universal-dev-standards 6.2.2 → 6.2.4

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.2
-translation_version: 6.2.2
+source_version: 6.2.4
+translation_version: 6.2.4
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,18 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.4] - 2026-07-31
+
+### 修复
+
+- **`uds update` 会提议删掉你自己写的技能。** 来源判定只要 `manifest.skillHashes` 记录了某个技能底下的任一文件，就把它当成 UDS 自己的资产。那个判准之所以安全，只因为 hasher 是坏的——它为 78 个已安装技能只留下 2 笔记录。6.2.2 修好 hasher 之后，同一份 map 被填满技能文件夹底下全部 137 个文件，包括手写的那些；它们于是落在「以 UDS 出货内容构建的期望状态」之外，被判为应删除的孤儿。某个项目的计划提议删掉 18 个目录，其中 14 个是它自己的运维技能。来源判定现在只保留一个信号：名称存在于 UDS 自己的 `skills/` 树下。UDS 已下架的技能改为发警告而非删除——磁盘上没有任何东西能把它们和你自己的作品区分开，而**留下一个带警告的陈旧目录，比删掉别人手写的文件，是比较好的失败方式**。**若你正在使用 6.2.2 或 6.2.3，且自己的技能与 UDS 的并存，应用任何变更前请先跑 `uds update --plan`。**
+
+## [6.2.3] - 2026-07-31
+
+### 修复
+
+- **重新选取已安装的 agent 会追加一笔重复的 manifest 记录。** 四个 manifest 写入端以 `[...existing, ...new]` 追加安装记录，于是一个已被记录的 agent 每次被重新选取就多一笔；某个项目的 manifest 读起来是 `['claude-code', 'claude-code']`。安装器本身从未受影响——`installSkillsToMultipleAgents` 会对输入去重。损害仅限于**记录**，以及每一个会迭代它的消费端：`checkNewFeatures`、reconciler 的扫描器与期望状态计算器都把那个 agent 走了两遍。效果无害——**这正是它跨越五次升级都没被注意到的原因**。四个写入端现在改用安装器早就在用的那个 helper。
+
 ## [6.2.2] - 2026-07-31
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.2.2 | **发布日期**: 2026-07-30 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.4 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.2.2 | ✅ 最新正式版 |
+| 6.2.4 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.2
-translation_version: 6.2.2
+source_version: 6.2.4
+translation_version: 6.2.4
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,18 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.4] - 2026-07-31
+
+### 修復
+
+- **`uds update` 會提議刪掉你自己寫的技能。** 來源判定只要 `manifest.skillHashes` 記錄了某個技能底下的任一檔案，就把它當成 UDS 自己的資產。那個判準之所以安全，只因為 hasher 是壞的——它為 78 個已安裝技能只留下 2 筆紀錄。6.2.2 修好 hasher 之後，同一份 map 被填滿技能資料夾底下全部 137 個檔案，包括手寫的那些；它們於是落在「以 UDS 出貨內容建構的期望狀態」之外，被判為應刪除的孤兒。某個專案的計畫提議刪掉 18 個目錄，其中 14 個是它自己的維運技能。來源判定現在只保留一個訊號：名稱存在於 UDS 自己的 `skills/` 樹下。UDS 已下架的技能改為發警告而非刪除——磁碟上沒有任何東西能把它們和你自己的作品區分開，而**留下一個帶警告的陳舊目錄，比刪掉別人手寫的檔案，是比較好的失敗方式**。**若你正在使用 6.2.2 或 6.2.3，且自己的技能與 UDS 的並存，套用任何變更前請先跑 `uds update --plan`。**
+
+## [6.2.3] - 2026-07-31
+
+### 修復
+
+- **重新選取已安裝的 agent 會追加一筆重複的 manifest 紀錄。** 四個 manifest 寫入端以 `[...existing, ...new]` 追加安裝紀錄，於是一個已被記錄的 agent 每次被重新選取就多一筆；某個專案的 manifest 讀起來是 `['claude-code', 'claude-code']`。安裝器本身從未受影響——`installSkillsToMultipleAgents` 會對輸入去重。損害僅限於**紀錄**，以及每一個會迭代它的消費端：`checkNewFeatures`、reconciler 的掃描器與期望狀態計算器都把那個 agent 走了兩次。效果無害——**這正是它跨越五次升級都沒被注意到的原因**。四個寫入端現在改用安裝器早就在用的那個 helper。
+
 ## [6.2.2] - 2026-07-31
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.2.2 | **發布日期**: 2026-07-30 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.4 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.2.2 | ✅ 最新正式版 |
+| 6.2.4 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.2.2",
+  "version": "6.2.4",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/update.js

