oh-my-knowledge 0.35.0 → 0.36.0

package/README.md

@@ -101,7 +101,7 @@ RAG-specific evals: see RAGAS (separate niche, complementary to omk). Full compa
 | **Knowledge-gap detection** | severity-weighted signals quantify risk exposure instead of claiming completeness |
 | **Construct-validity isolation** | `--strict-baseline` (default ON) cuts three contamination channels so baseline doesn't silently see the skill it's being compared against |
 | **Git & remote sources** | install / eval from a local git ref or a remote git URL (`--git-url`); directory-skills run in a content-addressed **isolated copy** so `references/` assets are real measured input, not just `SKILL.md` |
-| **Evidence-gated management** | `omk install` registers a managed record; `omk eval` auto-writes evidence bound by content fingerprint, moving a skill `installed → measurable`. [spec →](docs/specs/evidence-gated-management.md) |
+| **Evidence-gated management** | `omk install` registers a managed record; `omk eval` auto-writes evidence bound by content fingerprint, moving a skill `installed → measurable`; `omk list` surfaces each managed skill's status (installed / measurable / stale). [spec →](docs/specs/evidence-gated-management.md) |
 | **Sample design science** | sample schema with `capability` / `difficulty` / `construct` / `provenance` metadata (HF Dataset Cards style); studio surfaces coverage breakdown plus `rubric_clarity_low` / `capability_thin` flags. [docs/specs/sample-design-spec.md](docs/specs/sample-design-spec.md) |
 | **Multi-judge ensemble** | `--judge-models claude:opus,openai:gpt-4o` cross-vendor scoring + agreement metrics |
 | **Blind A/B** | `--blind` hides variant names; HTML report has a reveal button |

package/README.zh.md

@@ -101,7 +101,7 @@ RAG 专项评测请看 RAGAS（独立 niche，跟 omk 互补）。完整对比
 | **知识缺口识别** | 严重度加权的信号量化风险敞口，不宣称完备性 |
 | **用例隔离 (construct validity)** | `--strict-baseline`（默认开）三堵 baseline 拿到被测 skill 的污染路径 |
 | **Git / 远端源** | install / eval 支持本地 git ref 或远端 git URL（`--git-url`）；目录-skill 在内容寻址**隔离副本**里执行，`references/` 资产是真实测量输入，不只是 `SKILL.md` |
-| **证据门控管理** | `omk install` 登记受管记录；`omk eval` 按内容指纹自动写入证据，把 skill 从 `installed` 推到 `measurable`。[规范 →](docs/zh/specs/evidence-gated-management.md) |
+| **证据门控管理** | `omk install` 登记受管记录；`omk eval` 按内容指纹自动写入证据，把 skill 从 `installed` 推到 `measurable`；`omk list` 查看各受管 skill 的状态（installed / measurable / stale）。[规范 →](docs/zh/specs/evidence-gated-management.md) |
 | **用例设计科学性** | Sample schema 加 `capability` / `difficulty` / `construct` / `provenance` 元数据字段（HF Dataset Cards 风），studio 输出 coverage 分桶 + `rubric_clarity_low` / `capability_thin` issue。[docs/zh/specs/sample-design-spec.md](docs/zh/specs/sample-design-spec.md) |
 | **多评委 ensemble** | `--judge-models claude:opus,openai:gpt-4o` 跨厂商评分 + agreement 度量 |
 | **盲测 A/B** | `--blind` 隐藏变体名称，HTML 报告有揭晓按钮 |

package/dist/assets/agent-skills/omk/SKILL.md

@@ -4,7 +4,7 @@ description: |
   oh-my-knowledge 知识载体评测工具的智能代理。评测 skill（系统提示词）质量，对比不同版本效果，自动迭代改进。
   Use when: 用户提到"评测"、"测评"、"eval"、"benchmark"、"对比 skill"、"改进 skill"、"evolve"、"生成测试用例"、"gen-samples"、"omk"。
 user-invocable: true
-argument-hint: "<doctor|eval|evolve|init|install|observe|sample|studio> [options]"
+argument-hint: "<doctor|eval|evolve|init|install|list|observe|sample|studio> [options]"
 ---
 
 # OMK — 知识载体评测
@@ -19,7 +19,7 @@ argument-hint: "<doctor|eval|evolve|init|install|observe|sample|studio> [options
 npm i oh-my-knowledge -g
 ```
 
-omk CLI 顶层命令包括：`init` / `install` / `doctor` / `eval` / `observe` / `evolve` / `sample` / `studio`。没有 `bench` / `improve` / `gen-samples` 这些旧子命令名 —— 如果你在历史 SKILL / 文档里看到了，那是 v0.30 命令树重构之前的写法。
+omk CLI 顶层命令包括：`init` / `install` / `list` / `doctor` / `eval` / `observe` / `evolve` / `sample` / `studio`。没有 `bench` / `improve` / `gen-samples` 这些旧子命令名 —— 如果你在历史 SKILL / 文档里看到了，那是 v0.30 命令树重构之前的写法。
 
 ## 第二步：理解用户意图
 

package/dist/assets/agent-skills/omk/references/commands.md

@@ -348,6 +348,42 @@ omk install git:main:skills/review
 omk install --git-url https://github.com/org/repo.git --git-ref v1.0.0 skills/review
 ```
 
