replume-cli 0.1.1 → 0.1.2

package/dist/cli.js

@@ -6,7 +6,7 @@ import { Command, Option } from "commander";
 // package.json
 var package_default = {
   name: "replume-cli",
-  version: "0.1.1",
+  version: "0.1.2",
   type: "module",
   bin: {
     replume: "dist/cli.js"
@@ -48,9 +48,9 @@ var package_default = {
 };
 
 // src/cli.ts
-import { execFileSync as execFileSync10 } from "child_process";
-import { existsSync as existsSync18, lstatSync as lstatSync3, readFileSync as readFileSync17 } from "fs";
-import { join as join23, resolve as resolve6 } from "path";
+import { execFileSync as execFileSync11 } from "child_process";
+import { existsSync as existsSync20, lstatSync as lstatSync3, readFileSync as readFileSync19 } from "fs";
+import { join as join25, resolve as resolve8 } from "path";
 
 // src/hooks/session-start.ts
 import { execFileSync as execFileSync2 } from "child_process";
@@ -342,20 +342,21 @@ function markPathsOutsideRepo(text, repoRoot2) {
   const path = (value) => {
     const rel = relative(repoRoot2, value);
     if (!rel) return "[REPO_ROOT]";
+    if (/^\/dev\/[\w./-]+$/.test(value)) return value;
     return rel !== ".." && !rel.startsWith("../") && !isAbsolute(rel) ? rel.replace(/\\/g, "/") : "[OUTSIDE_REPO]";
   };
-  return text.replace(/(^|[\s"'=(,:])(\/(?!\/)[^\s"'`,;)]+)/g, (_m, prefix, absolute) => `${prefix}${path(absolute)}`);
+  return text.replace(/(^|[\s"'=(,:])(\/(?!\/)[^\s"'`,;)(]+)(?![^\s"'`,;)])/g, (_m, prefix, absolute) => `${prefix}${path(absolute)}`);
 }
 function redactLedgerText(text, repoRoot2) {
   const out = redact(text).replace(SECRET_ENV_ANYCASE, `$1${REDACTED}`).replace(URL_USER, `$1${REDACTED}:${REDACTED}@`);
   return markPathsOutsideRepo(out, repoRoot2);
 }
 function redactForLedger(value, repoRoot2) {
-  const str3 = (s) => redactLedgerText(s, repoRoot2);
+  const str4 = (s) => redactLedgerText(s, repoRoot2);
   const deep = (v) => {
-    if (typeof v === "string") return str3(v);
+    if (typeof v === "string") return str4(v);
     if (Array.isArray(v)) return v.map(deep);
-    if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, c]) => [str3(k), deep(c)]));
+    if (v && typeof v === "object") return Object.fromEntries(Object.entries(v).map(([k, c]) => [str4(k), deep(c)]));
     return v;
   };
   return deep(value);
@@ -601,7 +602,7 @@ async function runVerify(opts) {
 // src/agents/claude/handler.ts
 import { execFileSync as execFileSync5 } from "child_process";
 import { appendFileSync as appendFileSync3, mkdirSync as mkdirSync6 } from "fs";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { homedir as homedir2 } from "os";
 
 // src/core/usage-store.ts
@@ -1041,7 +1042,7 @@ var Parser = class {
     return ITEM.test(first.body) ? this.sequence(indent) : this.mapping(indent);
   }
   mapping(indent, seed) {
-    const obj2 = seed?.obj ?? {};
+    const obj3 = seed?.obj ?? {};
     while (this.peek()) {
       const line = this.peek();
       if (line.indent < indent) break;
@@ -1050,20 +1051,20 @@ var Parser = class {
       const m = KEY.exec(line.body);
       if (!m) throw new Error(`line ${line.n}: expected "key: value"`);
       this.i++;
-      this.entry(obj2, m[1], m[2], line, indent);
+      this.entry(obj3, m[1], m[2], line, indent);
     }
-    return obj2;
+    return obj3;
   }
-  entry(obj2, key, rest, line, indent) {
-    if (key in obj2) throw new Error(`line ${line.n}: duplicate key ${key}`);
+  entry(obj3, key, rest, line, indent) {
+    if (key in obj3) throw new Error(`line ${line.n}: duplicate key ${key}`);
     if (rest !== void 0 && rest.trim() !== "") {
-      obj2[key] = parseInline(rest, `line ${line.n}`);
+      obj3[key] = parseInline(rest, `line ${line.n}`);
       return;
     }
     const next = this.peek();
-    if (next && next.indent > indent) obj2[key] = this.block(next.indent);
-    else if (next && next.indent === indent && ITEM.test(next.body)) obj2[key] = this.sequence(indent);
-    else obj2[key] = null;
+    if (next && next.indent > indent) obj3[key] = this.block(next.indent);
+    else if (next && next.indent === indent && ITEM.test(next.body)) obj3[key] = this.sequence(indent);
+    else obj3[key] = null;
   }
   sequence(indent) {
     const items = [];
@@ -1082,11 +1083,11 @@ var Parser = class {
         continue;
       }
       const column = indent + (line.body.length - body.length);
-      const obj2 = {};
-      this.entry(obj2, km[1], km[2], line, column);
+      const obj3 = {};
+      this.entry(obj3, km[1], km[2], line, column);
       const next = this.peek();
-      if (next && next.indent === column && !ITEM.test(next.body)) this.mapping(column, { obj: obj2 });
-      items.push(obj2);
+      if (next && next.indent === column && !ITEM.test(next.body)) this.mapping(column, { obj: obj3 });
+      items.push(obj3);
     }
     return items;
   }
@@ -1113,9 +1114,9 @@ function emitScalar(v) {
   if (typeof v === "string") return JSON.stringify(v);
   return String(v);
 }
-function stringifyYaml(obj2, comments = {}) {
+function stringifyYaml(obj3, comments = {}) {
   const lines = [];
-  for (const [k, v] of Object.entries(obj2)) {
+  for (const [k, v] of Object.entries(obj3)) {
     if (v === void 0) continue;
     const c = comments[k] ? `  # ${comments[k]}` : "";
     if (Array.isArray(v)) {
@@ -1260,7 +1261,7 @@ function buildContract(input) {
 
 // src/core/rules.ts
 import { createHash } from "crypto";
-import { isAbsolute as isAbsolute3, relative as relative3, resolve as resolve2, sep } from "path";
+import { isAbsolute as isAbsolute3, join as join7, relative as relative3, resolve as resolve2, sep } from "path";
 import { homedir, tmpdir } from "os";
 