@@ -27,6 +27,7 @@ import { config } from '../utils/config-manager.js';
 import {
   installSkillsToMultipleAgents,
   installCommandsToMultipleAgents,
+  deduplicateInstallations,
   getInstalledSkillsInfoForAgent,
   getInstalledCommandsForAgent,
   cleanupDuplicateSkills,
@@ -958,10 +959,15 @@ export async function updateCommand(options) {
           manifest.skills.installed = true;
           manifest.skills.version = repoInfo.skills.version;
           manifest.skills.locale = skillsLocale;
-          manifest.skills.installations = [
+          // Deduplicate: the append form accumulated a duplicate entry every time
+          // an already-installed agent was re-selected. dev-platform's manifest read
+          // `['claude-code', 'claude-code']`. Harmless to the installer, which
+          // dedupes at install time, but every consumer that iterates installations
+          // saw the agent twice. (XSPEC-343 R2)
+          manifest.skills.installations = deduplicateInstallations([
             ...(manifest.skills.installations || []),
             ...installSkills
-          ];
+          ]);
           manifest.skills.names = mergeInstalledNames(manifest.skills.names, skillResult);
 
           // Derive location from installations if not set
@@ -1038,10 +1044,10 @@ export async function updateCommand(options) {
           if (!manifest.commands) manifest.commands = {};
           manifest.commands.installed = true;
           manifest.commands.version = repoInfo.skills.version;  // Track version
-          manifest.commands.installations = [
+          manifest.commands.installations = deduplicateInstallations([
             ...(manifest.commands.installations || []),
             ...installCommands
-          ];
+          ]);
           manifest.commands.names = mergeInstalledNames(manifest.commands.names, cmdResult);
 
           // Update command hashes for integrity tracking
@@ -1143,7 +1149,7 @@ export async function updateCommand(options) {
           manifest.skills.installed = true;
           manifest.skills.version = repoInfo.skills.version;
           manifest.skills.locale = skillsLocale;
-          manifest.skills.installations = [...(manifest.skills.installations || []), ...missingSkills];
+          manifest.skills.installations = deduplicateInstallations([...(manifest.skills.installations || []), ...missingSkills]);
           manifest.skills.names = mergeInstalledNames(manifest.skills.names, result);
           if (result.allFileHashes) {
             if (!manifest.skillHashes) manifest.skillHashes = {};
@@ -1187,7 +1193,7 @@ export async function updateCommand(options) {
           if (!manifest.commands) manifest.commands = {};
           manifest.commands.installed = true;
           manifest.commands.version = repoInfo.skills.version;
-          manifest.commands.installations = [...(manifest.commands.installations || []), ...missingCommands];
+          manifest.commands.installations = deduplicateInstallations([...(manifest.commands.installations || []), ...missingCommands]);
           manifest.commands.names = mergeInstalledNames(manifest.commands.names, result);
           if (result.allFileHashes) {
             if (!manifest.commandHashes) manifest.commandHashes = {};

package/src/reconciler/actual-state-scanner.js

@@ -295,10 +295,25 @@ function shippedCommandNames() {
  *
  * Anything else is the adopter's own, and is warned about rather than deleted.
  */
-function isUdsProvenance(skillName, manifest, agent, level) {
-  if (sourceEntryNames().has(skillName)) return true;
-  const prefix = `${agent}/${level}/${skillName}/`;
-  return Object.keys(manifest?.skillHashes || {}).some((k) => k.startsWith(prefix));
+// A directory whose name exists in UDS's own `skills/` tree was put there by UDS.
+// That is the only positive signal, and everything else is the adopter's.
+//
+// `manifest.skillHashes` USED TO BE a second signal here ("authoritative whenever
+// present"). That was only ever safe because the hasher was broken: a trailing
+// separator in three skill paths made it record 2 entries for 78 installed skills,
+// so the clause almost never fired. Fixing the hasher (6.2.2) populated the same
+// map with every file under the skills folder — including the adopter's own — and
+// each one of those became a deletion candidate, re-opening the exact defect this
+// function was written to close. The lesson is not about hashes: a broken tool's
+// sparse output was used as evidence that reading it was safe.
+//
+// The cost of the narrow signal is unchanged and still deliberate: skills UDS used
+// to ship and has since removed are warned about rather than deleted, because
+// nothing on disk distinguishes them from the adopter's own work. Leaving a few
+// stale directories with a warning is a better way to fail than deleting files
+// somebody hand-wrote.
+function isUdsProvenance(skillName) {
+  return sourceEntryNames().has(skillName);
 }
 
 /**
@@ -335,7 +350,7 @@ function scanSkills(state, projectPath, manifest) {
           // the skills folder used to be assumed UDS-managed, so a plan for a repo
           // with hand-written skills proposed deleting them: dev-platform's would
           // have removed fourteen. (XSPEC-343 R2)
-          udsManaged: isUdsProvenance(skillName, manifest, agent, level)
+          udsManaged: isUdsProvenance(skillName)
         }
       });
     }

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.2.2",
+  "version": "6.2.4",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.2.2"
+      "version": "6.2.4"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.2.2",
+      "version": "6.2.4",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.2.2",
+      "version": "6.2.4",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.2.2",
+      "version": "6.2.4",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.2.2",
+      "version": "6.2.4",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.2.2",
+      "version": "6.2.4",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"