crewforth 3.1.0-rc.2 → 3.1.0-rc.3

package/CHANGELOG.md

@@ -118,9 +118,39 @@ versioning follows [SemVer](https://semver.org/).
 - **Studio: a layout for a narrow window.** Below 640 px the panel is one column: the navigator is a drawer, the
   inspector and the conversation take the whole stage and stop above the dock. Checked in a narrow desktop browser
   window; not measured on a phone.
+- **Studio: what a session spent.** A summary box on the canvas and one line in the navigator give the session's
+  time, its tokens (agents included) and an estimate of the cost, such as `51m · 2.8M · ~$3.22`. The cost is an
+  estimate at API list price and reads as one (a leading `~`; on a subscription it is not what you are billed). The
+  prices are one table, read from the pricing page on 2026-10-08; a model with no row in it shows `—`, never a guess.
+  Not checked against an invoice.
+- **Studio: background work is shown.** A Bash command sent to the background is listed on its session (`1 in
+  background` on the card, **In the background** in the inspector) until the notice that ends it arrives.
+- **Studio: a question waiting in a terminal is named.** For a session started in a terminal, a permission question
+  can only be answered there; the view now says so, with the tool and the command: `Waiting for an answer in the
+  terminal: Bash · npm run build`.
+- **Studio: the inspector can be resized** (drag its left edge, arrow keys, double-click for the default; 280 to
+  720 px, remembered).
 
 ### Changed
 
+- **Studio: agents are named by their role.** `crew-backend-expert` reads Backend, `general-purpose` General Purpose,
+  in the graph, the Timeline, the List, the dock, the inspector and the conversation; the declared type is under the
+  name in the inspector and on hover. A task cut short on a card is said in full on hover.
+- **Studio: a group of agents opens beside itself.** Several agents of one type are one card; in a window of 1024 px
+  and up, clicking it puts its agents in the next column as ordinary cards, and opening another group folds the
+  first. Below that width it opens downward as before.
+- **In `auto` and `dontAsk`, a refused commit or push says what to ask and what to send back.** The refusal was a
+  paragraph with the approval text somewhere inside it, and the question the model made of it was as long. It now
+  asks for one shape: the commit message in one code block and, under it, one line with the exact text to send,
+  `approve: commit`, `approve: push` or `approve: commit+push` (`onay: …`), named for the call that was refused. A
+  sentence that says yes is still not an approval, and nothing about what an approval covers has changed.
+- **Where the approval cannot be recorded, the refusal says so.** The record is written by `prompt-approval.sh`. In a
+  session whose settings do not wire it (a worktree that carries an older Crewforth, for one) the message
+  `approve: commit` recorded nothing, and the refusal went on asking for it. The gate now reads the settings it can
+  see (the plugin's `hooks.json`, the project's `settings.json` and `settings.local.json`, the user's
+  `settings.json`) and, when none wires the hook, says the approval path is closed in this session and names the
+  two ways that work: Shift+Tab, or your own terminal. The command is refused either way. `doctor.sh` warns about
+  the same thing, and about a worktree of the repository that carries another Crewforth version.
 - **After a final release, npm's `next` no longer names something older than `latest`.** A final moved `latest`
   only, so `npx crewforth@next` went on installing the rc before it. The release now moves `next` to the final when
   what `next` names is older; an rc of a later version stays where it is.
@@ -205,6 +235,16 @@ versioning follows [SemVer](https://semver.org/).
   the same (measured on Windows, in a real session), and the conversation says who refused it. Known limit: the dock
   can ask about a call that another gate refuses anyway.
 
+### Fixed
+
+- **Studio: full screen keeps its panels.** In full screen the navigator, the inspector and the conversation could
+  not be opened, so a selected agent showed nothing and a request under "Needs you" could not be answered. A style
+  rule hid every panel there; it is gone, and full screen now only takes the browser away.
+- **Studio: a background agent that is still working is no longer drawn "Done".** Claude Code sends a `completed`
+  notice each time a background agent stops, and the agent can be resumed after it; Studio took the first notice as
+  final. A notice now stands only until the agent writes to its transcript again, and while its session is running
+  an agent in the middle of a turn is drawn Running.
+
 ## [3.0.4] — 2026-10-05
 
 ### Security

package/kit/agents/crew-commit-agent.md

@@ -87,8 +87,11 @@ On a mixed/non-atomic diff, **propose a split**; do not commit before approval (
   The tool-level gate `guard-bash.sh` intercepts commit/push in **every** permission mode: in normal modes it raises an
   approval prompt only the user can answer — so present the message FIRST, then run the commit yourself and let the user
   approve it at the prompt. Never hand the user a command to paste into their own terminal. In `auto` and `dontAsk`
-  the prompt reaches nobody: stage, present the message, and the user approves by sending a message that is only
-  `approve: commit` (`approve: push`, `approve: commit+push`; `onay:` too). It covers what is staged on that HEAD.
+  the prompt reaches nobody: stage, then ask in this shape and with nothing after it — the message in ONE code block,
+  and under it one line in the user's language: "If you approve, write only this: `approve: commit`" (`approve: push`,
+  `approve: commit+push`; `onay:` too). The user approves by sending that text alone; a sentence that says yes is not an
+  approval. It covers what is staged on that HEAD. If the gate says the approval path is closed in this session (the
+  recording hook is not wired), say so and offer Shift+Tab or their own terminal instead.
   Then run `git commit -m '…'` alone in its call (single-quoted, or from a here-document with a quoted delimiter),
   and a push as `git push <remote> <branch>`. Never write that message yourself. Under `plan` and
   `bypassPermissions` the gate fails closed; there the user must switch modes or pre-authorise with

