crewforth 3.1.0-rc.2 → 3.1.0-rc.4

package/CHANGELOG.md

@@ -9,6 +9,21 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Security
 
+- **A session could start another one and hand it the approval.** `claude -p "/crew-approve commit"` starts a session
+  whose only message is the approval; it was recorded there, and that session would then commit and push: the first
+  session had approved for you. Two things changed. The recording hook writes nothing in a headless session
+  (Claude Code marks one with `CLAUDE_CODE_SESSION_ATTENDED=0`, whatever its caller sets), and nothing unless the
+  session's transcript is already on disk, so not at a session's first message and not in a session started inside
+  another, which keeps none; each refusal says why. And `guard-bash.sh` refuses a command that names `claude` (also
+  through `npx`, `bunx` or `node`) when one of its words is an approval, judged by the function that reads your own
+  prompt. An ordinary `claude -p "…"` is untouched. Known limit: a session started with an emptied environment and
+  typed into by a program, for a second message, passes both.
+- **A session could schedule its own approval.** In `auto` and `dontAsk` the approval for a commit or a push is what
+  you type, and the hook that records it reads the prompt Claude Code hands it. A prompt that a tool schedules
+  (`CronCreate`, `ScheduleWakeup`, `RemoteTrigger`, an MCP tool that schedules) is handed to it in the same way when
+  it fires, so a session that scheduled `/crew-approve commit` would have approved its own commit. A new gate,
+  `guard-schedule.sh`, refuses such a call when any text in it is an approval, judged by the one function that reads
+  your own prompt. An ordinary scheduled prompt is untouched.
 - **A git subcommand the shell fills in walked past every gate.** Each rule about a git command finds it by its name,
   and with an expansion inside the word the name is not in the text: `git com${z}mit`, `c=commit; git "$c"`, `git
   $(printf com)mit`, a backtick, and the same for `git pu${z}sh --force`, `git re$(:)set --hard`, `git cl${z}ean -fdx`
@@ -90,10 +105,10 @@ versioning follows [SemVer](https://semver.org/).
   and no ad in a window that shows a sensitive screen. The rules were checked against Flutter's, Dart's and the
   named packages' and platforms' own pages; the sources, and what was not checked, are in the skill's `references/`.
   40 skills now.
-- **In `auto` and `dontAsk`, your own message approves a commit or a push.** Those modes answer a permission prompt
-  with software, so the commit gate fails closed there and the only way through was to switch mode for every commit.
-  Now a message that is nothing but `approve: commit`, `approve: push` or `approve: commit+push` (`onay:` works too)
-  is recorded by a new hook, `prompt-approval.sh`, with what git reports at that moment: the tree of what is staged
+- **In `auto` and `dontAsk`, a command you type approves a commit or a push: `/crew-approve`.** Those modes answer
+  a permission prompt with software, so the commit gate fails closed there and the only way through was to switch
+  mode for every commit. Now a message that is nothing but `/crew-approve commit`, `/crew-approve push` or
+  `/crew-approve commit+push` is recorded by a new hook, `prompt-approval.sh`, with what git reports at that moment: the tree of what is staged
   and `HEAD` for a commit; `HEAD`, the branch, its remote and the address that remote pushes to for a push; and the
   session you wrote in. The confirmation you see names that address. `guard-bash.sh` then allows one call and no other: `git commit -m …` alone (a single-quoted
   message, or one read from a here-document with a quoted delimiter; `-q`, `-s`, `-v`), or
@@ -118,9 +133,50 @@ versioning follows [SemVer](https://semver.org/).
 - **Studio: a layout for a narrow window.** Below 640 px the panel is one column: the navigator is a drawer, the
   inspector and the conversation take the whole stage and stop above the dock. Checked in a narrow desktop browser
   window; not measured on a phone.
+- **Studio: what a session spent.** A summary box on the canvas and one line in the navigator give the session's
+  time, its tokens (agents included) and an estimate of the cost, such as `51m · 2.8M · ~$3.22`. The cost is an
+  estimate at API list price and reads as one (a leading `~`; on a subscription it is not what you are billed). The
+  prices are one table, read from the pricing page on 2026-10-08; a model with no row in it shows `—`, never a guess.
+  Not checked against an invoice.
+- **Studio: the order the session called its agents in.** Each agent's card says its place and the time
+  (`#3 · 09:14`). **Order**, in the Group menu, lays the agents out by wave: the agents called in one message are a
+  wave, waves run left to right, and the Timeline groups by the same waves. A later wave is wired, dotted, from each
+  agent that reported before it was called, with the words `after Planner reported`; that wire is inferred from the
+  order of events and is not a call from one agent to another, and the panel says so. Read from the transcript
+  alone. Agents a workflow started are not called by the session, so they carry no place.
+- **Studio: background work is shown.** A Bash command sent to the background is listed on its session (`1 in
+  background` on the card, **In the background** in the inspector) until the notice that ends it arrives.
+- **Studio: a question waiting in a terminal is named.** For a session started in a terminal, a permission question
+  can only be answered there; the view now says so, with the tool and the command: `Waiting for an answer in the
+  terminal: Bash · npm run build`.
+- **Studio: the inspector can be resized** (drag its left edge, arrow keys, double-click for the default; 280 to
+  720 px, remembered).
 
