replume-cli 0.2.0 → 0.2.1

package/README.md

@@ -58,6 +58,8 @@ The first lines give `PASS`, `FAIL`, or `INCOMPLETE` and the reason. `DONE` mean
 
 Evidence labels distinguish what this verify run computed (`Verified in this environment`), what came from editable local files (`Observed`), optional model judgment (`Assumed`), and what was not checked (`Unknown`). The local event ledger records only actions that reached installed hooks. A manual commit can pass its checks while agent steps were not observed; the report calls that out. Use `replume demo` for a built-in recorded replay of rule decisions; it does not show live steering.
 
+In a second terminal inside the project, run `replume watch` while the agent works. It prints one line per recorded step, including blocks and their reasons, Stop retries, test results, and the final saved-report verdict. Use `replume watch --once` to read the ledger and exit. Colors appear in a terminal unless `NO_COLOR` is set; no events means the project hooks may not have run.
+
 ## What stays on your machine / what can leave it
 
 The default Replume flow (`init`, `draft`, `confirm`, hooks, `verify`) makes no Replume-managed outbound request. Contract, events, report and scenario results stay local. Commands in your own repository, including test/scenario commands, can use the network themselves; inspect them before running. Docker scenario mode disables container networking; the isolated working copy does not.
@@ -67,6 +69,7 @@ The default Replume flow (`init`, `draft`, `confirm`, hooks, `verify`) makes no
 | Default flow | None from Replume | Nothing sent by Replume |
 | `verify --legacy-judge` | OpenAI, `api.openai.com` | Full Git diff, task text and agent action summary; also a GitHub check-run with commit SHA and verdict to `api.github.com` |
 | `verify --legacy-judge --post-github-comment` | GitHub PR, `api.github.com` | Task text and model reasoning in a PR comment; it can be public if the repository is public |
+| `github comment --repo OWNER/REPO --pr N` | GitHub PR via logged-in `gh` or `api.github.com` with `GITHUB_TOKEN` | Previewed, redacted, allow-listed sections from one saved session report (or a saved verify JSON supplied with `--report`); task text and changed paths may be included |
 | `REPLUME_JUDGE=shadow` or `on`, `REPLUME_JUDGE_PROVIDER=http`, `REPLUME_JUDGE_URL=https://…` | The configured HTTPS host | Task text, recent agent action summaries and proposed action or final message; `REPLUME_JUDGE_ALLOW_INSECURE_HTTP=1` separately permits HTTP |
 | `verify --check-registry` | `registry.npmjs.org` or `pypi.org` | Package names added in dependency changes; no source file contents from this lookup |
 
@@ -88,10 +91,14 @@ Docker mode: when a local Docker daemon is running and the image (default `node:
 
 This stage **only** runs in Docker, even if scenario verification used the worktree fallback. For a detected web app, Replume uses the [official Playwright image](https://playwright.dev/docs/docker) pinned to `v1.64.0-noble`. On first use it announces the roughly 3.5 GB local image download and builds a local image with `playwright@1.64.0`, because the official image contains browsers but [not the npm package](https://playwright.dev/docs/docker). Image preparation contacts the image/npm registries; the app and browser run together over localhost in a fresh container with `--network none`, a read-only repo mount, and no host Docker socket. CLI and HTTP probes do not pull Playwright. Use `--runtime-image <local-image>` to supply another image; Replume never pulls a custom image. A Dockerfile `CMD` is run against the selected image and clean commit, without a Dockerfile build. If anything cannot run, the report says NOT CHECKED. An automatic end-of-task integration can call `runRuntimeAtTaskEnd` from `src/sandbox/index.ts`; its `enabled: false` option and CLI `--no-runtime` disable the stage. Existing projects should add `evidence/` to `.replume/.gitignore` before running this option; new `replume init` projects include it. Docker is useful isolation, not a perfect security boundary.
 
-Commands: `replume init`, `replume task`, `replume draft`, `replume confirm`, `replume watch`, `replume verify`, `replume accept`, `replume report`, `replume usage`, `replume demo`, `replume judge-eval`, `replume install`, `replume hook`.
+Commands: `replume init`, `replume task`, `replume draft`, `replume confirm`, `replume watch`, `replume verify`, `replume accept`, `replume report`, `replume share`, `replume github`, `replume memory`, `replume usage`, `replume demo`, `replume judge-eval`, `replume install`, `replume hook`.
 
 ### Local task metrics (first slice)
 
+`replume share [report]` uploads one session report to replume.dev and prints an unlisted link (`replume.dev/r/<id>`). It never runs on its own. It first prints exactly what will be sent: the verdict, what was asked and done, what changed, where Replume steered, tests, time and tokens, and the runtime and not-checked notes. Secrets are redacted, absolute paths become `<path>`, and the full verify output, assumptions, model-judge evidence and your code are not sent; `--no-diff` also drops diff hunks and per-file line counts. It asks before uploading (`--yes` skips the question, `--dry-run` only previews). The delete token stays in `.replume/shares.jsonl` (git-ignored); `replume share --delete <id>` removes the report.
+
+`replume github comment --repo OWNER/REPO --pr N --dry-run` previews a PR comment made from the latest saved session report, using the same redacted sections as `share`. Run it without `--dry-run` to confirm interactively, or add `--yes` in CI. `--report PATH` selects a report; a saved verify JSON produces a shorter comment labeled “from saved file, not re-verified.” Nothing is posted during `verify` by default.
+
 Replume reads Claude Code token counters from its local transcript at Stop and SessionEnd. To add counters from a local Codex rollout or Cursor CLI success JSON, run `replume usage import-codex --rollout <path> --task-id <id> --session-id <id>` or `replume usage import-cursor --result <path> --task-id <id> --session-id <id>`. These commands store only counts and task/session IDs in `.replume/usage.jsonl`; they make no API call. Uncaptured usage remains Unknown. Active agent time and human waiting time remain Unknown.
 
 After `replume verify` passes, run `replume accept` to explicitly accept the current commit. It runs verification again and records the acceptance locally. Run `replume verify` afterward to refresh the saved report's accepted-change metrics. Any dollar figure is labelled **estimated API-equivalent** for captured tokens using a dated price table; it is not a bill or a savings claim. Before acceptance, it remains Unknown.