+## omk list
+
+列出受管 skill 及其证据状态：生命周期（installed / measurable / stale）、最新 verdict、证据数、源。
+
+**用法:**
+
+```bash
+omk list [flags]
+```
+
+**Flags:**
+
+- `--global` `boolean`:看全局受管目录（~/.oh-my-knowledge/managed）而非项目 .omk/managed
+- `--json` `boolean`:输出 JSON（含完整可比性 marker），供脚本消费
+- `--lang` `option` (默认 `zh`):输出语言 zh|en，优先级 CLI > OMK_LANG env > zh。
+
+**示例:**
+
+> 列出当前项目的受管 skill
+
+```bash
+omk list
+```
+
+> 列出全局受管 skill
+
+```bash
+omk list --global
+```
+
+> 机器可读 JSON 输出
+
+```bash
+omk list --json
+```
+
 ## omk observe
 
 分析 sessions 目录的 skill 调用健康度（默认行为）。子命令:ingest / inbox / show。

package/dist/authoring/evolver.js

@@ -546,7 +546,7 @@ export function mergeEvolveReports(roundReports, skillName, totalCostUSD, sample
     }
     const runId = `evolve-${skillName}-${generateRunId([skillName]).split('-').slice(-2).join('-')}`;
     const report = {
-        reportKind: 'evaluation',
+        kind: 'evaluation',
         id: runId,
         meta: {
             ...firstReport.meta,

package/dist/cli/commands/doctor.js

@@ -300,7 +300,8 @@ export function pruneDoctorHistory(dir, skillName, maxKeep) {
             continue;
         try {
             const data = JSON.parse(readFileSync(join(dir, file), 'utf-8'));
-            if (data?.reportKind !== 'doctor' || !Array.isArray(data.skills) || data.skills.length !== 1)
+            const kind = data?.kind === 'doctor' ? data.kind : null;
+            if (!kind || !Array.isArray(data.skills) || data.skills.length !== 1)
                 continue;
             if (data.skills[0].skillName !== skillName)
                 continue;

package/dist/cli/commands/eval/index.js

@@ -8,6 +8,7 @@ import { parseRunConfig } from '../../lib/parse-run-config.js';
 import { makeOnProgress } from '../../lib/progress.js';
 import { computeRunTally } from '../../lib/run-tally.js';
 import { DEFAULT_BOOTSTRAP_SAMPLES } from '../../../eval-core/bootstrap.js';
+import { EVALUATION_REPORT_SCHEMA_VERSION } from '../../../eval-core/evaluation-reporting.js';
 function isDryRunReport(report) {
     return Boolean(report && typeof report === 'object' && report.dryRun === true);
 }
@@ -65,16 +66,16 @@ async function recordEvidenceSafely(report, verdict, values, lang) {
 }
 function batchItemFallbackReport(batch, item) {
     return {
-        reportKind: 'evaluation',
+        kind: 'evaluation',
         id: item.reportId,
         meta: {
             ...batch.meta,
             variants: ['baseline', item.name],
             sampleCount: item.sampleCount,
             totalCostUSD: item.totalCostUSD,
-            // item.artifactHash 来自子报告(走 aggregateReport 的整树哈),故 fallback 与之一致标 schemaVersion 3,
-            // 避免「树哈 artifactHashes + 错位 schemaVersion」的错配。
-            schemaVersion: 3,
+            // item.artifactHash 来自子报告(走 aggregateReport 的整树哈),故 fallback 与之一致标当前 eval
+            // report schemaVersion,避免「树哈 artifactHashes + 错位 schemaVersion」的错配。
+            schemaVersion: EVALUATION_REPORT_SCHEMA_VERSION,
             artifactHashes: item.artifactHash ? { [item.name]: item.artifactHash } : {},
         },
         summary: item.summary,
@@ -88,7 +89,7 @@ async function loadBatchChildReports(batch, reportsDir, lang) {
     const reports = [];
     for (const item of batch.items) {
         const loaded = await store.get(item.reportId);
-        if (loaded?.reportKind === 'evaluation') {
+        if (loaded?.kind === 'evaluation') {
             reports.push(loaded);
         }
         else {
@@ -128,7 +129,7 @@ async function emitBatchVerdict(report, reportsDir, values, lang) {
 }
 async function announceSavedReport({ report, filePath, reportsDir, values, lang, }) {
     const tally = computeRunTally(report);
-    process.stderr.write(tCli(report.reportKind === 'batch-evaluation' ? 'cli.run.batch_complete' : 'cli.run.eval_complete', lang));
+    process.stderr.write(tCli(report.kind === 'batch-evaluation' ? 'cli.run.batch_complete' : 'cli.run.eval_complete', lang));
     process.stderr.write(tCli('cli.run.tally', lang, tally));
     process.stderr.write(tCli('cli.run.report_saved', lang, { path: filePath }));
     if (!values['no-serve'] && process.stdout.isTTY) {

