universal-dev-standards 6.2.4 → 6.2.6

package/bin/uds.js

@@ -213,6 +213,7 @@ program
   .option('--commands', 'Install/update slash commands for configured AI tools')
   .option('--debug', 'Show debug output for Skills/Commands detection')
   .option('--plan', 'Show reconciliation plan without executing (like terraform plan)')
+  .option('--apply', 'Apply exactly the plan --plan prints (plain `uds update` does not)')
   .option('--force', 'Force update all files, ignoring hash comparison')
   .option('--rollback', 'Rollback to the most recent backup')
   .option('--locale <locale>', 'Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env')

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.4
-translation_version: 6.2.4
+source_version: 6.2.6
+translation_version: 6.2.6
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,22 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.6] - 2026-07-31
+
+### 新增
+
+- **`uds update --apply`** —— 应用 `uds update --plan` 打印出的那个计划，一字不差。
+
+### 修复
+
+- **`--plan` 叫你去跑一个会忽略计划的命令。** 它打印出「Run `uds update` to apply these changes」，但 `uds update` 根本到不了 reconciler——它走 legacy 路径、更新既有标准，然后为**那件事**报告成功。某次升级它打印出 `✓ 已更新 69 个标准文件`，而上方计划里的 8 个删除、2 个新增一个都没做，那些文件事后仍在磁盘上。**没有任何一步失败**，所以输出与「已应用计划」无从分辨。`--force` 也不是答案：它以 `force: true` 重算，那是一个会重写每个受管文件的更大计划。**如果你过去读完计划后都是跑 `uds update`，那些删除与新增从未被应用**——请重跑 `uds update --plan` 看还有什么未处理。
+
+## [6.2.5] - 2026-07-31
+
+### 修复
+
+- **`uds update` 的备份目录可能被提交进你的 repo。** `.uds-backup-<时间戳>/` 会写在项目旁供回滚，而没有任何规则忽略它——于是一次 `git add -A` 就把它扫了进去。这在我们自己的 repo 发生过两次，其中一次把 360 个文件、73,992 行带进了公开 repo。备份现在会忽略自己：创建时就在目录内写一个内容为 `*` 的 `.gitignore`，`git status` 与 `git add -A` 不再看得到它，而**你的** `.gitignore` 不会被修改。旧版本产生的既有备份不会被追溯隐藏——请自行删除或补上规则。
+
 ## [6.2.4] - 2026-07-31
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.2.4 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.6 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.2.4 | ✅ 最新正式版 |
+| 6.2.6 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-CN/docs/CHEATSHEET.md

@@ -1,6 +1,6 @@
 # UDS 速查表
 
-> Quick reference for all UDS features | Last updated: 2026-07-22
+> Quick reference for all UDS features | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/user/CHEATSHEET.md) | [繁體中文](../../zh-TW/docs/CHEATSHEET.md) | 简体中文
 
@@ -371,6 +371,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names register |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/bundled/locales/zh-CN/docs/FEATURE-REFERENCE.md

@@ -1,7 +1,7 @@
 # UDS 功能参考手册
 
 > Universal Development Standards - 完整功能文档
-> Auto-generated | Last updated: 2026-07-22
+> Auto-generated | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/reference/FEATURE-REFERENCE.md) | [繁體中文](../../zh-TW/docs/FEATURE-REFERENCE.md) | 简体中文
 
@@ -15,9 +15,9 @@
 4. [代理](#agents) (5)
 5. [工作流程](#workflows) (5)
 6. [核心规范](#core-standards) (149)
-7. [脚本](#scripts) (57)
+7. [脚本](#scripts) (58)
 