 // src/core/glob.ts
@@ -1351,7 +1352,8 @@ function captureCoverage(eventsFile, changedPaths, hooksConfigured = false) {
     for (const p of e.paths) {
       if (blocked) blockedPaths.add(p);
       else seenPaths.add(p);
-      if (landed) landedPaths.add(p);
+      const writes = e.type === "command" ? e.raw?.writes : void 0;
+      if (landed && (!Array.isArray(writes) || writes.includes(p))) landedPaths.add(p);
     }
   }
   const ts = events.map((e) => e.ts).sort();
@@ -1434,11 +1436,21 @@ var PREFIX = "Replume:";
 function fingerprint(tool, input) {
   return createHash("sha1").update(tool).update("\0").update(JSON.stringify(input ?? null)).digest("hex").slice(0, 16);
 }
+function expandHome(p) {
+  if (p === "~") return homedir();
+  if (p.startsWith("~/")) return join7(homedir(), p.slice(2));
+  return p;
+}
 function splitPaths(repoRoot2, paths) {
   const inside = [];
   const outside = [];
   const root = resolve2(repoRoot2);
-  for (const p of paths) {
+  for (const raw3 of paths) {
+    const p = expandHome(raw3);
+    if (p.startsWith("~")) {
+      outside.push(p);
+      continue;
+    }
     const abs = isAbsolute3(p) ? resolve2(p) : resolve2(root, p);
     const rel = relative3(root, abs);
     if (rel === "" || rel.startsWith("..") || isAbsolute3(rel)) outside.push(abs);
@@ -1529,11 +1541,13 @@ function shellTokens(src) {
       i++;
     } else if (">|<&;()".includes(c)) {
       const op = /^(?:&>>|>>|>\||>&|&>|&&|\|\||\|&|<<<|<<|<&|[>|<&;()])/.exec(src.slice(i))[0];
+      let fd;
       if ((op[0] === ">" || op[0] === "<") && has && /^\d+$/.test(cur)) {
+        fd = Number(cur);
         cur = "";
         has = false;
       } else flush();
-      toks.push({ op });
+      toks.push(fd === void 0 ? { op } : { op, fd });
       i += op.length;
     } else {
       cur += c;
@@ -1545,8 +1559,122 @@ function shellTokens(src) {
   return toks;
 }
 var SHELLS = /* @__PURE__ */ new Set(["sh", "bash", "zsh", "dash", "ksh"]);
-var WRAPPERS = /* @__PURE__ */ new Set(["sudo", "command", "exec", "time", "xargs", "env", "nohup"]);
 var WRITE_OPS = /* @__PURE__ */ new Set([">", ">>", ">|", "&>", "&>>"]);
+var MAX_NEST = 8;
+var SHELL_KEYWORDS = /* @__PURE__ */ new Set(["if", "then", "else", "elif", "fi", "while", "until", "do", "done", "esac", "{", "}", "!"]);
+var HEADER_KEYWORDS = /* @__PURE__ */ new Set(["for", "select", "case"]);
+var WRAPPER_SPECS = {
+  sudo: { withArg: ["-u", "-g", "-h", "-p", "-C", "-T", "-r", "-t", "-U", "-D", "-R", "--user", "--group", "--host", "--prompt"] },
+  doas: { withArg: ["-u", "-C"] },
+  env: { withArg: ["-u", "-C", "--unset", "--chdir"] },
+  command: { withArg: [] },
+  exec: { withArg: ["-a"] },
+  time: { withArg: ["-f", "-o", "--format", "--output"] },
+  nohup: { withArg: [] },
+  nice: { withArg: ["-n", "--adjustment"] },
+  ionice: { withArg: ["-c", "-n", "-p", "-P", "-u", "--class", "--classdata"] },
+  stdbuf: { withArg: ["-i", "-o", "-e"] },
+  timeout: { withArg: ["-s", "-k", "--signal", "--kill-after"], positional: 1 },
+  xargs: { withArg: ["-I", "-n", "-P", "-L", "-s", "-d", "-E", "-a"] }
+};
+function unwrapCommand(input) {
+  let words = input;
+  for (let guard = 0; guard < 16 && words.length; guard++) {
+    const w = words[0];
+    if (/^[A-Za-z_][A-Za-z0-9_]*=/.test(w) || SHELL_KEYWORDS.has(w)) {
+      words = words.slice(1);
+      continue;
+    }
+    if (HEADER_KEYWORDS.has(w)) return [];
+    if (w === "function") {
+      words = words.slice(2);
+      continue;
+    }
+    const spec = WRAPPER_SPECS[w.split("/").pop()];
+    if (!spec) break;
+    let i = 1;
+    while (i < words.length) {
+      const a = words[i];
+      if (a === "--") {
+        i++;
+        break;
+      }
+      if (a.startsWith("-") && a.length > 1) i += spec.withArg.includes(a) ? 2 : 1;
+      else break;
+    }
+    if (spec.positional && /^\d+(?:\.\d+)?[smhd]?$/.test(words[i] ?? "")) i += spec.positional;
+    words = words.slice(i);
+  }
+  return words;
+}
+function splitFlags(args) {
+  const flags = [];
+  const operands = [];
+  let done = false;
+  for (const a of args) {
+    if (done) operands.push(a);
+    else if (a === "--") done = true;
+    else if (a.startsWith("-") && a.length > 1) flags.push(a);
+    else operands.push(a);
+  }
+  return { flags, operands };
+}
+var isBlockDevice = (p) => /^\/dev\/(?:(?:s|h|v|xv)d[a-z]+[0-9]*|nvme[0-9]+n[0-9]+(?:p[0-9]+)?|mmcblk[0-9]+(?:p[0-9]+)?|r?disk[0-9]+(?:s[0-9]+)*)$/.test(p.trim());
+function substitutionBodies(src) {
+  const text = src.replace(/<<(-?)[ \t]*(['"]?)([A-Za-z_][\w-]*)\2[^\n]*\n[\s\S]*?\n[ \t]*\3(?=\n|$)/g, "");
+  const out = [];
+  const closing = (from) => {
+    let depth = 0;
+    for (let j = from; j < text.length; j++) {
+      const c = text[j];
+      if (c === "\\") {
+        j++;
+        continue;
+      }
+      if (c === "'") {
+        j = text.indexOf("'", j + 1);
+        if (j < 0) return text.length;
+        continue;
+      }
+      if (c === '"') {
+        for (j++; j < text.length && text[j] !== '"'; j++) if (text[j] === "\\") j++;
+        continue;
+      }
+      if (c === "(") depth++;
+      else if (c === ")" && --depth === 0) return j;
+    }
+    return text.length;
+  };
+  let dq = false;
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === "\\") {
+      i++;
+      continue;
+    }
+    if (c === "'" && !dq) {
+      const j = text.indexOf("'", i + 1);
+      if (j < 0) break;
+      i = j;
+      continue;
+    }
+    if (c === '"') {
+      dq = !dq;
+      continue;
+    }
+    if (text[i + 1] === "(" && (c === "$" && text[i + 2] !== "(" || (c === "<" || c === ">") && !dq)) {
+      const end = closing(i + 1);
+      out.push(text.slice(i + 2, end));
+      i = end;
+    } else if (c === "`") {
+      let j = i + 1;
+      while (j < text.length && text[j] !== "`") j += text[j] === "\\" ? 2 : 1;
+      out.push(text.slice(i + 1, j));
+      i = j;
+    }
+  }
+  return out;
+}
 function redirectTargets(command, depth = 0) {
   const toks = shellTokens(command);
   const out = [];
@@ -1559,13 +1687,13 @@ function redirectTargets(command, depth = 0) {
     }
     if (!("word" in t)) return;
     const prev = toks[i - 1];
-    const atCommand = !prev || "op" in prev || WRAPPERS.has(word(prev) ?? "");
+    const atCommand = !prev || "op" in prev || (word(prev) ?? "") in WRAPPER_SPECS;
     if (t.word === "tee" && atCommand) {
       for (let j = i + 1; j < toks.length && "word" in toks[j]; j++) {
         const w = word(toks[j]);
         if (!w.startsWith("-")) out.push(w);
       }
-    } else if (depth < 2 && SHELLS.has(t.word.split("/").pop())) {
+    } else if (depth < MAX_NEST && SHELLS.has(t.word.split("/").pop())) {
       const k = toks.findIndex((x, j) => j > i && "word" in x && /^-[a-z]*c$/.test(x.word));
       const script = k >= 0 ? word(toks[k + 1]) : null;
       if (script) out.push(...redirectTargets(script, depth + 1));
@@ -1588,13 +1716,13 @@ function fileVerbOperands(command, depth = 0) {
     }
     simple[simple.length - 1].push(t.word);
   }
-  for (let words of simple) {
-    while (words.length && (WRAPPERS.has(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
+  for (const sw of simple) {
+    const words = unwrapCommand(sw);
     if (!words.length) continue;
     const verb = words[0].split("/").pop();
     const args = words.slice(1);
-    const operands = args.filter((w) => !w.startsWith("-")).map((w) => w.replace(/^of=/, ""));
-    if (SHELLS.has(verb) && depth < 2) {
+    const operands = splitFlags(args).operands.map((w) => w.replace(/^of=/, ""));
+    if (SHELLS.has(verb) && depth < MAX_NEST) {
       const k = args.findIndex((w) => /^-[a-z]*c$/.test(w));
       if (k >= 0 && args[k + 1]) out.push(...fileVerbOperands(args[k + 1], depth + 1));
     } else if (FILE_VERBS.has(verb)) out.push(...operands);
@@ -1609,51 +1737,130 @@ var INLINE_WRITE = /writeFile|appendFile|createWriteStream|copyFile|rename|unlin
 var GIT_TREE_CHANGERS = /* @__PURE__ */ new Set(["switch", "reset", "stash", "apply", "am", "merge", "pull", "rebase", "cherry-pick", "revert", "clean"]);
 function shellWriteTargets(command, depth = 0) {
   const out = [];
+  const certain = [];
   let unparsed = false;
   const toks = shellTokens(command);
-  const simple = [[]];
+  let cond = false;
+  let base3 = false;
+  const orLists = /* @__PURE__ */ new Set();
+  let list2 = 0;
+  let construct = 0;
+  let pendingFunc = false;
+  const stack = [];
+  const simple = [{ words: [], redirects: [], conditional: false, list: 0, depth: 0, construct: 0, after: ";" }];
+  const next = (after) => simple.push({ words: [], redirects: [], conditional: cond, list: list2, depth: stack.length, construct, after });
   for (let i = 0; i < toks.length; i++) {
     const t = toks[i];
     if ("op" in t) {
-      if (SEPARATORS.has(t.op)) simple.push([]);
+      const cur2 = simple[simple.length - 1];
+      if (t.op === ";") {
+        cond = base3;
+        list2++;
+        pendingFunc = false;
+        next(";");
+      } else if (t.op === "&&") {
+        cond = true;
+        next("&&");
+      } else if (t.op === "||") {
+        cond = true;
+        orLists.add(list2);
+        next("||");
+      } else if (t.op === "(") {
+        if (cur2.words.length === 1 && /^[A-Za-z_][\w.-]*$/.test(cur2.words[0])) pendingFunc = true;
+        stack.push({ cond, base: base3, func: false });
+        base3 = cond;
+        next("(");
+      } else if (t.op === ")") {
+        const top = stack.pop();
+        cond = top?.cond ?? false;
+        base3 = top?.base ?? false;
+        next(")");
+      } else if (SEPARATORS.has(t.op)) next(t.op);
       else if (WRITE_OPS.has(t.op)) {
         const target = toks[i + 1];
         const w = target && "word" in target ? target.word : null;
-        if (!w || DYNAMIC.test(w)) unparsed = true;
-        else if (!DEVICE_SINK.test(w)) out.push(w);
+        const fds = t.fd !== void 0 ? [t.fd] : t.op === "&>" || t.op === "&>>" ? [1, 2] : [1];
+        cur2.redirects.push({ fds, target: w });
         i++;
-      } else if (t.op === "<" || t.op === "<<<" || t.op === "<<") i++;
+      } else if (t.op === "<" || t.op === "<<<" || t.op === "<<" || t.op === ">&" || t.op === "<&") i++;
       continue;
     }
-    simple[simple.length - 1].push(t.word);
-  }
-  const add = (ws) => {
-    for (const w of ws) {
-      if (!w) continue;
-      if (DYNAMIC.test(w)) unparsed = true;
-      else if (!DEVICE_SINK.test(w)) out.push(w);
+    const cur = simple[simple.length - 1];
+    if (cur.words.length === 0) {
+      if (["if", "while", "until", "for", "select", "case"].includes(t.word)) construct++;
+      else if (["fi", "done", "esac"].includes(t.word)) construct = Math.max(0, construct - 1);
+      else if (t.word === "function") pendingFunc = true;
+      else if (t.word === "{") {
+        stack.push({ cond, base: base3, func: pendingFunc });
+        base3 = cond;
+        if (pendingFunc) {
+          construct++;
+          cur.construct = construct;
+        }
+        pendingFunc = false;
+      } else if (t.word === "}") {
+        const top = stack.pop();
+        cond = top?.cond ?? false;
+        base3 = top?.base ?? false;
+        if (top?.func) construct = Math.max(0, construct - 1);
+      }
     }
+    cur.words.push(t.word);
+  }
+  const fails = (sc) => {
+    const w = unwrapCommand(sc.words);
+    return w[0] === "false" || (w[0] === "exit" || w[0] === "return") && /^[1-9][0-9]*$/.test(w[1] ?? "");
   };
-  for (let words of simple) {
-    while (words.length && (["sudo", "command", "exec", "time", "env", "nohup"].includes(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
-    if (!words.length) continue;
+  const skipped = simple.map(() => false);
+  simple.forEach((sc, i) => {
+    if (i > 0 && sc.after === "&&" && (fails(simple[i - 1]) || skipped[i - 1])) skipped[i] = true;
+  });
+  const lastList = [...simple].reverse().find((x) => x.words.length || x.redirects.length)?.list ?? 0;
+  simple.forEach((sc, idx) => {
+    const sure = !skipped[idx] && sc.construct === 0 && (!sc.conditional || sc.depth === 0 && !orLists.has(sc.list) && sc.list === lastList);
+    const last = /* @__PURE__ */ new Map();
+    sc.redirects.forEach((r, j) => r.fds.forEach((fd) => last.set(fd, j)));
+    sc.redirects.forEach((r, j) => {
+      if (!r.target || DYNAMIC.test(r.target)) {
+        unparsed = true;
+        return;
+      }
+      if (DEVICE_SINK.test(r.target)) return;
+      out.push(r.target);
+      if (sure && r.fds.some((fd) => last.get(fd) === j)) certain.push(r.target);
+    });
+    const add = (ws, content = true) => {
+      for (const w of ws) {
+        if (!w) continue;
+        if (DYNAMIC.test(w)) unparsed = true;
+        else if (!DEVICE_SINK.test(w)) {
+          out.push(w);
+          if (content && sure) certain.push(w);
+        }
+      }
+    };
+    const words = unwrapCommand(sc.words);
+    if (!words.length) return;
     const verb = words[0].split("/").pop();
     const args = words.slice(1);
-    const operands = args.filter((w) => !w.startsWith("-"));
+    const operands = splitFlags(args).operands;
+    if (sc.words.slice(0, sc.words.length - words.length).some((x) => x.split("/").pop() === "xargs")) {
+      if (FILE_VERBS.has(verb) || verb === "sed" || verb === "perl") unparsed = true;
+      return;
+    }
     if (SHELLS.has(verb)) {
       const k = args.findIndex((w) => /^-[a-z]*c$/.test(w));
       if (k >= 0 && args[k + 1] !== void 0) {
-        if (depth >= 2) unparsed = true;
+        if (depth >= MAX_NEST) unparsed = true;
         else {
           const r = shellWriteTargets(args[k + 1], depth + 1);
           out.push(...r.paths);
+          if (sure) certain.push(...r.certain);
           unparsed ||= r.unparsed;
         }
       }
-    } else if (verb === "xargs") {
-      if (args.some((w) => FILE_VERBS.has(w) || w === "sed" || w === "perl")) unparsed = true;
     } else if (["tee", "touch", "truncate", "rm", "unlink", "chmod", "chown"].includes(verb)) {
-      add(verb === "chmod" || verb === "chown" ? operands.slice(1) : verb === "truncate" ? args.filter((w, j) => !w.startsWith("-") && !/^-s$|^--size$/.test(args[j - 1] ?? "")) : operands);
+      add(verb === "chmod" || verb === "chown" ? operands.slice(1) : verb === "truncate" ? args.filter((w, j) => !w.startsWith("-") && !/^-s$|^--size$/.test(args[j - 1] ?? "")) : operands, !["touch", "chmod", "chown"].includes(verb));
     } else if (verb === "cp" || verb === "install" || verb === "ln") {
       const t = args.findIndex((w) => w === "-t" || w === "--target-directory");
       if (t >= 0 || args.some((w) => w.startsWith("--target-directory="))) unparsed = true;
@@ -1677,20 +1884,26 @@ function shellWriteTargets(command, depth = 0) {
         else unparsed = true;
       } else if (GIT_TREE_CHANGERS.has(sub)) unparsed = true;
     } else if (INLINE_INTERP.has(verb.replace(/[0-9.]+$/, "")) && args.some((w) => /^-[a-zA-Z]*[ec]$|^eval$/.test(w)) && INLINE_WRITE.test(args.join(" "))) unparsed = true;
+  });
+  const bodies = substitutionBodies(command);
+  if (bodies.length && depth >= MAX_NEST) unparsed = true;
+  else for (const body of bodies) {
+    const r = shellWriteTargets(body, depth + 1);
+    out.push(...r.paths);
+    unparsed ||= r.unparsed;
   }
   if (depth === 0 && unobservable(command)) unparsed = true;
-  return { paths: [...new Set(out)], unparsed };
+  return { paths: [...new Set(out)], unparsed, certain: [...new Set(certain)] };
 }
 function deletedOperands(command, depth = 0) {
   const out = [];
   for (const t of shellTokens(command).reduce((acc, x) => ("op" in x && SEPARATORS.has(x.op) ? acc.push([]) : "word" in x && acc[acc.length - 1].push(x.word), acc), [[]])) {
-    let words = t;
-    while (words.length && (WRAPPERS.has(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
+    const words = unwrapCommand(t);
     const verb = words[0]?.split("/").pop();
-    const ops = words.slice(1).filter((w) => !w.startsWith("-"));
+    const ops = splitFlags(words.slice(1)).operands;
     if (verb === "rm" || verb === "unlink") out.push(...ops);
     else if (verb === "git" && words[1] === "rm") out.push(...ops.slice(1));
-    else if (verb && SHELLS.has(verb) && depth < 2) {
+    else if (verb && SHELLS.has(verb) && depth < MAX_NEST) {
       const k = words.findIndex((w) => /^-[a-z]*c$/.test(w));
       if (k >= 0 && words[k + 1]) out.push(...deletedOperands(words[k + 1], depth + 1));
     }
@@ -1752,6 +1965,11 @@ var MUTATING_VERBS = /(^|[\s;&|(])(rm|mv|cp|truncate|tee|chmod|chown|ln|unlink|p
 function commandPathTokens(command) {
   return (command.match(/[A-Za-z0-9_./@+-]+/g) ?? []).filter((t) => t.includes("/") || t.includes("."));
 }
+function allowedForTask(ctx, protectedPaths) {
+  const allow = ctx.contract?.allow ?? [];
+  if (!allow.length) return null;
+  return allow.map((g) => protectedPaths.some((p) => matchesAny(p, [g])) ? `${g} (except protected files)` : g).join(", ");
+}
 var protectedPathModified = (a, ctx) => {
   const protect = ctx.contract?.protect ?? [];
   if (isWrite(a)) {
@@ -1765,22 +1983,24 @@ var protectedPathModified = (a, ctx) => {
     }
     const hit = a.paths.filter((p) => matchesAny(p, protect));
     if (!hit.length) return null;
+    const allowed = allowedForTask(ctx, hit);
     return {
       rule: "protected_path_modified",
       action: "block",
-      message: `${PREFIX} ${hit.join(", ")} is protected by the task contract and must not change. Leave it as it is and make the implementation satisfy it. If the task truly requires changing it, stop and ask the user.`
+      message: allowed ? `${PREFIX} ${hit.join(", ")} is protected. Allowed for this task: ${allowed}. Change those instead; if the protected file must change, stop and ask the user.` : `${PREFIX} ${hit.join(", ")} is protected by the task contract and must not change. Leave it as it is and make the implementation satisfy it. If the task truly requires changing it, stop and ask the user.`
     };
   }
   if (a.kind === "command" && a.command) {
     const guarded = (p) => matchesAny(p, protect) !== null || p === ".replume" || p.startsWith(".replume/");
     const redirected = writeTargets(a, ctx.repoRoot).inside.filter(guarded);
-    const operands = splitPaths(ctx.repoRoot, fileVerbOperands(a.command)).inside.filter(guarded);
+    const operands = splitPaths(ctx.repoRoot, [a.command, ...innerScripts(a.command)].flatMap((c) => fileVerbOperands(c))).inside.filter(guarded);
     const hit = [.../* @__PURE__ */ new Set([...redirected, ...operands])];
     if (!hit.length) return null;
+    const allowed = allowedForTask(ctx, hit);
     return {
       rule: "protected_path_modified",
       action: "block",
-      message: `${PREFIX} this command would modify ${hit.join(", ")}, which the task contract protects. Do not change protected files through the shell either. If it is required, stop and ask the user.`
+      message: allowed ? `${PREFIX} this command would modify ${hit.join(", ")}, which is protected. Allowed for this task: ${allowed}. Change those instead; if the protected file must change, stop and ask the user.` : `${PREFIX} this command would modify ${hit.join(", ")}, which the task contract protects. Do not change protected files through the shell either. If it is required, stop and ask the user.`
     };
   }
   return null;
@@ -1801,7 +2021,7 @@ var testWeakened = (a) => {
         message: `${PREFIX} this command forces the test run to succeed (\`|| true\` / \`exit 0\`), which hides failures. Run the tests plainly and fix what fails.`
       };
     }
-    const rmTests = [...new Set(deletedOperands(a.command).filter((t) => isTestFile(t)))];
+    const rmTests = [...new Set([a.command, ...innerScripts(a.command)].flatMap((c) => deletedOperands(c)).filter((t) => isTestFile(t)))];
     if (rmTests.length) {
       return {
         rule: "test_weakened",
@@ -1854,10 +2074,32 @@ var ALWAYS_DESTRUCTIVE = [
   { re: /\bgit\s+branch\s+-D\b/, why: "force-deletes a branch" },
   { re: /\b(DROP\s+(TABLE|DATABASE|SCHEMA)|TRUNCATE\s+TABLE)\b/i, why: "drops or truncates database data" },
   { re: /\bDELETE\s+FROM\s+\w+\s*(;|$|")/i, why: "deletes every row of a table" },
-  { re: /\bmkfs(\.\w+)?\b|\bdd\s+[^\n]*of=\/dev\//, why: "overwrites a disk" },
   { re: /\bchmod\s+-R\s+777\s+\//, why: "makes the filesystem world-writable" },
   { re: /:\(\)\s*\{\s*:\|:&\s*\};:/, why: "is a fork bomb" }
 ];
+function shellScripts(command, depth = 0) {
+  if (depth >= MAX_NEST) return [];
+  const out = [];
+  const groups = [[]];
+  for (const t of shellTokens(command)) {
+    if ("op" in t) {
+      if (SEPARATORS.has(t.op)) groups.push([]);
+    } else groups[groups.length - 1].push(t.word);
+  }
+  for (const g of groups) {
+    const words = unwrapCommand(g);
+    if (!words.length || !SHELLS.has(words[0].split("/").pop())) continue;
+    const k = words.findIndex((w, i) => i > 0 && /^-[a-z]*c$/.test(w));
+    const script = k >= 0 ? words[k + 1] : void 0;
+    if (script) out.push(script, ...shellScripts(script, depth + 1));
+  }
+  return out;
+}
+function innerScripts(command, depth = 0) {
+  if (depth >= MAX_NEST) return [];
+  const direct = [...shellScripts(command, MAX_NEST - 1), ...substitutionBodies(command)];
+  return [...new Set(direct)].flatMap((x) => [x, ...innerScripts(x, depth + 1)]);
+}
 function deletionTargets(command) {
   const groups = [[]];
   for (const token of shellTokens(command)) {
@@ -1865,32 +2107,54 @@ function deletionTargets(command) {
       if (SEPARATORS.has(token.op)) groups.push([]);
     } else groups[groups.length - 1].push(token.word);
   }
-  const result = [];
-  for (let words of groups) {
-    while (words.length && (WRAPPERS.has(words[0]) || /^[A-Za-z_][A-Za-z0-9_]*=/.test(words[0]))) words = words.slice(1);
+  const result2 = [];
+  for (const g of groups) {
+    const words = unwrapCommand(g);
     const verb = words[0]?.split("/").pop();
     if (verb === "rm") {
-      const args = words.slice(1);
-      if (args.some((x) => /^-[^-]*[rR]/.test(x) || x === "--recursive"))
-        result.push({ targets: args.filter((x) => x !== "--" && !x.startsWith("-")), gitClean: false });
+      const { flags, operands } = splitFlags(words.slice(1));
+      if (flags.some((x) => /^-[^-]*[rR]/.test(x) || x === "--recursive")) result2.push({ targets: operands, gitClean: false });
     } else if (verb === "rmdir") {
-      result.push({ targets: words.slice(1).filter((x) => x !== "--" && !x.startsWith("-")), gitClean: false });
+      result2.push({ targets: splitFlags(words.slice(1)).operands, gitClean: false });
     } else if (verb === "find" && words.includes("-delete")) {
-      result.push({ targets: words.slice(1, words.indexOf("-delete")).filter((x) => x !== "--" && !x.startsWith("-") && x !== "-depth"), gitClean: false });
+      result2.push({ targets: words.slice(1, words.indexOf("-delete")).filter((x) => x !== "--" && !x.startsWith("-") && x !== "-depth"), gitClean: false });
     } else if (verb === "git") {
       const clean = words.indexOf("clean");
       if (clean < 0 || !words.slice(clean + 1).some((x) => /^-[^-]*f/.test(x) || x === "--force")) continue;
       const c = words.indexOf("-C");
       const cwd = c >= 0 && c < clean ? words[c + 1] : null;
       const paths = words.slice(clean + 1).filter((x) => x !== "--" && !x.startsWith("-"));
-      result.push({ targets: [...cwd ? [cwd] : [], ...paths], gitClean: true });
+      result2.push({ targets: [...cwd ? [cwd] : [], ...paths], gitClean: true });
     }
   }
-  return result;
+  return result2;
+}
+function expandTmpdirVar(target, ctx) {
+  const m = /^\$\{?TMPDIR\}?(?=\/|$)/.exec(target);
+  if (!m) return target;
+  const env = process.env.TMPDIR === void 0 ? tmpdir() : process.env.TMPDIR;
+  if (!env || !isAbsolute3(env)) return null;
+  const base3 = resolve2(env);
+  if (!isTempDir(ctx, base3)) return null;
+  return base3 + target.slice(m[0].length);
+}
+function isTempDir(ctx, abs) {
+  const roots = ["/tmp", "/private/tmp", "/var/tmp", "/private/var/tmp", ...ctx.scratchDirs ?? []].map((d) => resolve2(d));
+  return roots.some((d) => abs === d || abs.startsWith(d + sep)) || /^\/(?:private\/)?var\/folders\/[^/]+\/[^/]+\/T(?:\/|$)/.test(abs);
 }
 function deletionLocation(target, ctx) {
-  if (target.startsWith("~") || /[$*?{}`]/.test(target)) return "critical";
-  const expanded = target === "~" || target.startsWith("~/") ? homedir() + target.slice(1) : target;
+  const bare = target.replace(/^["']|["']$/g, "");
+  const t = expandTmpdirVar(bare, ctx);
+  if (t === null) return "critical";
+  if (t.startsWith("~") || /[$?{}`]/.test(t) && !/[*?[]/.test(t)) return "critical";
+  if (/[*?[]/.test(t)) {
+    const segs = t.split("/");
+    const gi = segs.findIndex((x) => /[*?[]/.test(x));
+    const prefix = segs.slice(0, gi).join("/") || (t.startsWith("/") ? "/" : "");
+    if (!/[$`{]/.test(prefix) && prefix && isTempDir(ctx, resolve2(ctx.repoRoot, prefix))) return "outside";
+    return "critical";
+  }
+  const expanded = t === "~" || t.startsWith("~/") ? homedir() + t.slice(1) : t;
   const abs = resolve2(ctx.repoRoot, expanded);
   const root = resolve2(ctx.repoRoot);
   const home = resolve2(homedir());
@@ -1898,6 +2162,32 @@ function deletionLocation(target, ctx) {
   const rel = relative3(root, abs);
   return !rel || !rel.startsWith("..") && !isAbsolute3(rel) ? "inside" : "outside";
 }
+function resolvedTarget(target, ctx) {
+  const t = expandTmpdirVar(target.replace(/^["']|["']$/g, ""), ctx) ?? target;
+  return resolve2(ctx.repoRoot, t);
+}
+function blockDeviceWrites(scripts) {
+  const out = shellWriteTargets(scripts[0] ?? "").paths.filter(isBlockDevice);
+  for (const script of scripts) {
+    const groups = [[]];
+    const toks = shellTokens(script);
+    for (let i = 0; i < toks.length; i++) {
+      const t = toks[i];
+      if ("op" in t) {
+        if (SEPARATORS.has(t.op)) groups.push([]);
+        else if (WRITE_OPS.has(t.op) || t.op === "<" || t.op === "<<<" || t.op === "<<") i++;
+        continue;
+      }
+      groups[groups.length - 1].push(t.word);
+    }
+    for (const g of groups) {
+      const words = unwrapCommand(g);
+      const verb = words[0]?.split("/").pop() ?? "";
+      if (verb === "mkfs" || verb.startsWith("mkfs.") || verb === "mkswap") out.push(...splitFlags(words.slice(1)).operands.filter(isBlockDevice));
+    }
+  }
+  return [...new Set(out)];
+}
 function rmRfTargets(command) {
   const out = [];
   for (const seg of command.split(/&&|\|\||;|\|/)) {
@@ -1931,7 +2221,14 @@ var destructiveCommand = (a, ctx) => {
       };
     }
   }
-  const deletions = deletionTargets(cmd);
+  const scripts = [cmd, ...innerScripts(cmd)];
+  const devices = blockDeviceWrites(scripts);
+  if (devices.length) return {
+    rule: "destructive_command",
+    action: "block",
+    message: `${PREFIX} this command writes to a raw disk or block device (${devices.join(", ")}), which overwrites what is on it. It is blocked. If this is really intended, ask the user to run it themselves.`
+  };
+  const deletions = scripts.flatMap(deletionTargets);
   const deletionPaths = deletions.flatMap((d) => d.targets);
   const critical = deletionPaths.filter((p) => deletionLocation(p, ctx) === "critical");
   if (critical.length) return {
@@ -1939,7 +2236,7 @@ var destructiveCommand = (a, ctx) => {
     action: "block",
     message: `${PREFIX} this command can delete the home directory, filesystem root, or a parent of this repository (${critical.join(", ")}). It is blocked.`
   };
-  const foreignDeletion = deletionPaths.filter((p) => deletionLocation(p, ctx) === "outside" && !matchesAny(resolve2(ctx.repoRoot, p), ctx.contract?.allow ?? []));
+  const foreignDeletion = deletionPaths.filter((p) => deletionLocation(p, ctx) === "outside" && !matchesAny(resolvedTarget(p, ctx), ctx.contract?.allow ?? []));
   if (foreignDeletion.length) return {
     rule: "destructive_command",
     action: "warn",
@@ -1959,11 +2256,11 @@ var destructiveCommand = (a, ctx) => {
       };
     }
   }
-  for (const targets of rmRfTargets(cmd)) {
+  for (const targets of scripts.flatMap(rmRfTargets)) {
     const bad = targets.filter((t) => {
       const clean = t.replace(/^["']|["']$/g, "");
-      if (/^(\/|~|\$HOME|\*|\.{1,2}\/?)$/.test(clean) || clean.startsWith("~") || clean.includes("$")) return true;
-      const { inside, outside } = splitPaths(ctx.repoRoot, [clean]);
+      if (/^(\/|~|\$HOME|\*|\.{1,2}\/?)$/.test(clean) || clean.startsWith("~") || deletionLocation(clean, ctx) === "critical") return true;
+      const { inside, outside } = splitPaths(ctx.repoRoot, [expandTmpdirVar(clean, ctx) ?? clean]);
       if (outside.length) return !inScratch(ctx, outside[0]);
       return !REGENERABLE.test(inside[0]);
     });
@@ -1983,7 +2280,7 @@ var destructiveCommand = (a, ctx) => {
       message: `${PREFIX} this command deletes backup files. It is blocked; ask the user before removing backups.`
     };
   }
-  const verbTargets = MUTATING_VERBS.test(cmd) ? a.outsidePaths : [];
+  const verbTargets = MUTATING_VERBS.test(cmd) ? a.outsidePaths.filter((p) => !p.startsWith("/dev/")) : [];
   const foreign = [.../* @__PURE__ */ new Set([...verbTargets, ...writeTargets(a, ctx.repoRoot).outside])].filter((p) => !inScratch(ctx, p) && !DEVICE_SINK.test(p));
   if (foreign.length) {
     return {
@@ -2274,7 +2571,7 @@ function parseJudgeResponse(x) {
 function commandJudge(executable, apiKey) {
   return {
     name: `command:${executable}`,
-    judge: (req, signal) => new Promise((resolve7, reject) => {
+    judge: (req, signal) => new Promise((resolve9, reject) => {
       const env = { PATH: process.env.PATH, HOME: process.env.HOME };
       if (apiKey) env[ENV.apiKey] = apiKey;
       const child = spawn(executable, [], { env, stdio: ["pipe", "pipe", "pipe"], signal });
@@ -2291,7 +2588,7 @@ function commandJudge(executable, apiKey) {
         if (code !== 0) return reject(new Error(`judge command exited ${code}: ${err.trim().slice(0, 200)}`));
         if (stdinError) return reject(new Error(`judge command stdin failed: ${stdinError.message}`));
         try {
-          resolve7(parseJudgeResponse(JSON.parse(out)));
+          resolve9(parseJudgeResponse(JSON.parse(out)));
         } catch (e) {
           reject(e);
         }
@@ -2656,11 +2953,11 @@ async function supervise(input, opts) {
 
