replume-cli 0.1.0 → 0.1.2

package/dist/cli.js

@@ -6,7 +6,7 @@ import { Command, Option } from "commander";
 // package.json
 var package_default = {
   name: "replume-cli",
-  version: "0.1.0",
+  version: "0.1.2",
   type: "module",
   bin: {
     replume: "dist/cli.js"
@@ -48,9 +48,9 @@ var package_default = {
 };
 
 // src/cli.ts
-import { execFileSync as execFileSync10 } from "child_process";
-import { existsSync as existsSync18, lstatSync as lstatSync3, readFileSync as readFileSync17 } from "fs";
-import { join as join23, resolve as resolve6 } from "path";
+import { execFileSync as execFileSync11 } from "child_process";
+import { existsSync as existsSync20, lstatSync as lstatSync3, readFileSync as readFileSync19 } from "fs";
+import { join as join25, resolve as resolve8 } from "path";
 
 // src/hooks/session-start.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -342,20 +342,21 @@ function markPathsOutsideRepo(text, repoRoot2) {
   const path = (value) => {
     const rel = relative(repoRoot2, value);
     if (!rel) return "[REPO_ROOT]";
+    if (/^\/dev\/[\w./-]+$/.test(value)) return value;
     return rel !== ".." && !rel.startsWith("../") && !isAbsolute(rel) ? rel.replace(/\\/g, "/") : "[OUTSIDE_REPO]";
   };
-  return text.replace(/(^|[\s"'=(,:])(\/(?!\/)[^\s"'`,;)]+)/g, (_m, prefix, absolute) => `${prefix}${path(absolute)}`);
+  return text.replace(/(^|[\s"'=(,:])(\/(?!\/)[^\s"'`,;)(]+)(?![^\s"'`,;)])/g, (_m, prefix, absolute) => `${prefix}${path(absolute)}`);
 }
 function redactLedgerText(text, repoRoot2) {
   const out = redact(text).replace(SECRET_ENV_ANYCASE, `$1${REDACTED}`).replace(URL_USER, `$1${REDACTED}:${REDACTED}@`);
   return markPathsOutsideRepo(out, repoRoot2);
 }
 function redactForLedger(value, repoRoot2) {
-  const str3 = (s) => redactLedgerText(s, repoRoot2);
+  const str4 = (s) => redactLedgerText(s, repoRoot2);
   const deep = (v) => {
-    if (typeof v === "string") return str3(v);
+    if (typeof v === "string") return str4(v);
     if (Array.isArray(v)) return v.map(deep);
-    if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, c]) => [str3(k), deep(c)]));
+    if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, c]) => [str4(k), deep(c)]));
     return v;
   };
   return deep(value);
@@ -601,7 +602,7 @@ async function runVerify(opts) {
 // src/agents/claude/handler.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync6 } from "fs";
-import { join as join8 } from "path";
+import { join as join10 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/core/usage-store.ts
@@ -886,7 +887,9 @@ function validateReport(x) {
     const valid = isObj(a) && isObj(t) && isObj(tokens) && [t.wall, t.active, t.humanWait, tokens.input, tokens.output, tokens.cacheRead, tokens.cacheWrite, a.apiEquivalentUsd].every(metric) && typeof tokens.partial === "boolean" && typeof a.accepted === "boolean" && typeof a.priceVersion === "string" && (a.apiEquivalentReason === void 0 || typeof a.apiEquivalentReason === "string" && a.apiEquivalentReason.length > 0 && a.apiEquivalentReason.length <= 200);
     if (!valid) p.push("metrics.accounting has invalid evidence or value");
   }
-  const levelled = ["done", "failed", "extra", "tampering", "notChecked", "checks"].flatMap((k) => Array.isArray(x[k]) ? x[k] : []);
+  if (x.observedOnly !== void 0 && (!Array.isArray(x.observedOnly) || !x.observedOnly.every((e) => isObj(e) && typeof e.path === "string" && typeof e.reason === "string")))
+    p.push("observedOnly must be an array of {path, reason}");
+  const levelled = ["done", "failed", "extra", "tampering", "notChecked", "observedOnly", "checks"].flatMap((k) => Array.isArray(x[k]) ? x[k] : []);
   if (levelled.some((e) => isObj(e) && e.evidence_level !== void 0 && !EVIDENCE_LEVELS.includes(e.evidence_level)))
     p.push(`evidence_level must be one of ${EVIDENCE_LEVELS.join(", ")}`);
   return p;
@@ -1039,7 +1042,7 @@ var Parser = class {
     return ITEM.test(first.body) ? this.sequence(indent) : this.mapping(indent);
   }
   mapping(indent, seed) {
-    const obj2 = seed?.obj ?? {};
+    const obj3 = seed?.obj ?? {};
     while (this.peek()) {
       const line = this.peek();
       if (line.indent < indent) break;
@@ -1048,20 +1051,20 @@ var Parser = class {
       const m = KEY.exec(line.body);
       if (!m) throw new Error(`line ${line.n}: expected "key: value"`);
       this.i++;
-      this.entry(obj2, m[1], m[2], line, indent);
+      this.entry(obj3, m[1], m[2], line, indent);
     }
-    return obj2;
+    return obj3;
   }
-  entry(obj2, key, rest, line, indent) {
-    if (key in obj2) throw new Error(`line ${line.n}: duplicate key ${key}`);
+  entry(obj3, key, rest, line, indent) {
+    if (key in obj3) throw new Error(`line ${line.n}: duplicate key ${key}`);
     if (rest !== void 0 && rest.trim() !== "") {
-      obj2[key] = parseInline(rest, `line ${line.n}`);
+      obj3[key] = parseInline(rest, `line ${line.n}`);
       return;
     }
     const next = this.peek();
-    if (next && next.indent > indent) obj2[key] = this.block(next.indent);
-    else if (next && next.indent === indent && ITEM.test(next.body)) obj2[key] = this.sequence(indent);
-    else obj2[key] = null;
+    if (next && next.indent > indent) obj3[key] = this.block(next.indent);
+    else if (next && next.indent === indent && ITEM.test(next.body)) obj3[key] = this.sequence(indent);
+    else obj3[key] = null;
   }
   sequence(indent) {
     const items = [];
@@ -1080,11 +1083,11 @@ var Parser = class {
         continue;
       }
       const column = indent + (line.body.length - body.length);
-      const obj2 = {};
-      this.entry(obj2, km[1], km[2], line, column);
+      const obj3 = {};
+      this.entry(obj3, km[1], km[2], line, column);
       const next = this.peek();
-      if (next && next.indent === column && !ITEM.test(next.body)) this.mapping(column, { obj: obj2 });
-      items.push(obj2);
+      if (next && next.indent === column && !ITEM.test(next.body)) this.mapping(column, { obj: obj3 });
+      items.push(obj3);
     }
     return items;
   }
@@ -1111,9 +1114,9 @@ function emitScalar(v) {
   if (typeof v === "string") return JSON.stringify(v);
   return String(v);
 }
-function stringifyYaml(obj2, comments = {}) {
+function stringifyYaml(obj3, comments = {}) {
   const lines = [];
-  for (const [k, v] of Object.entries(obj2)) {
+  for (const [k, v] of Object.entries(obj3)) {
     if (v === void 0) continue;
     const c = comments[k] ? `  # ${comments[k]}` : "";
     if (Array.isArray(v)) {
@@ -1258,7 +1261,7 @@ function buildContract(input) {
 
 // src/core/rules.ts
 import { createHash } from "crypto";
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve2, sep } from "path";
+import { isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve2, sep } from "path";
 import { homedir, tmpdir } from "os";
 
 // src/core/glob.ts
@@ -1294,16 +1297,160 @@ function matchesAny(path, patterns) {
   return null;
 }
 
