replume-cli 0.1.0 → 0.1.1

package/dist/cli.js

@@ -6,7 +6,7 @@ import { Command, Option } from "commander";
 // package.json
 var package_default = {
   name: "replume-cli",
-  version: "0.1.0",
+  version: "0.1.1",
   type: "module",
   bin: {
     replume: "dist/cli.js"
@@ -601,7 +601,7 @@ async function runVerify(opts) {
 // src/agents/claude/handler.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/core/usage-store.ts
@@ -886,7 +886,9 @@ function validateReport(x) {
     const valid = isObj(a) && isObj(t) && isObj(tokens) && [t.wall, t.active, t.humanWait, tokens.input, tokens.output, tokens.cacheRead, tokens.cacheWrite, a.apiEquivalentUsd].every(metric) && typeof tokens.partial === "boolean" && typeof a.accepted === "boolean" && typeof a.priceVersion === "string" && (a.apiEquivalentReason === void 0 || typeof a.apiEquivalentReason === "string" && a.apiEquivalentReason.length > 0 && a.apiEquivalentReason.length <= 200);
     if (!valid) p.push("metrics.accounting has invalid evidence or value");
   }
-  const levelled = ["done", "failed", "extra", "tampering", "notChecked", "checks"].flatMap((k) => Array.isArray(x[k]) ? x[k] : []);
+  if (x.observedOnly !== void 0 && (!Array.isArray(x.observedOnly) || !x.observedOnly.every((e) => isObj(e) && typeof e.path === "string" && typeof e.reason === "string")))
+    p.push("observedOnly must be an array of {path, reason}");
+  const levelled = ["done", "failed", "extra", "tampering", "notChecked", "observedOnly", "checks"].flatMap((k) => Array.isArray(x[k]) ? x[k] : []);
   if (levelled.some((e) => isObj(e) && e.evidence_level !== void 0 && !EVIDENCE_LEVELS.includes(e.evidence_level)))
     p.push(`evidence_level must be one of ${EVIDENCE_LEVELS.join(", ")}`);
   return p;
@@ -1294,6 +1296,139 @@ function matchesAny(path, patterns) {
   return null;
 }
 
