diff --git a/.claude/harness-candidates.md b/.claude/harness-candidates.md
index dd3912db..8bf1b8af 100644
--- a/.claude/harness-candidates.md
+++ b/.claude/harness-candidates.md
@@ -107,3 +107,23 @@ Deferred lint/test guardrails surfaced during reviews. Promote to a `CExxx` rule
   caught them. The cleanup plan explicitly deferred this as YAGNI for the
   one-time purge, but any future doc rename/deletion re-opens the same blind
   spot — caught in the 2026-07-03 open-source-docs-cleanup implementation run.
+
+## From PR #77 (command-executed shell-normalize) — CE030-to-criteria deferred
+
+- [ ] **Extend CE030 doc/schema-parity to the `SuccessCriterion` union** so a new
+  criterion (or field) can't ship undocumented. Attempted in PR #77 and reverted:
+  CI installs `--extra uipath`, and in that environment `coder_eval.models.criteria`
+  gains a `CliCalledCriterion` (fields `log`/`positional`) that is NOT present in a
+  plain checkout (it did not reproduce on macOS, whose lockfile resolution omits the
+  contributing linux-only component). It defeated every discriminator tried — union
+  membership, a `__module__` string filter (it is spoofed to `coder_eval.models.criteria`),
+  a genuine-module-attribute scan (it is `setattr` onto the module), and even an AST
+  parse of the `SuccessCriterion` union literal in `criteria.py` source (CI's imported
+  criteria module resolves to a file whose union literal already contains it). No
+  runtime OR source signal available in the lint could separate the injected criterion
+  from an in-tree one. Revisit only with a way to identify the in-tree criterion set that
+  is provably immune to the uipath integration — e.g. a hardcoded name allowlist of the
+  in-tree criteria (losing auto-coverage of new ones), or first understanding exactly how
+  that environment injects the criterion. Until then CE030 stays scoped to the four
+  top-level models; the `command_pattern`/`exclude_pattern` contract this PR changed is
+  documented in the Field descriptions and TASK_DEFINITION_GUIDE regardless.
diff --git a/docs/TASK_DEFINITION_GUIDE.md b/docs/TASK_DEFINITION_GUIDE.md
index 1e988237..f10a7ccb 100644
--- a/docs/TASK_DEFINITION_GUIDE.md
+++ b/docs/TASK_DEFINITION_GUIDE.md
@@ -796,6 +796,7 @@ Runs a command and checks the exit code, with optional stdout matching. **Binary
 | `expected_exit_code` | 0 | Expected exit code |
 | `expected_stdout` | `null` | When set, stdout is also checked |
 | `stdout_match` | `"exact"` | Match mode: `exact` (stripped), `contains` (substring), `regex` (pattern) |
+| `score_from_stdout` | `false` | Read a float score (0.0–1.0) from the first stdout line (remaining lines become details); a non-zero exit code or a parse failure scores 0.0. Mutually exclusive with `expected_stdout`. |
 
 ### `file_matches_regex`
 
@@ -823,6 +824,12 @@ Compares agent's code with a reference solution using similarity scoring. **Cont
   weight: 2.0
 ```
 
+| Field | Default | Description |
+|-------|---------|-------------|
+| `agent_file` | *required* | Path to the agent's generated file (relative to the sandbox root). |
+| `comparison_method` | `"ast"` | `ast` (structure), `token` (text), or `complexity` (metrics). |
+| `similarity_threshold` | 0.8 | Minimum similarity score to pass (0.0–1.0). |
+
 **Comparison methods:**
 - `ast` — Abstract Syntax Tree similarity (structure-based)
 - `token` — Token-based similarity (implementation details)
@@ -841,6 +848,17 @@ Checks whether the agent executed specific tools/commands during evaluation. Ins
   description: "Agent must use curl to fetch weather"
 ```
 