-**Total Features: 331**
+**Total Features: 332**
 
 ---
 
@@ -108,6 +108,7 @@
 | `--commands` | Install/update slash commands for configured AI tools |
 | `--debug` | Show debug output for Skills/Commands detection |
 | `--plan` | Show reconciliation plan without executing (like terraform plan) |
+| `--apply` | Apply exactly the plan --plan prints (plain `uds update` does not) |
 | `--force` | Force update all files, ignoring hash comparison |
 | `--rollback` | Rollback to the most recent backup |
 | `--locale` | Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env |
@@ -499,6 +500,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names registered directly on the |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.4
-translation_version: 6.2.4
+source_version: 6.2.6
+translation_version: 6.2.6
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,22 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.6] - 2026-07-31
+
+### 新增
+
+- **`uds update --apply`** —— 套用 `uds update --plan` 印出的那個計畫，一字不差。
+
+### 修復
+
+- **`--plan` 叫你去跑一個會忽略計畫的指令。** 它印出「Run `uds update` to apply these changes」，但 `uds update` 根本到不了 reconciler——它走 legacy 路徑、更新既有標準，然後為**那件事**回報成功。某次升級它印出 `✓ 已更新 69 個標準檔案`，而上方計畫裡的 8 個刪除、2 個新增一個都沒做，那些檔事後仍在磁碟上。**沒有任何一步失敗**，所以輸出與「已套用計畫」無從分辨。`--force` 也不是答案：它以 `force: true` 重算，那是一個會重寫每個受管檔案的更大計畫。**如果你過去讀完計畫後都是跑 `uds update`，那些刪除與新增從未被套用**——請重跑 `uds update --plan` 看還有什麼未處理。
+
+## [6.2.5] - 2026-07-31
+
+### 修復
+
+- **`uds update` 的備份目錄可能被提交進你的 repo。** `.uds-backup-<時間戳>/` 會寫在專案旁供回滾，而沒有任何規則忽略它——於是一次 `git add -A` 就把它掃了進去。這在我們自己的 repo 發生過兩次，其中一次把 360 個檔、73,992 行帶進了公開 repo。備份現在會忽略自己：建立時就在目錄內寫一個內容為 `*` 的 `.gitignore`，`git status` 與 `git add -A` 不再看得到它，而**你的** `.gitignore` 不會被修改。舊版本產生的既有備份不會被追溯隱藏——請自行刪除或補上規則。
+
 ## [6.2.4] - 2026-07-31
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.2.4 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.6 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.2.4 | ✅ 最新正式版 |
+| 6.2.6 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/docs/CHEATSHEET.md

@@ -1,6 +1,6 @@
 # UDS 速查表
 
-> Quick reference for all UDS features | Last updated: 2026-07-22
+> Quick reference for all UDS features | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/user/CHEATSHEET.md) | 繁體中文 | [简体中文](../../zh-CN/docs/CHEATSHEET.md)
 
@@ -371,6 +371,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names register |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/bundled/locales/zh-TW/docs/FEATURE-REFERENCE.md

@@ -1,7 +1,7 @@
 # UDS 功能參考手冊
 
 > Universal Development Standards - 完整功能文件
-> Auto-generated | Last updated: 2026-07-22
+> Auto-generated | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/reference/FEATURE-REFERENCE.md) | 繁體中文 | [简体中文](../../zh-CN/docs/FEATURE-REFERENCE.md)
 
@@ -15,9 +15,9 @@
 4. [代理](#agents) (5)
 5. [工作流程](#workflows) (5)
 6. [核心規範](#core-standards) (149)
-7. [腳本](#scripts) (57)
+7. [腳本](#scripts) (58)
 
-**Total Features: 331**
+**Total Features: 332**
 
 ---
 
@@ -108,6 +108,7 @@
 | `--commands` | Install/update slash commands for configured AI tools |
 | `--debug` | Show debug output for Skills/Commands detection |
 | `--plan` | Show reconciliation plan without executing (like terraform plan) |
+| `--apply` | Apply exactly the plan --plan prints (plain `uds update` does not) |
 | `--force` | Force update all files, ignoring hash comparison |
 | `--rollback` | Rollback to the most recent backup |
 | `--locale` | Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env |
@@ -499,6 +500,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names registered directly on the |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.2.4",
+  "version": "6.2.6",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/update.js

@@ -374,9 +374,15 @@ export async function updateCommand(options) {
     return;
   }
 
+  // Handle --apply option (DSR: execute the plan `--plan` prints)
+  if (options.apply) {
+    await handleReconcile(projectPath, options, { force: false });
+    return;
+  }
+
   // Handle --force option (DSR force reconciliation)
   if (options.force) {
-    await handleForceReconcile(projectPath, options);
+    await handleReconcile(projectPath, options, { force: true });
     return;
   }
 