package/dist/cli/commands/list.d.ts

@@ -0,0 +1,46 @@
+import { BaseCommand } from '../oclif/base-command.js';
+import { type ManagedListRow, type SourceProbe } from '../../managed/index.js';
+import type { ManagedArtifactRecord } from '../../types/index.js';
+import type { CliLang } from '../lib/i18n.js';
+/**
+ * 探测一条受管记录**当前源**的状态(三态,喂 buildManagedListRow 判 drift / 生命周期)。
+ *   - 远端 git(带 url):源身份钉不可变 SHA(install 时 pin),内容恒定 → 直接取 record.contentHash,
+ *     不联网(list 是快读命令,不为 drift 检查发网络请求)。reachable。
+ *   - 本地 git:locator `git:<ref>:<spec>` 复用 resolveInstallSource 在**仓库对象库**内重物化重哈
+ *     (读取受 git 边界约束,无任意文件读 DoS)。解析不到(常因 `omk list` 的 cwd 与 install 时不同、
+ *     spec 随 cwd 漂)→ 抛错 → **reachable:false(未核,不当 stale)**,避免对未改动的 skill 误报漂移。
+ *   - 本地 file:locator 是绝对路径,但受管 JSON **用户可手改 / 随仓库分发**(无 install、无 opt-in 即被
+ *     loadAllManagedRecords 读到)。只读命令绝不盲读任意路径:**拒软链、只读常规文件 / 真目录、单文件
+ *     设 size cap**(挡 `evil.md → /dev/zero` 这类 readFileSync 无界 DoS 与项目外任意读)。守卫不过 →
+ *     reachable:false。目录-skill 整树哈本就跳软链(hashArtifactSource 用 isFile() 过滤)。
+ */
+export declare function probeSourceState(record: ManagedArtifactRecord): SourceProbe;
+/** CJK 全角字符按 2 列计宽,使含中文表头的列也能对齐。 */
+export declare function dispWidth(s: string): number;
+/** 按**显示宽度**截断(不是 code unit):逐码点累加 dispWidth,绝不切断 surrogate 对、CJK 也不溢出列。 */
+export declare function truncate(s: string, max: number): string;
+/** 洗不可信显示字符:managed JSON 可随仓库分发,name / sourceLabel / verdict 等字段塞进表格前必须先洗,
+ *  否则会破坏表格甚至伪造终端输出。一律映射到可见 U+FFFD(--json 路径保留原值给脚本)。
+ *  用 Unicode **属性类**而非手列码点 —— 手列清单天然有缺口(BiDi、U+2028 / 2029、Tags 块都曾漏一轮补一轮),
+ *  属性类一次覆盖整类、新码点自动纳入:
+ *    - `\p{Cc}` 控制符(C0 / C1 / DEL,含 ESC / 换行 / 回车 / TAB)→ 杀 ANSI / OSC 转义与终端控制;
+ *    - `\p{Cf}` 格式符(BiDi 重排 / 隔离、零宽、joiners、BOM、Tags、interlinear)→ 防 Trojan-Source 视觉伪造与零宽隐藏 / 分割;
+ *    - `\p{Zl}` / `\p{Zp}` 行 / 段分隔(U+2028 / 2029)→ LF 的 Unicode 孪生,防换行伪造表格行;
+ *    - `\p{Mn}` / `\p{Me}` 非间距 / 封闭组合附加符 → 变可见,避免零前进宽度令 dispWidth 与终端列错位
+ *      (间距组合符 `\p{Mc}` 合法占 1 列,保留);
+ *    - Hangul filler(U+115F / U+1160 / U+3164,属 Lo 不在上述任何类)→ 零宽显示诡计,补列。 */
+export declare function sanitizeCell(s: string): string;
+export declare function renderTable(rows: ManagedListRow[], lang: CliLang): string;
+export default class List extends BaseCommand {
+    static description: string;
+    static examples: {
+        description: string;
+        command: string;
+    }[];
+    static flags: {
+        lang: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/cli/commands/list.js