+| Field | Default | Description |
+|-------|---------|-------------|
+| `tool_name` | `null` | Tool-name filter (e.g. `Bash`); `null` counts any tool. |
+| `command_pattern` | `null` | Regex to match the command; `null` matches any command. Matched with shell normalization (see below). |
+| `min_count` | 1 | Minimum matching commands required. `0` permits zero matches — combine with `max_count: 0` to assert a command must **NOT** run. |
+| `max_count` | `null` | Optional inclusive upper bound. When set, the criterion passes iff `min_count <= matches <= max_count`. |
+| `require_success` | `false` | Only count commands that completed successfully. |
+| `exclude_pattern` | `null` | Regex that must NOT match; a command matching both `command_pattern` and `exclude_pattern` is skipped. Also matched with shell normalization (see below). |
+
+**Shell normalization.** For a Bash command, both `command_pattern` and `exclude_pattern` are matched against the raw command text **and** its shell-normalized form — the `bash`/`sh`/`zsh -lc "..."` wrapper stripped and shell quoting resolved with `shlex` — and a hit on *either* form counts. So a pattern like `curated_channels` matches whether the agent wrote the argument bare, `'single'`-quoted, `"double"`-quoted, or `\"escaped\"`; you do **not** hand-encode shell quoting. Because the same haystacks also feed `exclude_pattern` and the `max_count` gate, normalization is **not** purely additive: a quote-obfuscated call can now be caught by an exclusion or a `max_count: 0` gate that the raw text alone would have missed — and, conversely, an unedited `exclude_pattern` may now exclude a call it previously let through. Cross-repo suites that hand-encoded quote tolerance in their patterns should re-baseline.
+
 **Codex limitation.** Codex agents map `Read`, `Grep`, and `Glob` tools to `shell` commands (they execute via bash), so `tool_name: "Read"` on Codex returns no matches. Use `tool_name: "Bash"` or `tool_name: null` (any tool) for Codex-compatible checks. This criterion works correctly on Claude Code agents, which emit separate `Read`/`Grep`/`Glob` telemetry.
 
 ### `cli_called`
@@ -1026,6 +1044,8 @@ Have an LLM grade the task against a rubric written in the task YAML. **Continuo
 | `temperature` | `0.0` | Sampling temperature (0.0 = deterministic) |
 | `max_tokens` | `2000` | Maximum tokens in the judge's response |
 | `max_file_chars` | `20000` | Per-file (and agent_output) truncation applied before building the prompt |
+| `capture_transcript` | `true` | Persist a `JudgeTranscript` (raw verdict + rendered prompts + token usage) to a sibling `judge-<idx>.yaml`. Set `false` to drop it when on-disk size matters (e.g. 1000-row datasets); the `findings` on the result persist regardless. |
+| `max_transcript_chars` | `100000` | Aggregate cap on captured transcript text (verdict + prompt + system, split 60/30/10). Exceeding it marks the transcript `truncated=True`. |
 
 **Transport selection.** The judge call is routed by the active `API_BACKEND`:
 
@@ -1099,6 +1119,8 @@ Spawn a full Claude Code SDK agent as the judge. Unlike `llm_judge` (a single LL
 | `max_turns` | `50` | Judge's inner-loop turn limit |
 | `turn_timeout` | `300` | Wall-clock timeout (seconds) |
 | `agent` | hardened judge defaults | Nested `AgentConfig` — `model`, `permission_mode`, `allowed_tools`, `disallowed_tools`, `ignore_patterns`, `sdk_options`. A partial block (e.g. only `model:`) still applies the judge security defaults for missing fields, and the security floor (`.claude` / `.mcp.json` / `_reference` ignore patterns, `setting_sources=[]`) is always enforced. |
+| `capture_transcript` | `true` | Persist a `JudgeTranscript` (tool calls + token usage + raw verdict + rendered prompts) to a sibling `judge-<idx>.yaml`. Set `false` to drop the trajectory log when on-disk size matters; the `findings` on the result persist regardless. |
+| `max_transcript_chars` | `100000` | Aggregate cap on captured transcript text (verdict + prompt + system + tool detail/result-preview lines, split 60/30/10 with tool calls prioritized). Exceeding it marks the transcript `truncated=True`. |
 
 **Security**
 
diff --git a/src/coder_eval/criteria/command_executed.py b/src/coder_eval/criteria/command_executed.py
index e5343ef2..69aad136 100644
--- a/src/coder_eval/criteria/command_executed.py
+++ b/src/coder_eval/criteria/command_executed.py
@@ -3,6 +3,8 @@
 import json
 import logging
 import re
+import shlex
+from functools import lru_cache
 from typing import TYPE_CHECKING
 
 from coder_eval.criteria.base import BaseCriterion, CheckContext, LiveVerdict, register_criterion
@@ -16,10 +18,127 @@
 
 logger = logging.getLogger(__name__)
 
-# Limit regex search input length to mitigate ReDoS on large command strings
+# Limit regex search input length to mitigate ReDoS on large command strings.
+# Normalization runs over this same truncated window (see _match_haystacks), so
+# shlex never sees more than this many chars and needs no separate size guard.
 _MAX_PATTERN_SEARCH_LEN = 2000
 
