@agentwhy/cli 0.1.0 → 0.2.1

package/dist/report/watch/subagent-watch.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { join } from 'node:path';
 import { HOME_PREFIX, HOOK_INPUT } from '../../adapter/claude-code/contract/hooks.js';
 import { SETTINGS_FILES } from '../../adapter/claude-code/contract/settings.js';
@@ -7,13 +9,15 @@ import { parseJsonObject } from '../../shared/json.js';
 import { parseStopInput } from '../../adapter/claude-code/hooks/stop-input.js';
 import { parseSubagentStopInput } from '../../adapter/claude-code/hooks/subagent-stop-input.js';
 import { withLateMessage } from '../../core/late-message.js';
+import { FileAccessError } from '../../ports/file-access-error.js';
 import { buildReport } from '../build-report.js';
 import { choosePolicy } from '../choose-policy.js';
 import { alertOf, alerts, DEFAULT_THRESHOLD } from './agent-alert.js';
 import { DEFAULT_CHANNELS, DEFAULT_CLEAN, DEFAULT_LANG, DEFAULT_SAID_AS, langOfLocale, } from './notice-choices.js';
-import { instructionFor, reportCommand } from './render/instruction-words.js';
+import { CLAUDE_CODE_REQUESTS, reportCommand } from './render/instruction-words.js';
 import { preferencesFor, readPreferences } from './preferences.js';
 import { NOTICE_TITLE, withTitle } from './render/notice-words.js';
+import { toDoItems } from '../render/report-page/to-do.js';
 // Where they live now: both the notice and the preferences that choose it name them, and neither owns the other.
 export { CLEAN_MODES, DEFAULT_CHANNELS, DEFAULT_CLEAN, NOTICE_CHANNELS } from './notice-choices.js';
 /**
@@ -38,21 +42,45 @@ const SESSION_COUNTS = 'session:counts';
 const CLEAN_SAID = 'session:clean';
 /** That an unreadable preferences file has been said already: once a session, never after every turn (R24). */
 const PREFERENCES_SAID = 'session:preferences';
+/** That an agent which kept no record has been said already: once a session (`when-an-agent-finishes.md` R4a). */
+const NO_RECORD_SAID = 'session:no-record';
 /**
  * The ways into Claude Code that have a person reading, as `CLAUDE_CODE_ENTRYPOINT` names them - measured on the
  * terminal and on the editor extension (B9e2). `sdk-cli`, which is `claude -p`, is left out on purpose, and so is
- * any name this version has not seen.
+ * any name this version has not seen. `claude-desktop`, the Claude desktop app, was measured too (B9e3): the agent's
+ * message is shown there in the open, under folded rows for the hook's own words.
  */
-const ATTENDED = ['cli', 'claude-vscode'];
+const ATTENDED = ['cli', 'claude-vscode', 'claude-desktop'];
+/**
+ * Where the first quiet turn of a session is said by the agent as well as the line (R5, amended 2026-10-02 by the
+ * maintainer): the Claude desktop app, which folds the line away (B9e3), and the VS Code extension, a flow the
+ * maintainer wants the same. Not the terminal, where the line is in the open under the reply.
+ */
+const CLEAN_SAID_BY_AGENT = ['claude-desktop', 'claude-vscode'];
 /** The records the display keeps about the session itself. None of them is an agent, and none is ever counted as one. */
-const KEPT_NAMES = [OWN_REACH_SAID, SESSION_COUNTS, CLEAN_SAID, PREFERENCES_SAID];
-/** What the session had said about it before, plus what is being said now. Levels only, never what they were about. */
+const KEPT_NAMES = [OWN_REACH_SAID, SESSION_COUNTS, CLEAN_SAID, PREFERENCES_SAID, NO_RECORD_SAID];
+/** WS5: remembered with the alert, so the turn's own line knows a rule did not refuse everything it counts. */
+function notByRule(alert) {
+    return alert.level === 'refused' && alert.refusedByOthers !== undefined ? { notByRule: true } : {};
+}
+/**
+ * What the session had said about it before, plus what is being said now. Levels only, never what they were about. A
+ * value from a file the person lets their AI read is counted apart: a later quiet turn must not call it a key (F57a).
