  package.json modified:'));
+      for (const change of pkgChanges) {
+        console.log(chalk.gray(`    • ${change}`));
+      }
+    }
   } else {
     // Non-Node.js: write native .git/hooks/pre-commit
     console.log(chalk.cyan('Configuring Pre-commit Hook (native git hook)...'));

package/src/commands/quickstart.js

@@ -35,7 +35,7 @@ export const WORKFLOWS = [
     name: 'Test-Driven Development (TDD)',
     description: 'Red-Green-Refactor cycle',
     steps: [
-      { cmd: 'uds workflow execute tdd', desc: 'Start TDD workflow' },
+      { cmd: '# Drive TDD with the /tdd skill', desc: 'Red-Green-Refactor from your AI assistant' },
       { cmd: '# Write failing test (RED)', desc: 'Define expected behavior' },
       { cmd: '# Make it pass (GREEN)', desc: 'Minimal implementation' },
       { cmd: '# Improve (REFACTOR)', desc: 'Clean up without breaking tests' },
@@ -57,7 +57,6 @@ export const WORKFLOWS = [
     steps: [
       { cmd: 'uds sync', desc: 'Generate context.md from git diff + workflow state' },
       { cmd: 'cat .workflow-state/context.md', desc: 'Read context in new session' },
-      { cmd: 'uds workflow status', desc: 'Check workflow execution status' },
     ],
   },
 ];

package/src/commands/release.js

@@ -14,8 +14,12 @@ import yaml from 'js-yaml';
 import { existsSync, readFileSync, writeFileSync } from 'fs';
 import { join } from 'path';
 import { execSync } from 'child_process';
+import { createHash } from 'crypto';
 import { resolveReleaseWorkflow } from '../utils/release-config.js';
-import { formatGitTag, createPromotionRecord, parseRCVersion } from '../utils/version-promote.js';
+import { formatGitTag, createPromotionRecord, parseRCVersion, isStableVersion } from '../utils/version-promote.js';
+
+// Default deployment environments (overridable via release-config.yaml release.environments)
+const DEFAULT_ENVIRONMENTS = ['development', 'staging', 'canary', 'preview', 'production'];
 import { createManifest, verifyManifest } from '../utils/build-manifest.js';
 import { recordDeployment, updateDeploymentResult, checkDeploymentReadiness } from '../utils/deployment-tracker.js';
 
@@ -149,7 +153,7 @@ export async function releaseCommand(subcommand, args, options) {
         console.log(chalk.red('verify 子命令僅在 manual 或 hybrid 模式下可用。'));
         return;
       }
-      await handleVerify(projectPath);
+      await handleVerify(projectPath, options);
       break;
 
     default:
@@ -177,6 +181,13 @@ async function handlePromote(targetVersion, projectPath) {
     return;
   }
 
+  // Validate stable semver format (catches typos like 1.a.0, 1.2, abc)
+  if (!isStableVersion(targetVersion)) {
+    console.log(chalk.red(`版本格式無效: ${targetVersion}`));
+    console.log(chalk.gray('  需為 stable semver（X.Y.Z），例如: uds release promote 1.2.0'));
+    return;
+  }
+
   // Find the latest RC for this version
   const currentVersion = getPackageVersion(projectPath);
   const parsed = currentVersion ? parseRCVersion(currentVersion) : null;
@@ -221,6 +232,19 @@ async function handleDeploy(environment, options, projectPath) {
     return;
   }
 
+  // Validate environment against allow-list (overridable via release-config.yaml)
+  const deployConfig = loadReleaseConfig(projectPath);
+  const allowedEnvironments =
+    Array.isArray(deployConfig?.release?.environments) && deployConfig.release.environments.length > 0
+      ? deployConfig.release.environments
+      : DEFAULT_ENVIRONMENTS;
+  if (!allowedEnvironments.includes(environment)) {
+    console.log(chalk.red(`未知的部署環境: ${environment}`));
+    console.log(chalk.gray(`  允許的環境: ${allowedEnvironments.join(', ')}`));
+    console.log(chalk.gray('  自訂環境請在 .standards/release-config.yaml 設定 release.environments'));
+    return;
+  }
+
   const currentVersion = getPackageVersion(projectPath) || 'unknown';
   const deployments = loadDeployments(projectPath);
 
