universal-dev-standards 6.3.3 → 6.3.5

package/bundled/ai/standards/agent-behavior-discipline.ai.yaml

@@ -59,7 +59,7 @@ principles:
     triggers:
       - Any edit or refactor task
     do:
-      - Declare scope before editing ("I will modify: X. I will not touch: Y.")
+      - 'Declare scope before editing ("I will modify: X. I will not touch: Y.")'
       - Match the local code style rather than enforcing personal preferences
       - Flag pre-existing issues found out-of-scope with a verbal note only
     do_not:

package/bundled/ai/standards/container-security.ai.yaml

@@ -93,7 +93,7 @@ categories:
     required_settings:
       - readOnlyRootFilesystem: true
       - allowPrivilegeEscalation: false
-      - drop: [ALL] capabilities
+      - drop: "[ALL] capabilities"
     seccomp:
       profile: RuntimeDefault (or custom restricted profile)
       audit_mode: allowed for profiling only; not for production

package/bundled/ai/standards/full-coverage-testing.ai.yaml

@@ -161,23 +161,23 @@ standard:
   deployment_gates:
     pre_push_to_main:
       action: block
-      trigger: "// WARNING: STUB" marker found in src/
+      trigger: '"// WARNING: STUB" marker found in src/'
       message: "[STUB-BLOCK] STUB markers detected. Push to main rejected."
     deploy_to_uat:
       action: block
-      trigger: "// WARNING: STUB" marker found in src/
+      trigger: '"// WARNING: STUB" marker found in src/'
       message: "[DEPLOY-BLOCK] STUB markers detected. UAT deployment aborted."
     deploy_to_production:
       action: block
-      trigger: "// WARNING: STUB" marker found in src/
+      trigger: '"// WARNING: STUB" marker found in src/'
       message: "[CRITICAL] Production deployment with STUB markers is strictly prohibited."
     deploy_to_staging:
       action: warn
-      trigger: "// WARNING: STUB" marker found in src/
+      trigger: '"// WARNING: STUB" marker found in src/'
       message: "[STUB-WARN] Deploying with STUB markers to staging. NOT permitted in UAT/production."
     feature_branch_push:
       action: warn
-      trigger: "// WARNING: STUB" marker found in src/
+      trigger: '"// WARNING: STUB" marker found in src/'
       message: "[STUB-WARN] STUB markers found. Must remove before merging to main."
 
   migration_from_pyramid:

package/bundled/ai/standards/knowledge-graph-memory.ai.yaml

@@ -54,7 +54,7 @@ standard:
     - rule: "Spec impacted_by:[DEC]   => IMPACTS (Decision -> Spec)"
     - rule: "Decision supersedes:[DEC] => SUPERSEDES (Decision -> Decision)"
     - rule: "[[XSPEC-NNN]] link in a Decision body => IMPACTS (Decision -> Spec)"
-    idempotent: "Declaring a relationship from both ends yields one edge, not two"
+    - idempotent: "Declaring a relationship from both ends yields one edge, not two"
 
   modes:
     degraded:

package/bundled/locales/zh-CN/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.3
-translation_version: 6.3.3
+source_version: 6.3.5
+translation_version: 6.3.5
 last_synced: 2026-08-07
 status: current
 ---
@@ -17,6 +17,23 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.5] - 2026-08-07
+
+### Fixed
+
+- **四份出货的 `.ai.yaml` 标准无法解析。** 6.3.4 交付了 141 份机器可读标准，其中 `agent-behavior-discipline`、`container-security`、`full-coverage-testing`、`knowledge-graph-memory` 是语法无效的 YAML。同样四份也在 `.standards/`——那正是 `uds init` 放进采用者目录的东西。**agent 读它们得到的是异常而非空内容**，而下游若 catch 掉，得到的沉默与「这份标准没有规则」无从分辨。四份的失败方式相同：未加引号的纯量带着 YAML 语义字符——括号内的冒号、flow 序列后接散文、在值中途结束的引号、与兄弟项不同缩进的键。以加引号或调缩进修正，不重构结构。
+
+### Added
+
+- **`npm run check:ai-yaml`——每一份 `.ai.yaml` 都必须可解析，并已接上 pre-commit 与发版流程。** 上述四份之所以进得了发版，是因为有八个脚本会读那个目录而**没有一个解析全集**；`check-standards-sync.sh` 比对的是版本与注册表项目，一份无法解析的文件能安然通过。此检查读 `ai/`、`.standards/` 与 `cli/bundled/` 三处，且**无条件执行**而非藏在路径 glob 后面——一个窄到会跳过这次的 glob 就是同一个错误换个位置。**exit 2 保留给「检查跑不起来」**：读不到的目录、里面没有 `.ai.yaml` 的目录、载不到的 YAML 库。那不算通过，而且会挡下发版——因为一个「没问题」与「查不了」输出相同的检查，会把未知转成安心。
+
+## [6.3.4] - 2026-08-07
+
+### Fixed
+
+- **`uds deps` 指名了一个 npm 不会安装的版本。** 解析字段原本取「所有已发布版本中满足声明范围的最高版本」。那是 semver 的规则，不是 npm 的：`npm-pick-manifest` 在 `latest` dist-tag 满足范围时优先采用它，存在的目的正是不让带着普通版本号的 `next` 或 `beta` 发布落到只要了一个 caret 的人身上。以 `@anthropic-ai/claude-agent-sdk` 实测（`latest = 0.3.223`、`next = 0.3.224`）：命令回报 0.3.224，而 `npm install …@^0.3` 实际装 0.3.223。**那个字段存在的全部目的就是说出「安装会拿到什么」，而它指名了没有任何安装会拿到的东西。** 现改为单次 `npm view` 同时取版本清单与 dist-tags，套用 npm 自己的优先顺序；`latest` 落在范围外时退回「范围内最高版本」——锁在旧 major 的项目仍得到诚实的答案。两个分支各有测试覆盖。
+- 前两个版本修的是这个命令的**措辞**，这一版修的是它的**算术**。值得直说：先前那些修正只是让一个错的数字变得更好读。
+
 ## [6.3.3] - 2026-08-07
 
 ### Fixed

package/bundled/locales/zh-CN/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **语言**: [English](../../README.md) | [繁體中文](../zh-TW/README.md) | 简体中文
 
-**版本**: 6.3.3 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.5 | **发布日期**: 2026-07-31 | **授权**: [双重授权](../../LICENSE) (CC BY 4.0 + MIT)
 
 语言无关、框架无关的软件项目文档标准。通过 AI 原生工作流，确保不同技术栈之间的一致性、质量和可维护性。
 

package/bundled/locales/zh-TW/CHANGELOG.md

@@ -1,7 +1,7 @@
 ---
 source: ../../CHANGELOG.md
-source_version: 6.3.3
-translation_version: 6.3.3
+source_version: 6.3.5
+translation_version: 6.3.5
 last_synced: 2026-08-07
 status: current
 ---
@@ -17,6 +17,23 @@ status: current
 
 ## [Unreleased]
 
+## [6.3.5] - 2026-08-07
+
+### Fixed
+
+- **四份出貨的 `.ai.yaml` 標準無法解析。** 6.3.4 交付了 141 份機器可讀標準，其中 `agent-behavior-discipline`、`container-security`、`full-coverage-testing`、`knowledge-graph-memory` 是語法無效的 YAML。同樣四份也在 `.standards/`——那正是 `uds init` 放進採用者目錄的東西。**agent 讀它們得到的是例外而非空內容**，而下游若 catch 掉，得到的沉默與「這份標準沒有規則」無從分辨。四份的失敗方式相同：未加引號的純量帶著 YAML 語意字元——括號內的冒號、flow 序列後接散文、在值中途結束的引號、與兄弟項不同縮排的鍵。以加引號或調縮排修正，不重構結構。
+
+### Added
+
+- **`npm run check:ai-yaml`——每一份 `.ai.yaml` 都必須可解析，並已接上 pre-commit 與發版流程。** 上述四份之所以進得了發版，是因為有八個腳本會讀那個目錄而**沒有一個解析全集**；`check-standards-sync.sh` 比對的是版本與註冊表項目，一份無法解析的檔案能安然通過。此檢查讀 `ai/`、`.standards/` 與 `cli/bundled/` 三處，且**無條件執行**而非藏在路徑 glob 後面——一個窄到會跳過這次的 glob 就是同一個錯誤換個位置。**exit 2 保留給「檢查跑不起來」**：讀不到的目錄、裡面沒有 `.ai.yaml` 的目錄、載不到的 YAML 函式庫。那不算通過，而且會擋下發版——因為一個「沒問題」與「查不了」輸出相同的檢查，會把未知轉成安心。
+
+## [6.3.4] - 2026-08-07
+
+### Fixed
+
+- **`uds deps` 指名了一個 npm 不會安裝的版本。** 解析欄位原本取「所有已發布版本中滿足宣告範圍的最高版本」。那是 semver 的規則，不是 npm 的：`npm-pick-manifest` 在 `latest` dist-tag 滿足範圍時優先採用它，存在的目的正是不讓帶著普通版本號的 `next` 或 `beta` 發布落到只要了一個 caret 的人身上。以 `@anthropic-ai/claude-agent-sdk` 實測（`latest = 0.3.223`、`next = 0.3.224`）：指令回報 0.3.224，而 `npm install …@^0.3` 實際裝 0.3.223。**那個欄位存在的全部目的就是說出「安裝會拿到什麼」，而它指名了沒有任何安裝會拿到的東西。** 現改為單次 `npm view` 同時取版本清單與 dist-tags，套用 npm 自己的優先順序；`latest` 落在範圍外時退回「範圍內最高版本」——鎖在舊 major 的專案仍得到誠實的答案。兩個分支各有測試覆蓋。
+- 前兩個版本修的是這個指令的**措辭**，這一版修的是它的**算術**。值得直說：先前那些修正只是讓一個錯的數字變得更好讀。
+
 ## [6.3.3] - 2026-08-07
 