@@ -0,0 +1,243 @@
+import { existsSync, lstatSync, readdirSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { Flags } from '@oclif/core';
+import { LANG_FLAG, bilingual } from '../oclif/i18n.js';
+import { BaseCommand } from '../oclif/base-command.js';
+import { tCli } from '../lib/i18n.js';
+import { resolveInstallSource } from '../../inputs/source-resolver.js';
+import { buildManagedListRows, globalManagedDir, hashArtifactSource, isDistributablePath, loadAllManagedRecords, managedDir, resolveManagedDir, } from '../../managed/index.js';
+// 本地源读取成本上限。skill 是小体量 markdown(+少量 references 资产),远超这些边界的源必是手改 /
+// 投毒,拒读避免 `omk list`(只读命令,读盘上可能随仓库分发的 locator)被 /dev/zero / 超大文件 / 巨型
+// 目录递归拖垮(DoS)。
+const MAX_FILE_SOURCE_BYTES = 8 * 1024 * 1024; // 单文件-skill 上限
+const MAX_DIR_SOURCE_BYTES = 64 * 1024 * 1024; // 目录-skill 整树累计上限
+const MAX_DIR_SOURCE_FILES = 4000; // 目录-skill 文件数上限
+const MAX_DIR_SOURCE_DEPTH = 64; // 目录递归深度上限
+/**
+ * 目录-skill 源的**有边界**整树哈:先恢复 resolveFileSource 的形态校验(SKILL.md 存在、是常规文件、非
+ * 软链 —— 否则 locator 可指向任意可读目录让 list 递归读整棵树),再 stat-walk(只 stat 不读)按与
+ * hashArtifactSource 同一 `isDistributablePath` 过滤累计 文件数 / 字节 / 深度,超界即返回 null(unreachable),
+ * 把单文件 DoS 不再换成目录递归 DoS。通过后才真正 hashArtifactSource。返回 null = 拒读 / 非法 skill 目录。
+ */
+function boundedDirSkillHash(abs) {
+    const skillMd = join(abs, 'SKILL.md');
+    let md;
+    try {
+        md = lstatSync(skillMd);
+    }
+    catch {
+        return null; // 无 SKILL.md → 不是 skill 目录,拒
+    }
+    if (md.isSymbolicLink() || !md.isFile() || md.nlink !== 1)
+        return null; // SKILL.md 必须是常规、非软链、非硬链
+    let files = 0;
+    let bytes = 0;
+    const within = (dir, segs, depth) => {
+        if (depth > MAX_DIR_SOURCE_DEPTH)
+            return false;
+        let entries;
+        try {
+            entries = readdirSync(dir, { withFileTypes: true });
+        }
+        catch {
+            return false;
+        }
+        for (const e of entries) {
+            const ns = [...segs, e.name];
+            if (!isDistributablePath(ns))
+                continue; // 与 hashArtifactSource 读取范围一致
+            if (e.isDirectory()) {
+                if (!within(join(dir, e.name), ns, depth + 1))
+                    return false;
+            }
+            else if (e.isFile()) { // 软链 Dirent 既非 isFile 也非 isDirectory → 天然跳过
+                if (++files > MAX_DIR_SOURCE_FILES)
+                    return false;
+                try {
+                    const fst = lstatSync(join(dir, e.name));
+                    if (fst.nlink !== 1)
+                        return false; // 硬链(nlink>1)可在树内别名树外敏感 inode → 拒读整树
+                    bytes += fst.size;
+                }
+                catch {
+                    return false;
+                }
+                if (bytes > MAX_DIR_SOURCE_BYTES)
+                    return false;
+            }
+        }
+        return true;
+    };
+    if (!within(abs, [], 0))
+        return null;
+    return hashArtifactSource(abs, true);
+}
+/**
+ * 探测一条受管记录**当前源**的状态(三态,喂 buildManagedListRow 判 drift / 生命周期)。
+ *   - 远端 git(带 url):源身份钉不可变 SHA(install 时 pin),内容恒定 → 直接取 record.contentHash,
+ *     不联网(list 是快读命令,不为 drift 检查发网络请求)。reachable。
+ *   - 本地 git:locator `git:<ref>:<spec>` 复用 resolveInstallSource 在**仓库对象库**内重物化重哈
+ *     (读取受 git 边界约束,无任意文件读 DoS)。解析不到(常因 `omk list` 的 cwd 与 install 时不同、
+ *     spec 随 cwd 漂)→ 抛错 → **reachable:false(未核,不当 stale)**,避免对未改动的 skill 误报漂移。
+ *   - 本地 file:locator 是绝对路径,但受管 JSON **用户可手改 / 随仓库分发**(无 install、无 opt-in 即被
+ *     loadAllManagedRecords 读到)。只读命令绝不盲读任意路径:**拒软链、只读常规文件 / 真目录、单文件
+ *     设 size cap**(挡 `evil.md → /dev/zero` 这类 readFileSync 无界 DoS 与项目外任意读)。守卫不过 →
+ *     reachable:false。目录-skill 整树哈本就跳软链(hashArtifactSource 用 isFile() 过滤)。
+ */
+export function probeSourceState(record) {