+ */
 function countedWith(before, saying) {
+    const told = (before?.told ?? 0) + saying.filter((alert) => alert.told === true).length;
+    const data = (before?.data ?? 0) + saying.filter((alert) => alert.level === 'value' && alert.data === true).length;
     return {
-        values: (before?.values ?? 0) + saying.filter((alert) => alert.level === 'value').length,
-        reached: (before?.reached ?? 0) + saying.filter((alert) => alert.level === 'reached').length,
+        values: (before?.values ?? 0) + saying.filter((alert) => alert.level === 'value' && alert.told !== true && alert.data !== true).length,
+        reached: (before?.reached ?? 0) + saying.filter((alert) => alert.level === 'reached' && alert.told !== true).length,
+        ...(told > 0 ? { told } : {}),
+        ...(data > 0 ? { data } : {}),
     };
 }
+/** Whether a session has had anything said about it: a key, a private file opened, or one the person lets it read. */
+function anythingSaid(counts) {
+    return counts.values > 0 || counts.reached > 0 || (counts.told ?? 0) > 0 || (counts.data ?? 0) > 0;
+}
 /**
  * `agentwhy watch`: one finished agent, read the way `report` reads a session, and one notice about it
  * (`specs/2026-09-16-when-an-agent-finishes.md`). Every way it can fail to look is a notice saying so - never an
@@ -74,13 +102,59 @@ export class SubagentWatch {
             return this.announce({ kind: 'not-checked', reason: 'input' }, options.channels ?? DEFAULT_CHANNELS);
         // Where the session runs decides which project's answers apply, and it is on every input this hook is given.
         const settled = await this.#settle(options, directoryIn(text));
-        const stop = parseStopInput(text);
+        const format = this.#dependencies.turnFormat;
+        // CX2, CK13: a command agentwhy stopped this turn is the turn's message, and nothing else is asked of the agent. Looked
+        // for before the turn is read: it needs the turn and its rollout alone, as the Stop hook it replaced did, so a `Stop`
+        // without a session id (CKB12) still says it. Its continuation finds nothing.
+        if (format !== undefined) {
+            const stopped = await format.stoppedIn(text);
+            if (stopped.length > 0) {
+                const paths = [...new Set(stopped.map((one) => one.path))];
+                return { notice: { kind: 'quiet' }, output: blockNotice(format.requests.stopped(paths, settled.lang), '') };
+            }
+            // CX9, after the refusals: a command agentwhy refused is said wherever the hook ran, but outside a project the
+            // person set up, nothing else is - a user-level hook fires in every conversation, the app's scratch folders too.
+            if (!(await format.watchedHere(text)))
+                return { notice: { kind: 'quiet' }, output: '' };
+        }
+        const stop = format === undefined ? parseStopInput(text) : format.readStop(text);
         if (!('unusable' in stop))
-            return this.#sayWhatTheTurnFound(stop.turn, settled);
+            return this.#sayWhatTheTurnFound(stop.turn, await this.#rulesFor(settled, text));
+        // CX1, §4 of its specification: another AI's hook says what `Stop` says, and nothing for any other event.
+        if (format !== undefined)
+            return { notice: { kind: 'quiet' }, output: '' };
         const { notice, agent } = await this.#noticeFor(text, settled);
+        if (await this.#saidBefore(notice, agent))
+            return { notice: { kind: 'quiet' }, output: '' };
         await this.#remember(notice, agent, settled);
         return this.announce(notice, settled.channels);
     }
+    /**
+     * An agent that kept no record is said once a session (R4a). The Claude desktop app finishes one after many of its
+     * turns (B4g), and the same sentence after each is a line a person learns to skip. Said once is still said
+     * (invariant 4), and recorded before it is said, so a hook that fires again stays quiet. A session the input does
+     * not name has no "once", and hears it every time.
+     */
+    async #saidBefore(notice, agent) {
+        if (notice.kind !== 'no-record' || agent?.sessionId === undefined)
+            return false;
+        const { store } = this.#dependencies;
+        if ((await store.peek(agent.sessionId)).some((record) => record.agentId === NO_RECORD_SAID))
+            return true;
+        await store.remember(agent.sessionId, { agentId: NO_RECORD_SAID, level: 'no-record', words: '' });
+        return false;
+    }
+    /**
+     * CX5: where the hook is another AI's and no flag named the rules, the project's own, found from where it ran - the
+     * rules Claude Code's hooks read there, so one list is read by both (CK2).