 // src/supervisor/done.ts
 import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 
 // src/sandbox/scenarios.ts
 import { lstat, readdir, readFile, realpath } from "fs/promises";
-import { join as join7, relative as relative4, sep as sep2 } from "path";
+import { join as join8, relative as relative4, sep as sep2 } from "path";
 var required = (ok, file2, field) => {
   if (!ok) throw new Error(`${file2}: invalid or missing ${field}`);
 };
@@ -2703,14 +3000,14 @@ async function loadScenarios(dir, root = dir) {
   if (!inside(await realpath(dir))) throw new Error(`scenario directory ${rel(dir)} resolves outside the commit; ${NOT_REGULAR}`);
   const files = (await readdir(dir)).filter((n) => n.endsWith(".yaml") || n.endsWith(".yml")).sort();
   for (const n of files) {
-    const p = join7(dir, n);
+    const p = join8(dir, n);
     const st = await lstat(p);
     if (st.isSymbolicLink()) throw new Error(`scenario file ${rel(p)} is a symbolic link; ${NOT_REGULAR}`);
     if (!st.isFile()) throw new Error(`scenario file ${rel(p)} is not a regular file; ${NOT_REGULAR}`);
     if (!inside(await realpath(p))) throw new Error(`scenario file ${rel(p)} resolves outside the commit; ${NOT_REGULAR}`);
   }
   const scenarios = await Promise.all(files.map(async (n) => {
-    const s = parseScenario(await readFile(join7(dir, n), "utf8"), n);
+    const s = parseScenario(await readFile(join8(dir, n), "utf8"), n);
     required(n.replace(/\.ya?ml$/, "") === s.id, n, "id (must match filename)");
     return s;
   }));
@@ -2792,10 +3089,10 @@ function doneStatus(contract, sessionEvents, repoRoot2) {
   for (const d of entries) {
     if ("run" in d) need(d.run, `\`${d.run}\``, d.run);
     else {
-      const file2 = join8(".replume", "scenarios", `${d.scenario}.yaml`);
+      const file2 = join9(".replume", "scenarios", `${d.scenario}.yaml`);
       let run = null;
       try {
-        if (existsSync7(join8(repoRoot2, file2))) run = parseScenario(readFileSync8(join8(repoRoot2, file2), "utf-8"), file2).run;
+        if (existsSync7(join9(repoRoot2, file2))) run = parseScenario(readFileSync8(join9(repoRoot2, file2), "utf-8"), file2).run;
       } catch {
         run = null;
       }
@@ -2831,7 +3128,7 @@ function readIfExists(path) {
   }
 }
 function absolutePathsIn(command) {
-  return (command.match(/(?<![\w.:/])(?:\/|~\/)[\w.@+-]+(?:\/[\w.@+-]*)*/g) ?? []).map(
+  return (command.match(/(?<![\w.:/])(?:\/|~\/)[\w.@+-]+(?:\/[\w.@+-]*)*(?![\w.@+(/-])/g) ?? []).map(
     (p) => p.startsWith("~/") ? resolve3(process.env.HOME ?? "/", p.slice(2)) : p
   );
 }
@@ -2843,8 +3140,12 @@ function toProposedAction(p, repoRoot2) {
   let command = null;
   let writeTargetNotParsed = false;
   let mentioned = [];
+  let certainRaw = [];
   const pending = [];
-  const abs = (fp) => isAbsolute4(fp) ? fp : resolve3(p.cwd, fp);
+  const abs = (fp) => {
+    const h = expandHome(fp);
+    return isAbsolute4(h) || h.startsWith("~") ? h : resolve3(p.cwd, h);
+  };
   switch (tool) {
     case "Bash":
     case "PowerShell": {
@@ -2853,6 +3154,7 @@ function toProposedAction(p, repoRoot2) {
       const w = tool === "Bash" ? shellWriteTargets(command) : { paths: [], unparsed: false };
       writeTargetNotParsed = w.unparsed;
       rawPaths = w.paths.map(abs);
+      certainRaw = "certain" in w ? w.certain.map(abs) : [];
       mentioned = absolutePathsIn(command);
       break;
     }
@@ -2901,12 +3203,13 @@ function toProposedAction(p, repoRoot2) {
   }
   const { inside, outside: writtenOutside } = splitPaths(repoRoot2, rawPaths.filter(Boolean));
   const outside = [.../* @__PURE__ */ new Set([...writtenOutside, ...splitPaths(repoRoot2, mentioned).outside])];
+  const certainPaths = [...new Set(splitPaths(repoRoot2, certainRaw).inside)];
   const changes = [];
   for (const c of pending) {
     const rel = splitPaths(repoRoot2, [c.abs]).inside[0];
     if (rel !== void 0) changes.push({ path: rel, before: c.before, after: c.after });
   }
-  return { kind, tool, paths: [...new Set(inside)], outsidePaths: outside, command, changes, fingerprint: fingerprint(tool, input), ...writeTargetNotParsed ? { writeTargetNotParsed } : {} };
+  return { kind, tool, paths: [...new Set(inside)], outsidePaths: outside, command, changes, fingerprint: fingerprint(tool, input), ...writeTargetNotParsed ? { writeTargetNotParsed } : {}, ...kind === "command" ? { certainPaths } : {} };
 }
 