+    const s = record.source;
+    if (s.sourceKind === 'git' && s.url)
+        return { reachable: true, hash: record.contentHash };
+    try {
+        if (s.sourceKind === 'git') {
+            const resolved = resolveInstallSource(s.locator);
+            try {
+                return { reachable: true, hash: hashArtifactSource(resolved.localRoot, resolved.isDirectorySkill) };
+            }
+            finally {
+                resolved.cleanup();
+            }
+        }
+        // 本地 file 源:守卫后再读。locator 必须是 install 实际写出的形态(绝对路径) —— 受管 JSON 随仓库
+        // 分发、无 opt-in 即被读到,相对 locator 不是 install 产物,拒,避免按 cwd 解析到项目外。
+        if (!isAbsolute(s.locator))
+            return { reachable: false };
+        const abs = resolve(s.locator);
+        if (!existsSync(abs))
+            return { reachable: false };
+        const st = lstatSync(abs); // lstat:不跟随软链 —— 软链直接拒(防 evil.md → /dev/zero)
+        if (st.isSymbolicLink())
+            return { reachable: false };
+        if (s.isDirectorySkill) {
+            if (!st.isDirectory())
+                return { reachable: false };
+            const hash = boundedDirSkillHash(abs); // 形态校验 + 成本边界(防任意目录递归读 / 目录 DoS)
+            return hash === null ? { reachable: false } : { reachable: true, hash };
+        }
+        // 单文件-skill:恢复 install(resolveFileSource)的形态约束 —— 必须是 `.md` 常规文件、非硬链、≤ size cap。
+        // 否则攻击者可写 locator:`/etc/passwd` / `~/.ssh/id_rsa`(非 .md 直接拒),或用 `.md` 命名的**硬链**别名
+        // 树外敏感文件绕过扩展名 / 软链守卫(lstat 分不出硬链)→ 诱 list 把任意本地文件读进进程参与 hash。install
+        // 写出的是 nlink=1 的全新副本,拒 nlink>1 不误伤合法源。非 install 形态一律 reachable:false。
+        if (!/\.md$/i.test(abs) || !st.isFile() || st.nlink !== 1 || st.size > MAX_FILE_SOURCE_BYTES)
+            return { reachable: false };
+        return { reachable: true, hash: hashArtifactSource(abs, false) };
+    }
+    catch {
+        return { reachable: false };
+    }
+}
+/** CJK 全角字符按 2 列计宽,使含中文表头的列也能对齐。 */
+export function dispWidth(s) {
+    let w = 0;
+    for (const ch of s)
+        w += /[ᄀ-ᅟ⺀-꓏가-힣豈-﫿︰-﹏＀-｠￠-￦]/.test(ch) ? 2 : 1;
+    return w;
+}
+function pad(s, width) {
+    return s + ' '.repeat(Math.max(0, width - dispWidth(s)));
+}
+/** 按**显示宽度**截断(不是 code unit):逐码点累加 dispWidth,绝不切断 surrogate 对、CJK 也不溢出列。 */
+export function truncate(s, max) {
+    if (dispWidth(s) <= max)
+        return s;
+    let w = 0;
+    let out = '';
+    for (const ch of s) {
+        const cw = dispWidth(ch);
+        if (w + cw > max - 1)
+            break; // 留 1 列给省略号
+        out += ch;
+        w += cw;
+    }
+    return `${out}…`;
+}
+/** 洗不可信显示字符:managed JSON 可随仓库分发,name / sourceLabel / verdict 等字段塞进表格前必须先洗,
+ *  否则会破坏表格甚至伪造终端输出。一律映射到可见 U+FFFD(--json 路径保留原值给脚本)。
+ *  用 Unicode **属性类**而非手列码点 —— 手列清单天然有缺口(BiDi、U+2028 / 2029、Tags 块都曾漏一轮补一轮),
+ *  属性类一次覆盖整类、新码点自动纳入:
+ *    - `\p{Cc}` 控制符(C0 / C1 / DEL,含 ESC / 换行 / 回车 / TAB)→ 杀 ANSI / OSC 转义与终端控制;
+ *    - `\p{Cf}` 格式符(BiDi 重排 / 隔离、零宽、joiners、BOM、Tags、interlinear)→ 防 Trojan-Source 视觉伪造与零宽隐藏 / 分割;
+ *    - `\p{Zl}` / `\p{Zp}` 行 / 段分隔(U+2028 / 2029)→ LF 的 Unicode 孪生,防换行伪造表格行;
+ *    - `\p{Mn}` / `\p{Me}` 非间距 / 封闭组合附加符 → 变可见,避免零前进宽度令 dispWidth 与终端列错位
+ *      (间距组合符 `\p{Mc}` 合法占 1 列,保留);
+ *    - Hangul filler(U+115F / U+1160 / U+3164,属 Lo 不在上述任何类)→ 零宽显示诡计,补列。 */
+export function sanitizeCell(s) {
+    return s.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Mn}\p{Me}ᅟᅠㅤ]/gu, '�');
+}
+export function renderTable(rows, lang) {
+    const headers = [
+        tCli('cli.list.col_name', lang),
+        tCli('cli.list.col_kind', lang),
+        tCli('cli.list.col_state', lang),
+        tCli('cli.list.col_verdict', lang),
+        tCli('cli.list.col_evidence', lang),
+        tCli('cli.list.col_source', lang),
+    ];
+    const cells = rows.map((r) => [
