universal-dev-standards 6.2.6 → 6.2.8

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.6
-translation_version: 6.2.6
+source_version: 6.2.8
+translation_version: 6.2.8
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,18 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.8] - 2026-07-31
+
+### 修复
+
+- **下载回来的标准，中文是坏的。** HTTPS 响应以 `data += chunk` 累积，而那会对每一个分块各自解码——于是任何字节跨在分块边界上的字符都变成替换字符（`日期` → `日�期`）。单字节的拉丁文不受影响；三字节的中日韩文字受影响。**过程中没有任何一步失败**：传输完成、文件写入、动作报告成功，损坏只有读文字才看得见。在一台机器上实测，**11 个项目的已安装标准里共约 278 个替换字符**。损害集中在 `requirement-checklist.md`、`requirement-template.md`、`requirement-document-template.md` 与 locale 包——也就是发布包不出货的那些文件（`files` 不含 `templates/` 与 `extensions/`），它们只可能靠下载取得。**若你的标准里有 `�`，请在 6.2.8 以上跑 `uds update --force`——重新下载的内容是正确的，会覆盖掉它们。**
+
+## [6.2.7] - 2026-07-31
+
+### 修复
+
+- **reconciler 在任何 npm 安装下都取不到 extension。** `manifest.extensions` 的条目（locale 包之类）抵达 executor 时没有已解析的来源路径，因为发布包的 `files` 清单不含 `extensions/` 目录——于是 `uds update --force` 对它们报告 `No source path available`，而 `uds update` 却更新了同一个文件。executor 现在改以 `copyStandard` 解析 extension，那是它处理 registry entry 时本来就在用的 bundled → repo → download fallback，也正是 legacy 路径一直在用的那一条。完全没有任何来源的条目仍然会失败，本来就该如此。
+
 ## [6.2.6] - 2026-07-31
 
 ### 新增

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.2.6 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.8 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-CN/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支持状态 |
 |------|--------|
-| 6.2.6 | ✅ 最新正式版 |
+| 6.2.8 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已终止支持 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.2.6
-translation_version: 6.2.6
+source_version: 6.2.8
+translation_version: 6.2.8
 last_synced: 2026-07-31
 status: current
 ---
@@ -17,6 +17,18 @@ status: current
 
 ## [Unreleased]
 
+## [6.2.8] - 2026-07-31
+
+### 修復
+
+- **下載回來的標準，中文是壞的。** HTTPS 回應以 `data += chunk` 累積，而那會對每一個分塊各自解碼——於是任何位元組跨在分塊邊界上的字元都變成替換字元（`日期` → `日�期`）。單位元組的拉丁文不受影響；三位元組的中日韓文字受影響。**過程中沒有任何一步失敗**：傳輸完成、檔案寫入、動作回報成功，損壞只有讀文字才看得見。在一台機器上實測，**11 個專案的已安裝標準裡共約 278 個替換字元**。損害集中在 `requirement-checklist.md`、`requirement-template.md`、`requirement-document-template.md` 與 locale 包——也就是發布包不出貨的那些檔（`files` 不含 `templates/` 與 `extensions/`），它們只可能靠下載取得。**若你的標準裡有 `�`，請在 6.2.8 以上跑 `uds update --force`——重新下載的內容是正確的，會覆蓋掉它們。**
+
+## [6.2.7] - 2026-07-31
+
+### 修復
+
+- **reconciler 在任何 npm 安裝下都取不到 extension。** `manifest.extensions` 的項目（locale 包之類）抵達 executor 時沒有已解析的來源路徑，因為發布包的 `files` 清單不含 `extensions/` 目錄——於是 `uds update --force` 對它們回報 `No source path available`，而 `uds update` 卻更新了同一個檔案。executor 現在改以 `copyStandard` 解析 extension，那是它處理 registry entry 時本來就在用的 bundled → repo → download fallback，也正是 legacy 路徑一直在用的那一條。完全沒有任何來源的項目仍然會失敗，本來就該如此。
+
 ## [6.2.6] - 2026-07-31
 
 ### 新增

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.2.6 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.2.8 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/bundled/locales/zh-TW/SECURITY.md

@@ -13,7 +13,7 @@ status: current
 <!-- UDS_SUPPORTED_VERSIONS_START -->
 | 版本 | 支援狀態 |
 |------|--------|
-| 6.2.6 | ✅ 最新正式版 |
+| 6.2.8 | ✅ 最新正式版 |
 | < 6.0.0 | ❌ 已終止支援 |
 <!-- UDS_SUPPORTED_VERSIONS_END -->
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.2.6",
+  "version": "6.2.8",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/reconciler/plan-executor.js