@@ -307,9 +331,12 @@ async function handleManifest(versionArg, options, projectPath) {
 }
 
 /**
- * /release verify
+ * /release verify [--artifact <path>]
+ *
+ * T13 (XSPEC-292): when --artifact is given, compute its SHA256 so verify
+ * actually CONSUMES the checksum recorded in the manifest, not just stores it.
  */
-async function handleVerify(projectPath) {
+async function handleVerify(projectPath, options = {}) {
   const manifestPath = join(projectPath, 'build-manifest.json');
 
   if (!existsSync(manifestPath)) {
@@ -327,12 +354,26 @@ async function handleVerify(projectPath) {
   }
   const currentCommit = getGitCommit();
 
-  const result = verifyManifest(manifest, currentCommit);
+  // Compute the artefact's checksum when a path is supplied.
+  let actualChecksum;
+  const artifactPath = options.artifact || null;
+  if (artifactPath) {
+    if (!existsSync(artifactPath)) {
+      console.log(chalk.red(`找不到 artifact：${artifactPath}`));
+      return;
+    }
+    actualChecksum = createHash('sha256').update(readFileSync(artifactPath)).digest('hex');
+  }
+
+  const result = verifyManifest(manifest, currentCommit, { actualChecksum });
 
   if (result.valid) {
     console.log(chalk.green('✓ Manifest 驗證通過'));
     console.log(chalk.gray(`  版本: ${manifest.version}`));
     console.log(chalk.gray(`  Commit: ${manifest.commit} (一致)`));
+    if (actualChecksum && manifest.checksum?.package) {
+      console.log(chalk.gray(`  Checksum: ${actualChecksum} (一致)`));
+    }
   } else {
     console.log(chalk.red('✗ Manifest 驗證失敗'));
     for (const err of result.errors) {
@@ -340,6 +381,10 @@ async function handleVerify(projectPath) {
     }
   }
 
+  for (const w of result.warnings ?? []) {
+    console.log(chalk.yellow(`  ⚠ ${w}`));
+  }
+
   // Show staging status
   const deployments = loadDeployments(projectPath);
   const stagingPassed = deployments.some(
@@ -369,7 +414,7 @@ function showReleaseHelp(workflow) {
     console.log(chalk.gray('    deploy <env>          記錄部署紀錄'));
     console.log(chalk.gray('    deploy <env> --result  更新測試結果'));
     console.log(chalk.gray('    manifest              產生 build-manifest.json'));
-    console.log(chalk.gray('    verify                驗證 manifest 一致性'));
+    console.log(chalk.gray('    verify [--artifact <path>]  驗證 manifest 一致性（含 checksum 比對）'));
   } else {
     console.log(chalk.gray('  CI/CD 模式下，請使用 /release start 和 /release finish'));
     console.log(chalk.gray('  切換到手動模式: uds config --type release_mode'));

package/src/commands/run-intent.js

@@ -19,6 +19,15 @@ export async function runIntentCommand(intent, options = {}) {
     return;
   }
 
+  // T12 input validation (XSPEC-292 §9): intent is a config key lookup —
+  // restrict to a safe charset to reject malformed/injection-style input.
+  if (!/^[a-z0-9][a-z0-9_-]*$/.test(intent)) {
+    console.error(chalk.red(`✗ intent 格式無效: "${intent}"`));
+    console.log(chalk.gray('  intent 僅可含小寫字母、數字、- 與 _（例: test, lint, build）'));
+    process.exit(1);
+    return;
+  }
+
   let resolved;
   try {
     resolved = resolveCommand(intent, projectPath);