oh-my-knowledge 0.36.0 → 0.37.0

package/dist/cli/commands/list.js

@@ -1,131 +1,13 @@
-import { existsSync, lstatSync, readdirSync } from 'node:fs';
-import { isAbsolute, join, resolve } from 'node:path';
 import { Flags } from '@oclif/core';
 import { LANG_FLAG, bilingual } from '../oclif/i18n.js';
 import { BaseCommand } from '../oclif/base-command.js';
 import { tCli } from '../lib/i18n.js';
-import { resolveInstallSource } from '../../inputs/source-resolver.js';
-import { buildManagedListRows, globalManagedDir, hashArtifactSource, isDistributablePath, loadAllManagedRecords, managedDir, resolveManagedDir, } from '../../managed/index.js';
-// 本地源读取成本上限。skill 是小体量 markdown(+少量 references 资产),远超这些边界的源必是手改 /
-// 投毒,拒读避免 `omk list`(只读命令,读盘上可能随仓库分发的 locator)被 /dev/zero / 超大文件 / 巨型
-// 目录递归拖垮(DoS)。
-const MAX_FILE_SOURCE_BYTES = 8 * 1024 * 1024; // 单文件-skill 上限
-const MAX_DIR_SOURCE_BYTES = 64 * 1024 * 1024; // 目录-skill 整树累计上限
-const MAX_DIR_SOURCE_FILES = 4000; // 目录-skill 文件数上限
-const MAX_DIR_SOURCE_DEPTH = 64; // 目录递归深度上限
-/**
- * 目录-skill 源的**有边界**整树哈:先恢复 resolveFileSource 的形态校验(SKILL.md 存在、是常规文件、非
- * 软链 —— 否则 locator 可指向任意可读目录让 list 递归读整棵树),再 stat-walk(只 stat 不读)按与
- * hashArtifactSource 同一 `isDistributablePath` 过滤累计 文件数 / 字节 / 深度,超界即返回 null(unreachable),
- * 把单文件 DoS 不再换成目录递归 DoS。通过后才真正 hashArtifactSource。返回 null = 拒读 / 非法 skill 目录。
- */
-function boundedDirSkillHash(abs) {
-    const skillMd = join(abs, 'SKILL.md');
-    let md;
-    try {
-        md = lstatSync(skillMd);
-    }
-    catch {
-        return null; // 无 SKILL.md → 不是 skill 目录,拒
-    }
-    if (md.isSymbolicLink() || !md.isFile() || md.nlink !== 1)
-        return null; // SKILL.md 必须是常规、非软链、非硬链
-    let files = 0;
-    let bytes = 0;
-    const within = (dir, segs, depth) => {
-        if (depth > MAX_DIR_SOURCE_DEPTH)
-            return false;
-        let entries;
-        try {
-            entries = readdirSync(dir, { withFileTypes: true });
-        }
-        catch {
-            return false;
-        }
-        for (const e of entries) {
-            const ns = [...segs, e.name];
-            if (!isDistributablePath(ns))
-                continue; // 与 hashArtifactSource 读取范围一致
-            if (e.isDirectory()) {
-                if (!within(join(dir, e.name), ns, depth + 1))
-                    return false;
-            }
-            else if (e.isFile()) { // 软链 Dirent 既非 isFile 也非 isDirectory → 天然跳过
-                if (++files > MAX_DIR_SOURCE_FILES)
-                    return false;
-                try {
-                    const fst = lstatSync(join(dir, e.name));
-                    if (fst.nlink !== 1)
-                        return false; // 硬链(nlink>1)可在树内别名树外敏感 inode → 拒读整树
-                    bytes += fst.size;
-                }
-                catch {
-                    return false;
-                }
-                if (bytes > MAX_DIR_SOURCE_BYTES)
-                    return false;
-            }
-        }
-        return true;
-    };
-    if (!within(abs, [], 0))
-        return null;
-    return hashArtifactSource(abs, true);
-}
-/**
- * 探测一条受管记录**当前源**的状态(三态,喂 buildManagedListRow 判 drift / 生命周期)。
- *   - 远端 git(带 url):源身份钉不可变 SHA(install 时 pin),内容恒定 → 直接取 record.contentHash,
- *     不联网(list 是快读命令,不为 drift 检查发网络请求)。reachable。