 ### Changed
 
+- **Studio: agents are named by their role.** `crew-backend-expert` reads Backend, `general-purpose` General Purpose,
+  in the graph, the Timeline, the List, the dock, the inspector and the conversation; the declared type is under the
+  name in the inspector and on hover. A task cut short on a card is said in full on hover.
+- **Studio: a group of agents opens beside itself.** Several agents of one type are one card; in a window of 1024 px
+  and up, clicking it puts its agents in the next column as ordinary cards, and opening another group folds the
+  first. Below that width it opens downward as before.
+- **The approval of 3.1.0's release candidates was a text, `approve: commit` (`onay: commit`); it is the command
+  `/crew-approve commit` now.** The same in every language, and recorded exactly as the text was. Only a command you
+  type counts: measured on Claude Code 2.1.284, a typed command reaches the recording hook as typed, a skill the
+  model starts itself does not reach it at all, and Claude Code refuses to let the model start this one. The text
+  still works; the refusals and the documentation name the command only.
+- **In `auto` and `dontAsk`, a refused commit or push says what to ask and what to send back.** The refusal was a
+  paragraph with the approval text somewhere inside it, and the question the model made of it was as long. It now
+  asks for one shape: the commit message in one code block and, under it, one line with the command to send, named
+  for the call that was refused. A sentence that says yes is still not an approval, and nothing about what an
+  approval covers has changed.
+- **Where the approval cannot be recorded, the refusal says so.** The record is written by `prompt-approval.sh`. In a
+  session whose settings do not wire it (a worktree that carries an older Crewforth, for one) the approval
+  recorded nothing, and the refusal went on asking for it. The gate now reads the settings it can
+  see (the plugin's `hooks.json`, the project's `settings.json` and `settings.local.json`, the user's
+  `settings.json`) and, when none wires the hook, says the approval path is closed in this session and names the
+  two ways that work: Shift+Tab, or your own terminal. The command is refused either way. `doctor.sh` warns about
+  the same thing, and about a worktree of the repository that carries another Crewforth version.
 - **After a final release, npm's `next` no longer names something older than `latest`.** A final moved `latest`
   only, so `npx crewforth@next` went on installing the rc before it. The release now moves `next` to the final when
   what `next` names is older; an rc of a later version stays where it is.
@@ -205,6 +261,16 @@ versioning follows [SemVer](https://semver.org/).
   the same (measured on Windows, in a real session), and the conversation says who refused it. Known limit: the dock
   can ask about a call that another gate refuses anyway.
 
+### Fixed
+
+- **Studio: full screen keeps its panels.** In full screen the navigator, the inspector and the conversation could
+  not be opened, so a selected agent showed nothing and a request under "Needs you" could not be answered. A style
+  rule hid every panel there; it is gone, and full screen now only takes the browser away.
+- **Studio: a background agent that is still working is no longer drawn "Done".** Claude Code sends a `completed`
+  notice each time a background agent stops, and the agent can be resumed after it; Studio took the first notice as
+  final. A notice now stands only until the agent writes to its transcript again, and while its session is running
+  an agent in the middle of a turn is drawn Running.
+
 ## [3.0.4] — 2026-10-05
 
 ### Security

package/README.md

@@ -30,7 +30,7 @@ Then open Claude Code and run `/crew-doctor` to confirm the setup. Requires bash
 