@@ -221,32 +221,49 @@ async function executeCreateOrUpdate(projectPath, action, manifest) {
   if (action.category === 'standard' || action.category === 'option') {
     const sourcePath = action.details?.sourcePath;
     if (!sourcePath) {
-      // Use copyStandard which handles bundled/repo/download fallback
+      // No absolute path was resolved, so fall back to copyStandard, which walks
+      // bundled → repo → download. Two kinds of entry arrive here.
       const metadata = action.details?.metadata;
-      if (metadata?.registryEntry) {
+      let sourceStr = null;
+      let targetDir = '.standards';
+
+      if (metadata?.extensionSource) {
+        // An entry from `manifest.extensions`. PathResolver cannot resolve these
+        // from an npm install: the published package's `files` list is bin, src,
+        // bundled, standards-registry.json and README.md — no `extensions/`. So
+        // `sourcePath` is null for every adopter who did not install from a
+        // source checkout, and this function answered "No source path available"
+        // for a file it was perfectly able to fetch.
+        //
+        // The legacy update path never had the bug because it calls copyStandard
+        // directly (`update.js`, "Update extensions"). The same upgrade therefore
+        // refreshed `.standards/zh-tw.md` under `uds update` and failed under the
+        // reconciler — the two paths disagreed about whether the file was
+        // reachable, and only one of them was right. (XSPEC-343)
+        sourceStr = metadata.extensionSource;
+      } else if (metadata?.registryEntry) {
         const source = metadata.registryEntry.source;
-        const sourceStr = typeof source === 'string'
+        sourceStr = typeof source === 'string'
           ? source
           : (source?.[metadata.format] || source?.ai || source?.human);
-        if (sourceStr) {
-          const targetDir = action.category === 'option'
-            ? dirname(action.path)
-            : '.standards';
-          const result = await copyStandard(sourceStr, targetDir, projectPath);
-          if (result.success) {
-            // Update hash in manifest
-            const hashInfo = computeFileHash(join(projectPath, action.path));
-            if (hashInfo) {
-              const normalizedPath = action.path.replace(/\\/g, '/');
-              manifest.fileHashes[normalizedPath] = {
-                ...hashInfo,
-                installedAt: new Date().toISOString()
-              };
-            }
-            return { action, success: true };
+        targetDir = action.category === 'option' ? dirname(action.path) : '.standards';
+      }
+
+      if (sourceStr) {
+        const result = await copyStandard(sourceStr, targetDir, projectPath);
+        if (result.success) {
+          // Update hash in manifest
+          const hashInfo = computeFileHash(join(projectPath, action.path));
+          if (hashInfo) {
+            const normalizedPath = action.path.replace(/\\/g, '/');
+            manifest.fileHashes[normalizedPath] = {
+              ...hashInfo,
+              installedAt: new Date().toISOString()
+            };
           }
-          return { action, success: false, error: result.error };
+          return { action, success: true };
         }
+        return { action, success: false, error: result.error };
       }
       return { action, success: false, error: 'No source path available' };
     }

package/src/utils/github.js

@@ -90,13 +90,32 @@ function httpGet(url) {
         return;
       }
 
-      let data = '';
-      res.on('data', chunk => data += chunk);
-      res.on('end', () => resolve({
-        data,
-        statusCode: res.statusCode,
-        headers: res.headers
-      }));
+      // Collect Buffers and decode once at the end. `data += chunk` decoded each
+      // chunk on its own, so any character whose bytes straddled a chunk boundary
+      // became U+FFFD on both sides of the split. Latin text survived because its
+      // characters are one byte; Chinese standards are three bytes each and did
+      // not. `uds update --force` on one project downloaded four files and wrote
+      // 30 replacement characters into them — `日期` → `日�期`, `結構` → `結�構`
+      // — and reported every action as succeeded, because as far as the CLI was
+      // concerned the transfer completed and the file was written. (XSPEC-343)
+      const chunks = [];
+      res.on('data', chunk => chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)));
+      res.on('end', () => {
+        // try/catch because a throw inside an event handler does not reject the
+        // enclosing promise — it escapes, and the caller's await hangs forever.
+        // The first draft of this fix passed strings to Buffer.concat and the
+        // test run simply stopped, with no error to read. A hang is a worse
+        // failure than an exception: there is nothing to grep for.
+        try {
+          resolve({
+            data: Buffer.concat(chunks).toString('utf8'),
+            statusCode: res.statusCode,
+            headers: res.headers
+          });
+        } catch (err) {
+          reject(err);
+        }
+      });
       res.on('error', reject);
     }).on('error', reject);
   });

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.2.6",
+  "version": "6.2.8",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.2.6"
+      "version": "6.2.8"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.2.6",
+      "version": "6.2.8",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.2.6",
+      "version": "6.2.8",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.2.6",
+      "version": "6.2.8",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.2.6",
+      "version": "6.2.8",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.2.6",
+      "version": "6.2.8",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"