 
+def _is_shell_program(arg0: str) -> bool:
+    """True if argv[0]'s basename looks like a POSIX shell.
+
+    A predicate rather than an enumerated allowlist: the set of shells is open
+    (``bash``/``sh`` on Linux, ``zsh`` on macOS — Codex shells through the host's
+    login shell, see codex_agent.py — plus ``dash``/``ksh``/…), and every common
+    shell basename ends in ``sh``. Matching is additive (the raw text stays a
+    haystack), so favouring recall over a hand-maintained list is safe.
+    """
+    return arg0.rsplit("/", 1)[-1].endswith("sh")
+
+
+def _is_command_flag(tok: str) -> bool:
+    """True for a short-option cluster carrying a ``-c`` command string.
+
+    Covers ``-c``, ``-lc``, ``-ic``, ``-lic`` (login/interactive + command) in
+    any order — a single ``-``-prefixed token whose option letters are all
+    alphabetic and include ``c``. ``--long`` options and ``-o=val`` forms are
+    rejected, so this is the first flag that actually introduces the command
+    string. The combined and split (``bash -l -c``) forms both work: a non-``c``
+    short flag like ``-l`` simply isn't the command flag and the scan continues.
+    """
+    return len(tok) >= 2 and tok[0] == "-" and tok[1] != "-" and tok[1:].isalpha() and "c" in tok[1:]
+
+
+@lru_cache(maxsize=1024)
+def _normalize_shell(cmd_text: str) -> str | None:
+    """Quote-resolved, wrapper-stripped form of a shell command, or None.
+
+    ``command_pattern`` regexes are written against the *logical* command
+    (``uip is resources run list <key> <resource>``), but telemetry records the
+    raw ``bash -lc "..."`` wrapper — so whichever way the agent happened to quote
+    an argument (bare, ``"double"``, ``'single'``, ``\\"escaped\\"``) leaks into
+    the pattern. Authors then hand-model that escaping and get it subtly wrong
+    (e.g. allowing ``"`` but not ``'``), silently under-counting correct calls.
+
+    This unwraps a ``bash``/``sh``/``zsh -c`` wrapper and resolves shell quoting
+    with ``shlex`` so a pattern can match argv semantics regardless of quoting.
+    Shell operators (``&&``, ``|``, ``>``) survive as their own tokens, so
+    patterns that reference them keep working, and embedded newlines collapse to
+    single spaces. Returns ``None`` when the text can't be parsed (an odd quote
+    count — NOT heredocs, which tokenize fine); the caller then keeps only the
+    raw text as a haystack.
+
+    Adding a second (normalized) haystack is *not* purely additive: a
+    ``command_pattern`` can only gain matches, but the same haystacks feed
+    ``exclude_pattern`` and the ``max_count`` gate, so a normalized form can
+    newly satisfy an exclusion or trip a ``max_count`` cap — i.e. a command that
+    counted on the raw text alone can stop counting. See
+    ``CommandExecutedChecker._matching_commands``.
+
+    Memoized (pure function of ``cmd_text``): the early-stop watcher re-scans the
+    whole accumulated trajectory on every tool-call event, so the same command is
+    normalized many times per run — the cache collapses that to once per distinct
+    (already-truncated) command string.
+    """
+    try:
+        tokens = shlex.split(cmd_text, posix=True)
+    except ValueError:
+        return None
+    if not tokens:
+        return None
+    # Unwrap `bash -lc "<script>"` / `sh -c "<script>"`: the real command is
+    # everything after the -c/-lc flag.
+    if _is_shell_program(tokens[0]):
+        for i in range(1, len(tokens) - 1):
+            tok = tokens[i]
+            if _is_command_flag(tok):
+                rest = tokens[i + 1 :]
+                if len(rest) == 1:
+                    # Quoted whole-script form (`bash -lc "uip ... 'arg' ..."`):
+                    # the script is a single token that may still hold inner
+                    # quotes — re-split to resolve them.
+                    try:
+                        tokens = shlex.split(rest[0], posix=True)
+                    except ValueError:
+                        return None
+                else:
+                    # Argv-joined form: Codex rollout recovery joins argv WITHOUT
+                    # re-quoting (codex_agent.py), so `bash -lc uip is resources ...`
+                    # already arrives split — keep every token instead of
+                    # collapsing to the first word.
+                    tokens = rest
+                break
+            if not tok.startswith("-"):
+                break  # first positional before any -c: not a command wrapper
+    return " ".join(tokens)
+
+
+def _match_haystacks(cmd_text: str, *, is_shell: bool) -> list[str]:
+    """Strings a pattern may match against for one command.
+
+    Always the raw ``cmd_text`` truncated to the ReDoS bound; when ``is_shell``,
+    additionally the quote-resolved, wrapper-stripped form of that **same
+    truncated window** (see :func:`_normalize_shell`). Normalizing the already-
+    truncated slice keeps both haystacks describing the same window, so quote-
+    stripping can never slide content from past the cap into the match, and
+    caps ``shlex`` input at ``_MAX_PATTERN_SEARCH_LEN`` for free. Matching is
+    "either" — a pattern hits the command if it matches ANY haystack.
+
+    ``is_shell`` is decided once by the caller (a Bash tool whose ``command`` is
+    a non-empty ``str``) and passed in, rather than re-derived here from
+    ``tool_name`` alone: a Bash record with a missing/empty ``command`` serializes
+    its params to JSON, where shell tokenization is meaningless, and must NOT be
+    normalized (else stripped JSON quotes could newly satisfy an exclusion).
+    """
+    window = cmd_text[:_MAX_PATTERN_SEARCH_LEN]
+    haystacks = [window]
+    if is_shell:
+        normalized = _normalize_shell(window)
+        if normalized is not None and normalized != window:
+            haystacks.append(normalized)
+    return haystacks
+
+
 @register_criterion
 class CommandExecutedChecker(BaseCriterion[CommandExecutedCriterion]):
     """Checker for CommandExecutedCriterion.
@@ -54,27 +173,39 @@ def _matching_commands(
             if criterion.require_success and cmd.result_status != "success":
                 continue
 
