universal-dev-standards 6.2.3 → 6.2.5

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.3
-translation_version: 6.2.3
+source_version: 6.2.5
+translation_version: 6.2.5
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,18 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.5] - 2026-07-31
+
+### 修复
+
+- **`uds update` 的备份目录可能被提交进你的 repo。** `.uds-backup-<时间戳>/` 会写在项目旁供回滚，而没有任何规则忽略它——于是一次 `git add -A` 就把它扫了进去。这在我们自己的 repo 发生过两次，其中一次把 360 个文件、73,992 行带进了公开 repo。备份现在会忽略自己：创建时就在目录内写一个内容为 `*` 的 `.gitignore`，`git status` 与 `git add -A` 不再看得到它，而**你的** `.gitignore` 不会被修改。旧版本产生的既有备份不会被追溯隐藏——请自行删除或补上规则。
+
+## [6.2.4] - 2026-07-31
+
+### 修复
+
+- **`uds update` 会提议删掉你自己写的技能。** 来源判定只要 `manifest.skillHashes` 记录了某个技能底下的任一文件，就把它当成 UDS 自己的资产。那个判准之所以安全，只因为 hasher 是坏的——它为 78 个已安装技能只留下 2 笔记录。6.2.2 修好 hasher 之后，同一份 map 被填满技能文件夹底下全部 137 个文件，包括手写的那些；它们于是落在「以 UDS 出货内容构建的期望状态」之外，被判为应删除的孤儿。某个项目的计划提议删掉 18 个目录，其中 14 个是它自己的运维技能。来源判定现在只保留一个信号：名称存在于 UDS 自己的 `skills/` 树下。UDS 已下架的技能改为发警告而非删除——磁盘上没有任何东西能把它们和你自己的作品区分开，而**留下一个带警告的陈旧目录，比删掉别人手写的文件，是比较好的失败方式**。**若你正在使用 6.2.2 或 6.2.3，且自己的技能与 UDS 的并存，应用任何变更前请先跑 `uds update --plan`。**
+
 ## [6.2.3] - 2026-07-31
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.2.3 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.5 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.2.3 | ✅ 最新正式版 |
+| 6.2.5 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.3
-translation_version: 6.2.3
+source_version: 6.2.5
+translation_version: 6.2.5
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,18 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.5] - 2026-07-31
+
+### 修復
+
+- **`uds update` 的備份目錄可能被提交進你的 repo。** `.uds-backup-<時間戳>/` 會寫在專案旁供回滾，而沒有任何規則忽略它——於是一次 `git add -A` 就把它掃了進去。這在我們自己的 repo 發生過兩次，其中一次把 360 個檔、73,992 行帶進了公開 repo。備份現在會忽略自己：建立時就在目錄內寫一個內容為 `*` 的 `.gitignore`，`git status` 與 `git add -A` 不再看得到它，而**你的** `.gitignore` 不會被修改。舊版本產生的既有備份不會被追溯隱藏——請自行刪除或補上規則。
+
+## [6.2.4] - 2026-07-31
+
+### 修復
+
+- **`uds update` 會提議刪掉你自己寫的技能。** 來源判定只要 `manifest.skillHashes` 記錄了某個技能底下的任一檔案，就把它當成 UDS 自己的資產。那個判準之所以安全，只因為 hasher 是壞的——它為 78 個已安裝技能只留下 2 筆紀錄。6.2.2 修好 hasher 之後，同一份 map 被填滿技能資料夾底下全部 137 個檔案，包括手寫的那些；它們於是落在「以 UDS 出貨內容建構的期望狀態」之外，被判為應刪除的孤兒。某個專案的計畫提議刪掉 18 個目錄，其中 14 個是它自己的維運技能。來源判定現在只保留一個訊號：名稱存在於 UDS 自己的 `skills/` 樹下。UDS 已下架的技能改為發警告而非刪除——磁碟上沒有任何東西能把它們和你自己的作品區分開，而**留下一個帶警告的陳舊目錄，比刪掉別人手寫的檔案，是比較好的失敗方式**。**若你正在使用 6.2.2 或 6.2.3，且自己的技能與 UDS 的並存，套用任何變更前請先跑 `uds update --plan`。**
+
 ## [6.2.3] - 2026-07-31
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.2.3 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.5 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.2.3 | ✅ 最新正式版 |
+| 6.2.5 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.2.3",
+  "version": "6.2.5",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/reconciler/actual-state-scanner.js