+// src/core/capture.ts
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
+var EXPECTED_TYPES = ["prompt", "tool_pre", "command", "stop"];
+var SHOWN_PATHS = 5;
+var count2 = (m, k) => {
+  m[k] = (m[k] ?? 0) + 1;
+};
+var HOOK_CRASH = "hook-errors.log exists: at least one hook crashed, so some steps may not have been recorded";
+function captureCoverage(eventsFile, changedPaths, hooksConfigured = false) {
+  const absence = hooksConfigured ? "Replume project hooks are configured, but no hook events were recorded; agent steps and scope were not observed" : "no Replume project hooks were found; agent steps and scope were not observed";
+  const empty = (ledger, notes) => ({
+    ledger,
+    hooksConfigured,
+    events: 0,
+    sessions: 0,
+    agents: [],
+    byType: {},
+    tools: {},
+    firstTs: null,
+    lastTs: null,
+    badLines: 0,
+    hookErrorsLogged: hookErrors(eventsFile),
+    changedFiles: changedPaths.length,
+    changedFilesSeen: 0,
+    changedFilesLanded: 0,
+    changedFilesAttemptedOnly: [],
+    changedFilesNotSeen: changedPaths.slice(0, SHOWN_PATHS),
+    unobservableCommands: 0,
+    // a hook that crashed on every call leaves no ledger: say so here too, not only in the JSON flag
+    notSeen: hookErrors(eventsFile) ? [...notes, HOOK_CRASH] : notes
+  });
+  if (!existsSync6(eventsFile)) {
+    return empty("absent", [`no ledger file: ${absence}`]);
+  }
+  const text = readFileSync7(eventsFile, "utf-8");
+  const { events, badLines } = parseEvents(text);
+  if (!events.length) {
+    return empty("empty", [
+      badLines.length ? `the ledger has ${badLines.length} line(s) but none is a valid event` : `the ledger is empty: ${absence}`
+    ]);
+  }
+  const byType = {};
+  const tools = {};
+  const seenPaths = /* @__PURE__ */ new Set();
+  const landedPaths = /* @__PURE__ */ new Set();
+  const blockedPaths = /* @__PURE__ */ new Set();
+  for (const e of events) {
+    count2(byType, e.type);
+    if (e.type === "tool_pre" && e.tool) count2(tools, e.tool);
+    const blocked = e.action === "block" && e.type !== "file_edit" && e.type !== "command";
+    const landed = e.type === "file_edit" || e.type === "command" && e.raw?.ok !== false;
+    for (const p of e.paths) {
+      if (blocked) blockedPaths.add(p);
+      else seenPaths.add(p);
+      const writes = e.type === "command" ? e.raw?.writes : void 0;
+      if (landed && (!Array.isArray(writes) || writes.includes(p))) landedPaths.add(p);
+    }
+  }
+  const ts = events.map((e) => e.ts).sort();
+  const notSeen = [];
+  const missing = EXPECTED_TYPES.filter((t) => !byType[t]);
+  if (missing.length) notSeen.push(`no ${missing.join(", ")} events`);
+  const truncated = badLines.length > 0 || !text.endsWith("\n");
+  if (truncated) notSeen.push(`the ledger may be truncated or damaged (${badLines.length} unreadable line(s)${text.endsWith("\n") ? "" : ", last line has no line break"}); events after that point may be missing`);
+  const attemptedOnly = changedPaths.filter((p) => !seenPaths.has(p) && blockedPaths.has(p));
+  if (attemptedOnly.length)
+    notSeen.push(
+      `${attemptedOnly.length} changed file(s) appear in the ledger only as blocked attempts (${attemptedOnly.slice(0, SHOWN_PATHS).join(", ")}${attemptedOnly.length > SHOWN_PATHS ? ", \u2026" : ""}): the change that landed was not observed by any hook`
+    );
+  const unseen = changedPaths.filter((p) => !seenPaths.has(p) && !blockedPaths.has(p));
+  if (unseen.length) {
+    notSeen.push(
+      `${unseen.length} of ${changedPaths.length} changed file(s) are named by no ledger event (${unseen.slice(0, SHOWN_PATHS).join(", ")}${unseen.length > SHOWN_PATHS ? ", \u2026" : ""}); a file changed through a shell command is seen only if the command text names it`
+    );
+  }
+  const opaque = [...new Set(events.filter((e) => (e.type === "command" || e.type === "tool_pre") && e.command && unobservable(e.command)).map((e) => e.command))];
+  const unparsed = [...new Set(events.filter((e) => (e.type === "command" || e.type === "tool_pre") && e.command && !unobservable(e.command) && e.raw?.writeNote === "write target not parsed").map((e) => e.command))];
+  if (opaque.length)
+    notSeen.push(
+      `${opaque.length} shell command${opaque.length === 1 ? "" : "s"} ran a script file or wrote to a path built at run time (e.g. \`${opaque[0].slice(0, 80)}\`); what ${opaque.length === 1 ? "it" : "they"} wrote is not observable by Replume's shell rules`
+    );
+  if (unparsed.length)
+    notSeen.push(
+      `${unparsed.length} shell command${unparsed.length === 1 ? "" : "s"} wrote to a target that was not parsed (variable, glob, inline code, patch or a git command that rewrites files; e.g. \`${unparsed[0].slice(0, 80)}\`): write target not parsed, so ${unparsed.length === 1 ? "its" : "their"} writes are not attributed to any file`
+    );
+  const hookErrorsLogged = hookErrors(eventsFile);
+  if (hookErrorsLogged) notSeen.push(HOOK_CRASH);
+  return {
+    ledger: "present",
+    events: events.length,
+    sessions: new Set(events.map((e) => e.sessionId)).size,
+    agents: [...new Set(events.map((e) => e.agent))].sort(),
+    byType,
+    tools,
+    firstTs: ts[0],
+    lastTs: ts[ts.length - 1],
+    badLines: badLines.length,
+    hookErrorsLogged,
+    changedFiles: changedPaths.length,
+    changedFilesSeen: changedPaths.filter((p) => seenPaths.has(p)).length,
+    changedFilesLanded: changedPaths.filter((p) => landedPaths.has(p)).length,
+    changedFilesAttemptedOnly: attemptedOnly.slice(0, SHOWN_PATHS),
+    changedFilesNotSeen: unseen.slice(0, SHOWN_PATHS),
+    unobservableCommands: opaque.length + unparsed.length,
+    notSeen
+  };
+}
+var SCRIPT_RUN = /(?:^|[;&|(]\s*|\s(?:sudo|exec|env|nohup|time)\s+)(?:(?:node|nodejs|deno|bun|python[0-9.]*|ruby|perl|php|bash|sh|zsh|pwsh|tsx|ts-node)\s+(?:-[^-ce\s][^\s]*\s+)*[\w./~-]+\.(?:js|mjs|cjs|ts|py|rb|pl|php|sh|bash|zsh|ps1)\b|\.{1,2}\/[\w./-]+)/;
+var RUNTIME_TARGET = /(?:>{1,2}|>\||\btee(?:\s+-\w+)*)\s*["']?[^\s"';|&]*(?:\$|`)/;
+var unobservable = (command) => SCRIPT_RUN.test(command) || RUNTIME_TARGET.test(command);
+function hookErrors(eventsFile) {
+  return existsSync6(join6(dirname4(eventsFile), "hook-errors.log"));
+}
+var list = (m) => Object.entries(m).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([k, n]) => `${k} ${n}`).join(", ");
+function renderCapture(c) {
+  const out = ["CAPTURE COVERAGE"];
+  if (c.ledger !== "present") {
+    out.push(`  seen       nothing (ledger ${c.ledger === "absent" ? "file not found" : "empty"})`);
+  } else {
+    out.push(`  seen       ${c.events} events from ${c.agents.join(", ")} in ${c.sessions} session${c.sessions === 1 ? "" : "s"} (${c.firstTs} to ${c.lastTs}): ${list(c.byType)}`);
+    if (Object.keys(c.tools).length) out.push(`  tools      ${list(c.tools)}`);
+    if (c.changedFilesLanded !== void 0) {
+      const a = c.changedFilesAttemptedOnly ?? [];
+      out.push(
+        `  files      ${c.changedFilesSeen} of ${c.changedFiles} changed file(s) named by an allowed step; ${c.changedFilesLanded} landed and observed (file_edit or successful command event); ${a.length} only attempted (blocked)${a.length ? `: ${a.join(", ")}` : ""}`
+      );
+    }
+  }
+  out.push(`  not seen   ${c.notSeen.length ? c.notSeen.join("; ") : "nothing flagged by these checks (they cannot see steps taken outside the hooks)"}`);
+  out.push("  limits     only agents with a Replume adapter and installed hooks write events; the ledger is a local file that can be edited or deleted. This is what was captured, not proof of what the agent did.");
+  return out;
+}
+
 // src/core/rules.ts
 var PREFIX = "Replume:";
 function fingerprint(tool, input) {
   return createHash("sha1").update(tool).update("\0").update(JSON.stringify(input ?? null)).digest("hex").slice(0, 16);
 }
+function expandHome(p) {
+  if (p === "~") return homedir();
+  if (p.startsWith("~/")) return join7(homedir(), p.slice(2));
+  return p;
+}
 function splitPaths(repoRoot2, paths) {
   const inside = [];
   const outside = [];
   const root = resolve2(repoRoot2);
-  for (const p of paths) {
+  for (const raw3 of paths) {
+    const p = expandHome(raw3);
+    if (p.startsWith("~")) {
+      outside.push(p);
+      continue;
+    }
     const abs = isAbsolute3(p) ? resolve2(p) : resolve2(root, p);
     const rel = relative3(root, abs);
     if (rel === "" || rel.startsWith("..") || isAbsolute3(rel)) outside.push(abs);
@@ -1332,11 +1479,32 @@ function shellTokens(src) {
   const toks = [];
   let cur = "";
   let has = false;
+  const heredocs = [];
   const flush = () => {
-    if (has) toks.push({ word: cur });
+    if (has) {
+      const prev = toks[toks.length - 1];
+      if (prev && "op" in prev && prev.op === "<<") {
+        const strip = cur.startsWith("-");
+        heredocs.push({ delim: strip ? cur.slice(1) : cur, strip });
+      }
+      toks.push({ word: cur });
+    }
     cur = "";
     has = false;
   };
+  const skipBodies = (from) => {
+    let at = from;
+    for (const h of heredocs.splice(0)) {
+      for (; ; ) {
+        if (at >= src.length) return src.length;
+        const nl = src.indexOf("\n", at);
+        const line = src.slice(at, nl < 0 ? src.length : nl);
+        at = nl < 0 ? src.length : nl + 1;
+        if ((h.strip ? line.replace(/^\t+/, "") : line) === h.delim) break;
+      }
+    }
+    return at;
+  };
   for (let i = 0; i < src.length; ) {
     const c = src[i];
     if (c === "'") {
@@ -1363,15 +1531,23 @@ function shellTokens(src) {
       i = j < 0 ? src.length : j;
     } else if (/\s/.test(c)) {
       flush();
-      if (c === "\n") toks.push({ op: ";" });
+      if (c === "\n") {
+        toks.push({ op: ";" });
+        if (heredocs.length) {
+          i = skipBodies(i + 1);
+          continue;
+        }
+      }
       i++;
     } else if (">|<&;()".includes(c)) {
       const op = /^(?:&>>|>>|>\||>&|&>|&&|\|\||\|&|<<<|<<|<&|[>|<&;()])/.exec(src.slice(i))[0];
+      let fd;
       if ((op[0] === ">" || op[0] === "<") && has && /^\d+$/.test(cur)) {
+        fd = Number(cur);
         cur = "";
         has = false;
       } else flush();
-      toks.push({ op });
+      toks.push(fd === void 0 ? { op } : { op, fd });
       i += op.length;
     } else {
       cur += c;
@@ -1383,8 +1559,122 @@ function shellTokens(src) {
   return toks;
 }
 var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
-var WRAPPERS = /* @__PURE__ */ new Set(["sudo", "command", "exec", "time", "xargs", "env", "nohup"]);
 var WRITE_OPS = /* @__PURE__ */ new Set([">", ">>", ">|", "&>", "&>>"]);
+var MAX_NEST = 8;
+var SHELL_KEYWORDS = /* @__PURE__ */ new Set(["if", "then", "else", "elif", "fi", "while", "until", "do", "done", "esac", "{", "}", "!"]);
+var HEADER_KEYWORDS = /* @__PURE__ */ new Set(["for", "select", "case"]);
+var WRAPPER_SPECS = {
+  sudo: { withArg: ["-u", "-g", "-h", "-p", "-C", "-T", "-r", "-t", "-U", "-D", "-R", "--user", "--group", "--host", "--prompt"] },
+  doas: { withArg: ["-u", "-C"] },
+  env: { withArg: ["-u", "-C", "--unset", "--chdir"] },
+  command: { withArg: [] },
+  exec: { withArg: ["-a"] },
+  time: { withArg: ["-f", "-o", "--format", "--output"] },
+  nohup: { withArg: [] },
+  nice: { withArg: ["-n", "--adjustment"] },
+  ionice: { withArg: ["-c", "-n", "-p", "-P", "-u", "--class", "--classdata"] },
+  stdbuf: { withArg: ["-i", "-o", "-e"] },
+  timeout: { withArg: ["-s", "-k", "--signal", "--kill-after"], positional: 1 },
+  xargs: { withArg: ["-I", "-n", "-P", "-L", "-s", "-d", "-E", "-a"] }
+};
+function unwrapCommand(input) {
+  let words = input;
+  for (let guard = 0; guard < 16 && words.length; guard++) {
+    const w = words[0];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w) || SHELL_KEYWORDS.has(w)) {
+      words = words.slice(1);
+      continue;
+    }
+    if (HEADER_KEYWORDS.has(w)) return [];
+    if (w === "function") {
+      words = words.slice(2);
+      continue;
+    }
+    const spec = WRAPPER_SPECS[w.split("/").pop()];
+    if (!spec) break;
+    let i = 1;
+    while (i < words.length) {
+      const a = words[i];
+      if (a === "--") {
+        i++;
+        break;
+      }
+      if (a.startsWith("-") && a.length > 1) i += spec.withArg.includes(a) ? 2 : 1;
+      else break;
+    }
+    if (spec.positional && /^\d+(?:\.\d+)?[smhd]?$/.test(words[i] ?? "")) i += spec.positional;
+    words = words.slice(i);
+  }
+  return words;
+}
+function splitFlags(args) {
+  const flags = [];
+  const operands = [];
+  let done = false;
+  for (const a of args) {
+    if (done) operands.push(a);
+    else if (a === "--") done = true;
+    else if (a.startsWith("-") && a.length > 1) flags.push(a);
+    else operands.push(a);
+  }
+  return { flags, operands };
+}
+var isBlockDevice = (p) => /^\/dev\/(?:(?:s|h|v|xv)d[a-z]+[0-9]*|nvme[0-9]+n[0-9]+(?:p[0-9]+)?|mmcblk[0-9]+(?:p[0-9]+)?|r?disk[0-9]+(?:s[0-9]+)*)$/.test(p.trim());
+function substitutionBodies(src) {
+  const text = src.replace(/<<(-?)[ \t]*(['"]?)([A-Za-z_][\w-]*)\2[^\n]*\n[\s\S]*?\n[ \t]*\3(?=\n|$)/g, "");
+  const out = [];
+  const closing = (from) => {
+    let depth = 0;
+    for (let j = from; j < text.length; j++) {
+      const c = text[j];
+      if (c === "\\") {
+        j++;
+        continue;
+      }
+      if (c === "'") {
+        j = text.indexOf("'", j + 1);
+        if (j < 0) return text.length;
+        continue;
+      }
+      if (c === '"') {
+        for (j++; j < text.length && text[j] !== '"'; j++) if (text[j] === "\\") j++;
+        continue;
+      }
+      if (c === "(") depth++;
+      else if (c === ")" && --depth === 0) return j;
+    }
+    return text.length;
+  };
+  let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === "\\") {
+      i++;
+      continue;
+    }
+    if (c === "'" && !dq) {
+      const j = text.indexOf("'", i + 1);
+      if (j < 0) break;
+      i = j;
+      continue;
+    }
+    if (c === '"') {
+      dq = !dq;
+      continue;
+    }
+    if (text[i + 1] === "(" && (c === "$" && text[i + 2] !== "(" || (c === "<" || c === ">") && !dq)) {
+      const end = closing(i + 1);
+      out.push(text.slice(i + 2, end));
+      i = end;
+    } else if (c === "`") {
+      let j = i + 1;
+      while (j < text.length && text[j] !== "`") j += text[j] === "\\" ? 2 : 1;
+      out.push(text.slice(i + 1, j));
+      i = j;
+    }
+  }
+  return out;
+}
 function redirectTargets(command, depth = 0) {
   const toks = shellTokens(command);
   const out = [];
@@ -1397,13 +1687,13 @@ function redirectTargets(command, depth = 0) {
     }
     if (!("word" in t)) return;
     const prev = toks[i - 1];
-    const atCommand = !prev || "op" in prev || WRAPPERS.has(word(prev) ?? "");
+    const atCommand = !prev || "op" in prev || (word(prev) ?? "") in WRAPPER_SPECS;
     if (t.word === "tee" && atCommand) {
       for (let j = i + 1; j < toks.length && "word" in toks[j]; j++) {
         const w = word(toks[j]);
         if (!w.startsWith("-")) out.push(w);
       }
-    } else if (depth < 2 && SHELLS.has(t.word.split("/").pop())) {
+    } else if (depth < MAX_NEST && SHELLS.has(t.word.split("/").pop())) {
       const k = toks.findIndex((x, j) => j > i && "word" in x && /^-[a-z]*c$/.test(x.word));
       const script = k >= 0 ? word(toks[k + 1]) : null;
       if (script) out.push(...redirectTargets(script, depth + 1));
@@ -1421,18 +1711,18 @@ function fileVerbOperands(command, depth = 0) {
     const t = toks[i];
     if ("op" in t) {
       if (SEPARATORS.has(t.op)) simple.push([]);
-      else if (WRITE_OPS.has(t.op) || t.op === "<" || t.op === "<<<") i++;
+      else if (WRITE_OPS.has(t.op) || t.op === "<" || t.op === "<<<" || t.op === "<<") i++;
       continue;
     }
     simple[simple.length - 1].push(t.word);
   }
-  for (let words of simple) {
-    while (words.length && (WRAPPERS.has(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
+  for (const sw of simple) {
+    const words = unwrapCommand(sw);
     if (!words.length) continue;
     const verb = words[0].split("/").pop();
     const args = words.slice(1);
-    const operands = args.filter((w) => !w.startsWith("-")).map((w) => w.replace(/^of=/, ""));
-    if (SHELLS.has(verb) && depth < 2) {
+    const operands = splitFlags(args).operands.map((w) => w.replace(/^of=/, ""));
+    if (SHELLS.has(verb) && depth < MAX_NEST) {
       const k = args.findIndex((w) => /^-[a-z]*c$/.test(w));
       if (k >= 0 && args[k + 1]) out.push(...fileVerbOperands(args[k + 1], depth + 1));
     } else if (FILE_VERBS.has(verb)) out.push(...operands);
@@ -1441,16 +1731,179 @@ function fileVerbOperands(command, depth = 0) {
   }
   return out.filter((p) => p && !/[$*?{}`]/.test(p));
 }
+var DYNAMIC = /[$*?{}`]/;
+var INLINE_INTERP = /* @__PURE__ */ new Set(["node", "nodejs", "python", "python3", "perl", "ruby", "deno", "bun", "php"]);
+var INLINE_WRITE = /writeFile|appendFile|createWriteStream|copyFile|rename|unlink|rmSync|mkdir|open\s*\(|\.write\s*\(|write_text|write_bytes|shutil\.|os\.remove|File\.write|IO\.write/;
+var GIT_TREE_CHANGERS = /* @__PURE__ */ new Set(["switch", "reset", "stash", "apply", "am", "merge", "pull", "rebase", "cherry-pick", "revert", "clean"]);
+function shellWriteTargets(command, depth = 0) {
+  const out = [];
+  const certain = [];
+  let unparsed = false;
+  const toks = shellTokens(command);
+  let cond = false;
+  let base3 = false;
+  const orLists = /* @__PURE__ */ new Set();
+  let list2 = 0;
+  let construct = 0;
+  let pendingFunc = false;
+  const stack = [];
+  const simple = [{ words: [], redirects: [], conditional: false, list: 0, depth: 0, construct: 0, after: ";" }];
+  const next = (after) => simple.push({ words: [], redirects: [], conditional: cond, list: list2, depth: stack.length, construct, after });
+  for (let i = 0; i < toks.length; i++) {
+    const t = toks[i];
+    if ("op" in t) {
+      const cur2 = simple[simple.length - 1];
+      if (t.op === ";") {
+        cond = base3;
+        list2++;
+        pendingFunc = false;
+        next(";");
+      } else if (t.op === "&&") {
+        cond = true;
+        next("&&");
+      } else if (t.op === "||") {
+        cond = true;
+        orLists.add(list2);
+        next("||");
+      } else if (t.op === "(") {
+        if (cur2.words.length === 1 && /^[A-Za-z_][\w.-]*$/.test(cur2.words[0])) pendingFunc = true;
+        stack.push({ cond, base: base3, func: false });
+        base3 = cond;
+        next("(");
+      } else if (t.op === ")") {
+        const top = stack.pop();
+        cond = top?.cond ?? false;
+        base3 = top?.base ?? false;
+        next(")");
+      } else if (SEPARATORS.has(t.op)) next(t.op);
+      else if (WRITE_OPS.has(t.op)) {
+        const target = toks[i + 1];
+        const w = target && "word" in target ? target.word : null;
+        const fds = t.fd !== void 0 ? [t.fd] : t.op === "&>" || t.op === "&>>" ? [1, 2] : [1];
+        cur2.redirects.push({ fds, target: w });
+        i++;
+      } else if (t.op === "<" || t.op === "<<<" || t.op === "<<" || t.op === ">&" || t.op === "<&") i++;
+      continue;
+    }
+    const cur = simple[simple.length - 1];
+    if (cur.words.length === 0) {
+      if (["if", "while", "until", "for", "select", "case"].includes(t.word)) construct++;
+      else if (["fi", "done", "esac"].includes(t.word)) construct = Math.max(0, construct - 1);
+      else if (t.word === "function") pendingFunc = true;
+      else if (t.word === "{") {
+        stack.push({ cond, base: base3, func: pendingFunc });
+        base3 = cond;
+        if (pendingFunc) {
+          construct++;
+          cur.construct = construct;
+        }
+        pendingFunc = false;
+      } else if (t.word === "}") {
+        const top = stack.pop();
+        cond = top?.cond ?? false;
+        base3 = top?.base ?? false;
+        if (top?.func) construct = Math.max(0, construct - 1);
+      }
+    }
+    cur.words.push(t.word);
+  }
+  const fails = (sc) => {
+    const w = unwrapCommand(sc.words);
+    return w[0] === "false" || (w[0] === "exit" || w[0] === "return") && /^[1-9][0-9]*$/.test(w[1] ?? "");
+  };
+  const skipped = simple.map(() => false);
+  simple.forEach((sc, i) => {
+    if (i > 0 && sc.after === "&&" && (fails(simple[i - 1]) || skipped[i - 1])) skipped[i] = true;
+  });
+  const lastList = [...simple].reverse().find((x) => x.words.length || x.redirects.length)?.list ?? 0;
+  simple.forEach((sc, idx) => {
+    const sure = !skipped[idx] && sc.construct === 0 && (!sc.conditional || sc.depth === 0 && !orLists.has(sc.list) && sc.list === lastList);
+    const last = /* @__PURE__ */ new Map();
+    sc.redirects.forEach((r, j) => r.fds.forEach((fd) => last.set(fd, j)));
+    sc.redirects.forEach((r, j) => {
+      if (!r.target || DYNAMIC.test(r.target)) {
+        unparsed = true;
+        return;
+      }
+      if (DEVICE_SINK.test(r.target)) return;
+      out.push(r.target);
+      if (sure && r.fds.some((fd) => last.get(fd) === j)) certain.push(r.target);
+    });
+    const add = (ws, content = true) => {
+      for (const w of ws) {
+        if (!w) continue;
+        if (DYNAMIC.test(w)) unparsed = true;
+        else if (!DEVICE_SINK.test(w)) {
+          out.push(w);
+          if (content && sure) certain.push(w);
+        }
+      }
+    };
+    const words = unwrapCommand(sc.words);
+    if (!words.length) return;
+    const verb = words[0].split("/").pop();
+    const args = words.slice(1);
+    const operands = splitFlags(args).operands;
+    if (sc.words.slice(0, sc.words.length - words.length).some((x) => x.split("/").pop() === "xargs")) {
+      if (FILE_VERBS.has(verb) || verb === "sed" || verb === "perl") unparsed = true;
+      return;
+    }
+    if (SHELLS.has(verb)) {
+      const k = args.findIndex((w) => /^-[a-z]*c$/.test(w));
+      if (k >= 0 && args[k + 1] !== void 0) {
+        if (depth >= MAX_NEST) unparsed = true;
+        else {
+          const r = shellWriteTargets(args[k + 1], depth + 1);
+          out.push(...r.paths);
+          if (sure) certain.push(...r.certain);
+          unparsed ||= r.unparsed;
+        }
+      }
+    } else if (["tee", "touch", "truncate", "rm", "unlink", "chmod", "chown"].includes(verb)) {
+      add(verb === "chmod" || verb === "chown" ? operands.slice(1) : verb === "truncate" ? args.filter((w, j) => !w.startsWith("-") && !/^-s$|^--size$/.test(args[j - 1] ?? "")) : operands, !["touch", "chmod", "chown"].includes(verb));
+    } else if (verb === "cp" || verb === "install" || verb === "ln") {
+      const t = args.findIndex((w) => w === "-t" || w === "--target-directory");
+      if (t >= 0 || args.some((w) => w.startsWith("--target-directory="))) unparsed = true;
+      else if (operands.length >= 2) add([operands[operands.length - 1]]);
+    } else if (verb === "mv") add(operands);
+    else if (verb === "dd") add(args.filter((w) => w.startsWith("of=")).map((w) => w.slice(3)));
+    else if (verb === "patch") unparsed = true;
+    else if (verb === "sed" && args.some((w) => /^-[a-zA-Z]*i|^--in-place/.test(w))) {
+      const ops = args.filter((w, j) => !w.startsWith("-") && !/^-[a-zA-Z]*[ef]$|^--expression$|^--file$/.test(args[j - 1] ?? "") && !(w === "" && /^-[a-zA-Z]*i$/.test(args[j - 1] ?? "")));
+      const scripted = args.some((w) => /^-[a-zA-Z]*[ef]$|^--expression|^--file/.test(w));
+      add(scripted ? ops : ops.slice(1));
+    } else if (verb === "perl" && args.some((w) => /^-[a-zA-Z]*i/.test(w))) {
+      add(args.filter((w, j) => !w.startsWith("-") && !/^-[a-zA-Z]*e$/.test(args[j - 1] ?? "")));
+    } else if (verb === "git") {
+      const sub = args[0] ?? "";
+      if (sub === "rm" || sub === "mv") add(operands.slice(1));
+      else if (sub === "checkout" || sub === "restore") {
+        const dd = args.indexOf("--");
+        if (dd >= 0) add(args.slice(dd + 1));
+        else if (sub === "restore") add(operands.slice(1));
+        else unparsed = true;
+      } else if (GIT_TREE_CHANGERS.has(sub)) unparsed = true;
+    } else if (INLINE_INTERP.has(verb.replace(/[0-9.]+$/, "")) && args.some((w) => /^-[a-zA-Z]*[ec]$|^eval$/.test(w)) && INLINE_WRITE.test(args.join(" "))) unparsed = true;
+  });
+  const bodies = substitutionBodies(command);
+  if (bodies.length && depth >= MAX_NEST) unparsed = true;
+  else for (const body of bodies) {
+    const r = shellWriteTargets(body, depth + 1);
+    out.push(...r.paths);
+    unparsed ||= r.unparsed;
+  }
+  if (depth === 0 && unobservable(command)) unparsed = true;
+  return { paths: [...new Set(out)], unparsed, certain: [...new Set(certain)] };
+}
 function deletedOperands(command, depth = 0) {
   const out = [];
   for (const t of shellTokens(command).reduce((acc, x) => ("op" in x && SEPARATORS.has(x.op) ? acc.push([]) : "word" in x && acc[acc.length - 1].push(x.word), acc), [[]])) {
-    let words = t;
-    while (words.length && (WRAPPERS.has(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
+    const words = unwrapCommand(t);
     const verb = words[0]?.split("/").pop();
-    const ops = words.slice(1).filter((w) => !w.startsWith("-"));
+    const ops = splitFlags(words.slice(1)).operands;
     if (verb === "rm" || verb === "unlink") out.push(...ops);
     else if (verb === "git" && words[1] === "rm") out.push(...ops.slice(1));
-    else if (verb && SHELLS.has(verb) && depth < 2) {
+    else if (verb && SHELLS.has(verb) && depth < MAX_NEST) {
       const k = words.findIndex((w) => /^-[a-z]*c$/.test(w));
       if (k >= 0 && words[k + 1]) out.push(...deletedOperands(words[k + 1], depth + 1));
     }
@@ -1485,7 +1938,7 @@ function stripShellComments(src) {
 }
 function writeTargets(a, repoRoot2) {
   if (a.kind !== "command" || !a.command) return { inside: [], outside: [] };
-  return splitPaths(repoRoot2, redirectTargets(a.command));
+  return splitPaths(repoRoot2, [...redirectTargets(a.command), ...shellWriteTargets(a.command).paths]);
 }
 var isWrite = (a) => a.kind === "edit" || a.kind === "write";
 var outOfScopeEdit = (a, ctx) => {
@@ -1512,6 +1965,11 @@ var MUTATING_VERBS = /(^|[\s;&|(])(rm|mv|cp|truncate|tee|chmod|chown|ln|unlink|p
 function commandPathTokens(command) {
   return (command.match(/[A-Za-z0-9_./@+-]+/g) ?? []).filter((t) => t.includes("/") || t.includes("."));
 }
+function allowedForTask(ctx, protectedPaths) {
+  const allow = ctx.contract?.allow ?? [];
+  if (!allow.length) return null;
+  return allow.map((g) => protectedPaths.some((p) => matchesAny(p, [g])) ? `${g} (except protected files)` : g).join(", ");
+}
 var protectedPathModified = (a, ctx) => {
   const protect = ctx.contract?.protect ?? [];
   if (isWrite(a)) {
@@ -1525,22 +1983,24 @@ var protectedPathModified = (a, ctx) => {
     }
     const hit = a.paths.filter((p) => matchesAny(p, protect));
     if (!hit.length) return null;
+    const allowed = allowedForTask(ctx, hit);
     return {
       rule: "protected_path_modified",
       action: "block",
-      message: `${PREFIX} ${hit.join(", ")} is protected by the task contract and must not change. Leave it as it is and make the implementation satisfy it. If the task truly requires changing it, stop and ask the user.`
+      message: allowed ? `${PREFIX} ${hit.join(", ")} is protected. Allowed for this task: ${allowed}. Change those instead; if the protected file must change, stop and ask the user.` : `${PREFIX} ${hit.join(", ")} is protected by the task contract and must not change. Leave it as it is and make the implementation satisfy it. If the task truly requires changing it, stop and ask the user.`
     };
   }
   if (a.kind === "command" && a.command) {
     const guarded = (p) => matchesAny(p, protect) !== null || p === ".replume" || p.startsWith(".replume/");
     const redirected = writeTargets(a, ctx.repoRoot).inside.filter(guarded);
-    const operands = splitPaths(ctx.repoRoot, fileVerbOperands(a.command)).inside.filter(guarded);
+    const operands = splitPaths(ctx.repoRoot, [a.command, ...innerScripts(a.command)].flatMap((c) => fileVerbOperands(c))).inside.filter(guarded);
     const hit = [.../* @__PURE__ */ new Set([...redirected, ...operands])];
     if (!hit.length) return null;
+    const allowed = allowedForTask(ctx, hit);
     return {
       rule: "protected_path_modified",
       action: "block",
-      message: `${PREFIX} this command would modify ${hit.join(", ")}, which the task contract protects. Do not change protected files through the shell either. If it is required, stop and ask the user.`
+      message: allowed ? `${PREFIX} this command would modify ${hit.join(", ")}, which is protected. Allowed for this task: ${allowed}. Change those instead; if the protected file must change, stop and ask the user.` : `${PREFIX} this command would modify ${hit.join(", ")}, which the task contract protects. Do not change protected files through the shell either. If it is required, stop and ask the user.`
     };
   }
   return null;
@@ -1548,7 +2008,7 @@ var protectedPathModified = (a, ctx) => {
 var ASSERTION = /\b(expect|assert(?:Equal|StrictEqual|DeepEqual|True|False|Raises|That)?|should)\s*[.(]|\bassert\s+\S|\bt\.(is|not|deepEqual|equal|ok|notOk|true|false|throws|same|match)\s*\(|\.(toBe|toEqual|toStrictEqual|toMatch|toThrow|toHaveBeenCalled\w*|toContain|toHaveLength)\s*\(/g;
 var SKIP_MARK = /\b(?:it|test|describe|suite|context)\.(?:skip|only|todo)\s*\(|\b(?:xit|xtest|xdescribe|fit|fdescribe)\s*\(|@pytest\.mark\.skip|@unittest\.skip|\bt\.skip\s*\(|\bpytest\.skip\s*\(|\.skip\s*=\s*true/g;
 var FORCED_SUCCESS = /(\b(test|jest|vitest|mocha|pytest|ava|tap|go test|cargo test|npm t)\b[^\n]*(\|\|\s*(true|:|exit 0)|;\s*exit 0))/;
-var count2 = (re, s) => (s.match(re) ?? []).length;
+var count3 = (re, s) => (s.match(re) ?? []).length;
 function assertionLiterals(s) {
   return s.split("\n").filter((l) => new RegExp(ASSERTION.source).test(l)).map((l) => l.trim()).sort();
 }
@@ -1561,7 +2021,7 @@ var testWeakened = (a) => {
         message: `${PREFIX} this command forces the test run to succeed (\`|| true\` / \`exit 0\`), which hides failures. Run the tests plainly and fix what fails.`
       };
     }
-    const rmTests = [...new Set(deletedOperands(a.command).filter((t) => isTestFile(t)))];
+    const rmTests = [...new Set([a.command, ...innerScripts(a.command)].flatMap((c) => deletedOperands(c)).filter((t) => isTestFile(t)))];
     if (rmTests.length) {
       return {
         rule: "test_weakened",
@@ -1580,8 +2040,8 @@ var testWeakened = (a) => {
       severity = "block";
     }
     if (!isTestFile(ch.path)) continue;
-    const removed = count2(ASSERTION, ch.before) - count2(ASSERTION, ch.after);
-    const skipsAdded = count2(SKIP_MARK, ch.after) - count2(SKIP_MARK, ch.before);
+    const removed = count3(ASSERTION, ch.before) - count3(ASSERTION, ch.after);
+    const skipsAdded = count3(SKIP_MARK, ch.after) - count3(SKIP_MARK, ch.before);
     if (ch.before && removed > 0) {
       findings.push(`${ch.path}: ${removed} assertion${removed > 1 ? "s" : ""} removed`);
       severity = "block";
@@ -1614,10 +2074,32 @@ var ALWAYS_DESTRUCTIVE = [
   { re: /\bgit\s+branch\s+-D\b/, why: "force-deletes a branch" },
   { re: /\b(DROP\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE\s+TABLE)\b/i, why: "drops or truncates database data" },
   { re: /\bDELETE\s+FROM\s+\w+\s*(;|$|")/i, why: "deletes every row of a table" },
-  { re: /\bmkfs(\.\w+)?\b|\bdd\s+[^\n]*of=\/dev\//, why: "overwrites a disk" },
   { re: /\bchmod\s+-R\s+777\s+\//, why: "makes the filesystem world-writable" },
   { re: /:\(\)\s*\{\s*:\|:&\s*\};:/, why: "is a fork bomb" }
 ];
+function shellScripts(command, depth = 0) {
+  if (depth >= MAX_NEST) return [];
+  const out = [];
+  const groups = [[]];
+  for (const t of shellTokens(command)) {
+    if ("op" in t) {
+      if (SEPARATORS.has(t.op)) groups.push([]);
+    } else groups[groups.length - 1].push(t.word);
+  }
+  for (const g of groups) {
+    const words = unwrapCommand(g);
+    if (!words.length || !SHELLS.has(words[0].split("/").pop())) continue;
+    const k = words.findIndex((w, i) => i > 0 && /^-[a-z]*c$/.test(w));
+    const script = k >= 0 ? words[k + 1] : void 0;
+    if (script) out.push(script, ...shellScripts(script, depth + 1));
+  }
+  return out;
+}
+function innerScripts(command, depth = 0) {
+  if (depth >= MAX_NEST) return [];
+  const direct = [...shellScripts(command, MAX_NEST - 1), ...substitutionBodies(command)];
+  return [...new Set(direct)].flatMap((x) => [x, ...innerScripts(x, depth + 1)]);
+}
 function deletionTargets(command) {
   const groups = [[]];
   for (const token of shellTokens(command)) {
@@ -1625,32 +2107,54 @@ function deletionTargets(command) {
       if (SEPARATORS.has(token.op)) groups.push([]);
     } else groups[groups.length - 1].push(token.word);
   }
-  const result = [];
-  for (let words of groups) {
-    while (words.length && (WRAPPERS.has(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
+  const result2 = [];
+  for (const g of groups) {
+    const words = unwrapCommand(g);
     const verb = words[0]?.split("/").pop();
     if (verb === "rm") {
-      const args = words.slice(1);
-      if (args.some((x) => /^-[^-]*[rR]/.test(x) || x === "--recursive"))
-        result.push({ targets: args.filter((x) => x !== "--" && !x.startsWith("-")), gitClean: false });
+      const { flags, operands } = splitFlags(words.slice(1));
+      if (flags.some((x) => /^-[^-]*[rR]/.test(x) || x === "--recursive")) result2.push({ targets: operands, gitClean: false });
     } else if (verb === "rmdir") {
-      result.push({ targets: words.slice(1).filter((x) => x !== "--" && !x.startsWith("-")), gitClean: false });
+      result2.push({ targets: splitFlags(words.slice(1)).operands, gitClean: false });
     } else if (verb === "find" && words.includes("-delete")) {
-      result.push({ targets: words.slice(1, words.indexOf("-delete")).filter((x) => x !== "--" && !x.startsWith("-") && x !== "-depth"), gitClean: false });
+      result2.push({ targets: words.slice(1, words.indexOf("-delete")).filter((x) => x !== "--" && !x.startsWith("-") && x !== "-depth"), gitClean: false });
     } else if (verb === "git") {
       const clean = words.indexOf("clean");
       if (clean < 0 || !words.slice(clean + 1).some((x) => /^-[^-]*f/.test(x) || x === "--force")) continue;
       const c = words.indexOf("-C");
       const cwd = c >= 0 && c < clean ? words[c + 1] : null;
       const paths = words.slice(clean + 1).filter((x) => x !== "--" && !x.startsWith("-"));
-      result.push({ targets: [...cwd ? [cwd] : [], ...paths], gitClean: true });
+      result2.push({ targets: [...cwd ? [cwd] : [], ...paths], gitClean: true });
     }
   }
-  return result;
+  return result2;
+}
+function expandTmpdirVar(target, ctx) {
+  const m = /^\$\{?TMPDIR\}?(?=\/|$)/.exec(target);
+  if (!m) return target;
+  const env = process.env.TMPDIR === void 0 ? tmpdir() : process.env.TMPDIR;
+  if (!env || !isAbsolute3(env)) return null;
+  const base3 = resolve2(env);
+  if (!isTempDir(ctx, base3)) return null;
+  return base3 + target.slice(m[0].length);
+}
+function isTempDir(ctx, abs) {
+  const roots = ["/tmp", "/private/tmp", "/var/tmp", "/private/var/tmp", ...ctx.scratchDirs ?? []].map((d) => resolve2(d));
+  return roots.some((d) => abs === d || abs.startsWith(d + sep)) || /^\/(?:private\/)?var\/folders\/[^/]+\/[^/]+\/T(?:\/|$)/.test(abs);
 }
 function deletionLocation(target, ctx) {
-  if (target.startsWith("~") || /[$*?{}`]/.test(target)) return "critical";
-  const expanded = target === "~" || target.startsWith("~/") ? homedir() + target.slice(1) : target;
+  const bare = target.replace(/^["']|["']$/g, "");
+  const t = expandTmpdirVar(bare, ctx);
+  if (t === null) return "critical";
+  if (t.startsWith("~") || /[$?{}`]/.test(t) && !/[*?[]/.test(t)) return "critical";
+  if (/[*?[]/.test(t)) {
+    const segs = t.split("/");
+    const gi = segs.findIndex((x) => /[*?[]/.test(x));
+    const prefix = segs.slice(0, gi).join("/") || (t.startsWith("/") ? "/" : "");
+    if (!/[$`{]/.test(prefix) && prefix && isTempDir(ctx, resolve2(ctx.repoRoot, prefix))) return "outside";
+    return "critical";
+  }
+  const expanded = t === "~" || t.startsWith("~/") ? homedir() + t.slice(1) : t;
   const abs = resolve2(ctx.repoRoot, expanded);
   const root = resolve2(ctx.repoRoot);
   const home = resolve2(homedir());
@@ -1658,6 +2162,32 @@ function deletionLocation(target, ctx) {
   const rel = relative3(root, abs);
   return !rel || !rel.startsWith("..") && !isAbsolute3(rel) ? "inside" : "outside";
 }
+function resolvedTarget(target, ctx) {
+  const t = expandTmpdirVar(target.replace(/^["']|["']$/g, ""), ctx) ?? target;
+  return resolve2(ctx.repoRoot, t);
+}
+function blockDeviceWrites(scripts) {
+  const out = shellWriteTargets(scripts[0] ?? "").paths.filter(isBlockDevice);
+  for (const script of scripts) {
+    const groups = [[]];
+    const toks = shellTokens(script);
+    for (let i = 0; i < toks.length; i++) {
+      const t = toks[i];
+      if ("op" in t) {
+        if (SEPARATORS.has(t.op)) groups.push([]);
+        else if (WRITE_OPS.has(t.op) || t.op === "<" || t.op === "<<<" || t.op === "<<") i++;
+        continue;
+      }
+      groups[groups.length - 1].push(t.word);
+    }
+    for (const g of groups) {
+      const words = unwrapCommand(g);
+      const verb = words[0]?.split("/").pop() ?? "";
+      if (verb === "mkfs" || verb.startsWith("mkfs.") || verb === "mkswap") out.push(...splitFlags(words.slice(1)).operands.filter(isBlockDevice));
+    }
+  }
+  return [...new Set(out)];
+}
 function rmRfTargets(command) {
   const out = [];
   for (const seg of command.split(/&&|\|\||;|\|/)) {
@@ -1691,7 +2221,14 @@ var destructiveCommand = (a, ctx) => {
       };
     }
   }
-  const deletions = deletionTargets(cmd);
+  const scripts = [cmd, ...innerScripts(cmd)];
+  const devices = blockDeviceWrites(scripts);
+  if (devices.length) return {
+    rule: "destructive_command",
+    action: "block",
+    message: `${PREFIX} this command writes to a raw disk or block device (${devices.join(", ")}), which overwrites what is on it. It is blocked. If this is really intended, ask the user to run it themselves.`
+  };
+  const deletions = scripts.flatMap(deletionTargets);
   const deletionPaths = deletions.flatMap((d) => d.targets);
   const critical = deletionPaths.filter((p) => deletionLocation(p, ctx) === "critical");
   if (critical.length) return {
@@ -1699,7 +2236,7 @@ var destructiveCommand = (a, ctx) => {
     action: "block",
     message: `${PREFIX} this command can delete the home directory, filesystem root, or a parent of this repository (${critical.join(", ")}). It is blocked.`
   };
-  const foreignDeletion = deletionPaths.filter((p) => deletionLocation(p, ctx) === "outside" && !matchesAny(resolve2(ctx.repoRoot, p), ctx.contract?.allow ?? []));
+  const foreignDeletion = deletionPaths.filter((p) => deletionLocation(p, ctx) === "outside" && !matchesAny(resolvedTarget(p, ctx), ctx.contract?.allow ?? []));
   if (foreignDeletion.length) return {
     rule: "destructive_command",
     action: "warn",
@@ -1719,11 +2256,11 @@ var destructiveCommand = (a, ctx) => {
       };
     }
   }
-  for (const targets of rmRfTargets(cmd)) {
+  for (const targets of scripts.flatMap(rmRfTargets)) {
     const bad = targets.filter((t) => {
       const clean = t.replace(/^["']|["']$/g, "");
-      if (/^(\/|~|\$HOME|\*|\.{1,2}\/?)$/.test(clean) || clean.startsWith("~") || clean.includes("$")) return true;
-      const { inside, outside } = splitPaths(ctx.repoRoot, [clean]);
+      if (/^(\/|~|\$HOME|\*|\.{1,2}\/?)$/.test(clean) || clean.startsWith("~") || deletionLocation(clean, ctx) === "critical") return true;
+      const { inside, outside } = splitPaths(ctx.repoRoot, [expandTmpdirVar(clean, ctx) ?? clean]);
       if (outside.length) return !inScratch(ctx, outside[0]);
       return !REGENERABLE.test(inside[0]);
     });
@@ -1743,7 +2280,7 @@ var destructiveCommand = (a, ctx) => {
       message: `${PREFIX} this command deletes backup files. It is blocked; ask the user before removing backups.`
     };
   }
-  const verbTargets = MUTATING_VERBS.test(cmd) ? a.outsidePaths : [];
+  const verbTargets = MUTATING_VERBS.test(cmd) ? a.outsidePaths.filter((p) => !p.startsWith("/dev/")) : [];
   const foreign = [.../* @__PURE__ */ new Set([...verbTargets, ...writeTargets(a, ctx.repoRoot).outside])].filter((p) => !inScratch(ctx, p) && !DEVICE_SINK.test(p));
   if (foreign.length) {
     return {
@@ -2034,7 +2571,7 @@ function parseJudgeResponse(x) {
 function commandJudge(executable, apiKey) {
   return {
     name: `command:${executable}`,
-    judge: (req, signal) => new Promise((resolve7, reject) => {
+    judge: (req, signal) => new Promise((resolve9, reject) => {
       const env = { PATH: process.env.PATH, HOME: process.env.HOME };
       if (apiKey) env[ENV.apiKey] = apiKey;
       const child = spawn(executable, [], { env, stdio: ["pipe", "pipe", "pipe"], signal });
@@ -2051,7 +2588,7 @@ function commandJudge(executable, apiKey) {
         if (code !== 0) return reject(new Error(`judge command exited ${code}: ${err.trim().slice(0, 200)}`));
         if (stdinError) return reject(new Error(`judge command stdin failed: ${stdinError.message}`));
         try {
-          resolve7(parseJudgeResponse(JSON.parse(out)));
+          resolve9(parseJudgeResponse(JSON.parse(out)));
         } catch (e) {
           reject(e);
         }
@@ -2415,12 +2952,12 @@ async function supervise(input, opts) {
 }
 
