universal-dev-standards 6.2.5 → 6.2.7

package/bin/uds.js

@@ -213,6 +213,7 @@ program
   .option('--commands', 'Install/update slash commands for configured AI tools')
   .option('--debug', 'Show debug output for Skills/Commands detection')
   .option('--plan', 'Show reconciliation plan without executing (like terraform plan)')
+  .option('--apply', 'Apply exactly the plan --plan prints (plain `uds update` does not)')
   .option('--force', 'Force update all files, ignoring hash comparison')
   .option('--rollback', 'Rollback to the most recent backup')
   .option('--locale <locale>', 'Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env')

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.5
-translation_version: 6.2.5
+source_version: 6.2.7
+translation_version: 6.2.7
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,22 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.7] - 2026-07-31
+
+### 修复
+
+- **reconciler 在任何 npm 安装下都取不到 extension。** `manifest.extensions` 的条目（locale 包之类）抵达 executor 时没有已解析的来源路径，因为发布包的 `files` 清单不含 `extensions/` 目录——于是 `uds update --force` 对它们报告 `No source path available`，而 `uds update` 却更新了同一个文件。executor 现在改以 `copyStandard` 解析 extension，那是它处理 registry entry 时本来就在用的 bundled → repo → download fallback，也正是 legacy 路径一直在用的那一条。完全没有任何来源的条目仍然会失败，本来就该如此。
+
+## [6.2.6] - 2026-07-31
+
+### 新增
+
+- **`uds update --apply`** —— 应用 `uds update --plan` 打印出的那个计划，一字不差。
+
+### 修复
+
+- **`--plan` 叫你去跑一个会忽略计划的命令。** 它打印出「Run `uds update` to apply these changes」，但 `uds update` 根本到不了 reconciler——它走 legacy 路径、更新既有标准，然后为**那件事**报告成功。某次升级它打印出 `✓ 已更新 69 个标准文件`，而上方计划里的 8 个删除、2 个新增一个都没做，那些文件事后仍在磁盘上。**没有任何一步失败**，所以输出与「已应用计划」无从分辨。`--force` 也不是答案：它以 `force: true` 重算，那是一个会重写每个受管文件的更大计划。**如果你过去读完计划后都是跑 `uds update`，那些删除与新增从未被应用**——请重跑 `uds update --plan` 看还有什么未处理。
+
 ## [6.2.5] - 2026-07-31
 
 ### 修复

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.2.5 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.7 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.2.5 | ✅ 最新正式版 |
+| 6.2.7 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-CN/docs/CHEATSHEET.md

@@ -1,6 +1,6 @@
 # UDS 速查表
 
-> Quick reference for all UDS features | Last updated: 2026-07-22
+> Quick reference for all UDS features | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/user/CHEATSHEET.md) | [繁體中文](../../zh-TW/docs/CHEATSHEET.md) | 简体中文
 
@@ -371,6 +371,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names register |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/bundled/locales/zh-CN/docs/FEATURE-REFERENCE.md

@@ -1,7 +1,7 @@
 # UDS 功能参考手册
 
 > Universal Development Standards - 完整功能文档
-> Auto-generated | Last updated: 2026-07-22
+> Auto-generated | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/reference/FEATURE-REFERENCE.md) | [繁體中文](../../zh-TW/docs/FEATURE-REFERENCE.md) | 简体中文
 
@@ -15,9 +15,9 @@
 4. [代理](#agents) (5)
 5. [工作流程](#workflows) (5)
 6. [核心规范](#core-standards) (149)
-7. [脚本](#scripts) (57)
+7. [脚本](#scripts) (58)
 
-**Total Features: 331**
+**Total Features: 332**
 
 ---
 
@@ -108,6 +108,7 @@
 | `--commands` | Install/update slash commands for configured AI tools |
 | `--debug` | Show debug output for Skills/Commands detection |
 | `--plan` | Show reconciliation plan without executing (like terraform plan) |
+| `--apply` | Apply exactly the plan --plan prints (plain `uds update` does not) |
 | `--force` | Force update all files, ignoring hash comparison |
 | `--rollback` | Rollback to the most recent backup |
 | `--locale` | Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env |
@@ -499,6 +500,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names registered directly on the |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.5
-translation_version: 6.2.5
+source_version: 6.2.7
+translation_version: 6.2.7
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,22 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.7] - 2026-07-31
+
+### 修復
+
+- **reconciler 在任何 npm 安裝下都取不到 extension。** `manifest.extensions` 的項目（locale 包之類）抵達 executor 時沒有已解析的來源路徑，因為發布包的 `files` 清單不含 `extensions/` 目錄——於是 `uds update --force` 對它們回報 `No source path available`，而 `uds update` 卻更新了同一個檔案。executor 現在改以 `copyStandard` 解析 extension，那是它處理 registry entry 時本來就在用的 bundled → repo → download fallback，也正是 legacy 路徑一直在用的那一條。完全沒有任何來源的項目仍然會失敗，本來就該如此。
+
+## [6.2.6] - 2026-07-31
+
+### 新增
+
+- **`uds update --apply`** —— 套用 `uds update --plan` 印出的那個計畫，一字不差。
+
+### 修復
+
+- **`--plan` 叫你去跑一個會忽略計畫的指令。** 它印出「Run `uds update` to apply these changes」，但 `uds update` 根本到不了 reconciler——它走 legacy 路徑、更新既有標準，然後為**那件事**回報成功。某次升級它印出 `✓ 已更新 69 個標準檔案`，而上方計畫裡的 8 個刪除、2 個新增一個都沒做，那些檔事後仍在磁碟上。**沒有任何一步失敗**，所以輸出與「已套用計畫」無從分辨。`--force` 也不是答案：它以 `force: true` 重算，那是一個會重寫每個受管檔案的更大計畫。**如果你過去讀完計畫後都是跑 `uds update`，那些刪除與新增從未被套用**——請重跑 `uds update --plan` 看還有什麼未處理。
+
 ## [6.2.5] - 2026-07-31
 