package/kit/eval/doctor.sh

@@ -96,6 +96,10 @@ _mt() {
       'SessionStart not wired — session rehydration after /compact or /clear is inactive (update Crewforth)') s="SessionStart bağlı değil — /compact ya da /clear sonrasında oturum toparlanmıyor (Crewforth'u güncelleyin)" ;;
       'SessionStart wired (session rehydration active)') s='SessionStart bağlı (oturum toparlama devrede)' ;;
       'settings.json is invalid JSON') s='settings.json geçersiz JSON' ;;
+      'approval by your own message is wired (auto / dontAsk: approve: commit)') s='kendi mesajınızla onay bağlı (auto / dontAsk: onay: commit)' ;;
+      "settings.json wires prompt-approval.sh but the script is missing — in auto and dontAsk the message 'approve: commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)") s="settings.json prompt-approval.sh'i bağlıyor ama betik yok — auto ve dontAsk modunda 'onay: commit' mesajı hiçbir şey kaydetmez; Shift+Tab ile mod değiştirin ya da kendi terminalinizden commit edin (Crewforth'u güncelleyin)" ;;
+      "prompt-approval.sh is not wired on UserPromptSubmit — in auto and dontAsk the message 'approve: commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)") s="prompt-approval.sh UserPromptSubmit'e bağlı değil — auto ve dontAsk modunda 'onay: commit' mesajı hiçbir şey kaydetmez; Shift+Tab ile mod değiştirin ya da kendi terminalinizden commit edin (Crewforth'u güncelleyin)" ;;
+      "worktree %s carries Crewforth %s, this one %s — a session there runs that version's gates and approval path (update Crewforth there)") s="%s worktree'sinde Crewforth %s var, burada %s — orada açılan oturum o sürümün kapılarını ve onay yolunu koşar (Crewforth'u orada güncelleyin)" ;;
       "fix the syntax by hand — restoring Crewforth's file would drop any hooks you added") s="sözdizimini elle düzeltin — Crewforth'un dosyasını geri yüklemek eklediğiniz hook'ları siler" ;;
       'settings.json wires hooks through the %s placeholder — on Windows its separators are stripped before bash runs, so NO hook launches and every gate is silently absent') s="settings.json hook'ları %s yer tutucusuyla bağlıyor — Windows'ta ayırıcılar bash çalışmadan silinir, bu yüzden HİÇBİR hook başlamaz ve bütün kapılar sessizce yok olur" ;;
       'update Crewforth (npx crewforth adopt) — hook commands become:') s="Crewforth'u güncelleyin (npx crewforth adopt) — hook komutları şu olur:" ;;
@@ -349,6 +353,14 @@ if [ -f "$S" ]; then
                     || bad "settings.json hook events empty or missing:%s — those gates won't fire" "restore settings.json from Crewforth (npx crewforth update)" "$EMPTY"
     sn="$(awk -v op=len -v path=hooks.SessionStart -f "$SJ" "$S" 2>/dev/null)"
     case "$sn" in ''|0) warn "SessionStart not wired — session rehydration after /compact or /clear is inactive (update Crewforth)" ;; *) ok "SessionStart wired (session rehydration active)" ;; esac
+    # In auto and dontAsk the only approval is the user's own message, and ONE hook records it. Where it is not wired
+    # the gate stays closed and a message 'approve: commit' records nothing (field report: a worktree on an older
+    # Crewforth). A warning, not a failure: commit and push still cannot happen without the user.
+    case "$(awk -v op=get -v path=hooks.UserPromptSubmit -f "$SJ" "$S" 2>/dev/null)" in
+      *prompt-approval.sh*) if [ -f .claude/hooks/prompt-approval.sh ]; then ok "approval by your own message is wired (auto / dontAsk: approve: commit)"
+                            else warn "settings.json wires prompt-approval.sh but the script is missing — in auto and dontAsk the message 'approve: commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)"; fi ;;
+      *) warn "prompt-approval.sh is not wired on UserPromptSubmit — in auto and dontAsk the message 'approve: commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)" ;;
+    esac
   else bad "settings.json is invalid JSON" "fix the syntax by hand — restoring Crewforth's file would drop any hooks you added"; fi
   # `${CLAUDE_PROJECT_DIR}` inside a hook command is the shape that breaks on Windows, and it breaks invisibly.
   # Claude Code substitutes that placeholder into the command STRING before any shell sees it; on Windows the
@@ -370,6 +382,20 @@ if [ -f "$S" ]; then
 else
   bad "settings.json missing — the tool-level gates (commit approval, guards, context) are INACTIVE" "reinstall Crewforth"
 fi
+# 4b) Another worktree of this repository on another Crewforth. A session that moves there runs THAT version's hooks
+#     against this one's expectations: its gates, its approval path (3.0 has none for auto mode). `.claude/` is
+#     tracked in some projects, so a worktree cut from an older branch carries the older kit.
+if [ -f .claude/VERSION ] && git rev-parse --git-dir >/dev/null 2>&1; then
+  _wv0="$(head -1 .claude/VERSION 2>/dev/null | tr -cd '0-9A-Za-z.-')"; _wt0="$(git rev-parse --show-toplevel 2>/dev/null)"
+  while IFS= read -r _wl; do
+    case "$_wl" in "worktree "*) _wp="${_wl#worktree }" ;; *) continue ;; esac
+    [ "$_wp" != "$_wt0" ] && [ -f "$_wp/.claude/VERSION" ] || continue
+    _wv="$(head -1 "$_wp/.claude/VERSION" 2>/dev/null | tr -cd '0-9A-Za-z.-')"
+    [ "$_wv" = "$_wv0" ] || warn "worktree %s carries Crewforth %s, this one %s — a session there runs that version's gates and approval path (update Crewforth there)" "$_wp" "${_wv:-?}" "$_wv0"
+  done <<EOF_WT
+$(git worktree list --porcelain 2>/dev/null)
+EOF_WT
+fi
 
