universal-dev-standards 6.2.1 → 6.2.3

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.1
-translation_version: 6.2.1
+source_version: 6.2.3
+translation_version: 6.2.3
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,19 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.3] - 2026-07-31
+
+### 修复
+
+- **重新选取已安装的 agent 会追加一笔重复的 manifest 记录。** 四个 manifest 写入端以 `[...existing, ...new]` 追加安装记录，于是一个已被记录的 agent 每次被重新选取就多一笔；某个项目的 manifest 读起来是 `['claude-code', 'claude-code']`。安装器本身从未受影响——`installSkillsToMultipleAgents` 会对输入去重。损害仅限于**记录**，以及每一个会迭代它的消费端：`checkNewFeatures`、reconciler 的扫描器与期望状态计算器都把那个 agent 走了两遍。效果无害——**这正是它跨越五次升级都没被注意到的原因**。四个写入端现在改用安装器早就在用的那个 helper。
+
+## [6.2.2] - 2026-07-31
+
+### 修复
+
+- **`uds check` 的技能完整性只检查了你文件中的一小部分。** 某个项目上它打印出 `✓ All skill files intact (6 files)`，而实际安装了 **345** 个。`scanDirectory` 以 `fullPath.slice(basePath.length + 1)` 推导相对路径，这假设了 base path 不带尾部分隔符——而三个 agent 的技能路径带（`.claude/skills/`、`.opencode/skill/`、`.cursor/skills/`）。于是每个条目都被砍掉第一个字符（`ac-coverage` → `c-coverage`、`.manifest.json` → `manifest.json`）；`computeDirectoryHashes` 用这个坏掉的名字重组绝对路径、找不到文件、跳过该条目。**扫了 115 个文件，只算出 2 个哈希。** 过程中没有任何一步失败——目录存在、循环跑完、函数返回对象，而检查在 2% 的表面上打了绿勾。`manifest.skillHashes` 现在会被正确填入；同一个项目报告 345。
+
+
 ## [6.2.1] - 2026-07-31
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.2.1 | **发布日期**: 2026-07-30 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.3 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.2.1 | ✅ 最新正式版 |
+| 6.2.3 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.1
-translation_version: 6.2.1
+source_version: 6.2.3
+translation_version: 6.2.3
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,19 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.3] - 2026-07-31
+
+### 修復
+
+- **重新選取已安裝的 agent 會追加一筆重複的 manifest 紀錄。** 四個 manifest 寫入端以 `[...existing, ...new]` 追加安裝紀錄，於是一個已被記錄的 agent 每次被重新選取就多一筆；某個專案的 manifest 讀起來是 `['claude-code', 'claude-code']`。安裝器本身從未受影響——`installSkillsToMultipleAgents` 會對輸入去重。損害僅限於**紀錄**，以及每一個會迭代它的消費端：`checkNewFeatures`、reconciler 的掃描器與期望狀態計算器都把那個 agent 走了兩次。效果無害——**這正是它跨越五次升級都沒被注意到的原因**。四個寫入端現在改用安裝器早就在用的那個 helper。
+
+## [6.2.2] - 2026-07-31
+
+### 修復
+
+- **`uds check` 的技能完整性只檢查了你檔案中的一小部分。** 某個專案上它印出 `✓ All skill files intact (6 files)`，而實際安裝了 **345** 個。`scanDirectory` 以 `fullPath.slice(basePath.length + 1)` 推導相對路徑，這假設了 base path 不帶尾端分隔符——而三個 agent 的技能路徑帶（`.claude/skills/`、`.opencode/skill/`、`.cursor/skills/`）。於是每個項目都被砍掉第一個字元（`ac-coverage` → `c-coverage`、`.manifest.json` → `manifest.json`）；`computeDirectoryHashes` 用這個壞掉的名字重組絕對路徑、找不到檔案、跳過該項。**掃了 115 個檔，只算出 2 個雜湊。** 過程中沒有任何一步失敗——目錄存在、迴圈跑完、函式回傳物件，而檢查在 2% 的表面上印了綠勾。`manifest.skillHashes` 現在會被正確填入；同一個專案回報 345。
+
+
 ## [6.2.1] - 2026-07-31
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.2.1 | **發布日期**: 2026-07-30 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.3 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.2.1 | ✅ 最新正式版 |
+| 6.2.3 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.2.1",
+  "version": "6.2.3",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/update.js