 - **12 specialist agents**, from `crew-planner` to `crew-commit-agent`, each owning one domain.
 - **40 skills** holding the method: testing, migrations, API contracts, observability, accessibility, deployment.
-- **10 commands**, each started with its `/crew-…` name: `/crew-plan`, `/crew-review`, `/crew-ship`, `/crew-handoff`, `/crew-brainstorm`, `/crew-update`, `/crew-doctor`, `/crew-gates`, `/crew-skill`, `/crew-studio`.
+- **11 commands**, each started with its `/crew-…` name: `/crew-plan`, `/crew-review`, `/crew-ship`, `/crew-handoff`, `/crew-brainstorm`, `/crew-update`, `/crew-doctor`, `/crew-gates`, `/crew-skill`, `/crew-studio`, `/crew-approve`.
 - **Safe adoption.** `adopt` lands everything on a branch, staged and uncommitted; `main` is never touched.
 
 ## Updating

package/kit/agents/crew-commit-agent.md

@@ -87,8 +87,11 @@ On a mixed/non-atomic diff, **propose a split**; do not commit before approval (
   The tool-level gate `guard-bash.sh` intercepts commit/push in **every** permission mode: in normal modes it raises an
   approval prompt only the user can answer — so present the message FIRST, then run the commit yourself and let the user
   approve it at the prompt. Never hand the user a command to paste into their own terminal. In `auto` and `dontAsk`
-  the prompt reaches nobody: stage, present the message, and the user approves by sending a message that is only
-  `approve: commit` (`approve: push`, `approve: commit+push`; `onay:` too). It covers what is staged on that HEAD.
+  the prompt reaches nobody: stage, then ask in this shape and with nothing after it — the message in ONE code block,
+  and under it one line, the sentence in the user's language and the command as it is: "If you approve, send only
+  this: `/crew-approve commit`" (or `/crew-approve push`, `/crew-approve commit+push`). The user approves by sending
+  that command alone; a sentence that says yes is not an approval, and you cannot run `/crew-approve` for them. It covers what is staged on that HEAD. If the gate says the approval path is closed in this session (the
+  recording hook is not wired), say so and offer Shift+Tab or their own terminal instead.
   Then run `git commit -m '…'` alone in its call (single-quoted, or from a here-document with a quoted delimiter),
   and a push as `git push <remote> <branch>`. Never write that message yourself. Under `plan` and
   `bypassPermissions` the gate fails closed; there the user must switch modes or pre-authorise with