 # 4a) Skill listing budget. Claude Code puts a listing of every model-invocable skill's name and description into
 #     context each turn and caps it at skillListingBudgetFraction of the context window (default 0.01); over the

package/kit/eval/smoke-test.sh

@@ -6167,6 +6167,35 @@ GBCP
   ( cd "$DTMP" && env -u CREW_LANG CREW_I18N_MISS="$DTMP/miss2" bash .claude/eval/doctor-twin.sh >/dev/null 2>&1 )
   grep -qx 'planted line with no translation' "$DTMP/miss2" && pass "twin: a planted untranslated line is named by the miss list" \
     || fail "twin: the miss list did not name a planted untranslated line — the empty list above proves nothing"
+  # THE APPROVAL PATH, AS DOCTOR SEES IT. In auto and dontAsk one hook records the user's own message; where it is
+  # not wired, or another worktree carries another Crewforth, the gate stays closed and its advice used to be wrong
+  # (field report, 3.1.0-rc.2). Four states of the wiring and two of the worktree, each read from doctor's own lines.
+  DAP="$(mktemp -d)"; DAP="$(cd -P "$DAP" && pwd)"; mkdir -p "$DAP/p/.claude"
+  for d in eval hooks; do [ -d "$ROOT/$d" ] && cp -R "$ROOT/$d" "$DAP/p/.claude/$d"; done
+  cp "$ROOT/settings.json" "$DAP/p/.claude/settings.json" 2>/dev/null; echo 3.1.0 > "$DAP/p/.claude/VERSION"
+  ( cd "$DAP/p" && git init -q . && git config user.email t@example.com && git config user.name t && git config core.hooksPath /dev/null \
+    && echo x > f && git add f && git commit -qm init && git worktree add -q "$DAP/old" -b old ) >/dev/null 2>&1
+  _dap(){ ( cd "$DAP/p" && CREW_LANG=en bash .claude/eval/doctor.sh 2>/dev/null ); }
+  if [ ! -d "$DAP/old" ]; then fail "FIXTURE: the linked worktree for doctor's approval cases was not created"
+  else
+    _d1="$(_dap)"
+    case "$_d1" in *"approval by your own message is wired"*) case "$_d1" in *"carries Crewforth"*|*"records nothing"*) fail "doctor warned about the approval path on a healthy install with a worktree that carries no Crewforth" ;;
+                     *) pass "doctor: the approval hook is reported wired on a fresh install, with no warning" ;; esac ;;
+                   *) fail "doctor did not report the approval hook as wired on a fresh install" ;; esac
+    mkdir -p "$DAP/old/.claude"; echo 3.1.0 > "$DAP/old/.claude/VERSION"; _d2="$(_dap)"
+    echo 3.0.4 > "$DAP/old/.claude/VERSION"; _d3="$(_dap)"
+    case "$_d2" in *"carries Crewforth"*) fail "doctor warned about a worktree on the SAME Crewforth" ;; *)
+      # The path is git's own spelling (`C:/…` on Windows, where this script says `/tmp/…`), so only its last part is read.
+      case "$_d3" in *"/old carries Crewforth 3.0.4, this one 3.1.0"*) pass "doctor: a worktree on another Crewforth is named with both versions; one on the same version is not" ;;
+                     *) fail "doctor did not name a worktree that carries Crewforth 3.0.4 beside this 3.1.0" ;; esac ;; esac
+    mv "$DAP/p/.claude/hooks/prompt-approval.sh" "$DAP/pa.sh"; _d4="$(_dap)"; mv "$DAP/pa.sh" "$DAP/p/.claude/hooks/prompt-approval.sh"
+    case "$_d4" in *"wires prompt-approval.sh but the script is missing"*) pass "doctor: wired with the script missing is a warning that names the two ways that still work" ;;
+                   *) fail "doctor did not warn when prompt-approval.sh is wired and missing" ;; esac
+    sed 's/prompt-approval\.sh/some-other.sh/' "$DAP/p/.claude/settings.json" > "$DAP/s.tmp" && mv "$DAP/s.tmp" "$DAP/p/.claude/settings.json"; _d5="$(_dap)"
+    case "$_d5" in *"prompt-approval.sh is not wired on UserPromptSubmit"*"Shift+Tab"*) pass "doctor: an install whose settings do not wire the approval hook is warned, with Shift+Tab and the terminal named" ;;
+                   *) fail "doctor did not warn when prompt-approval.sh is not wired on UserPromptSubmit" ;; esac
+  fi
+  rm -rf "$DAP"
   # WHAT git IS POINTED AT. .claude/git-shim is Crewforth's too: the updater points git there when the project has a
   # hook chain of its own, and each shim runs Crewforth's hook and then the project's. Doctor did not know it: on such a
   # project it answered "not Crewforth's hooks" and advised `git config core.hooksPath .claude/hooks`, the command that
@@ -6897,10 +6926,11 @@ _pa_new(){  # a fresh repository on branch feat/x with one remote, a staged chan
     && git config user.name t && git config core.hooksPath /dev/null && git checkout -q -b feat/x && echo one > a.txt && git add a.txt \
     && git commit -qm init && git remote add origin "$_PA/remote.git" && echo two >> a.txt && git add a.txt ) >/dev/null 2>&1
   _pa_review; }
+# The fixture wires the recording hook, as an install does (_pa_review writes the settings file): the refusal reads it.
 # The remote's address AS GIT SPELLS IT. On Git Bash git answers `C:/…` where the shell says `/c/…`, so an address is
 # never compared against a path this script built: it is asked back from git (_pa_url), and "elsewhere" is derived from it.
 _pa_url(){ ( cd "$_paw" && git remote get-url --push "${1:-origin}" 2>/dev/null ); }
-_pa_review(){ ( cd "$_paw" && mkdir -p .claude && printf '{"diff_oid":"%s","head":"%s"}\n' "$(git diff --cached | git hash-object --stdin)" "$(git rev-parse --verify --quiet HEAD)" > .claude/review-pass.json ); }
+_pa_review(){ ( cd "$_paw" && mkdir -p .claude && printf '%s' '{"hooks":{"UserPromptSubmit":[{"hooks":[{"type":"command","command":"bash .claude/hooks/prompt-approval.sh"}]}]}}' > .claude/settings.json && printf '{"diff_oid":"%s","head":"%s"}\n' "$(git diff --cached | git hash-object --stdin)" "$(git rev-parse --verify --quiet HEAD)" > .claude/review-pass.json ); }
