I really only have time to give a quick idea for #1. You could accomplish this fairly easily in the following way:
- Make a directory to house all the wrappers
- Put that directory first in the PATH
- Make a generic script, and fill the wrapper directory with symlinks to that script, named the same as the programs you want to wrap
- The wrapper script could work as follows:
- Log @ARGV, etc
- Remove the wrapper directory from the PATH
- exec basename($0), @ARGV
This could easily be circumvented by an aware user (they just have to modify the PATH), but would probably be the easiest to implement.