 // src/supervisor/done.ts
-import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { join as join9 } from "path";
 
 // src/sandbox/scenarios.ts
 import { lstat, readdir, readFile, realpath } from "fs/promises";
-import { join as join6, relative as relative4, sep as sep2 } from "path";
+import { join as join8, relative as relative4, sep as sep2 } from "path";
 var required = (ok, file2, field) => {
   if (!ok) throw new Error(`${file2}: invalid or missing ${field}`);
 };
@@ -2463,14 +3000,14 @@ async function loadScenarios(dir, root = dir) {
   if (!inside(await realpath(dir))) throw new Error(`scenario directory ${rel(dir)} resolves outside the commit; ${NOT_REGULAR}`);
   const files = (await readdir(dir)).filter((n) => n.endsWith(".yaml") || n.endsWith(".yml")).sort();
   for (const n of files) {
-    const p = join6(dir, n);
+    const p = join8(dir, n);
     const st = await lstat(p);
     if (st.isSymbolicLink()) throw new Error(`scenario file ${rel(p)} is a symbolic link; ${NOT_REGULAR}`);
     if (!st.isFile()) throw new Error(`scenario file ${rel(p)} is not a regular file; ${NOT_REGULAR}`);
     if (!inside(await realpath(p))) throw new Error(`scenario file ${rel(p)} resolves outside the commit; ${NOT_REGULAR}`);
   }
   const scenarios = await Promise.all(files.map(async (n) => {
-    const s = parseScenario(await readFile(join6(dir, n), "utf8"), n);
+    const s = parseScenario(await readFile(join8(dir, n), "utf8"), n);
     required(n.replace(/\.ya?ml$/, "") === s.id, n, "id (must match filename)");
     return s;
   }));
@@ -2552,10 +3089,10 @@ function doneStatus(contract, sessionEvents, repoRoot2) {
   for (const d of entries) {
     if ("run" in d) need(d.run, `\`${d.run}\``, d.run);
     else {
-      const file2 = join7(".replume", "scenarios", `${d.scenario}.yaml`);
+      const file2 = join9(".replume", "scenarios", `${d.scenario}.yaml`);
       let run = null;
       try {
-        if (existsSync6(join7(repoRoot2, file2))) run = parseScenario(readFileSync7(join7(repoRoot2, file2), "utf-8"), file2).run;
+        if (existsSync7(join9(repoRoot2, file2))) run = parseScenario(readFileSync8(join9(repoRoot2, file2), "utf-8"), file2).run;
       } catch {
         run = null;
       }
@@ -2572,7 +3109,7 @@ function doneMessage(s) {
 }
 
 // src/agents/claude/payload.ts
-import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { existsSync as existsSync8, readFileSync as readFileSync9 } from "fs";
 import { isAbsolute as isAbsolute4, resolve as resolve3 } from "path";
 function parsePayload(text) {
   const x = JSON.parse(text);
@@ -2585,13 +3122,13 @@ function parsePayload(text) {
 var str = (v) => typeof v === "string" ? v : "";
 function readIfExists(path) {
   try {
-    return existsSync7(path) ? readFileSync8(path, "utf-8") : "";
+    return existsSync8(path) ? readFileSync9(path, "utf-8") : "";
   } catch {
     return "";
   }
 }
 function absolutePathsIn(command) {
-  return (command.match(/(?<![\w.:/])(?:\/|~\/)[\w.@+-]+(?:\/[\w.@+-]*)*/g) ?? []).map(
+  return (command.match(/(?<![\w.:/])(?:\/|~\/)[\w.@+-]+(?:\/[\w.@+-]*)*(?![\w.@+(/-])/g) ?? []).map(
     (p) => p.startsWith("~/") ? resolve3(process.env.HOME ?? "/", p.slice(2)) : p
   );
 }
@@ -2601,14 +3138,24 @@ function toProposedAction(p, repoRoot2) {
   let kind = "other";
   let rawPaths = [];
   let command = null;
+  let writeTargetNotParsed = false;
+  let mentioned = [];
+  let certainRaw = [];
   const pending = [];
-  const abs = (fp) => isAbsolute4(fp) ? fp : resolve3(p.cwd, fp);
+  const abs = (fp) => {
+    const h = expandHome(fp);
+    return isAbsolute4(h) || h.startsWith("~") ? h : resolve3(p.cwd, h);
+  };
   switch (tool) {
     case "Bash":
     case "PowerShell": {
       kind = "command";
       command = str(input.command);
-      rawPaths = absolutePathsIn(command);
+      const w = tool === "Bash" ? shellWriteTargets(command) : { paths: [], unparsed: false };
+      writeTargetNotParsed = w.unparsed;
+      rawPaths = w.paths.map(abs);
+      certainRaw = "certain" in w ? w.certain.map(abs) : [];
+      mentioned = absolutePathsIn(command);
       break;
     }
     case "Write": {
@@ -2654,13 +3201,15 @@ function toProposedAction(p, repoRoot2) {
       break;
     }
   }
-  const { inside, outside } = splitPaths(repoRoot2, rawPaths.filter(Boolean));
+  const { inside, outside: writtenOutside } = splitPaths(repoRoot2, rawPaths.filter(Boolean));
+  const outside = [.../* @__PURE__ */ new Set([...writtenOutside, ...splitPaths(repoRoot2, mentioned).outside])];
+  const certainPaths = [...new Set(splitPaths(repoRoot2, certainRaw).inside)];
   const changes = [];
   for (const c of pending) {
     const rel = splitPaths(repoRoot2, [c.abs]).inside[0];
     if (rel !== void 0) changes.push({ path: rel, before: c.before, after: c.after });
   }
-  return { kind, tool, paths: inside, outsidePaths: outside, command, changes, fingerprint: fingerprint(tool, input) };
+  return { kind, tool, paths: [...new Set(inside)], outsidePaths: outside, command, changes, fingerprint: fingerprint(tool, input), ...writeTargetNotParsed ? { writeTargetNotParsed } : {}, ...kind === "command" ? { certainPaths } : {} };
 }
 