- *   - 本地 git:locator `git:<ref>:<spec>` 复用 resolveInstallSource 在**仓库对象库**内重物化重哈
- *     (读取受 git 边界约束,无任意文件读 DoS)。解析不到(常因 `omk list` 的 cwd 与 install 时不同、
- *     spec 随 cwd 漂)→ 抛错 → **reachable:false(未核,不当 stale)**,避免对未改动的 skill 误报漂移。
- *   - 本地 file:locator 是绝对路径,但受管 JSON **用户可手改 / 随仓库分发**(无 install、无 opt-in 即被
- *     loadAllManagedRecords 读到)。只读命令绝不盲读任意路径:**拒软链、只读常规文件 / 真目录、单文件
- *     设 size cap**(挡 `evil.md → /dev/zero` 这类 readFileSync 无界 DoS 与项目外任意读)。守卫不过 →
- *     reachable:false。目录-skill 整树哈本就跳软链(hashArtifactSource 用 isFile() 过滤)。
- */
-export function probeSourceState(record) {
-    const s = record.source;
-    if (s.sourceKind === 'git' && s.url)
-        return { reachable: true, hash: record.contentHash };
-    try {
-        if (s.sourceKind === 'git') {
-            const resolved = resolveInstallSource(s.locator);
-            try {
-                return { reachable: true, hash: hashArtifactSource(resolved.localRoot, resolved.isDirectorySkill) };
-            }
-            finally {
-                resolved.cleanup();
-            }
-        }
-        // 本地 file 源:守卫后再读。locator 必须是 install 实际写出的形态(绝对路径) —— 受管 JSON 随仓库
-        // 分发、无 opt-in 即被读到,相对 locator 不是 install 产物,拒,避免按 cwd 解析到项目外。
-        if (!isAbsolute(s.locator))
-            return { reachable: false };
-        const abs = resolve(s.locator);
-        if (!existsSync(abs))
-            return { reachable: false };
-        const st = lstatSync(abs); // lstat:不跟随软链 —— 软链直接拒(防 evil.md → /dev/zero)
-        if (st.isSymbolicLink())
-            return { reachable: false };
-        if (s.isDirectorySkill) {
-            if (!st.isDirectory())
-                return { reachable: false };
-            const hash = boundedDirSkillHash(abs); // 形态校验 + 成本边界(防任意目录递归读 / 目录 DoS)
-            return hash === null ? { reachable: false } : { reachable: true, hash };
-        }
-        // 单文件-skill:恢复 install(resolveFileSource)的形态约束 —— 必须是 `.md` 常规文件、非硬链、≤ size cap。
-        // 否则攻击者可写 locator:`/etc/passwd` / `~/.ssh/id_rsa`(非 .md 直接拒),或用 `.md` 命名的**硬链**别名
-        // 树外敏感文件绕过扩展名 / 软链守卫(lstat 分不出硬链)→ 诱 list 把任意本地文件读进进程参与 hash。install
-        // 写出的是 nlink=1 的全新副本,拒 nlink>1 不误伤合法源。非 install 形态一律 reachable:false。
-        if (!/\.md$/i.test(abs) || !st.isFile() || st.nlink !== 1 || st.size > MAX_FILE_SOURCE_BYTES)
-            return { reachable: false };
-        return { reachable: true, hash: hashArtifactSource(abs, false) };
-    }
-    catch {
-        return { reachable: false };
-    }
-}
+import { probeSourceState } from '../lib/source-probe.js';
+import { sanitizeCell } from '../lib/cell-format.js';
+import { buildManagedListRows, globalManagedDir, loadAllManagedRecords, managedDir, resolveManagedDir, } from '../../managed/index.js';
+// 源探测(含 DoS / 软硬链 / 投毒守卫)已抽到 ../lib/source-probe.js,promote 复用同一套守卫与 drift 判定。
+// 此处 re-export 保持既有 import 入口不破(test/cli/list-probe.test.ts 仍从本文件取 probeSourceState)。
+export { probeSourceState };
 /** CJK 全角字符按 2 列计宽,使含中文表头的列也能对齐。 */
 export function dispWidth(s) {
     let w = 0;
@@ -151,19 +33,9 @@ export function truncate(s, max) {
     }
     return `${out}…`;
 }
-/** 洗不可信显示字符:managed JSON 可随仓库分发,name / sourceLabel / verdict 等字段塞进表格前必须先洗,
- *  否则会破坏表格甚至伪造终端输出。一律映射到可见 U+FFFD(--json 路径保留原值给脚本)。