+// src/core/capture.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
+var EXPECTED_TYPES = ["prompt", "tool_pre", "command", "stop"];
+var SHOWN_PATHS = 5;
+var count2 = (m, k) => {
+  m[k] = (m[k] ?? 0) + 1;
+};
+var HOOK_CRASH = "hook-errors.log exists: at least one hook crashed, so some steps may not have been recorded";
+function captureCoverage(eventsFile, changedPaths, hooksConfigured = false) {
+  const absence = hooksConfigured ? "Replume project hooks are configured, but no hook events were recorded; agent steps and scope were not observed" : "no Replume project hooks were found; agent steps and scope were not observed";
+  const empty = (ledger, notes) => ({
+    ledger,
+    hooksConfigured,
+    events: 0,
+    sessions: 0,
+    agents: [],
+    byType: {},
+    tools: {},
+    firstTs: null,
+    lastTs: null,
+    badLines: 0,
+    hookErrorsLogged: hookErrors(eventsFile),
+    changedFiles: changedPaths.length,
+    changedFilesSeen: 0,
+    changedFilesLanded: 0,
+    changedFilesAttemptedOnly: [],
+    changedFilesNotSeen: changedPaths.slice(0, SHOWN_PATHS),
+    unobservableCommands: 0,
+    // a hook that crashed on every call leaves no ledger: say so here too, not only in the JSON flag
+    notSeen: hookErrors(eventsFile) ? [...notes, HOOK_CRASH] : notes
+  });
+  if (!existsSync6(eventsFile)) {
+    return empty("absent", [`no ledger file: ${absence}`]);
+  }
+  const text = readFileSync7(eventsFile, "utf-8");
+  const { events, badLines } = parseEvents(text);
+  if (!events.length) {
+    return empty("empty", [
+      badLines.length ? `the ledger has ${badLines.length} line(s) but none is a valid event` : `the ledger is empty: ${absence}`
+    ]);
+  }
+  const byType = {};
+  const tools = {};
+  const seenPaths = /* @__PURE__ */ new Set();
+  const landedPaths = /* @__PURE__ */ new Set();
+  const blockedPaths = /* @__PURE__ */ new Set();
+  for (const e of events) {
+    count2(byType, e.type);
+    if (e.type === "tool_pre" && e.tool) count2(tools, e.tool);
+    const blocked = e.action === "block" && e.type !== "file_edit" && e.type !== "command";
+    const landed = e.type === "file_edit" || e.type === "command" && e.raw?.ok !== false;
+    for (const p of e.paths) {
+      if (blocked) blockedPaths.add(p);
+      else seenPaths.add(p);
+      if (landed) landedPaths.add(p);
+    }
+  }
+  const ts = events.map((e) => e.ts).sort();
+  const notSeen = [];
+  const missing = EXPECTED_TYPES.filter((t) => !byType[t]);
+  if (missing.length) notSeen.push(`no ${missing.join(", ")} events`);
+  const truncated = badLines.length > 0 || !text.endsWith("\n");
+  if (truncated) notSeen.push(`the ledger may be truncated or damaged (${badLines.length} unreadable line(s)${text.endsWith("\n") ? "" : ", last line has no line break"}); events after that point may be missing`);
+  const attemptedOnly = changedPaths.filter((p) => !seenPaths.has(p) && blockedPaths.has(p));
+  if (attemptedOnly.length)
+    notSeen.push(
+      `${attemptedOnly.length} changed file(s) appear in the ledger only as blocked attempts (${attemptedOnly.slice(0, SHOWN_PATHS).join(", ")}${attemptedOnly.length > SHOWN_PATHS ? ", \u2026" : ""}): the change that landed was not observed by any hook`
+    );
+  const unseen = changedPaths.filter((p) => !seenPaths.has(p) && !blockedPaths.has(p));
+  if (unseen.length) {
+    notSeen.push(
+      `${unseen.length} of ${changedPaths.length} changed file(s) are named by no ledger event (${unseen.slice(0, SHOWN_PATHS).join(", ")}${unseen.length > SHOWN_PATHS ? ", \u2026" : ""}); a file changed through a shell command is seen only if the command text names it`
+    );
+  }
+  const opaque = [...new Set(events.filter((e) => (e.type === "command" || e.type === "tool_pre") && e.command && unobservable(e.command)).map((e) => e.command))];
+  const unparsed = [...new Set(events.filter((e) => (e.type === "command" || e.type === "tool_pre") && e.command && !unobservable(e.command) && e.raw?.writeNote === "write target not parsed").map((e) => e.command))];
+  if (opaque.length)
+    notSeen.push(
+      `${opaque.length} shell command${opaque.length === 1 ? "" : "s"} ran a script file or wrote to a path built at run time (e.g. \`${opaque[0].slice(0, 80)}\`); what ${opaque.length === 1 ? "it" : "they"} wrote is not observable by Replume's shell rules`
+    );
+  if (unparsed.length)
+    notSeen.push(
+      `${unparsed.length} shell command${unparsed.length === 1 ? "" : "s"} wrote to a target that was not parsed (variable, glob, inline code, patch or a git command that rewrites files; e.g. \`${unparsed[0].slice(0, 80)}\`): write target not parsed, so ${unparsed.length === 1 ? "its" : "their"} writes are not attributed to any file`
+    );
+  const hookErrorsLogged = hookErrors(eventsFile);
+  if (hookErrorsLogged) notSeen.push(HOOK_CRASH);
+  return {
+    ledger: "present",
+    events: events.length,
+    sessions: new Set(events.map((e) => e.sessionId)).size,
+    agents: [...new Set(events.map((e) => e.agent))].sort(),
+    byType,
+    tools,
+    firstTs: ts[0],
+    lastTs: ts[ts.length - 1],
+    badLines: badLines.length,
+    hookErrorsLogged,
+    changedFiles: changedPaths.length,
+    changedFilesSeen: changedPaths.filter((p) => seenPaths.has(p)).length,
+    changedFilesLanded: changedPaths.filter((p) => landedPaths.has(p)).length,
+    changedFilesAttemptedOnly: attemptedOnly.slice(0, SHOWN_PATHS),
+    changedFilesNotSeen: unseen.slice(0, SHOWN_PATHS),
+    unobservableCommands: opaque.length + unparsed.length,
+    notSeen
+  };
+}
+var SCRIPT_RUN = /(?:^|[;&|(]\s*|\s(?:sudo|exec|env|nohup|time)\s+)(?:(?:node|nodejs|deno|bun|python[0-9.]*|ruby|perl|php|bash|sh|zsh|pwsh|tsx|ts-node)\s+(?:-[^-ce\s][^\s]*\s+)*[\w./~-]+\.(?:js|mjs|cjs|ts|py|rb|pl|php|sh|bash|zsh|ps1)\b|\.{1,2}\/[\w./-]+)/;
+var RUNTIME_TARGET = /(?:>{1,2}|>\||\btee(?:\s+-\w+)*)\s*["']?[^\s"';|&]*(?:\$|`)/;
+var unobservable = (command) => SCRIPT_RUN.test(command) || RUNTIME_TARGET.test(command);
+function hookErrors(eventsFile) {
+  return existsSync6(join6(dirname4(eventsFile), "hook-errors.log"));
+}
+var list = (m) => Object.entries(m).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([k, n]) => `${k} ${n}`).join(", ");
+function renderCapture(c) {
+  const out = ["CAPTURE COVERAGE"];
+  if (c.ledger !== "present") {
+    out.push(`  seen       nothing (ledger ${c.ledger === "absent" ? "file not found" : "empty"})`);
+  } else {
+    out.push(`  seen       ${c.events} events from ${c.agents.join(", ")} in ${c.sessions} session${c.sessions === 1 ? "" : "s"} (${c.firstTs} to ${c.lastTs}): ${list(c.byType)}`);
+    if (Object.keys(c.tools).length) out.push(`  tools      ${list(c.tools)}`);
+    if (c.changedFilesLanded !== void 0) {
+      const a = c.changedFilesAttemptedOnly ?? [];
+      out.push(
+        `  files      ${c.changedFilesSeen} of ${c.changedFiles} changed file(s) named by an allowed step; ${c.changedFilesLanded} landed and observed (file_edit or successful command event); ${a.length} only attempted (blocked)${a.length ? `: ${a.join(", ")}` : ""}`
+      );
+    }
+  }
+  out.push(`  not seen   ${c.notSeen.length ? c.notSeen.join("; ") : "nothing flagged by these checks (they cannot see steps taken outside the hooks)"}`);
+  out.push("  limits     only agents with a Replume adapter and installed hooks write events; the ledger is a local file that can be edited or deleted. This is what was captured, not proof of what the agent did.");
+  return out;
+}
+
 // src/core/rules.ts
 var PREFIX = "Replume:";
 function fingerprint(tool, input) {
@@ -1332,11 +1467,32 @@ function shellTokens(src) {
   const toks = [];
   let cur = "";
   let has = false;
+  const heredocs = [];
   const flush = () => {
-    if (has) toks.push({ word: cur });
+    if (has) {
+      const prev = toks[toks.length - 1];
+      if (prev && "op" in prev && prev.op === "<<") {
+        const strip = cur.startsWith("-");
+        heredocs.push({ delim: strip ? cur.slice(1) : cur, strip });
+      }
+      toks.push({ word: cur });
+    }
     cur = "";
     has = false;
   };
+  const skipBodies = (from) => {
+    let at = from;
+    for (const h of heredocs.splice(0)) {
+      for (; ; ) {
+        if (at >= src.length) return src.length;
+        const nl = src.indexOf("\n", at);
+        const line = src.slice(at, nl < 0 ? src.length : nl);
+        at = nl < 0 ? src.length : nl + 1;
+        if ((h.strip ? line.replace(/^\t+/, "") : line) === h.delim) break;
+      }
+    }
+    return at;
+  };
   for (let i = 0; i < src.length; ) {
     const c = src[i];
     if (c === "'") {
@@ -1363,7 +1519,13 @@ function shellTokens(src) {
       i = j < 0 ? src.length : j;
     } else if (/\s/.test(c)) {
       flush();
-      if (c === "\n") toks.push({ op: ";" });
+      if (c === "\n") {
+        toks.push({ op: ";" });
+        if (heredocs.length) {
+          i = skipBodies(i + 1);
+          continue;
+        }
+      }
       i++;
     } else if (">|<&;()".includes(c)) {
       const op = /^(?:&>>|>>|>\||>&|&>|&&|\|\||\|&|<<<|<<|<&|[>|<&;()])/.exec(src.slice(i))[0];
@@ -1421,7 +1583,7 @@ function fileVerbOperands(command, depth = 0) {
     const t = toks[i];
     if ("op" in t) {
       if (SEPARATORS.has(t.op)) simple.push([]);
-      else if (WRITE_OPS.has(t.op) || t.op === "<" || t.op === "<<<") i++;
+      else if (WRITE_OPS.has(t.op) || t.op === "<" || t.op === "<<<" || t.op === "<<") i++;
       continue;
     }
     simple[simple.length - 1].push(t.word);
@@ -1441,6 +1603,84 @@ function fileVerbOperands(command, depth = 0) {
   }
   return out.filter((p) => p && !/[$*?{}`]/.test(p));
 }
+var DYNAMIC = /[$*?{}`]/;
+var INLINE_INTERP = /* @__PURE__ */ new Set(["node", "nodejs", "python", "python3", "perl", "ruby", "deno", "bun", "php"]);
+var INLINE_WRITE = /writeFile|appendFile|createWriteStream|copyFile|rename|unlink|rmSync|mkdir|open\s*\(|\.write\s*\(|write_text|write_bytes|shutil\.|os\.remove|File\.write|IO\.write/;
+var GIT_TREE_CHANGERS = /* @__PURE__ */ new Set(["switch", "reset", "stash", "apply", "am", "merge", "pull", "rebase", "cherry-pick", "revert", "clean"]);
+function shellWriteTargets(command, depth = 0) {
+  const out = [];
+  let unparsed = false;
+  const toks = shellTokens(command);
+  const simple = [[]];
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if ("op" in t) {
+      if (SEPARATORS.has(t.op)) simple.push([]);
+      else if (WRITE_OPS.has(t.op)) {
+        const target = toks[i + 1];
+        const w = target && "word" in target ? target.word : null;
+        if (!w || DYNAMIC.test(w)) unparsed = true;
+        else if (!DEVICE_SINK.test(w)) out.push(w);
+        i++;
+      } else if (t.op === "<" || t.op === "<<<" || t.op === "<<") i++;
+      continue;
+    }
+    simple[simple.length - 1].push(t.word);
+  }
+  const add = (ws) => {
+    for (const w of ws) {
+      if (!w) continue;
+      if (DYNAMIC.test(w)) unparsed = true;
+      else if (!DEVICE_SINK.test(w)) out.push(w);
+    }
+  };
+  for (let words of simple) {
+    while (words.length && (["sudo", "command", "exec", "time", "env", "nohup"].includes(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
+    if (!words.length) continue;
+    const verb = words[0].split("/").pop();
+    const args = words.slice(1);
+    const operands = args.filter((w) => !w.startsWith("-"));
+    if (SHELLS.has(verb)) {
+      const k = args.findIndex((w) => /^-[a-z]*c$/.test(w));
+      if (k >= 0 && args[k + 1] !== void 0) {
+        if (depth >= 2) unparsed = true;
+        else {
+          const r = shellWriteTargets(args[k + 1], depth + 1);
+          out.push(...r.paths);
+          unparsed ||= r.unparsed;
+        }
+      }
+    } else if (verb === "xargs") {
+      if (args.some((w) => FILE_VERBS.has(w) || w === "sed" || w === "perl")) unparsed = true;
+    } else if (["tee", "touch", "truncate", "rm", "unlink", "chmod", "chown"].includes(verb)) {
+      add(verb === "chmod" || verb === "chown" ? operands.slice(1) : verb === "truncate" ? args.filter((w, j) => !w.startsWith("-") && !/^-s$|^--size$/.test(args[j - 1] ?? "")) : operands);
+    } else if (verb === "cp" || verb === "install" || verb === "ln") {
+      const t = args.findIndex((w) => w === "-t" || w === "--target-directory");
+      if (t >= 0 || args.some((w) => w.startsWith("--target-directory="))) unparsed = true;
+      else if (operands.length >= 2) add([operands[operands.length - 1]]);
+    } else if (verb === "mv") add(operands);
+    else if (verb === "dd") add(args.filter((w) => w.startsWith("of=")).map((w) => w.slice(3)));
+    else if (verb === "patch") unparsed = true;
+    else if (verb === "sed" && args.some((w) => /^-[a-zA-Z]*i|^--in-place/.test(w))) {
+      const ops = args.filter((w, j) => !w.startsWith("-") && !/^-[a-zA-Z]*[ef]$|^--expression$|^--file$/.test(args[j - 1] ?? "") && !(w === "" && /^-[a-zA-Z]*i$/.test(args[j - 1] ?? "")));
+      const scripted = args.some((w) => /^-[a-zA-Z]*[ef]$|^--expression|^--file/.test(w));
+      add(scripted ? ops : ops.slice(1));
+    } else if (verb === "perl" && args.some((w) => /^-[a-zA-Z]*i/.test(w))) {
+      add(args.filter((w, j) => !w.startsWith("-") && !/^-[a-zA-Z]*e$/.test(args[j - 1] ?? "")));
+    } else if (verb === "git") {
+      const sub = args[0] ?? "";
+      if (sub === "rm" || sub === "mv") add(operands.slice(1));
+      else if (sub === "checkout" || sub === "restore") {
+        const dd = args.indexOf("--");
+        if (dd >= 0) add(args.slice(dd + 1));
+        else if (sub === "restore") add(operands.slice(1));
+        else unparsed = true;
+      } else if (GIT_TREE_CHANGERS.has(sub)) unparsed = true;
+    } else if (INLINE_INTERP.has(verb.replace(/[0-9.]+$/, "")) && args.some((w) => /^-[a-zA-Z]*[ec]$|^eval$/.test(w)) && INLINE_WRITE.test(args.join(" "))) unparsed = true;
+  }
+  if (depth === 0 && unobservable(command)) unparsed = true;
+  return { paths: [...new Set(out)], unparsed };
+}
 function deletedOperands(command, depth = 0) {
   const out = [];
   for (const t of shellTokens(command).reduce((acc, x) => ("op" in x && SEPARATORS.has(x.op) ? acc.push([]) : "word" in x && acc[acc.length - 1].push(x.word), acc), [[]])) {
@@ -1485,7 +1725,7 @@ function stripShellComments(src) {
 }
 function writeTargets(a, repoRoot2) {
   if (a.kind !== "command" || !a.command) return { inside: [], outside: [] };
-  return splitPaths(repoRoot2, redirectTargets(a.command));
+  return splitPaths(repoRoot2, [...redirectTargets(a.command), ...shellWriteTargets(a.command).paths]);
 }
 var isWrite = (a) => a.kind === "edit" || a.kind === "write";
 var outOfScopeEdit = (a, ctx) => {
@@ -1548,7 +1788,7 @@ var protectedPathModified = (a, ctx) => {
 var ASSERTION = /\b(expect|assert(?:Equal|StrictEqual|DeepEqual|True|False|Raises|That)?|should)\s*[.(]|\bassert\s+\S|\bt\.(is|not|deepEqual|equal|ok|notOk|true|false|throws|same|match)\s*\(|\.(toBe|toEqual|toStrictEqual|toMatch|toThrow|toHaveBeenCalled\w*|toContain|toHaveLength)\s*\(/g;
 var SKIP_MARK = /\b(?:it|test|describe|suite|context)\.(?:skip|only|todo)\s*\(|\b(?:xit|xtest|xdescribe|fit|fdescribe)\s*\(|@pytest\.mark\.skip|@unittest\.skip|\bt\.skip\s*\(|\bpytest\.skip\s*\(|\.skip\s*=\s*true/g;
 var FORCED_SUCCESS = /(\b(test|jest|vitest|mocha|pytest|ava|tap|go test|cargo test|npm t)\b[^\n]*(\|\|\s*(true|:|exit 0)|;\s*exit 0))/;
-var count2 = (re, s) => (s.match(re) ?? []).length;
+var count3 = (re, s) => (s.match(re) ?? []).length;
 function assertionLiterals(s) {
   return s.split("\n").filter((l) => new RegExp(ASSERTION.source).test(l)).map((l) => l.trim()).sort();
 }
@@ -1580,8 +1820,8 @@ var testWeakened = (a) => {
       severity = "block";
     }
     if (!isTestFile(ch.path)) continue;
-    const removed = count2(ASSERTION, ch.before) - count2(ASSERTION, ch.after);
-    const skipsAdded = count2(SKIP_MARK, ch.after) - count2(SKIP_MARK, ch.before);
+    const removed = count3(ASSERTION, ch.before) - count3(ASSERTION, ch.after);
+    const skipsAdded = count3(SKIP_MARK, ch.after) - count3(SKIP_MARK, ch.before);
     if (ch.before && removed > 0) {
       findings.push(`${ch.path}: ${removed} assertion${removed > 1 ? "s" : ""} removed`);
       severity = "block";
@@ -2415,12 +2655,12 @@ async function supervise(input, opts) {
 }
 