 // src/agents/claude/handler.ts
@@ -2922,7 +3225,7 @@ function resolveRepoRoot(p, env = process.env) {
 var WRITE_NOT_PARSED = "write target not parsed";
 function writeFields(a) {
   if (a.kind !== "command") return {};
-  return { writes: a.paths, ...a.writeTargetNotParsed ? { writeNote: WRITE_NOT_PARSED } : {} };
+  return { writes: a.certainPaths ?? a.paths, ...a.writeTargetNotParsed ? { writeNote: WRITE_NOT_PARSED } : {} };
 }
 function summarize(a) {
   if (a.command !== null) return `${a.tool}: ${a.command}${a.writeTargetNotParsed ? ` (${WRITE_NOT_PARSED})` : ""}`;
@@ -3013,14 +3316,14 @@ function decide(p, repoRoot2, proposal, sessionEvents, env, deps) {
   };
   const opts = { layer2, judge, sessionEvents, slot };
   if (layer2Inactive(opts)) return { result: superviseSync(input, opts), contract };
-  return supervise(input, opts).then((result) => ({ result, contract }));
+  return supervise(input, opts).then((result2) => ({ result: result2, contract }));
 }
 function preToolUse(p, repoRoot2, env, deps) {
   const ledger = ledgerPath(repoRoot2);
   const action = toProposedAction(p, repoRoot2);
   const session = readEvents(ledger).events.filter((e) => e.sessionId === p.session_id);
-  return andThen(decide(p, repoRoot2, { kind: "action", action }, session, env, deps), ({ result, contract }) => {
-    const deciding = result.findings.find((f) => f.decision === result.decision);
+  return andThen(decide(p, repoRoot2, { kind: "action", action }, session, env, deps), ({ result: result2, contract }) => {
+    const deciding = result2.findings.find((f) => f.decision === result2.decision);
     appendEvent(ledger, {
       ...base(p, "tool_pre"),
       tool: action.tool,
@@ -3028,22 +3331,22 @@ function preToolUse(p, repoRoot2, env, deps) {
       command: action.command,
       summary: summarize(action),
       rule: deciding?.rule ?? null,
-      action: ledgerAction(result.decision),
-      message: result.message,
+      action: ledgerAction(result2.decision),
+      message: result2.message,
       raw: {
         fingerprint: action.fingerprint,
-        decision: result.decision,
-        layer: result.layer,
-        layer2Mode: result.layer2.mode,
+        decision: result2.decision,
+        layer: result2.layer,
+        layer2Mode: result2.layer2.mode,
         tool_use_id: p.tool_use_id ?? null,
         tool_input: p.tool_input ?? null,
         ...writeFields(action)
       }
     });
     const rec = { p, ledger, tool: action.tool, paths: action.paths, command: action.command, target: summarize(action), contractId: contract?.id ?? null };
-    recordFindings(rec, result.findings);
-    recordLayer2(rec, result.layer2Run, result.layer2.mode);
-    return { exitCode: 0, stdout: decisionOutput("PreToolUse", result), stderr: "" };
+    recordFindings(rec, result2.findings);
+    recordLayer2(rec, result2.layer2Run, result2.layer2.mode);
+    return { exitCode: 0, stdout: decisionOutput("PreToolUse", result2), stderr: "" };
   });
 }
 var DONE_SLOT_RULE = "done_stop_slot";
@@ -3071,18 +3374,18 @@ function stop(p, repoRoot2, env, deps) {
   const session = readEvents(ledger).events.filter((e) => e.sessionId === p.session_id);
   const lastAssistantMessage = typeof p.last_assistant_message === "string" ? p.last_assistant_message : "";
   const stopHookActive = p.stop_hook_active === true;
-  return andThen(decide(p, repoRoot2, { kind: "stop", lastAssistantMessage, stopHookActive }, session, env, deps), ({ result, contract }) => {
-    const deciding = result.findings.find((f) => f.decision === result.decision);
+  return andThen(decide(p, repoRoot2, { kind: "stop", lastAssistantMessage, stopHookActive }, session, env, deps), ({ result: result2, contract }) => {
+    const deciding = result2.findings.find((f) => f.decision === result2.decision);
     const done = contract?.done?.length && !stopHookActive ? doneStatus(contract, session, repoRoot2) : null;
     const cap = contract?.max_stop_blocks ?? DEFAULT_MAX_STOP_BLOCKS;
     const unmet = done !== null && done.missing.length > 0;
     const slot = unmet ? reserveStopSlot(p, ledger) : null;
     const blocksSoFar = slot?.ahead ?? 0;
     const blockStop = unmet && blocksSoFar < cap;
-    const steer = result.decision === "block" ? { decision: "steer", message: result.message } : result;
+    const steer = result2.decision === "block" ? { decision: "steer", message: result2.message } : result2;
     const doneText = !unmet ? null : blockStop ? `${doneMessage(done)} (stop block ${blocksSoFar + 1} of ${cap})` : `${doneMessage(done)} Replume is not blocking again (max_stop_blocks ${cap} reached).`;
     const message = doneText ? [doneText, steer.decision === "ok" ? "" : steer.message ?? ""].filter(Boolean).join("\n") : null;
-    const stopDecision = doneText ? blockStop ? "block" : "steer" : result.decision;
+    const stopDecision = doneText ? blockStop ? "block" : "steer" : result2.decision;
     appendEvent(ledger, {
       ...base(p, "stop"),
       tool: null,
@@ -3091,19 +3394,19 @@ function stop(p, repoRoot2, env, deps) {
       summary: stopHookActive ? "agent finished its turn (continuing after stop-hook feedback)" : "agent finished its turn",
       rule: doneText ? DONE_RULE : deciding?.rule ?? null,
       action: ledgerAction(stopDecision),
-      message: message ?? result.message,
+      message: message ?? result2.message,
       raw: {
         decision: stopDecision,
-        layer: result.layer,
-        layer2Mode: result.layer2.mode,
+        layer: result2.layer,
+        layer2Mode: result2.layer2.mode,
         stopHookActive,
         lastAssistantMessage: lastAssistantMessage.slice(0, 2e3),
         ...done ? { done: { checked: done.checked, missing: done.missing, blocked: blockStop } } : {}
       }
     });
     const rec = { p, ledger, tool: null, paths: [], command: null, target: "stop", contractId: contract?.id ?? null };
-    recordFindings(rec, result.findings);
-    recordLayer2(rec, result.layer2Run, result.layer2.mode);
+    recordFindings(rec, result2.findings);
+    recordLayer2(rec, result2.layer2Run, result2.layer2.mode);
     if (!unmet || !doneText || !message) return { exitCode: 0, stdout: decisionOutput("Stop", steer), stderr: "" };
     appendEvent(ledger, {
       ...base(p, "rule_hit"),
@@ -3166,9 +3469,9 @@ function prompt(p, repoRoot2) {
 }
 function failOpen(err, repoRoot2, env) {
   try {
-    const dir = join9(repoRoot2 ?? env.CLAUDE_PROJECT_DIR ?? process.cwd(), REPLUME_DIR);
+    const dir = join10(repoRoot2 ?? env.CLAUDE_PROJECT_DIR ?? process.cwd(), REPLUME_DIR);
     mkdirSync6(dir, { recursive: true });
-    appendFileSync3(join9(dir, "hook-errors.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${err.stack ?? err}
+    appendFileSync3(join10(dir, "hook-errors.log"), `${(/* @__PURE__ */ new Date()).toISOString()} ${err.stack ?? err}
 `);
   } catch {
   }
@@ -3203,19 +3506,19 @@ function handleClaudeHook(stdinText, env = process.env, deps = {}) {
         out = QUIET;
     }
     const root = repoRoot2;
-    const finish = (result) => {
+    const finish = (result2) => {
       if ((p.hook_event_name === "Stop" || p.hook_event_name === "SessionEnd") && p.transcript_path) {
         const contract = loadContract(contractPath(root));
         if (contract && contract.status !== "draft") captureClaudeUsage({
           repoRoot: root,
-          allowedRoot: join9(env.HOME ?? homedir2(), ".claude", "projects"),
+          allowedRoot: join10(env.HOME ?? homedir2(), ".claude", "projects"),
           transcriptPath: p.transcript_path,
           taskId: contract.id,
           sessionId: p.session_id,
           final: p.hook_event_name === "SessionEnd"
         });
       }
-      return result;
+      return result2;
     };
     return out instanceof Promise ? out.then(finish).catch((err) => failOpen(err, root, env)) : Promise.resolve(finish(out));
   } catch (err) {
@@ -3470,13 +3773,16 @@ function ruleDecisionToHookResponse(hookEventName, decision2) {
 }
 
 // src/agents/cursor/action.ts
-import { isAbsolute as isAbsolute6, join as join10 } from "path";
+import { isAbsolute as isAbsolute6, join as join11 } from "path";
 var str2 = (v) => typeof v === "string" && v.length > 0 ? v : null;
 function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
   const hook2 = str2(raw3.hook_event_name);
   const toolInput = raw3.tool_input && typeof raw3.tool_input === "object" ? raw3.tool_input : {};
   const command = str2(raw3.command) && hook2 !== "beforeMCPExecution" ? str2(raw3.command) : str2(raw3.tool_name) === "Shell" ? str2(toolInput.command) : fallback.command ?? null;
-  const abs = (p) => isAbsolute6(p) ? p : join10(repoRoot2, p);
+  const abs = (p) => {
+    const h = expandHome(p);
+    return isAbsolute6(h) || h.startsWith("~") ? h : join11(repoRoot2, h);
+  };
   const proposedPath = hook2 === "preToolUse" && /write|edit|delete/i.test(str2(raw3.tool_name) ?? "") ? str2(toolInput.file_path) : null;
   const files = [str2(raw3.file_path), proposedPath, ...fallback.paths ?? []].filter((p) => !!p).map(abs);
   const edits = Array.isArray(raw3.edits) ? raw3.edits : [];
@@ -3502,7 +3808,8 @@ function cursorPayloadToAction(raw3, repoRoot2, fallback = {}) {
     command,
     changes,
     fingerprint: fingerprint(tool, { files: inside, command, edits }),
-    ...w?.unparsed ? { writeTargetNotParsed: true } : {}
+    ...w?.unparsed ? { writeTargetNotParsed: true } : {},
+    ...w ? { certainPaths: [...new Set(splitPaths(repoRoot2, w.certain.map(abs)).inside)] } : {}
   };
 }
 
@@ -3527,7 +3834,7 @@ function handleCursorHook(stdinText, env = process.env) {
       action: evaluation?.action ?? "ok",
       message: evaluation?.message ?? null
     };
-    const writes = action.kind === "command" ? { writes: action.paths, ...action.writeTargetNotParsed ? { writeNote: "write target not parsed" } : {} } : {};
+    const writes = action.kind === "command" ? { writes: action.certainPaths ?? action.paths, ...action.writeTargetNotParsed ? { writeNote: "write target not parsed" } : {} } : {};
     appendEvent(ledger, sanitizeCursorLedgerEvent({
       ...event,
       ...action.kind === "command" ? { paths: action.paths } : {},
@@ -3546,10 +3853,221 @@ function handleCursorHook(stdinText, env = process.env) {
   }
 }
 
-// src/agents/cursor/install.ts
+// src/agents/codex/handler.ts
+import { execFileSync as execFileSync6 } from "child_process";
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync10, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
-import { dirname as dirname5, join as join11 } from "path";
+import { existsSync as existsSync9, readFileSync as readFileSync10 } from "fs";
+import { resolve as resolve6 } from "path";
+
+// src/agents/codex/action.ts
+import { resolve as resolve5 } from "path";
+function codexAction(payload, root) {
+  const tool = typeof payload.tool_name === "string" ? payload.tool_name : "unknown";
+  const input = payload.tool_input && typeof payload.tool_input === "object" && !Array.isArray(payload.tool_input) ? payload.tool_input : {};
+  const command = typeof input.command === "string" ? input.command : "";
+  if (tool === "Bash") {
+    return toProposedAction({ session_id: "", cwd: String(payload.cwd), hook_event_name: "PreToolUse", tool_name: tool, tool_input: input }, root);
+  }
+  if (tool === "apply_patch") {
+    const rawPaths = [...command.matchAll(/^\*\*\* (?:Add File|Update File|Delete File|Move to): (.+)$/gm)].map((m) => m[1].trim());
+    const { inside, outside } = splitPaths(root, rawPaths.map((p) => resolve5(String(payload.cwd), p)));
+    return {
+      kind: "edit",
+      tool,
+      paths: [...new Set(inside)],
+      outsidePaths: outside,
+      command: null,
+      changes: [],
+      fingerprint: fingerprint(tool, input)
+    };
+  }
+  return { kind: "other", tool, paths: [], outsidePaths: [], command: null, changes: [], fingerprint: fingerprint(tool, input) };
+}
+
+// src/agents/codex/handler.ts
+var QUIET2 = { stdout: "", stderr: "", exitCode: 0 };
+var object = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+var str3 = (x) => typeof x === "string" ? x : "";
+var result = (stdout) => ({ ...QUIET2, stdout });
+var fileHash = (path) => {
+  try {
+    return createHash2("sha256").update(readFileSync10(path)).digest("hex");
+  } catch {
+    return null;
+  }
+};
+function handleCodexHook(stdinText) {
+  try {
+    if (stdinText.length > 1024 * 1024) throw new Error("oversized hook input");
+    const p = JSON.parse(stdinText);
+    if (!object(p) || !str3(p.session_id) || !str3(p.cwd) || !str3(p.hook_event_name)) throw new Error("invalid hook input");
+    const cwd = resolve6(str3(p.cwd));
+    let root = cwd;
+    try {
+      root = execFileSync6("git", ["rev-parse", "--show-toplevel"], { cwd, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    } catch {
+    }
+    if (!existsSync9(resolve6(root, ".replume"))) return QUIET2;
+    const ledger = ledgerPath(root);
+    const base3 = (type) => ({
+      agent: "codex",
+      agentVersion: null,
+      sessionId: str3(p.session_id),
+      type,
+      tool: null,
+      paths: [],
+      command: null,
+      summary: str3(p.hook_event_name),
+      rule: null,
+      action: null,
+      message: null
+    });
+    const event = str3(p.hook_event_name);
+    if (event === "UserPromptSubmit") {
+      appendEvent(ledger, { ...base3("prompt"), summary: "Codex prompt received" });
+      return QUIET2;
+    }
+    if (event === "Stop" || event === "SessionEnd") {
+      appendEvent(ledger, { ...base3("stop"), summary: `Codex ${event}` });
+      return QUIET2;
+    }
+    if (event !== "PreToolUse" && event !== "PostToolUse") return QUIET2;
+    const a = codexAction(p, root);
+    const raw3 = {
+      tool_use_id: str3(p.tool_use_id),
+      fingerprint: a.fingerprint,
+      ...a.kind === "command" ? { writes: a.certainPaths ?? a.paths, ...a.writeTargetNotParsed ? { writeNote: "write target not parsed" } : {} } : {}
+    };
+    const loaded = loadContract(contractPath(root));
+    const contract = isDraft(loaded) ? null : loaded;
+    if (event === "PreToolUse") {
+      const history = readEvents(ledger).events.filter((e) => e.sessionId === str3(p.session_id));
+      const verdict = evaluate(a, { contract, history, repoRoot: root });
+      const first = verdict.hits[0];
+      appendEvent(ledger, {
+        ...base3("tool_pre"),
+        tool: a.tool,
+        paths: a.paths,
+        command: a.command,
+        summary: a.command ? `${a.tool}: ${a.command}` : `${a.tool} ${a.paths.join(", ")}`,
+        rule: first?.rule ?? null,
+        action: verdict.action,
+        message: verdict.message,
+        raw: { ...raw3, beforeHashes: a.kind === "edit" ? Object.fromEntries(a.paths.map((path) => [path, fileHash(resolve6(root, path))])) : void 0 }
+      });
+      for (const hit of verdict.hits) appendEvent(ledger, {
+        ...base3("rule_hit"),
+        tool: a.tool,
+        paths: a.paths,
+        command: a.command,
+        summary: `${hit.rule}: ${hit.action}`,
+        rule: hit.rule,
+        action: hit.action,
+        message: hit.message,
+        raw: { tool_use_id: str3(p.tool_use_id), layer: "layer1", sentToAgent: true }
+      });
+      if (verdict.action === "block") return result(JSON.stringify({ hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        permissionDecision: "deny",
+        permissionDecisionReason: verdict.message
+      } }));
+      if (verdict.action === "warn") return result(JSON.stringify({ hookSpecificOutput: {
+        hookEventName: "PreToolUse",
+        additionalContext: verdict.message
+      } }));
+      return QUIET2;
+    }
+    const response = object(p.tool_response) ? p.tool_response : {};
+    const responseText = str3(p.tool_response);
+    const exit = typeof response.exit_code === "number" ? response.exit_code : typeof response.exitCode === "number" ? response.exitCode : /^Exit code: (\d+)\b/m.exec(responseText)?.[1];
+    const success = exit === 0 || exit === "0";
+    const prior = readEvents(ledger).events.reverse().find((e) => e.type === "tool_pre" && e.raw?.tool_use_id === str3(p.tool_use_id));
+    const before = prior?.raw?.beforeHashes;
+    const changed = a.paths.filter((path) => before && path in before && fileHash(resolve6(root, path)) !== before[path]);
+    appendEvent(ledger, {
+      ...base3("tool_post"),
+      tool: a.tool,
+      paths: a.paths,
+      command: a.command,
+      summary: `${a.tool} completed`,
+      raw: { ...raw3, ok: success }
+    });
+    if (a.kind === "edit" && changed.length && (success || responseText.includes("Success."))) {
+      for (const path of changed)
+        appendEvent(ledger, {
+          ...base3("file_edit"),
+          tool: a.tool,
+          paths: [path],
+          summary: `${a.tool} changed ${path}`,
+          action: "ok",
+          raw: raw3
+        });
+    } else if (a.kind === "command") {
+      appendEvent(ledger, {
+        ...base3("command"),
+        tool: a.tool,
+        paths: a.paths,
+        command: a.command,
+        summary: `${a.tool}: ${a.command}`,
+        raw: { ...raw3, ok: success }
+      });
+    }
+    return QUIET2;
+  } catch {
+    return { stdout: "", stderr: "replume codex hook: failed to process payload\n", exitCode: 0 };
+  }
+}
+
+// src/agents/codex/install.ts
+import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync7, readFileSync as readFileSync11, writeFileSync as writeFileSync5 } from "fs";
+import { dirname as dirname5, join as join12 } from "path";
+var CODEX_HOOK_COMMAND = "replume hook codex";
+var CODEX_HOOK_EVENTS = ["PreToolUse", "PostToolUse", "UserPromptSubmit", "Stop", "SessionEnd"];
+var codexHooksPath = (root) => join12(root, ".codex", "hooks.json");
+var obj2 = (x) => !!x && typeof x === "object" && !Array.isArray(x);
+function mergeCodexHooks(config, command = CODEX_HOOK_COMMAND) {
+  if (config.hooks !== void 0 && !obj2(config.hooks)) throw new Error("hooks must be an object");
+  const hooks = { ...config.hooks ?? {} };
+  const added = [];
+  for (const event of CODEX_HOOK_EVENTS) {
+    const groups = hooks[event] ?? [];
+    if (!Array.isArray(groups)) throw new Error(`hooks.${event} must be an array`);
+    if (groups.some((g) => obj2(g) && Array.isArray(g.hooks) && g.hooks.some((h) => obj2(h) && h.command === command))) continue;
+    const entry = { hooks: [{ type: "command", command, timeout: event === "SessionEnd" ? 2 : 10 }] };
+    hooks[event] = [...groups, event === "PreToolUse" || event === "PostToolUse" ? { matcher: "^(Bash|apply_patch)$", ...entry } : entry];
+    added.push(event);
+  }
+  return { config: { ...config, hooks }, added };
+}
+function validateCodexHooks(root) {
+  const path = codexHooksPath(root);
+  if (!existsSync10(path)) return;
+  try {
+    const parsed = JSON.parse(readFileSync11(path, "utf8"));
+    if (!obj2(parsed)) throw new Error("expected an object");
+    mergeCodexHooks(parsed);
+  } catch (e) {
+    throw new Error(`${path} is invalid (${e.message}); nothing was changed. Fix it and run replume init again.`);
+  }
+}
+function installCodexHooks(root) {
+  validateCodexHooks(root);
+  const path = codexHooksPath(root);
+  const original = existsSync10(path) ? readFileSync11(path, "utf8") : null;
+  const parsed = original ? JSON.parse(original) : {};
+  const { config, added } = mergeCodexHooks(parsed);
+  if (added.length) {
+    mkdirSync7(dirname5(path), { recursive: true });
+    if (original !== null && !existsSync10(`${path}.replume-backup`)) copyFileSync2(path, `${path}.replume-backup`);
+    writeFileSync5(path, JSON.stringify(config, null, 2) + "\n");
+  }
+  return { path, added, backupPath: original === null ? null : `${path}.replume-backup` };
+}
+
+// src/agents/cursor/install.ts
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync11, mkdirSync as mkdirSync8, readFileSync as readFileSync12, renameSync, rmSync as rmSync2, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname6, join as join13 } from "path";
 var CURSOR_HOOK_COMMAND = "replume hook cursor";
 var CURSOR_HOOK_EVENTS = [
   "preToolUse",
@@ -3563,9 +4081,9 @@ var CURSOR_HOOK_EVENTS = [
   "stop",
   "sessionEnd"
 ];
-var hash = (text) => createHash2("sha256").update(text).digest("hex");
+var hash = (text) => createHash3("sha256").update(text).digest("hex");
 var isObject = (x) => !!x && typeof x === "object" && !Array.isArray(x);
-var cursorHooksPath = (root) => join11(root, ".cursor", "hooks.json");
+var cursorHooksPath = (root) => join13(root, ".cursor", "hooks.json");
 var backupPathFor = (path) => `${path}.replume-backup`;
 var statePathFor = (path) => `${path}.replume-state.json`;
 function parseConfig(text, path) {
@@ -3589,17 +4107,17 @@ function exactInstalledEntry(x, command) {
 function validateCursorHooksConfig(root, opts = {}) {
   const path = cursorHooksPath(root);
   const command = opts.command ?? CURSOR_HOOK_COMMAND;
-  const config = existsSync9(path) ? parseConfig(readFileSync10(path, "utf8"), path) : {};
+  const config = existsSync11(path) ? parseConfig(readFileSync12(path, "utf8"), path) : {};
   const hooks = config.hooks ?? {};
   for (const event of CURSOR_HOOK_EVENTS) {
     if (hooks[event] !== void 0 && !Array.isArray(hooks[event]))
       throw new Error(`${path}.hooks.${event} is not an array; nothing was changed. Fix it and run replume init again.`);
   }
   const statePath = statePathFor(path);
-  if (existsSync9(statePath)) {
+  if (existsSync11(statePath)) {
     let state;
     try {
-      state = JSON.parse(readFileSync10(statePath, "utf8"));
+      state = JSON.parse(readFileSync12(statePath, "utf8"));
     } catch {
       throw new Error(`${statePath} is not valid JSON; nothing was changed. Fix it and run replume init again.`);
     }
@@ -3611,9 +4129,9 @@ function installCursorHooks(root, opts = {}) {
   const path = cursorHooksPath(root);
   const backupPath = backupPathFor(path);
   const statePath = statePathFor(path);
-  const hadOriginal = existsSync9(path);
+  const hadOriginal = existsSync11(path);
   const command = opts.command ?? CURSOR_HOOK_COMMAND;
-  const original = hadOriginal ? readFileSync10(path, "utf8") : null;
+  const original = hadOriginal ? readFileSync12(path, "utf8") : null;
   const config = original === null ? {} : parseConfig(original, path);
   const hooks = { ...config.hooks ?? {} };
   const added = [];
@@ -3625,36 +4143,36 @@ function installCursorHooks(root, opts = {}) {
       added.push(event);
     }
   }
-  if (!added.length) return { path, backupPath: existsSync9(backupPath) ? backupPath : null, added };
+  if (!added.length) return { path, backupPath: existsSync11(backupPath) ? backupPath : null, added };
   const updated = JSON.stringify({ ...config, version: 1, hooks }, null, 2) + "\n";
-  mkdirSync7(dirname5(path), { recursive: true });
-  if (!existsSync9(statePath)) {
-    if (original !== null) writeFileSync5(backupPath, original, { flag: "wx" });
-    writeFileSync5(statePath, JSON.stringify({ hadOriginal, installedHash: hash(updated), added, command }) + "\n", { flag: "wx" });
+  mkdirSync8(dirname6(path), { recursive: true });
+  if (!existsSync11(statePath)) {
+    if (original !== null) writeFileSync6(backupPath, original, { flag: "wx" });
+    writeFileSync6(statePath, JSON.stringify({ hadOriginal, installedHash: hash(updated), added, command }) + "\n", { flag: "wx" });
   } else {
-    const state = JSON.parse(readFileSync10(statePath, "utf8"));
+    const state = JSON.parse(readFileSync12(statePath, "utf8"));
     if (state.command !== command) throw new Error(`Cursor hooks already installed with a different command; uninstall first`);
     state.added = [.../* @__PURE__ */ new Set([...state.added, ...added])];
     state.installedHash = hash(updated);
-    writeFileSync5(statePath, JSON.stringify(state) + "\n");
+    writeFileSync6(statePath, JSON.stringify(state) + "\n");
   }
   const temp = `${path}.replume-tmp`;
-  writeFileSync5(temp, updated);
+  writeFileSync6(temp, updated);
   renameSync(temp, path);
-  return { path, backupPath: existsSync9(backupPath) ? backupPath : null, added };
+  return { path, backupPath: existsSync11(backupPath) ? backupPath : null, added };
 }
 function uninstallCursorHooks(root) {
   const path = cursorHooksPath(root);
   const backupPath = backupPathFor(path);
   const statePath = statePathFor(path);
-  if (!existsSync9(statePath)) return { restored: false, path };
-  const state = JSON.parse(readFileSync10(statePath, "utf8"));
-  const current = existsSync9(path) ? readFileSync10(path, "utf8") : null;
+  if (!existsSync11(statePath)) return { restored: false, path };
+  const state = JSON.parse(readFileSync12(statePath, "utf8"));
+  const current = existsSync11(path) ? readFileSync12(path, "utf8") : null;
   const unchanged = current !== null && hash(current) === state.installedHash;
   if (unchanged) {
     if (state.hadOriginal) {
-      if (!existsSync9(backupPath)) throw new Error(`Cursor hook backup missing: ${backupPath}`);
-      writeFileSync5(path, readFileSync10(backupPath));
+      if (!existsSync11(backupPath)) throw new Error(`Cursor hook backup missing: ${backupPath}`);
+      writeFileSync6(path, readFileSync12(backupPath));
     } else rmSync2(path);
   } else if (current !== null) {
     const config = parseConfig(current, path);
@@ -3670,20 +4188,20 @@ function uninstallCursorHooks(root) {
       if (kept.length) hooks[event] = kept;
       else delete hooks[event];
     }
-    writeFileSync5(path, JSON.stringify({ ...config, hooks }, null, 2) + "\n");
+    writeFileSync6(path, JSON.stringify({ ...config, hooks }, null, 2) + "\n");
   }
   rmSync2(statePath);
   if (unchanged) rmSync2(backupPath, { force: true });
-  return { restored: true, path, backupRetained: !unchanged && existsSync9(backupPath) };
+  return { restored: true, path, backupRetained: !unchanged && existsSync11(backupPath) };
 }
 