-            # Extract text for pattern matching (Bash: command param; others: JSON-serialized params)
-            if cmd.tool_name == "Bash" and cmd.parameters.get("command"):
-                cmd_text = cmd.parameters["command"]
+            # Extract text for pattern matching (Bash: command param; others: JSON-serialized params).
+            # ``parameters`` is ``dict[str, Any]``, and a ``command`` value is not
+            # guaranteed to be a ``str`` — Codex sub-agent rollout recovery can carry
+            # it as an argv *list* (codex_agent.py). Narrow with ``isinstance`` so a
+            # non-``str`` value never reaches ``shlex.split``/slicing (which would raise
+            # ``AttributeError`` and zero the whole criterion); fall back to the JSON blob.
+            raw_command = cmd.parameters.get("command")
+            if cmd.tool_name == "Bash" and isinstance(raw_command, str) and raw_command:
+                cmd_text = raw_command
+                is_shell = True
             else:
                 cmd_text = json.dumps(cmd.parameters)
+                is_shell = False
 
-            # Truncate to mitigate ReDoS on large command strings
-            if len(cmd_text) > _MAX_PATTERN_SEARCH_LEN:
-                cmd_text = cmd_text[:_MAX_PATTERN_SEARCH_LEN]
+            # Match the pattern against the raw command AND its quote-resolved
+            # form, so authors need not encode shell quoting/escaping (which they
+            # do inconsistently, silently under-counting correctly-quoted calls).
+            # ``is_shell`` (decided once, above) tells the helper whether cmd_text
+            # is a shell command — it must not re-derive that from tool_name alone.
+            haystacks = _match_haystacks(cmd_text, is_shell=is_shell)
 
             # Filter by command pattern
-            if pattern is not None and not pattern.search(cmd_text):
+            if pattern is not None and not any(pattern.search(h) for h in haystacks):
                 continue
 
-            # Apply exclusion pattern (skip commands matching the exclusion)
-            if exclude_re is not None and exclude_re.search(cmd_text):
+            # Apply exclusion pattern (skip commands matching the exclusion).
+            # Same both-haystacks logic so exclusion can't be dodged by quoting.
+            if exclude_re is not None and any(exclude_re.search(h) for h in haystacks):
                 continue
 
-            # Build a display label for the matched command
-            if cmd.tool_name == "Bash" and cmd.parameters.get("command"):
-                label = cmd.parameters["command"]
+            # Build a display label for the matched command (same narrowing as above)
+            if cmd.tool_name == "Bash" and isinstance(raw_command, str) and raw_command:
+                label = raw_command
             else:
                 label = f"{cmd.tool_name}({json.dumps(cmd.parameters)[:80]})"
             matching.append(label)
diff --git a/src/coder_eval/models/criteria.py b/src/coder_eval/models/criteria.py
index c368ca3b..dadc2237 100644
--- a/src/coder_eval/models/criteria.py
+++ b/src/coder_eval/models/criteria.py
@@ -906,7 +906,14 @@ class CommandExecutedCriterion(LiveSuccessCriterion):
     type: Literal["command_executed"] = "command_executed"
     tool_name: str | None = Field(default=None, description="Tool name filter (e.g., 'Bash'). None = any tool.")
     command_pattern: str | None = Field(
-        default=None, description="Regex to match command parameters. None = any command."
+        default=None,
+        description=(
+            "Regex to match command parameters. None = any command. For a Bash "
+            "command the pattern is matched against the raw command text OR its "
+            "shell-normalized form — `shlex`-resolved quoting with a "
+            "`bash`/`zsh -lc` wrapper stripped — whichever hits, so you need not "
+            "hand-encode shell quoting/escaping (`'single'`, `\"double\"`, bare)."
+        ),
     )
     min_count: int = Field(
         default=1,
@@ -930,7 +937,9 @@ class CommandExecutedCriterion(LiveSuccessCriterion):
     exclude_pattern: str | None = Field(
         default=None,
         description=(
-            "Regex that must NOT match. Commands matching both command_pattern and exclude_pattern are skipped."
+            "Regex that must NOT match. Commands matching both command_pattern and exclude_pattern are skipped. "
+            "Like command_pattern, this is matched against the raw Bash command OR its shell-normalized form, so "
+            "it also excludes quote-obfuscated variants of the same call."
         ),
     )
 
