v6.14.0-beta.3

Pre-release — install with npm install -g universal-dev-standards@beta. What to test and how to go back to stable: docs/PRE-RELEASE.md.

Existing adopters — run uds update once. The pre-commit hook that uds init wrote in earlier versions is the single line npx uds check, which can ask npm for a package named uds that is not this project. New installs no longer write it, and uds update replaces the line UDS itself wrote in an existing .husky/pre-commit. Also new: uds uninstall removes only what it can prove UDS wrote (a project installed by an earlier UDS keeps some files, and says why), and uds open-work next-action reads a next action written as a table column.

Changed

• uds open-work next-action now reads a next action written as a Markdown table column, not only as a heading or an inline label. A column whose header is in the next-action vocabulary (Next action, Next step, 下一步, 下一動, and now 回來要做什麼) is read on every row, and each report carries the line number and the row's first cell. The vocabulary is still one list: headings, inline labels and table headers all read it. A table inside a blockquote (> | … |) is now seen, and a | inside a code span or after a backslash no longer splits a cell. A row whose cell count differs from its header is listed as UNDECIDABLE and never read as empty; with no violation elsewhere the exit code is 2, because a clean result would cover only part of the field. An empty, — or - cell is counted and not evaluated, and is not an OWT-019 violation. Found while measuring the DEC-122 H2 baseline on a real work log, where 32 of 80 rows had a different cell count than their header. 回來要做什麼 is the header that work log actually uses (its prose calls the column 下一動) and is UNCALIBRATED (OWT-016). The check's own mutation tests gain eight table mutants; the previous seventeen still go red.

Fixed

• uds uninstall no longer leaves UDS's own files behind, and no longer removes what it cannot prove is UDS's. After init → update --with-hooks → uninstall -y it reported "Removed 5, Skipped 1, Errors 0" and left 15 hook scripts under scripts/hooks/, an empty .codex/, an AGENTS.md whose generated header still pointed at the deleted .standards/, and the body of .git/hooks/pre-commit that uds init had written. The rule is now: a whole file is deleted only if the manifest records that UDS wrote it (installedArtifacts, written by init and update --with-hooks) and its content still matches the recorded hash. Anything else is kept, and the output says why (kept: modified since UDS wrote it, kept: no install record — installed by an older UDS or not by UDS, so UDS cannot prove it wrote this). Folders are removed only if UDS created them and they are now empty; the adopter's own scripts/hooks/*.mjs, .agents/rules/* and hook entries are kept. A project installed by an earlier UDS has no records, so its scripts, generated AGENTS.md text and native pre-commit body are kept and explained rather than guessed at. Every "Removed" line now corresponds to a real deletion or edit, and a run that ends with errors exits non-zero.
• uds uninstall no longer draws a prompt or a stack trace when nobody can answer, and no longer exits 0 when it did nothing. --dry-run never prompts (it writes nothing) and previews every category. Without --yes and without a terminal, a real run refuses with exit code 2 instead of assuming "yes"; a closed prompt exits 130; an uninitialized project exits 1.
• uds init --with-hooks no longer prints 'chmod' is not recognized on Windows. The pre-commit hook was made executable with execSync("chmod +x ...") inside a try/catch; the catch hid the failure from the code but execSync had already sent cmd.exe's error to the terminal. It now calls fs.chmodSync and skips the step on Windows, where there is no execute bit.
• Security: the pre-commit hook uds init writes no longer asks npm for a package named uds, which is not this project. The hook was the single line npx uds check. npx looks in node_modules/.bin and on PATH first and goes to the npm registry only when neither has it, and the registry package uds is an unrelated project (maintainer wizawu, github.com/wizawu/uds, v0.3.6, last published 2022, no bin today). On a machine with UDS installed nothing changed; on any clone without it the hook fetched a stranger's package by name — harmless only because that package has no executable yet, and the day it ships one every adopter's every commit would run it. --no-install is not a fix: measured against a local registry that logs every request (npm 10.9.9, 11.20.0, 12.1.0, identical), npx --no-install uds still requests GET /uds, and npx --no-install --package=universal-dev-standards uds cannot find a global install at all. The hook now uses neither: it looks for universal-dev-standards (the package's own name, which only this project can publish) in the project's node_modules/.bin and then on PATH, runs check, and when it is found nowhere prints what to install and exits non-zero — it neither skips the check nor downloads anything, and a failing check stops the commit even when the adopter's own commands follow it. uds uninstall removes the new block whole, by its markers. The human-readable text has the same fix: the warning line inside generated CLAUDE.md/AGENTS.md blocks and the hook hints now say npx universal-dev-standards init / update (the warning line is a few tokens longer, so scripts/prompt-footprint-baseline.json is raised by exactly the measured 3–6). Existing adopters: uds update (every mode except --skills, --commands, --integrations-only, --standards-only and --rollback, and --with-hooks; --plan reports without writing) replaces the line UDS itself wrote in .husky/pre-commit — only the two exact shapes UDS has ever generated (npx uds check, and the older npx uds check --standard checkin-standards) directly under its # UDS Standard Check marker — and a line you wrote or edited yourself is left alone and reported with its line number. It runs before the "already up to date" return, so an adopter whose standards are current gets it too. uds check now warns about a hook that still runs the bare name. A new test walks everything npm pack ships and fails on any string that runs the bare uds through a package runner (npx, bunx, pnpm dlx, yarn dlx, npm exec); the non-Node native hook (uds check, resolved from PATH only, never a registry) was not affected and is unchanged.