package/kit/eval/doctor.sh

@@ -96,6 +96,10 @@ _mt() {
       'SessionStart not wired — session rehydration after /compact or /clear is inactive (update Crewforth)') s="SessionStart bağlı değil — /compact ya da /clear sonrasında oturum toparlanmıyor (Crewforth'u güncelleyin)" ;;
       'SessionStart wired (session rehydration active)') s='SessionStart bağlı (oturum toparlama devrede)' ;;
       'settings.json is invalid JSON') s='settings.json geçersiz JSON' ;;
+      'approval by your own message is wired (auto / dontAsk: /crew-approve commit)') s='kendi mesajınızla onay bağlı (auto / dontAsk: /crew-approve commit)' ;;
+      "settings.json wires prompt-approval.sh but the script is missing — in auto and dontAsk '/crew-approve commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)") s="settings.json prompt-approval.sh'i bağlıyor ama betik yok — auto ve dontAsk modunda '/crew-approve commit' hiçbir şey kaydetmez; Shift+Tab ile mod değiştirin ya da kendi terminalinizden commit edin (Crewforth'u güncelleyin)" ;;
+      "prompt-approval.sh is not wired on UserPromptSubmit — in auto and dontAsk '/crew-approve commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)") s="prompt-approval.sh UserPromptSubmit'e bağlı değil — auto ve dontAsk modunda '/crew-approve commit' hiçbir şey kaydetmez; Shift+Tab ile mod değiştirin ya da kendi terminalinizden commit edin (Crewforth'u güncelleyin)" ;;
+      "worktree %s carries Crewforth %s, this one %s — a session there runs that version's gates and approval path (update Crewforth there)") s="%s worktree'sinde Crewforth %s var, burada %s — orada açılan oturum o sürümün kapılarını ve onay yolunu koşar (Crewforth'u orada güncelleyin)" ;;
       "fix the syntax by hand — restoring Crewforth's file would drop any hooks you added") s="sözdizimini elle düzeltin — Crewforth'un dosyasını geri yüklemek eklediğiniz hook'ları siler" ;;
       'settings.json wires hooks through the %s placeholder — on Windows its separators are stripped before bash runs, so NO hook launches and every gate is silently absent') s="settings.json hook'ları %s yer tutucusuyla bağlıyor — Windows'ta ayırıcılar bash çalışmadan silinir, bu yüzden HİÇBİR hook başlamaz ve bütün kapılar sessizce yok olur" ;;
       'update Crewforth (npx crewforth adopt) — hook commands become:') s="Crewforth'u güncelleyin (npx crewforth adopt) — hook komutları şu olur:" ;;
@@ -349,6 +353,14 @@ if [ -f "$S" ]; then
                     || bad "settings.json hook events empty or missing:%s — those gates won't fire" "restore settings.json from Crewforth (npx crewforth update)" "$EMPTY"
     sn="$(awk -v op=len -v path=hooks.SessionStart -f "$SJ" "$S" 2>/dev/null)"
     case "$sn" in ''|0) warn "SessionStart not wired — session rehydration after /compact or /clear is inactive (update Crewforth)" ;; *) ok "SessionStart wired (session rehydration active)" ;; esac
+    # In auto and dontAsk the only approval is the user's own message, and ONE hook records it. Where it is not wired
+    # the gate stays closed and '/crew-approve commit' records nothing (field report: a worktree on an older
+    # Crewforth). A warning, not a failure: commit and push still cannot happen without the user.
+    case "$(awk -v op=get -v path=hooks.UserPromptSubmit -f "$SJ" "$S" 2>/dev/null)" in
+      *prompt-approval.sh*) if [ -f .claude/hooks/prompt-approval.sh ]; then ok "approval by your own message is wired (auto / dontAsk: /crew-approve commit)"
+                            else warn "settings.json wires prompt-approval.sh but the script is missing — in auto and dontAsk '/crew-approve commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)"; fi ;;
+      *) warn "prompt-approval.sh is not wired on UserPromptSubmit — in auto and dontAsk '/crew-approve commit' records nothing; switch mode with Shift+Tab or commit in your own terminal (update Crewforth)" ;;
+    esac
   else bad "settings.json is invalid JSON" "fix the syntax by hand — restoring Crewforth's file would drop any hooks you added"; fi
   # `${CLAUDE_PROJECT_DIR}` inside a hook command is the shape that breaks on Windows, and it breaks invisibly.
   # Claude Code substitutes that placeholder into the command STRING before any shell sees it; on Windows the
@@ -370,6 +382,20 @@ if [ -f "$S" ]; then
 else
   bad "settings.json missing — the tool-level gates (commit approval, guards, context) are INACTIVE" "reinstall Crewforth"
 fi
+# 4b) Another worktree of this repository on another Crewforth. A session that moves there runs THAT version's hooks
+#     against this one's expectations: its gates, its approval path (3.0 has none for auto mode). `.claude/` is
+#     tracked in some projects, so a worktree cut from an older branch carries the older kit.
+if [ -f .claude/VERSION ] && git rev-parse --git-dir >/dev/null 2>&1; then
+  _wv0="$(head -1 .claude/VERSION 2>/dev/null | tr -cd '0-9A-Za-z.-')"; _wt0="$(git rev-parse --show-toplevel 2>/dev/null)"
+  while IFS= read -r _wl; do
+    case "$_wl" in "worktree "*) _wp="${_wl#worktree }" ;; *) continue ;; esac
+    [ "$_wp" != "$_wt0" ] && [ -f "$_wp/.claude/VERSION" ] || continue
+    _wv="$(head -1 "$_wp/.claude/VERSION" 2>/dev/null | tr -cd '0-9A-Za-z.-')"
+    [ "$_wv" = "$_wv0" ] || warn "worktree %s carries Crewforth %s, this one %s — a session there runs that version's gates and approval path (update Crewforth there)" "$_wp" "${_wv:-?}" "$_wv0"
+  done <<EOF_WT
+$(git worktree list --porcelain 2>/dev/null)
+EOF_WT
+fi
 
 # 4a) Skill listing budget. Claude Code puts a listing of every model-invocable skill's name and description into
 #     context each turn and caps it at skillListingBudgetFraction of the context window (default 0.01); over the