 // src/agents/claude/handler.ts
@@ -2673,8 +3222,13 @@ function resolveRepoRoot(p, env = process.env) {
     return p.cwd;
   }
 }
+var WRITE_NOT_PARSED = "write target not parsed";
+function writeFields(a) {
+  if (a.kind !== "command") return {};
+  return { writes: a.certainPaths ?? a.paths, ...a.writeTargetNotParsed ? { writeNote: WRITE_NOT_PARSED } : {} };
+}
 function summarize(a) {
-  if (a.command !== null) return `${a.tool}: ${a.command}`;
+  if (a.command !== null) return `${a.tool}: ${a.command}${a.writeTargetNotParsed ? ` (${WRITE_NOT_PARSED})` : ""}`;
   const targets = [...a.paths, ...a.outsidePaths];
   return targets.length ? `${a.tool} ${targets.join(", ")}` : a.tool;
 }
@@ -2762,14 +3316,14 @@ function decide(p, repoRoot2, proposal, sessionEvents, env, deps) {
   };
   const opts = { layer2, judge, sessionEvents, slot };
   if (layer2Inactive(opts)) return { result: superviseSync(input, opts), contract };
-  return supervise(input, opts).then((result) => ({ result, contract }));
+  return supervise(input, opts).then((result2) => ({ result: result2, contract }));
 }
 function preToolUse(p, repoRoot2, env, deps) {
   const ledger = ledgerPath(repoRoot2);
   const action = toProposedAction(p, repoRoot2);
   const session = readEvents(ledger).events.filter((e) => e.sessionId === p.session_id);
-  return andThen(decide(p, repoRoot2, { kind: "action", action }, session, env, deps), ({ result, contract }) => {
-    const deciding = result.findings.find((f) => f.decision === result.decision);
+  return andThen(decide(p, repoRoot2, { kind: "action", action }, session, env, deps), ({ result: result2, contract }) => {
+    const deciding = result2.findings.find((f) => f.decision === result2.decision);
     appendEvent(ledger, {
       ...base(p, "tool_pre"),
       tool: action.tool,
@@ -2777,21 +3331,22 @@ function preToolUse(p, repoRoot2, env, deps) {
       command: action.command,
       summary: summarize(action),
       rule: deciding?.rule ?? null,
-      action: ledgerAction(result.decision),
-      message: result.message,
+      action: ledgerAction(result2.decision),
+      message: result2.message,
       raw: {
         fingerprint: action.fingerprint,
-        decision: result.decision,
-        layer: result.layer,
-        layer2Mode: result.layer2.mode,
+        decision: result2.decision,
+        layer: result2.layer,
+        layer2Mode: result2.layer2.mode,
         tool_use_id: p.tool_use_id ?? null,
-        tool_input: p.tool_input ?? null
+        tool_input: p.tool_input ?? null,
+        ...writeFields(action)
       }
     });
     const rec = { p, ledger, tool: action.tool, paths: action.paths, command: action.command, target: summarize(action), contractId: contract?.id ?? null };
-    recordFindings(rec, result.findings);
-    recordLayer2(rec, result.layer2Run, result.layer2.mode);
-    return { exitCode: 0, stdout: decisionOutput("PreToolUse", result), stderr: "" };
+    recordFindings(rec, result2.findings);
+    recordLayer2(rec, result2.layer2Run, result2.layer2.mode);
+    return { exitCode: 0, stdout: decisionOutput("PreToolUse", result2), stderr: "" };
   });
 }
 var DONE_SLOT_RULE = "done_stop_slot";
@@ -2819,18 +3374,18 @@ function stop(p, repoRoot2, env, deps) {
   const session = readEvents(ledger).events.filter((e) => e.sessionId === p.session_id);
   const lastAssistantMessage = typeof p.last_assistant_message === "string" ? p.last_assistant_message : "";
   const stopHookActive = p.stop_hook_active === true;
-  return andThen(decide(p, repoRoot2, { kind: "stop", lastAssistantMessage, stopHookActive }, session, env, deps), ({ result, contract }) => {
-    const deciding = result.findings.find((f) => f.decision === result.decision);
+  return andThen(decide(p, repoRoot2, { kind: "stop", lastAssistantMessage, stopHookActive }, session, env, deps), ({ result: result2, contract }) => {
+    const deciding = result2.findings.find((f) => f.decision === result2.decision);
     const done = contract?.done?.length && !stopHookActive ? doneStatus(contract, session, repoRoot2) : null;
     const cap = contract?.max_stop_blocks ?? DEFAULT_MAX_STOP_BLOCKS;
     const unmet = done !== null && done.missing.length > 0;
     const slot = unmet ? reserveStopSlot(p, ledger) : null;
     const blocksSoFar = slot?.ahead ?? 0;
     const blockStop = unmet && blocksSoFar < cap;
-    const steer = result.decision === "block" ? { decision: "steer", message: result.message } : result;
+    const steer = result2.decision === "block" ? { decision: "steer", message: result2.message } : result2;
     const doneText = !unmet ? null : blockStop ? `${doneMessage(done)} (stop block ${blocksSoFar + 1} of ${cap})` : `${doneMessage(done)} Replume is not blocking again (max_stop_blocks ${cap} reached).`;
     const message = doneText ? [doneText, steer.decision === "ok" ? "" : steer.message ?? ""].filter(Boolean).join("\n") : null;
-    const stopDecision = doneText ? blockStop ? "block" : "steer" : result.decision;
+    const stopDecision = doneText ? blockStop ? "block" : "steer" : result2.decision;
     appendEvent(ledger, {
       ...base(p, "stop"),
       tool: null,
@@ -2839,19 +3394,19 @@ function stop(p, repoRoot2, env, deps) {
       summary: stopHookActive ? "agent finished its turn (continuing after stop-hook feedback)" : "agent finished its turn",
       rule: doneText ? DONE_RULE : deciding?.rule ?? null,
       action: ledgerAction(stopDecision),
-      message: message ?? result.message,
+      message: message ?? result2.message,
       raw: {
         decision: stopDecision,
-        layer: result.layer,
-        layer2Mode: result.layer2.mode,
+        layer: result2.layer,
+        layer2Mode: result2.layer2.mode,
         stopHookActive,
         lastAssistantMessage: lastAssistantMessage.slice(0, 2e3),
         ...done ? { done: { checked: done.checked, missing: done.missing, blocked: blockStop } } : {}
       }
     });
     const rec = { p, ledger, tool: null, paths: [], command: null, target: "stop", contractId: contract?.id ?? null };
-    recordFindings(rec, result.findings);
-    recordLayer2(rec, result.layer2Run, result.layer2.mode);
+    recordFindings(rec, result2.findings);
+    recordLayer2(rec, result2.layer2Run, result2.layer2.mode);
     if (!unmet || !doneText || !message) return { exitCode: 0, stdout: decisionOutput("Stop", steer), stderr: "" };
     appendEvent(ledger, {
       ...base(p, "rule_hit"),
@@ -2886,6 +3441,7 @@ function postToolUse(p, repoRoot2, failed) {
       tool_use_id: p.tool_use_id ?? null,
       duration_ms: p.duration_ms ?? null,
       ok: !failed,
+      ...writeFields(action),
       ...failed ? {
         exitCode: exitMatch ? Number(exitMatch[1]) : null,
         isInterrupt: p.is_interrupt === true,
@@ -2913,9 +3469,9 @@ function prompt(p, repoRoot2) {
 }
 function failOpen(err, repoRoot2, env) {
   try {
-    const dir = join8(repoRoot2 ?? env.CLAUDE_PROJECT_DIR ?? process.cwd(), REPLUME_DIR);
+    const dir = join10(repoRoot2 ?? env.CLAUDE_PROJECT_DIR ?? process.cwd(), REPLUME_DIR);
     mkdirSync6(dir, { recursive: true });
-    appendFileSync3(join8(dir, "hook-errors.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${err.stack ?? err}
+    appendFileSync3(join10(dir, "hook-errors.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${err.stack ?? err}
 `);
   } catch {
   }
@@ -2950,19 +3506,19 @@ function handleClaudeHook(stdinText, env = process.env, deps = {}) {
         out = QUIET;
     }
     const root = repoRoot2;
-    const finish = (result) => {
+    const finish = (result2) => {
       if ((p.hook_event_name === "Stop" || p.hook_event_name === "SessionEnd") && p.transcript_path) {
         const contract = loadContract(contractPath(root));
         if (contract && contract.status !== "draft") captureClaudeUsage({
           repoRoot: root,
-          allowedRoot: join8(env.HOME ?? homedir2(), ".claude", "projects"),
+          allowedRoot: join10(env.HOME ?? homedir2(), ".claude", "projects"),
           transcriptPath: p.transcript_path,
           taskId: contract.id,
           sessionId: p.session_id,
           final: p.hook_event_name === "SessionEnd"
         });
       }
-      return result;
+      return result2;
     };
     return out instanceof Promise ? out.then(finish).catch((err) => failOpen(err, root, env)) : Promise.resolve(finish(out));
   } catch (err) {
@@ -3217,13 +3773,16 @@ function ruleDecisionToHookResponse(hookEventName, decision2) {
 }
 
 // src/agents/cursor/action.ts
-import { isAbsolute as isAbsolute6, join as join9 } from "path";
+import { isAbsolute as isAbsolute6, join as join11 } from "path";
 var str2 = (v) => typeof v === "string" && v.length > 0 ? v : null;
 function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
   const hook2 = str2(raw3.hook_event_name);
   const toolInput = raw3.tool_input && typeof raw3.tool_input === "object" ? raw3.tool_input : {};
   const command = str2(raw3.command) && hook2 !== "beforeMCPExecution" ? str2(raw3.command) : str2(raw3.tool_name) === "Shell" ? str2(toolInput.command) : fallback.command ?? null;
-  const abs = (p) => isAbsolute6(p) ? p : join9(repoRoot2, p);
+  const abs = (p) => {
+    const h = expandHome(p);
+    return isAbsolute6(h) || h.startsWith("~") ? h : join11(repoRoot2, h);
+  };
   const proposedPath = hook2 === "preToolUse" && /write|edit|delete/i.test(str2(raw3.tool_name) ?? "") ? str2(toolInput.file_path) : null;
   const files = [str2(raw3.file_path), proposedPath, ...fallback.paths ?? []].filter((p) => !!p).map(abs);
   const edits = Array.isArray(raw3.edits) ? raw3.edits : [];
@@ -3231,7 +3790,8 @@ function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
   if (command) kind = "command";
   else if (edits.length || hook2 === "afterFileEdit" || hook2 === "afterTabFileEdit" || /write|edit|delete/i.test(fallback.tool ?? "")) kind = "edit";
   else if (hook2 === "beforeReadFile" || hook2 === "beforeTabFileRead" || /read|grep/i.test(fallback.tool ?? "")) kind = "read";
-  const { inside, outside } = splitPaths(repoRoot2, [...new Set(files)]);
+  const w = kind === "command" && command ? shellWriteTargets(command) : null;
+  const { inside, outside } = splitPaths(repoRoot2, w ? w.paths.map(abs) : [...new Set(files)]);
   const changes = kind === "edit" && inside.length && edits.length ? [
     {
       path: inside[0],
@@ -3247,7 +3807,9 @@ function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
     outsidePaths: outside,
     command,
     changes,
-    fingerprint: fingerprint(tool, { files: inside, command, edits })
+    fingerprint: fingerprint(tool, { files: inside, command, edits }),
+    ...w?.unparsed ? { writeTargetNotParsed: true } : {},
+    ...w ? { certainPaths: [...new Set(splitPaths(repoRoot2, w.certain.map(abs)).inside)] } : {}
   };
 }
 
@@ -3272,12 +3834,14 @@ function handleCursorHook(stdinText, env = process.env) {
       action: evaluation?.action ?? "ok",
       message: evaluation?.message ?? null
     };
+    const writes = action.kind === "command" ? { writes: action.certainPaths ?? action.paths, ...action.writeTargetNotParsed ? { writeNote: "write target not parsed" } : {} } : {};
     appendEvent(ledger, sanitizeCursorLedgerEvent({
       ...event,
+      ...action.kind === "command" ? { paths: action.paths } : {},
       rule: decision2.rule,
       action: decision2.action,
       message: decision2.message,
-      raw: { ...event.raw, fingerprint: action.fingerprint }
+      raw: { ...event.raw, fingerprint: action.fingerprint, ...writes }
     }, root));
     for (const hit of evaluation?.hits ?? []) {
       appendEvent(ledger, sanitizeCursorLedgerEvent(ruleHitEvent(event, hit, { id: newEventId(), ts: (/* @__PURE__ */ new Date()).toISOString() }), root));
@@ -3289,10 +3853,221 @@ function handleCursorHook(stdinText, env = process.env) {
   }
 }
 
-// src/agents/cursor/install.ts
+// src/agents/codex/handler.ts
+import { execFileSync as execFileSync6 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync8, mkdirSync as mkdirSync7, readFileSync as readFileSync9, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve6 } from "path";
+
+// src/agents/codex/action.ts
+import { resolve as resolve5 } from "path";
+function codexAction(payload, root) {
+  const tool = typeof payload.tool_name === "string" ? payload.tool_name : "unknown";
+  const input = payload.tool_input && typeof payload.tool_input === "object" && !Array.isArray(payload.tool_input) ? payload.tool_input : {};
+  const command = typeof input.command === "string" ? input.command : "";
+  if (tool === "Bash") {
+    return toProposedAction({ session_id: "", cwd: String(payload.cwd), hook_event_name: "PreToolUse", tool_name: tool, tool_input: input }, root);
+  }
+  if (tool === "apply_patch") {
+    const rawPaths = [...command.matchAll(/^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm)].map((m) => m[1].trim());
+    const { inside, outside } = splitPaths(root, rawPaths.map((p) => resolve5(String(payload.cwd), p)));
+    return {
+      kind: "edit",
+      tool,
+      paths: [...new Set(inside)],
+      outsidePaths: outside,
+      command: null,
+      changes: [],
+      fingerprint: fingerprint(tool, input)
+    };
+  }
+  return { kind: "other", tool, paths: [], outsidePaths: [], command: null, changes: [], fingerprint: fingerprint(tool, input) };
+}
+
+// src/agents/codex/handler.ts
+var QUIET2 = { stdout: "", stderr: "", exitCode: 0 };
+var object = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+var str3 = (x) => typeof x === "string" ? x : "";
+var result = (stdout) => ({ ...QUIET2, stdout });
+var fileHash = (path) => {
+  try {
+    return createHash2("sha256").update(readFileSync10(path)).digest("hex");
+  } catch {
+    return null;
+  }
+};
+function handleCodexHook(stdinText) {
+  try {
+    if (stdinText.length > 1024 * 1024) throw new Error("oversized hook input");
+    const p = JSON.parse(stdinText);
+    if (!object(p) || !str3(p.session_id) || !str3(p.cwd) || !str3(p.hook_event_name)) throw new Error("invalid hook input");
+    const cwd = resolve6(str3(p.cwd));
+    let root = cwd;
+    try {
+      root = execFileSync6("git", ["rev-parse", "--show-toplevel"], { cwd, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    } catch {
+    }
+    if (!existsSync9(resolve6(root, ".replume"))) return QUIET2;
+    const ledger = ledgerPath(root);
+    const base3 = (type) => ({
+      agent: "codex",
+      agentVersion: null,
+      sessionId: str3(p.session_id),
+      type,
+      tool: null,
+      paths: [],
+      command: null,
+      summary: str3(p.hook_event_name),
+      rule: null,
+      action: null,
+      message: null
+    });
+    const event = str3(p.hook_event_name);
+    if (event === "UserPromptSubmit") {
+      appendEvent(ledger, { ...base3("prompt"), summary: "Codex prompt received" });
+      return QUIET2;
+    }
+    if (event === "Stop" || event === "SessionEnd") {
+      appendEvent(ledger, { ...base3("stop"), summary: `Codex ${event}` });
+      return QUIET2;
+    }
+    if (event !== "PreToolUse" && event !== "PostToolUse") return QUIET2;
+    const a = codexAction(p, root);
+    const raw3 = {
+      tool_use_id: str3(p.tool_use_id),
+      fingerprint: a.fingerprint,
+      ...a.kind === "command" ? { writes: a.certainPaths ?? a.paths, ...a.writeTargetNotParsed ? { writeNote: "write target not parsed" } : {} } : {}
+    };
+    const loaded = loadContract(contractPath(root));
+    const contract = isDraft(loaded) ? null : loaded;
+    if (event === "PreToolUse") {
+      const history = readEvents(ledger).events.filter((e) => e.sessionId === str3(p.session_id));
+      const verdict = evaluate(a, { contract, history, repoRoot: root });
+      const first = verdict.hits[0];
+      appendEvent(ledger, {
+        ...base3("tool_pre"),
+        tool: a.tool,
+        paths: a.paths,
+        command: a.command,
+        summary: a.command ? `${a.tool}: ${a.command}` : `${a.tool} ${a.paths.join(", ")}`,
+        rule: first?.rule ?? null,
+        action: verdict.action,
+        message: verdict.message,
+        raw: { ...raw3, beforeHashes: a.kind === "edit" ? Object.fromEntries(a.paths.map((path) => [path, fileHash(resolve6(root, path))])) : void 0 }
+      });
+      for (const hit of verdict.hits) appendEvent(ledger, {
+        ...base3("rule_hit"),
+        tool: a.tool,
+        paths: a.paths,
+        command: a.command,
+        summary: `${hit.rule}: ${hit.action}`,
+        rule: hit.rule,
+        action: hit.action,
+        message: hit.message,
+        raw: { tool_use_id: str3(p.tool_use_id), layer: "layer1", sentToAgent: true }
+      });
+      if (verdict.action === "block") return result(JSON.stringify({ hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: verdict.message
+      } }));
+      if (verdict.action === "warn") return result(JSON.stringify({ hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        additionalContext: verdict.message
+      } }));
+      return QUIET2;
+    }
+    const response = object(p.tool_response) ? p.tool_response : {};
+    const responseText = str3(p.tool_response);
+    const exit = typeof response.exit_code === "number" ? response.exit_code : typeof response.exitCode === "number" ? response.exitCode : /^Exit code: (\d+)\b/m.exec(responseText)?.[1];
+    const success = exit === 0 || exit === "0";
+    const prior = readEvents(ledger).events.reverse().find((e) => e.type === "tool_pre" && e.raw?.tool_use_id === str3(p.tool_use_id));
+    const before = prior?.raw?.beforeHashes;
+    const changed = a.paths.filter((path) => before && path in before && fileHash(resolve6(root, path)) !== before[path]);
+    appendEvent(ledger, {
+      ...base3("tool_post"),
+      tool: a.tool,
+      paths: a.paths,
+      command: a.command,
+      summary: `${a.tool} completed`,
+      raw: { ...raw3, ok: success }
+    });
+    if (a.kind === "edit" && changed.length && (success || responseText.includes("Success."))) {
+      for (const path of changed)
+        appendEvent(ledger, {
+          ...base3("file_edit"),
+          tool: a.tool,
+          paths: [path],
+          summary: `${a.tool} changed ${path}`,
+          action: "ok",
+          raw: raw3
+        });
+    } else if (a.kind === "command") {
+      appendEvent(ledger, {
+        ...base3("command"),
+        tool: a.tool,
+        paths: a.paths,
+        command: a.command,
+        summary: `${a.tool}: ${a.command}`,
+        raw: { ...raw3, ok: success }
+      });
+    }
+    return QUIET2;
+  } catch {
+    return { stdout: "", stderr: "replume codex hook: failed to process payload\n", exitCode: 0 };
+  }
+}
+
+// src/agents/codex/install.ts
+import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, join as join12 } from "path";
+var CODEX_HOOK_COMMAND = "replume hook codex";
+var CODEX_HOOK_EVENTS = ["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SessionEnd"];
+var codexHooksPath = (root) => join12(root, ".codex", "hooks.json");
+var obj2 = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+function mergeCodexHooks(config, command = CODEX_HOOK_COMMAND) {
+  if (config.hooks !== void 0 && !obj2(config.hooks)) throw new Error("hooks must be an object");
+  const hooks = { ...config.hooks ?? {} };
+  const added = [];
+  for (const event of CODEX_HOOK_EVENTS) {
+    const groups = hooks[event] ?? [];
+    if (!Array.isArray(groups)) throw new Error(`hooks.${event} must be an array`);
+    if (groups.some((g) => obj2(g) && Array.isArray(g.hooks) && g.hooks.some((h) => obj2(h) && h.command === command))) continue;
+    const entry = { hooks: [{ type: "command", command, timeout: event === "SessionEnd" ? 2 : 10 }] };
+    hooks[event] = [...groups, event === "PreToolUse" || event === "PostToolUse" ? { matcher: "^(Bash|apply_patch)$", ...entry } : entry];
+    added.push(event);
+  }
+  return { config: { ...config, hooks }, added };
+}
+function validateCodexHooks(root) {
+  const path = codexHooksPath(root);
+  if (!existsSync10(path)) return;
+  try {
+    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    if (!obj2(parsed)) throw new Error("expected an object");
+    mergeCodexHooks(parsed);
+  } catch (e) {
+    throw new Error(`${path} is invalid (${e.message}); nothing was changed. Fix it and run replume init again.`);
+  }
+}
+function installCodexHooks(root) {
+  validateCodexHooks(root);
+  const path = codexHooksPath(root);
+  const original = existsSync10(path) ? readFileSync11(path, "utf8") : null;
+  const parsed = original ? JSON.parse(original) : {};
+  const { config, added } = mergeCodexHooks(parsed);
+  if (added.length) {
+    mkdirSync7(dirname5(path), { recursive: true });
+    if (original !== null && !existsSync10(`${path}.replume-backup`)) copyFileSync2(path, `${path}.replume-backup`);
+    writeFileSync5(path, JSON.stringify(config, null, 2) + "\n");
+  }
+  return { path, added, backupPath: original === null ? null : `${path}.replume-backup` };
+}
+
+// src/agents/cursor/install.ts
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join13 } from "path";
 var CURSOR_HOOK_COMMAND = "replume hook cursor";
 var CURSOR_HOOK_EVENTS = [
   "preToolUse",
@@ -3306,9 +4081,9 @@ var CURSOR_HOOK_EVENTS = [
   "stop",
   "sessionEnd"
 ];
-var hash = (text) => createHash2("sha256").update(text).digest("hex");
+var hash = (text) => createHash3("sha256").update(text).digest("hex");
 var isObject = (x) => !!x && typeof x === "object" && !Array.isArray(x);
-var cursorHooksPath = (root) => join10(root, ".cursor", "hooks.json");
+var cursorHooksPath = (root) => join13(root, ".cursor", "hooks.json");
 var backupPathFor = (path) => `${path}.replume-backup`;
 var statePathFor = (path) => `${path}.replume-state.json`;
 function parseConfig(text, path) {
@@ -3332,17 +4107,17 @@ function exactInstalledEntry(x, command) {
 function validateCursorHooksConfig(root, opts = {}) {
   const path = cursorHooksPath(root);
   const command = opts.command ?? CURSOR_HOOK_COMMAND;
-  const config = existsSync8(path) ? parseConfig(readFileSync9(path, "utf8"), path) : {};
+  const config = existsSync11(path) ? parseConfig(readFileSync12(path, "utf8"), path) : {};
   const hooks = config.hooks ?? {};
   for (const event of CURSOR_HOOK_EVENTS) {
     if (hooks[event] !== void 0 && !Array.isArray(hooks[event]))
       throw new Error(`${path}.hooks.${event} is not an array; nothing was changed. Fix it and run replume init again.`);
   }
   const statePath = statePathFor(path);
-  if (existsSync8(statePath)) {
+  if (existsSync11(statePath)) {
     let state;
     try {
-      state = JSON.parse(readFileSync9(statePath, "utf8"));
+      state = JSON.parse(readFileSync12(statePath, "utf8"));
     } catch {
       throw new Error(`${statePath} is not valid JSON; nothing was changed. Fix it and run replume init again.`);
     }
@@ -3354,9 +4129,9 @@ function installCursorHooks(root, opts = {}) {
   const path = cursorHooksPath(root);
   const backupPath = backupPathFor(path);
   const statePath = statePathFor(path);
-  const hadOriginal = existsSync8(path);
+  const hadOriginal = existsSync11(path);
   const command = opts.command ?? CURSOR_HOOK_COMMAND;
-  const original = hadOriginal ? readFileSync9(path, "utf8") : null;
+  const original = hadOriginal ? readFileSync12(path, "utf8") : null;
   const config = original === null ? {} : parseConfig(original, path);
   const hooks = { ...config.hooks ?? {} };
   const added = [];
@@ -3368,36 +4143,36 @@ function installCursorHooks(root, opts = {}) {
       added.push(event);
     }
   }
-  if (!added.length) return { path, backupPath: existsSync8(backupPath) ? backupPath : null, added };
+  if (!added.length) return { path, backupPath: existsSync11(backupPath) ? backupPath : null, added };
   const updated = JSON.stringify({ ...config, version: 1, hooks }, null, 2) + "\n";
-  mkdirSync7(dirname4(path), { recursive: true });
-  if (!existsSync8(statePath)) {
-    if (original !== null) writeFileSync5(backupPath, original, { flag: "wx" });
-    writeFileSync5(statePath, JSON.stringify({ hadOriginal, installedHash: hash(updated), added, command }) + "\n", { flag: "wx" });
+  mkdirSync8(dirname6(path), { recursive: true });
+  if (!existsSync11(statePath)) {
+    if (original !== null) writeFileSync6(backupPath, original, { flag: "wx" });
+    writeFileSync6(statePath, JSON.stringify({ hadOriginal, installedHash: hash(updated), added, command }) + "\n", { flag: "wx" });
   } else {
-    const state = JSON.parse(readFileSync9(statePath, "utf8"));
+    const state = JSON.parse(readFileSync12(statePath, "utf8"));
     if (state.command !== command) throw new Error(`Cursor hooks already installed with a different command; uninstall first`);
     state.added = [.../* @__PURE__ */ new Set([...state.added, ...added])];
     state.installedHash = hash(updated);
-    writeFileSync5(statePath, JSON.stringify(state) + "\n");
+    writeFileSync6(statePath, JSON.stringify(state) + "\n");
   }
   const temp = `${path}.replume-tmp`;
-  writeFileSync5(temp, updated);
+  writeFileSync6(temp, updated);
   renameSync(temp, path);
-  return { path, backupPath: existsSync8(backupPath) ? backupPath : null, added };
+  return { path, backupPath: existsSync11(backupPath) ? backupPath : null, added };
 }
 function uninstallCursorHooks(root) {
   const path = cursorHooksPath(root);
   const backupPath = backupPathFor(path);
   const statePath = statePathFor(path);
-  if (!existsSync8(statePath)) return { restored: false, path };
-  const state = JSON.parse(readFileSync9(statePath, "utf8"));
-  const current = existsSync8(path) ? readFileSync9(path, "utf8") : null;
+  if (!existsSync11(statePath)) return { restored: false, path };
+  const state = JSON.parse(readFileSync12(statePath, "utf8"));
+  const current = existsSync11(path) ? readFileSync12(path, "utf8") : null;
   const unchanged = current !== null && hash(current) === state.installedHash;
   if (unchanged) {
     if (state.hadOriginal) {
-      if (!existsSync8(backupPath)) throw new Error(`Cursor hook backup missing: ${backupPath}`);
-      writeFileSync5(path, readFileSync9(backupPath));
+      if (!existsSync11(backupPath)) throw new Error(`Cursor hook backup missing: ${backupPath}`);
+      writeFileSync6(path, readFileSync12(backupPath));
     } else rmSync2(path);
   } else if (current !== null) {
     const config = parseConfig(current, path);
@@ -3413,20 +4188,20 @@ function uninstallCursorHooks(root) {
       if (kept.length) hooks[event] = kept;
       else delete hooks[event];
     }
-    writeFileSync5(path, JSON.stringify({ ...config, hooks }, null, 2) + "\n");
+    writeFileSync6(path, JSON.stringify({ ...config, hooks }, null, 2) + "\n");
   }
   rmSync2(statePath);
   if (unchanged) rmSync2(backupPath, { force: true });
-  return { restored: true, path, backupRetained: !unchanged && existsSync8(backupPath) };
+  return { restored: true, path, backupRetained: !unchanged && existsSync11(backupPath) };
 }
 
