universal-dev-standards 6.2.4 → 6.2.5

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.4
-translation_version: 6.2.4
+source_version: 6.2.5
+translation_version: 6.2.5
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,12 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.5] - 2026-07-31
+
+### 修复
+
+- **`uds update` 的备份目录可能被提交进你的 repo。** `.uds-backup-<时间戳>/` 会写在项目旁供回滚，而没有任何规则忽略它——于是一次 `git add -A` 就把它扫了进去。这在我们自己的 repo 发生过两次，其中一次把 360 个文件、73,992 行带进了公开 repo。备份现在会忽略自己：创建时就在目录内写一个内容为 `*` 的 `.gitignore`，`git status` 与 `git add -A` 不再看得到它，而**你的** `.gitignore` 不会被修改。旧版本产生的既有备份不会被追溯隐藏——请自行删除或补上规则。
+
 ## [6.2.4] - 2026-07-31
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.2.4 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.5 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.2.4 | ✅ 最新正式版 |
+| 6.2.5 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.4
-translation_version: 6.2.4
+source_version: 6.2.5
+translation_version: 6.2.5
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,12 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.5] - 2026-07-31
+
+### 修復
+
+- **`uds update` 的備份目錄可能被提交進你的 repo。** `.uds-backup-<時間戳>/` 會寫在專案旁供回滾，而沒有任何規則忽略它——於是一次 `git add -A` 就把它掃了進去。這在我們自己的 repo 發生過兩次，其中一次把 360 個檔、73,992 行帶進了公開 repo。備份現在會忽略自己：建立時就在目錄內寫一個內容為 `*` 的 `.gitignore`，`git status` 與 `git add -A` 不再看得到它，而**你的** `.gitignore` 不會被修改。舊版本產生的既有備份不會被追溯隱藏——請自行刪除或補上規則。
+
 ## [6.2.4] - 2026-07-31
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.2.4 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.5 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.2.4 | ✅ 最新正式版 |
+| 6.2.5 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.2.4",
+  "version": "6.2.5",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/reconciler/backup-manager.js

@@ -64,6 +64,28 @@ export function createBackup(projectPath, plan) {
     };
   }
 
+  // Make the backup invisible to git, from inside itself.
+  //
+  // WHY THIS IS NOT A LINE IN THE ADOPTER'S .gitignore. We create this directory
+  // in someone else's repository; making it disappear is our job, but editing
+  // their .gitignore to do it is not — that file is theirs, it may be generated,
+  // and a tool appending to it on every update is a worse trade than the problem.
+  // A `*` here ignores everything in this directory (this file included, which is
+  // fine: git reads .gitignore whether or not it is tracked), so `git status` and
+  // `git add -A` never see the backup at all, and nothing outside is touched.
+  //
+  // WHY IT EXISTS. Nothing ignored these directories, so `git add -A` in two
+  // sibling repos committed them: EngramGraph's 0.8.0 release commit took in 5
+  // backups — 360 files, 73,992 lines — and dev-platform took one. Both were
+  // public. The adopter is not the right place to put this responsibility: they
+  // did not create the directory and have no reason to expect it.
+  try {
+    writeFileSync(join(backupDir, '.gitignore'), '*\n', 'utf8');
+  } catch (err) {
+    // A backup that git can see still beats no backup — record and carry on.
+    errors.push(`Failed to write backup .gitignore: ${err.message}`);
+  }
+
   // Backup each file
   for (const relativePath of filesToBackup) {
     const sourcePath = join(projectPath, relativePath);

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.2.4",
+  "version": "6.2.5",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.2.4"
+      "version": "6.2.5"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.2.4",
+      "version": "6.2.5",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.2.4",
+      "version": "6.2.5",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.2.4",
+      "version": "6.2.5",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.2.4",
+      "version": "6.2.5",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.2.4",
+      "version": "6.2.5",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"