 _pa_rec="$_paw/.git/crewforth-approval"
 # $1 = mode, $2 = the prompt AS JSON TEXT (already escaped), $3 = cwd (default: the repository)
 _pa_say(){ printf '{"session_id":"s","cwd":"%s","permission_mode":"%s","hook_event_name":"UserPromptSubmit","prompt":"%s"}' "${3:-$_paw}" "$1" "$2" \
@@ -6917,7 +6947,7 @@ _pa_op(){ sed -n 's/^op=//p' "$_pa_rec" 2>/dev/null; }
 if [ "$UNITS" != 1 ]; then
   # The cases below feed payloads to the two hooks; like the other gate unit cases they belong to the source run.
   # An installed project keeps the two pins after them: the shared definitions and the wiring.
-  skip scope "approval by the user's own message: the unit cases run in the source checkout (scope=install)" 37
+  skip scope "approval by the user's own message: the unit cases run in the source checkout (scope=install)" 39
 elif [ ! -f "$HOOKS/prompt-approval.sh" ]; then
   fail "hooks/prompt-approval.sh is missing — in auto and dontAsk nothing can turn the user's own yes into an approval"
 else
@@ -7458,6 +7488,43 @@ else
   if [ "$_pc2" -ge 5 ] && [ "$_pc2" -le 12 ]; then pass "an approval costs it a handful of git calls ($_pc2 external commands for commit+push), paid once per approval"
   else fail "the approval hook ran $_pc2 external commands for one commit+push approval — outside 5..12, so either it measured nothing or it grew"; fi
 fi
+# ---- what the refusal tells the model to do (3.1.0, field report) ---------------------------------------------
+# In auto the refusal is the only instruction the model gets, and the user sees what the model makes of it. Two
+# things are pinned: with the recording hook wired it asks for one shape (the message in one block, one line with
+# the exact text to send back, the operation of THIS call); with the hook not wired it says the path is closed and
+# does not tell anyone to type an approval. Verdicts do not move: each case is refused, and a matching record is
+# still allowed whatever the wiring says. The case sets CLAUDE_PROJECT_DIR and HOME itself: both are read.
+_pa_new; mkdir -p "$_PA/home"
+_pa_gate(){ printf '{"session_id":"s","cwd":"%s","permission_mode":"%s","tool_name":"Bash","tool_input":{"command":"%s"}}' "$_paw" "$1" "$2" > "$_PA/pl.json"
+  ( cd "$_paw" && HOME="$_PA/home" CLAUDE_PROJECT_DIR="$_paw" CREW_GATE_LOG=/dev/null bash "$HOOKS/guard-bash.sh" < "$_PA/pl.json" >"$_PA/out" 2>"$_PA/err" ); _par=$?; _pae="$(cat "$_PA/err")"; }
+_pa_wire(){ printf '%s' "$1" > "$_paw/.claude/settings.json"; }
+_PAW_ON='{"hooks":{"UserPromptSubmit":[{"hooks":[{"type":"command","command":"bash .claude/hooks/prompt-approval.sh"}]}]}}'
+_parow=""
+_pa_want(){  # $1 = label, $2 = text that must be there, $3 = text that must not
+  case "$_par/$_pae" in 2/*"$2"*) case "$_pae" in *"$3"*) _parow="$_parow [$1: says '$3']" ;; esac ;; *) _parow="$_parow [$1: rc $_par, no '$2']" ;; esac; }
+_pa_wire "$_PAW_ON"
+_pa_gate auto 'git commit -m x';          _pa_want 'wired, commit' 'write only this: approve: commit' 'APPROVAL PATH IS CLOSED'
+                                          _pa_want 'wired, commit, one block' 'in ONE code block' 'approve: push'
+_pa_gate dontAsk 'git push origin feat/x'; _pa_want 'wired, push' 'write only this: approve: push' 'APPROVAL PATH IS CLOSED'
+_pa_gate auto 'git commit -m x';          _pa_want 'wired, Turkish line' 'yalnız şunu yaz: onay: commit' 'APPROVAL PATH IS CLOSED'
+rm -f "$_paw/.claude/settings.json"
+_pa_gate auto 'git commit -m x';          _pa_want 'no settings' 'APPROVAL PATH IS CLOSED' 'write only this'
+                                          _pa_want 'no settings, the ways' 'Shift+Tab' 'ONE code block'
+_pa_wire '{"note":"prompt-approval.sh","hooks":{"UserPromptSubmit":[{"hooks":[{"type":"command","command":"bash .claude/hooks/route-hint.sh"}]}]}}'
+_pa_gate auto 'git push origin feat/x';   _pa_want 'named before the event only' 'APPROVAL PATH IS CLOSED' 'write only this'
+_pa_wire '{"hooks":{"PreToolUse":[{"hooks":[{"type":"command","command":"bash .claude/hooks/guard-bash.sh"}]}]}}'
+_pa_gate auto 'git commit -m x';          _pa_want 'other events only' 'APPROVAL PATH IS CLOSED' 'write only this'
+rm -f "$_paw/.claude/settings.json"; _pa_wire "$_PAW_ON"; mv "$_paw/.claude/settings.json" "$_paw/.claude/settings.local.json"
+_pa_gate auto 'git commit -m x';          _pa_want 'wired in settings.local.json' 'write only this: approve: commit' 'APPROVAL PATH IS CLOSED'
+rm -f "$_paw/.claude/settings.local.json"
+if [ -z "$_parow" ]; then pass "the auto-mode refusal asks in one shape when the approval hook is wired, and says the path is closed when it is not (9 readings, each refused)"
+else fail "the auto-mode refusal does not say what it should:$_parow"; fi
+# The wiring changes a sentence, never the verdict: with no settings at all, a record the hook wrote still allows
+# its command, and the same command without the record is refused.
+_pa_say auto 'approve: commit' >/dev/null; _pa_gate auto 'git commit -m x'; _pav1="$_par"
+_pa_new; _pa_gate auto 'git commit -m x'; _pav2="$_par"
+[ "$_pav1/$_pav2" = 0/2 ] && pass "the wiring check moves no verdict: a recorded approval is allowed (rc 0) and its absence refused (rc 2) with no settings file" \
+                          || fail "the wiring check moved a verdict: approved $_pav1 (want 0), unapproved $_pav2 (want 2)"
 fi   # prompt-approval.sh present
 