+        truncate(sanitizeCell(r.name), 40), // name 与 source 同为用户可控、可超长 → 同样按显示宽度截断,防撑爆表宽
+        r.kind, // ArtifactKind 枚举(validator 已收窄),无需洗
+        // 不可达 → 标「?」(drift 未核),绝不冒充 stale;reachable 且漂移才 stale ⚠️。
+        !r.reachable ? `${r.state} ?` : r.state === 'stale' ? 'stale ⚠️' : r.state,
+        r.latestVerdict ? sanitizeCell(r.latestVerdict) : '—',
+        `${r.currentEvidenceCount}/${r.totalEvidenceCount}`,
+        truncate(sanitizeCell(r.sourceLabel), 48),
+    ]);
+    const widths = headers.map((h, i) => Math.max(dispWidth(h), ...cells.map((c) => dispWidth(c[i]))));
+    const line = (c) => c.map((v, i) => pad(v, widths[i])).join('  ').trimEnd();
+    return [line(headers), ...cells.map(line)].join('\n');
+}
+export default class List extends BaseCommand {
+    static description = bilingual({
+        zh: '列出受管 skill 及其证据状态：生命周期（installed / measurable / stale）、最新 verdict、证据数、源。',
+        en: 'List managed skills with evidence status: lifecycle (installed / measurable / stale), latest verdict, evidence count, source.',
+    });
+    static examples = [
+        { description: bilingual({ zh: '列出当前项目的受管 skill', en: 'List managed skills in the current project' }), command: '<%= config.bin %> list' },
+        { description: bilingual({ zh: '列出全局受管 skill', en: 'List globally managed skills' }), command: '<%= config.bin %> list --global' },
+        { description: bilingual({ zh: '机器可读 JSON 输出', en: 'Machine-readable JSON output' }), command: '<%= config.bin %> list --json' },
+    ];
+    static flags = {
+        lang: LANG_FLAG,
+        global: Flags.boolean({
+            description: bilingual({ zh: '看全局受管目录（~/.oh-my-knowledge/managed）而非项目 .omk/managed', en: 'Show the global managed dir (~/.oh-my-knowledge/managed) instead of project .omk/managed' }),
+        }),
+        json: Flags.boolean({
+            description: bilingual({ zh: '输出 JSON（含完整可比性 marker），供脚本消费', en: 'Output JSON (with full comparability markers) for scripts' }),
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(List);
+        const lang = this.lang;
+        await this.runWithCliExit(async () => {
+            const dir = flags.global ? globalManagedDir() : resolveManagedDir(managedDir());
+            const records = loadAllManagedRecords(dir);
+            const rows = buildManagedListRows(records, probeSourceState);
+            if (flags.json) {
+                // 版本化信封 —— 与 eval / doctor / diagnosis 等机读出口一致(都带 schemaVersion),让未来字段增删 /
+                // 改名是可检测的版本 bump,而非脚本静默 break。rows 的逐行形态见 ManagedListRow。
+                this.log(JSON.stringify({ schemaVersion: 1, rows }, null, 2));
+                return;
+            }
+            if (rows.length === 0) {
+                process.stderr.write(tCli('cli.list.empty', lang));
+                process.stderr.write(tCli('cli.list.empty_hint', lang));
+                return;
+            }
+            const scope = dir === globalManagedDir()
+                ? (lang === 'zh' ? '全局' : 'global')
+                : (lang === 'zh' ? '项目' : 'project');
+            process.stderr.write(tCli('cli.list.header', lang, { scope, count: rows.length }));
+            this.log(renderTable(rows, lang));
+            // 注脚块前留一行空白(无论先触发哪条 note);空行挂在块上而非 drift 分支,避免只 unreachable 时丢分隔。
+            const hasDrift = rows.some((r) => r.drifted);
+            const hasUnreachable = rows.some((r) => !r.reachable);
+            if (hasDrift || hasUnreachable)
+                process.stderr.write('\n');
+            if (hasDrift)
+                process.stderr.write(tCli('cli.list.drift_note', lang));
+            if (hasUnreachable)
+                process.stderr.write(tCli('cli.list.unreachable_note', lang));
+            process.stderr.write(tCli('cli.list.legend', lang));
+        });
+    }
+}