 ### Fixed

package/bundled/locales/zh-TW/README.md

@@ -15,7 +15,7 @@ status: current
 
 > **語言**: [English](../../README.md) | 繁體中文 | [简体中文](../zh-CN/README.md)
 
-**版本**: 6.3.3 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
+**版本**: 6.3.5 | **發布日期**: 2026-07-31 | **授權**: [雙重授權](../../LICENSE) (CC BY 4.0 + MIT)
 
 語言無關、框架無關的軟體專案文件標準。透過 AI 原生工作流，確保不同技術堆疊之間的一致性、品質和可維護性。
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "universal-dev-standards",
-  "version": "6.3.3",
+  "version": "6.3.5",
   "description": "CLI tool for adopting Universal Development Standards",
   "keywords": [
     "documentation",

package/src/utils/dependency-resolution.js

@@ -38,6 +38,12 @@
  * silently answer a different question for anyone who does not install from
  * the public registry, and would answer it confidently.
  *
+ * **And it applies npm's resolution rule, not semver's.** The highest version
+ * satisfying a range is *not* what npm installs: npm prefers the `latest`
+ * dist-tag whenever it satisfies, so a `next` or `beta` publish carrying an
+ * ordinary version number does not land on people. Getting this wrong made the
+ * tool name a version no consumer receives — see `resolveViaNpm`.
+ *
  * **A registry lookup that fails is never folded into "consistent".** It
  * becomes `unverifiable` and makes the whole check non-zero. A tool whose
  * "everything is fine" and "I could not find out" look the same is worse than
@@ -68,18 +74,30 @@ import semver from 'semver';
 const DEFAULT_CONCURRENCY = 8;
 
 /**
- * Run `npm view <name>@<range> version --json` and return the highest version
- * that satisfies the range.
+ * Return the version an install of `range` would actually receive.
+ *
+ * **This deliberately reproduces npm's rule, not semver's.** The obvious
+ * implementation — take the highest published version satisfying the range —
+ * is wrong, and wrong in the direction this module exists to catch. npm's
+ * resolver (`npm-pick-manifest`) prefers the `latest` dist-tag whenever it
+ * satisfies the range, and only falls back to the maximum otherwise. That rule
+ * exists so a `next` or `beta` publish does not land on people who asked for a
+ * caret.
+ *
+ * Measured on 2026-08-07: `@anthropic-ai/claude-agent-sdk` published
+ * `latest = 0.3.223` and `next = 0.3.224`, both ordinary semver strings, both
+ * satisfying `^0.3`. The maximum-satisfying rule named 0.3.224;
+ * `npm install @anthropic-ai/claude-agent-sdk@^0.3` installs 0.3.223. **The
+ * earlier implementation reported a version no consumer receives** — in the one
+ * column whose entire purpose is to say what they receive.
  *
- * npm prints a bare JSON string when exactly one version matches and a JSON
- * array when several do. The array is in publish order, **not** semver order —
- * a backport released after a major bump appears last while being the lowest
- * version — so the maximum is computed with semver rather than by taking the
- * final element. Guessing here would produce a confident wrong answer, which
- * is the failure mode this whole module exists to detect.
+ * Versions and tags are read in a single `npm view` call. The version list is
+ * in publish order, **not** semver order — a backport released after a major
+ * bump appears last while being the lowest version — so the fallback maximum is
+ * computed with semver rather than by taking the final element.
  */
 async function resolveViaNpm(name, range, run) {
-  const { code, stdout, stderr } = await run(['view', `${name}@${range}`, 'version', '--json']);
+  const { code, stdout, stderr } = await run(['view', name, 'versions', 'dist-tags', '--json']);
 