@@ -295,10 +295,25 @@ function shippedCommandNames() {
  *
  * Anything else is the adopter's own, and is warned about rather than deleted.
  */
-function isUdsProvenance(skillName, manifest, agent, level) {
-  if (sourceEntryNames().has(skillName)) return true;
-  const prefix = `${agent}/${level}/${skillName}/`;
-  return Object.keys(manifest?.skillHashes || {}).some((k) => k.startsWith(prefix));
+// A directory whose name exists in UDS's own `skills/` tree was put there by UDS.
+// That is the only positive signal, and everything else is the adopter's.
+//
+// `manifest.skillHashes` USED TO BE a second signal here ("authoritative whenever
+// present"). That was only ever safe because the hasher was broken: a trailing
+// separator in three skill paths made it record 2 entries for 78 installed skills,
+// so the clause almost never fired. Fixing the hasher (6.2.2) populated the same
+// map with every file under the skills folder — including the adopter's own — and
+// each one of those became a deletion candidate, re-opening the exact defect this
+// function was written to close. The lesson is not about hashes: a broken tool's
+// sparse output was used as evidence that reading it was safe.
+//
+// The cost of the narrow signal is unchanged and still deliberate: skills UDS used
+// to ship and has since removed are warned about rather than deleted, because
+// nothing on disk distinguishes them from the adopter's own work. Leaving a few
+// stale directories with a warning is a better way to fail than deleting files
+// somebody hand-wrote.
+function isUdsProvenance(skillName) {
+  return sourceEntryNames().has(skillName);
 }
 
 /**
@@ -335,7 +350,7 @@ function scanSkills(state, projectPath, manifest) {
           // the skills folder used to be assumed UDS-managed, so a plan for a repo
           // with hand-written skills proposed deleting them: dev-platform's would
           // have removed fourteen. (XSPEC-343 R2)
-          udsManaged: isUdsProvenance(skillName, manifest, agent, level)
+          udsManaged: isUdsProvenance(skillName)
         }
       });
     }

package/src/reconciler/backup-manager.js

@@ -64,6 +64,28 @@ export function createBackup(projectPath, plan) {
     };
   }
 
+  // Make the backup invisible to git, from inside itself.
+  //
+  // WHY THIS IS NOT A LINE IN THE ADOPTER'S .gitignore. We create this directory
+  // in someone else's repository; making it disappear is our job, but editing
+  // their .gitignore to do it is not — that file is theirs, it may be generated,
+  // and a tool appending to it on every update is a worse trade than the problem.
+  // A `*` here ignores everything in this directory (this file included, which is
+  // fine: git reads .gitignore whether or not it is tracked), so `git status` and
+  // `git add -A` never see the backup at all, and nothing outside is touched.
+  //
+  // WHY IT EXISTS. Nothing ignored these directories, so `git add -A` in two
+  // sibling repos committed them: EngramGraph's 0.8.0 release commit took in 5
+  // backups — 360 files, 73,992 lines — and dev-platform took one. Both were
+  // public. The adopter is not the right place to put this responsibility: they
+  // did not create the directory and have no reason to expect it.
+  try {
+    writeFileSync(join(backupDir, '.gitignore'), '*\n', 'utf8');
+  } catch (err) {
+    // A backup that git can see still beats no backup — record and carry on.
+    errors.push(`Failed to write backup .gitignore: ${err.message}`);
+  }
+
   // Backup each file
   for (const relativePath of filesToBackup) {
     const sourcePath = join(projectPath, relativePath);

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.2.3",
+  "version": "6.2.5",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.2.3"
+      "version": "6.2.5"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.2.3",
+      "version": "6.2.5",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.2.3",
+      "version": "6.2.5",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.2.3",
+      "version": "6.2.5",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.2.3",
+      "version": "6.2.5",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.2.3",
+      "version": "6.2.5",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"