diff --git a/tests/test_command_executed.py b/tests/test_command_executed.py
index a936b029..9c6a3711 100644
--- a/tests/test_command_executed.py
+++ b/tests/test_command_executed.py
@@ -2,6 +2,7 @@
 
 from datetime import datetime
 
+from coder_eval.criteria.command_executed import _MAX_PATTERN_SEARCH_LEN, _match_haystacks, _normalize_shell
 from coder_eval.evaluation.checker import SuccessChecker
 from coder_eval.models import CommandExecutedCriterion
 from coder_eval.models.results import TurnRecord
@@ -513,6 +514,50 @@ def test_non_bash_tool(self):
 
         assert result.score == 1.0
 
+    def test_non_str_command_does_not_crash_criterion(self):
+        """A non-``str`` ``command`` (Codex argv array) must not zero the criterion.
+
+        Codex sub-agent rollout recovery can carry ``command`` as an argv *list*
+        (codex_agent.py), which reaches ``CommandTelemetry.parameters`` verbatim.
+        Before the ``isinstance`` narrow, the list fell through to
+        ``shlex.split(list)`` -> ``AttributeError: 'list' object has no attribute
+        'read'``, which aborted ``_matching_commands`` for the entire trajectory
+        and scored a pattern-less, otherwise-passing criterion 0.0.
+        """
+        sandbox = MockSandbox()
+        turn_records = [
+            _make_turn(
+                [
+                    _make_command(tool_name="Bash", parameters={"command": ["bash", "-lc", "ls"]}, tool_id="t1"),
+                    _make_command(tool_name="Bash", parameters={"command": "echo hi"}, tool_id="t2"),
+                ]
+            )
+        ]
+        # Pattern-less: both Bash commands count; the argv-list one must not crash.
+        criterion = CommandExecutedCriterion(description="ran bash", tool_name="Bash", min_count=1)
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.error is None
+        assert result.score == 1.0
+        assert "2/1" in result.details
+
+    def test_non_str_command_still_matches_sibling_by_pattern(self):
+        """One argv-list ``command`` must not poison a pattern match on its sibling."""
+        sandbox = MockSandbox()
+        turn_records = [
+            _make_turn(
+                [
+                    _make_command(tool_name="Bash", parameters={"command": ["bash", "-lc", "ls"]}, tool_id="t1"),
+                    _make_command(tool_name="Bash", parameters={"command": "uip run foo"}, tool_id="t2"),
+                ]
+            )
+        ]
+        criterion = CommandExecutedCriterion(
+            description="ran uip", tool_name="Bash", command_pattern=r"uip\s+run", min_count=1
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.error is None
+        assert result.score == 1.0
+
     def test_crashed_turn_commands_are_counted(self):
         """Commands from crashed partial turns count toward min_count.
 