+     */
+    async #rulesFor(settled, text) {
+        const format = this.#dependencies.turnFormat;
+        if (format === undefined || settled.policyPath !== undefined || settled.settingsPath !== undefined)
+            return settled;
+        const settingsPath = await format.settingsFor(text);
+        return settingsPath === undefined ? settled : { ...settled, settingsPath };
+    }
     /**
      * One question at a time, in the order R24 sets: the flag if it was written, then this project's answer, then this
      * person's, then what this tool does when nobody has said anything. A file that cannot be read answers nothing and
@@ -116,53 +190,87 @@ export class SubagentWatch {
      * unless it changes.
      */
     async #sayWhatTheTurnFound(turn, options) {
-        // Taking clears the store, so a run that cannot show the words must not take them.
-        if (!options.channels.includes('chat'))
+        const format = this.#dependencies.turnFormat;
+        // Taking clears the store, so a run that cannot show the words must not take them: they are shown as the line in the
+        // conversation, or as a system notification (`when-an-agent-finishes.md` R15a).
+        const chat = options.channels.includes('chat');
+        if (!chat && !options.channels.includes('os'))
             return { notice: { kind: 'quiet' }, output: '' };
+        // What is said once a conversation is remembered under the conversation (CX8), which for Claude Code is the session.
+        const conversation = format === undefined ? turn.sessionId : await format.conversationOf(turn);
         const { store } = this.#dependencies;
-        const remembered = await store.take(turn.sessionId);
+        const remembered = await store.take(conversation);
         const kept = new Map(remembered.map((alert) => [alert.agentId, alert]));
         const said = kept.get(OWN_REACH_SAID);
         const delegated = remembered.filter((alert) => !KEPT_NAMES.includes(alert.agentId));
         const own = await this.#ownReach(turn, options);
         const reach = own.kind === 'alert' ? own.alert : undefined;
         if (reach !== undefined)
-            await store.remember(turn.sessionId, { ...reach, agentId: OWN_REACH_SAID });
-        // Written back because `take` cleared them. A turn nobody looked at changes nothing that was said: without this the
-        // turn after it took the same finding for a new one and blocked a second time (R10). An unusable preferences file
-        // is said once a session (R24), whatever this turn says. A clean line said once is let go on a turn with a finding,
-        // on purpose: the next quiet turn then says what the session holds (R4, R6).
-        const unchanged = own.kind === 'not-looked' ? [said, kept.get(CLEAN_SAID), kept.get(PREFERENCES_SAID)] : [kept.get(PREFERENCES_SAID)];
+            await store.remember(conversation, { ...reach, agentId: OWN_REACH_SAID });
+        // Written back because `take` cleared them. A turn nobody looked at, or one that opened a file nobody asked to hear
+        // about (R6a), changes nothing that was said: without this the turn after it took the same finding for a new one
+        // and blocked a second time (R10). An unusable preferences file and an agent that kept no record are each said once
+        // a session (R24; `when-an-agent-finishes` R4a), whatever this turn says. A clean line said once is let go on a turn
+        // with a finding, on purpose: the next quiet turn then says what the session holds (R4, R6).
+        const always = [kept.get(PREFERENCES_SAID), kept.get(NO_RECORD_SAID)];
+        const unchanged = own.kind === 'not-looked' || own.kind === 'unsaid' ? [said, kept.get(CLEAN_SAID), ...always] : always;
         for (const record of unchanged)
             if (record !== undefined)
-                await store.remember(turn.sessionId, record);
+                await store.remember(conversation, record);
         const fresh = reach !== undefined && reach.words !== said?.words ? [reach] : [];
         const saying = [...fresh, ...delegated];
         // What this session has had said about it, this turn included. Written back because `take` cleared it.
         const counts = countedWith(kept.get(SESSION_COUNTS)?.counts, saying);
-        if (counts.values > 0 || counts.reached > 0) {
-            await store.remember(turn.sessionId, { agentId: SESSION_COUNTS, level: 'counts', words: '', counts });
+        if (anythingSaid(counts)) {
+            await store.remember(conversation, { agentId: SESSION_COUNTS, level: 'counts', words: '', counts });
         }
         /*
          * A turn this run could not look at is not a quiet turn, and must never be said as one: every way of failing to
          * look is silence on this event (`the-agent-nobody-watches` R9), and a clean line over a reading that did not
-         * happen is the one sentence this tool must never write.