 # ---- the two definitions that live in two files, and the wiring -----------------------------------------------

package/kit/hooks/context-usage.sh

@@ -103,7 +103,7 @@ if [ -n "${IN:-}" ] && [ -n "${PSID:-}" ]; then
           # In auto and dontAsk the user's own message is the approval (hooks/prompt-approval.sh); plan and
           # bypassPermissions have no such route.
           case "$PM" in
-            auto|dontAsk) PMHOW="stage the change and show the message, then the user approves by sending a message that is only 'approve: commit' ('approve: push', 'approve: commit+push'; 'onay:' works too). It covers what is staged at that moment, for 30 minutes, until their next message; never write it for them" ;;
+            auto|dontAsk) PMHOW="stage the change, show the message in ONE code block and under it one line in the user's language, 'If you approve, write only this: approve: commit' ('approve: push', 'approve: commit+push'; 'onay:' works too); the user approves by sending that text alone. It covers what is staged at that moment, for 30 minutes, until their next message; never write it for them" ;;
             *)            PMHOW="a real yes still comes first, then the user switches mode (or exports CLAUDE_GIT_OK=1 in headless/CI)" ;;
           esac
           echo "🔒 Permission mode: $PM. git commit/push fail closed in this mode (§4.4). Only when a commit or push comes up: say so before you ask for approval; $PMHOW. Otherwise do not mention it."

package/kit/hooks/guard-bash.sh

@@ -2355,6 +2355,26 @@ _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise
   [ -n "$tr" ] && [ "$cur" = "$tr" ] || { _APW="the commit on HEAD does not carry what the user approved"; return 1; }
   return 0
 }
+# IS THE RECORDING HOOK WIRED? Asked only when a commit or a push is about to be refused, so that the refusal names
+# a way that exists. It reads the settings this hook can see: the plugin's own hooks.json, the project's
+# settings.json and settings.local.json, the user's settings.json. HONEST SCOPE: the text of each file is searched
+# for the script's name after the event's name; it is not parsed, and managed settings are not read. A wrong answer
+# changes a sentence, never the verdict: the command is refused either way. eval/doctor.sh does the parsed check.
+_appr_wired(){  # 0 = prompt-approval.sh is beside this hook and a settings file wires it; else _APRW names what was read
+  local f t d="${CLAUDE_PROJECT_DIR:-.}" seen="" here="${BASH_SOURCE%/*}"
+  [ "$here" = "${BASH_SOURCE}" ] && here=.
+  d="${d//\\//}"; d="${d%/}"
+  _APRW="no prompt-approval.sh beside this hook"
+  [ -f "$here/prompt-approval.sh" ] || return 1
+  for f in "${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT//\\//}/hooks/hooks.json}" "$d/.claude/settings.json" "$d/.claude/settings.local.json" "${HOME:+${HOME//\\//}/.claude/settings.json}"; do
+    [ -n "$f" ] && [ -f "$f" ] || continue
+    seen="$seen${seen:+, }$f"
+    t=""; IFS= read -r -d '' t < "$f" || true
+    case "$t" in *'"UserPromptSubmit"'*prompt-approval.sh*) return 0 ;; esac
+  done
+  _APRW="read: ${seen:-no settings file found}"
+  return 1
+}
 allow_approved(){
   gatelog ALLOW 4.4 "the user's own approval message covers this command"
   printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"allow","permissionDecisionReason":"%s"}}\n' \
@@ -3144,11 +3164,22 @@ ${BRANCH_WARN}Approve only if the commit message above was shown to you and you
       gatelog BLOCK 4.4 "commit/push with no matching approval from the user"
       echo "GUARD (§4.4): 'git commit/push' needs the user's approval, and in '$PERM_MODE' a permission prompt is answered by software, not by a person." >&2
       echo "Not allowed now: $_APW." >&2
-      echo "Present the commit MESSAGE to the user (stage first: the approval covers what is staged at that moment). Then one of:" >&2
-      echo "  (a) the user sends a message that is ONLY the approval: 'approve: commit', 'approve: push' or 'approve: commit+push' ('onay: …' works too)." >&2
-      echo "      It is tied to the staged diff and HEAD at that moment, lasts 30 minutes and ends at the user's next message. The command then runs ALONE in its call (no cd, no pipe, nothing chained): git commit -m …, or git push <remote> <branch>. OR" >&2
-      echo "  (b) the user presses Shift+Tab to switch to default/acceptEdits — in this session, no restart — and this gate asks them directly, OR" >&2
-      echo "  (c) the user runs the command in their own terminal." >&2
+      if ! _appr_wired; then
+        # The record is written by one hook. Where it is not wired, a message from the user records nothing, and
+        # telling them to type one sends them into a wall (measured in the field: a worktree on an older Crewforth).
+        echo "THE APPROVAL PATH IS CLOSED IN THIS SESSION: the hook that records the user's approval (prompt-approval.sh) is not wired on UserPromptSubmit in the settings in effect ($_APRW). A message 'approve: …' records nothing here." >&2
+        echo "Tell the user exactly that, in their language, and give them the two ways that work: Shift+Tab to default/acceptEdits (this gate then asks them directly), or the command in their own terminal." >&2
+        echo "Do not create an approval any other way." >&2
+        exit 2
+      fi
+      _aps=push; git_has "$CMD_SEEN" 'commit' && _aps=commit
+      echo "ASK THE USER NOW, in their language, in this shape and with nothing after it (stage first: the approval covers what is staged at that moment):" >&2
+      echo "  1. the commit message, whole, in ONE code block;" >&2
+      echo "  2. under it ONE line:  If you approve, write only this: approve: $_aps" >&2
+      echo "     (in Turkish:  Onaylıyorsan yalnız şunu yaz: onay: $_aps). Name the one that fits: commit, push, or commit+push when a push follows the commit." >&2
+      echo "Their reply has to be that text alone: a sentence such as 'go ahead and commit' is not an approval. It is tied to the staged tree and HEAD, lasts 30 minutes and ends at their next message." >&2
+      echo "Then run the command ALONE in its call (no cd, no pipe, nothing chained): git commit -m '…', or git push <remote> <branch>." >&2
+      echo "The other ways: Shift+Tab to default/acceptEdits (this gate then asks them directly), or the command in their own terminal." >&2
       echo "Only the user can write that message. Do not write it for them, and do not create an approval any other way." >&2
       exit 2 ;;
     *)