@@ -750,3 +795,312 @@ def test_invalid_range_rejected_at_model_level(self):
                 min_count=5,
                 max_count=2,
             )
+
+
+class TestNormalizeShell:
+    """Unit tests for the shell-normalization helper."""
+
+    def test_unwraps_bash_lc_and_resolves_single_quotes(self):
+        raw = (
+            '/bin/bash -lc "uip is resources run list uipath-salesforce-slack '
+            "'curated_channels?types=public_channel,private_channel' --output json\""
+        )
+        assert _normalize_shell(raw) == (
+            "uip is resources run list uipath-salesforce-slack "
+            "curated_channels?types=public_channel,private_channel --output json"
+        )
+
+    def test_unwraps_escaped_double_quotes(self):
+        raw = '/bin/bash -lc "uip is resources run list \\"slack\\" \\"curated_channels\\""'
+        assert _normalize_shell(raw) == "uip is resources run list slack curated_channels"
+
+    def test_bare_command_is_just_requoted(self):
+        assert _normalize_shell("uip is resources run list slack 'curated_channels'") == (
+            "uip is resources run list slack curated_channels"
+        )
+
+    def test_shell_operators_survive_as_tokens(self):
+        raw = "uip maestro flow validate X.flow --output json && uip maestro flow format X.flow"
+        assert _normalize_shell(raw) == raw  # already unquoted; operators kept verbatim
+
+    def test_unbalanced_quotes_return_none(self):
+        assert _normalize_shell("echo 'unterminated") is None
+
+    def test_argv_joined_payload_is_not_collapsed_to_first_word(self):
+        """Codex rollout recovery joins argv WITHOUT re-quoting (codex_agent.py).
+
+        The wrapper unwrap must keep every token after ``-lc``, not just the
+        first — otherwise ``bash -lc uip is resources ...`` collapses to ``uip``,
+        making the fix a silent no-op on the sub-agent path.
+        """
+        raw = "bash -lc uip is resources run list slack curated_channels --output json"
+        assert _normalize_shell(raw) == "uip is resources run list slack curated_channels --output json"
+
+    def test_argv_joined_short_command(self):
+        assert _normalize_shell("bash -c echo hi there") == "echo hi there"
+
+    def test_every_wrapper_form_is_unwrapped(self):
+        """One case per shell/flag shape the agents emit — the allowlist can't rot.
+
+        The predicate replaced an enumerated allowlist that omitted ``zsh``
+        (Codex's shell on macOS, codex_agent.py) and ``-ic`` while listing the
+        exotic ``-lic``; on those hosts the normalization silently reverted to
+        the pre-fix false-negative behaviour. Each entry must strip the wrapper.
+        """
+        cases = {
+            # zsh — Codex's default login shell on macOS
+            '/bin/zsh -lc "uip is resources run list slack curated_channels"': (
+                "uip is resources run list slack curated_channels"
+            ),
+            'zsh -lc "echo hi"': "echo hi",
+            'sh -c "echo hi"': "echo hi",
+            'dash -c "echo hi"': "echo hi",
+            'ksh -c "echo hi"': "echo hi",
+            'bash -ic "echo hi"': "echo hi",  # interactive + command
+            '/usr/bin/bash -lic "echo hi"': "echo hi",  # login + interactive + command
+            "bash -l -c 'echo hi'": "echo hi",  # split login/command flags
+        }
+        for raw, expected in cases.items():
+            assert _normalize_shell(raw) == expected, raw
+
+    def test_non_shell_arg0_is_not_unwrapped(self):
+        """A non-shell program (basename not ending in ``sh``) is only re-quoted.
+
+        ``git -c <config>`` is the motivating case: ``-c`` is a real git flag, but
+        because ``git`` is not a shell the payload must NOT be unwrapped.
+        """
+        assert _normalize_shell("git -c user.name=x status") == "git -c user.name=x status"
+        assert _normalize_shell("uip is resources run list slack 'curated_channels'") == (
+            "uip is resources run list slack curated_channels"
+        )
+
+    def test_empty_and_whitespace_input_return_none(self):
+        """Empty / whitespace-only input has no tokens -> None (benign, not an error)."""
+        assert _normalize_shell("") is None
+        assert _normalize_shell("   ") is None
+
+    def test_inner_unbalanced_quotes_return_none(self):
+        """A wrapper whose script token can't be re-split falls back to None."""
+        # Outer double quotes balance, so the script token is `echo 'unterminated`;
+        # re-splitting that raises ValueError on the stray single quote.
+        assert _normalize_shell('bash -lc "echo \'unterminated"') is None
+
+    def test_non_wrapper_positional_returns_verbatim(self):
+        """A shell with a positional before any -c is a script invocation, not `-c`.
+
+        `bash script.sh -c foo` runs the file `script.sh`; the later `-c` is an
+        argument to the script, not a command flag, so nothing is unwrapped.
+        """
+        assert _normalize_shell("bash script.sh -c foo") == "bash script.sh -c foo"
+