- *  用 Unicode **属性类**而非手列码点 —— 手列清单天然有缺口(BiDi、U+2028 / 2029、Tags 块都曾漏一轮补一轮),
- *  属性类一次覆盖整类、新码点自动纳入:
- *    - `\p{Cc}` 控制符(C0 / C1 / DEL,含 ESC / 换行 / 回车 / TAB)→ 杀 ANSI / OSC 转义与终端控制;
- *    - `\p{Cf}` 格式符(BiDi 重排 / 隔离、零宽、joiners、BOM、Tags、interlinear)→ 防 Trojan-Source 视觉伪造与零宽隐藏 / 分割;
- *    - `\p{Zl}` / `\p{Zp}` 行 / 段分隔(U+2028 / 2029)→ LF 的 Unicode 孪生,防换行伪造表格行;
- *    - `\p{Mn}` / `\p{Me}` 非间距 / 封闭组合附加符 → 变可见,避免零前进宽度令 dispWidth 与终端列错位
- *      (间距组合符 `\p{Mc}` 合法占 1 列,保留);
- *    - Hangul filler(U+115F / U+1160 / U+3164,属 Lo 不在上述任何类)→ 零宽显示诡计,补列。 */
-export function sanitizeCell(s) {
-    return s.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Mn}\p{Me}ᅟᅠㅤ]/gu, '�');
-}
+// sanitizeCell 已下沉到 ../lib/cell-format.js(promote 文本输出复用同一套不可信字符洗白)。
+// 此处 re-export 保持既有 import 入口不破(test/cli/list-probe.test.ts 仍从本文件取 sanitizeCell)。
+export { sanitizeCell };
 export function renderTable(rows, lang) {
     const headers = [
         tCli('cli.list.col_name', lang),
@@ -176,8 +48,8 @@ export function renderTable(rows, lang) {
     const cells = rows.map((r) => [
         truncate(sanitizeCell(r.name), 40), // name 与 source 同为用户可控、可超长 → 同样按显示宽度截断,防撑爆表宽
         r.kind, // ArtifactKind 枚举(validator 已收窄),无需洗
-        // 不可达 → 标「?」(drift 未核),绝不冒充 stale;reachable 且漂移才 stale ⚠️。
-        !r.reachable ? `${r.state} ?` : r.state === 'stale' ? 'stale ⚠️' : r.state,
+        // 不可达 → 标「?」(drift 未核),绝不冒充 stale;reachable 且漂移才 stale ⚠️;已人工接受标 promoted ✓。
+        !r.reachable ? `${r.state} ?` : r.state === 'stale' ? 'stale ⚠️' : r.state === 'promoted' ? 'promoted ✓' : r.state,
         r.latestVerdict ? sanitizeCell(r.latestVerdict) : '—',
         `${r.currentEvidenceCount}/${r.totalEvidenceCount}`,
         truncate(sanitizeCell(r.sourceLabel), 48),
@@ -188,8 +60,8 @@ export function renderTable(rows, lang) {
 }
 export default class List extends BaseCommand {
     static description = bilingual({
-        zh: '列出受管 skill 及其证据状态：生命周期（installed / measurable / stale）、最新 verdict、证据数、源。',
-        en: 'List managed skills with evidence status: lifecycle (installed / measurable / stale), latest verdict, evidence count, source.',
+        zh: '列出受管 skill 及其证据状态：生命周期（installed / measurable / promoted / stale）、最新 verdict、证据数、源。',
+        en: 'List managed skills with evidence status: lifecycle (installed / measurable / promoted / stale), latest verdict, evidence count, source.',
     });
     static examples = [
         { description: bilingual({ zh: '列出当前项目的受管 skill', en: 'List managed skills in the current project' }), command: '<%= config.bin %> list' },
@@ -231,8 +103,11 @@ export default class List extends BaseCommand {
             // 注脚块前留一行空白(无论先触发哪条 note);空行挂在块上而非 drift 分支,避免只 unreachable 时丢分隔。
             const hasDrift = rows.some((r) => r.drifted);
             const hasUnreachable = rows.some((r) => !r.reachable);
-            if (hasDrift || hasUnreachable)
+            const hasPromoted = rows.some((r) => r.state === 'promoted');
+            if (hasDrift || hasUnreachable || hasPromoted)
                 process.stderr.write('\n');
+            if (hasPromoted)
+                process.stderr.write(tCli('cli.list.promoted_note', lang));
             if (hasDrift)
                 process.stderr.write(tCli('cli.list.drift_note', lang));
             if (hasUnreachable)

