crewforth 3.1.0-rc.4 → 3.1.0-rc.6

package/kit/hooks/guard-bash.sh

@@ -1375,7 +1375,7 @@ fi
 # the shell is Turing-complete, so this is defence-in-depth — guard-write.sh covers the Write/Edit tools (the
 # model's natural path to a file), and install-time read-only hook files would be the airtight layer.
 _GP='[/\\]+(\.[/\\]+)*'      # a path separator as the shell and the filesystem take it: `/`, `\`, doubled, with `/./` between
-GATE='(\.(claude'"$_GP"'(hooks|git-shim|settings\.json|DISCIPLINE\.md|eval'"$_GP"'lib'"$_GP"'crew-env\.sh)|git'"$_GP"'hooks|git'"$_GP"'(config|worktrees'"$_GP"'[^/\\[:space:]]+'"$_GP"'config|modules'"$_GP"'[^[:space:]]+'"$_GP"'config))|\.gitconfig([^A-Za-z0-9_.-]|$)|\.config'"$_GP"'git'"$_GP"'config([^A-Za-z0-9_.-]|$))'
+GATE='(\.(claude'"$_GP"'(hooks|git-shim|settings\.json|settings\.local\.json|DISCIPLINE\.md|eval'"$_GP"'lib'"$_GP"'crew-env\.sh)|git'"$_GP"'hooks|git'"$_GP"'(config|worktrees'"$_GP"'[^/\\[:space:]]+'"$_GP"'config|modules'"$_GP"'[^[:space:]]+'"$_GP"'config))|\.gitconfig([^A-Za-z0-9_.-]|$)|\.config'"$_GP"'git'"$_GP"'config([^A-Za-z0-9_.-]|$))'
 # .git/config (with a worktree's and a submodule's own) is on the list because core.hooksPath LIVES there: the rules
 # above stop `git config core.hooksPath …`, and a plain `printf '[core]\n\thooksPath = /dev/null\n' >> .git/config`
 # walked past them — after it a commit from the user's own terminal skips the trace and secret scans (measured, 3.1.0
@@ -1897,6 +1897,31 @@ _appr_in_claude_call(){  # 0 = a word of this command is an approval (OP names i
   [ "$inw" = 1 ] && _appr_word "$w" && return 0
   return 1
 }
+# What model routing decides from is written by the user and by Crewforth's own hooks (guard-write.sh has the same rule
+# for the file tools): the user's rules, the floors, the list of critical paths, and the records of calls and results.
+# A command that NAMES one is refused, reading included; model-outcomes.tsv, the plain record, may be read. The
+# name is `crew-model…` for all of them (the rules, the floors, the user's lowerings, the records of calls).
+# HONEST SCOPE: this stops an accident and a plain attempt, not a determined one. A command that builds the name
+# from pieces (`f=crew-mo; … ${f}del-loosened.tsv`), writes through an interpreter (`python3 -c`), or moves a
+# folder above it (`cd .claude && mv state x`) spells none of what is matched here and is past this rule.
+_mr_named(){ local nc=0 rc=1; shopt -q nocasematch && nc=1; shopt -s nocasematch
+  case "$CMD_UQ" in *crew-model*|*crew-critical-paths*) rc=0 ;; esac
+  # ...and by a glob that could reach one, or the folder itself in a command that moves, copies or removes: a word
+  # that holds `.claude/state` and a wildcard, or that IS that folder beside rm, mv, cp, rmdir, rsync, tar or ln.
+  if [ "$rc" = 1 ]; then
+    local w unglob=0 verb=0
+    case "$-" in *f*) ;; *) unglob=1; set -f ;; esac
+    for w in $CMD_UQ; do case "$w" in rm|mv|cp|rmdir|rsync|tar|ln|*/rm|*/mv|*/cp) verb=1 ;; esac; done
+    for w in $CMD_UQ; do
+      case "$w" in
+        *.claude[/\\]state[/\\]*[\*\?\[]*|*.claude[/\\]state[\*\?\[]*) rc=0 ;;
+        *.claude[/\\]state|*.claude[/\\]state[/\\]) [ "$verb" = 1 ] && rc=0 ;;
+      esac
+    done
+    [ "$unglob" = 1 ] && set +f
+  fi
+  [ "$nc" = 0 ] && shopt -u nocasematch; return "$rc"; }
+_mr_named && block "a model routing record named in a command (the user and Crewforth's hooks write it)" "4.5" tamper
 _appr_in_claude_call && block "a command that hands a Claude Code session an approval as its prompt (only the user's own message approves)" "4.4" tamper
 