 // src/supervisor/done.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { join as join8 } from "path";
 
 // src/sandbox/scenarios.ts
 import { lstat, readdir, readFile, realpath } from "fs/promises";
-import { join as join6, relative as relative4, sep as sep2 } from "path";
+import { join as join7, relative as relative4, sep as sep2 } from "path";
 var required = (ok, file2, field) => {
   if (!ok) throw new Error(`${file2}: invalid or missing ${field}`);
 };
@@ -2463,14 +2703,14 @@ async function loadScenarios(dir, root = dir) {
   if (!inside(await realpath(dir))) throw new Error(`scenario directory ${rel(dir)} resolves outside the commit; ${NOT_REGULAR}`);
   const files = (await readdir(dir)).filter((n) => n.endsWith(".yaml") || n.endsWith(".yml")).sort();
   for (const n of files) {
-    const p = join6(dir, n);
+    const p = join7(dir, n);
     const st = await lstat(p);
     if (st.isSymbolicLink()) throw new Error(`scenario file ${rel(p)} is a symbolic link; ${NOT_REGULAR}`);
     if (!st.isFile()) throw new Error(`scenario file ${rel(p)} is not a regular file; ${NOT_REGULAR}`);
     if (!inside(await realpath(p))) throw new Error(`scenario file ${rel(p)} resolves outside the commit; ${NOT_REGULAR}`);
   }
   const scenarios = await Promise.all(files.map(async (n) => {
-    const s = parseScenario(await readFile(join6(dir, n), "utf8"), n);
+    const s = parseScenario(await readFile(join7(dir, n), "utf8"), n);
     required(n.replace(/\.ya?ml$/, "") === s.id, n, "id (must match filename)");
     return s;
   }));
@@ -2552,10 +2792,10 @@ function doneStatus(contract, sessionEvents, repoRoot2) {
   for (const d of entries) {
     if ("run" in d) need(d.run, `\`${d.run}\``, d.run);
     else {
-      const file2 = join7(".replume", "scenarios", `${d.scenario}.yaml`);
+      const file2 = join8(".replume", "scenarios", `${d.scenario}.yaml`);
       let run = null;
       try {
-        if (existsSync6(join7(repoRoot2, file2))) run = parseScenario(readFileSync7(join7(repoRoot2, file2), "utf-8"), file2).run;
+        if (existsSync7(join8(repoRoot2, file2))) run = parseScenario(readFileSync8(join8(repoRoot2, file2), "utf-8"), file2).run;
       } catch {
         run = null;
       }
@@ -2572,7 +2812,7 @@ function doneMessage(s) {
 }
 
 // src/agents/claude/payload.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
 import { isAbsolute as isAbsolute4, resolve as resolve3 } from "path";
 function parsePayload(text) {
   const x = JSON.parse(text);
@@ -2585,7 +2825,7 @@ function parsePayload(text) {
 var str = (v) => typeof v === "string" ? v : "";
 function readIfExists(path) {
   try {
-    return existsSync7(path) ? readFileSync8(path, "utf-8") : "";
+    return existsSync8(path) ? readFileSync9(path, "utf-8") : "";
   } catch {
     return "";
   }
@@ -2601,6 +2841,8 @@ function toProposedAction(p, repoRoot2) {
   let kind = "other";
   let rawPaths = [];
   let command = null;
+  let writeTargetNotParsed = false;
+  let mentioned = [];
   const pending = [];
   const abs = (fp) => isAbsolute4(fp) ? fp : resolve3(p.cwd, fp);
   switch (tool) {
@@ -2608,7 +2850,10 @@ function toProposedAction(p, repoRoot2) {
     case "PowerShell": {
       kind = "command";
       command = str(input.command);
-      rawPaths = absolutePathsIn(command);
+      const w = tool === "Bash" ? shellWriteTargets(command) : { paths: [], unparsed: false };
+      writeTargetNotParsed = w.unparsed;
+      rawPaths = w.paths.map(abs);
+      mentioned = absolutePathsIn(command);
       break;
     }
     case "Write": {
@@ -2654,13 +2899,14 @@ function toProposedAction(p, repoRoot2) {
       break;
     }
   }
-  const { inside, outside } = splitPaths(repoRoot2, rawPaths.filter(Boolean));
+  const { inside, outside: writtenOutside } = splitPaths(repoRoot2, rawPaths.filter(Boolean));
+  const outside = [.../* @__PURE__ */ new Set([...writtenOutside, ...splitPaths(repoRoot2, mentioned).outside])];
   const changes = [];
   for (const c of pending) {
     const rel = splitPaths(repoRoot2, [c.abs]).inside[0];
     if (rel !== void 0) changes.push({ path: rel, before: c.before, after: c.after });
   }
-  return { kind, tool, paths: inside, outsidePaths: outside, command, changes, fingerprint: fingerprint(tool, input) };
+  return { kind, tool, paths: [...new Set(inside)], outsidePaths: outside, command, changes, fingerprint: fingerprint(tool, input), ...writeTargetNotParsed ? { writeTargetNotParsed } : {} };
 }
 
 // src/agents/claude/handler.ts
@@ -2673,8 +2919,13 @@ function resolveRepoRoot(p, env = process.env) {
     return p.cwd;
   }
 }
+var WRITE_NOT_PARSED = "write target not parsed";
+function writeFields(a) {
+  if (a.kind !== "command") return {};
+  return { writes: a.paths, ...a.writeTargetNotParsed ? { writeNote: WRITE_NOT_PARSED } : {} };
+}
 function summarize(a) {
-  if (a.command !== null) return `${a.tool}: ${a.command}`;
+  if (a.command !== null) return `${a.tool}: ${a.command}${a.writeTargetNotParsed ? ` (${WRITE_NOT_PARSED})` : ""}`;
   const targets = [...a.paths, ...a.outsidePaths];
   return targets.length ? `${a.tool} ${targets.join(", ")}` : a.tool;
 }
@@ -2785,7 +3036,8 @@ function preToolUse(p, repoRoot2, env, deps) {
         layer: result.layer,
         layer2Mode: result.layer2.mode,
         tool_use_id: p.tool_use_id ?? null,
-        tool_input: p.tool_input ?? null
+        tool_input: p.tool_input ?? null,
+        ...writeFields(action)
       }
     });
     const rec = { p, ledger, tool: action.tool, paths: action.paths, command: action.command, target: summarize(action), contractId: contract?.id ?? null };
@@ -2886,6 +3138,7 @@ function postToolUse(p, repoRoot2, failed) {
       tool_use_id: p.tool_use_id ?? null,
       duration_ms: p.duration_ms ?? null,
       ok: !failed,
+      ...writeFields(action),
       ...failed ? {
         exitCode: exitMatch ? Number(exitMatch[1]) : null,
         isInterrupt: p.is_interrupt === true,
@@ -2913,9 +3166,9 @@ function prompt(p, repoRoot2) {
 }
 function failOpen(err, repoRoot2, env) {
   try {
-    const dir = join8(repoRoot2 ?? env.CLAUDE_PROJECT_DIR ?? process.cwd(), REPLUME_DIR);
+    const dir = join9(repoRoot2 ?? env.CLAUDE_PROJECT_DIR ?? process.cwd(), REPLUME_DIR);
     mkdirSync6(dir, { recursive: true });
-    appendFileSync3(join8(dir, "hook-errors.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${err.stack ?? err}
+    appendFileSync3(join9(dir, "hook-errors.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${err.stack ?? err}
 `);
   } catch {
   }
@@ -2955,7 +3208,7 @@ function handleClaudeHook(stdinText, env = process.env, deps = {}) {
         const contract = loadContract(contractPath(root));
         if (contract && contract.status !== "draft") captureClaudeUsage({
           repoRoot: root,
-          allowedRoot: join8(env.HOME ?? homedir2(), ".claude", "projects"),
+          allowedRoot: join9(env.HOME ?? homedir2(), ".claude", "projects"),
           transcriptPath: p.transcript_path,
           taskId: contract.id,
           sessionId: p.session_id,
@@ -3217,13 +3470,13 @@ function ruleDecisionToHookResponse(hookEventName, decision2) {
 }
 
 // src/agents/cursor/action.ts
-import { isAbsolute as isAbsolute6, join as join9 } from "path";
+import { isAbsolute as isAbsolute6, join as join10 } from "path";
 var str2 = (v) => typeof v === "string" && v.length > 0 ? v : null;
 function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
   const hook2 = str2(raw3.hook_event_name);
   const toolInput = raw3.tool_input && typeof raw3.tool_input === "object" ? raw3.tool_input : {};
   const command = str2(raw3.command) && hook2 !== "beforeMCPExecution" ? str2(raw3.command) : str2(raw3.tool_name) === "Shell" ? str2(toolInput.command) : fallback.command ?? null;
-  const abs = (p) => isAbsolute6(p) ? p : join9(repoRoot2, p);
+  const abs = (p) => isAbsolute6(p) ? p : join10(repoRoot2, p);
   const proposedPath = hook2 === "preToolUse" && /write|edit|delete/i.test(str2(raw3.tool_name) ?? "") ? str2(toolInput.file_path) : null;
   const files = [str2(raw3.file_path), proposedPath, ...fallback.paths ?? []].filter((p) => !!p).map(abs);
   const edits = Array.isArray(raw3.edits) ? raw3.edits : [];
@@ -3231,7 +3484,8 @@ function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
   if (command) kind = "command";
   else if (edits.length || hook2 === "afterFileEdit" || hook2 === "afterTabFileEdit" || /write|edit|delete/i.test(fallback.tool ?? "")) kind = "edit";
   else if (hook2 === "beforeReadFile" || hook2 === "beforeTabFileRead" || /read|grep/i.test(fallback.tool ?? "")) kind = "read";
-  const { inside, outside } = splitPaths(repoRoot2, [...new Set(files)]);
+  const w = kind === "command" && command ? shellWriteTargets(command) : null;
+  const { inside, outside } = splitPaths(repoRoot2, w ? w.paths.map(abs) : [...new Set(files)]);
   const changes = kind === "edit" && inside.length && edits.length ? [
     {
       path: inside[0],
@@ -3247,7 +3501,8 @@ function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
     outsidePaths: outside,
     command,
     changes,
-    fingerprint: fingerprint(tool, { files: inside, command, edits })
+    fingerprint: fingerprint(tool, { files: inside, command, edits }),
+    ...w?.unparsed ? { writeTargetNotParsed: true } : {}
   };
 }
 