package/dist/cli/commands/promote.d.ts

@@ -0,0 +1,24 @@
+import { BaseCommand } from '../oclif/base-command.js';
+export default class Promote extends BaseCommand {
+    static description: string;
+    static examples: {
+        description: string;
+        command: string;
+    }[];
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        lang: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        kind: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        'accept-cautious': import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        force: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        reason: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        actor: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+    private emitBlocked;
+    private emitPromoted;
+}

package/dist/cli/commands/promote.js

@@ -0,0 +1,158 @@
+import { execFileSync } from 'node:child_process';
+import { Args, Flags } from '@oclif/core';
+import { LANG_FLAG, bilingual } from '../oclif/i18n.js';
+import { BaseCommand } from '../oclif/base-command.js';
+import { tCli } from '../lib/i18n.js';
+import { CliExit } from '../lib/cli-exit.js';
+import { probeSourceState } from '../lib/source-probe.js';
+import { sanitizeCell } from '../lib/cell-format.js';
+import { getJudgePromptHash } from '../../grading/judge.js';
+import { appendManagedDecision, evaluatePromoteGate, globalManagedDir, isCurrentlyPromoted, loadManagedRecord, managedDir, managedRecordId, resolveManagedDir, } from '../../managed/index.js';
+const SUPPORTED_KINDS = ['skill'];
+/** 决定的 actor:--actor > git config user.name > $USER / $LOGNAME > unknown。git 参数无用户输入,安全。 */
+function resolveActor(flagActor) {
+    if (flagActor && flagActor.trim())
+        return flagActor.trim();
+    try {
+        const name = execFileSync('git', ['config', 'user.name'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (name)
+            return name;
+    }
+    catch { /* git 缺失 / 无配置 → 回退环境 */ }
+    return process.env.USER || process.env.LOGNAME || 'unknown';
+}
+/** 洗 detail 里来自受管 JSON 的不可信值(verdict / judgePromptHash),文本输出防 ANSI/OSC 注入。 */
+function safeDetail(detail) {
+    if (!detail)
+        return undefined;
+    return Object.fromEntries(Object.entries(detail).map(([k, v]) => [k, sanitizeCell(v)]));
+}
+/** blockKind → i18n key(细节 detail 作为 tCli params,文本路径经 safeDetail 洗白)。 */
+const BLOCK_KEY = {
+    drifted: 'cli.promote.drifted',
+    no_current_evidence: 'cli.promote.no_current_evidence',
+    incomparable: 'cli.promote.incomparable',
+    verdict_blocked: 'cli.promote.verdict_blocked',
+};
+export default class Promote extends BaseCommand {
+    static description = bilingual({
+        zh: '把受管 skill 的当前版本按证据门禁「接受」为 promoted：默认仅放行 verdict=PROGRESS,在记录里追加一条带证据指针的人工决定。',
+        en: 'Accept a managed skill\'s current version as promoted, gated on evidence: by default only verdict=PROGRESS passes; appends a human decision with an evidence pointer to the record.',
+    });
+    static examples = [
+        { description: bilingual({ zh: 'promote 一个证据达标的 skill', en: 'Promote a skill whose evidence passes the gate' }), command: '<%= config.bin %> promote review' },
+        { description: bilingual({ zh: '接受 CAUTIOUS 结果（显式放宽门禁）', en: 'Accept a CAUTIOUS result (explicitly loosen the gate)' }), command: '<%= config.bin %> promote review --accept-cautious' },
+        { description: bilingual({ zh: '越门 promote 并记录理由（人工 override）', en: 'Override the gate and record a reason (human override)' }), command: '<%= config.bin %> promote review --force --reason "已人工复核"' },
+    ];
+    static args = {
+        name: Args.string({ description: bilingual({ zh: '受管 skill 名（omk list 里的 NAME）', en: 'Managed skill name (the NAME shown by omk list)' }), required: true }),
+    };
+    static flags = {
+        lang: LANG_FLAG,
+        kind: Flags.string({ description: bilingual({ zh: 'artifact 类型（当前仅 skill）', en: 'artifact kind (only skill today)' }), default: 'skill' }),
+        'accept-cautious': Flags.boolean({ description: bilingual({ zh: '把 CAUTIOUS 也算可接受（默认仅 PROGRESS）', en: 'also accept CAUTIOUS (default PROGRESS only)' }) }),
+        force: Flags.boolean({ description: bilingual({ zh: '越过可越门拦截强制 promote，记为人工 override 决定（无当前证据或源 hash 已变时仍拒）', en: 'override forceable gate blocks and force-promote, recorded as a human override (still refused with no current evidence or changed source hash)' }) }),
+        reason: Flags.string({ description: bilingual({ zh: 'promote / 越门的理由（写入决定）', en: 'reason for the promotion / override (stored on the decision)' }) }),
+        actor: Flags.string({ description: bilingual({ zh: '决定的 actor（默认取 git config user.name）', en: 'decision actor (defaults to git config user.name)' }) }),
+        global: Flags.boolean({ description: bilingual({ zh: '操作全局受管目录而非项目 .omk/managed', en: 'operate on the global managed dir instead of project .omk/managed' }) }),
+        json: Flags.boolean({ description: bilingual({ zh: '输出 JSON（版本化信封）供脚本消费', en: 'output JSON (versioned envelope) for scripts' }) }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(Promote);
+        const lang = this.lang;
+        await this.runWithCliExit(async () => {
+            const name = args.name;
+            const kind = flags.kind;
+            if (!SUPPORTED_KINDS.includes(kind)) {
+                process.stderr.write(tCli('cli.promote.kind_unsupported', lang, { kind: sanitizeCell(String(kind)) }) + '\n');
+                throw new CliExit(1);