 // src/agents/claude/install.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync9, mkdirSync as mkdirSync8, readFileSync as readFileSync10, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname5, join as join11 } from "path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname7, join as join14 } from "path";
 var DEFAULT_HOOK_COMMAND = "replume hook claude";
 var HOOK_EVENTS = ["PreToolUse", "PostToolUse", "PostToolUseFailure", "UserPromptSubmit", "Stop", "SessionEnd"];
 function claudeSettingsPath(repoRoot2) {
-  return join11(repoRoot2, ".claude", "settings.json");
+  return join14(repoRoot2, ".claude", "settings.json");
 }
 var isReplume = (h, command) => typeof h.command === "string" && (h.command === command || /(^|\s)hook claude\s*$/.test(h.command));
 function mergeHooks(settings, command = DEFAULT_HOOK_COMMAND) {
@@ -3455,8 +4230,8 @@ function installClaudeHooks(repoRoot2, opts = {}) {
   const settingsPath = claudeSettingsPath(repoRoot2);
   let current = {};
   let original = null;
-  if (existsSync9(settingsPath)) {
-    original = readFileSync10(settingsPath, "utf-8");
+  if (existsSync12(settingsPath)) {
+    original = readFileSync13(settingsPath, "utf-8");
     try {
       const parsed = original.trim() ? JSON.parse(original) : {};
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not a JSON object");
@@ -3471,24 +4246,24 @@ function installClaudeHooks(repoRoot2, opts = {}) {
     if (original !== null) {
       const stamp = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       backupPath = `${settingsPath}.replume-backup-${stamp}`;
-      copyFileSync2(settingsPath, backupPath);
+      copyFileSync3(settingsPath, backupPath);
     }
-    mkdirSync8(dirname5(settingsPath), { recursive: true });
-    writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    mkdirSync9(dirname7(settingsPath), { recursive: true });
+    writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   }
   return { settingsPath, backupPath, added, alreadyPresent };
 }
 
 // src/agents/claude/replay-hooks.ts
-import { mkdtempSync, mkdirSync as mkdirSync9, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
+import { mkdtempSync, mkdirSync as mkdirSync10, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join12 } from "path";
+import { join as join15 } from "path";
 var REPLAY_HOOKS_BANNER = "HOOK PAYLOAD REPLAY. Each line is a Claude Code hook payload run through Replume's live hook handler in a temporary project.\nThis shows Replume's answers to these payloads; it does not show a live agent receiving or following them.";
 async function replayHooks(content, opts = {}) {
-  const repo = mkdtempSync(join12(tmpdir2(), "replume-replay-hooks-"));
+  const repo = mkdtempSync(join15(tmpdir2(), "replume-replay-hooks-"));
   try {
-    mkdirSync9(join12(repo, ".replume"), { recursive: true });
-    if (opts.contractYaml) writeFileSync7(contractPath(repo), opts.contractYaml);
+    mkdirSync10(join15(repo, ".replume"), { recursive: true });
+    if (opts.contractYaml) writeFileSync8(contractPath(repo), opts.contractYaml);
     const env = { REPLUME_JUDGE: "off", ...opts.env, CLAUDE_PROJECT_DIR: repo };
     const steps = [];
     const lines = content.split("\n").filter((l) => l.trim());
@@ -3518,10 +4293,10 @@ async function replayHooks(content, opts = {}) {
 }
 
 // src/core/init.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { existsSync as existsSync11, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "fs";
+import { execFileSync as execFileSync8 } from "child_process";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10 } from "fs";
 import { homedir as homedir3 } from "os";
-import { join as join14 } from "path";
+import { delimiter, join as join17 } from "path";
 
 // src/core/capabilities.ts
 var CAPABILITIES = [
@@ -3543,11 +4318,11 @@ var CAPABILITIES = [
   },
   {
     agent: "Codex",
-    observe: "unverified",
-    block: "unverified",
-    steer: "unverified",
+    observe: "verified live (CLI)",
+    block: "verified live (CLI)",
+    steer: "documented",
     installedByInit: false,
-    notes: "partial at best; live hook delivery has not been verified"
+    notes: "Codex CLI 0.144.4: project hooks delivered PreToolUse and PostToolUse with trust enabled; Replume blocked one protected apply_patch and observed one allowed edit leading to a no-scenario PASS on 20.10.2026. Warning delivery and Stop continuation not tested; hook trust and disabled hooks limit capture; cloud project hooks unsupported."
   }
 ];
 function renderCapabilities(caps = CAPABILITIES, detected = {}) {
@@ -3576,10 +4351,10 @@ function renderCapabilities(caps = CAPABILITIES, detected = {}) {
 }
 
 // src/core/baseline.ts
-import { createHash as createHash3 } from "crypto";
-import { execFileSync as execFileSync6 } from "child_process";
-import { appendFileSync as appendFileSync4, existsSync as existsSync10, lstatSync, readFileSync as readFileSync11, readdirSync, readlinkSync, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname6, join as join13 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { execFileSync as execFileSync7 } from "child_process";
+import { appendFileSync as appendFileSync4, existsSync as existsSync13, lstatSync, readFileSync as readFileSync14, readdirSync, readlinkSync, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join16 } from "path";
 var BASELINE_FILE = "baseline.json";
 var DEFAULT_REPLUME_GITIGNORE = `events.jsonl
 reports/
@@ -3591,22 +4366,22 @@ acceptance.jsonl
 `;
 var SCENARIOS_SUBDIR = "scenarios";
 var PREFLIGHT_STATUS = ["works", "fails_before", "not_runnable", "skipped"];
-var sha256 = (data) => createHash3("sha256").update(data).digest("hex");
+var sha256 = (data) => createHash4("sha256").update(data).digest("hex");
 var IGNORED_NAMES = /* @__PURE__ */ new Set([".DS_Store"]);
 function hashTree(dir) {
   const out = {};
   const walk = (abs, rel) => {
     for (const name of readdirSync(abs).sort()) {
       if (IGNORED_NAMES.has(name)) continue;
-      const p = join13(abs, name);
+      const p = join16(abs, name);
       const r = rel ? `${rel}/${name}` : name;
       const st = lstatSync(p);
       if (st.isSymbolicLink()) out[r] = sha256(`symlink:${readlinkSync(p)}`);
       else if (st.isDirectory()) walk(p, r);
-      else if (st.isFile()) out[r] = sha256(readFileSync11(p));
+      else if (st.isFile()) out[r] = sha256(readFileSync14(p));
     }
   };
-  if (existsSync10(dir)) {
+  if (existsSync13(dir)) {
     try {
       if (lstatSync(dir).isDirectory()) walk(dir, "");
     } catch {
@@ -3616,19 +4391,19 @@ function hashTree(dir) {
 }
 function headCommit(repoRoot2) {
   try {
-    return execFileSync6("git", ["rev-parse", "--verify", "-q", "HEAD^{commit}"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    return execFileSync7("git", ["rev-parse", "--verify", "-q", "HEAD^{commit}"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
   } catch {
     return null;
   }
 }
-var baselinePath = (contractPath2) => join13(dirname6(contractPath2), BASELINE_FILE);
+var baselinePath = (contractPath2) => join16(dirname8(contractPath2), BASELINE_FILE);
 function ensureBaselineIgnored(replumeDir) {
-  const gi = join13(replumeDir, ".gitignore");
-  if (!existsSync10(gi)) {
-    writeFileSync8(gi, DEFAULT_REPLUME_GITIGNORE);
+  const gi = join16(replumeDir, ".gitignore");
+  if (!existsSync13(gi)) {
+    writeFileSync9(gi, DEFAULT_REPLUME_GITIGNORE);
     return;
   }
-  const text = readFileSync11(gi, "utf-8");
+  const text = readFileSync14(gi, "utf-8");
   if (text.split(/\r?\n/).some((l) => l.trim() === BASELINE_FILE)) return;
   appendFileSync4(gi, `${text === "" || text.endsWith("\n") ? "" : "\n"}${BASELINE_FILE}
 `);
@@ -3640,12 +4415,12 @@ function recordBaseline(opts) {
     contract_id: opts.contractId,
     recorded_at: (opts.now ?? /* @__PURE__ */ new Date()).toISOString(),
     base_commit: headCommit(opts.repoRoot),
-    policy_hash: sha256(readFileSync11(opts.contractPath)),
-    scenario_hashes: hashTree(opts.scenariosDir ?? join13(dirname6(opts.contractPath), SCENARIOS_SUBDIR)),
+    policy_hash: sha256(readFileSync14(opts.contractPath)),
+    scenario_hashes: hashTree(opts.scenariosDir ?? join16(dirname8(opts.contractPath), SCENARIOS_SUBDIR)),
     ...opts.preflight ? { preflight: opts.preflight } : {}
   };
-  writeFileSync8(path, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
-  ensureBaselineIgnored(dirname6(opts.contractPath));
+  writeFileSync9(path, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
+  ensureBaselineIgnored(dirname8(opts.contractPath));
   return { path, baseline };
 }
 var isHash = (x) => typeof x === "string" && /^[0-9a-f]{64}$/.test(x);
@@ -3666,10 +4441,10 @@ function validateBaseline(x) {
   return p;
 }
 function readBaseline(path) {
-  if (!existsSync10(path)) return { status: "absent" };
+  if (!existsSync13(path)) return { status: "absent" };
   let raw3;
   try {
-    raw3 = JSON.parse(readFileSync11(path, "utf-8"));
+    raw3 = JSON.parse(readFileSync14(path, "utf-8"));
   } catch (e) {
     return { status: "unreadable", detail: e.message };
   }
@@ -3703,26 +4478,39 @@ function compareToBaseline(baseline, current, displayPaths) {
 // src/core/init.ts
 function onPath(bin) {
   try {
-    execFileSync7(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" });
+    execFileSync8(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" });
     return true;
   } catch {
     return false;
   }
 }
+function launchedThroughNpx() {
+  return process.env.npm_command === "exec" || (process.env.PATH ?? "").split(delimiter).some((entry) => entry.split(/[\\/]/).includes("_npx"));
+}
+function gitIdentity(repoRoot2, key) {
+  try {
+    return execFileSync8("git", ["-C", repoRoot2, "config", "--get", key], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim().length > 0;
+  } catch {
+    return false;
+  }
+}
 function detectAgents(repoRoot2, home = homedir3()) {
   return {
-    "Claude Code": onPath("claude") || existsSync11(join14(repoRoot2, ".claude")) || existsSync11(join14(home, ".claude")),
-    Cursor: onPath("cursor") || existsSync11(join14(repoRoot2, ".cursor")) || existsSync11(join14(home, ".cursor")),
-    Codex: onPath("codex") || existsSync11(join14(home, ".codex"))
+    "Claude Code": onPath("claude") || existsSync14(join17(repoRoot2, ".claude")) || existsSync14(join17(home, ".claude")),
+    Cursor: onPath("cursor") || existsSync14(join17(repoRoot2, ".cursor")) || existsSync14(join17(home, ".cursor")),
+    Codex: onPath("codex") || existsSync14(join17(home, ".codex"))
   };
 }
 function runInit(repoRoot2, opts = {}) {
   const lines = [];
-  const dir = join14(repoRoot2, REPLUME_DIR);
-  mkdirSync10(join14(dir, "scenarios"), { recursive: true });
-  const gi = join14(dir, ".gitignore");
-  if (!existsSync11(gi)) {
-    writeFileSync9(gi, DEFAULT_REPLUME_GITIGNORE);
+  const dir = join17(repoRoot2, REPLUME_DIR);
+  mkdirSync11(join17(dir, "scenarios"), { recursive: true });
+  const gi = join17(dir, ".gitignore");
+  if (!existsSync14(gi)) {
+    writeFileSync10(gi, DEFAULT_REPLUME_GITIGNORE);
   }
   lines.push(`\u2713 ${REPLUME_DIR}/ ready (scenarios/ for team scenarios; ledger and reports are git-ignored)`);
   const detected = opts.detected ?? detectAgents(repoRoot2);
@@ -3734,11 +4522,14 @@ function runInit(repoRoot2, opts = {}) {
       lines.push(`\u2713 Claude Code hooks added to .claude/settings.json: ${claude.added.join(", ")}`);
       if (claude.backupPath) lines.push(`  backup of your previous settings: ${claude.backupPath}`);
     } else lines.push("\u2713 Claude Code hooks already present (nothing changed)");
-    if (!opts.hookCommand && !onPath("replume")) {
-      lines.push("! `replume` is not on PATH, so the hooks will fail (Claude Code then continues without them).");
-      lines.push("  Install the published command with `npm i -g replume-cli`, then re-run `replume init`.");
-    }
   } else lines.push("- Claude Code not found: no hooks written");
+  const npx = launchedThroughNpx();
+  const persistentCommand = !npx && onPath("replume");
+  const defaultHooks = detected["Claude Code"] && !opts.hookCommand || opts.cursorHooks && !opts.cursorHookCommand || opts.codexHooks;
+  if (defaultHooks && !persistentCommand) {
+    lines.push(npx ? "! `replume` is not guaranteed on PATH for later agent hooks: npx's temporary PATH entry does not persist, so those hooks may fail." : "! `replume` is not on PATH, so the hooks will fail (the agent then continues without them).");
+    lines.push("  Install the persistent command with `npm install -g replume-cli`, then re-run `replume init`.");
+  }
   for (const c of CAPABILITIES.filter((x) => !x.installedByInit)) {
     if (detected[c.agent]) lines.push(`- ${c.agent} found, but replume init does not install its hooks yet (${c.observe})`);
   }
@@ -3746,15 +4537,18 @@ function runInit(repoRoot2, opts = {}) {
   lines.push("Capability matrix");
   lines.push(renderCapabilities(CAPABILITIES, detected));
   lines.push("");
-  lines.push('Next: replume draft --task "<what you asked the agent>"; review .replume/contract.yaml, then run `replume confirm`.');
-  lines.push('To make commits, Git needs an identity in this repository: `git config user.name "Your Name"` and `git config user.email "you@example.com"`.');
+  const draftCommand = persistentCommand ? "replume draft" : "npm install -g replume-cli && replume draft";
+  lines.push(`Next: ${draftCommand} --task "<what you asked the agent>"; review .replume/contract.yaml, then run \`replume confirm\`.`);
+  lines.push("  Scenarios are optional (D-062): verify can PASS when the contract's test_command runs at least one test and passes, nothing is EXTRA or TAMPERING, and the hooks record the agent changing each file. A scenario in .replume/scenarios/ adds a stated behaviour check.");
+  if (!gitIdentity(repoRoot2, "user.name")) lines.push('To make commits, set Git user.name: `git config user.name "Your Name"`.');
+  if (!gitIdentity(repoRoot2, "user.email")) lines.push('To make commits, set Git user.email: `git config user.email "you@example.com"`.');
   return { lines, claude };
 }
 
 // src/core/draft.ts
-import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync12, lstatSync as lstatSync2, readFileSync as readFileSync12 } from "fs";
-import { join as join15, posix } from "path";
+import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync15, lstatSync as lstatSync2, readFileSync as readFileSync15 } from "fs";
+import { join as join18, posix } from "path";
 var LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb", "poetry.lock", "Pipfile.lock", "uv.lock", "Cargo.lock", "go.sum", "Gemfile.lock", "composer.lock"];
 var CI_CONFIG = [
   [".github/workflows/**", /^\.github\/workflows\//],
@@ -3772,20 +4566,20 @@ var STOPWORDS = new Set(
 var NPM_PLACEHOLDER = /no test specified/;
 function trackedFiles(repoRoot2) {
   try {
-    return execFileSync8("git", ["ls-files", "-z"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 }).toString().split("\0").filter(Boolean);
+    return execFileSync9("git", ["ls-files", "-z"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 }).toString().split("\0").filter(Boolean);
   } catch {
     return [];
   }
 }
 var read = (repoRoot2, rel) => {
   try {
-    return readFileSync12(join15(repoRoot2, rel), "utf-8");
+    return readFileSync15(join18(repoRoot2, rel), "utf-8");
   } catch {
     return "";
   }
 };
 function detectTestCommand(repoRoot2, files) {
-  const has = (f) => files.includes(f) || existsSync12(join15(repoRoot2, f));
+  const has = (f) => files.includes(f) || existsSync15(join18(repoRoot2, f));
   if (has("package.json")) {
     let script;
     try {
@@ -3815,10 +4609,10 @@ function draftContract(input) {
   const t = detectTestCommand(input.repoRoot, files);
   notes.push(t.command ? `test_command "${t.command}": ${t.reason}` : `test_command: none (${t.reason})`);
   const scenarios = files.filter((f) => /^\.replume\/scenarios\/[^/]+\.ya?ml$/.test(f)).flatMap((f) => {
-    const path = join15(input.repoRoot, f);
+    const path = join18(input.repoRoot, f);
     try {
       if (!lstatSync2(path).isFile() || lstatSync2(path).isSymbolicLink()) return [];
-      const s = parseScenario(readFileSync12(path, "utf8"), f);
+      const s = parseScenario(readFileSync15(path, "utf8"), f);
       return [s.id === posix.basename(f).replace(/\.ya?ml$/, "") ? s : null].filter((x) => x !== null);
     } catch {
       notes.push(`must_check: skipped invalid scenario ${f}; fix it before verification`);
@@ -3885,7 +4679,7 @@ function draftContract(input) {
     for (const p of namedCandidates) notes.push(`candidate: ${p} (named in the task; review before allowing)`);
     let recent = [];
     try {
-      recent = execFileSync8("git", ["log", "-5", "--name-only", "--pretty=format:"], { cwd: input.repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\n").filter(Boolean);
+      recent = execFileSync9("git", ["log", "-5", "--name-only", "--pretty=format:"], { cwd: input.repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\n").filter(Boolean);
     } catch {
     }
     const recentCandidates = [...new Set(recent.filter((f) => source.includes(f) && !namedCandidates.includes(f) && !["README.md", "package.json"].includes(f)))].slice(0, Math.max(0, 5 - namedCandidates.length));
@@ -3900,10 +4694,14 @@ function draftContract(input) {
   };
   return { contract, notes, broad: broad.filter((g) => allow.includes(g)) };
 }
+function allowHasNoSource(allow) {
+  return allow.every((g) => isTestFile(g.replace(/\*+/g, "x")));
+}
+var ALLOW_NO_SOURCE_WARNING = "allow contains no source files; the agent may have no allowed way to finish this task. Name the files in --task or edit allow.";
 
 // src/sandbox/preflight.ts
-import { existsSync as existsSync16 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { join as join23 } from "path";
 