@@ -3272,12 +3527,14 @@ function handleCursorHook(stdinText, env = process.env) {
       action: evaluation?.action ?? "ok",
       message: evaluation?.message ?? null
     };
+    const writes = action.kind === "command" ? { writes: action.paths, ...action.writeTargetNotParsed ? { writeNote: "write target not parsed" } : {} } : {};
     appendEvent(ledger, sanitizeCursorLedgerEvent({
       ...event,
+      ...action.kind === "command" ? { paths: action.paths } : {},
       rule: decision2.rule,
       action: decision2.action,
       message: decision2.message,
-      raw: { ...event.raw, fingerprint: action.fingerprint }
+      raw: { ...event.raw, fingerprint: action.fingerprint, ...writes }
     }, root));
     for (const hit of evaluation?.hits ?? []) {
       appendEvent(ledger, sanitizeCursorLedgerEvent(ruleHitEvent(event, hit, { id: newEventId(), ts: (/* @__PURE__ */ new Date()).toISOString() }), root));
@@ -3291,8 +3548,8 @@ function handleCursorHook(stdinText, env = process.env) {
 
 // src/agents/cursor/install.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync9, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, join as join11 } from "path";
 var CURSOR_HOOK_COMMAND = "replume hook cursor";
 var CURSOR_HOOK_EVENTS = [
   "preToolUse",
@@ -3308,7 +3565,7 @@ var CURSOR_HOOK_EVENTS = [
 ];
 var hash = (text) => createHash2("sha256").update(text).digest("hex");
 var isObject = (x) => !!x && typeof x === "object" && !Array.isArray(x);
-var cursorHooksPath = (root) => join10(root, ".cursor", "hooks.json");
+var cursorHooksPath = (root) => join11(root, ".cursor", "hooks.json");
 var backupPathFor = (path) => `${path}.replume-backup`;
 var statePathFor = (path) => `${path}.replume-state.json`;
 function parseConfig(text, path) {
@@ -3332,17 +3589,17 @@ function exactInstalledEntry(x, command) {
 function validateCursorHooksConfig(root, opts = {}) {
   const path = cursorHooksPath(root);
   const command = opts.command ?? CURSOR_HOOK_COMMAND;
-  const config = existsSync8(path) ? parseConfig(readFileSync9(path, "utf8"), path) : {};
+  const config = existsSync9(path) ? parseConfig(readFileSync10(path, "utf8"), path) : {};
   const hooks = config.hooks ?? {};
   for (const event of CURSOR_HOOK_EVENTS) {
     if (hooks[event] !== void 0 && !Array.isArray(hooks[event]))
       throw new Error(`${path}.hooks.${event} is not an array; nothing was changed. Fix it and run replume init again.`);
   }
   const statePath = statePathFor(path);
-  if (existsSync8(statePath)) {
+  if (existsSync9(statePath)) {
     let state;
     try {
-      state = JSON.parse(readFileSync9(statePath, "utf8"));
+      state = JSON.parse(readFileSync10(statePath, "utf8"));
     } catch {
       throw new Error(`${statePath} is not valid JSON; nothing was changed. Fix it and run replume init again.`);
     }
@@ -3354,9 +3611,9 @@ function installCursorHooks(root, opts = {}) {
   const path = cursorHooksPath(root);
   const backupPath = backupPathFor(path);
   const statePath = statePathFor(path);
-  const hadOriginal = existsSync8(path);
+  const hadOriginal = existsSync9(path);
   const command = opts.command ?? CURSOR_HOOK_COMMAND;
-  const original = hadOriginal ? readFileSync9(path, "utf8") : null;
+  const original = hadOriginal ? readFileSync10(path, "utf8") : null;
   const config = original === null ? {} : parseConfig(original, path);
   const hooks = { ...config.hooks ?? {} };
   const added = [];
@@ -3368,14 +3625,14 @@ function installCursorHooks(root, opts = {}) {
       added.push(event);
     }
   }
-  if (!added.length) return { path, backupPath: existsSync8(backupPath) ? backupPath : null, added };
+  if (!added.length) return { path, backupPath: existsSync9(backupPath) ? backupPath : null, added };
   const updated = JSON.stringify({ ...config, version: 1, hooks }, null, 2) + "\n";
-  mkdirSync7(dirname4(path), { recursive: true });
-  if (!existsSync8(statePath)) {
+  mkdirSync7(dirname5(path), { recursive: true });
+  if (!existsSync9(statePath)) {
     if (original !== null) writeFileSync5(backupPath, original, { flag: "wx" });
     writeFileSync5(statePath, JSON.stringify({ hadOriginal, installedHash: hash(updated), added, command }) + "\n", { flag: "wx" });
   } else {
-    const state = JSON.parse(readFileSync9(statePath, "utf8"));
+    const state = JSON.parse(readFileSync10(statePath, "utf8"));
     if (state.command !== command) throw new Error(`Cursor hooks already installed with a different command; uninstall first`);
     state.added = [.../* @__PURE__ */ new Set([...state.added, ...added])];
     state.installedHash = hash(updated);
@@ -3384,20 +3641,20 @@ function installCursorHooks(root, opts = {}) {
   const temp = `${path}.replume-tmp`;
   writeFileSync5(temp, updated);
   renameSync(temp, path);
-  return { path, backupPath: existsSync8(backupPath) ? backupPath : null, added };
+  return { path, backupPath: existsSync9(backupPath) ? backupPath : null, added };
 }
 function uninstallCursorHooks(root) {
   const path = cursorHooksPath(root);
   const backupPath = backupPathFor(path);
   const statePath = statePathFor(path);
-  if (!existsSync8(statePath)) return { restored: false, path };
-  const state = JSON.parse(readFileSync9(statePath, "utf8"));
-  const current = existsSync8(path) ? readFileSync9(path, "utf8") : null;
+  if (!existsSync9(statePath)) return { restored: false, path };
+  const state = JSON.parse(readFileSync10(statePath, "utf8"));
+  const current = existsSync9(path) ? readFileSync10(path, "utf8") : null;
   const unchanged = current !== null && hash(current) === state.installedHash;
   if (unchanged) {
     if (state.hadOriginal) {
-      if (!existsSync8(backupPath)) throw new Error(`Cursor hook backup missing: ${backupPath}`);
-      writeFileSync5(path, readFileSync9(backupPath));
+      if (!existsSync9(backupPath)) throw new Error(`Cursor hook backup missing: ${backupPath}`);
+      writeFileSync5(path, readFileSync10(backupPath));
     } else rmSync2(path);
   } else if (current !== null) {
     const config = parseConfig(current, path);
@@ -3417,16 +3674,16 @@ function uninstallCursorHooks(root) {
   }
   rmSync2(statePath);
   if (unchanged) rmSync2(backupPath, { force: true });
-  return { restored: true, path, backupRetained: !unchanged && existsSync8(backupPath) };
+  return { restored: true, path, backupRetained: !unchanged && existsSync9(backupPath) };
 }
 
 // src/agents/claude/install.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join11 } from "path";
+import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join12 } from "path";
 var DEFAULT_HOOK_COMMAND = "replume hook claude";
 var HOOK_EVENTS = ["PreToolUse", "PostToolUse", "PostToolUseFailure", "UserPromptSubmit", "Stop", "SessionEnd"];
 function claudeSettingsPath(repoRoot2) {
-  return join11(repoRoot2, ".claude", "settings.json");
+  return join12(repoRoot2, ".claude", "settings.json");
 }
 var isReplume = (h, command) => typeof h.command === "string" && (h.command === command || /(^|\s)hook claude\s*$/.test(h.command));
 function mergeHooks(settings, command = DEFAULT_HOOK_COMMAND) {
@@ -3455,8 +3712,8 @@ function installClaudeHooks(repoRoot2, opts = {}) {
   const settingsPath = claudeSettingsPath(repoRoot2);
   let current = {};
   let original = null;
-  if (existsSync9(settingsPath)) {
-    original = readFileSync10(settingsPath, "utf-8");
+  if (existsSync10(settingsPath)) {
+    original = readFileSync11(settingsPath, "utf-8");
     try {
       const parsed = original.trim() ? JSON.parse(original) : {};
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not a JSON object");
@@ -3473,7 +3730,7 @@ function installClaudeHooks(repoRoot2, opts = {}) {
       backupPath = `${settingsPath}.replume-backup-${stamp}`;
       copyFileSync2(settingsPath, backupPath);
     }
-    mkdirSync8(dirname5(settingsPath), { recursive: true });
+    mkdirSync8(dirname6(settingsPath), { recursive: true });
     writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   }
   return { settingsPath, backupPath, added, alreadyPresent };
@@ -3482,12 +3739,12 @@ function installClaudeHooks(repoRoot2, opts = {}) {
 // src/agents/claude/replay-hooks.ts
 import { mkdtempSync, mkdirSync as mkdirSync9, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 var REPLAY_HOOKS_BANNER = "HOOK PAYLOAD REPLAY. Each line is a Claude Code hook payload run through Replume's live hook handler in a temporary project.\nThis shows Replume's answers to these payloads; it does not show a live agent receiving or following them.";
 async function replayHooks(content, opts = {}) {
-  const repo = mkdtempSync(join12(tmpdir2(), "replume-replay-hooks-"));
+  const repo = mkdtempSync(join13(tmpdir2(), "replume-replay-hooks-"));
   try {
-    mkdirSync9(join12(repo, ".replume"), { recursive: true });
+    mkdirSync9(join13(repo, ".replume"), { recursive: true });
     if (opts.contractYaml) writeFileSync7(contractPath(repo), opts.contractYaml);
     const env = { REPLUME_JUDGE: "off", ...opts.env, CLAUDE_PROJECT_DIR: repo };
     const steps = [];
@@ -3519,9 +3776,9 @@ async function replayHooks(content, opts = {}) {
 
 // src/core/init.ts
 import { execFileSync as execFileSync7 } from "child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "fs";
+import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join14 } from "path";
+import { delimiter, join as join15 } from "path";
 
