universal-dev-standards 6.9.0 → 6.10.0

package/src/installers/standards-installer.js

@@ -1,5 +1,5 @@
 import chalk from 'chalk';
-import ora from 'ora';
+import { createSpinner } from '../utils/spinner.js';
 import { basename, join } from 'path';
 import {
   getAllStandards,
@@ -75,7 +75,7 @@ export async function installStandards(config, projectPath) {
   };
 
   // Start copying standards
-  const copySpinner = ora(msg.copyingStandards).start();
+  const copySpinner = createSpinner(msg.copyingStandards).start();
 
   // Copy standards based on format
   const formatsToUse = config.format === 'both' ? ['ai', 'human'] : [config.format];
@@ -113,7 +113,7 @@ export async function installStandards(config, projectPath) {
   const localeExtension = (config.displayLanguage === 'zh-tw' || config.displayLanguage === 'zh-cn') ? config.displayLanguage : null;
 
   if (config.languages.length > 0 || config.frameworks.length > 0 || localeExtension) {
-    const extSpinner = ora(msg.copyingExtensions).start();
+    const extSpinner = createSpinner(msg.copyingExtensions).start();
 
     for (const lang of config.languages) {
       if (EXTENSION_MAPPINGS[lang]) {

package/src/prompts/init.js

@@ -1,5 +1,5 @@
 import { select, checkbox, confirm as inquirerConfirm, Separator, input } from '@inquirer/prompts';
-import { existsSync, writeFileSync, readdirSync } from 'fs';
+import { existsSync, readFileSync, writeFileSync, readdirSync } from 'fs';
 import { join } from 'path';
 import chalk from 'chalk';
 import os from 'os';
@@ -1385,11 +1385,40 @@ export function suggestCommands(projectPath) {
   if (existsSync(p('Gemfile')))
     return { test: 'bundle exec rspec', lint: 'bundle exec rubocop', build: 'gem build *.gemspec', security: 'bundle audit' };
 
-  // C# — glob for .csproj / .sln
+  // C# — glob for .csproj / .sln.
+  //
+  // `.csproj` has named two incompatible build systems since 2017. An SDK-style
+  // project (`<Project Sdk="…">`, `<TargetFramework>`) builds with the `dotnet`
+  // CLI. An old-style one (`<TargetFrameworkVersion>`, no Sdk attribute) needs
+  // MSBuild and Visual Studio's targets, and handing it `dotnet build` produces
+  // `MSB4019: could not find Import project …Microsoft.WebApplication.targets`
+  // — reported 2026-09-16 from a .NET Framework 4.8 Web App, which also got
+  // `dotnet list package --vulnerable`, a command that silently reports nothing
+  // for a `packages.config` project because it only reads `PackageReference`.
+  //
+  // For the old style only `build` gets an answer. `dotnet format` requires an
+  // SDK-style project and there is no drop-in equivalent; test discovery
+  // depends on which runner the solution uses. The unknown-ecosystem branch
+  // below already returns blanks "so user fills them in", and a blank a human
+  // completes beats a command that looks authoritative and fails on first use.
   try {
     const files = readdirSync(projectPath);
-    if (files.some(f => f.endsWith('.csproj') || f.endsWith('.sln')))
-      return { test: 'dotnet test', lint: 'dotnet format --verify-no-changes', build: 'dotnet build', security: 'dotnet list package --vulnerable' };
+    const projectFiles = files.filter(f => f.endsWith('.csproj') || f.endsWith('.vbproj'));
+    if (projectFiles.length > 0 || files.some(f => f.endsWith('.sln'))) {
+      const oldStyle = projectFiles.some(f => {
+        try {
+          const xml = readFileSync(join(projectPath, f), 'utf-8');
+          if (/<Project[^>]*\sSdk\s*=/i.test(xml)) return false;
+          return /<TargetFrameworkVersion\s*>/i.test(xml);
+        } catch {
+          return false;
+        }
+      });
+
+      return oldStyle
+        ? { test: '', lint: '', build: 'msbuild /t:Build /p:Configuration=Release', security: '' }
+        : { test: 'dotnet test', lint: 'dotnet format --verify-no-changes', build: 'dotnet build', security: 'dotnet list package --vulnerable' };
+    }
   } catch {
     // ignore read errors
   }

package/src/reconciler/diff-engine.js

@@ -14,6 +14,8 @@
  * Integration files use migrate_block: only the UDS marker block is replaced.
  */
 