   if (code !== 0) {
     const detail = (stderr || stdout || '').split('\n').find((l) => l.trim()) ?? '';
@@ -93,13 +111,30 @@ async function resolveViaNpm(name, range, run) {
     throw new Error(`npm view returned output that is not JSON: ${stdout.slice(0, 120)}`);
   }
 
-  if (typeof parsed === 'string') return parsed;
-  if (Array.isArray(parsed) && parsed.length > 0) {
-    const max = semver.maxSatisfying(parsed, range);
-    if (max) return max;
-    throw new Error(`no version in [${parsed.join(', ')}] satisfies ${range}`);
+  // npm flattens the response when only one of the requested fields exists on
+  // the package, so neither key can be assumed present. A package with exactly
+  // one published version reports `versions` as a bare string.
+  const versions = Array.isArray(parsed?.versions)
+    ? parsed.versions
+    : typeof parsed?.versions === 'string'
+      ? [parsed.versions]
+      : Array.isArray(parsed)
+        ? parsed
+        : typeof parsed === 'string'
+          ? [parsed]
+          : [];
+  const tags = parsed?.['dist-tags'] ?? {};
+
+  if (versions.length === 0) throw new Error('npm view returned no versions');
+
+  const latest = tags.latest;
+  if (typeof latest === 'string' && semver.valid(latest) && semver.satisfies(latest, range)) {
+    return latest;
   }
-  throw new Error('npm view returned no version');
+
+  const max = semver.maxSatisfying(versions, range);
+  if (max) return max;
+  throw new Error(`no published version of ${name} satisfies ${range}`);
 }
 
 /**

package/standards-registry.json

@@ -1,6 +1,6 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "version": "6.3.3",
+  "version": "6.3.5",
   "lastUpdated": "2026-05-13",
   "description": "Standards registry for universal-dev-standards with integrated skills and AI-optimized formats",
   "formats": {
@@ -58,14 +58,14 @@
     "standards": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
-      "version": "6.3.3"
+      "version": "6.3.5"
     },
     "skills": {
       "name": "universal-dev-standards",
       "url": "https://github.com/AsiaOstrich/universal-dev-standards",
       "localPath": "skills",
       "rawUrl": "https://raw.githubusercontent.com/AsiaOstrich/universal-dev-standards/main/skills",
-      "version": "6.3.3",
+      "version": "6.3.5",
       "note": "Skills are now included in the main repository under skills/"
     }
   },
@@ -2236,7 +2236,7 @@
       "id": "license-compliance",
       "name": "License Compliance Standards",
       "nameZh": "授權合規標準",
-      "version": "6.3.3",
+      "version": "6.3.5",
       "source": {
         "human": "core/license-compliance.md",
         "ai": "ai/standards/license-compliance.ai.yaml"
@@ -2248,7 +2248,7 @@
       "id": "verification-oracle",
       "name": "Verification Oracle Standards",
       "nameZh": "驗證 Oracle 標準",
-      "version": "6.3.3",
+      "version": "6.3.5",
       "source": {
         "human": "core/verification-oracle.md",
         "ai": "ai/standards/verification-oracle.ai.yaml"
@@ -2260,7 +2260,7 @@
       "id": "model-provenance",
       "name": "Model Provenance Policy Standards",
       "nameZh": "模型來源政策標準",
-      "version": "6.3.3",
+      "version": "6.3.5",
       "source": {
         "human": "core/model-provenance.md",
         "ai": "ai/standards/model-provenance.ai.yaml"
@@ -2272,7 +2272,7 @@
       "id": "resource-cost-boundary",
       "name": "Resource / Cost Boundary Declaration Standards",
       "nameZh": "資源／成本邊界宣告標準",
-      "version": "6.3.3",
+      "version": "6.3.5",
       "source": {
         "human": "core/resource-cost-boundary.md",
         "ai": "ai/standards/resource-cost-boundary.ai.yaml"