 // src/sandbox/docker.ts
 import { spawn as spawn2, spawnSync } from "child_process";
@@ -3911,12 +4709,17 @@ import { randomUUID } from "crypto";
 import { rmSync as rmSync4 } from "fs";
 import { chmod, cp, lstat as lstat2, mkdtemp, readdir as readdir2, rm, writeFile } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename2, join as join16 } from "path";
+import { basename as basename2, join as join19 } from "path";
 import { performance } from "perf_hooks";
 var DEFAULT_DOCKER_IMAGE = "node:20-bookworm-slim";
-var DOCKER_PROBE_TIMEOUT_MS = 2e4;
-async function probeDaemon(binary = "docker", timeoutMs = DOCKER_PROBE_TIMEOUT_MS) {
-  const context = await dockerCli(binary, ["context", "inspect"], timeoutMs);
+var DOCKER_PROBE_TIMEOUT_MS = 15e3;
+var remaining = (deadline) => Math.max(0, Math.ceil(deadline - performance.now()));
+var probeCli = (binary, args, deadline) => {
+  const left = remaining(deadline);
+  return left > 0 ? dockerCli(binary, args, left) : Promise.resolve({ code: null, stdout: "", stderr: "", timedOut: true, notFound: false });
+};
+async function probeDaemonUntil(binary, deadline) {
+  const context = await probeCli(binary, ["context", "inspect"], deadline);
   if (context.timedOut) return { status: "timeout", step: "docker context inspect" };
   if (context.notFound) return { status: "unavailable", detail: "docker CLI not found" };
   if (context.code !== 0) return { status: "unavailable" };
@@ -3926,12 +4729,12 @@ async function probeDaemon(binary = "docker", timeoutMs = DOCKER_PROBE_TIMEOUT_M
   } catch {
     return { status: "unavailable" };
   }
-  const info = await dockerCli(binary, ["info", "--format", "{{.ServerVersion}}"], timeoutMs);
+  const info = await probeCli(binary, ["info", "--format", "{{.ServerVersion}}"], deadline);
   if (info.timedOut) return { status: "timeout", step: "docker info" };
   return info.code === 0 ? { status: "ok" } : { status: "unavailable" };
 }
-async function probeImage(image, binary = "docker", timeoutMs = DOCKER_PROBE_TIMEOUT_MS) {
-  const r = await dockerCli(binary, ["image", "inspect", image], timeoutMs);
+async function probeImageUntil(image, binary, deadline) {
+  const r = await probeCli(binary, ["image", "inspect", image], deadline);
   return r.timedOut ? "timeout" : r.code === 0 ? "present" : "missing";
 }
 var seconds = (ms) => `${ms / 1e3} s`;
@@ -3939,19 +4742,20 @@ async function resolveIsolation(choice, image, probe = {}) {
   if (choice === "worktree") return { mode: "worktree", reason: "requested: worktree" };
   const legacy = "daemon" in probe;
   const timeoutMs = legacy ? DOCKER_PROBE_TIMEOUT_MS : probe.timeoutMs ?? DOCKER_PROBE_TIMEOUT_MS;
-  const daemon = legacy ? await probe.daemon() ? { status: "ok" } : { status: "unavailable" } : await probeDaemon(probe.binary, timeoutMs);
+  const deadline = performance.now() + timeoutMs;
+  const daemon = legacy ? await probe.daemon() ? { status: "ok" } : { status: "unavailable" } : await probeDaemonUntil(probe.binary ?? "docker", deadline);
   if (daemon.status === "timeout") {
     if (choice === "docker") throw new Error(`Docker was requested but did not answer within ${seconds(timeoutMs)} (${daemon.step})`);
-    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (${daemon.step}); used the worktree` };
+    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (${daemon.step}); using the isolated working copy instead (not a security sandbox)` };
   }
   if (daemon.status === "unavailable") {
     if (choice === "docker") throw new Error(`Docker was requested but the Docker CLI or a local daemon is unavailable${daemon.detail ? ` (${daemon.detail})` : ""}`);
     return { mode: "worktree", reason: `auto: no local Docker daemon${daemon.detail ? ` (${daemon.detail})` : ""}` };
   }
-  const img = legacy ? await probe.image(image) ? "present" : "missing" : await probeImage(image, probe.binary, timeoutMs);
+  const img = legacy ? await probe.image(image) ? "present" : "missing" : await probeImageUntil(image, probe.binary ?? "docker", deadline);
   if (img === "timeout") {
     if (choice === "docker") throw new Error(`Docker was requested but did not answer within ${seconds(timeoutMs)} (docker image inspect)`);
-    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (docker image inspect); used the worktree` };
+    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (docker image inspect); using the isolated working copy instead (not a security sandbox)` };
   }
   if (img === "missing") {
     if (choice === "docker") throw new Error(`Docker was requested but image ${image} is not present locally; run: docker pull ${image}`);
@@ -3963,14 +4767,14 @@ function cliEnv() {
   return { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: process.env.HOME, DOCKER_CONFIG: process.env.DOCKER_CONFIG };
 }
 function dockerCli(binary, args, timeoutMs) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     const child = spawn2(binary, args, { env: cliEnv(), stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "", stderr = "", settled = false, timedOut = false, notFound = false;
     const done = (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve7({ code, stdout, stderr, timedOut, notFound });
+      resolve9({ code, stdout, stderr, timedOut, notFound });
     };
     child.stdout.on("data", (chunk) => {
       stdout += chunk.toString();
@@ -3991,6 +4795,8 @@ function dockerCli(binary, args, timeoutMs) {
     }, timeoutMs);
   });
 }
+var commandStartMarker = (name) => `__replume_command_start_${name}__`;
+var DOCKER_STARTUP_TIMEOUT_SEC = 120;
 function buildDockerRunArgs(input) {
   const uid = process.getuid?.() ?? 1e3, gid = process.getgid?.() ?? 1e3;
   return [
@@ -4026,11 +4832,14 @@ function buildDockerRunArgs(input) {
     "--env",
     "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
     ...Object.entries(input.labels ?? {}).flatMap(([k, v]) => ["--label", `${k}=${v}`]),
+    // the marker, then exactly the old `sh -lc <command>` (passed as an argument, never spliced into this script)
     "--workdir",
     "/repo",
     input.image,
     "sh",
-    "-lc",
+    "-c",
+    `printf '%s\\n' ${commandStartMarker(input.name)} >&2; exec sh -lc "$1"`,
+    "replume-scenario",
     input.command
   ];
 }
@@ -4047,11 +4856,11 @@ async function sweepStaleStaging(tmpRoot = tmpdir3(), now = Date.now()) {
   }
   for (const n of names) {
     if (!n.startsWith(STAGING_PREFIX)) continue;
-    const dir = join16(tmpRoot, n);
+    const dir = join19(tmpRoot, n);
     try {
       const st = await lstat2(dir);
       if (st.isSymbolicLink() || !st.isDirectory()) continue;
-      const marker = await lstat2(join16(dir, STAGING_MARKER));
+      const marker = await lstat2(join19(dir, STAGING_MARKER));
       if (!marker.isFile() || now - marker.mtimeMs < STALE_AFTER_MS) continue;
       await rm(dir, { recursive: true, force: true });
       removed.push(dir);
@@ -4088,44 +4897,57 @@ async function runDockerScenario(input) {
   const binary = input.dockerBinary ?? "docker";
   const tmpRoot = input.tmpRoot ?? tmpdir3();
   await sweepStaleStaging(tmpRoot);
-  const temp = await mkdtemp(join16(tmpRoot, STAGING_PREFIX));
-  const staged = join16(temp, "repo");
+  const temp = await mkdtemp(join19(tmpRoot, STAGING_PREFIX));
+  const staged = join19(temp, "repo");
   const name = `replume-${randomUUID()}`;
   active.set(temp, { binary, name });
   attachSignals();
   try {
-    await writeFile(join16(temp, STAGING_MARKER), JSON.stringify({ by: "replume", pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n");
+    await writeFile(join19(temp, STAGING_MARKER), JSON.stringify({ by: "replume", pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n");
     await cp(input.root, staged, { recursive: true, filter: (path) => basename2(path) !== ".git" });
     if (process.getuid?.() === 0) await chmod(temp, 493);
     const args = buildDockerRunArgs({ name, image: input.image ?? DEFAULT_DOCKER_IMAGE, source: staged, command: input.command, labels: input.labels });
-    return await new Promise((resolve7) => {
+    return await new Promise((resolve9) => {
       const child = spawn2(binary, args, { env: cliEnv(), stdio: ["ignore", "pipe", "pipe"] });
-      let stdout = "", stderr = "", timedOut = false, settled = false;
+      const marker = `${commandStartMarker(name)}
+`;
+      let stdout = "", stderr = "", timedOut = false, settled = false, commandStarted = false;
+      let timer;
       const finish = (exitCode) => {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        resolve7({ stdout, stderr, exitCode, timedOut, durationMs: Math.round(performance.now() - started) });
+        resolve9({ stdout, stderr, exitCode, timedOut, durationMs: Math.round(performance.now() - started) });
+      };
+      const expire = (note) => async () => {
+        timedOut = true;
+        if (note) stderr += note;
+        const removed = await dockerCli(binary, ["rm", "--force", name], 1e4);
+        if (removed.code !== 0) stderr += `
+Docker timeout cleanup: ${removed.stderr.trim()}`;
+        child.kill("SIGKILL");
+        finish(null);
       };
       child.stdout.on("data", (chunk) => {
         stdout += chunk.toString();
       });
       child.stderr.on("data", (chunk) => {
         stderr += chunk.toString();
+        if (!commandStarted && stderr.includes(marker)) {
+          commandStarted = true;
+          stderr = stderr.replace(marker, "");
+          clearTimeout(timer);
+          timer = setTimeout(expire(""), input.timeoutSec * 1e3);
+        }
       });
       child.on("error", (error) => {
         stderr += error.message;
         finish(null);
       });
       child.on("close", finish);
-      const timer = setTimeout(async () => {
-        timedOut = true;
-        const removed = await dockerCli(binary, ["rm", "--force", name], 1e4);
-        if (removed.code !== 0) stderr += `
-Docker timeout cleanup: ${removed.stderr.trim()}`;
-        child.kill("SIGKILL");
-        finish(null);
-      }, input.timeoutSec * 1e3);
+      const startup = input.startupTimeoutSec ?? DOCKER_STARTUP_TIMEOUT_SEC;
+      timer = setTimeout(expire(`
+Docker container did not start the scenario command within ${startup}s (start-up limit; timeout_sec counts from the command start)`), startup * 1e3);
     });
   } finally {
     try {
@@ -4141,20 +4963,20 @@ Docker timeout cleanup: ${removed.stderr.trim()}`;
 }
 
 // src/sandbox/index.ts
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "fs";
-import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync17, readFileSync as readFileSync17 } from "fs";
+import { execFileSync as execFileSync10 } from "child_process";
 import { lstat as lstat3, mkdir, writeFile as writeFile2 } from "fs/promises";
-import { isAbsolute as isAbsolute7, join as join20, relative as relative6, resolve as resolve5, sep as sep3 } from "path";
+import { isAbsolute as isAbsolute7, join as join22, relative as relative6, resolve as resolve7, sep as sep3 } from "path";
 import { performance as performance3 } from "perf_hooks";
 
 // src/sandbox/working-copy.ts
 import { spawn as spawn3 } from "child_process";
 import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join17 } from "path";
+import { join as join20 } from "path";
 import { performance as performance2 } from "perf_hooks";
 async function git(cwd, args) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = spawn3("git", args, { cwd, env: { PATH: process.env.PATH ?? "/usr/bin:/bin" }, stdio: ["ignore", "pipe", "pipe"] });
     let out = "", err = "";
     child.stdout.on("data", (v) => {
@@ -4164,13 +4986,13 @@ async function git(cwd, args) {
       err += v.toString();
     });
     child.on("error", reject);
-    child.on("close", (code) => code === 0 ? resolve7(out.trim()) : reject(new Error(`git ${args.join(" ")}: ${err.trim() || `exit ${code}`}`)));
+    child.on("close", (code) => code === 0 ? resolve9(out.trim()) : reject(new Error(`git ${args.join(" ")}: ${err.trim() || `exit ${code}`}`)));
   });
 }
 async function withWorkingCopy(repo, commit, keep, fn) {
-  const temp = await mkdtemp2(join17(tmpdir4(), "replume-copy-"));
-  const root = join17(temp, "repo");
-  const home = join17(temp, "home");
+  const temp = await mkdtemp2(join20(tmpdir4(), "replume-copy-"));
+  const root = join20(temp, "repo");
+  const home = join20(temp, "home");
   let added = false;
   try {
     await git(repo, ["worktree", "add", "--detach", root, commit]);
@@ -4190,14 +5012,14 @@ async function withWorkingCopy(repo, commit, keep, fn) {
 }
 async function runCommand(command, cwd, home, timeoutSec) {
   const started = performance2.now();
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     const child = spawn3(command, { cwd, shell: true, detached: process.platform !== "win32", env: { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: home }, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "", stderr = "", timedOut = false, settled = false;
     const finish = (exitCode) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve7({ stdout, stderr, exitCode, durationMs: Math.round(performance2.now() - started), timedOut });
+      resolve9({ stdout, stderr, exitCode, durationMs: Math.round(performance2.now() - started), timedOut });
     };
     child.stdout.on("data", (v) => {
       stdout += v.toString();
@@ -4301,10 +5123,22 @@ function buildReport(input) {
     extra.push({ path: l.file, reason: `lockfile adds ${l.names.length} package${l.names.length === 1 ? "" : "s"} with no new direct dependency: ${l.names.slice(0, 10).join(", ")}${l.names.length > 10 ? ", \u2026" : ""}` });
   const ran = new Set(input.results.filter((r) => !["not_run", "error"].includes(r.status)).map((r) => r.id));
   const claims = scenarios.filter((s) => ran.has(s.id)).flatMap((s) => s.declared_covers);
-  const notChecked = paths.filter((p) => !matches(claims, p)).map((path) => ({
-    path,
-    reason: input.draft ? "changed in diff; the contract is an unconfirmed draft, so its policy was not applied (run `replume confirm`); no scenario declares coverage among scenarios that ran" : "changed in diff; no scenario declares coverage among scenarios that ran"
-  }));
+  const testsPassed = !input.draft && input.testCommand?.status === "passed";
+  const obs = input.observation;
+  const named = new Set(obs?.namedPaths ?? []);
+  const reasonFor = (path) => {
+    if (input.draft) return "changed in diff; the contract is an unconfirmed draft, so its policy was not applied (run `replume confirm`); no scenario declares coverage among scenarios that ran";
+    if (!testsPassed) return `changed in diff; no scenario declares coverage, and ${!contract.test_command ? "the contract has no test_command" : "test_command did not pass with at least one test"}`;
+    if (!obs || obs.sessions === 0) return "changed in diff; no scenario declares coverage; agent steps not observed (no agent session for this task in the ledger)";
+    if (!named.has(path)) return "changed in diff; no scenario declares coverage; change not seen by hooks (no ledger event records a write to this file)";
+    return null;
+  };
+  const uncovered = paths.filter((p) => !matches(claims, p));
+  const notChecked = uncovered.flatMap((path) => {
+    const reason = reasonFor(path);
+    return reason ? [{ path, reason }] : [];
+  });
+  const observedOnly = uncovered.filter((p) => reasonFor(p) === null).map((path) => ({ path, reason: "checked by test_command and observed steps; no scenario" }));
   const failed = results.filter((r) => r.status !== "passed" && r.status !== "unconfirmed").map((r) => ({ id: r.id, evidence: r.expectationFailures.join("; ") || r.status }));
   const evidenceFor = (r) => {
     if (r.id === TEST_COMMAND_ID) return `\`${contract.test_command}\` exit ${r.exitCode}`;
@@ -4332,7 +5166,7 @@ function buildReport(input) {
   const checks = [
     emptyDiff ? { name: "scope", status: "not_run", detail: `empty diff, nothing compared: base ${base3.slice(0, 7)} and commit ${commit.slice(0, 7)} have no differences` } : input.draft ? { name: "scope", status: "not_run", detail: "contract is an unconfirmed draft, so its allow globs were not applied" } : contract.allow.length ? { name: "scope", status: "done", detail: `${n(paths.length, "changed file")} compared with allow globs, ${outsideAllow} outside` } : { name: "scope", status: "not_run", detail: "contract has no allow globs, so changes outside the task were not checked" },
     { name: "tampering", status: "done", detail: `${n(testFiles, "changed test file")} inspected for removed assertions, skip/only and forced success; ${input.draft ? "protect globs of the unconfirmed draft not applied" : n(contract.protect.length, "protect glob")}; .replume/ changes` },
-    !input.testCommand ? { name: "test_command", status: "not_run", detail: input.draft ? "contract is an unconfirmed draft, so its test_command was not run" : "contract lists no test_command" } : input.testCommand.status === "unconfirmed" ? { name: "test_command", status: "unconfirmed", detail: `\`${contract.test_command}\` exit ${input.testCommand.exitCode}; ${input.testCommand.expectationFailures.join("; ")}` } : input.testCommand.status === "passed" ? { name: "test_command", status: "done", detail: `\`${contract.test_command}\` exit 0 (declares no coverage)` } : { name: "test_command", status: "failed", detail: `\`${contract.test_command}\` ${input.testCommand.expectationFailures.join("; ") || input.testCommand.status}` },
+    !input.testCommand ? { name: "test_command", status: "not_run", detail: input.draft ? "contract is an unconfirmed draft, so its test_command was not run" : "contract lists no test_command" } : input.testCommand.status === "unconfirmed" ? { name: "test_command", status: "unconfirmed", detail: `\`${contract.test_command}\` exit ${input.testCommand.exitCode}; ${input.testCommand.expectationFailures.join("; ")}` } : input.testCommand.status === "passed" ? { name: "test_command", status: "done", detail: `\`${contract.test_command}\` exit 0 (declares no coverage by itself; with observed agent steps it checks changed files no scenario declares, D-062)` } : { name: "test_command", status: "failed", detail: `\`${contract.test_command}\` ${input.testCommand.expectationFailures.join("; ") || input.testCommand.status}` },
     scenarioRuns.length ? { name: "scenarios", status: scenarioRuns.every((r) => r.status === "passed") ? "done" : "failed", detail: `${n(scenarioRuns.length, "scenario")} ran` } : { name: "scenarios", status: "not_run", detail: scenarios.length ? "no scenario ran" : "no scenario files at this commit" },
     ...input.baselineCheck ? [input.baselineCheck] : [],
     ...deps ? [dependencyCheck(deps)] : [],
@@ -4355,6 +5189,7 @@ function buildReport(input) {
     extra: lv(extra, () => "verified_here"),
     tampering: lv(tampering, (t) => RECORDED.has(t.rule) ? "observed" : "verified_here"),
     notChecked: lv(notChecked, () => "unknown"),
+    ...observedOnly.length ? { observedOnly: lv(observedOnly, () => "observed") } : {},
     scenarios: [...results, ...doneRuns],
     baseCommit: base3,
     ...input.baseSource ? { baseSource: input.baseSource } : {},
@@ -4401,15 +5236,15 @@ function parsePackageJson(text) {
     return { error: "not valid JSON" };
   }
   if (!j || typeof j !== "object" || Array.isArray(j)) return { error: "not a package manifest" };
-  const obj2 = j;
+  const obj3 = j;
   for (const s of NPM_SECTIONS) {
-    if (!(s in obj2) || obj2[s] == null) continue;
-    const sec = obj2[s];
+    if (!(s in obj3) || obj3[s] == null) continue;
+    const sec = obj3[s];
     if (typeof sec !== "object" || Array.isArray(sec)) return { error: `${s} is not an object` };
   }
   const entries = [];
   for (const s of NPM_SECTIONS) {
-    const sec = obj2[s];
+    const sec = obj3[s];
     if (sec && typeof sec === "object" && !Array.isArray(sec)) {
       for (const name of Object.keys(sec)) entries.push({ name, section: s });
     }
@@ -4590,134 +5425,6 @@ async function checkRegistry(d, fetcher, timeoutMs = REGISTRY_TIMEOUT_MS) {
 }
 var dependencyAllowed = (name, allow) => !!allow?.length && matchesAny(name, allow) !== null;
 