@@ -2318,21 +2324,40 @@ async function handlePlan(projectPath, options) {
   console.log();
 
   if (result.plan.actions.length > 0) {
-    console.log(chalk.gray('Run `uds update` to apply these changes.'));
-    console.log(chalk.gray('Run `uds update --force` to force update all files.'));
+    // NOT `uds update`. That runs the legacy path, which never executes this
+    // plan — it refreshes existing standards and reports success for having done
+    // so, which reads exactly like the plan was applied. Upgrading one project it
+    // printed "✓ 69 standards updated" while all 8 deletions and 2 creations in
+    // the plan above were silently skipped; the files were still on disk
+    // afterwards. Nor is `--force` the answer for "apply what I just read": it
+    // recomputes with force:true, a larger plan that rewrites every managed file.
+    console.log(chalk.gray('Run `uds update --apply` to apply exactly these changes.'));
+    console.log(chalk.gray('Run `uds update --force` to rewrite every managed file (a larger plan than the one above).'));
     console.log();
   }
 }
 
 /**
- * Handle --force: run the full reconciler with force mode.
+ * Run the reconciler and apply its plan.
+ *
+ * `force` selects WHICH plan: force mode rewrites every managed file regardless
+ * of hash, so it is a different and larger plan than the one `--plan` prints.
+ * That difference is why `--apply` exists — see handlePlan.
+ *
+ * @param {string} projectPath
+ * @param {Object} options - Command options (uses `yes`)
+ * @param {{ force: boolean }} mode
  */
-async function handleForceReconcile(projectPath, options) {
-  console.log(chalk.cyan('Running declarative state reconciliation (force mode)...'));
+async function handleReconcile(projectPath, options, { force }) {
+  console.log(chalk.cyan(
+    force
+      ? 'Running declarative state reconciliation (force mode)...'
+      : 'Running declarative state reconciliation...'
+  ));
   console.log();
 
   // First show the plan
-  const planResult = await reconcilerPlan(projectPath, { force: true });
+  const planResult = await reconcilerPlan(projectPath, { force });
 
   if (planResult.plan.actions.length === 0) {
     console.log(chalk.green('Everything is up to date. No changes needed.'));
@@ -2360,7 +2385,7 @@ async function handleForceReconcile(projectPath, options) {
   const spinner = ora('Applying reconciliation plan...').start();
 
   const result = await reconcile(projectPath, {
-    force: true,
+    force,
     backup: true,
     onAction: (action, index, total) => {
       spinner.text = `[${index + 1}/${total}] ${action.type} ${action.path || action.category}`;

package/src/reconciler/backup-manager.js

@@ -64,6 +64,28 @@ export function createBackup(projectPath, plan) {
     };
   }
 
+  // Make the backup invisible to git, from inside itself.
+  //
+  // WHY THIS IS NOT A LINE IN THE ADOPTER'S .gitignore. We create this directory
+  // in someone else's repository; making it disappear is our job, but editing
+  // their .gitignore to do it is not — that file is theirs, it may be generated,
+  // and a tool appending to it on every update is a worse trade than the problem.
+  // A `*` here ignores everything in this directory (this file included, which is
+  // fine: git reads .gitignore whether or not it is tracked), so `git status` and
+  // `git add -A` never see the backup at all, and nothing outside is touched.
+  //
+  // WHY IT EXISTS. Nothing ignored these directories, so `git add -A` in two
+  // sibling repos committed them: EngramGraph's 0.8.0 release commit took in 5
+  // backups — 360 files, 73,992 lines — and dev-platform took one. Both were
+  // public. The adopter is not the right place to put this responsibility: they
+  // did not create the directory and have no reason to expect it.
+  try {
+    writeFileSync(join(backupDir, '.gitignore'), '*\n', 'utf8');
+  } catch (err) {
+    // A backup that git can see still beats no backup — record and carry on.
+    errors.push(`Failed to write backup .gitignore: ${err.message}`);
+  }
+
   // Backup each file
   for (const relativePath of filesToBackup) {
     const sourcePath = join(projectPath, relativePath);

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.2.4",
+  "version": "6.2.6",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.2.4"
+      "version": "6.2.6"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.2.4",
+      "version": "6.2.6",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.2.4",
+      "version": "6.2.6",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.2.4",
+      "version": "6.2.6",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.2.4",
+      "version": "6.2.6",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.2.4",
+      "version": "6.2.6",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"