 # §4.5-adjacent: a .env file holds secrets. The settings.json Read-tool deny does NOT cover the Bash tool, so a

package/kit/hooks/guard-schedule.sh

@@ -81,8 +81,13 @@ while IFS= read -r sv; do
   [ -n "$sv" ] || continue
   _json_unescape "$sv" >/dev/null; _crew_appr_op "$_JU"
   if [ -n "$OP" ]; then
-    echo "GUARD (§4.4): this call schedules a prompt that is an approval for a commit or a push ($OP). An approval is what the user types; a prompt a tool schedules would approve in their place, so the call is refused." >&2
-    echo "Schedule the work without it. For the approval itself, show the commit message and ask: the user can type /crew-approve $OP when they agree." >&2
+    if [ "$OP" = loosen ]; then
+      echo "GUARD (§4.4): this call schedules a prompt that lowers a model floor. Only the user can type /crew-loosen; a prompt a tool schedules would lower the floor in their place, so the call is refused." >&2
+      echo "Schedule the work without it. If a floor looks too high, say so: the user can type /crew-loosen $LO_AGENT $LO_CHANGE $LO_RISK themselves." >&2
+    else
+      echo "GUARD (§4.4): this call schedules a prompt that is an approval for a commit or a push ($OP). An approval is what the user types; a prompt a tool schedules would approve in their place, so the call is refused." >&2
+      echo "Schedule the work without it. For the approval itself, show the commit message and ask: the user can type /crew-approve $OP when they agree." >&2
+    fi
     exit 2
   fi
 done <<< "$strs"

package/kit/hooks/guard-write.sh

@@ -387,6 +387,7 @@ block(){  # $1 = rule name for the log (must keep the `gate-file edit` prefix
 WHY_SCRIPT="This file is a gate script — rewriting it would disarm the trace/secret/approval gates."
 WHY_DISC="This file is Crewforth's discipline document — it IS the text of §4.1-§4.5, so editing it empties the rules the gates enforce."
 WHY_LINK="A parent directory of this path is a symlink and it resolves into a gate directory, so the write would land on a gate file."
+WHY_MODEL="This file is what model routing decides from: the user's rules, a class's floor, the critical paths, or the record of a call and its result. Only the user and Crewforth's own hooks write it, so a session cannot lower its own floor or erase its own failure."
 WHY_APPR="This file records the user's own approval for a commit or a push (§4.4). Only the user's message writes it, so a session cannot approve its own commit."
 WHY_GITCFG="This file holds core.hooksPath: writing it can switch the git hooks off without touching one of them. Settings go through git config, which the Bash guard reads."
 WHY_LONG="The path in this payload is longer than any filesystem accepts. It is refused rather than parsed, because parsing it is the slow path an attacker would aim at."
@@ -544,6 +545,13 @@ _is_gate(){   # 0 = gate file; sets GATE_RULE and GATE_WHY
     # Matched by name wherever it is: a linked worktree keeps its git directory elsewhere.
     */[Cc][Rr][Ee][Ww][Ff][Oo][Rr][Tt][Hh]-[Aa][Pp][Pp][Rr][Oo][Vv][Aa][Ll]|[Cc][Rr][Ee][Ww][Ff][Oo][Rr][Tt][Hh]-[Aa][Pp][Pp][Rr][Oo][Vv][Aa][Ll])
       GATE_RULE="approval-record edit (Write/Edit tools)"; GATE_WHY="$WHY_APPR"; return 0 ;;
+    # What model routing decides from (hooks/guard-agent-model.sh, hooks/agent-outcome.sh): the user's own rules,
+    # the floors raised from the record of outcomes, the list of critical paths, and the records of calls and
+    # results. A session that writes one lowers its own floor or wipes its own failure.
+    */.[Cc][Ll][Aa][Uu][Dd][Ee]/[Cc][Rr][Ee][Ww]-[Mm][Oo][Dd][Ee][Ll]-[Rr][Uu][Ll][Ee][Ss]|.[Cc][Ll][Aa][Uu][Dd][Ee]/[Cc][Rr][Ee][Ww]-[Mm][Oo][Dd][Ee][Ll]-[Rr][Uu][Ll][Ee][Ss]\
+    |*/.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Cc][Rr][Ee][Ww]-*|.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Cc][Rr][Ee][Ww]-*\
+    |*/.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Mm][Oo][Dd][Ee][Ll]-[Oo][Uu][Tt][Cc][Oo][Mm][Ee][Ss].[Tt][Ss][Vv]|.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Mm][Oo][Dd][Ee][Ll]-[Oo][Uu][Tt][Cc][Oo][Mm][Ee][Ss].[Tt][Ss][Vv])
+      GATE_RULE="gate-file edit (model routing record)"; GATE_WHY="$WHY_MODEL"; return 0 ;;
   esac
   # core.hooksPath lives in git's configuration files: the repository's (.git/config, with a linked worktree's and a
   # submodule's own) and the user's (~/.gitconfig, ~/.config/git/config). Writing one switches the git hooks off without
@@ -602,6 +610,29 @@ while case "$_anc" in */*) true ;; *) false ;; esac; do
   fi
 done
 