+import { isShippedFilename } from '../utils/registry.js';
+
 /**
  * @typedef {Object} PlanAction
  * @property {'create'|'update'|'delete'|'migrate_block'|'patch_hook'} type
@@ -205,12 +207,18 @@ function diffCategory(desiredMap, actualMap, category, actions, warnings, summar
   // Check actual entries not in desired → delete (only if UDS-managed)
   for (const [key, actualEntry] of actualMap) {
     if (!desiredMap.has(key)) {
-      if (isUDSManaged(actualEntry)) {
+      if (isUserConfigPath(actualEntry.relativePath)) {
+        // Said out loud rather than skipped quietly: a plan that silently omits
+        // things is how the previous round of deletion bugs stayed invisible.
+        warnings.push(
+          `Keeping ${actualEntry.relativePath}: it holds a setting you chose (uds config writes it), not content UDS ships`
+        );
+      } else if (isUDSManaged(actualEntry)) {
         actions.push({
           type: 'delete',
           category,
           path: actualEntry.relativePath,
-          reason: 'no longer in desired state',
+          reason: describeDeletion(actualEntry.relativePath, category),
           details: {
             currentHash: actualEntry.hash,
             metadata: actualEntry.metadata
@@ -330,6 +338,53 @@ function diffIntegrations(desiredMap, actualMap, actions, warnings, summary, for
  * Files in .standards/ are always UDS-managed.
  * Skill/command entries from manifest installations are UDS-managed.
  */
+/**
+ * Files under `.standards/` that hold a choice the user made, not content UDS
+ * ships.
+ *
+ * `release-config.yaml` is written by `uds init` from the release mode the user
+ * picked and rewritten by `uds config`. Nothing in the desired-state calculator
+ * models it, so it fell out of every diff as "no longer in desired state" and
+ * into the delete plan — a plan that discards a user setting and calls that
+ * reconciliation. Reported 2026-09-16 by an adopter who could not tell from the
+ * plan whether the file held anything of theirs. It did.
+ *
+ * @param {string} relativePath
+ * @returns {boolean}
+ */
+export function isUserConfigPath(relativePath) {
+  const normalized = String(relativePath || '').replace(/\\/g, '/');
+  return normalized === '.standards/release-config.yaml';
+}
+
+/**
+ * Why this file is being deleted, in terms the adopter can act on.
+ *
+ * "no longer in desired state" was the reason given for a standard UDS retired
+ * upstream, an option the project deselected, and a path the desired state does
+ * not model — three different situations, three different right responses, one
+ * sentence. The distinction that matters most is the first one: if UDS still
+ * ships the file, the change came from this project and is reversible by
+ * re-selecting it; if UDS does not, it is gone upstream and re-selecting it will
+ * not bring it back.
+ *
+ * @param {string} relativePath
+ * @param {string} category - 'standard' | 'option' | 'skill' | 'command' | …
+ * @returns {string}
+ */
+export function describeDeletion(relativePath, category) {
+  const normalized = String(relativePath || '').replace(/\\/g, '/');
+
+  if (category === 'standard' || category === 'option') {
+    const fileName = normalized.split('/').pop();
+    return isShippedFilename(fileName)
+      ? 'this project no longer selects it (UDS still ships it, so re-selecting restores it)'
+      : 'UDS no longer ships this file (re-selecting will not bring it back)';
+  }
+
+  return `not part of what this project's manifest asks for (category: ${category})`;
+}
+
 function isUDSManaged(entry) {
   // Files in .standards/ are always UDS-managed
   if (entry.relativePath.startsWith('.standards/')) return true;

package/src/reconciler/plan-executor.js

@@ -436,6 +436,22 @@ async function executeSkillBatch(projectPath, skillActions, manifest) {
   return results;
 }
 
+/**
+ * Hash-map key for a command action: `<agent>/<file>`.
+ *
+ * `commandHashes` is keyed by agent and filename; a plan action carries a
+ * project-relative path (`.opencode/command/atdd.md`). Deleting by the wrong key
+ * leaves the entry behind and the next `check` reports the file missing.
+ */
+function commandHashKey(action) {
+  const meta = action.details?.metadata;
+  if (meta?.agent && meta?.commandName) return `${meta.agent}/${meta.commandName}.md`;
+  const parts = action.path.split('/').filter(Boolean);
+  const agent = parts[0] ? parts[0].replace(/^\./, '') : null;
+  const file = parts[parts.length - 1];
+  return agent && file ? `${agent}/${file}` : action.path;
+}
+
 /**
  * Batch execute command installations.
  */
@@ -452,6 +468,9 @@ async function executeCommandBatch(projectPath, commandActions, manifest) {
       if (existsSync(targetPath)) {
         rmSync(targetPath, { recursive: true, force: true });
       }
+      // A deleted file must also lose its hash entry, or the next check calls
+      // it missing for good.
+      delete manifest.commandHashes[commandHashKey(action)];
       results.push({ action, success: true });
     } catch (err) {
       results.push({ action, success: false, error: err.message });
@@ -475,17 +494,18 @@ async function executeCommandBatch(projectPath, commandActions, manifest) {
         );
 
         if (installResult.allFileHashes) {
-          // Clean up stale entries for agents being updated before merging
-          const updatedPrefixes = new Set(
-            Object.keys(installResult.allFileHashes).map(k => k.split('/')[0])
-          );
-          for (const prefix of updatedPrefixes) {
-            for (const key of Object.keys(manifest.commandHashes)) {
-              if (key.startsWith(prefix + '/')) {
-                delete manifest.commandHashes[key];
-              }
-            }
-          }
+          // Merge, exactly as the skill path above does.
+          //
+          // 🔴 This used to delete every key whose prefix matched an agent in the
+          // result before merging. That is correct only when the installer
+          // reinstalled ALL of that agent's commands — which `uds update`'s own
+          // call sites do (they pass `commandNames = null`). Here the plan names a
+          // subset, so the wipe threw away the entry for every command the plan did
+          // not mention. Measured on 6.9.0 (2026-09-16): a three-file drift turned
+          // 51 tracked commands into 3, the other 48 stayed on disk untracked, and
+          // `uds check` printed "All command files intact (3 files)" in the same run
+          // as "Commands: 51 installed" — tampering with one of the 48 changed
+          // neither line.
           Object.assign(manifest.commandHashes, installResult.allFileHashes);
         }