 ### 修復

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.2.5 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.7 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.2.5 | ✅ 最新正式版 |
+| 6.2.7 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/docs/CHEATSHEET.md

@@ -1,6 +1,6 @@
 # UDS 速查表
 
-> Quick reference for all UDS features | Last updated: 2026-07-22
+> Quick reference for all UDS features | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/user/CHEATSHEET.md) | 繁體中文 | [简体中文](../../zh-CN/docs/CHEATSHEET.md)
 
@@ -371,6 +371,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names register |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/bundled/locales/zh-TW/docs/FEATURE-REFERENCE.md

@@ -1,7 +1,7 @@
 # UDS 功能參考手冊
 
 > Universal Development Standards - 完整功能文件
-> Auto-generated | Last updated: 2026-07-22
+> Auto-generated | Last updated: 2026-07-31
 
 **Language**: [English](../../../docs/reference/FEATURE-REFERENCE.md) | 繁體中文 | [简体中文](../../zh-CN/docs/FEATURE-REFERENCE.md)
 
@@ -15,9 +15,9 @@
 4. [代理](#agents) (5)
 5. [工作流程](#workflows) (5)
 6. [核心規範](#core-standards) (149)
-7. [腳本](#scripts) (57)
+7. [腳本](#scripts) (58)
 
-**Total Features: 331**
+**Total Features: 332**
 
 ---
 
@@ -108,6 +108,7 @@
 | `--commands` | Install/update slash commands for configured AI tools |
 | `--debug` | Show debug output for Skills/Commands detection |
 | `--plan` | Show reconciliation plan without executing (like terraform plan) |
+| `--apply` | Apply exactly the plan --plan prints (plain `uds update` does not) |
 | `--force` | Force update all files, ignoring hash comparison |
 | `--rollback` | Rollback to the most recent backup |
 | `--locale` | Override locale for skills install (zh-tw, zh-cn, en); also reads .uds/install.yaml + UDS_LOCALE env |
@@ -499,6 +500,7 @@
 | `pre-release.sh` | Pre-Release Preparation Script |
 | `setup-husky.mjs` | Cross-platform Husky Setup Script |
 | `sync-manifest.mjs` | Extract top-level Commander command names registered directly on the |
+| `watch-model-versions.sh` | Model / tool version watch — XSPEC-357 AC-6.2 |
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.2.5",
+  "version": "6.2.7",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/commands/update.js

@@ -374,9 +374,15 @@ export async function updateCommand(options) {
     return;
   }
 
+  // Handle --apply option (DSR: execute the plan `--plan` prints)
+  if (options.apply) {
+    await handleReconcile(projectPath, options, { force: false });
+    return;
+  }
+
   // Handle --force option (DSR force reconciliation)
   if (options.force) {
-    await handleForceReconcile(projectPath, options);
+    await handleReconcile(projectPath, options, { force: true });
     return;
   }
 
@@ -2318,21 +2324,40 @@ async function handlePlan(projectPath, options) {
   console.log();
 
   if (result.plan.actions.length > 0) {
-    console.log(chalk.gray('Run `uds update` to apply these changes.'));
-    console.log(chalk.gray('Run `uds update --force` to force update all files.'));
+    // NOT `uds update`. That runs the legacy path, which never executes this
+    // plan — it refreshes existing standards and reports success for having done
+    // so, which reads exactly like the plan was applied. Upgrading one project it
+    // printed "✓ 69 standards updated" while all 8 deletions and 2 creations in
+    // the plan above were silently skipped; the files were still on disk
+    // afterwards. Nor is `--force` the answer for "apply what I just read": it
+    // recomputes with force:true, a larger plan that rewrites every managed file.
+    console.log(chalk.gray('Run `uds update --apply` to apply exactly these changes.'));
+    console.log(chalk.gray('Run `uds update --force` to rewrite every managed file (a larger plan than the one above).'));
     console.log();
   }
 }
 