+            }
+            const dir = flags.global ? globalManagedDir() : resolveManagedDir(managedDir());
+            const record = loadManagedRecord(dir, managedRecordId(kind, name));
+            if (!record) {
+                process.stderr.write(tCli('cli.promote.not_managed', lang, { name: sanitizeCell(name), kind }) + '\n');
+                throw new CliExit(1);
+            }
+            const probe = probeSourceState(record);
+            const currentContentHash = probe.reachable ? probe.hash : undefined;
+            const sourceHashMismatch = probe.reachable && currentContentHash !== record.contentHash;
+            // 幂等：当前内容已 promote 过 → 无操作成功退出，不堆冗余事件。与 list 的不可达分支同口径：
+            // 源不可达不代表内容已变；只有源可达且 hash 已变时，才不把旧 promote 当作当前 no-op。
+            const alreadyPromoted = !sourceHashMismatch && isCurrentlyPromoted(record);
+            if (alreadyPromoted) {
+                if (flags.json)
+                    this.log(JSON.stringify({ schemaVersion: 1, alreadyPromoted: { name, contentHash: record.contentHash } }, null, 2));
+                else
+                    process.stderr.write(tCli('cli.promote.already_promoted', lang, { name: sanitizeCell(name) }) + '\n');
+                return;
+            }
+            const currentJudgeHashes = new Set([getJudgePromptHash(true), getJudgePromptHash(false)]);
+            const gate = evaluatePromoteGate({ record, currentContentHash, acceptCautious: flags['accept-cautious'], currentJudgeHashes });
+            // 拦截：无当前证据 force 也越不过；源可达但 hash 已变也不可越门，因为 decision 仍锚在
+            // record.contentHash，越过去后 list 仍会按当前源 hash 判 stale。源不可达则可作为人工未核越门。
+            const forceable = gate.evidence !== undefined && !sourceHashMismatch;
+            const reason = flags.reason?.trim();
+            if (!gate.ok && flags.force && forceable && !reason) {
+                if (flags.json)
+                    this.log(JSON.stringify({ schemaVersion: 1, blocked: { name, reasons: [{ blockKind: 'force_reason_required' }] } }, null, 2));
+                else
+                    process.stderr.write(tCli('cli.promote.force_reason_required', lang) + '\n');
+                throw new CliExit(1);
+            }
+            if (!gate.ok && !(flags.force && forceable)) {
+                this.emitBlocked(name, gate, lang, flags.json, forceable);
+                throw new CliExit(1);
+            }
+            // 通过 或 force 越门:写决定。
+            const overridden = !gate.ok; // 走到这里且未提前 return,说明是 force 越门
+            const evidence = gate.evidence; // forceable 已保证非空(无证据分支在上面已拦)
+            const decision = {
+                decisionKind: 'promote',
+                actor: resolveActor(flags.actor),
+                decidedAt: new Date().toISOString(),
+                contentHash: record.contentHash,
+                ...(evidence.reportId ? { reportId: evidence.reportId } : {}),
+                ...(reason ? { reason } : {}),
+                ...(overridden ? { override: { verdict: evidence.verdict ?? 'UNKNOWN', overriddenBlocks: gate.blocked.map((b) => b.blockKind) } } : {}),
+            };
+            appendManagedDecision(dir, record.id, decision);
+            // 非拦截级提醒(如 judgePromptHash 缺失)始终提示。当前 warnings 仅 incomparable_unverified 一类。
+            if (gate.warnings.length > 0)
+                process.stderr.write(tCli('cli.promote.incomparable_unverified', lang) + '\n');
+            this.emitPromoted(name, record, evidence.verdict, evidence.reportId, overridden, lang, flags.json);
+        });
+    }
+    emitBlocked(name, gate, lang, json, forceable) {
+        if (json) {
+            this.log(JSON.stringify({ schemaVersion: 1, blocked: { name, reasons: gate.blocked.map((b) => ({ blockKind: b.blockKind, ...(b.detail ? { detail: b.detail } : {}) })) } }, null, 2));
+            return;
+        }
+        process.stderr.write(tCli('cli.promote.blocked_header', lang, { name: sanitizeCell(name) }) + '\n');
+        // detail 里的 verdict / judgePromptHash 来自不可信受管 JSON,文本路径先洗(与 list 同口径,防 ANSI/OSC 注入)。
+        for (const b of gate.blocked)
+            process.stderr.write(tCli(BLOCK_KEY[b.blockKind], lang, safeDetail(b.detail)) + '\n');
+        if (gate.warnings.length > 0)
+            process.stderr.write(tCli('cli.promote.incomparable_unverified', lang) + '\n');
+        // 有可锚定证据(非「无证据」终态)才提示 --force 可越门。
+        if (forceable)
+            process.stderr.write(tCli('cli.promote.force_hint', lang) + '\n');
+    }
+    emitPromoted(name, record, verdict, reportId, overridden, lang, json) {
+        const hash = record.contentHash;
+        if (json) {
+            this.log(JSON.stringify({
+                schemaVersion: 1,
+                promoted: { name, kind: record.kind, contentHash: hash, ...(reportId ? { reportId } : {}), verdict: verdict ?? null, override: overridden },
+            }, null, 2));
+            return;
+        }
+        // hash / verdict / reportId 来自不可信受管 JSON,文本路径先洗(--json 路径上面已 return、保留原值)。
+        const short = sanitizeCell(hash.slice(0, 12));
+        const safeVerdict = sanitizeCell(verdict ?? 'UNKNOWN');
+        const safeName = sanitizeCell(name);
+        if (overridden)
+            this.log(tCli('cli.promote.forced_override', lang, { name: safeName, hash: short, verdict: safeVerdict }));
+        else
+            this.log(tCli('cli.promote.promoted', lang, { name: safeName, hash: short, verdict: safeVerdict, reportId: sanitizeCell(reportId ?? '—') }));
+    }
+}