-// src/core/capture.ts
-import { existsSync as existsSync13, readFileSync as readFileSync13 } from "fs";
-import { dirname as dirname7, join as join18 } from "path";
-var EXPECTED_TYPES = ["prompt", "tool_pre", "command", "stop"];
-var SHOWN_PATHS = 5;
-var count3 = (m, k) => {
-  m[k] = (m[k] ?? 0) + 1;
-};
-var HOOK_CRASH = "hook-errors.log exists: at least one hook crashed, so some steps may not have been recorded";
-function captureCoverage(eventsFile, changedPaths, hooksConfigured = false) {
-  const absence = hooksConfigured ? "Replume project hooks are configured, but no hook events were recorded; agent steps and scope were not observed" : "no Replume project hooks were found; agent steps and scope were not observed";
-  const empty = (ledger, notes) => ({
-    ledger,
-    hooksConfigured,
-    events: 0,
-    sessions: 0,
-    agents: [],
-    byType: {},
-    tools: {},
-    firstTs: null,
-    lastTs: null,
-    badLines: 0,
-    hookErrorsLogged: hookErrors(eventsFile),
-    changedFiles: changedPaths.length,
-    changedFilesSeen: 0,
-    changedFilesLanded: 0,
-    changedFilesAttemptedOnly: [],
-    changedFilesNotSeen: changedPaths.slice(0, SHOWN_PATHS),
-    unobservableCommands: 0,
-    // a hook that crashed on every call leaves no ledger: say so here too, not only in the JSON flag
-    notSeen: hookErrors(eventsFile) ? [...notes, HOOK_CRASH] : notes
-  });
-  if (!existsSync13(eventsFile)) {
-    return empty("absent", [`no ledger file: ${absence}`]);
-  }
-  const text = readFileSync13(eventsFile, "utf-8");
-  const { events, badLines } = parseEvents(text);
-  if (!events.length) {
-    return empty("empty", [
-      badLines.length ? `the ledger has ${badLines.length} line(s) but none is a valid event` : `the ledger is empty: ${absence}`
-    ]);
-  }
-  const byType = {};
-  const tools = {};
-  const seenPaths = /* @__PURE__ */ new Set();
-  const landedPaths = /* @__PURE__ */ new Set();
-  const blockedPaths = /* @__PURE__ */ new Set();
-  for (const e of events) {
-    count3(byType, e.type);
-    if (e.type === "tool_pre" && e.tool) count3(tools, e.tool);
-    const blocked = e.action === "block" && e.type !== "file_edit" && e.type !== "command";
-    const landed = e.type === "file_edit" || e.type === "command" && e.raw?.ok !== false;
-    for (const p of e.paths) {
-      if (blocked) blockedPaths.add(p);
-      else seenPaths.add(p);
-      if (landed) landedPaths.add(p);
-    }
-  }
-  const ts = events.map((e) => e.ts).sort();
-  const notSeen = [];
-  const missing = EXPECTED_TYPES.filter((t) => !byType[t]);
-  if (missing.length) notSeen.push(`no ${missing.join(", ")} events`);
-  const truncated = badLines.length > 0 || !text.endsWith("\n");
-  if (truncated) notSeen.push(`the ledger may be truncated or damaged (${badLines.length} unreadable line(s)${text.endsWith("\n") ? "" : ", last line has no line break"}); events after that point may be missing`);
-  const attemptedOnly = changedPaths.filter((p) => !seenPaths.has(p) && blockedPaths.has(p));
-  if (attemptedOnly.length)
-    notSeen.push(
-      `${attemptedOnly.length} changed file(s) appear in the ledger only as blocked attempts (${attemptedOnly.slice(0, SHOWN_PATHS).join(", ")}${attemptedOnly.length > SHOWN_PATHS ? ", \u2026" : ""}): the change that landed was not observed by any hook`
-    );
-  const unseen = changedPaths.filter((p) => !seenPaths.has(p) && !blockedPaths.has(p));
-  if (unseen.length) {
-    notSeen.push(
-      `${unseen.length} of ${changedPaths.length} changed file(s) are named by no ledger event (${unseen.slice(0, SHOWN_PATHS).join(", ")}${unseen.length > SHOWN_PATHS ? ", \u2026" : ""}); a file changed through a shell command is seen only if the command text names it`
-    );
-  }
-  const opaque = [...new Set(events.filter((e) => (e.type === "command" || e.type === "tool_pre") && e.command && unobservable(e.command)).map((e) => e.command))];
-  if (opaque.length)
-    notSeen.push(
-      `${opaque.length} shell command${opaque.length === 1 ? "" : "s"} ran a script file or wrote to a path built at run time (e.g. \`${opaque[0].slice(0, 80)}\`); what ${opaque.length === 1 ? "it" : "they"} wrote is not observable by Replume's shell rules`
-    );
-  const hookErrorsLogged = hookErrors(eventsFile);
-  if (hookErrorsLogged) notSeen.push(HOOK_CRASH);
-  return {
-    ledger: "present",
-    events: events.length,
-    sessions: new Set(events.map((e) => e.sessionId)).size,
-    agents: [...new Set(events.map((e) => e.agent))].sort(),
-    byType,
-    tools,
-    firstTs: ts[0],
-    lastTs: ts[ts.length - 1],
-    badLines: badLines.length,
-    hookErrorsLogged,
-    changedFiles: changedPaths.length,
-    changedFilesSeen: changedPaths.filter((p) => seenPaths.has(p)).length,
-    changedFilesLanded: changedPaths.filter((p) => landedPaths.has(p)).length,
-    changedFilesAttemptedOnly: attemptedOnly.slice(0, SHOWN_PATHS),
-    changedFilesNotSeen: unseen.slice(0, SHOWN_PATHS),
-    unobservableCommands: opaque.length,
-    notSeen
-  };
-}
-var SCRIPT_RUN = /(?:^|[;&|(]\s*|\s(?:sudo|exec|env|nohup|time)\s+)(?:(?:node|nodejs|deno|bun|python[0-9.]*|ruby|perl|php|bash|sh|zsh|pwsh|tsx|ts-node)\s+(?:-[^-ce\s][^\s]*\s+)*[\w./~-]+\.(?:js|mjs|cjs|ts|py|rb|pl|php|sh|bash|zsh|ps1)\b|\.{1,2}\/[\w./-]+)/;
-var RUNTIME_TARGET = /(?:>{1,2}|>\||\btee(?:\s+-\w+)*)\s*["']?[^\s"';|&]*(?:\$|`)/;
-var unobservable = (command) => SCRIPT_RUN.test(command) || RUNTIME_TARGET.test(command);
-function hookErrors(eventsFile) {
-  return existsSync13(join18(dirname7(eventsFile), "hook-errors.log"));
-}
-var list = (m) => Object.entries(m).sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([k, n]) => `${k} ${n}`).join(", ");
-function renderCapture(c) {
-  const out = ["CAPTURE COVERAGE"];
-  if (c.ledger !== "present") {
-    out.push(`  seen       nothing (ledger ${c.ledger === "absent" ? "file not found" : "empty"})`);
-  } else {
-    out.push(`  seen       ${c.events} events from ${c.agents.join(", ")} in ${c.sessions} session${c.sessions === 1 ? "" : "s"} (${c.firstTs} to ${c.lastTs}): ${list(c.byType)}`);
-    if (Object.keys(c.tools).length) out.push(`  tools      ${list(c.tools)}`);
-    if (c.changedFilesLanded !== void 0) {
-      const a = c.changedFilesAttemptedOnly ?? [];
-      out.push(
-        `  files      ${c.changedFilesSeen} of ${c.changedFiles} changed file(s) named by an allowed step; ${c.changedFilesLanded} landed and observed (file_edit or successful command event); ${a.length} only attempted (blocked)${a.length ? `: ${a.join(", ")}` : ""}`
-      );
-    }
-  }
-  out.push(`  not seen   ${c.notSeen.length ? c.notSeen.join("; ") : "nothing flagged by these checks (they cannot see steps taken outside the hooks)"}`);
-  out.push("  limits     only agents with a Replume adapter and installed hooks write events; the ledger is a local file that can be edited or deleted. This is what was captured, not proof of what the agent did.");
-  return out;
-}
-
 // src/sandbox/failing-tests.ts
 var PATTERNS2 = [
   /^[ \t]*✖ (.+?) \(\d+(?:\.\d+)?m?s\)[ \t]*$/,
@@ -4750,29 +5457,29 @@ function failingTestNames(output) {
 }
 
 // src/core/acceptance.ts
-import { appendFileSync as appendFileSync5, existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "fs";
-import { join as join19 } from "path";
-var file = (root) => join19(root, ".replume", "acceptance.jsonl");
+import { appendFileSync as appendFileSync5, existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync16, writeFileSync as writeFileSync11 } from "fs";
+import { join as join21 } from "path";
+var file = (root) => join21(root, ".replume", "acceptance.jsonl");
 function recordAcceptance(repoRoot2, opts) {
   if (opts.verdict !== "pass") throw new Error("accept requires a fresh verify PASS");
   if (!/^[a-zA-Z0-9_-]{1,128}$/.test(opts.taskId) || !/^[0-9a-f]{40}$/.test(opts.commit)) throw new Error("invalid task ID or commit");
   const existing = readAcceptance(repoRoot2, opts.taskId, opts.commit);
   if (existing) return { ...existing, alreadyAccepted: true };
-  const dir = join19(repoRoot2, ".replume");
-  mkdirSync11(dir, { recursive: true });
-  const ignore = join19(dir, ".gitignore");
-  const prior = existsSync14(ignore) ? readFileSync14(ignore, "utf8") : "";
-  if (!prior.split(/\r?\n/).includes("acceptance.jsonl")) writeFileSync10(ignore, `${prior}${prior && !prior.endsWith("\n") ? "\n" : ""}acceptance.jsonl
+  const dir = join21(repoRoot2, ".replume");
+  mkdirSync12(dir, { recursive: true });
+  const ignore = join21(dir, ".gitignore");
+  const prior = existsSync16(ignore) ? readFileSync16(ignore, "utf8") : "";
+  if (!prior.split(/\r?\n/).includes("acceptance.jsonl")) writeFileSync11(ignore, `${prior}${prior && !prior.endsWith("\n") ? "\n" : ""}acceptance.jsonl
 `);
   const entry = { taskId: opts.taskId, commit: opts.commit, acceptedAt: (opts.now ?? /* @__PURE__ */ new Date()).toISOString() };
   appendFileSync5(file(repoRoot2), JSON.stringify(entry) + "\n");
   return { ...entry, alreadyAccepted: false };
 }
 function readAcceptance(repoRoot2, taskId, commit) {
-  if (!existsSync14(file(repoRoot2))) return null;
+  if (!existsSync16(file(repoRoot2))) return null;
   let content;
   try {
-    content = readFileSync14(file(repoRoot2), "utf8");
+    content = readFileSync16(file(repoRoot2), "utf8");
   } catch {
     return null;
   }
@@ -4901,15 +5608,15 @@ async function isLink(p) {
   }
 }
 function safeRelative(root, path) {
-  const full = resolve5(root, path);
+  const full = resolve7(root, path);
   if (full !== root && !full.startsWith(root + "/")) throw new Error(`path outside repository: ${path}`);
   return full;
 }
 function projectHooksConfigured(root) {
-  for (const rel of [".claude/settings.json", ".cursor/hooks.json"]) {
+  for (const rel of [".claude/settings.json", ".cursor/hooks.json", ".codex/hooks.json"]) {
     try {
-      const settings = JSON.parse(readFileSync15(join20(root, rel), "utf8"));
-      if (JSON.stringify(settings.hooks ?? {}).includes("replume hook claude") || JSON.stringify(settings.hooks ?? {}).includes("replume hook cursor")) return true;
+      const settings = JSON.parse(readFileSync17(join22(root, rel), "utf8"));
+      if (["claude", "cursor", "codex"].some((agent) => JSON.stringify(settings.hooks ?? {}).includes(`replume hook ${agent}`))) return true;
     } catch {
     }
   }
@@ -4998,7 +5705,7 @@ var showRef = (t) => `${/^[0-9a-f]{40}$/.test(t.ref) ? t.ref.slice(0, 7) : t.ref
 async function compareToTrustedBase(repo, t, commit, contractRel, scenariosRel, contractFile) {
   const where = `the trusted base ${showRef(t)}`;
   const out = [];
-  const local = existsSync15(contractFile) ? readFileSync15(contractFile, "utf-8").trim() : null;
+  const local = existsSync17(contractFile) ? readFileSync17(contractFile, "utf-8").trim() : null;
   if (local !== t.contractText.trim())
     out.push({ rule: "policy_differs_from_trusted_base", path: contractRel, detail: local === null ? `contract missing in the working tree; ${where} has one` : `working-tree contract differs from the one at ${where}; the contract at the ref was used as the policy` });
   const blobs = async (rev) => new Map(
@@ -5015,8 +5722,22 @@ async function compareToTrustedBase(repo, t, commit, contractRel, scenariosRel,
   }
   return out;
 }
+function observedChanges(events, changedPaths, since) {
+  const t = since ? Date.parse(since) : NaN;
+  const inTask = events.filter((e) => !!e.sessionId && !!e.agent && (Number.isNaN(t) || Date.parse(e.ts) >= t));
+  const named = /* @__PURE__ */ new Set();
+  for (const e of inTask) {
+    const raw3 = e.raw ?? {};
+    if (e.action === "block" || raw3.ok === false) continue;
+    if (e.type === "file_edit") for (const p of e.paths) named.add(p);
+    else if (e.type === "command" && raw3.hook_event_name !== "beforeShellExecution" && Array.isArray(raw3.writes)) {
+      for (const p of raw3.writes) if (typeof p === "string") named.add(p);
+    }
+  }
+  return { sessions: new Set(inTask.map((e) => e.sessionId)).size, namedPaths: changedPaths.filter((p) => named.has(p)) };
+}
 async function runVerify2(opts) {
-  const repo = resolve5(opts.repoPath);
+  const repo = resolve7(opts.repoPath);
   if (!isAbsolute7(opts.repoPath)) throw new Error("repoPath must be absolute");
   const startedAt = (/* @__PURE__ */ new Date()).toISOString(), started = performance3.now();
   const image = opts.dockerImage ?? DEFAULT_DOCKER_IMAGE;
@@ -5039,9 +5760,9 @@ async function runVerify2(opts) {
   }
   const loaded = trusted ? parseContract(trusted.contractText, `${trusted.ref}:${contractRel}`) : loadContract(contractFile);
   if (!loaded) {
-    const example = join20(repo, ".replume/contract.example.yaml");
+    const example = join22(repo, ".replume/contract.example.yaml");
     throw new Error(
-      `no task contract at ${contractFile}; write one with: replume task "<what you asked the agent>" --allow "<glob>"` + (existsSync15(example) ? ", or copy .replume/contract.example.yaml to .replume/contract.yaml" : "")
+      `no task contract at ${contractFile}; write one with: replume task "<what you asked the agent>" --allow "<glob>"` + (existsSync17(example) ? ", or copy .replume/contract.example.yaml to .replume/contract.yaml" : "")
     );
   }
   const draft = isDraft(loaded);
@@ -5096,7 +5817,7 @@ async function runVerify2(opts) {
   const entries = await diffEntries(repo, base3, commit);
   const setup = /* @__PURE__ */ new Set();
   if (baseline?.base_commit === base3) {
-    const committed = (p) => execFileSync9("git", ["show", `${commit}:${p}`], { cwd: repo });
+    const committed = (p) => execFileSync10("git", ["show", `${commit}:${p}`], { cwd: repo });
     for (const e of entries) {
       if (e.status !== "A" && e.status !== "M" || e.oldPath) continue;
       if (e.path === contractRel && sha256(committed(e.path)) === baseline.policy_hash) setup.add(e.path);
@@ -5108,10 +5829,14 @@ async function runVerify2(opts) {
   const tampering = await tamperingFindings(repo, base3, commit, agentEntries);
   const newTests = agentEntries.filter((e) => e.status === "A" && TEST_PATH.test(e.path) && !tampering.some((t) => t.path === e.path)).map((e) => e.path);
   const dependencies = await dependencySection(repo, base3, commit, paths, contract, opts);
+  const eventsFile = safeRelative(repo, opts.eventsPath ?? ".replume/events.jsonl");
+  const ledgerEvents = readEvents(eventsFile).events;
+  const since = baseline?.recorded_at ?? null;
+  const observation = observedChanges(ledgerEvents, paths, since);
   const report = await withWorkingCopy(repo, commit, mode === "worktree" && (opts.keepWorkdir ?? false), async (root, home) => {
     const run = (command, timeoutSec) => mode === "docker" ? runDockerScenario({ root, command, timeoutSec, image }) : runCommand(command, root, home, timeoutSec);
     const dir = safeRelative(root, opts.scenariosDir ?? ".replume/scenarios");
-    const scenarios = existsSync15(dir) || await isLink(dir) ? await loadScenarios(dir, root) : [];
+    const scenarios = existsSync17(dir) || await isLink(dir) ? await loadScenarios(dir, root) : [];
     if (scenarios.some((s) => s.id === TEST_COMMAND_ID)) throw new Error(`scenario id "${TEST_COMMAND_ID}" is reserved for the contract's test_command`);
     const results = [];
     for (const scenario of scenarios) results.push(await execute(scenario, run, opts.timeoutSecDefault ?? 60));
@@ -5139,7 +5864,7 @@ async function runVerify2(opts) {
     }
     const baselineFindings = trusted ? await compareToTrustedBase(repo, trusted, commit, contractRel, scenariosRel, contractFile) : baseline ? compareToBaseline(
       baseline,
-      { policyHash: sha256(readFileSync15(contractFile)), scenarioHashes: hashTree(dir) },
+      { policyHash: sha256(readFileSync17(contractFile)), scenarioHashes: hashTree(dir) },
       { contract: opts.contractPath ?? ".replume/contract.yaml", scenariosDir: opts.scenariosDir ?? ".replume/scenarios" }
     ) : [];
     return buildReport({
@@ -5157,6 +5882,7 @@ async function runVerify2(opts) {
       draft,
       dependencies,
       newTests,
+      observation,
       baselineCheck: trusted ? {
         name: "baseline",
         status: "done",
@@ -5168,9 +5894,6 @@ async function runVerify2(opts) {
       isolationReason: reason
     });
   });
-  const eventsFile = safeRelative(repo, opts.eventsPath ?? ".replume/events.jsonl");
-  const ledgerEvents = readEvents(eventsFile).events;
-  const since = baseline?.recorded_at ?? null;
   const { interventions, layer2, layer2Modes, scope, sessions } = supervisorSection(ledgerEvents, paths, since);
   report.metrics = taskMetrics(ledgerEvents, {
     repoRoot: repo,
@@ -5203,9 +5926,9 @@ async function runVerify2(opts) {
     }
   }
   const safe = redactDeep(report, Number.POSITIVE_INFINITY);
-  const reportsDir = join20(repo, ".replume/reports");
+  const reportsDir = join22(repo, ".replume/reports");
   await mkdir(reportsDir, { recursive: true });
-  await writeFile2(join20(reportsDir, `${commit}.json`), JSON.stringify(safe, null, 2) + "\n");
+  await writeFile2(join22(reportsDir, `${commit}.json`), JSON.stringify(safe, null, 2) + "\n");
   return safe;
 }
 function isolationFooter(report) {
@@ -5228,11 +5951,21 @@ function countTag(levels) {
   if (counts.size <= 1) return TAG[levels[0] ?? "verified_here"];
   return `[evidence: ${[...counts].map(([l, k]) => `${k} ${LEVEL_NAME[l]}`).join("; ")}]`;
 }
+function notCheckedCauses(report) {
+  const causes = [...new Set(report.notChecked.map((x) => {
+    const m = /; (agent steps not observed|change not seen by hooks)/.exec(x.reason);
+    if (m) return `no scenario declares coverage; ${m[1]}`;
+    if (/the contract has no test_command/.test(x.reason)) return "no scenario declares coverage and no test_command";
+    if (/test_command did not pass/.test(x.reason)) return "no scenario declares coverage and test_command did not pass with at least one test";
+    return "no scenario declares coverage";
+  }))];
+  return causes.length ? ` (${causes.join("; ")})` : "";
+}
 function renderReport(report, opts = {}) {
   if (opts.json) return JSON.stringify(report, null, 2);
   const quietCapture = report.capture?.ledger === "absent" || report.capture?.ledger === "empty";
   const first = report.verdict === "pass" ? "Verdict: PASS \u2014 the checks that ran passed" : report.verdict === "fail" ? "Verdict: FAIL \u2014 at least one required check failed" : "Verdict: INCOMPLETE \u2014 the available checks cannot establish a pass";
-  const why = report.verdict === "pass" ? `Why: ${report.done.length} scenario(s) passed; no failing check, blocking extra change, tampering or undeclared coverage was reported.` : report.verdict === "fail" ? `Why: ${report.failed.length} failed scenario(s), ${report.extra.filter((e) => !e.informational).length} blocking extra change(s), ${report.tampering.length} tampering finding(s); inspect the details below.` : `Why: ${report.notChecked.length} path(s) have no scenario declaring coverage, or a required check did not run; inspect NOT RUN below.`;
+  const why = report.verdict === "pass" ? `Why: ${report.done.length} check(s) passed (${report.done.map((d) => d.id).join(", ")}); no failing check, blocking extra change, tampering or undeclared coverage was reported${report.observedOnly?.length ? `; ${report.observedOnly.length} changed file(s) checked by test_command and observed steps, no scenario` : ""}.` : report.verdict === "fail" ? `Why: ${report.failed.length} failed scenario(s), ${report.extra.filter((e) => !e.informational).length} blocking extra change(s), ${report.tampering.length} tampering finding(s); inspect the details below.` : `Why: ${report.notChecked.length} path(s) are not checked${notCheckedCauses(report)}, or a required check did not run; inspect NOT CHECKED and NOT RUN below.`;
   const activity = quietCapture ? `WARNING: ${report.capture?.hooksConfigured ? "Replume project hooks are configured, but no hook events were recorded" : "no Replume project hooks were found"}; agent steps and scope were not observed.` : report.capture ? `Agent activity: ${report.capture.events} event(s) reached Replume; this is not proof that every step was captured.` : "Agent activity: no capture information is available in this report.";
   const lines = [first, why, activity, `Replume report  commit ${report.commit.slice(0, 7)}  task: ${report.contractId}`];
   if (report.baseSource) lines.push(`Base         ${report.baseCommit.slice(0, 7)}  ${BASE_SOURCE_TEXT[report.baseSource]}  ${TAG[report.baseSource === "recorded_at_task" ? "observed" : "verified_here"]}`);
@@ -5266,7 +5999,9 @@ function renderReport(report, opts = {}) {
   }
   lines.push(`EXTRA        (${report.extra.length})  ${report.extra.map((x) => `${x.dependency ? `${x.path}: ${x.dependency.name}` : x.path}  ${x.reason}`).join(", ") || "\u2014"}  ${countTag(report.extra.map((x) => levelOf(x, "verified_here")))}`);
   lines.push(`TAMPERING    (${report.tampering.length})  ${report.tampering.map((x) => `${x.path}  ${x.detail}`).join(", ") || "\u2014"}  ${countTag(report.tampering.map((x) => levelOf(x, "verified_here")))}`);
-  lines.push(`NOT CHECKED  (${report.notChecked.length})  ${report.notChecked.map((x) => x.path).join(", ") || "\u2014"}${report.notChecked.length ? "  no scenario declares coverage" : ""}  ${TAG.unknown}`);
+  if (report.observedOnly?.length)
+    lines.push(`OBSERVED     (${report.observedOnly.length})  ${report.observedOnly.map((x) => x.path).join(", ")}  checked by test_command and observed steps; no scenario  [Observed]`);
+  lines.push(`NOT CHECKED  (${report.notChecked.length})  ${report.notChecked.map((x) => x.path).join(", ") || "\u2014"}${report.notChecked.length ? `  ${notCheckedCauses(report).replace(/^ \(|\)$/g, "")}` : ""}  ${TAG.unknown}`);
   if (report.supervisor) {
     const [head, ...rest] = renderInterventions(report.supervisor, report.supervisor.scope);
     lines.push(`${head}  ${TAG.observed}`, "  Meaning: SUPERVISOR lists permission decisions; matching Cursor shell hooks are counted once. Hook output alone does not confirm execution. These records are editable.", ...rest);
@@ -5326,8 +6061,8 @@ async function runPreflight(opts) {
   const { mode, reason } = await resolveIsolation(opts.isolation ?? "auto", image);
   const results = await withWorkingCopy(opts.repoPath, opts.commit, false, async (root, home) => {
     const run = (command, t) => mode === "docker" ? runDockerScenario({ root, command, timeoutSec: t, image }) : runCommand(command, root, home, t);
-    const dir = join21(root, opts.scenariosDir ?? ".replume/scenarios");
-    const scenarios = existsSync16(dir) ? await loadScenarios(dir, root).catch(() => []) : [];
+    const dir = join23(root, opts.scenariosDir ?? ".replume/scenarios");
+    const scenarios = existsSync18(dir) ? await loadScenarios(dir, root).catch(() => []) : [];
     const out = [];
     for (const id of c.must_check) {
       const s = scenarios.find((x) => x.id === id);
@@ -5383,7 +6118,7 @@ function comparePreflight(p, now) {
 }
 