package/dist/cli/lib/i18n-dict/list.d.ts

@@ -0,0 +1,3 @@
+import type { CliMessage } from './types.js';
+export type ListMessageKey = 'cli.list.header' | 'cli.list.empty' | 'cli.list.empty_hint' | 'cli.list.col_name' | 'cli.list.col_kind' | 'cli.list.col_state' | 'cli.list.col_verdict' | 'cli.list.col_evidence' | 'cli.list.col_source' | 'cli.list.drift_note' | 'cli.list.unreachable_note' | 'cli.list.legend';
+export declare const listDict: Record<ListMessageKey, CliMessage>;

package/dist/cli/lib/i18n-dict/list.js

@@ -0,0 +1,32 @@
+export const listDict = {
+    'cli.list.header': {
+        zh: '受管 skill（{scope}，{count} 条）\n',
+        en: 'Managed skills ({scope}, {count})\n',
+    },
+    'cli.list.empty': {
+        zh: '没有受管记录。\n',
+        en: 'No managed records.\n',
+    },
+    'cli.list.empty_hint': {
+        zh: '用 omk install <skill> 登记并分发一个 skill 后，它会出现在这里。\n',
+        en: 'Run omk install <skill> to register and distribute a skill; it will show up here.\n',
+    },
+    'cli.list.col_name': { zh: '名称', en: 'NAME' },
+    'cli.list.col_kind': { zh: '类型', en: 'KIND' },
+    'cli.list.col_state': { zh: '状态', en: 'STATE' },
+    'cli.list.col_verdict': { zh: 'VERDICT', en: 'VERDICT' },
+    'cli.list.col_evidence': { zh: '证据', en: 'EVIDENCE' },
+    'cli.list.col_source': { zh: '源', en: 'SOURCE' },
+    'cli.list.drift_note': {
+        zh: '⚠️ = 源内容已漂移、脱离证据（stale）；重跑 omk eval 重新取证。\n',
+        en: '⚠️ = source content drifted off its evidence (stale); re-run omk eval to re-measure.\n',
+    },
+    'cli.list.unreachable_note': {
+        zh: '? = 源此处不可达 / 拒读，drift 未核（非 stale）；本地 git 源请在原仓库根目录跑 omk list。\n',
+        en: '? = source unreachable / refused here, drift unchecked (not stale); for a local git source run omk list from the original repo root.\n',
+    },
+    'cli.list.legend': {
+        zh: '证据列 = 当前有效 / 全部（历史含旧内容证据，供回滚）。\n',
+        en: 'EVIDENCE column = current / total (history keeps old-content evidence for rollback).\n',
+    },
+};

package/dist/cli/lib/i18n-dict.d.ts

@@ -56,8 +56,9 @@ import { type GenMessageKey } from './i18n-dict/gen.js';
 import { type HelpMessageKey } from './i18n-dict/help.js';
 import { type InitMessageKey } from './i18n-dict/init.js';
 import { type InstallMessageKey } from './i18n-dict/install.js';
+import { type ListMessageKey } from './i18n-dict/list.js';
 import { type RunMessageKey } from './i18n-dict/run.js';
 import type { CliMessage } from './i18n-dict/types.js';
 export type { CliMessage } from './i18n-dict/types.js';
-export type CliMessageKey = CommonMessageKey | EvolveMessageKey | GenMessageKey | HelpMessageKey | InitMessageKey | InstallMessageKey | RunMessageKey;
+export type CliMessageKey = CommonMessageKey | EvolveMessageKey | GenMessageKey | HelpMessageKey | InitMessageKey | InstallMessageKey | ListMessageKey | RunMessageKey;
 export declare const CLI_DICT: Record<CliMessageKey, CliMessage>;

package/dist/cli/lib/i18n-dict.js

@@ -56,6 +56,7 @@ import { genDict } from './i18n-dict/gen.js';
 import { helpDict } from './i18n-dict/help.js';
 import { initDict } from './i18n-dict/init.js';
 import { installDict } from './i18n-dict/install.js';
+import { listDict } from './i18n-dict/list.js';
 import { runDict } from './i18n-dict/run.js';
 export const CLI_DICT = {
     ...commonDict,
@@ -64,5 +65,6 @@ export const CLI_DICT = {
     ...helpDict,
     ...initDict,
     ...installDict,
+    ...listDict,
     ...runDict,
 };

package/dist/cli/lib/run-tally.js

@@ -19,7 +19,7 @@ export function computeRunTally(report) {
             failed += s.errorCount;
         }
     };
-    if (report.reportKind === 'batch-evaluation') {
+    if (report.kind === 'batch-evaluation') {
         for (const item of report.items)
             accumulate(item.summary);
     }

package/dist/cli/lib/shared.js

@@ -5,7 +5,7 @@ export function requireEvaluationReport(report, id, lang) {
         console.error(tCli('cli.common.report_not_found', lang, { id }));
         throw new CliExit(1);
     }
-    if (report.reportKind === 'batch-evaluation') {
+    if (report.kind === 'batch-evaluation') {
         console.error(lang === 'zh'
             ? `报告 ${id} 是 BatchEvaluationReport。该命令需要单次 EvaluationReport；请使用其中的 child reportId。`
             : `Report ${id} is a BatchEvaluationReport. This command requires an EvaluationReport; use a child reportId from the batch.`);

package/dist/doctor/index.js

@@ -229,7 +229,7 @@ export async function runDoctor(opts) {
             ? 'warnings_only'
             : 'passed';
     return {
-        reportKind: 'doctor',
+        kind: 'doctor',
         schemaVersion: DOCTOR_REPORT_SCHEMA_VERSION,
         id: nextReportId(),
         timestamp: new Date().toISOString(),

package/dist/eval-core/evaluation-reporting.d.ts

@@ -1,5 +1,6 @@
 import type { Artifact, Report, Sample, Task, VariantResult, GitInfo, EvaluationJob, EvaluationRequest, EvaluationRun } from '../types/index.js';
 export declare const DEFAULT_OUTPUT_DIR: string;
+export declare const EVALUATION_REPORT_SCHEMA_VERSION = 4;
 export declare function hashString(str: string): string;
 /**
  * Stable content hash of a sample. Hashes the prompt + assertions + dimensions/rubric