package/dist/cli/commands/rollback.d.ts

@@ -0,0 +1,20 @@
+import { BaseCommand } from '../oclif/base-command.js';
+export default class Rollback extends BaseCommand {
+    static description: string;
+    static examples: {
+        description: string;
+        command: string;
+    }[];
+    static args: {
+        name: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        lang: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        kind: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        reason: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        actor: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        global: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/cli/commands/rollback.js

@@ -0,0 +1,95 @@
+import { execFileSync } from 'node:child_process';
+import { Args, Flags } from '@oclif/core';
+import { LANG_FLAG, bilingual } from '../oclif/i18n.js';
+import { BaseCommand } from '../oclif/base-command.js';
+import { tCli } from '../lib/i18n.js';
+import { CliExit } from '../lib/cli-exit.js';
+import { sanitizeCell } from '../lib/cell-format.js';
+import { appendManagedDecision, globalManagedDir, isCurrentlyPromoted, loadManagedRecord, managedDir, managedRecordId, resolveManagedDir, } from '../../managed/index.js';
+const SUPPORTED_KINDS = ['skill'];
+/** 决定的 actor:--actor > git config user.name > $USER / $LOGNAME > unknown。git 参数无用户输入,安全。 */
+function resolveActor(flagActor) {
+    if (flagActor && flagActor.trim())
+        return flagActor.trim();
+    try {
+        const name = execFileSync('git', ['config', 'user.name'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (name)
+            return name;
+    }
+    catch { /* git 缺失 / 无配置 → 回退环境 */ }
+    return process.env.USER || process.env.LOGNAME || 'unknown';
+}
+export default class Rollback extends BaseCommand {
+    static description = bilingual({
+        zh: '回退受管 skill 当前版本的 promoted 接受：撤销最近一次 promote，在记录里追加一条 rollback 决定（源未漂移则状态回到 measurable，源已漂移则仍 stale）。',
+        en: 'Roll back a managed skill\'s current promoted acceptance: revoke the latest promote by appending a rollback decision (state returns to measurable if the source is unchanged, or stays stale if it has drifted).',
+    });
+    static examples = [
+        { description: bilingual({ zh: '回退一个已 promoted 的 skill', en: 'Roll back a promoted skill' }), command: '<%= config.bin %> rollback review' },
+        { description: bilingual({ zh: '回退并记录理由', en: 'Roll back and record a reason' }), command: '<%= config.bin %> rollback review --reason "线上发现回归"' },
+    ];
+    static args = {
+        name: Args.string({ description: bilingual({ zh: '受管 skill 名（omk list 里的 NAME）', en: 'Managed skill name (the NAME shown by omk list)' }), required: true }),
+    };
+    static flags = {
+        lang: LANG_FLAG,
+        kind: Flags.string({ description: bilingual({ zh: 'artifact 类型（当前仅 skill）', en: 'artifact kind (only skill today)' }), default: 'skill' }),
+        reason: Flags.string({ description: bilingual({ zh: '回退的理由（写入决定）', en: 'reason for the rollback (stored on the decision)' }) }),
+        actor: Flags.string({ description: bilingual({ zh: '决定的 actor（默认取 git config user.name）', en: 'decision actor (defaults to git config user.name)' }) }),
+        global: Flags.boolean({ description: bilingual({ zh: '操作全局受管目录而非项目 .omk/managed', en: 'operate on the global managed dir instead of project .omk/managed' }) }),
+        json: Flags.boolean({ description: bilingual({ zh: '输出 JSON（版本化信封）供脚本消费', en: 'output JSON (versioned envelope) for scripts' }) }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(Rollback);
+        const lang = this.lang;
+        await this.runWithCliExit(async () => {
+            const name = args.name;
+            const kind = flags.kind;
+            if (!SUPPORTED_KINDS.includes(kind)) {
+                process.stderr.write(tCli('cli.rollback.kind_unsupported', lang, { kind: sanitizeCell(String(kind)) }) + '\n');
+                throw new CliExit(1);
+            }
+            const dir = flags.global ? globalManagedDir() : resolveManagedDir(managedDir());
+            const record = loadManagedRecord(dir, managedRecordId(kind, name));
+            if (!record) {
+                process.stderr.write(tCli('cli.rollback.not_managed', lang, { name: sanitizeCell(name), kind }) + '\n');
+                throw new CliExit(1);
+            }
+            // rollback 是内容锚定的纯决定撤销:只看 record.contentHash 上的 promote/rollback 事件流,不探源、不设门禁
+            // (降级永远安全)。当前未 promoted → 无可回退;若曾对当前内容 promote 过(即已回退)则幂等成功,否则报错。
+            if (!isCurrentlyPromoted(record)) {
+                const hadPromote = record.decisions.some((d) => d.decisionKind === 'promote' && d.contentHash === record.contentHash);
+                if (hadPromote) {
+                    if (flags.json)
+                        this.log(JSON.stringify({ schemaVersion: 1, alreadyRolledBack: { name, contentHash: record.contentHash } }, null, 2));
+                    else
+                        process.stderr.write(tCli('cli.rollback.already_rolled_back', lang, { name: sanitizeCell(name) }) + '\n');
+                    return;
+                }
+                if (flags.json)
+                    this.log(JSON.stringify({ schemaVersion: 1, notPromoted: { name } }, null, 2));
+                else
+                    process.stderr.write(tCli('cli.rollback.not_promoted', lang, { name: sanitizeCell(name) }) + '\n');
+                throw new CliExit(1);
+            }
+            const reason = flags.reason?.trim();
+            const decision = {
+                decisionKind: 'rollback',
+                actor: resolveActor(flags.actor),
+                decidedAt: new Date().toISOString(),
+                contentHash: record.contentHash,
+                ...(reason ? { reason } : {}),
+            };
+            appendManagedDecision(dir, record.id, decision);
+            if (flags.json) {
+                this.log(JSON.stringify({
+                    schemaVersion: 1,
+                    rolledBack: { name, kind: record.kind, contentHash: record.contentHash, ...(reason ? { reason } : {}) },
+                }, null, 2));
+                return;
+            }
+            // hash 来自不可信受管 JSON,文本路径先洗(--json 路径上面已 return、保留原值)。
+            this.log(tCli('cli.rollback.rolled_back', lang, { name: sanitizeCell(name), hash: sanitizeCell(record.contentHash.slice(0, 12)) }));
+        });
+    }
+}

package/dist/cli/commands/sample.d.ts

@@ -26,6 +26,7 @@ export default class Sample extends BaseCommand {
         batch: import("@oclif/core/interfaces").BooleanFlag<boolean>;
         count: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         model: import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
+        executor: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'skill-dir': import("@oclif/core/interfaces").OptionFlag<string, import("@oclif/core/interfaces").CustomOptions>;
         focus: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
         'no-mock': import("@oclif/core/interfaces").BooleanFlag<boolean>;