+         * happen is the one sentence this tool must never write. Nor is a turn that opened a private file the person did
+         * not ask to hear about (R6a): the clean line says no private file was opened.
          */
+        // R13: the turn a block caused is the agent saying what was found, and a quiet line after it - "nothing new now,
+        // earlier a key was read" - repeats it, in the chat and as a notification. Only something new is said there.
         const notice = saying.length > 0
             ? { kind: 'turn', remembered: saying }
-            : own.kind === 'not-looked'
+            : own.kind === 'not-looked' || turn.active
                 ? { kind: 'quiet' }
-                : (await this.#preferencesNotice(turn, options, kept.has(PREFERENCES_SAID))) ??
-                    (await this.#cleanNotice(turn, options, counts, kept.has(CLEAN_SAID)));
+                : (await this.#preferencesNotice(conversation, options, kept.has(PREFERENCES_SAID))) ??
+                    (own.kind === 'unsaid' ? { kind: 'quiet' } : await this.#cleanNotice(conversation, options, counts, kept.has(CLEAN_SAID)));
+        await this.#notifyTurn(notice, fresh, options.channels);
+        if (!chat)
+            return { notice, output: '' };
         // The other two channels carry a title of their own; a line in the conversation has none, so it says who speaks.
         const words = this.#dependencies.renderer.render(notice);
         const files = own.kind === 'alert' ? own.files : [];
-        if (this.#agentSpeaks(turn, options, fresh)) {
-            const command = reportCommand(turn.sessionId, await this.#invocation());
-            return { notice, output: blockNotice(instructionFor(files, command), withTitle(words)) };
+        const reader = await this.#readerOf(turn);
+        const requests = format?.requests ?? CLAUDE_CODE_REQUESTS;
+        if (this.#agentSpeaks(turn, options, fresh, reader)) {
+            const command = reportCommand(format === undefined ? turn.sessionId : format.sessionKey(turn.sessionId), await this.#invocation());
+            const asked = requests[own.kind === 'alert' ? own.found : 'keys'];
+            return { notice, output: blockNotice(asked(files, command, options.lang, reader.foldsTurn === true), withTitle(words)) };
         }
+        if (this.#agentSaysClean(turn, options, notice, reader))
+            return { notice, output: blockNotice(requests.quiet(options.lang, reader.foldsTurn === true), withTitle(words)) };
         return { notice, output: chatNotice(withTitle(words)) };
     }
+    /**
+     * The end of a turn as a system notification, where one was chosen (`when-an-agent-finishes.md` R15a): the Claude
+     * desktop app shows no line in the conversation (B4h), and this is what reaches a person there. Only what this turn
+     * adds: a delegated agent's notice went out on it when that agent finished, so where the conversation is told as
+     * well, the new part is the turn's own reach or the line of a quiet turn. Without the conversation it is the whole turn.
+     */
+    async #notifyTurn(notice, fresh, channels) {
+        if (!channels.includes('os'))
+            return;
+        const shown = notice.kind !== 'turn' || !channels.includes('chat')
+            ? notice
+            : fresh.length > 0 ? { kind: 'turn', remembered: fresh } : { kind: 'quiet' };
+        const words = this.#dependencies.renderer.render(shown);
+        if (words !== '')
+            await this.#dependencies.notifier.notify(NOTICE_TITLE, words);
+    }
     /**
      * Whether this turn's finding is said by the session's own agent rather than as a line (R9-R14). Every condition
      * is a measurement or a reason written down beside it, and all of them must hold:
@@ -179,12 +287,37 @@ export class SubagentWatch {
      * - **a person is reading** - the entry point is one measured attended (B9e2, R14). One this version does not
      *   know, or none at all, gets the line: a scripted run continued by a block prints an answer it never asked for.