 // src/agents/claude/install.ts
-import { copyFileSync as copyFileSync2, existsSync as existsSync10, mkdirSync as mkdirSync8, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname6, join as join12 } from "path";
+import { copyFileSync as copyFileSync3, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync13, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname7, join as join14 } from "path";
 var DEFAULT_HOOK_COMMAND = "replume hook claude";
 var HOOK_EVENTS = ["PreToolUse", "PostToolUse", "PostToolUseFailure", "UserPromptSubmit", "Stop", "SessionEnd"];
 function claudeSettingsPath(repoRoot2) {
-  return join12(repoRoot2, ".claude", "settings.json");
+  return join14(repoRoot2, ".claude", "settings.json");
 }
 var isReplume = (h, command) => typeof h.command === "string" && (h.command === command || /(^|\s)hook claude\s*$/.test(h.command));
 function mergeHooks(settings, command = DEFAULT_HOOK_COMMAND) {
@@ -3712,8 +4230,8 @@ function installClaudeHooks(repoRoot2, opts = {}) {
   const settingsPath = claudeSettingsPath(repoRoot2);
   let current = {};
   let original = null;
-  if (existsSync10(settingsPath)) {
-    original = readFileSync11(settingsPath, "utf-8");
+  if (existsSync12(settingsPath)) {
+    original = readFileSync13(settingsPath, "utf-8");
     try {
       const parsed = original.trim() ? JSON.parse(original) : {};
       if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error("not a JSON object");
@@ -3728,24 +4246,24 @@ function installClaudeHooks(repoRoot2, opts = {}) {
     if (original !== null) {
       const stamp = (opts.now ?? /* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
       backupPath = `${settingsPath}.replume-backup-${stamp}`;
-      copyFileSync2(settingsPath, backupPath);
+      copyFileSync3(settingsPath, backupPath);
     }
-    mkdirSync8(dirname6(settingsPath), { recursive: true });
-    writeFileSync6(settingsPath, JSON.stringify(settings, null, 2) + "\n");
+    mkdirSync9(dirname7(settingsPath), { recursive: true });
+    writeFileSync7(settingsPath, JSON.stringify(settings, null, 2) + "\n");
   }
   return { settingsPath, backupPath, added, alreadyPresent };
 }
 
 // src/agents/claude/replay-hooks.ts
-import { mkdtempSync, mkdirSync as mkdirSync9, rmSync as rmSync3, writeFileSync as writeFileSync7 } from "fs";
+import { mkdtempSync, mkdirSync as mkdirSync10, rmSync as rmSync3, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir2 } from "os";
-import { join as join13 } from "path";
+import { join as join15 } from "path";
 var REPLAY_HOOKS_BANNER = "HOOK PAYLOAD REPLAY. Each line is a Claude Code hook payload run through Replume's live hook handler in a temporary project.\nThis shows Replume's answers to these payloads; it does not show a live agent receiving or following them.";
 async function replayHooks(content, opts = {}) {
-  const repo = mkdtempSync(join13(tmpdir2(), "replume-replay-hooks-"));
+  const repo = mkdtempSync(join15(tmpdir2(), "replume-replay-hooks-"));
   try {
-    mkdirSync9(join13(repo, ".replume"), { recursive: true });
-    if (opts.contractYaml) writeFileSync7(contractPath(repo), opts.contractYaml);
+    mkdirSync10(join15(repo, ".replume"), { recursive: true });
+    if (opts.contractYaml) writeFileSync8(contractPath(repo), opts.contractYaml);
     const env = { REPLUME_JUDGE: "off", ...opts.env, CLAUDE_PROJECT_DIR: repo };
     const steps = [];
     const lines = content.split("\n").filter((l) => l.trim());
@@ -3775,10 +4293,10 @@ async function replayHooks(content, opts = {}) {
 }
 
 // src/core/init.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { existsSync as existsSync12, mkdirSync as mkdirSync10, writeFileSync as writeFileSync9 } from "fs";
+import { execFileSync as execFileSync8 } from "child_process";
+import { existsSync as existsSync14, mkdirSync as mkdirSync11, writeFileSync as writeFileSync10 } from "fs";
 import { homedir as homedir3 } from "os";
-import { delimiter, join as join15 } from "path";
+import { delimiter, join as join17 } from "path";
 
 // src/core/capabilities.ts
 var CAPABILITIES = [
@@ -3800,11 +4318,11 @@ var CAPABILITIES = [
   },
   {
     agent: "Codex",
-    observe: "unverified",
-    block: "unverified",
-    steer: "unverified",
+    observe: "verified live (CLI)",
+    block: "verified live (CLI)",
+    steer: "documented",
     installedByInit: false,
-    notes: "partial at best; live hook delivery has not been verified"
+    notes: "Codex CLI 0.144.4: project hooks delivered PreToolUse and PostToolUse with trust enabled; Replume blocked one protected apply_patch and observed one allowed edit leading to a no-scenario PASS on 20.10.2026. Warning delivery and Stop continuation not tested; hook trust and disabled hooks limit capture; cloud project hooks unsupported."
   }
 ];
 function renderCapabilities(caps = CAPABILITIES, detected = {}) {
@@ -3833,10 +4351,10 @@ function renderCapabilities(caps = CAPABILITIES, detected = {}) {
 }
 