package/dist/cli/commands/sample.js

@@ -225,7 +225,7 @@ async function runSampleFix(args, flags, lang) {
     }
     process.stderr.write(lang === 'zh' ? `🔧 发现 ${sampleDesignCount} 条 sample_design 失败，开始修复...\n` : `🔧 Found ${sampleDesignCount} sample_design failure(s), fixing...\n`);
     const { createExecutor } = await import('../../executors/index.js');
-    const exec = createExecutor('claude');
+    const exec = createExecutor(flags.executor ?? 'claude');
     const executorFn = async (opts) => {
         const result = await exec({
             model: opts.model,
@@ -298,7 +298,7 @@ async function runSampleFromTraces(flags, lang) {
         ? `🔭 发现 ${items.length} 个失败信号，正在生成回归用例草稿...\n`
         : `🔭 Found ${items.length} failure signal(s); generating regression-sample drafts...\n`);
     try {
-        const { samples, costUSD } = await generateSamplesFromTraces({ items, count, model: flags.model });
+        const { samples, costUSD } = await generateSamplesFromTraces({ items, count, model: flags.model, executorName: flags.executor });
         const cost = costUSD > 0 ? ` $${costUSD.toFixed(4)}` : '';
         if (samples.length === 0) {
             // The model conservatively skipped every signal (noise / unreproducible). That's a
@@ -380,7 +380,7 @@ async function runSample(args, flags, lang) {
             }
             try {
                 const skillContent = readFileSync(skillPath, 'utf-8');
-                const { samples, costUSD } = await generateSamples({ skillContent, count, model, focus, noMock: flags['no-mock'] });
+                const { samples, costUSD } = await generateSamples({ skillContent, count, model, focus, noMock: flags['no-mock'], executorName: flags.executor });
                 mkdirSync(dirname(samplesPath), { recursive: true });
                 writeFileSync(samplesPath, JSON.stringify(samples, null, 2));
                 const cost = costUSD > 0 ? ` $${costUSD.toFixed(4)}` : '';
@@ -444,7 +444,7 @@ async function runSample(args, flags, lang) {
             process.stderr.write(tCli('cli.gen.single_generating_auto', lang));
         }
         try {
-            const { samples, costUSD } = await generateSamples({ skillContent, count, model, focus, noMock: flags['no-mock'] });
+            const { samples, costUSD } = await generateSamples({ skillContent, count, model, focus, noMock: flags['no-mock'], executorName: flags.executor });
             mkdirSync(dirname(outputPath), { recursive: true });
             writeFileSync(outputPath, JSON.stringify(samples, null, 2));
             const cost = costUSD > 0 ? ` $${costUSD.toFixed(4)}` : '';
@@ -528,6 +528,12 @@ export default class Sample extends BaseCommand {
             }),
             default: 'sonnet',
         }),
+        executor: Flags.string({
+            description: bilingual({
+                zh: '执行器名，默认 claude（同 omk eval / doctor / evolve）。指定 codex 等其它执行器时，记得连带传一个该执行器能识别的 --model。',
+                en: 'Executor name, default claude (same as omk eval / doctor / evolve). When using another executor like codex, also pass a --model it recognizes.',
+            }),
+        }),
         'skill-dir': Flags.string({
             description: bilingual({
                 zh: 'skill 根目录，默认 skills。batch 模式扫此目录。',

package/dist/cli/lib/cell-format.d.ts

@@ -0,0 +1,17 @@
+/**
+ * 终端展示前的不可信字符洗白——`omk list` 与 `omk promote` 共用。受管 JSON 可随仓库分发、用户可手改
+ * (store.ts validator 只收窄到「是字符串」,不卡内容),把它的字段(name / verdict / judgePromptHash /
+ * reportId / sourceLabel 等)塞进终端输出前必须先洗,否则 ANSI / OSC 转义、BiDi 重排、零宽分割会破坏排版
+ * 甚至伪造输出(清屏、改窗口标题、覆盖历史行误导审计)。一律映射到可见 U+FFFD;`--json` 路径保留原值
+ * (JSON.stringify 自带控制符转义,脚本消费要的是原始值)。
+ *
+ * 用 Unicode **属性类**而非手列码点 —— 手列清单天然有缺口(BiDi、U+2028 / 2029、Tags 块都曾漏一轮补一轮),
+ * 属性类一次覆盖整类、新码点自动纳入:
+ *   - `\p{Cc}` 控制符(C0 / C1 / DEL,含 ESC / 换行 / 回车 / TAB)→ 杀 ANSI / OSC 转义与终端控制;
+ *   - `\p{Cf}` 格式符(BiDi 重排 / 隔离、零宽、joiners、BOM、Tags、interlinear)→ 防 Trojan-Source 视觉伪造与零宽隐藏 / 分割;
+ *   - `\p{Zl}` / `\p{Zp}` 行 / 段分隔(U+2028 / 2029)→ LF 的 Unicode 孪生,防换行伪造;
+ *   - `\p{Mn}` / `\p{Me}` 非间距 / 封闭组合附加符 → 变可见,避免零前进宽度令列宽与终端错位
+ *     (间距组合符 `\p{Mc}` 合法占 1 列,保留);
+ *   - Hangul filler(U+115F / U+1160 / U+3164,属 Lo 不在上述任何类)→ 零宽显示诡计,补列。
+ */
+export declare function sanitizeCell(s: string): string;