package/dist/eval-core/evaluation-reporting.js

@@ -22,6 +22,7 @@ function findPackageJson(startDir) {
 }
 const PKG = JSON.parse(readFileSync(findPackageJson(__dirname), 'utf-8'));
 export const DEFAULT_OUTPUT_DIR = join(homedir(), '.oh-my-knowledge', 'reports');
+export const EVALUATION_REPORT_SCHEMA_VERSION = 4;
 export function hashString(str) {
     return createHash('sha256').update(str).digest('hex').slice(0, 12);
 }
@@ -182,7 +183,7 @@ export function aggregateReport({ runId, variants, model, judgeModel, noJudge, e
         debiasModeList.push('length');
     const totalCostReported = Object.values(summary).every((variant) => variant.execCostReported !== false && variant.judgeCostReported !== false);
     return {
-        reportKind: 'evaluation',
+        kind: 'evaluation',
         id: runId,
         meta: {
             variants,
@@ -197,9 +198,10 @@ export function aggregateReport({ runId, variants, model, judgeModel, noJudge, e
             cliVersion: getCliVersion(),
             nodeVersion: process.version,
             // schemaVersion 3 起,所有 dir-skill(本地 + git)都经隔离副本物化、整棵可分发树哈,与 install
-            // 受管记录 contentHash 同空间(evidence 全绑)。2 是过渡纪元(本地 dir-skill 树哈、git dir-skill
-            // 仅 SKILL.md 字节、不绑);git dir-skill 的 v2 与 v3 不可比。作判别位:消费方对缺位/旧报告不错配比对。
-            schemaVersion: 3,
+            // 受管记录 contentHash 同空间(evidence 全绑)。4 延续 v3 的哈/绑定义,并作为当前 canonical
+            // 顶层判别字段纪元,方便外部消费方按版本识别 JSON 形状。2 是过渡纪元(本地 dir-skill 树哈、
+            // git dir-skill 仅 SKILL.md 字节、不绑);git dir-skill 的 v2 与 v3+ 不可比。
+            schemaVersion: EVALUATION_REPORT_SCHEMA_VERSION,
             artifactHashes,
             sampleHashes,
             ...(noJudge ? {} : { judgePromptHash: getJudgePromptHash(lengthDebiasOn) }),

package/dist/eval-workflows/batch-evaluation-workflow.js

@@ -1,5 +1,5 @@
 import { dirname } from 'node:path';
-import { DEFAULT_OUTPUT_DIR, generateRunId, getCliVersion, getGitInfo, persistReport } from '../eval-core/evaluation-reporting.js';
+import { DEFAULT_OUTPUT_DIR, EVALUATION_REPORT_SCHEMA_VERSION, generateRunId, getCliVersion, getGitInfo, persistReport, } from '../eval-core/evaluation-reporting.js';
 import { buildEvaluationRequest, createEvaluationRun, createSucceededJob, finalizeEvaluationRun } from '../eval-core/evaluation-job.js';
 import { getExecutorRuntimeFingerprint } from '../executors/runtime-fingerprint.js';
 import { createFileJobStore, DEFAULT_JOBS_DIR } from '../server/job-store.js';
@@ -135,11 +135,12 @@ export function buildBatchEvaluationReport({ batchRunId, skillDir, skillEntries,
         ...(noJudge ? {} : { runtime: getExecutorRuntimeFingerprint(jc.executor, jc.model, { skillDir }) }),
     }));
     const report = {
-        reportKind: 'batch-evaluation',
+        kind: 'batch-evaluation',
         id: batchRunId,
         mode: 'skill',
         meta: {
             mode: 'skill',
+            schemaVersion: EVALUATION_REPORT_SCHEMA_VERSION,
             model,
             executor: executorName,
             skillDir,

package/dist/eval-workflows/run-evaluation.js

@@ -97,7 +97,7 @@ export async function runEvaluation({ samplesPath, skillDir, variantSpecs = [],
         const { createFileStore } = await import('../server/report-store.js');
         const store = createFileStore(resolve(outputDir || DEFAULT_OUTPUT_DIR));
         const existing = await store.get(resume);
-        if (existing?.reportKind === 'evaluation') {
+        if (existing?.kind === 'evaluation') {
             existingResults = {};
             for (const entry of existing.results || []) {
                 existingResults[entry.sample_id] = entry.variants;
@@ -121,7 +121,7 @@ export async function runEvaluation({ samplesPath, skillDir, variantSpecs = [],
                     + `   新 entries 不隔离 → 与现有 entries 不可比。建议恢复默认 strict-baseline。\n`);
             }
         }
-        else if (existing?.reportKind === 'batch-evaluation') {
+        else if (existing?.kind === 'batch-evaluation') {
             process.stderr.write(`\n⚠️  report ${resume} is a BatchEvaluationReport; resume needs a child EvaluationReport, starting from scratch\n`);
         }
         else {