 // src/core/baseline.ts
-import { createHash as createHash3 } from "crypto";
-import { execFileSync as execFileSync6 } from "child_process";
-import { appendFileSync as appendFileSync4, existsSync as existsSync11, lstatSync, readFileSync as readFileSync12, readdirSync, readlinkSync, writeFileSync as writeFileSync8 } from "fs";
-import { dirname as dirname7, join as join14 } from "path";
+import { createHash as createHash4 } from "crypto";
+import { execFileSync as execFileSync7 } from "child_process";
+import { appendFileSync as appendFileSync4, existsSync as existsSync13, lstatSync, readFileSync as readFileSync14, readdirSync, readlinkSync, writeFileSync as writeFileSync9 } from "fs";
+import { dirname as dirname8, join as join16 } from "path";
 var BASELINE_FILE = "baseline.json";
 var DEFAULT_REPLUME_GITIGNORE = `events.jsonl
 reports/
@@ -3848,22 +4366,22 @@ acceptance.jsonl
 `;
 var SCENARIOS_SUBDIR = "scenarios";
 var PREFLIGHT_STATUS = ["works", "fails_before", "not_runnable", "skipped"];
-var sha256 = (data) => createHash3("sha256").update(data).digest("hex");
+var sha256 = (data) => createHash4("sha256").update(data).digest("hex");
 var IGNORED_NAMES = /* @__PURE__ */ new Set([".DS_Store"]);
 function hashTree(dir) {
   const out = {};
   const walk = (abs, rel) => {
     for (const name of readdirSync(abs).sort()) {
       if (IGNORED_NAMES.has(name)) continue;
-      const p = join14(abs, name);
+      const p = join16(abs, name);
       const r = rel ? `${rel}/${name}` : name;
       const st = lstatSync(p);
       if (st.isSymbolicLink()) out[r] = sha256(`symlink:${readlinkSync(p)}`);
       else if (st.isDirectory()) walk(p, r);
-      else if (st.isFile()) out[r] = sha256(readFileSync12(p));
+      else if (st.isFile()) out[r] = sha256(readFileSync14(p));
     }
   };
-  if (existsSync11(dir)) {
+  if (existsSync13(dir)) {
     try {
       if (lstatSync(dir).isDirectory()) walk(dir, "");
     } catch {
@@ -3873,19 +4391,19 @@ function hashTree(dir) {
 }
 function headCommit(repoRoot2) {
   try {
-    return execFileSync6("git", ["rev-parse", "--verify", "-q", "HEAD^{commit}"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    return execFileSync7("git", ["rev-parse", "--verify", "-q", "HEAD^{commit}"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
   } catch {
     return null;
   }
 }
-var baselinePath = (contractPath2) => join14(dirname7(contractPath2), BASELINE_FILE);
+var baselinePath = (contractPath2) => join16(dirname8(contractPath2), BASELINE_FILE);
 function ensureBaselineIgnored(replumeDir) {
-  const gi = join14(replumeDir, ".gitignore");
-  if (!existsSync11(gi)) {
-    writeFileSync8(gi, DEFAULT_REPLUME_GITIGNORE);
+  const gi = join16(replumeDir, ".gitignore");
+  if (!existsSync13(gi)) {
+    writeFileSync9(gi, DEFAULT_REPLUME_GITIGNORE);
     return;
   }
-  const text = readFileSync12(gi, "utf-8");
+  const text = readFileSync14(gi, "utf-8");
   if (text.split(/\r?\n/).some((l) => l.trim() === BASELINE_FILE)) return;
   appendFileSync4(gi, `${text === "" || text.endsWith("\n") ? "" : "\n"}${BASELINE_FILE}
 `);
@@ -3897,12 +4415,12 @@ function recordBaseline(opts) {
     contract_id: opts.contractId,
     recorded_at: (opts.now ?? /* @__PURE__ */ new Date()).toISOString(),
     base_commit: headCommit(opts.repoRoot),
-    policy_hash: sha256(readFileSync12(opts.contractPath)),
-    scenario_hashes: hashTree(opts.scenariosDir ?? join14(dirname7(opts.contractPath), SCENARIOS_SUBDIR)),
+    policy_hash: sha256(readFileSync14(opts.contractPath)),
+    scenario_hashes: hashTree(opts.scenariosDir ?? join16(dirname8(opts.contractPath), SCENARIOS_SUBDIR)),
     ...opts.preflight ? { preflight: opts.preflight } : {}
   };
-  writeFileSync8(path, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
-  ensureBaselineIgnored(dirname7(opts.contractPath));
+  writeFileSync9(path, JSON.stringify(baseline, null, 2) + "\n", "utf-8");
+  ensureBaselineIgnored(dirname8(opts.contractPath));
   return { path, baseline };
 }
 var isHash = (x) => typeof x === "string" && /^[0-9a-f]{64}$/.test(x);
@@ -3923,10 +4441,10 @@ function validateBaseline(x) {
   return p;
 }
 function readBaseline(path) {
-  if (!existsSync11(path)) return { status: "absent" };
+  if (!existsSync13(path)) return { status: "absent" };
   let raw3;
   try {
-    raw3 = JSON.parse(readFileSync12(path, "utf-8"));
+    raw3 = JSON.parse(readFileSync14(path, "utf-8"));
   } catch (e) {
     return { status: "unreadable", detail: e.message };
   }
@@ -3960,7 +4478,7 @@ function compareToBaseline(baseline, current, displayPaths) {
 // src/core/init.ts
 function onPath(bin) {
   try {
-    execFileSync7(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" });
+    execFileSync8(process.platform === "win32" ? "where" : "which", [bin], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -3971,7 +4489,7 @@ function launchedThroughNpx() {
 }
 function gitIdentity(repoRoot2, key) {
   try {
-    return execFileSync7("git", ["-C", repoRoot2, "config", "--get", key], {
+    return execFileSync8("git", ["-C", repoRoot2, "config", "--get", key], {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "ignore"]
     }).trim().length > 0;
@@ -3981,18 +4499,18 @@ function gitIdentity(repoRoot2, key) {
 }
 function detectAgents(repoRoot2, home = homedir3()) {
   return {
-    "Claude Code": onPath("claude") || existsSync12(join15(repoRoot2, ".claude")) || existsSync12(join15(home, ".claude")),
-    Cursor: onPath("cursor") || existsSync12(join15(repoRoot2, ".cursor")) || existsSync12(join15(home, ".cursor")),
-    Codex: onPath("codex") || existsSync12(join15(home, ".codex"))
+    "Claude Code": onPath("claude") || existsSync14(join17(repoRoot2, ".claude")) || existsSync14(join17(home, ".claude")),
+    Cursor: onPath("cursor") || existsSync14(join17(repoRoot2, ".cursor")) || existsSync14(join17(home, ".cursor")),
+    Codex: onPath("codex") || existsSync14(join17(home, ".codex"))
   };
 }
 function runInit(repoRoot2, opts = {}) {
   const lines = [];
-  const dir = join15(repoRoot2, REPLUME_DIR);
-  mkdirSync10(join15(dir, "scenarios"), { recursive: true });
-  const gi = join15(dir, ".gitignore");
-  if (!existsSync12(gi)) {
-    writeFileSync9(gi, DEFAULT_REPLUME_GITIGNORE);
+  const dir = join17(repoRoot2, REPLUME_DIR);
+  mkdirSync11(join17(dir, "scenarios"), { recursive: true });
+  const gi = join17(dir, ".gitignore");
+  if (!existsSync14(gi)) {
+    writeFileSync10(gi, DEFAULT_REPLUME_GITIGNORE);
   }
   lines.push(`\u2713 ${REPLUME_DIR}/ ready (scenarios/ for team scenarios; ledger and reports are git-ignored)`);
   const detected = opts.detected ?? detectAgents(repoRoot2);
@@ -4007,7 +4525,7 @@ function runInit(repoRoot2, opts = {}) {
   } else lines.push("- Claude Code not found: no hooks written");
   const npx = launchedThroughNpx();
   const persistentCommand = !npx && onPath("replume");
-  const defaultHooks = detected["Claude Code"] && !opts.hookCommand || opts.cursorHooks && !opts.cursorHookCommand;
+  const defaultHooks = detected["Claude Code"] && !opts.hookCommand || opts.cursorHooks && !opts.cursorHookCommand || opts.codexHooks;
   if (defaultHooks && !persistentCommand) {
     lines.push(npx ? "! `replume` is not guaranteed on PATH for later agent hooks: npx's temporary PATH entry does not persist, so those hooks may fail." : "! `replume` is not on PATH, so the hooks will fail (the agent then continues without them).");
     lines.push("  Install the persistent command with `npm install -g replume-cli`, then re-run `replume init`.");
@@ -4028,9 +4546,9 @@ function runInit(repoRoot2, opts = {}) {
 }
 
 // src/core/draft.ts
-import { execFileSync as execFileSync8 } from "child_process";
-import { existsSync as existsSync13, lstatSync as lstatSync2, readFileSync as readFileSync13 } from "fs";
-import { join as join16, posix } from "path";
+import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync15, lstatSync as lstatSync2, readFileSync as readFileSync15 } from "fs";
+import { join as join18, posix } from "path";
 var LOCKFILES = ["package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "bun.lockb", "poetry.lock", "Pipfile.lock", "uv.lock", "Cargo.lock", "go.sum", "Gemfile.lock", "composer.lock"];
 var CI_CONFIG = [
   [".github/workflows/**", /^\.github\/workflows\//],
@@ -4048,20 +4566,20 @@ var STOPWORDS = new Set(
 var NPM_PLACEHOLDER = /no test specified/;
 function trackedFiles(repoRoot2) {
   try {
-    return execFileSync8("git", ["ls-files", "-z"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 }).toString().split("\0").filter(Boolean);
+    return execFileSync9("git", ["ls-files", "-z"], { cwd: repoRoot2, stdio: ["ignore", "pipe", "ignore"], maxBuffer: 64 * 1024 * 1024 }).toString().split("\0").filter(Boolean);
   } catch {
     return [];
   }
 }
 var read = (repoRoot2, rel) => {
   try {
-    return readFileSync13(join16(repoRoot2, rel), "utf-8");
+    return readFileSync15(join18(repoRoot2, rel), "utf-8");
   } catch {
     return "";
   }
 };
 function detectTestCommand(repoRoot2, files) {
-  const has = (f) => files.includes(f) || existsSync13(join16(repoRoot2, f));
+  const has = (f) => files.includes(f) || existsSync15(join18(repoRoot2, f));
   if (has("package.json")) {
     let script;
     try {
@@ -4091,10 +4609,10 @@ function draftContract(input) {
   const t = detectTestCommand(input.repoRoot, files);
   notes.push(t.command ? `test_command "${t.command}": ${t.reason}` : `test_command: none (${t.reason})`);
   const scenarios = files.filter((f) => /^\.replume\/scenarios\/[^/]+\.ya?ml$/.test(f)).flatMap((f) => {
-    const path = join16(input.repoRoot, f);
+    const path = join18(input.repoRoot, f);
     try {
       if (!lstatSync2(path).isFile() || lstatSync2(path).isSymbolicLink()) return [];
-      const s = parseScenario(readFileSync13(path, "utf8"), f);
+      const s = parseScenario(readFileSync15(path, "utf8"), f);
       return [s.id === posix.basename(f).replace(/\.ya?ml$/, "") ? s : null].filter((x) => x !== null);
     } catch {
       notes.push(`must_check: skipped invalid scenario ${f}; fix it before verification`);
@@ -4161,7 +4679,7 @@ function draftContract(input) {
     for (const p of namedCandidates) notes.push(`candidate: ${p} (named in the task; review before allowing)`);
     let recent = [];
     try {
-      recent = execFileSync8("git", ["log", "-5", "--name-only", "--pretty=format:"], { cwd: input.repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\n").filter(Boolean);
+      recent = execFileSync9("git", ["log", "-5", "--name-only", "--pretty=format:"], { cwd: input.repoRoot, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).split("\n").filter(Boolean);
     } catch {
     }
     const recentCandidates = [...new Set(recent.filter((f) => source.includes(f) && !namedCandidates.includes(f) && !["README.md", "package.json"].includes(f)))].slice(0, Math.max(0, 5 - namedCandidates.length));
@@ -4176,10 +4694,14 @@ function draftContract(input) {
   };
   return { contract, notes, broad: broad.filter((g) => allow.includes(g)) };
 }
+function allowHasNoSource(allow) {
+  return allow.every((g) => isTestFile(g.replace(/\*+/g, "x")));
+}
+var ALLOW_NO_SOURCE_WARNING = "allow contains no source files; the agent may have no allowed way to finish this task. Name the files in --task or edit allow.";
 
 // src/sandbox/preflight.ts
-import { existsSync as existsSync16 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync18 } from "fs";
+import { join as join23 } from "path";
 
 // src/sandbox/docker.ts
 import { spawn as spawn2, spawnSync } from "child_process";
@@ -4187,12 +4709,17 @@ import { randomUUID } from "crypto";
 import { rmSync as rmSync4 } from "fs";
 import { chmod, cp, lstat as lstat2, mkdtemp, readdir as readdir2, rm, writeFile } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { basename as basename2, join as join17 } from "path";
+import { basename as basename2, join as join19 } from "path";
 import { performance } from "perf_hooks";
 var DEFAULT_DOCKER_IMAGE = "node:20-bookworm-slim";
-var DOCKER_PROBE_TIMEOUT_MS = 2e4;
-async function probeDaemon(binary = "docker", timeoutMs = DOCKER_PROBE_TIMEOUT_MS) {
-  const context = await dockerCli(binary, ["context", "inspect"], timeoutMs);
+var DOCKER_PROBE_TIMEOUT_MS = 15e3;
+var remaining = (deadline) => Math.max(0, Math.ceil(deadline - performance.now()));
+var probeCli = (binary, args, deadline) => {
+  const left = remaining(deadline);
+  return left > 0 ? dockerCli(binary, args, left) : Promise.resolve({ code: null, stdout: "", stderr: "", timedOut: true, notFound: false });
+};
+async function probeDaemonUntil(binary, deadline) {
+  const context = await probeCli(binary, ["context", "inspect"], deadline);
   if (context.timedOut) return { status: "timeout", step: "docker context inspect" };
   if (context.notFound) return { status: "unavailable", detail: "docker CLI not found" };
   if (context.code !== 0) return { status: "unavailable" };
@@ -4202,12 +4729,12 @@ async function probeDaemon(binary = "docker", timeoutMs = DOCKER_PROBE_TIMEOUT_M
   } catch {
     return { status: "unavailable" };
   }
-  const info = await dockerCli(binary, ["info", "--format", "{{.ServerVersion}}"], timeoutMs);
+  const info = await probeCli(binary, ["info", "--format", "{{.ServerVersion}}"], deadline);
   if (info.timedOut) return { status: "timeout", step: "docker info" };
   return info.code === 0 ? { status: "ok" } : { status: "unavailable" };
 }
-async function probeImage(image, binary = "docker", timeoutMs = DOCKER_PROBE_TIMEOUT_MS) {
-  const r = await dockerCli(binary, ["image", "inspect", image], timeoutMs);
+async function probeImageUntil(image, binary, deadline) {
+  const r = await probeCli(binary, ["image", "inspect", image], deadline);
   return r.timedOut ? "timeout" : r.code === 0 ? "present" : "missing";
 }
 var seconds = (ms) => `${ms / 1e3} s`;
@@ -4215,19 +4742,20 @@ async function resolveIsolation(choice, image, probe = {}) {
   if (choice === "worktree") return { mode: "worktree", reason: "requested: worktree" };
   const legacy = "daemon" in probe;
   const timeoutMs = legacy ? DOCKER_PROBE_TIMEOUT_MS : probe.timeoutMs ?? DOCKER_PROBE_TIMEOUT_MS;
-  const daemon = legacy ? await probe.daemon() ? { status: "ok" } : { status: "unavailable" } : await probeDaemon(probe.binary, timeoutMs);
+  const deadline = performance.now() + timeoutMs;
+  const daemon = legacy ? await probe.daemon() ? { status: "ok" } : { status: "unavailable" } : await probeDaemonUntil(probe.binary ?? "docker", deadline);
   if (daemon.status === "timeout") {
     if (choice === "docker") throw new Error(`Docker was requested but did not answer within ${seconds(timeoutMs)} (${daemon.step})`);
-    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (${daemon.step}); used the worktree` };
+    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (${daemon.step}); using the isolated working copy instead (not a security sandbox)` };
   }
   if (daemon.status === "unavailable") {
     if (choice === "docker") throw new Error(`Docker was requested but the Docker CLI or a local daemon is unavailable${daemon.detail ? ` (${daemon.detail})` : ""}`);
     return { mode: "worktree", reason: `auto: no local Docker daemon${daemon.detail ? ` (${daemon.detail})` : ""}` };
   }
-  const img = legacy ? await probe.image(image) ? "present" : "missing" : await probeImage(image, probe.binary, timeoutMs);
+  const img = legacy ? await probe.image(image) ? "present" : "missing" : await probeImageUntil(image, probe.binary ?? "docker", deadline);
   if (img === "timeout") {
     if (choice === "docker") throw new Error(`Docker was requested but did not answer within ${seconds(timeoutMs)} (docker image inspect)`);
-    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (docker image inspect); used the worktree` };
+    return { mode: "worktree", reason: `auto: Docker did not answer within ${seconds(timeoutMs)} (docker image inspect); using the isolated working copy instead (not a security sandbox)` };
   }
   if (img === "missing") {
     if (choice === "docker") throw new Error(`Docker was requested but image ${image} is not present locally; run: docker pull ${image}`);
@@ -4239,14 +4767,14 @@ function cliEnv() {
   return { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: process.env.HOME, DOCKER_CONFIG: process.env.DOCKER_CONFIG };
 }
 function dockerCli(binary, args, timeoutMs) {
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     const child = spawn2(binary, args, { env: cliEnv(), stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "", stderr = "", settled = false, timedOut = false, notFound = false;
     const done = (code) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve7({ code, stdout, stderr, timedOut, notFound });
+      resolve9({ code, stdout, stderr, timedOut, notFound });
     };
     child.stdout.on("data", (chunk) => {
       stdout += chunk.toString();
@@ -4328,11 +4856,11 @@ async function sweepStaleStaging(tmpRoot = tmpdir3(), now = Date.now()) {
   }
   for (const n of names) {
     if (!n.startsWith(STAGING_PREFIX)) continue;
-    const dir = join17(tmpRoot, n);
+    const dir = join19(tmpRoot, n);
     try {
       const st = await lstat2(dir);
       if (st.isSymbolicLink() || !st.isDirectory()) continue;
-      const marker = await lstat2(join17(dir, STAGING_MARKER));
+      const marker = await lstat2(join19(dir, STAGING_MARKER));
       if (!marker.isFile() || now - marker.mtimeMs < STALE_AFTER_MS) continue;
       await rm(dir, { recursive: true, force: true });
       removed.push(dir);
@@ -4369,17 +4897,17 @@ async function runDockerScenario(input) {
   const binary = input.dockerBinary ?? "docker";
   const tmpRoot = input.tmpRoot ?? tmpdir3();
   await sweepStaleStaging(tmpRoot);
-  const temp = await mkdtemp(join17(tmpRoot, STAGING_PREFIX));
-  const staged = join17(temp, "repo");
+  const temp = await mkdtemp(join19(tmpRoot, STAGING_PREFIX));
+  const staged = join19(temp, "repo");
   const name = `replume-${randomUUID()}`;
   active.set(temp, { binary, name });
   attachSignals();
   try {
-    await writeFile(join17(temp, STAGING_MARKER), JSON.stringify({ by: "replume", pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n");
+    await writeFile(join19(temp, STAGING_MARKER), JSON.stringify({ by: "replume", pid: process.pid, createdAt: (/* @__PURE__ */ new Date()).toISOString() }) + "\n");
     await cp(input.root, staged, { recursive: true, filter: (path) => basename2(path) !== ".git" });
     if (process.getuid?.() === 0) await chmod(temp, 493);
     const args = buildDockerRunArgs({ name, image: input.image ?? DEFAULT_DOCKER_IMAGE, source: staged, command: input.command, labels: input.labels });
-    return await new Promise((resolve7) => {
+    return await new Promise((resolve9) => {
       const child = spawn2(binary, args, { env: cliEnv(), stdio: ["ignore", "pipe", "pipe"] });
       const marker = `${commandStartMarker(name)}
 `;
@@ -4389,7 +4917,7 @@ async function runDockerScenario(input) {
         if (settled) return;
         settled = true;
         clearTimeout(timer);
-        resolve7({ stdout, stderr, exitCode, timedOut, durationMs: Math.round(performance.now() - started) });
+        resolve9({ stdout, stderr, exitCode, timedOut, durationMs: Math.round(performance.now() - started) });
       };
       const expire = (note) => async () => {
         timedOut = true;
@@ -4435,20 +4963,20 @@ Docker container did not start the scenario command within ${startup}s (start-up
 }
 