package/kit/studio/server/index.js

@@ -19,6 +19,9 @@ import { fileURLToPath, pathToFileURL } from 'node:url';
 import { getFleet, measureSpawnCost } from './lib/fleet.js';
 import { projectDir, listSessions, findSession, listProjects, sessionCwd } from './lib/projects.js';
 import { buildGraph, agentDetail, conversation, STALE_MS } from './lib/graph.js';
+import { cachedUsage } from './lib/usage.js';
+
+const USAGE_BATCH = 12;
 import { palette } from './lib/palette.js';
 import { latestVersion, latestVersionCached, kitStatus } from './lib/kit.js';
 import { parsePeers, askAll, ask } from './lib/peers.js';
@@ -192,6 +195,21 @@ async function handle(req, res) {
     });
   }
 
+  // What a handful of sessions spent, for the navigator's rows. Asked for a few at a time and answered from a
+  // cache that lasts until a transcript grows: reading every transcript on the machine to draw a list is not
+  // something a page load should do.
+  if (url.pathname === '/api/usage') {
+    const ids = (url.searchParams.get('ids') ?? '').split(',').filter(Boolean).slice(0, USAGE_BATCH);
+    const usage = {};
+    for (const id of ids) {
+      const session = await findSession(id);
+      if (!session) continue;                 // a session on another machine: not read here, and not guessed
+      const u = await cachedUsage(session);
+      usage[id] = { durationMs: u.durationMs, workedMs: u.workedMs, tokens: u.tokens.total, cost: u.cost, unpriced: u.unpriced };
+    }
+    return sendJson(res, 200, { measured: true, usage });
+  }
+
   if (url.pathname === '/api/fleet') {
     const local = await getFleet();
     const mine = (local.sessions ?? []).map((sn) => ({ ...sn, origin: SELF_NAME, local: true }));

package/kit/studio/server/lib/graph.js

@@ -19,6 +19,8 @@ import path from 'node:path';
 
 import { readAll, contextFill } from './transcript.js';
 import { agentMetaFiles } from './projects.js';
+import { Usage, timesOf } from './usage.js';
+import { detailOf } from './permissions.js';
 
 const SESSION_NODE = 'session';
 