      */
-    #agentSpeaks(turn, options, fresh) {
+    #agentSpeaks(turn, options, fresh, reader) {
+        return fresh.some((alert) => alert.level === 'value' || alert.told === true) &&
+            options.say === 'agent' &&
+            !turn.active &&
+            reader.attended;
+    }
+    /**
+     * Who reads the session (R14, R5): for Claude Code, the entry point its hooks are handed (B9e2, B9e3); for another
+     * AI, what its own record says (`codex-says-it-too` CX4).
+     */
+    async #readerOf(turn) {
+        const format = this.#dependencies.turnFormat;
+        if (format !== undefined)
+            return format.readerOf(turn);
         const { entryPoint } = this.#dependencies;
-        return fresh.some((alert) => alert.level === 'value') &&
+        return {
+            attended: entryPoint !== undefined && ATTENDED.includes(entryPoint),
+            quietSaidByAgent: entryPoint !== undefined && CLEAN_SAID_BY_AGENT.includes(entryPoint),
+        };
+    }
+    /**
+     * Whether the first quiet turn of a session is said by the agent too (R5, amended 2026-10-02): the line that says the
+     * watch is running and nothing has been opened - never a later quiet turn, never one over an earlier finding (R6),
+     * never every turn - where the person left `say` at `agent`, outside a continuation (R13), and in an interface the
+     * maintainer asked it for (`CLEAN_SAID_BY_AGENT`). The line was marked said before this is asked, so it blocks once.
+     */
+    #agentSaysClean(turn, options, notice, reader) {
+        return notice.kind === 'clean' && notice.first && !anythingSaid(notice.counts) &&
             options.say === 'agent' &&
             !turn.active &&
-            entryPoint !== undefined && ATTENDED.includes(entryPoint);
+            reader.quietSaidByAgent;
     }
     /**
      * How the agent is to run agentwhy: the way the `Stop` hook running now does, read from the project's settings -
@@ -209,11 +342,11 @@ export class SubagentWatch {
      * never as a block. Without it a broken file reads exactly like choices that were honoured - the person who set
      * `off` and still hears a line, or set `every-turn` and hears nothing, would have no way to know why.
      */
-    async #preferencesNotice(turn, options, said) {
+    async #preferencesNotice(conversation, options, said) {
         if (!options.preferencesUnusable)
             return undefined;
         // Written back whatever happens next, since `take` cleared it with everything else.
-        await this.#dependencies.store.remember(turn.sessionId, { agentId: PREFERENCES_SAID, level: 'preferences', words: '' });
+        await this.#dependencies.store.remember(conversation, { agentId: PREFERENCES_SAID, level: 'preferences', words: '' });
         return said ? undefined : { kind: 'preferences-unusable' };
     }
     /**
@@ -221,17 +354,17 @@ export class SubagentWatch {
      * it is held to two things: it never speaks where the person asked for silence, and it never says a session is
      * clean when an earlier turn of it was not - what the turn found and what the session holds are said apart.
      */
-    async #cleanNotice(turn, options, counts, cleanSaid) {
+    async #cleanNotice(conversation, options, counts, cleanSaid) {
         const mode = options.clean;
         if (mode === 'off')
             return { kind: 'quiet' };
         // Said once means once: the marker is written back, since `take` cleared it with everything else.
         if (mode === 'once' && cleanSaid) {
-            await this.#dependencies.store.remember(turn.sessionId, { agentId: CLEAN_SAID, level: 'clean', words: '' });
+            await this.#dependencies.store.remember(conversation, { agentId: CLEAN_SAID, level: 'clean', words: '' });
             return { kind: 'quiet' };
         }
         if (mode === 'once')
-            await this.#dependencies.store.remember(turn.sessionId, { agentId: CLEAN_SAID, level: 'clean', words: '' });
+            await this.#dependencies.store.remember(conversation, { agentId: CLEAN_SAID, level: 'clean', words: '' });
         return { kind: 'clean', first: !cleanSaid && mode === 'once', counts, lang: options.lang };
     }
     /**
@@ -253,13 +386,56 @@ export class SubagentWatch {
         const model = turn.lastMessage === undefined ? read : withLateMessage(read, read.sessionId, turn.lastMessage);
         const report = buildReport(model, policy.policy, createRedactor(model.projectRoot), { share: false, projectRoot: model.projectRoot });
         const alert = alertOf(report, report.graph.main.index);
+        /*
+         * S1 of `the-chat-says-what-the-report-says`: a read of files the person tracks is `told` at every threshold -
+         * choosing Tell me is asking to be told, and only switching alerts off silences it. Asked before the threshold,
+         * because a tracked read without a traced value is `reached`, which the default threshold never says: the person
+         * heard "no value found", in English, over a read they had asked to hear about - and in the ChatGPT/Codex app,
+         * which shows no plain line, nothing at all (seen by the maintainer, 2026-10-02).