 // src/core/capabilities.ts
 var CAPABILITIES = [
@@ -3578,8 +3835,8 @@ function renderCapabilities(caps = CAPABILITIES, detected = {}) {
 // src/core/baseline.ts
 import { createHash as createHash3 } from "crypto";
 import { execFileSync as execFileSync6 } from "child_process";
-import { appendFileSync as appendFileSync4, existsSync as existsSync10, lstatSync, readFileSync as readFileSync11, readdirSync, readlinkSync, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname6, join as join13 } from "path";
+import { appendFileSync as appendFileSync4, existsSync as existsSync11, lstatSync, readFileSync as readFileSync12, readdirSync, readlinkSync, writeFileSync as writeFileSync8 } from "fs";
+import { dirname as dirname7, join as join14 } from "path";
 var BASELINE_FILE = "baseline.json";
 var DEFAULT_REPLUME_GITIGNORE = `events.jsonl
 reports/
@@ -3598,15 +3855,15 @@ function hashTree(dir) {
   const walk = (abs, rel) => {
     for (const name of readdirSync(abs).sort()) {
       if (IGNORED_NAMES.has(name)) continue;
-      const p = join13(abs, name);
+      const p = join14(abs, name);
       const r = rel ? `${rel}/${name}` : name;
       const st = lstatSync(p);
       if (st.isSymbolicLink()) out[r] = sha256(`symlink:${readlinkSync(p)}`);
       else if (st.isDirectory()) walk(p, r);
-      else if (st.isFile()) out[r] = sha256(readFileSync11(p));
+      else if (st.isFile()) out[r] = sha256(readFileSync12(p));
     }
   };
-  if (existsSync10(dir)) {
+  if (existsSync11(dir)) {
     try {
       if (lstatSync(dir).isDirectory()) walk(dir, "");
     } catch {
@@ -3621,14 +3878,14 @@ function headCommit(repoRoot2) {
     return null;
   }
 }
-var baselinePath = (contractPath2) => join13(dirname6(contractPath2), BASELINE_FILE);
+var baselinePath = (contractPath2) => join14(dirname7(contractPath2), BASELINE_FILE);
 function ensureBaselineIgnored(replumeDir) {
-  const gi = join13(replumeDir, ".gitignore");
-  if (!existsSync10(gi)) {
+  const gi = join14(replumeDir, ".gitignore");
+  if (!existsSync11(gi)) {
     writeFileSync8(gi, DEFAULT_REPLUME_GITIGNORE);
     return;
   }
-  const text = readFileSync11(gi, "utf-8");
+  const text = readFileSync12(gi, "utf-8");
   if (text.split(/\r?\n/).some((l) => l.trim() === BASELINE_FILE)) return;
   appendFileSync4(gi, `${text === "" || text.endsWith("\n") ? "" : "\n"}${BASELINE_FILE}
 `);
@@ -3640,12 +3897,12 @@ function recordBaseline(opts) {
     contract_id: opts.contractId,
     recorded_at: (opts.now ?? /* @__PURE__ */ new Date()).toISOString(),
     base_commit: headCommit(opts.repoRoot),
-    policy_hash: sha256(readFileSync11(opts.contractPath)),
-    scenario_hashes: hashTree(opts.scenariosDir ?? join13(dirname6(opts.contractPath), SCENARIOS_SUBDIR)),
+    policy_hash: sha256(readFileSync12(opts.contractPath)),
+    scenario_hashes: hashTree(opts.scenariosDir ?? join14(dirname7(opts.contractPath), SCENARIOS_SUBDIR)),
     ...opts.preflight ? { preflight: opts.preflight } : {}
   };
   writeFileSync8(path, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
-  ensureBaselineIgnored(dirname6(opts.contractPath));
+  ensureBaselineIgnored(dirname7(opts.contractPath));
   return { path, baseline };
 }
 var isHash = (x) => typeof x === "string" && /^[0-9a-f]{64}$/.test(x);
@@ -3666,10 +3923,10 @@ function validateBaseline(x) {
   return p;
 }
 function readBaseline(path) {
-  if (!existsSync10(path)) return { status: "absent" };
+  if (!existsSync11(path)) return { status: "absent" };
   let raw3;
   try {
-    raw3 = JSON.parse(readFileSync11(path, "utf-8"));
+    raw3 = JSON.parse(readFileSync12(path, "utf-8"));
   } catch (e) {
     return { status: "unreadable", detail: e.message };
   }
@@ -3709,19 +3966,32 @@ function onPath(bin) {
     return false;
   }
 }
+function launchedThroughNpx() {
+  return process.env.npm_command === "exec" || (process.env.PATH ?? "").split(delimiter).some((entry) => entry.split(/[\\/]/).includes("_npx"));
+}
+function gitIdentity(repoRoot2, key) {
+  try {
+    return execFileSync7("git", ["-C", repoRoot2, "config", "--get", key], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim().length > 0;
+  } catch {
+    return false;
+  }
+}
 function detectAgents(repoRoot2, home = homedir3()) {
   return {
-    "Claude Code": onPath("claude") || existsSync11(join14(repoRoot2, ".claude")) || existsSync11(join14(home, ".claude")),
-    Cursor: onPath("cursor") || existsSync11(join14(repoRoot2, ".cursor")) || existsSync11(join14(home, ".cursor")),
-    Codex: onPath("codex") || existsSync11(join14(home, ".codex"))
+    "Claude Code": onPath("claude") || existsSync12(join15(repoRoot2, ".claude")) || existsSync12(join15(home, ".claude")),
+    Cursor: onPath("cursor") || existsSync12(join15(repoRoot2, ".cursor")) || existsSync12(join15(home, ".cursor")),
+    Codex: onPath("codex") || existsSync12(join15(home, ".codex"))
   };
 }
 function runInit(repoRoot2, opts = {}) {
   const lines = [];
-  const dir = join14(repoRoot2, REPLUME_DIR);
-  mkdirSync10(join14(dir, "scenarios"), { recursive: true });
-  const gi = join14(dir, ".gitignore");
-  if (!existsSync11(gi)) {
+  const dir = join15(repoRoot2, REPLUME_DIR);
+  mkdirSync10(join15(dir, "scenarios"), { recursive: true });
+  const gi = join15(dir, ".gitignore");
+  if (!existsSync12(gi)) {
     writeFileSync9(gi, DEFAULT_REPLUME_GITIGNORE);
   }
   lines.push(`\u2713 ${REPLUME_DIR}/ ready (scenarios/ for team scenarios; ledger and reports are git-ignored)`);
@@ -3734,11 +4004,14 @@ function runInit(repoRoot2, opts = {}) {
       lines.push(`\u2713 Claude Code hooks added to .claude/settings.json: ${claude.added.join(", ")}`);
       if (claude.backupPath) lines.push(`  backup of your previous settings: ${claude.backupPath}`);
     } else lines.push("\u2713 Claude Code hooks already present (nothing changed)");
-    if (!opts.hookCommand && !onPath("replume")) {
-      lines.push("! `replume` is not on PATH, so the hooks will fail (Claude Code then continues without them).");
-      lines.push("  Install the published command with `npm i -g replume-cli`, then re-run `replume init`.");
-    }
   } else lines.push("- Claude Code not found: no hooks written");
+  const npx = launchedThroughNpx();
+  const persistentCommand = !npx && onPath("replume");
+  const defaultHooks = detected["Claude Code"] && !opts.hookCommand || opts.cursorHooks && !opts.cursorHookCommand;
+  if (defaultHooks && !persistentCommand) {
+    lines.push(npx ? "! `replume` is not guaranteed on PATH for later agent hooks: npx's temporary PATH entry does not persist, so those hooks may fail." : "! `replume` is not on PATH, so the hooks will fail (the agent then continues without them).");
+    lines.push("  Install the persistent command with `npm install -g replume-cli`, then re-run `replume init`.");
+  }
   for (const c of CAPABILITIES.filter((x) => !x.installedByInit)) {
     if (detected[c.agent]) lines.push(`- ${c.agent} found, but replume init does not install its hooks yet (${c.observe})`);
   }
@@ -3746,15 +4019,18 @@ function runInit(repoRoot2, opts = {}) {
   lines.push("Capability matrix");
   lines.push(renderCapabilities(CAPABILITIES, detected));
   lines.push("");
-  lines.push('Next: replume draft --task "<what you asked the agent>"; review .replume/contract.yaml, then run `replume confirm`.');
-  lines.push('To make commits, Git needs an identity in this repository: `git config user.name "Your Name"` and `git config user.email "you@example.com"`.');
+  const draftCommand = persistentCommand ? "replume draft" : "npm install -g replume-cli && replume draft";
+  lines.push(`Next: ${draftCommand} --task "<what you asked the agent>"; review .replume/contract.yaml, then run \`replume confirm\`.`);
+  lines.push("  Scenarios are optional (D-062): verify can PASS when the contract's test_command runs at least one test and passes, nothing is EXTRA or TAMPERING, and the hooks record the agent changing each file. A scenario in .replume/scenarios/ adds a stated behaviour check.");
+  if (!gitIdentity(repoRoot2, "user.name")) lines.push('To make commits, set Git user.name: `git config user.name "Your Name"`.');
+  if (!gitIdentity(repoRoot2, "user.email")) lines.push('To make commits, set Git user.email: `git config user.email "you@example.com"`.');
   return { lines, claude };
 }
 