 /**
- * Handle --force: run the full reconciler with force mode.
+ * Run the reconciler and apply its plan.
+ *
+ * `force` selects WHICH plan: force mode rewrites every managed file regardless
+ * of hash, so it is a different and larger plan than the one `--plan` prints.
+ * That difference is why `--apply` exists — see handlePlan.
+ *
+ * @param {string} projectPath
+ * @param {Object} options - Command options (uses `yes`)
+ * @param {{ force: boolean }} mode
  */
-async function handleForceReconcile(projectPath, options) {
-  console.log(chalk.cyan('Running declarative state reconciliation (force mode)...'));
+async function handleReconcile(projectPath, options, { force }) {
+  console.log(chalk.cyan(
+    force
+      ? 'Running declarative state reconciliation (force mode)...'
+      : 'Running declarative state reconciliation...'
+  ));
   console.log();
 
   // First show the plan
-  const planResult = await reconcilerPlan(projectPath, { force: true });
+  const planResult = await reconcilerPlan(projectPath, { force });
 
   if (planResult.plan.actions.length === 0) {
     console.log(chalk.green('Everything is up to date. No changes needed.'));
@@ -2360,7 +2385,7 @@ async function handleForceReconcile(projectPath, options) {
   const spinner = ora('Applying reconciliation plan...').start();
 
   const result = await reconcile(projectPath, {
-    force: true,
+    force,
     backup: true,
     onAction: (action, index, total) => {
       spinner.text = `[${index + 1}/${total}] ${action.type} ${action.path || action.category}`;

package/src/reconciler/plan-executor.js

@@ -221,32 +221,49 @@ async function executeCreateOrUpdate(projectPath, action, manifest) {
   if (action.category === 'standard' || action.category === 'option') {
     const sourcePath = action.details?.sourcePath;
     if (!sourcePath) {
-      // Use copyStandard which handles bundled/repo/download fallback
+      // No absolute path was resolved, so fall back to copyStandard, which walks
+      // bundled → repo → download. Two kinds of entry arrive here.
       const metadata = action.details?.metadata;
-      if (metadata?.registryEntry) {
+      let sourceStr = null;
+      let targetDir = '.standards';
+
+      if (metadata?.extensionSource) {
+        // An entry from `manifest.extensions`. PathResolver cannot resolve these
+        // from an npm install: the published package's `files` list is bin, src,
+        // bundled, standards-registry.json and README.md — no `extensions/`. So
+        // `sourcePath` is null for every adopter who did not install from a
+        // source checkout, and this function answered "No source path available"
+        // for a file it was perfectly able to fetch.
+        //
+        // The legacy update path never had the bug because it calls copyStandard
+        // directly (`update.js`, "Update extensions"). The same upgrade therefore
+        // refreshed `.standards/zh-tw.md` under `uds update` and failed under the
+        // reconciler — the two paths disagreed about whether the file was
+        // reachable, and only one of them was right. (XSPEC-343)
+        sourceStr = metadata.extensionSource;
+      } else if (metadata?.registryEntry) {
         const source = metadata.registryEntry.source;
-        const sourceStr = typeof source === 'string'
+        sourceStr = typeof source === 'string'
           ? source
           : (source?.[metadata.format] || source?.ai || source?.human);
-        if (sourceStr) {
-          const targetDir = action.category === 'option'
-            ? dirname(action.path)
-            : '.standards';
-          const result = await copyStandard(sourceStr, targetDir, projectPath);
-          if (result.success) {
-            // Update hash in manifest
-            const hashInfo = computeFileHash(join(projectPath, action.path));
-            if (hashInfo) {
-              const normalizedPath = action.path.replace(/\\/g, '/');
-              manifest.fileHashes[normalizedPath] = {
-                ...hashInfo,
-                installedAt: new Date().toISOString()
-              };
-            }
-            return { action, success: true };
+        targetDir = action.category === 'option' ? dirname(action.path) : '.standards';
+      }
+
+      if (sourceStr) {
+        const result = await copyStandard(sourceStr, targetDir, projectPath);
+        if (result.success) {
+          // Update hash in manifest
+          const hashInfo = computeFileHash(join(projectPath, action.path));
+          if (hashInfo) {
+            const normalizedPath = action.path.replace(/\\/g, '/');
+            manifest.fileHashes[normalizedPath] = {
+              ...hashInfo,
+              installedAt: new Date().toISOString()
+            };
           }
-          return { action, success: false, error: result.error };
+          return { action, success: true };
         }
+        return { action, success: false, error: result.error };
       }
       return { action, success: false, error: 'No source path available' };
     }

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.2.5",
+  "version": "6.2.7",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.2.5"
+      "version": "6.2.7"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.2.5",
+      "version": "6.2.7",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.2.5",
+      "version": "6.2.7",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.2.5",
+      "version": "6.2.7",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.2.5",
+      "version": "6.2.7",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.2.5",
+      "version": "6.2.7",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"