+         */
+        if (alert !== undefined && (alert.level === 'value' || alert.level === 'reached')) {
+            const readByMain = this.#toldReadBy(report);
+            if (readByMain !== undefined) {
+                const words = renderer.render({ kind: 'told', lang: options.lang });
+                return {
+                    kind: 'alert',
+                    alert: { agentId: OWN_REACH_SAID, level: alert.level, words, ...notByRule(alert), told: true },
+                    files: readByMain,
+                    found: 'told',
+                };
+            }
+        }
+        // A refusal opened nothing, so a clean line stays true over it; a reach did, so it does not (R6a).
+        if (alert !== undefined && alert.level === 'reached' && !alerts(alert.level, options.on))
+            return { kind: 'unsaid' };
         if (alert === undefined || !alerts(alert.level, options.on))
             return { kind: 'nothing' };
-        return {
-            kind: 'alert',
-            alert: { agentId: OWN_REACH_SAID, level: alert.level, words: renderer.render({ kind: 'alert', alert }) },
-            files: readFrom(report, report.graph.main.index),
-        };
+        const opened = readFrom(report, report.graph.main.index);
+        if (alert.level !== 'value') {
+            const words = renderer.render({ kind: 'alert', alert });
+            return { kind: 'alert', alert: { agentId: OWN_REACH_SAID, level: alert.level, words, ...notByRule(alert) }, files: opened, found: 'keys' };
+        }
+        const found = foundIn(report, opened);
+        const { what } = found;
+        const words = renderer.render(what === 'told' ? { kind: 'told', lang: options.lang } : { kind: 'read', what, lang: options.lang });
+        const remembered = what === 'told' ? { told: true } : what === 'data' ? { data: true } : {};
+        return { kind: 'alert', alert: { agentId: OWN_REACH_SAID, level: alert.level, words, ...notByRule(alert), ...remembered }, files: found.files, found: what };
+    }
+    /**
+     * The files the session's own agent read where every one is tracked (S1, `told`): their paths, or nothing where any
+     * is blocked - one blocked file among them keeps the stronger words - or where nothing was read at all. Read from
+     * the stories, by the page's word for read (S3): a call that printed the file's text, never a name seen in a
+     * listing, never a write, and never a delegated agent's read (R12b).
+     */
+    #toldReadBy(report) {
+        const main = report.graph.main.index;
+        const read = [...new Set(report.stories
+                .filter((story) => story.agentIndex === main && story.read === true)
+                .map((story) => story.path))];
+        if (read.length === 0)
+            return undefined;
+        const told = new Set(report.findings.filter((finding) => finding.told === true).map((finding) => finding.path));
+        return read.every((path) => told.has(path)) ? read : undefined;
     }
     /**
      * What `chat` does at `SubagentStop`: keep the words for the end of the turn, because this event discards a
@@ -268,7 +444,7 @@ export class SubagentWatch {
     async #remember(notice, agent, options) {
         if (!options.channels.includes('chat'))
             return;
-        if (notice.kind !== 'alert' && notice.kind !== 'not-checked')
+        if (notice.kind !== 'alert' && notice.kind !== 'not-checked' && notice.kind !== 'no-record')
             return;
         // Without a session there is no conversation to speak in; the immediate channels said it if they were asked to.
         if (agent?.sessionId === undefined)
@@ -276,10 +452,11 @@ export class SubagentWatch {
         const words = this.#dependencies.renderer.render(notice);
         if (words === '')
             return;
-        // A reason it could not look is remembered under the reason, so a hook that fires again says it once (R8).