@@ -37,8 +39,12 @@ function textOf(content) {
  * pairs the first id with the status swallows the rest; measured on this
  * machine, one notice carried six ids and five were being dropped. Every id
  * seen since the previous status takes that status.
+ *
+ * `at` is when the record carrying the notice was written. A notice is not the end of an agent: Claude Code sends
+ * one each time a background agent stops, and the agent can be sent another message and work again. Whether a
+ * notice still stands is decided by comparing `at` with what the agent wrote afterwards.
  */
-function harvestCompletions(text, into) {
+function harvestCompletions(text, into, at = null) {
   if (!text || !text.includes('<task-id>')) return;
   const token = /<task-id>([^<]+)<\/task-id>|<status>([^<]+)<\/status>/g;
   let pending = [];
@@ -48,7 +54,7 @@ function harvestCompletions(text, into) {
       pending.push(m[1].trim());
     } else {
       const status = m[2].trim();
-      for (const id of pending) into.set(id, status);
+      for (const id of pending) into.set(id, { status, at });
       pending = [];
     }
   }
@@ -60,7 +66,9 @@ function scanMain(records) {
     startedAt: null, updatedAt: null,
     agentCalls: new Map(),   // toolUseId -> { subagentType, description }
     links: new Map(),        // toolUseId -> { agentId, status, model }
-    completions: new Map(),  // agentId  -> status
+    completions: new Map(),  // task id (an agent's, or a background command's) -> { status, at }
+    commands: new Map(),     // toolUseId -> the command a Bash call ran
+    background: new Map(),   // background task id -> { toolUseId, startedAt }
     owners: new Map(),       // toolUseId -> owner node id
     userTurns: 0,
   };
@@ -71,9 +79,11 @@ function scanMain(records) {
     if (r?.cwd && !out.cwd) out.cwd = r.cwd;
     if (r?.gitBranch && !out.gitBranch) out.gitBranch = r.gitBranch;
     if (r?.version && !out.version) out.version = r.version;
+    let at = null;
     if (r?.timestamp) {
       const t = Date.parse(r.timestamp);
       if (Number.isFinite(t)) {
+        at = t;
         if (out.startedAt === null || t < out.startedAt) out.startedAt = t;
         if (out.updatedAt === null || t > out.updatedAt) out.updatedAt = t;
       }
@@ -86,6 +96,7 @@ function scanMain(records) {
         for (const c of content) {
           if (c?.type === 'tool_use' && c.id) {
             out.owners.set(c.id, SESSION_NODE);
+            if (typeof c.input?.command === 'string') out.commands.set(c.id, c.input.command);
             if (c.name === 'Agent') {
               out.agentCalls.set(c.id, {
                 subagentType: c.input?.subagent_type ?? null,
@@ -95,12 +106,12 @@ function scanMain(records) {
           }
         }
       }
-      harvestCompletions(textOf(content), out.completions);
+      harvestCompletions(textOf(content), out.completions, at);
     }
 
     if (r?.type === 'user') {
       out.userTurns += 1;
-      harvestCompletions(textOf(r.message?.content), out.completions);
+      harvestCompletions(textOf(r.message?.content), out.completions, at);
     }
 
     // Present on the record that carries a subagent's result, whatever its type.
@@ -112,15 +123,81 @@ function scanMain(records) {
       if (id) out.links.set(id, entry);
       else out.links.set(`agent:${tur.agentId}`, entry);
     }
-    if (r?.type === 'attachment') harvestCompletions(JSON.stringify(r.attachment ?? ''), out.completions);
+    // A command sent to the background answers at once with the id it runs under; its end comes later, as a notice.
+    if (tur && typeof tur === 'object' && typeof tur.backgroundTaskId === 'string') {
+      const id = r.message?.content?.find?.((c) => c?.type === 'tool_result')?.tool_use_id ?? null;
+      out.background.set(tur.backgroundTaskId, { toolUseId: id, startedAt: at });
+    }
+    if (r?.type === 'attachment') harvestCompletions(JSON.stringify(r.attachment ?? ''), out.completions, at);
   }
 
   return out;
 }
 
+/**
+ * Does a transcript stop in the middle of a turn? It does when the last thing in it is a tool call with no answer,
+ * or an answer the agent has not replied to. A turn that is over ends on the agent's own words.
+ */
+export function midTurn(records) {
+  for (let i = records.length - 1; i >= 0; i -= 1) {
+    const r = records[i];
+    if (r?.type !== 'assistant' && r?.type !== 'user') continue;
+    const content = r.message?.content;
+    if (r.type === 'user') return true;
+    return Array.isArray(content) && content.some((c) => c?.type === 'tool_use');
+  }
+  return false;
+}
+
+// How long after a notice an agent's own last record may be and still belong to the turn the notice ended. The
+// notice is written after the agent's last record, so anything later than this is the agent working again.
+const NOTICE_SLACK_MS = 5000;
+
+/**
+ * Does a completion notice still say how the agent stands? Not when the agent wrote to its transcript after it:
+ * it was sent another message and is working, or has worked, again.
+ */
+export function noticeStands(notice, lastOwnAt) {
+  if (!notice) return false;
+  if (notice.at == null || lastOwnAt == null) return true;
+  return lastOwnAt <= notice.at + NOTICE_SLACK_MS;
+}
+
+// A call that hands work to an agent is open for as long as that agent runs; it is not a call anyone is asked about.
+const DELEGATES = new Set(['Agent', 'Task']);
+const OPEN_DETAIL_MAX = 2000;
+
+/**
+ * The tool calls a transcript has asked for and has no result for yet, oldest first.
+ *
+ * A call is open while it runs and while it waits for someone to allow it; the transcript does not say which. It
+ * is what a session started in a terminal is asking about when the machine reports it as waiting for its user —
+ * the panel has no hook in such a session, so this is the only place the question can be read from.
+ */
+export function openCalls(records) {
+  const open = new Map();
+  for (const r of records) {
+    const content = r?.message?.content;
+    if (!Array.isArray(content)) continue;
+    for (const c of content) {
+      if (r.type === 'assistant' && c?.type === 'tool_use' && c.id && !DELEGATES.has(c.name)) {
+        const at = Date.parse(r.timestamp ?? '');
+        const detail = detailOf(c.input);
+        open.set(c.id, {
+          toolUseId: c.id, toolName: c.name ?? 'unknown',
+          detail: detail === null ? null : detail.slice(0, OPEN_DETAIL_MAX),
+          at: Number.isFinite(at) ? at : null,
+        });
+      } else if (r.type === 'user' && c?.type === 'tool_result' && c.tool_use_id) open.delete(c.tool_use_id);
+    }
+  }
+  return [...open.values()];
+}
+
 /** Roll one agent's own transcript into the numbers its node shows. */
-async function scanAgent(file) {
+async function scanAgent(file, usage = null) {
   const { records } = await readAll(file);
+  usage?.add(records);
   const stats = {
     tools: {}, toolCount: 0, lastTool: null, errors: 0,
     tokens: null, startedAt: null, endedAt: null, turns: 0,
@@ -164,10 +241,12 @@ async function scanAgent(file) {
   stats.durationMs = stats.startedAt !== null && stats.endedAt !== null
     ? stats.endedAt - stats.startedAt
     : null;
+  stats.midTurn = midTurn(records);
+  stats.open = openCalls(records);
   return stats;
 }
 