@@ -27,6 +27,7 @@ import { config } from '../utils/config-manager.js';
 import {
   installSkillsToMultipleAgents,
   installCommandsToMultipleAgents,
+  deduplicateInstallations,
   getInstalledSkillsInfoForAgent,
   getInstalledCommandsForAgent,
   cleanupDuplicateSkills,
@@ -958,10 +959,15 @@ export async function updateCommand(options) {
           manifest.skills.installed = true;
           manifest.skills.version = repoInfo.skills.version;
           manifest.skills.locale = skillsLocale;
-          manifest.skills.installations = [
+          // Deduplicate: the append form accumulated a duplicate entry every time
+          // an already-installed agent was re-selected. dev-platform's manifest read
+          // `['claude-code', 'claude-code']`. Harmless to the installer, which
+          // dedupes at install time, but every consumer that iterates installations
+          // saw the agent twice. (XSPEC-343 R2)
+          manifest.skills.installations = deduplicateInstallations([
             ...(manifest.skills.installations || []),
             ...installSkills
-          ];
+          ]);
           manifest.skills.names = mergeInstalledNames(manifest.skills.names, skillResult);
 
           // Derive location from installations if not set
@@ -1038,10 +1044,10 @@ export async function updateCommand(options) {
           if (!manifest.commands) manifest.commands = {};
           manifest.commands.installed = true;
           manifest.commands.version = repoInfo.skills.version;  // Track version
-          manifest.commands.installations = [
+          manifest.commands.installations = deduplicateInstallations([
             ...(manifest.commands.installations || []),
             ...installCommands
-          ];
+          ]);
           manifest.commands.names = mergeInstalledNames(manifest.commands.names, cmdResult);
 
           // Update command hashes for integrity tracking
@@ -1143,7 +1149,7 @@ export async function updateCommand(options) {
           manifest.skills.installed = true;
           manifest.skills.version = repoInfo.skills.version;
           manifest.skills.locale = skillsLocale;
-          manifest.skills.installations = [...(manifest.skills.installations || []), ...missingSkills];
+          manifest.skills.installations = deduplicateInstallations([...(manifest.skills.installations || []), ...missingSkills]);
           manifest.skills.names = mergeInstalledNames(manifest.skills.names, result);
           if (result.allFileHashes) {
             if (!manifest.skillHashes) manifest.skillHashes = {};
@@ -1187,7 +1193,7 @@ export async function updateCommand(options) {
           if (!manifest.commands) manifest.commands = {};
           manifest.commands.installed = true;
           manifest.commands.version = repoInfo.skills.version;
-          manifest.commands.installations = [...(manifest.commands.installations || []), ...missingCommands];
+          manifest.commands.installations = deduplicateInstallations([...(manifest.commands.installations || []), ...missingCommands]);
           manifest.commands.names = mergeInstalledNames(manifest.commands.names, result);
           if (result.allFileHashes) {
             if (!manifest.commandHashes) manifest.commandHashes = {};

package/src/utils/hasher.js

@@ -1,6 +1,6 @@
 import { createHash } from 'crypto';
 import { readFileSync, statSync, existsSync, readdirSync } from 'fs';
-import { join } from 'path';
+import { join, relative } from 'path';
 import { UDS_MARKERS } from '../core/constants.js';
 import { resolveIntegrationFile } from '../core/constants.js';
 
@@ -163,9 +163,17 @@ function scanDirectory(dirPath, basePath) {
 
   for (const item of items) {
     const fullPath = join(dirPath, item.name);
-    // Calculate relative path by removing basePath prefix
-    // Normalize to forward slashes for cross-platform consistency
-    const relativePath = fullPath.slice(basePath.length + 1).replace(/\\/g, '/');
+    // `relative()` rather than slice arithmetic. The old form was
+    // `fullPath.slice(basePath.length + 1)`, which assumed basePath carries no
+    // trailing separator. Three agent skill paths do (`.claude/skills/`,
+    // `.opencode/skill/`, `.cursor/skills/`), so every name lost its first
+    // character — `ac-coverage` became `c-coverage`, `.manifest.json` became
+    // `manifest.json`. computeDirectoryHashes then rebuilt an absolute path from
+    // the mangled name, found no file, and dropped the entry: 115 files in, 2
+    // out. `manifest.skillHashes` was therefore never populated, the reconciler
+    // read that as "no hash available for comparison", and every `uds update`
+    // rewrote all 55 skill directories forever. (XSPEC-343 R2)
+    const relativePath = relative(basePath, fullPath).replace(/\\/g, '/');
 
     if (item.isDirectory()) {
       files.push(...scanDirectory(fullPath, basePath));

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.2.1",
+  "version": "6.2.3",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.2.1"
+      "version": "6.2.3"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.2.1",
+      "version": "6.2.3",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.2.1",
+      "version": "6.2.3",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.2.1",
+      "version": "6.2.3",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.2.1",
+      "version": "6.2.3",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.2.1",
+      "version": "6.2.3",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"