 // src/sandbox/index.ts
-import { existsSync as existsSync15, readFileSync as readFileSync15 } from "fs";
-import { execFileSync as execFileSync9 } from "child_process";
+import { existsSync as existsSync17, readFileSync as readFileSync17 } from "fs";
+import { execFileSync as execFileSync10 } from "child_process";
 import { lstat as lstat3, mkdir, writeFile as writeFile2 } from "fs/promises";
-import { isAbsolute as isAbsolute7, join as join20, relative as relative6, resolve as resolve5, sep as sep3 } from "path";
+import { isAbsolute as isAbsolute7, join as join22, relative as relative6, resolve as resolve7, sep as sep3 } from "path";
 import { performance as performance3 } from "perf_hooks";
 
 // src/sandbox/working-copy.ts
 import { spawn as spawn3 } from "child_process";
 import { mkdtemp as mkdtemp2, rm as rm2 } from "fs/promises";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join18 } from "path";
+import { join as join20 } from "path";
 import { performance as performance2 } from "perf_hooks";
 async function git(cwd, args) {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     const child = spawn3("git", args, { cwd, env: { PATH: process.env.PATH ?? "/usr/bin:/bin" }, stdio: ["ignore", "pipe", "pipe"] });
     let out = "", err = "";
     child.stdout.on("data", (v) => {
@@ -4458,13 +4986,13 @@ async function git(cwd, args) {
       err += v.toString();
     });
     child.on("error", reject);
-    child.on("close", (code) => code === 0 ? resolve7(out.trim()) : reject(new Error(`git ${args.join(" ")}: ${err.trim() || `exit ${code}`}`)));
+    child.on("close", (code) => code === 0 ? resolve9(out.trim()) : reject(new Error(`git ${args.join(" ")}: ${err.trim() || `exit ${code}`}`)));
   });
 }
 async function withWorkingCopy(repo, commit, keep, fn) {
-  const temp = await mkdtemp2(join18(tmpdir4(), "replume-copy-"));
-  const root = join18(temp, "repo");
-  const home = join18(temp, "home");
+  const temp = await mkdtemp2(join20(tmpdir4(), "replume-copy-"));
+  const root = join20(temp, "repo");
+  const home = join20(temp, "home");
   let added = false;
   try {
     await git(repo, ["worktree", "add", "--detach", root, commit]);
@@ -4484,14 +5012,14 @@ async function withWorkingCopy(repo, commit, keep, fn) {
 }
 async function runCommand(command, cwd, home, timeoutSec) {
   const started = performance2.now();
-  return new Promise((resolve7) => {
+  return new Promise((resolve9) => {
     const child = spawn3(command, { cwd, shell: true, detached: process.platform !== "win32", env: { PATH: process.env.PATH ?? "/usr/bin:/bin", HOME: home }, stdio: ["ignore", "pipe", "pipe"] });
     let stdout = "", stderr = "", timedOut = false, settled = false;
     const finish = (exitCode) => {
       if (settled) return;
       settled = true;
       clearTimeout(timer);
-      resolve7({ stdout, stderr, exitCode, durationMs: Math.round(performance2.now() - started), timedOut });
+      resolve9({ stdout, stderr, exitCode, durationMs: Math.round(performance2.now() - started), timedOut });
     };
     child.stdout.on("data", (v) => {
       stdout += v.toString();
@@ -4708,15 +5236,15 @@ function parsePackageJson(text) {
     return { error: "not valid JSON" };
   }
   if (!j || typeof j !== "object" || Array.isArray(j)) return { error: "not a package manifest" };
-  const obj2 = j;
+  const obj3 = j;
   for (const s of NPM_SECTIONS) {
-    if (!(s in obj2) || obj2[s] == null) continue;
-    const sec = obj2[s];
+    if (!(s in obj3) || obj3[s] == null) continue;
+    const sec = obj3[s];
     if (typeof sec !== "object" || Array.isArray(sec)) return { error: `${s} is not an object` };
   }
   const entries = [];
   for (const s of NPM_SECTIONS) {
-    const sec = obj2[s];
+    const sec = obj3[s];
     if (sec && typeof sec === "object" && !Array.isArray(sec)) {
       for (const name of Object.keys(sec)) entries.push({ name, section: s });
     }
@@ -4929,29 +5457,29 @@ function failingTestNames(output) {
 }
 
 // src/core/acceptance.ts
-import { appendFileSync as appendFileSync5, existsSync as existsSync14, mkdirSync as mkdirSync11, readFileSync as readFileSync14, writeFileSync as writeFileSync10 } from "fs";
-import { join as join19 } from "path";
-var file = (root) => join19(root, ".replume", "acceptance.jsonl");
+import { appendFileSync as appendFileSync5, existsSync as existsSync16, mkdirSync as mkdirSync12, readFileSync as readFileSync16, writeFileSync as writeFileSync11 } from "fs";
+import { join as join21 } from "path";
+var file = (root) => join21(root, ".replume", "acceptance.jsonl");
 function recordAcceptance(repoRoot2, opts) {
   if (opts.verdict !== "pass") throw new Error("accept requires a fresh verify PASS");
   if (!/^[a-zA-Z0-9_-]{1,128}$/.test(opts.taskId) || !/^[0-9a-f]{40}$/.test(opts.commit)) throw new Error("invalid task ID or commit");
   const existing = readAcceptance(repoRoot2, opts.taskId, opts.commit);
   if (existing) return { ...existing, alreadyAccepted: true };
-  const dir = join19(repoRoot2, ".replume");
-  mkdirSync11(dir, { recursive: true });
-  const ignore = join19(dir, ".gitignore");
-  const prior = existsSync14(ignore) ? readFileSync14(ignore, "utf8") : "";
-  if (!prior.split(/\r?\n/).includes("acceptance.jsonl")) writeFileSync10(ignore, `${prior}${prior && !prior.endsWith("\n") ? "\n" : ""}acceptance.jsonl
+  const dir = join21(repoRoot2, ".replume");
+  mkdirSync12(dir, { recursive: true });
+  const ignore = join21(dir, ".gitignore");
+  const prior = existsSync16(ignore) ? readFileSync16(ignore, "utf8") : "";
+  if (!prior.split(/\r?\n/).includes("acceptance.jsonl")) writeFileSync11(ignore, `${prior}${prior && !prior.endsWith("\n") ? "\n" : ""}acceptance.jsonl
 `);
   const entry = { taskId: opts.taskId, commit: opts.commit, acceptedAt: (opts.now ?? /* @__PURE__ */ new Date()).toISOString() };
   appendFileSync5(file(repoRoot2), JSON.stringify(entry) + "\n");
   return { ...entry, alreadyAccepted: false };
 }
 function readAcceptance(repoRoot2, taskId, commit) {
-  if (!existsSync14(file(repoRoot2))) return null;
+  if (!existsSync16(file(repoRoot2))) return null;
   let content;
   try {
-    content = readFileSync14(file(repoRoot2), "utf8");
+    content = readFileSync16(file(repoRoot2), "utf8");
   } catch {
     return null;
   }
@@ -5080,15 +5608,15 @@ async function isLink(p) {
   }
 }
 function safeRelative(root, path) {
-  const full = resolve5(root, path);
+  const full = resolve7(root, path);
   if (full !== root && !full.startsWith(root + "/")) throw new Error(`path outside repository: ${path}`);
   return full;
 }
 function projectHooksConfigured(root) {
-  for (const rel of [".claude/settings.json", ".cursor/hooks.json"]) {
+  for (const rel of [".claude/settings.json", ".cursor/hooks.json", ".codex/hooks.json"]) {
     try {
-      const settings = JSON.parse(readFileSync15(join20(root, rel), "utf8"));
-      if (JSON.stringify(settings.hooks ?? {}).includes("replume hook claude") || JSON.stringify(settings.hooks ?? {}).includes("replume hook cursor")) return true;
+      const settings = JSON.parse(readFileSync17(join22(root, rel), "utf8"));
+      if (["claude", "cursor", "codex"].some((agent) => JSON.stringify(settings.hooks ?? {}).includes(`replume hook ${agent}`))) return true;
     } catch {
     }
   }
@@ -5177,7 +5705,7 @@ var showRef = (t) => `${/^[0-9a-f]{40}$/.test(t.ref) ? t.ref.slice(0, 7) : t.ref
 async function compareToTrustedBase(repo, t, commit, contractRel, scenariosRel, contractFile) {
   const where = `the trusted base ${showRef(t)}`;
   const out = [];
-  const local = existsSync15(contractFile) ? readFileSync15(contractFile, "utf-8").trim() : null;
+  const local = existsSync17(contractFile) ? readFileSync17(contractFile, "utf-8").trim() : null;
   if (local !== t.contractText.trim())
     out.push({ rule: "policy_differs_from_trusted_base", path: contractRel, detail: local === null ? `contract missing in the working tree; ${where} has one` : `working-tree contract differs from the one at ${where}; the contract at the ref was used as the policy` });
   const blobs = async (rev) => new Map(
@@ -5209,7 +5737,7 @@ function observedChanges(events, changedPaths, since) {
   return { sessions: new Set(inTask.map((e) => e.sessionId)).size, namedPaths: changedPaths.filter((p) => named.has(p)) };
 }
 async function runVerify2(opts) {
-  const repo = resolve5(opts.repoPath);
+  const repo = resolve7(opts.repoPath);
   if (!isAbsolute7(opts.repoPath)) throw new Error("repoPath must be absolute");
   const startedAt = (/* @__PURE__ */ new Date()).toISOString(), started = performance3.now();
   const image = opts.dockerImage ?? DEFAULT_DOCKER_IMAGE;
@@ -5232,9 +5760,9 @@ async function runVerify2(opts) {
   }
   const loaded = trusted ? parseContract(trusted.contractText, `${trusted.ref}:${contractRel}`) : loadContract(contractFile);
   if (!loaded) {
-    const example = join20(repo, ".replume/contract.example.yaml");
+    const example = join22(repo, ".replume/contract.example.yaml");
     throw new Error(
-      `no task contract at ${contractFile}; write one with: replume task "<what you asked the agent>" --allow "<glob>"` + (existsSync15(example) ? ", or copy .replume/contract.example.yaml to .replume/contract.yaml" : "")
+      `no task contract at ${contractFile}; write one with: replume task "<what you asked the agent>" --allow "<glob>"` + (existsSync17(example) ? ", or copy .replume/contract.example.yaml to .replume/contract.yaml" : "")
     );
   }
   const draft = isDraft(loaded);
@@ -5289,7 +5817,7 @@ async function runVerify2(opts) {
   const entries = await diffEntries(repo, base3, commit);
   const setup = /* @__PURE__ */ new Set();
   if (baseline?.base_commit === base3) {
-    const committed = (p) => execFileSync9("git", ["show", `${commit}:${p}`], { cwd: repo });
+    const committed = (p) => execFileSync10("git", ["show", `${commit}:${p}`], { cwd: repo });
     for (const e of entries) {
       if (e.status !== "A" && e.status !== "M" || e.oldPath) continue;
       if (e.path === contractRel && sha256(committed(e.path)) === baseline.policy_hash) setup.add(e.path);
@@ -5308,7 +5836,7 @@ async function runVerify2(opts) {
   const report = await withWorkingCopy(repo, commit, mode === "worktree" && (opts.keepWorkdir ?? false), async (root, home) => {
     const run = (command, timeoutSec) => mode === "docker" ? runDockerScenario({ root, command, timeoutSec, image }) : runCommand(command, root, home, timeoutSec);
     const dir = safeRelative(root, opts.scenariosDir ?? ".replume/scenarios");
-    const scenarios = existsSync15(dir) || await isLink(dir) ? await loadScenarios(dir, root) : [];
+    const scenarios = existsSync17(dir) || await isLink(dir) ? await loadScenarios(dir, root) : [];
     if (scenarios.some((s) => s.id === TEST_COMMAND_ID)) throw new Error(`scenario id "${TEST_COMMAND_ID}" is reserved for the contract's test_command`);
     const results = [];
     for (const scenario of scenarios) results.push(await execute(scenario, run, opts.timeoutSecDefault ?? 60));
@@ -5336,7 +5864,7 @@ async function runVerify2(opts) {
     }
     const baselineFindings = trusted ? await compareToTrustedBase(repo, trusted, commit, contractRel, scenariosRel, contractFile) : baseline ? compareToBaseline(
       baseline,
-      { policyHash: sha256(readFileSync15(contractFile)), scenarioHashes: hashTree(dir) },
+      { policyHash: sha256(readFileSync17(contractFile)), scenarioHashes: hashTree(dir) },
       { contract: opts.contractPath ?? ".replume/contract.yaml", scenariosDir: opts.scenariosDir ?? ".replume/scenarios" }
     ) : [];
     return buildReport({
@@ -5398,9 +5926,9 @@ async function runVerify2(opts) {
     }
   }
   const safe = redactDeep(report, Number.POSITIVE_INFINITY);
-  const reportsDir = join20(repo, ".replume/reports");
+  const reportsDir = join22(repo, ".replume/reports");
   await mkdir(reportsDir, { recursive: true });
-  await writeFile2(join20(reportsDir, `${commit}.json`), JSON.stringify(safe, null, 2) + "\n");
+  await writeFile2(join22(reportsDir, `${commit}.json`), JSON.stringify(safe, null, 2) + "\n");
   return safe;
 }
 function isolationFooter(report) {
@@ -5533,8 +6061,8 @@ async function runPreflight(opts) {
   const { mode, reason } = await resolveIsolation(opts.isolation ?? "auto", image);
   const results = await withWorkingCopy(opts.repoPath, opts.commit, false, async (root, home) => {
     const run = (command, t) => mode === "docker" ? runDockerScenario({ root, command, timeoutSec: t, image }) : runCommand(command, root, home, t);
-    const dir = join21(root, opts.scenariosDir ?? ".replume/scenarios");
-    const scenarios = existsSync16(dir) ? await loadScenarios(dir, root).catch(() => []) : [];
+    const dir = join23(root, opts.scenariosDir ?? ".replume/scenarios");
+    const scenarios = existsSync18(dir) ? await loadScenarios(dir, root).catch(() => []) : [];
     const out = [];
     for (const id of c.must_check) {
       const s = scenarios.find((x) => x.id === id);
@@ -5590,7 +6118,7 @@ function comparePreflight(p, now) {
 }
 
 // src/core/watch.ts
-import { existsSync as existsSync17, readFileSync as readFileSync16, statSync as statSync2, watchFile, unwatchFile } from "fs";
+import { existsSync as existsSync19, readFileSync as readFileSync18, statSync as statSync2, watchFile, unwatchFile } from "fs";
 function formatEvent(e) {
   const time = e.ts.slice(11, 19);
   const action = e.action && e.action !== "ok" ? e.action.toUpperCase() : "";
@@ -5601,11 +6129,11 @@ ${" ".repeat(19)}${e.message.split("\n")[0]}`;
   return head;
 }
 function readNew(path, offset) {
-  if (!existsSync17(path)) return { lines: [], offset, bad: 0 };
+  if (!existsSync19(path)) return { lines: [], offset, bad: 0 };
   const size = statSync2(path).size;
   if (size < offset) offset = 0;
   if (size === offset) return { lines: [], offset, bad: 0 };
-  const buf = readFileSync16(path);
+  const buf = readFileSync18(path);
   const chunk = buf.subarray(offset, size).toString("utf-8");
   const lastNl = chunk.lastIndexOf("\n");
   if (lastNl < 0) return { lines: [], offset, bad: 0 };
@@ -5629,7 +6157,7 @@ function watchLedger(path, print, opts = {}) {
 }
 