 // src/core/draft.ts
 import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync12, lstatSync as lstatSync2, readFileSync as readFileSync12 } from "fs";
-import { join as join15, posix } from "path";
+import { existsSync as existsSync13, lstatSync as lstatSync2, readFileSync as readFileSync13 } from "fs";
+import { join as join16, posix } from "path";
 var LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb", "poetry.lock", "Pipfile.lock", "uv.lock", "Cargo.lock", "go.sum", "Gemfile.lock", "composer.lock"];
 var CI_CONFIG = [
   [".github/workflows/**", /^\.github\/workflows\//],
@@ -3779,13 +4055,13 @@ function trackedFiles(repoRoot2) {
 }
 var read = (repoRoot2, rel) => {
   try {
-    return readFileSync12(join15(repoRoot2, rel), "utf-8");
+    return readFileSync13(join16(repoRoot2, rel), "utf-8");
   } catch {
     return "";
   }
 };
 function detectTestCommand(repoRoot2, files) {
-  const has = (f) => files.includes(f) || existsSync12(join15(repoRoot2, f));
+  const has = (f) => files.includes(f) || existsSync13(join16(repoRoot2, f));
   if (has("package.json")) {
     let script;
     try {
@@ -3815,10 +4091,10 @@ function draftContract(input) {
   const t = detectTestCommand(input.repoRoot, files);
   notes.push(t.command ? `test_command "${t.command}": ${t.reason}` : `test_command: none (${t.reason})`);
   const scenarios = files.filter((f) => /^\.replume\/scenarios\/[^/]+\.ya?ml$/.test(f)).flatMap((f) => {
-    const path = join15(input.repoRoot, f);
+    const path = join16(input.repoRoot, f);
     try {
       if (!lstatSync2(path).isFile() || lstatSync2(path).isSymbolicLink()) return [];
-      const s = parseScenario(readFileSync12(path, "utf8"), f);
+      const s = parseScenario(readFileSync13(path, "utf8"), f);
       return [s.id === posix.basename(f).replace(/\.ya?ml$/, "") ? s : null].filter((x) => x !== null);
     } catch {
       notes.push(`must_check: skipped invalid scenario ${f}; fix it before verification`);
@@ -3911,7 +4187,7 @@ import { randomUUID } from "crypto";
 import { rmSync as rmSync4 } from "fs";
 import { chmod, cp, lstat as lstat2, mkdtemp, readdir as readdir2, rm, writeFile } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename2, join as join16 } from "path";
+import { basename as basename2, join as join17 } from "path";
 import { performance } from "perf_hooks";
 var DEFAULT_DOCKER_IMAGE = "node:20-bookworm-slim";
 var DOCKER_PROBE_TIMEOUT_MS = 2e4;
@@ -3991,6 +4267,8 @@ function dockerCli(binary, args, timeoutMs) {
     }, timeoutMs);
   });
 }
+var commandStartMarker = (name) => `__replume_command_start_${name}__`;
+var DOCKER_STARTUP_TIMEOUT_SEC = 120;
 function buildDockerRunArgs(input) {
   const uid = process.getuid?.() ?? 1e3, gid = process.getgid?.() ?? 1e3;
   return [
@@ -4026,11 +4304,14 @@ function buildDockerRunArgs(input) {
     "--env",
     "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
     ...Object.entries(input.labels ?? {}).flatMap(([k, v]) => ["--label", `${k}=${v}`]),
+    // the marker, then exactly the old `sh -lc <command>` (passed as an argument, never spliced into this script)
     "--workdir",
     "/repo",
     input.image,
     "sh",
-    "-lc",
+    "-c",
+    `printf '%s\\n' ${commandStartMarker(input.name)} >&2; exec sh -lc "$1"`,
+    "replume-scenario",
     input.command
   ];
 }
@@ -4047,11 +4328,11 @@ async function sweepStaleStaging(tmpRoot = tmpdir3(), now = Date.now()) {
   }
   for (const n of names) {
     if (!n.startsWith(STAGING_PREFIX)) continue;
-    const dir = join16(tmpRoot, n);
+    const dir = join17(tmpRoot, n);
     try {
       const st = await lstat2(dir);
       if (st.isSymbolicLink() || !st.isDirectory()) continue;
-      const marker = await lstat2(join16(dir, STAGING_MARKER));
+      const marker = await lstat2(join17(dir, STAGING_MARKER));
       if (!marker.isFile() || now - marker.mtimeMs < STALE_AFTER_MS) continue;
       await rm(dir, { recursive: true, force: true });
       removed.push(dir);
@@ -4088,44 +4369,57 @@ async function runDockerScenario(input) {
   const binary = input.dockerBinary ?? "docker";
   const tmpRoot = input.tmpRoot ?? tmpdir3();
   await sweepStaleStaging(tmpRoot);
-  const temp = await mkdtemp(join16(tmpRoot, STAGING_PREFIX));
-  const staged = join16(temp, "repo");
+  const temp = await mkdtemp(join17(tmpRoot, STAGING_PREFIX));
+  const staged = join17(temp, "repo");
   const name = `replume-${randomUUID()}`;
   active.set(temp, { binary, name });
   attachSignals();
   try {
-    await writeFile(join16(temp, STAGING_MARKER), JSON.stringify({ by: "replume", pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n");
+    await writeFile(join17(temp, STAGING_MARKER), JSON.stringify({ by: "replume", pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n");
     await cp(input.root, staged, { recursive: true, filter: (path) => basename2(path) !== ".git" });
     if (process.getuid?.() === 0) await chmod(temp, 493);
     const args = buildDockerRunArgs({ name, image: input.image ?? DEFAULT_DOCKER_IMAGE, source: staged, command: input.command, labels: input.labels });
     return await new Promise((resolve7) => {
       const child = spawn2(binary, args, { env: cliEnv(), stdio: ["ignore", "pipe", "pipe"] });
-      let stdout = "", stderr = "", timedOut = false, settled = false;
+      const marker = `${commandStartMarker(name)}
+`;
+      let stdout = "", stderr = "", timedOut = false, settled = false, commandStarted = false;
+      let timer;
       const finish = (exitCode) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
         resolve7({ stdout, stderr, exitCode, timedOut, durationMs: Math.round(performance.now() - started) });
       };
+      const expire = (note) => async () => {
+        timedOut = true;
+        if (note) stderr += note;
+        const removed = await dockerCli(binary, ["rm", "--force", name], 1e4);
+        if (removed.code !== 0) stderr += `
+Docker timeout cleanup: ${removed.stderr.trim()}`;
+        child.kill("SIGKILL");
+        finish(null);
+      };
       child.stdout.on("data", (chunk) => {
         stdout += chunk.toString();
       });
       child.stderr.on("data", (chunk) => {
         stderr += chunk.toString();
+        if (!commandStarted && stderr.includes(marker)) {
+          commandStarted = true;
+          stderr = stderr.replace(marker, "");
+          clearTimeout(timer);
+          timer = setTimeout(expire(""), input.timeoutSec * 1e3);
+        }
       });
       child.on("error", (error) => {
         stderr += error.message;
         finish(null);
       });
       child.on("close", finish);
-      const timer = setTimeout(async () => {
-        timedOut = true;
-        const removed = await dockerCli(binary, ["rm", "--force", name], 1e4);
-        if (removed.code !== 0) stderr += `
-Docker timeout cleanup: ${removed.stderr.trim()}`;
-        child.kill("SIGKILL");
-        finish(null);
-      }, input.timeoutSec * 1e3);
+      const startup = input.startupTimeoutSec ?? DOCKER_STARTUP_TIMEOUT_SEC;
+      timer = setTimeout(expire(`
+Docker container did not start the scenario command within ${startup}s (start-up limit; timeout_sec counts from the command start)`), startup * 1e3);
     });
   } finally {
     try {
@@ -4151,7 +4445,7 @@ import { performance as performance3 } from "perf_hooks";
 import { spawn as spawn3 } from "child_process";
 import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 import { performance as performance2 } from "perf_hooks";
 async function git(cwd, args) {
   return new Promise((resolve7, reject) => {
@@ -4168,9 +4462,9 @@ async function git(cwd, args) {
   });
 }
 async function withWorkingCopy(repo, commit, keep, fn) {
-  const temp = await mkdtemp2(join17(tmpdir4(), "replume-copy-"));
-  const root = join17(temp, "repo");
-  const home = join17(temp, "home");
+  const temp = await mkdtemp2(join18(tmpdir4(), "replume-copy-"));
+  const root = join18(temp, "repo");
+  const home = join18(temp, "home");
   let added = false;
   try {
     await git(repo, ["worktree", "add", "--detach", root, commit]);
@@ -4301,10 +4595,22 @@ function buildReport(input) {
     extra.push({ path: l.file, reason: `lockfile adds ${l.names.length} package${l.names.length === 1 ? "" : "s"} with no new direct dependency: ${l.names.slice(0, 10).join(", ")}${l.names.length > 10 ? ", \u2026" : ""}` });
   const ran = new Set(input.results.filter((r) => !["not_run", "error"].includes(r.status)).map((r) => r.id));
   const claims = scenarios.filter((s) => ran.has(s.id)).flatMap((s) => s.declared_covers);
-  const notChecked = paths.filter((p) => !matches(claims, p)).map((path) => ({
-    path,
-    reason: input.draft ? "changed in diff; the contract is an unconfirmed draft, so its policy was not applied (run `replume confirm`); no scenario declares coverage among scenarios that ran" : "changed in diff; no scenario declares coverage among scenarios that ran"
-  }));
+  const testsPassed = !input.draft && input.testCommand?.status === "passed";
+  const obs = input.observation;
+  const named = new Set(obs?.namedPaths ?? []);
+  const reasonFor = (path) => {
+    if (input.draft) return "changed in diff; the contract is an unconfirmed draft, so its policy was not applied (run `replume confirm`); no scenario declares coverage among scenarios that ran";
+    if (!testsPassed) return `changed in diff; no scenario declares coverage, and ${!contract.test_command ? "the contract has no test_command" : "test_command did not pass with at least one test"}`;
+    if (!obs || obs.sessions === 0) return "changed in diff; no scenario declares coverage; agent steps not observed (no agent session for this task in the ledger)";
+    if (!named.has(path)) return "changed in diff; no scenario declares coverage; change not seen by hooks (no ledger event records a write to this file)";
+    return null;
+  };
+  const uncovered = paths.filter((p) => !matches(claims, p));
+  const notChecked = uncovered.flatMap((path) => {
+    const reason = reasonFor(path);
+    return reason ? [{ path, reason }] : [];
+  });
+  const observedOnly = uncovered.filter((p) => reasonFor(p) === null).map((path) => ({ path, reason: "checked by test_command and observed steps; no scenario" }));
   const failed = results.filter((r) => r.status !== "passed" && r.status !== "unconfirmed").map((r) => ({ id: r.id, evidence: r.expectationFailures.join("; ") || r.status }));
   const evidenceFor = (r) => {
     if (r.id === TEST_COMMAND_ID) return `\`${contract.test_command}\` exit ${r.exitCode}`;
@@ -4332,7 +4638,7 @@ function buildReport(input) {
   const checks = [
     emptyDiff ? { name: "scope", status: "not_run", detail: `empty diff, nothing compared: base ${base3.slice(0, 7)} and commit ${commit.slice(0, 7)} have no differences` } : input.draft ? { name: "scope", status: "not_run", detail: "contract is an unconfirmed draft, so its allow globs were not applied" } : contract.allow.length ? { name: "scope", status: "done", detail: `${n(paths.length, "changed file")} compared with allow globs, ${outsideAllow} outside` } : { name: "scope", status: "not_run", detail: "contract has no allow globs, so changes outside the task were not checked" },
     { name: "tampering", status: "done", detail: `${n(testFiles, "changed test file")} inspected for removed assertions, skip/only and forced success; ${input.draft ? "protect globs of the unconfirmed draft not applied" : n(contract.protect.length, "protect glob")}; .replume/ changes` },
-    !input.testCommand ? { name: "test_command", status: "not_run", detail: input.draft ? "contract is an unconfirmed draft, so its test_command was not run" : "contract lists no test_command" } : input.testCommand.status === "unconfirmed" ? { name: "test_command", status: "unconfirmed", detail: `\`${contract.test_command}\` exit ${input.testCommand.exitCode}; ${input.testCommand.expectationFailures.join("; ")}` } : input.testCommand.status === "passed" ? { name: "test_command", status: "done", detail: `\`${contract.test_command}\` exit 0 (declares no coverage)` } : { name: "test_command", status: "failed", detail: `\`${contract.test_command}\` ${input.testCommand.expectationFailures.join("; ") || input.testCommand.status}` },
+    !input.testCommand ? { name: "test_command", status: "not_run", detail: input.draft ? "contract is an unconfirmed draft, so its test_command was not run" : "contract lists no test_command" } : input.testCommand.status === "unconfirmed" ? { name: "test_command", status: "unconfirmed", detail: `\`${contract.test_command}\` exit ${input.testCommand.exitCode}; ${input.testCommand.expectationFailures.join("; ")}` } : input.testCommand.status === "passed" ? { name: "test_command", status: "done", detail: `\`${contract.test_command}\` exit 0 (declares no coverage by itself; with observed agent steps it checks changed files no scenario declares, D-062)` } : { name: "test_command", status: "failed", detail: `\`${contract.test_command}\` ${input.testCommand.expectationFailures.join("; ") || input.testCommand.status}` },
     scenarioRuns.length ? { name: "scenarios", status: scenarioRuns.every((r) => r.status === "passed") ? "done" : "failed", detail: `${n(scenarioRuns.length, "scenario")} ran` } : { name: "scenarios", status: "not_run", detail: scenarios.length ? "no scenario ran" : "no scenario files at this commit" },
     ...input.baselineCheck ? [input.baselineCheck] : [],
     ...deps ? [dependencyCheck(deps)] : [],
@@ -4355,6 +4661,7 @@ function buildReport(input) {
     extra: lv(extra, () => "verified_here"),
     tampering: lv(tampering, (t) => RECORDED.has(t.rule) ? "observed" : "verified_here"),
     notChecked: lv(notChecked, () => "unknown"),
+    ...observedOnly.length ? { observedOnly: lv(observedOnly, () => "observed") } : {},
     scenarios: [...results, ...doneRuns],
     baseCommit: base3,
     ...input.baseSource ? { baseSource: input.baseSource } : {},
@@ -4590,134 +4897,6 @@ async function checkRegistry(d, fetcher, timeoutMs = REGISTRY_TIMEOUT_MS) {
 }
 var dependencyAllowed = (name, allow) => !!allow?.length && matchesAny(name, allow) !== null;
 