-async function readAgentDir(subagentsDir) {
+async function readAgentDir(subagentsDir, usage = null) {
   const out = [];
   // Nested too: a workflow puts its agents under subagents/workflows/<id>/.
   for (const metaPath of await agentMetaFiles(subagentsDir)) {
@@ -185,7 +264,7 @@ async function readAgentDir(subagentsDir) {
     // `stats` needs the transcript read; a missing file is a normal state (the
     // agent has not written yet), so absence is a null rather than a throw.
     let stats = null;
-    if (mtime !== null) stats = await scanAgent(jsonl);
+    if (mtime !== null) stats = await scanAgent(jsonl, usage);
 
     out.push({
       agentId,
@@ -220,7 +299,9 @@ export const STALE_MS = 120000;
 export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
   const { records, malformed } = await readAll(session.file);
   const main = scanMain(records);
-  const agents = await readAgentDir(session.subagentsDir);
+  // What the session spent, its agents' tokens included and each response counted once.
+  const usage = new Usage().add(records);
+  const agents = await readAgentDir(session.subagentsDir, usage);
   const now = Date.now();
 
   // Ownership: session first, then every agent's own tool_use ids, so a nested
@@ -248,13 +329,26 @@ export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
     tokens: contextFill(records),
     startedAt: main.startedAt,
     endedAt: main.updatedAt,
+    usage: { ...usage.result(), ...timesOf(records) },
+    // Commands sent to the background that no notice has ended, oldest first. A session that is over has none
+    // running whatever this says: the page shows them only while the session is live.
+    backgroundCommands: [...main.background]
+      .filter(([id]) => !main.completions.has(id))
+      .map(([id, b]) => ({ id, toolName: 'Bash', detail: main.commands.get(b.toolUseId) ?? null, startedAt: b.startedAt }))
+      .sort((x, y) => (x.startedAt ?? 0) - (y.startedAt ?? 0)),
+    // The newest call nothing has answered, the session's own or an agent's. Null when every call has its result.
+    openCall: [
+      ...openCalls(records).map((c) => ({ ...c, agentId: null, agentType: null })),
+      ...agents.flatMap((a) => (a.stats?.open ?? []).map((c) => ({ ...c, agentId: a.agentId, agentType: a.agentType ?? null }))),
+    ].sort((a, b) => (b.at ?? 0) - (a.at ?? 0))[0] ?? null,
   }];
   const edges = [];
 
   for (const a of agents) {
     const call = a.toolUseId ? main.agentCalls.get(a.toolUseId) : null;
     const link = a.toolUseId ? byToolUse.get(a.toolUseId) : null;
-    const completion = main.completions.get(a.agentId) ?? null;
+    const notice = main.completions.get(a.agentId) ?? null;
+    const completion = noticeStands(notice, a.stats?.endedAt ?? null) ? notice.status : null;
 
     // Order matters. A synchronous Agent call never produces a task
     // notification — it reports through toolUseResult.status instead. Reading
@@ -288,6 +382,11 @@ export async function buildGraph(session, { staleMs = STALE_MS } = {}) {
       toolUseId: a.toolUseId,
       model: link?.model ?? null,
       launchStatus: link?.status ?? null,
+      // Started in the background, and its transcript stops in the middle of a turn. Such an agent can be quiet
+      // for a long time inside one tool call; whether it is still working is the live session's to say, so the
+      // page decides (graph-plan.js `settle`), not this file.
+      background: link?.status === 'async_launched',
+      midTurn: a.stats?.midTurn ?? false,
       parentId,
       tools: a.stats?.tools ?? {},
       toolCount: a.stats?.toolCount ?? 0,

package/kit/studio/server/lib/permissions.js

@@ -74,6 +74,16 @@ function gateMode(mode) {
   return typeof mode === 'string' && /^[A-Za-z]+$/.test(mode) ? `CREW_GATE_MODE=${mode} ` : '';
 }
 
+/**
+ * The most identifying field each tool has. Showing "Bash" alone would ask someone to approve a command they
+ * cannot see.
+ */
+export function detailOf(input) {
+  const i = input && typeof input === 'object' ? input : {};
+  const d = i.command ?? i.file_path ?? i.pattern ?? i.query ?? i.description ?? null;
+  return typeof d === 'string' ? d : null;
+}
+
 /** One pending request, as the panel needs to show it. */
 function readRequest(spool, file) {
   const toolUseId = file.replace(/\.json$/, '');
@@ -87,9 +97,7 @@ function readRequest(spool, file) {
   return {
     toolUseId,
     toolName: payload.tool_name ?? 'unknown',
-    // The most identifying field each tool has. Showing "Bash" alone would ask
-    // someone to approve a command they cannot see.
-    detail: input.command ?? input.file_path ?? input.pattern ?? input.query ?? input.description ?? null,
+    detail: detailOf(input),
     input,
     cwd: payload.cwd ?? null,
     // Who asked. Claude Code puts these in the hook's input only when the call comes from inside a subagent, so