 // src/core/replay.ts
-import { isAbsolute as isAbsolute8, join as join22 } from "path";
+import { isAbsolute as isAbsolute8, join as join24 } from "path";
 var REPLAY_ROOT = "/replay-repo";
 var REPLAY_BANNER = "RECORDED SESSION (replay). These are recorded events run through Replume's rules now.\nThis shows what the rules decide on these events; it does not show a live agent being steered.";
 function kindOf(e) {
@@ -5647,10 +6175,10 @@ function actionFromEvent(e) {
     for (const k of ["file_path", "notebook_path", "path"]) {
       const v = input[k];
       if (typeof v !== "string") continue;
-      if (!isAbsolute8(v)) input[k] = join22(REPLAY_ROOT, v);
+      if (!isAbsolute8(v)) input[k] = join24(REPLAY_ROOT, v);
       else {
         const rel = e.paths.find((p) => v.endsWith(`/${p}`));
-        if (rel) input[k] = join22(REPLAY_ROOT, rel);
+        if (rel) input[k] = join24(REPLAY_ROOT, rel);
       }
     }
     return toProposedAction(
@@ -5666,7 +6194,7 @@ function actionFromEvent(e) {
     });
   }
   const kind = kindOf(e);
-  const { inside, outside } = splitPaths(REPLAY_ROOT, e.paths.map((p) => isAbsolute8(p) ? p : join22(REPLAY_ROOT, p)));
+  const { inside, outside } = splitPaths(REPLAY_ROOT, e.paths.map((p) => isAbsolute8(p) ? p : join24(REPLAY_ROOT, p)));
   const rawEdit = raw3;
   const before = rawEdit.before ?? rawEdit.old_string;
   const after = rawEdit.after ?? rawEdit.new_string;
@@ -5764,17 +6292,17 @@ var builtInEvents = JSON.stringify({
 
 // src/cli.ts
 function readStdin() {
-  return new Promise((resolve7, reject) => {
+  return new Promise((resolve9, reject) => {
     let data = "";
     process.stdin.setEncoding("utf-8");
     process.stdin.on("data", (chunk) => data += chunk);
-    process.stdin.on("end", () => resolve7(data));
+    process.stdin.on("end", () => resolve9(data));
     process.stdin.on("error", reject);
   });
 }
 function repoRoot() {
   try {
-    return execFileSync10("git", ["rev-parse", "--show-toplevel"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
+    return execFileSync11("git", ["rev-parse", "--show-toplevel"], { stdio: ["ignore", "pipe", "ignore"] }).toString().trim();
   } catch {
     return process.cwd();
   }
@@ -5820,16 +6348,16 @@ usageCommand.command("import-cursor").requiredOption("--result <path>", "local C
 });
 program.name("replume").description("Verify what your AI coding agent actually did").version(package_default.version);
 program.addHelpText("after", "\nOff-machine options: verify --legacy-judge sends the full git diff, task text, and agent action summary to api.openai.com; --post-github-comment posts task text to the PR on api.github.com; --check-registry sends package names to npm/PyPI. HTTP layer 2 is off unless REPLUME_JUDGE=shadow|on and REPLUME_JUDGE_PROVIDER=http with REPLUME_JUDGE_URL; HTTP needs REPLUME_JUDGE_ALLOW_INSECURE_HTTP=1.\n");
-program.command("init").description("Create .replume/, install agent hooks where supported, print the capability matrix").option("--hook-command <cmd>", "command Claude Code should run for hooks", void 0).option("--cursor", "install Cursor project hooks even when .cursor/ is absent").option("--cursor-hook-command <cmd>", "command Cursor should run for hooks").option("--remove-cursor-hooks", "restore the Cursor hook config from before Replume init").action((opts) => {
+program.command("init").description("Create .replume/, install agent hooks where supported, print the capability matrix").option("--hook-command <cmd>", "command Claude Code should run for hooks", void 0).option("--cursor", "install Cursor project hooks even when .cursor/ is absent").option("--codex", "install Codex project hooks even when .codex/ is absent").option("--cursor-hook-command <cmd>", "command Cursor should run for hooks").option("--remove-cursor-hooks", "restore the Cursor hook config from before Replume init").action((opts) => {
   try {
     const root = repoRoot();
     if (opts.removeCursorHooks) {
-      const result = uninstallCursorHooks(root);
-      console.log(result.restored ? result.backupRetained ? `Cursor hooks removed where still identifiable; edited settings kept at ${result.path}; original backup retained beside it` : `Cursor hooks removed; previous configuration restored at ${result.path}` : "No Replume Cursor installation found");
+      const result2 = uninstallCursorHooks(root);
+      console.log(result2.restored ? result2.backupRetained ? `Cursor hooks removed where still identifiable; edited settings kept at ${result2.path}; original backup retained beside it` : `Cursor hooks removed; previous configuration restored at ${result2.path}` : "No Replume Cursor installation found");
       return;
     }
     const detected = detectAgents(root);
-    const cursorDir = join23(root, ".cursor");
+    const cursorDir = join25(root, ".cursor");
     let cursorEntry = null;
     try {
       cursorEntry = lstatSync3(cursorDir);
@@ -5839,12 +6367,23 @@ program.command("init").description("Create .replume/, install agent hooks where
     if (opts.cursor && cursorEntry && !cursorEntry.isDirectory())
       throw new Error(`${cursorDir} must be a directory; nothing was changed.`);
     const wantCursor = Boolean(opts.cursor || cursorEntry?.isDirectory());
+    const codexDir = join25(root, ".codex");
+    let codexEntry = null;
+    try {
+      codexEntry = lstatSync3(codexDir);
+    } catch (e) {
+      if (e.code !== "ENOENT") throw e;
+    }
+    if (opts.codex && codexEntry && !codexEntry.isDirectory())
+      throw new Error(`${codexDir} must be a directory; nothing was changed.`);
+    const wantCodex = Boolean(opts.codex || codexEntry?.isDirectory());
     if (wantCursor) validateCursorHooksConfig(root, { command: opts.cursorHookCommand });
-    if (detected["Claude Code"] && existsSync18(claudeSettingsPath(root))) {
+    if (wantCodex) validateCodexHooks(root);
+    if (detected["Claude Code"] && existsSync20(claudeSettingsPath(root))) {
       const path = claudeSettingsPath(root);
       let parsed;
       try {
-        parsed = JSON.parse(readFileSync17(path, "utf8"));
+        parsed = JSON.parse(readFileSync19(path, "utf8"));
       } catch {
         throw new Error(`${path} is not valid JSON; nothing was changed. Fix it and run replume init again.`);
       }
@@ -5856,15 +6395,24 @@ program.command("init").description("Create .replume/, install agent hooks where
       hookCommand: opts.hookCommand,
       cursorHookCommand: opts.cursorHookCommand,
       cursorHooks: wantCursor,
+      codexHooks: wantCodex,
       detected
     });
     const oldNotice = lines.findIndex((l) => l.startsWith("- Cursor found, but"));
     if (oldNotice >= 0) lines.splice(oldNotice, 1);
+    const codexNotice = lines.findIndex((l) => l.startsWith("- Codex found, but"));
+    if (codexNotice >= 0) lines.splice(codexNotice, 1);
     const matrixAt = lines.indexOf("Capability matrix");
     lines[matrixAt + 1] = renderCapabilities(CAPABILITIES.map((c) => c.agent === "Cursor" ? {
       ...c,
       installedByInit: wantCursor
-    } : c), detected);
+    } : c.agent === "Codex" ? { ...c, installedByInit: wantCodex } : c), detected);
+    if (wantCodex) {
+      const codex = installCodexHooks(root);
+      lines.splice(matrixAt, 0, codex.added.length ? `\u2713 Codex hooks added to .codex/hooks.json: ${codex.added.join(", ")}; run /hooks in Codex to trust this definition` : "\u2713 Codex hooks already present; run /hooks in Codex if the definition changed");
+    } else {
+      lines.splice(matrixAt, 0, "- Codex project hooks not installed: run replume init --codex; otherwise Codex agent steps will not be recorded in the ledger");
+    }
     if (wantCursor) {
       const cursor = installCursorHooks(root, { command: opts.cursorHookCommand });
       lines.splice(matrixAt, 0, cursor.added.length ? `\u2713 Cursor hooks added to .cursor/hooks.json: ${cursor.added.join(", ")}${cursor.backupPath ? ` (backup: ${cursor.backupPath})` : ""}` : "\u2713 Cursor hooks already present (nothing changed)");
@@ -5940,6 +6488,7 @@ addPreflightOptions(program.command("draft")).description("Propose a Task Contra
     console.log(serializeContract(c).trimEnd());
     console.log("");
     console.log(finalAllow);
+    if (allowHasNoSource(c.allow)) console.log(`  WARNING: ${ALLOW_NO_SOURCE_WARNING}`);
     if (opts.yes) await preflightAndRecord(root, path, c, opts);
     else console.log("  This draft is NOT policy yet: verify reports the contract as NOT CHECKED and the hooks ignore it. Review the file, then run `replume confirm`.");
     console.log(passPathHint(c));
@@ -5968,7 +6517,7 @@ addPreflightOptions(program.command("confirm")).description("Confirm the draft c
 });
 program.command("watch").description("Live view of .replume/events.jsonl with rule hits").option("--once", "print what is there and exit").action((opts) => {
   const path = ledgerPath(repoRoot());
-  if (!existsSync18(path)) console.log(`(no events yet at ${path}; waiting)`);
+  if (!existsSync20(path)) console.log(`(no events yet at ${path}; waiting)`);
   watchLedger(path, (l) => console.log(l), { once: opts.once });
 });
 program.command("verify").description("Run the contract and scenarios on a commit in an isolated working copy (exit 0 pass, 1 fail, 2 incomplete)").option("--commit <sha>", "commit to verify", "HEAD").option("--base <sha>", "commit to diff against").option("--trusted-base <ref>", "git ref (commit or protected branch) whose contract and scenarios are the policy; also the diff base unless --base is given").option("--json", "print the report as JSON").option("--keep-workdir", "keep the isolated working copy for debugging (worktree mode only)").addOption(
@@ -5982,7 +6531,7 @@ program.command("verify").description("Run the contract and scenarios on a commi
   if (opts.checkRegistry) console.error("replume: opt-in registry check sends package names from dependency changes to registry.npmjs.org or pypi.org; no source file contents are sent by this lookup.");
   try {
     const root = repoRoot();
-    const commit = execFileSync10("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root }).toString().trim();
+    const commit = execFileSync11("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root }).toString().trim();
     const report = await runVerify2({
       repoPath: root,
       commit,
@@ -6002,7 +6551,7 @@ program.command("verify").description("Run the contract and scenarios on a commi
 program.command("accept").description("Explicitly accept HEAD after a fresh verification PASS; only then count cost per accepted change").option("--base <sha>", "commit to diff against").addOption(new Option("--isolation <mode>", "verification mode").choices(["auto", "docker", "worktree"]).default("auto")).action(async (opts) => {
   const root = repoRoot();
   try {
-    const commit = execFileSync10("git", ["rev-parse", "--verify", "HEAD^{commit}"], { cwd: root, encoding: "utf8" }).trim();
+    const commit = execFileSync11("git", ["rev-parse", "--verify", "HEAD^{commit}"], { cwd: root, encoding: "utf8" }).trim();
     const report = await runVerify2({ repoPath: root, commit, baseCommit: opts.base, isolation: opts.isolation });
     if (report.isolationMode === "worktree") console.error(WORKTREE_WARNING);
     if (report.verdict !== "pass") fail(`accept requires a fresh verify PASS; this commit is ${report.verdict.toUpperCase()}`);
@@ -6016,15 +6565,15 @@ program.command("report").description("Re-print the report saved for a commit (.
   const root = repoRoot();
   let commit;
   try {
-    commit = execFileSync10("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root, stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
+    commit = execFileSync11("git", ["rev-parse", "--verify", `${opts.commit}^{commit}`], { cwd: root, stdio: ["ignore", "pipe", "pipe"] }).toString().trim();
   } catch {
     fail(`not a commit: ${opts.commit}`);
   }
-  const file2 = join23(root, REPLUME_DIR, "reports", `${commit}.json`);
-  if (!existsSync18(file2)) fail(`no report for ${commit.slice(0, 7)} at ${file2}; run replume verify --commit ${opts.commit}`);
+  const file2 = join25(root, REPLUME_DIR, "reports", `${commit}.json`);
+  if (!existsSync20(file2)) fail(`no report for ${commit.slice(0, 7)} at ${file2}; run replume verify --commit ${opts.commit}`);
   let report;
   try {
-    report = JSON.parse(readFileSync17(file2, "utf-8"));
+    report = JSON.parse(readFileSync19(file2, "utf-8"));
   } catch (e) {
     fail(`${file2} is not valid JSON: ${e.message}`);
   }
@@ -6048,25 +6597,25 @@ demo.option("--replay <file>", "run a recorded events.jsonl session through the
     console.log(renderReplay(replay(builtInEvents, builtInContract), builtInContract));
     return;
   }
-  const file2 = resolve6(opts.replay);
-  if (!existsSync18(file2)) fail(`replay file not found: ${file2}`);
+  const file2 = resolve8(opts.replay);
+  if (!existsSync20(file2)) fail(`replay file not found: ${file2}`);
   try {
     const sibling = file2.replace(/\.jsonl?$/, "") + ".contract.yaml";
-    const contractFile = opts.contract ? resolve6(opts.contract) : existsSync18(sibling) ? sibling : contractPath(repoRoot());
+    const contractFile = opts.contract ? resolve8(opts.contract) : existsSync20(sibling) ? sibling : contractPath(repoRoot());
     const contract = loadContract(contractFile);
-    console.log(renderReplay(replay(readFileSync17(file2, "utf-8"), contract), contract, contract ? contractFile : void 0));
+    console.log(renderReplay(replay(readFileSync19(file2, "utf-8"), contract), contract, contract ? contractFile : void 0));
   } catch (e) {
     fail(e.message);
   }
 });
 async function demoReplayHooks(path, contractOpt) {
-  const file2 = resolve6(path);
-  if (!existsSync18(file2)) fail(`replay file not found: ${file2}`);
+  const file2 = resolve8(path);
+  if (!existsSync20(file2)) fail(`replay file not found: ${file2}`);
   const sibling = file2.replace(/\.jsonl?$/, "") + ".contract.yaml";
-  const contractFile = contractOpt ? resolve6(contractOpt) : existsSync18(sibling) ? sibling : null;
+  const contractFile = contractOpt ? resolve8(contractOpt) : existsSync20(sibling) ? sibling : null;
   try {
-    const r = await replayHooks(readFileSync17(file2, "utf-8"), {
-      contractYaml: contractFile ? readFileSync17(contractFile, "utf-8") : void 0,
+    const r = await replayHooks(readFileSync19(file2, "utf-8"), {
+      contractYaml: contractFile ? readFileSync19(contractFile, "utf-8") : void 0,
       env: process.env
     });
     console.log(REPLAY_HOOKS_BANNER);
@@ -6089,13 +6638,13 @@ program.command("install").description("[legacy, August MVP] Register SessionSta
 });
 async function legacyVerify(postGithubComment) {
   const repoDir = process.cwd();
-  const headSha = process.env.REPLUME_HEAD_SHA ?? execFileSync10("git", ["rev-parse", "HEAD"], { cwd: repoDir }).toString().trim();
+  const headSha = process.env.REPLUME_HEAD_SHA ?? execFileSync11("git", ["rev-parse", "HEAD"], { cwd: repoDir }).toString().trim();
   const [owner, repo] = (process.env.GITHUB_REPOSITORY ?? "/").split("/");
   const prNumber = Number(process.env.REPLUME_PR_NUMBER ?? "0");
   const baseRef = process.env.REPLUME_BASE_REF ?? "main";
   let diff = "";
   try {
-    diff = execFileSync10("git", ["diff", `origin/${baseRef}...HEAD`], { cwd: repoDir }).toString();
+    diff = execFileSync11("git", ["diff", `origin/${baseRef}...HEAD`], { cwd: repoDir }).toString();
   } catch (err) {
     console.warn(`replume: could not compute diff against origin/${baseRef}, continuing with empty diff:`, err);
   }
@@ -6114,6 +6663,12 @@ async function legacyVerify(postGithubComment) {
   console.log(`replume verdict: ${verdict}`);
 }
 var hook = program.command("hook").description("Internal: agent hook entry points");
+hook.command("codex").description("Codex CLI hook handler").action(async () => {
+  const out = handleCodexHook(await readStdin());
+  if (out.stdout) process.stdout.write(out.stdout);
+  if (out.stderr) process.stderr.write(out.stderr);
+  process.exitCode = out.exitCode;
+});
 hook.command("cursor").description("Cursor hook handler").action(async () => {
   const out = handleCursorHook(await readStdin());
   process.stdout.write(out.stdout);