 // src/core/watch.ts
-import { existsSync as existsSync17, readFileSync as readFileSync16, statSync as statSync2, watchFile, unwatchFile } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync18, statSync as statSync2, watchFile, unwatchFile } from "fs";
 function formatEvent(e) {
   const time = e.ts.slice(11, 19);
   const action = e.action && e.action !== "ok" ? e.action.toUpperCase() : "";
@@ -5394,11 +6129,11 @@ ${" ".repeat(19)}${e.message.split("\n")[0]}`;
   return head;
 }
 function readNew(path, offset) {
-  if (!existsSync17(path)) return { lines: [], offset, bad: 0 };
+  if (!existsSync19(path)) return { lines: [], offset, bad: 0 };
   const size = statSync2(path).size;
   if (size < offset) offset = 0;
   if (size === offset) return { lines: [], offset, bad: 0 };
-  const buf = readFileSync16(path);
+  const buf = readFileSync18(path);
   const chunk = buf.subarray(offset, size).toString("utf-8");
   const lastNl = chunk.lastIndexOf("\n");
   if (lastNl < 0) return { lines: [], offset, bad: 0 };
@@ -5422,7 +6157,7 @@ function watchLedger(path, print, opts = {}) {
 }
 
 // src/core/replay.ts
-import { isAbsolute as isAbsolute8, join as join22 } from "path";
+import { isAbsolute as isAbsolute8, join as join24 } from "path";
 var REPLAY_ROOT = "/replay-repo";
 var REPLAY_BANNER = "RECORDED SESSION (replay). These are recorded events run through Replume's rules now.\nThis shows what the rules decide on these events; it does not show a live agent being steered.";
 function kindOf(e) {
@@ -5440,10 +6175,10 @@ function actionFromEvent(e) {
     for (const k of ["file_path", "notebook_path", "path"]) {
       const v = input[k];
       if (typeof v !== "string") continue;
-      if (!isAbsolute8(v)) input[k] = join22(REPLAY_ROOT, v);
+      if (!isAbsolute8(v)) input[k] = join24(REPLAY_ROOT, v);
       else {
         const rel = e.paths.find((p) => v.endsWith(`/${p}`));
-        if (rel) input[k] = join22(REPLAY_ROOT, rel);
+        if (rel) input[k] = join24(REPLAY_ROOT, rel);
       }
     }
     return toProposedAction(
@@ -5459,7 +6194,7 @@ function actionFromEvent(e) {
     });
   }
   const kind = kindOf(e);
-  const { inside, outside } = splitPaths(REPLAY_ROOT, e.paths.map((p) => isAbsolute8(p) ? p : join22(REPLAY_ROOT, p)));
+  const { inside, outside } = splitPaths(REPLAY_ROOT, e.paths.map((p) => isAbsolute8(p) ? p : join24(REPLAY_ROOT, p)));
   const rawEdit = raw3;
   const before = rawEdit.before ?? rawEdit.old_string;
   const after = rawEdit.after ?? rawEdit.new_string;
@@ -5557,17 +6292,17 @@ var builtInEvents = JSON.stringify({
 
 // src/cli.ts
 function readStdin() {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => data += chunk);
-    process.stdin.on("end", () => resolve7(data));
+    process.stdin.on("end", () => resolve9(data));
     process.stdin.on("error", reject);
   });
 }
 function repoRoot() {
   try {
-    return execFileSync10("git", ["rev-parse", "--show-toplevel"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    return execFileSync11("git", ["rev-parse", "--show-toplevel"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
   } catch {
     return process.cwd();
   }
@@ -5613,16 +6348,16 @@ usageCommand.command("import-cursor").requiredOption("--result <path>", "local C
 });
 program.name("replume").description("Verify what your AI coding agent actually did").version(package_default.version);
 program.addHelpText("after", "\nOff-machine options: verify --legacy-judge sends the full git diff, task text, and agent action summary to api.openai.com; --post-github-comment posts task text to the PR on api.github.com; --check-registry sends package names to npm/PyPI. HTTP layer 2 is off unless REPLUME_JUDGE=shadow|on and REPLUME_JUDGE_PROVIDER=http with REPLUME_JUDGE_URL; HTTP needs REPLUME_JUDGE_ALLOW_INSECURE_HTTP=1.\n");
-program.command("init").description("Create .replume/, install agent hooks where supported, print the capability matrix").option("--hook-command <cmd>", "command Claude Code should run for hooks", void 0).option("--cursor", "install Cursor project hooks even when .cursor/ is absent").option("--cursor-hook-command <cmd>", "command Cursor should run for hooks").option("--remove-cursor-hooks", "restore the Cursor hook config from before Replume init").action((opts) => {
+program.command("init").description("Create .replume/, install agent hooks where supported, print the capability matrix").option("--hook-command <cmd>", "command Claude Code should run for hooks", void 0).option("--cursor", "install Cursor project hooks even when .cursor/ is absent").option("--codex", "install Codex project hooks even when .codex/ is absent").option("--cursor-hook-command <cmd>", "command Cursor should run for hooks").option("--remove-cursor-hooks", "restore the Cursor hook config from before Replume init").action((opts) => {
   try {
     const root = repoRoot();
     if (opts.removeCursorHooks) {
-      const result = uninstallCursorHooks(root);
-      console.log(result.restored ? result.backupRetained ? `Cursor hooks removed where still identifiable; edited settings kept at ${result.path}; original backup retained beside it` : `Cursor hooks removed; previous configuration restored at ${result.path}` : "No Replume Cursor installation found");
+      const result2 = uninstallCursorHooks(root);
+      console.log(result2.restored ? result2.backupRetained ? `Cursor hooks removed where still identifiable; edited settings kept at ${result2.path}; original backup retained beside it` : `Cursor hooks removed; previous configuration restored at ${result2.path}` : "No Replume Cursor installation found");
       return;
     }
     const detected = detectAgents(root);
-    const cursorDir = join23(root, ".cursor");
+    const cursorDir = join25(root, ".cursor");
     let cursorEntry = null;
     try {
       cursorEntry = lstatSync3(cursorDir);
@@ -5632,12 +6367,23 @@ program.command("init").description("Create .replume/, install agent hooks where
     if (opts.cursor && cursorEntry && !cursorEntry.isDirectory())
       throw new Error(`${cursorDir} must be a directory; nothing was changed.`);
     const wantCursor = Boolean(opts.cursor || cursorEntry?.isDirectory());
+    const codexDir = join25(root, ".codex");
+    let codexEntry = null;
+    try {
+      codexEntry = lstatSync3(codexDir);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+    if (opts.codex && codexEntry && !codexEntry.isDirectory())
+      throw new Error(`${codexDir} must be a directory; nothing was changed.`);
+    const wantCodex = Boolean(opts.codex || codexEntry?.isDirectory());
     if (wantCursor) validateCursorHooksConfig(root, { command: opts.cursorHookCommand });
-    if (detected["Claude Code"] && existsSync18(claudeSettingsPath(root))) {
+    if (wantCodex) validateCodexHooks(root);
+    if (detected["Claude Code"] && existsSync20(claudeSettingsPath(root))) {
       const path = claudeSettingsPath(root);
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync17(path, "utf8"));
+        parsed = JSON.parse(readFileSync19(path, "utf8"));
       } catch {
         throw new Error(`${path} is not valid JSON; nothing was changed. Fix it and run replume init again.`);
       }
@@ -5645,14 +6391,28 @@ program.command("init").description("Create .replume/, install agent hooks where
         throw new Error(`${path} is not a JSON object; nothing was changed. Fix it and run replume init again.`);
       mergeHooks(parsed, opts.hookCommand ?? DEFAULT_HOOK_COMMAND);
     }
-    const { lines } = runInit(root, { hookCommand: opts.hookCommand, detected });
+    const { lines } = runInit(root, {
+      hookCommand: opts.hookCommand,
+      cursorHookCommand: opts.cursorHookCommand,
+      cursorHooks: wantCursor,
+      codexHooks: wantCodex,
+      detected
+    });
     const oldNotice = lines.findIndex((l) => l.startsWith("- Cursor found, but"));
     if (oldNotice >= 0) lines.splice(oldNotice, 1);
+    const codexNotice = lines.findIndex((l) => l.startsWith("- Codex found, but"));
+    if (codexNotice >= 0) lines.splice(codexNotice, 1);
     const matrixAt = lines.indexOf("Capability matrix");
     lines[matrixAt + 1] = renderCapabilities(CAPABILITIES.map((c) => c.agent === "Cursor" ? {
       ...c,
       installedByInit: wantCursor
-    } : c), detected);
+    } : c.agent === "Codex" ? { ...c, installedByInit: wantCodex } : c), detected);
+    if (wantCodex) {
+      const codex = installCodexHooks(root);
+      lines.splice(matrixAt, 0, codex.added.length ? `\u2713 Codex hooks added to .codex/hooks.json: ${codex.added.join(", ")}; run /hooks in Codex to trust this definition` : "\u2713 Codex hooks already present; run /hooks in Codex if the definition changed");
+    } else {
+      lines.splice(matrixAt, 0, "- Codex project hooks not installed: run replume init --codex; otherwise Codex agent steps will not be recorded in the ledger");
+    }
     if (wantCursor) {
       const cursor = installCursorHooks(root, { command: opts.cursorHookCommand });
       lines.splice(matrixAt, 0, cursor.added.length ? `\u2713 Cursor hooks added to .cursor/hooks.json: ${cursor.added.join(", ")}${cursor.backupPath ? ` (backup: ${cursor.backupPath})` : ""}` : "\u2713 Cursor hooks already present (nothing changed)");
@@ -5695,6 +6455,9 @@ addPreflightOptions(program.command("task")).description("Write the Task Contrac
     fail(e.message);
   }
 });
+function passPathHint(c) {
+  return c.test_command ? `  Scenarios are optional: verify can PASS when \`${c.test_command}\` runs at least one test and passes, nothing is EXTRA or TAMPERING, and the hooks record the agent changing each changed file. A scenario adds a stated behaviour check.` : "  No test_command: without a test_command or a scenario, verify cannot reach PASS. Set test_command in .replume/contract.yaml (scenarios are optional).";
+}
 addPreflightOptions(program.command("draft")).description("Propose a Task Contract from the repository and the task text (status: draft, not policy until confirmed)").requiredOption("--task <text>", "what the agent will be asked to do").option("--yes", "confirm at once (for CI): the draft becomes policy and the baseline is recorded").option("--accept-broad", "with --yes: also confirm allow globs broader than the paths the task names").option("--refine", "model refinement of the draft (not built)").action(async (opts) => {
   if (opts.refine) fail("model refinement is not built; the draft is deterministic only (no model is called). Edit .replume/contract.yaml by hand instead.");
   const root = repoRoot();
@@ -5725,8 +6488,10 @@ addPreflightOptions(program.command("draft")).description("Propose a Task Contra
     console.log(serializeContract(c).trimEnd());
     console.log("");
     console.log(finalAllow);
+    if (allowHasNoSource(c.allow)) console.log(`  WARNING: ${ALLOW_NO_SOURCE_WARNING}`);
     if (opts.yes) await preflightAndRecord(root, path, c, opts);
     else console.log("  This draft is NOT policy yet: verify reports the contract as NOT CHECKED and the hooks ignore it. Review the file, then run `replume confirm`.");
+    console.log(passPathHint(c));
   } catch (e) {
     fail(e.message);
   }
@@ -5744,14 +6509,15 @@ addPreflightOptions(program.command("confirm")).description("Confirm the draft c
     writeContract(path, confirmed);
     console.log(`\u2713 confirmed ${REPLUME_DIR}/contract.yaml (${c.id}, status: confirmed)`);
     await preflightAndRecord(root, path, confirmed, opts);
-    console.log("  commit .replume/contract.yaml before running the agent (commit the scenario files and .replume/.gitignore too)");
+    console.log(passPathHint(confirmed));
+    console.log("  commit .replume/contract.yaml before running the agent (and .replume/.gitignore, and any scenario files)");
   } catch (e) {
     fail(e.message);
   }
 });
 program.command("watch").description("Live view of .replume/events.jsonl with rule hits").option("--once", "print what is there and exit").action((opts) => {
   const path = ledgerPath(repoRoot());
-  if (!existsSync18(path)) console.log(`(no events yet at ${path}; waiting)`);
+  if (!existsSync20(path)) console.log(`(no events yet at ${path}; waiting)`);
   watchLedger(path, (l) => console.log(l), { once: opts.once });
 });
 program.command("verify").description("Run the contract and scenarios on a commit in an isolated working copy (exit 0 pass, 1 fail, 2 incomplete)").option("--commit <sha>", "commit to verify", "HEAD").option("--base <sha>", "commit to diff against").option("--trusted-base <ref>", "git ref (commit or protected branch) whose contract and scenarios are the policy; also the diff base unless --base is given").option("--json", "print the report as JSON").option("--keep-workdir", "keep the isolated working copy for debugging (worktree mode only)").addOption(
@@ -5765,7 +6531,7 @@ program.command("verify").description("Run the contract and scenarios on a commi
   if (opts.checkRegistry) console.error("replume: opt-in registry check sends package names from dependency changes to registry.npmjs.org or pypi.org; no source file contents are sent by this lookup.");
   try {
     const root = repoRoot();
-    const commit = execFileSync10("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root }).toString().trim();
+    const commit = execFileSync11("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root }).toString().trim();
     const report = await runVerify2({
       repoPath: root,
       commit,
@@ -5785,7 +6551,7 @@ program.command("verify").description("Run the contract and scenarios on a commi
 program.command("accept").description("Explicitly accept HEAD after a fresh verification PASS; only then count cost per accepted change").option("--base <sha>", "commit to diff against").addOption(new Option("--isolation <mode>", "verification mode").choices(["auto", "docker", "worktree"]).default("auto")).action(async (opts) => {
   const root = repoRoot();
   try {
-    const commit = execFileSync10("git", ["rev-parse", "--verify", "HEAD^{commit}"], { cwd: root, encoding: "utf8" }).trim();
+    const commit = execFileSync11("git", ["rev-parse", "--verify", "HEAD^{commit}"], { cwd: root, encoding: "utf8" }).trim();
     const report = await runVerify2({ repoPath: root, commit, baseCommit: opts.base, isolation: opts.isolation });
     if (report.isolationMode === "worktree") console.error(WORKTREE_WARNING);
     if (report.verdict !== "pass") fail(`accept requires a fresh verify PASS; this commit is ${report.verdict.toUpperCase()}`);
@@ -5799,15 +6565,15 @@ program.command("report").description("Re-print the report saved for a commit (.
   const root = repoRoot();
   let commit;
   try {
-    commit = execFileSync10("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root, stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
+    commit = execFileSync11("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root, stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
   } catch {
     fail(`not a commit: ${opts.commit}`);
   }
-  const file2 = join23(root, REPLUME_DIR, "reports", `${commit}.json`);
-  if (!existsSync18(file2)) fail(`no report for ${commit.slice(0, 7)} at ${file2}; run replume verify --commit ${opts.commit}`);
+  const file2 = join25(root, REPLUME_DIR, "reports", `${commit}.json`);
+  if (!existsSync20(file2)) fail(`no report for ${commit.slice(0, 7)} at ${file2}; run replume verify --commit ${opts.commit}`);
   let report;
   try {
-    report = JSON.parse(readFileSync17(file2, "utf-8"));
+    report = JSON.parse(readFileSync19(file2, "utf-8"));
   } catch (e) {
     fail(`${file2} is not valid JSON: ${e.message}`);
   }
@@ -5831,25 +6597,25 @@ demo.option("--replay <file>", "run a recorded events.jsonl session through the
     console.log(renderReplay(replay(builtInEvents, builtInContract), builtInContract));
     return;
   }
-  const file2 = resolve6(opts.replay);
-  if (!existsSync18(file2)) fail(`replay file not found: ${file2}`);
+  const file2 = resolve8(opts.replay);
+  if (!existsSync20(file2)) fail(`replay file not found: ${file2}`);
   try {
     const sibling = file2.replace(/\.jsonl?$/, "") + ".contract.yaml";
-    const contractFile = opts.contract ? resolve6(opts.contract) : existsSync18(sibling) ? sibling : contractPath(repoRoot());
+    const contractFile = opts.contract ? resolve8(opts.contract) : existsSync20(sibling) ? sibling : contractPath(repoRoot());
     const contract = loadContract(contractFile);
-    console.log(renderReplay(replay(readFileSync17(file2, "utf-8"), contract), contract, contract ? contractFile : void 0));
+    console.log(renderReplay(replay(readFileSync19(file2, "utf-8"), contract), contract, contract ? contractFile : void 0));
   } catch (e) {
     fail(e.message);
   }
 });
 async function demoReplayHooks(path, contractOpt) {
-  const file2 = resolve6(path);
-  if (!existsSync18(file2)) fail(`replay file not found: ${file2}`);
+  const file2 = resolve8(path);
+  if (!existsSync20(file2)) fail(`replay file not found: ${file2}`);
   const sibling = file2.replace(/\.jsonl?$/, "") + ".contract.yaml";
-  const contractFile = contractOpt ? resolve6(contractOpt) : existsSync18(sibling) ? sibling : null;
+  const contractFile = contractOpt ? resolve8(contractOpt) : existsSync20(sibling) ? sibling : null;
   try {
-    const r = await replayHooks(readFileSync17(file2, "utf-8"), {
-      contractYaml: contractFile ? readFileSync17(contractFile, "utf-8") : void 0,
+    const r = await replayHooks(readFileSync19(file2, "utf-8"), {
+      contractYaml: contractFile ? readFileSync19(contractFile, "utf-8") : void 0,
       env: process.env
     });
     console.log(REPLAY_HOOKS_BANNER);
@@ -5872,13 +6638,13 @@ program.command("install").description("[legacy, August MVP] Register SessionSta
 });
 async function legacyVerify(postGithubComment) {
   const repoDir = process.cwd();
-  const headSha = process.env.REPLUME_HEAD_SHA ?? execFileSync10("git", ["rev-parse", "HEAD"], { cwd: repoDir }).toString().trim();
+  const headSha = process.env.REPLUME_HEAD_SHA ?? execFileSync11("git", ["rev-parse", "HEAD"], { cwd: repoDir }).toString().trim();
   const [owner, repo] = (process.env.GITHUB_REPOSITORY ?? "/").split("/");
   const prNumber = Number(process.env.REPLUME_PR_NUMBER ?? "0");
   const baseRef = process.env.REPLUME_BASE_REF ?? "main";
   let diff = "";
   try {
-    diff = execFileSync10("git", ["diff", `origin/${baseRef}...HEAD`], { cwd: repoDir }).toString();
+    diff = execFileSync11("git", ["diff", `origin/${baseRef}...HEAD`], { cwd: repoDir }).toString();
   } catch (err) {
     console.warn(`replume: could not compute diff against origin/${baseRef}, continuing with empty diff:`, err);
   }
@@ -5897,6 +6663,12 @@ async function legacyVerify(postGithubComment) {
   console.log(`replume verdict: ${verdict}`);
 }
 var hook = program.command("hook").description("Internal: agent hook entry points");
+hook.command("codex").description("Codex CLI hook handler").action(async () => {
+  const out = handleCodexHook(await readStdin());
+  if (out.stdout) process.stdout.write(out.stdout);
+  if (out.stderr) process.stderr.write(out.stderr);
+  process.exitCode = out.exitCode;
+});
 hook.command("cursor").description("Cursor hook handler").action(async () => {
   const out = handleCursorHook(await readStdin());
   process.stdout.write(out.stdout);