+        // A reason it could not look is remembered under the reason, so a hook that fires again says it once (R8). An agent
+        // that kept no record is one that could not be checked, and is counted as one where a turn sums several.
         const which = notice.kind === 'alert'
-            ? { agentId: agent.agentId, level: notice.alert.level }
-            : { agentId: `not-checked:${notice.reason}`, level: 'not-checked' };
+            ? { agentId: agent.agentId, level: notice.alert.level, ...notByRule(notice.alert) }
+            : { agentId: `not-checked:${notice.kind === 'no-record' ? 'no-record' : notice.reason}`, level: 'not-checked' };
         await this.#dependencies.store.remember(agent.sessionId, { ...which, words });
     }
     async #noticeFor(text, options) {
@@ -298,6 +475,8 @@ export class SubagentWatch {
         const model = agent.lastMessage === undefined ? read : withLateMessage(read, agent.agentId, agent.lastMessage);
         // R3: by the id the hook names, and by nothing else.
         const agentIndex = model.agents.findIndex((candidate) => candidate.id === agent.agentId);
+        if (agentIndex < 0 && (await leftNoRecord(files, agent, home)))
+            return { notice: { kind: 'no-record', lang: options.lang }, agent };
         if (agentIndex < 0 || model.agents[agentIndex]?.id === model.sessionId) {
             return { notice: { kind: 'not-checked', reason: 'agent-not-found' }, agent };
         }
@@ -316,6 +495,30 @@ export class SubagentWatch {
  * file the session only wrote a value into. Found by the first test of this, on a session that read `.env` and
  * wrote into `.env.production`.
  */
+/**
+ * What the files the conversation read held (`the-chat-says-what-the-report-says.md` S1): `told` where every one is a
+ * file the person lets their AI read (F57); else the strongest kind among the others, as the report's to-do list says it -
+ * keys, then a template, then private data - with the files of that kind alone, the rest being the report's. A tracked
+ * file beside a blocked one keeps the blocked one's words, the safer of the two. A file the list does not hold is said as
+ * keys, the words used for every value before S1.
+ */
+function foundIn(report, opened) {
+    const told = new Set(report.findings.filter((finding) => finding.told === true).map((finding) => finding.path));
+    if (opened.length > 0 && opened.every((file) => told.has(file)))
+        return { what: 'told', files: opened };
+    const items = new Map(toDoItems(report).map((item) => [item.path, item]));
+    const kindOf = (file) => {
+        const item = items.get(file);
+        return item === undefined ? 'keys' : item.template ? 'template' : item.kind;
+    };
+    const blocked = opened.filter((file) => !told.has(file));
+    for (const what of ['keys', 'template', 'data']) {
+        const files = blocked.filter((file) => kindOf(file) === what);
+        if (files.length > 0)
+            return { what, files };
+    }
+    return { what: 'keys', files: opened };
+}
 function readFrom(report, agentIndex) {
     return [...new Set([
             ...report.uses.filter((use) => use.agentIndex === agentIndex).flatMap((use) => use.files),
@@ -339,6 +542,28 @@ async function textOf(files, path) {
         return undefined;
     }
 }
+/**
+ * Whether a finished agent kept no record at all: the input names its own file, and the file is not there (R4a, B4g).
+ * One line is read, enough to know the file exists. A file that cannot be read, or an input that names none, is not
+ * this - it stays an agent that was not found (R4).
+ */
+async function leftNoRecord(files, agent, home) {
+    if (agent.agentTranscriptPath === undefined)
+        return false;
+    const lines = files.readLines(expandHome(agent.agentTranscriptPath, home))[Symbol.asyncIterator]();
+    try {
+        await lines.next();
+        return false;
+    }
+    catch (error) {
+        if (error instanceof FileAccessError)
+            return error.failure === 'not-found';
+        throw error;
+    }
+    finally {
+        await lines.return?.();
+    }
+}
 /** A path the hooks reference writes with a leading `~/` in its examples: expanded, never read as relative. */
 function expandHome(path, home) {
     return path.startsWith(HOME_PREFIX) ? join(home, path.slice(HOME_PREFIX.length)) : path;

package/dist/setup/behind.js

@@ -1,3 +1,5 @@
+// Copyright 2026 Nessprim Karol Kozer
+// SPDX-License-Identifier: Apache-2.0
 import { pinnedVersions } from '../adapter/claude-code/settings/hook-entries.js';
 import { isOlder, plainVersion } from '../shared/plain-version.js';
 /**