package/dist/cli/lib/cell-format.js

@@ -0,0 +1,19 @@
+/**
+ * 终端展示前的不可信字符洗白——`omk list` 与 `omk promote` 共用。受管 JSON 可随仓库分发、用户可手改
+ * (store.ts validator 只收窄到「是字符串」,不卡内容),把它的字段(name / verdict / judgePromptHash /
+ * reportId / sourceLabel 等)塞进终端输出前必须先洗,否则 ANSI / OSC 转义、BiDi 重排、零宽分割会破坏排版
+ * 甚至伪造输出(清屏、改窗口标题、覆盖历史行误导审计)。一律映射到可见 U+FFFD;`--json` 路径保留原值
+ * (JSON.stringify 自带控制符转义,脚本消费要的是原始值)。
+ *
+ * 用 Unicode **属性类**而非手列码点 —— 手列清单天然有缺口(BiDi、U+2028 / 2029、Tags 块都曾漏一轮补一轮),
+ * 属性类一次覆盖整类、新码点自动纳入:
+ *   - `\p{Cc}` 控制符(C0 / C1 / DEL,含 ESC / 换行 / 回车 / TAB)→ 杀 ANSI / OSC 转义与终端控制;
+ *   - `\p{Cf}` 格式符(BiDi 重排 / 隔离、零宽、joiners、BOM、Tags、interlinear)→ 防 Trojan-Source 视觉伪造与零宽隐藏 / 分割;
+ *   - `\p{Zl}` / `\p{Zp}` 行 / 段分隔(U+2028 / 2029)→ LF 的 Unicode 孪生,防换行伪造;
+ *   - `\p{Mn}` / `\p{Me}` 非间距 / 封闭组合附加符 → 变可见,避免零前进宽度令列宽与终端错位
+ *     (间距组合符 `\p{Mc}` 合法占 1 列,保留);
+ *   - Hangul filler(U+115F / U+1160 / U+3164,属 Lo 不在上述任何类)→ 零宽显示诡计,补列。
+ */
+export function sanitizeCell(s) {
+    return s.replace(/[\p{Cc}\p{Cf}\p{Zl}\p{Zp}\p{Mn}\p{Me}ᅟᅠㅤ]/gu, '�');
+}

package/dist/cli/lib/cmd-flags.d.ts

@@ -149,6 +149,7 @@ export interface SampleFlags {
     batch: boolean;
     count?: string;
     model: string;
+    executor?: string;
     'skill-dir': string;
     focus?: string;
     'no-mock': boolean;

package/dist/cli/lib/i18n-dict/common.d.ts

@@ -1,3 +1,3 @@
 import type { CliMessage } from './types.js';
-export type CommonMessageKey = 'cli.common.unknown_domain' | 'cli.common.error_prefix' | 'cli.common.skill_dir_not_found' | 'cli.common.skill_file_not_found' | 'cli.common.skill_dir_no_skill_md' | 'cli.common.report_not_found' | 'cli.common.no_judge_model' | 'cli.common.judge_models_single_only' | 'cli.common.warn_load_samples_failed' | 'cli.update.new_version_available' | 'cli.update.box_title' | 'cli.update.box_version_line' | 'cli.update.box_upgrade_line' | 'cli.update.box_silence_line' | 'cli.observe.view_hint' | 'cli.studio.started' | 'cli.studio.stop_hint' | 'cli.studio.open_failed' | 'cli.doctor.no_skill_found' | 'cli.doctor.samples_detected';
+export type CommonMessageKey = 'cli.common.unknown_domain' | 'cli.common.error_prefix' | 'cli.common.skill_dir_not_found' | 'cli.common.skill_file_not_found' | 'cli.common.skill_dir_no_skill_md' | 'cli.common.report_not_found' | 'cli.common.no_judge_model' | 'cli.common.judge_models_single_only' | 'cli.common.warn_load_samples_failed' | 'cli.update.new_version_available' | 'cli.update.box_title' | 'cli.update.box_version_line' | 'cli.update.box_upgrade_line' | 'cli.update.box_silence_line' | 'cli.observe.view_hint' | 'cli.studio.started' | 'cli.studio.stop_hint' | 'cli.studio.open_failed' | 'cli.doctor.no_skill_found' | 'cli.doctor.samples_detected' | 'cli.doctor.progress_skill_start' | 'cli.doctor.progress_skill_done';
 export declare const commonDict: Record<CommonMessageKey, CliMessage>;

package/dist/cli/lib/i18n-dict/common.js

@@ -79,4 +79,12 @@ export const commonDict = {
         zh: '✓ 使用评测用例文件：{path}',
         en: '✓ Using eval samples file: {path}',
     },
+    'cli.doctor.progress_skill_start': {
+        zh: '{prefix}{skill} ⏳ 体检中...\n',
+        en: '{prefix}{skill} ⏳ checking...\n',
+    },
+    'cli.doctor.progress_skill_done': {
+        zh: '{prefix}{skill} {result}（{ms}ms）\n',
+        en: '{prefix}{skill} {result} ({ms}ms)\n',
+    },
 };