-// src/core/capture.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
-var EXPECTED_TYPES = ["prompt", "tool_pre", "command", "stop"];
-var SHOWN_PATHS = 5;
-var count3 = (m, k) => {
-  m[k] = (m[k] ?? 0) + 1;
-};
-var HOOK_CRASH = "hook-errors.log exists: at least one hook crashed, so some steps may not have been recorded";
-function captureCoverage(eventsFile, changedPaths, hooksConfigured = false) {
-  const absence = hooksConfigured ? "Replume project hooks are configured, but no hook events were recorded; agent steps and scope were not observed" : "no Replume project hooks were found; agent steps and scope were not observed";
-  const empty = (ledger, notes) => ({
-    ledger,
-    hooksConfigured,
-    events: 0,
-    sessions: 0,
-    agents: [],
-    byType: {},
-    tools: {},
-    firstTs: null,
-    lastTs: null,
-    badLines: 0,
-    hookErrorsLogged: hookErrors(eventsFile),
-    changedFiles: changedPaths.length,
-    changedFilesSeen: 0,
-    changedFilesLanded: 0,
-    changedFilesAttemptedOnly: [],
-    changedFilesNotSeen: changedPaths.slice(0, SHOWN_PATHS),
-    unobservableCommands: 0,
-    // a hook that crashed on every call leaves no ledger: say so here too, not only in the JSON flag
-    notSeen: hookErrors(eventsFile) ? [...notes, HOOK_CRASH] : notes
-  });
-  if (!existsSync13(eventsFile)) {
-    return empty("absent", [`no ledger file: ${absence}`]);
-  }
-  const text = readFileSync13(eventsFile, "utf-8");
-  const { events, badLines } = parseEvents(text);
-  if (!events.length) {
-    return empty("empty", [
-      badLines.length ? `the ledger has ${badLines.length} line(s) but none is a valid event` : `the ledger is empty: ${absence}`
-    ]);
-  }
-  const byType = {};
-  const tools = {};
-  const seenPaths = /* @__PURE__ */ new Set();
-  const landedPaths = /* @__PURE__ */ new Set();
-  const blockedPaths = /* @__PURE__ */ new Set();
-  for (const e of events) {
-    count3(byType, e.type);
-    if (e.type === "tool_pre" && e.tool) count3(tools, e.tool);
-    const blocked = e.action === "block" && e.type !== "file_edit" && e.type !== "command";
-    const landed = e.type === "file_edit" || e.type === "command" && e.raw?.ok !== false;
-    for (const p of e.paths) {
-      if (blocked) blockedPaths.add(p);
-      else seenPaths.add(p);
-      if (landed) landedPaths.add(p);
-    }
-  }
-  const ts = events.map((e) => e.ts).sort();
-  const notSeen = [];
-  const missing = EXPECTED_TYPES.filter((t) => !byType[t]);
-  if (missing.length) notSeen.push(`no ${missing.join(", ")} events`);
-  const truncated = badLines.length > 0 || !text.endsWith("\n");
-  if (truncated) notSeen.push(`the ledger may be truncated or damaged (${badLines.length} unreadable line(s)${text.endsWith("\n") ? "" : ", last line has no line break"}); events after that point may be missing`);
-  const attemptedOnly = changedPaths.filter((p) => !seenPaths.has(p) && blockedPaths.has(p));
-  if (attemptedOnly.length)
-    notSeen.push(
-      `${attemptedOnly.length} changed file(s) appear in the ledger only as blocked attempts (${attemptedOnly.slice(0, SHOWN_PATHS).join(", ")}${attemptedOnly.length > SHOWN_PATHS ? ", \u2026" : ""}): the change that landed was not observed by any hook`
-    );
-  const unseen = changedPaths.filter((p) => !seenPaths.has(p) && !blockedPaths.has(p));
-  if (unseen.length) {
-    notSeen.push(
-      `${unseen.length} of ${changedPaths.length} changed file(s) are named by no ledger event (${unseen.slice(0, SHOWN_PATHS).join(", ")}${unseen.length > SHOWN_PATHS ? ", \u2026" : ""}); a file changed through a shell command is seen only if the command text names it`
-    );
-  }
-  const opaque = [...new Set(events.filter((e) => (e.type === "command" || e.type === "tool_pre") && e.command && unobservable(e.command)).map((e) => e.command))];
-  if (opaque.length)
-    notSeen.push(
-      `${opaque.length} shell command${opaque.length === 1 ? "" : "s"} ran a script file or wrote to a path built at run time (e.g. \`${opaque[0].slice(0, 80)}\`); what ${opaque.length === 1 ? "it" : "they"} wrote is not observable by Replume's shell rules`
-    );
-  const hookErrorsLogged = hookErrors(eventsFile);
-  if (hookErrorsLogged) notSeen.push(HOOK_CRASH);
-  return {
-    ledger: "present",
-    events: events.length,
-    sessions: new Set(events.map((e) => e.sessionId)).size,
-    agents: [...new Set(events.map((e) => e.agent))].sort(),
-    byType,
-    tools,
-    firstTs: ts[0],
-    lastTs: ts[ts.length - 1],
-    badLines: badLines.length,
-    hookErrorsLogged,
-    changedFiles: changedPaths.length,
-    changedFilesSeen: changedPaths.filter((p) => seenPaths.has(p)).length,
-    changedFilesLanded: changedPaths.filter((p) => landedPaths.has(p)).length,
-    changedFilesAttemptedOnly: attemptedOnly.slice(0, SHOWN_PATHS),
-    changedFilesNotSeen: unseen.slice(0, SHOWN_PATHS),
-    unobservableCommands: opaque.length,
-    notSeen
-  };
-}
-var SCRIPT_RUN = /(?:^|[;&|(]\s*|\s(?:sudo|exec|env|nohup|time)\s+)(?:(?:node|nodejs|deno|bun|python[0-9.]*|ruby|perl|php|bash|sh|zsh|pwsh|tsx|ts-node)\s+(?:-[^-ce\s][^\s]*\s+)*[\w./~-]+\.(?:js|mjs|cjs|ts|py|rb|pl|php|sh|bash|zsh|ps1)\b|\.{1,2}\/[\w./-]+)/;
-var RUNTIME_TARGET = /(?:>{1,2}|>\||\btee(?:\s+-\w+)*)\s*["']?[^\s"';|&]*(?:\$|`)/;
-var unobservable = (command) => SCRIPT_RUN.test(command) || RUNTIME_TARGET.test(command);
-function hookErrors(eventsFile) {
-  return existsSync13(join18(dirname7(eventsFile), "hook-errors.log"));
-}
-var list = (m) => Object.entries(m).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([k, n]) => `${k} ${n}`).join(", ");
-function renderCapture(c) {
-  const out = ["CAPTURE COVERAGE"];
-  if (c.ledger !== "present") {
-    out.push(`  seen       nothing (ledger ${c.ledger === "absent" ? "file not found" : "empty"})`);
-  } else {
-    out.push(`  seen       ${c.events} events from ${c.agents.join(", ")} in ${c.sessions} session${c.sessions === 1 ? "" : "s"} (${c.firstTs} to ${c.lastTs}): ${list(c.byType)}`);
-    if (Object.keys(c.tools).length) out.push(`  tools      ${list(c.tools)}`);
-    if (c.changedFilesLanded !== void 0) {
-      const a = c.changedFilesAttemptedOnly ?? [];
-      out.push(
-        `  files      ${c.changedFilesSeen} of ${c.changedFiles} changed file(s) named by an allowed step; ${c.changedFilesLanded} landed and observed (file_edit or successful command event); ${a.length} only attempted (blocked)${a.length ? `: ${a.join(", ")}` : ""}`
-      );
-    }
-  }
-  out.push(`  not seen   ${c.notSeen.length ? c.notSeen.join("; ") : "nothing flagged by these checks (they cannot see steps taken outside the hooks)"}`);
-  out.push("  limits     only agents with a Replume adapter and installed hooks write events; the ledger is a local file that can be edited or deleted. This is what was captured, not proof of what the agent did.");
-  return out;
-}
-
 // src/sandbox/failing-tests.ts
 var PATTERNS2 = [
   /^[ \t]*✖ (.+?) \(\d+(?:\.\d+)?m?s\)[ \t]*$/,
@@ -5015,6 +5194,20 @@ async function compareToTrustedBase(repo, t, commit, contractRel, scenariosRel,
   }
   return out;
 }
+function observedChanges(events, changedPaths, since) {
+  const t = since ? Date.parse(since) : NaN;
+  const inTask = events.filter((e) => !!e.sessionId && !!e.agent && (Number.isNaN(t) || Date.parse(e.ts) >= t));
+  const named = /* @__PURE__ */ new Set();
+  for (const e of inTask) {
+    const raw3 = e.raw ?? {};
+    if (e.action === "block" || raw3.ok === false) continue;
+    if (e.type === "file_edit") for (const p of e.paths) named.add(p);
+    else if (e.type === "command" && raw3.hook_event_name !== "beforeShellExecution" && Array.isArray(raw3.writes)) {
+      for (const p of raw3.writes) if (typeof p === "string") named.add(p);
+    }
+  }
+  return { sessions: new Set(inTask.map((e) => e.sessionId)).size, namedPaths: changedPaths.filter((p) => named.has(p)) };
+}
 async function runVerify2(opts) {
   const repo = resolve5(opts.repoPath);
   if (!isAbsolute7(opts.repoPath)) throw new Error("repoPath must be absolute");
@@ -5108,6 +5301,10 @@ async function runVerify2(opts) {
   const tampering = await tamperingFindings(repo, base3, commit, agentEntries);
   const newTests = agentEntries.filter((e) => e.status === "A" && TEST_PATH.test(e.path) && !tampering.some((t) => t.path === e.path)).map((e) => e.path);
   const dependencies = await dependencySection(repo, base3, commit, paths, contract, opts);
+  const eventsFile = safeRelative(repo, opts.eventsPath ?? ".replume/events.jsonl");
+  const ledgerEvents = readEvents(eventsFile).events;
+  const since = baseline?.recorded_at ?? null;
+  const observation = observedChanges(ledgerEvents, paths, since);
   const report = await withWorkingCopy(repo, commit, mode === "worktree" && (opts.keepWorkdir ?? false), async (root, home) => {
     const run = (command, timeoutSec) => mode === "docker" ? runDockerScenario({ root, command, timeoutSec, image }) : runCommand(command, root, home, timeoutSec);