+    def test_shell_with_flags_but_no_command_flag_is_verbatim(self):
+        """A shell invoked with only non-``-c`` flags (no command) unwraps nothing.
+
+        The wrapper scan exhausts without finding a command flag or a positional,
+        so the tokens are returned as-is.
+        """
+        assert _normalize_shell("bash --norc -i") == "bash --norc -i"
+
+    def test_is_memoized(self):
+        """The hot early-stop path re-scans the trajectory; normalize once per command.
+
+        Counting via ``cache_info`` (not wall-clock) so the guard can't flake.
+        """
+        _normalize_shell.cache_clear()
+        raw = "bash -lc 'echo hello world'"
+        first = _normalize_shell(raw)
+        second = _normalize_shell(raw)
+        assert first == second == "echo hello world"
+        assert _normalize_shell.cache_info().hits >= 1  # second call served from cache
+
+
+class TestShellQuotingNormalization:
+    """Patterns match regardless of how the agent quoted the command.
+
+    Regression for ``skill-flow-paginated-reference-lookup``: the agent
+    paginated ``uip is resources run list <slack> 'curated_channels?...'``
+    correctly (a sibling ``nextPage=`` criterion matched the same calls), but the
+    gating pagination criterion's pattern allowed only a bare or ``\\"``-escaped
+    token — the agent single-quoted the resource arg — so it scored 0.0 (false
+    negative). Normalizing the command before matching fixes the whole class
+    without touching any task YAML.
+    """
+
+    # The exact recorded shape: `bash -lc "..."` wrapper, resource arg in SINGLE
+    # quotes. Second call adds a nextPage token (still single-quoted).
+    _PAGE1 = (
+        '/bin/bash -lc "uip is resources run list uipath-salesforce-slack '
+        "'curated_channels?types=public_channel,private_channel' --connection-id abc --output json\""
+    )
+    _PAGE2 = (
+        '/bin/bash -lc "uip is resources run list uipath-salesforce-slack '
+        "'curated_channels?types=public_channel,private_channel' "
+        "--query 'nextPage=eyJwYWdlIjoyfQ' --output json\""
+    )
+    # The ORIGINAL, unchanged pattern from the task YAML: allows an optional
+    # backslash + optional DOUBLE quote, but no single quote.
+    _YAML_PATTERN = r'uip\s+is\s+resources\s+run\s+list\s+\\?"?uipath-salesforce-slack\\?"?\s+\\?"?curated_channels'
+
+    def test_single_quoted_calls_now_counted_with_original_pattern(self):
+        """The unchanged YAML pattern now counts both single-quoted calls."""
+        sandbox = MockSandbox()
+        turn_records = [
+            _make_turn(
+                [
+                    _make_command(tool_name="Bash", parameters={"command": self._PAGE1}, tool_id="t1"),
+                    _make_command(tool_name="Bash", parameters={"command": self._PAGE2}, tool_id="t2"),
+                ]
+            )
+        ]
+        criterion = CommandExecutedCriterion(
+            description="paginated curated_channels list ran >1x",
+            tool_name="Bash",
+            command_pattern=self._YAML_PATTERN,
+            min_count=2,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 1.0
+        assert "2/2" in result.details
+
+    def test_escaped_double_quote_form_still_matches(self):
+        """Backward compat: the escaping style the pattern anticipated still hits."""
+        sandbox = MockSandbox()
+        raw = (
+            '/bin/bash -lc "uip is resources run list \\"uipath-salesforce-slack\\" '
+            '\\"curated_channels?types=x\\" --output json"'
+        )
+        turn_records = [_make_turn([_make_command(tool_name="Bash", parameters={"command": raw})])]
+        criterion = CommandExecutedCriterion(
+            description="curated_channels list ran",
+            tool_name="Bash",
+            command_pattern=self._YAML_PATTERN,
+            min_count=1,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 1.0
+
+    def test_shell_operator_pattern_still_matches(self):
+        """`&&`/`|` patterns keep working — operators survive normalization."""
+        sandbox = MockSandbox()
+        cmd = "/bin/bash -lc 'uip maestro flow validate X.flow --output json && uip maestro flow format X.flow'"
+        turn_records = [_make_turn([_make_command(tool_name="Bash", parameters={"command": cmd})])]
+        criterion = CommandExecutedCriterion(
+            description="validate then format",
+            tool_name="Bash",
+            command_pattern=r"uip\s+maestro\s+flow\s+validate.*&&.*uip\s+maestro\s+flow\s+format",
+            min_count=1,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 1.0
+
+    def test_unbalanced_quotes_fall_back_to_raw_without_crashing(self):
+        """A command shlex can't parse still matches against its raw text."""
+        sandbox = MockSandbox()
+        turn_records = [_make_turn([_make_command(tool_name="Bash", parameters={"command": "echo 'unterminated"})])]
+        criterion = CommandExecutedCriterion(
+            description="echo ran",
+            tool_name="Bash",
+            command_pattern=r"echo\s+",