     const dir = safeRelative(root, opts.scenariosDir ?? ".replume/scenarios");
@@ -5157,6 +5354,7 @@ async function runVerify2(opts) {
       draft,
       dependencies,
       newTests,
+      observation,
       baselineCheck: trusted ? {
         name: "baseline",
         status: "done",
@@ -5168,9 +5366,6 @@ async function runVerify2(opts) {
       isolationReason: reason
     });
   });
-  const eventsFile = safeRelative(repo, opts.eventsPath ?? ".replume/events.jsonl");
-  const ledgerEvents = readEvents(eventsFile).events;
-  const since = baseline?.recorded_at ?? null;
   const { interventions, layer2, layer2Modes, scope, sessions } = supervisorSection(ledgerEvents, paths, since);
   report.metrics = taskMetrics(ledgerEvents, {
     repoRoot: repo,
@@ -5228,11 +5423,21 @@ function countTag(levels) {
   if (counts.size <= 1) return TAG[levels[0] ?? "verified_here"];
   return `[evidence: ${[...counts].map(([l, k]) => `${k} ${LEVEL_NAME[l]}`).join("; ")}]`;
 }
+function notCheckedCauses(report) {
+  const causes = [...new Set(report.notChecked.map((x) => {
+    const m = /; (agent steps not observed|change not seen by hooks)/.exec(x.reason);
+    if (m) return `no scenario declares coverage; ${m[1]}`;
+    if (/the contract has no test_command/.test(x.reason)) return "no scenario declares coverage and no test_command";
+    if (/test_command did not pass/.test(x.reason)) return "no scenario declares coverage and test_command did not pass with at least one test";
+    return "no scenario declares coverage";
+  }))];
+  return causes.length ? ` (${causes.join("; ")})` : "";
+}
 function renderReport(report, opts = {}) {
   if (opts.json) return JSON.stringify(report, null, 2);
   const quietCapture = report.capture?.ledger === "absent" || report.capture?.ledger === "empty";
   const first = report.verdict === "pass" ? "Verdict: PASS \u2014 the checks that ran passed" : report.verdict === "fail" ? "Verdict: FAIL \u2014 at least one required check failed" : "Verdict: INCOMPLETE \u2014 the available checks cannot establish a pass";
-  const why = report.verdict === "pass" ? `Why: ${report.done.length} scenario(s) passed; no failing check, blocking extra change, tampering or undeclared coverage was reported.` : report.verdict === "fail" ? `Why: ${report.failed.length} failed scenario(s), ${report.extra.filter((e) => !e.informational).length} blocking extra change(s), ${report.tampering.length} tampering finding(s); inspect the details below.` : `Why: ${report.notChecked.length} path(s) have no scenario declaring coverage, or a required check did not run; inspect NOT RUN below.`;
+  const why = report.verdict === "pass" ? `Why: ${report.done.length} check(s) passed (${report.done.map((d) => d.id).join(", ")}); no failing check, blocking extra change, tampering or undeclared coverage was reported${report.observedOnly?.length ? `; ${report.observedOnly.length} changed file(s) checked by test_command and observed steps, no scenario` : ""}.` : report.verdict === "fail" ? `Why: ${report.failed.length} failed scenario(s), ${report.extra.filter((e) => !e.informational).length} blocking extra change(s), ${report.tampering.length} tampering finding(s); inspect the details below.` : `Why: ${report.notChecked.length} path(s) are not checked${notCheckedCauses(report)}, or a required check did not run; inspect NOT CHECKED and NOT RUN below.`;
   const activity = quietCapture ? `WARNING: ${report.capture?.hooksConfigured ? "Replume project hooks are configured, but no hook events were recorded" : "no Replume project hooks were found"}; agent steps and scope were not observed.` : report.capture ? `Agent activity: ${report.capture.events} event(s) reached Replume; this is not proof that every step was captured.` : "Agent activity: no capture information is available in this report.";
   const lines = [first, why, activity, `Replume report  commit ${report.commit.slice(0, 7)}  task: ${report.contractId}`];
   if (report.baseSource) lines.push(`Base         ${report.baseCommit.slice(0, 7)}  ${BASE_SOURCE_TEXT[report.baseSource]}  ${TAG[report.baseSource === "recorded_at_task" ? "observed" : "verified_here"]}`);
@@ -5266,7 +5471,9 @@ function renderReport(report, opts = {}) {
   }
   lines.push(`EXTRA        (${report.extra.length})  ${report.extra.map((x) => `${x.dependency ? `${x.path}: ${x.dependency.name}` : x.path}  ${x.reason}`).join(", ") || "\u2014"}  ${countTag(report.extra.map((x) => levelOf(x, "verified_here")))}`);
   lines.push(`TAMPERING    (${report.tampering.length})  ${report.tampering.map((x) => `${x.path}  ${x.detail}`).join(", ") || "\u2014"}  ${countTag(report.tampering.map((x) => levelOf(x, "verified_here")))}`);
-  lines.push(`NOT CHECKED  (${report.notChecked.length})  ${report.notChecked.map((x) => x.path).join(", ") || "\u2014"}${report.notChecked.length ? "  no scenario declares coverage" : ""}  ${TAG.unknown}`);
+  if (report.observedOnly?.length)
+    lines.push(`OBSERVED     (${report.observedOnly.length})  ${report.observedOnly.map((x) => x.path).join(", ")}  checked by test_command and observed steps; no scenario  [Observed]`);
+  lines.push(`NOT CHECKED  (${report.notChecked.length})  ${report.notChecked.map((x) => x.path).join(", ") || "\u2014"}${report.notChecked.length ? `  ${notCheckedCauses(report).replace(/^ \(|\)$/g, "")}` : ""}  ${TAG.unknown}`);
   if (report.supervisor) {
     const [head, ...rest] = renderInterventions(report.supervisor, report.supervisor.scope);
     lines.push(`${head}  ${TAG.observed}`, "  Meaning: SUPERVISOR lists permission decisions; matching Cursor shell hooks are counted once. Hook output alone does not confirm execution. These records are editable.", ...rest);
@@ -5645,7 +5852,12 @@ program.command("init").description("Create .replume/, install agent hooks where
         throw new Error(`${path} is not a JSON object; nothing was changed. Fix it and run replume init again.`);
       mergeHooks(parsed, opts.hookCommand ?? DEFAULT_HOOK_COMMAND);
     }
-    const { lines } = runInit(root, { hookCommand: opts.hookCommand, detected });
+    const { lines } = runInit(root, {
+      hookCommand: opts.hookCommand,
+      cursorHookCommand: opts.cursorHookCommand,
+      cursorHooks: wantCursor,
+      detected
+    });
     const oldNotice = lines.findIndex((l) => l.startsWith("- Cursor found, but"));
     if (oldNotice >= 0) lines.splice(oldNotice, 1);
     const matrixAt = lines.indexOf("Capability matrix");
@@ -5695,6 +5907,9 @@ addPreflightOptions(program.command("task")).description("Write the Task Contrac
     fail(e.message);
   }
 });
+function passPathHint(c) {
+  return c.test_command ? `  Scenarios are optional: verify can PASS when \`${c.test_command}\` runs at least one test and passes, nothing is EXTRA or TAMPERING, and the hooks record the agent changing each changed file. A scenario adds a stated behaviour check.` : "  No test_command: without a test_command or a scenario, verify cannot reach PASS. Set test_command in .replume/contract.yaml (scenarios are optional).";
+}
 addPreflightOptions(program.command("draft")).description("Propose a Task Contract from the repository and the task text (status: draft, not policy until confirmed)").requiredOption("--task <text>", "what the agent will be asked to do").option("--yes", "confirm at once (for CI): the draft becomes policy and the baseline is recorded").option("--accept-broad", "with --yes: also confirm allow globs broader than the paths the task names").option("--refine", "model refinement of the draft (not built)").action(async (opts) => {
   if (opts.refine) fail("model refinement is not built; the draft is deterministic only (no model is called). Edit .replume/contract.yaml by hand instead.");
   const root = repoRoot();
@@ -5727,6 +5942,7 @@ addPreflightOptions(program.command("draft")).description("Propose a Task Contra
     console.log(finalAllow);
     if (opts.yes) await preflightAndRecord(root, path, c, opts);
     else console.log("  This draft is NOT policy yet: verify reports the contract as NOT CHECKED and the hooks ignore it. Review the file, then run `replume confirm`.");
+    console.log(passPathHint(c));
   } catch (e) {
     fail(e.message);
   }
@@ -5744,7 +5960,8 @@ addPreflightOptions(program.command("confirm")).description("Confirm the draft c
     writeContract(path, confirmed);
     console.log(`\u2713 confirmed ${REPLUME_DIR}/contract.yaml (${c.id}, status: confirmed)`);
     await preflightAndRecord(root, path, confirmed, opts);
-    console.log("  commit .replume/contract.yaml before running the agent (commit the scenario files and .replume/.gitignore too)");
+    console.log(passPathHint(confirmed));
+    console.log("  commit .replume/contract.yaml before running the agent (and .replume/.gitignore, and any scenario files)");
   } catch (e) {
     fail(e.message);
   }