+            min_count=1,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 1.0
+
+    def test_argv_joined_command_matches_full_pattern(self):
+        """The argv-joined (unquoted) shape matches a whole-command pattern.
+
+        This is Codex's sub-agent rollout-recovery telemetry — argv joined with
+        spaces and no re-quoting. Before the unwrap fix it collapsed to the first
+        word, so this pattern scored 0.0.
+        """
+        sandbox = MockSandbox()
+        cmd = "bash -lc uip is resources run list uipath-salesforce-slack curated_channels --output json"
+        turn_records = [_make_turn([_make_command(tool_name="Bash", parameters={"command": cmd})])]
+        criterion = CommandExecutedCriterion(
+            description="listed curated_channels",
+            tool_name="Bash",
+            command_pattern=r"uip\s+is\s+resources\s+run\s+list\s+\S+\s+curated_channels",
+            min_count=1,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 1.0
+
+    def test_argv_joined_not_collapsed_into_false_anchored_match(self):
+        """The collapse-to-first-word bug could make ``^git$`` match ``git push ...``.
+
+        The real command is ``git push --force origin main``; an anchored
+        ``^git$`` negative assertion must PASS (score 1.0). The old code collapsed
+        the payload to the single token ``git``, which matched ``^git$`` and
+        force-failed the gate for a command the agent never actually ran bare.
+        """
+        sandbox = MockSandbox()
+        cmd = "bash -lc git push --force origin main"
+        turn_records = [_make_turn([_make_command(tool_name="Bash", parameters={"command": cmd})])]
+        criterion = CommandExecutedCriterion(
+            description="must NOT run bare `git`",
+            tool_name="Bash",
+            command_pattern=r"^git$",
+            min_count=0,
+            max_count=0,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 1.0
+
+    def test_bash_record_without_command_is_not_shell_normalized(self):
+        """A Bash record with no ``command`` key must not have its JSON params tokenized.
+
+        ``_match_haystacks`` is now told whether cmd_text is a shell command
+        (``is_shell``, decided once at the extraction site) instead of
+        re-deriving it from ``tool_name == "Bash"`` alone. A Bash record whose
+        ``command`` is missing (reachable on the Codex path) falls back to the
+        JSON blob and must NOT be normalized — otherwise shlex strips the JSON
+        quotes, adding a haystack that can newly satisfy an ``exclude_pattern``
+        and wrongly drop the command below ``min_count``.
+        """
+        sandbox = MockSandbox()
+        # Bash tool, but params carry a `description`, not a `command`.
+        turn_records = [
+            _make_turn([_make_command(tool_name="Bash", parameters={"description": "run the pytest suite"})])
+        ]
+        criterion = CommandExecutedCriterion(
+            description="counts the bash record",
+            tool_name="Bash",
+            # Matches the shlex-stripped JSON (`{description: run ...}`) but NOT the
+            # raw JSON (`{"description": "run ...}`); with the is_shell fix the raw
+            # is the only haystack, so the command is not excluded.
+            exclude_pattern=r"description:\s+run",
+            min_count=1,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 1.0
+
+    def test_normalized_haystack_shares_the_raw_truncation_window(self):
+        """Both haystacks describe the same <=2000-char window (no past-cap leak).
+
+        Previously the raw haystack was truncated at 2000 chars but normalization
+        ran over the FULL command, so quote-stripping could slide content from
+        past the cap into the normalized haystack — a task relying on the
+        2000-char bound changed verdict. Normalization now runs over the
+        already-truncated window.
+        """
+        cmd = "bash -lc " + ("word " * 600) + "TARGET"  # TARGET sits well past 2000 chars
+        haystacks = _match_haystacks(cmd, is_shell=True)
+        assert all(len(h) <= _MAX_PATTERN_SEARCH_LEN for h in haystacks)
+        assert not any("TARGET" in h for h in haystacks)
+
+    def test_negative_assertion_not_dodged_by_quoting(self):
+        """A quote-obfuscated retired call is still caught by a max_count=0 gate."""
+        sandbox = MockSandbox()
+        # `'uip' or users list` doesn't match `uip\s+or` on the raw text (a quote
+        # sits right after uip), but the normalized form `uip or users list` does.
+        obfuscated = "/bin/bash -lc \"'uip' or users list\""
+        turn_records = [_make_turn([_make_command(tool_name="Bash", parameters={"command": obfuscated})])]
+        criterion = CommandExecutedCriterion(
+            description="must NOT use retired `uip or users list`",
+            tool_name="Bash",
+            command_pattern=r"uip\s+or\s+users\s+list",
+            min_count=0,
+            max_count=0,
+        )
+        result = SuccessChecker(sandbox).check(criterion, turn_records=turn_records)
+        assert result.score == 0.0