+# ---- model routing: an agent that is not on opus does not write to a critical path ------------------------------
+# The card a crew agent is called with can leave a file out, so the files it names are not the last word: the
+# write itself is checked. Asked only of a call that comes from inside an agent (the payload then carries agent_id;
+# measured on Claude Code 2.1.294), so the session's own writes pay one test of the payload's text and nothing else.
+# One definition of "critical path" and of "which model is this agent on": hooks/guard-agent-model.sh, sourced.
+case "$INPUT" in *'"agent_id"'*)
+  if [ "${CREW_MODEL_ROUTING:-}" != off ]; then
+    _gwm="${BASH_SOURCE%/*}"; [ "$_gwm" = "${BASH_SOURCE}" ] && _gwm=.
+    if [ -f "$_gwm/guard-agent-model.sh" ]; then
+      . "$_gwm/guard-agent-model.sh"
+      declare -F _am_write_check >/dev/null 2>&1 && _am_write_check "$INPUT" "$FP"
+      # An agent does not write the settings files either: a Bash(...) rule in permissions.allow is one of the two
+      # ways the USER allows a verify command by name, and an agent that could add one would allow its own.
+      case "${FP//\\//}" in
+        */.claude/settings.json|.claude/settings.json|*/.claude/settings.local.json|.claude/settings.local.json)
+          declare -F _am_log >/dev/null 2>&1 && _am_log "a settings file written from inside an agent"
+          echo "GUARD (agent model): an agent does not write ${FP##*/}: a permission rule there decides which verify command a hook may run, and that is the user's to give. Stop, say what you wanted to change, and end your report with confidence: low" >&2
+          exit 2 ;;
+      esac
+    fi
+  fi ;;
+esac
+
 # ---- team board: you may not start work nobody knows you started -----------------------------------------------
 # The claim lock already makes it impossible for two people to HOLD the same item — a losing claim is refused in
 # under a second, before any code exists. The hole this closes is the other one: somebody who never claims at all.

package/kit/hooks/prompt-approval.sh

@@ -358,20 +358,24 @@ _crew_appr_path(){  # $1 = a directory -> _AP: the record's path in that worktre
 
 # ---- WHICH TEXT IS AN APPROVAL: one function, asked here of the user's prompt and by guard-schedule.sh of a
 # prompt a tool is about to schedule ---------------------------------------------------------------------------
-_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push, or "" when the text is not an approval
-  local P="$1" _k _v LC_ALL=C
-  OP=""
+_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | loosen, or "" when the text is neither
+  # `loosen` is the other thing only the user's own message does: `/crew-loosen <agent> <change> <risk>` lowers a
+  # floor that model routing raised (3.1.0). It is matched HERE so that everything that refuses to hand a session
+  # an approval (a scheduled prompt, a `claude -p` call) refuses to hand it this as well: one question, one answer.
+  local P="$1" _k _v _vr LC_ALL=C
+  OP=""; LO_AGENT=""; LO_CHANGE=""; LO_RISK=""
   P="${P//$'\r'/}"
   while :; do case "$P" in [$' \t\n']*) P="${P:1}" ;; *) break ;; esac; done
   while :; do case "$P" in *[$' \t\n']) P="${P%?}" ;; *) break ;; esac; done
-  [ "${#P}" -le 40 ] || return 0
+  [ "${#P}" -le 90 ] || return 0
+  _vr=""
   case "$P" in
     *$'\n'*) return 0 ;;
     # THE COMMAND: `/crew-approve <what>`, or `/<plugin>:crew-approve <what>` as a plugin names its commands. Measured
     # on Claude Code 2.1.284: a command the user types reaches UserPromptSubmit with `prompt` as typed, and a skill
     # the model starts with the Skill tool raises PreToolUse and PostToolUse only, never that event.
     /*) _k="${P%%[$' \t']*}"; [ "$_k" != "$P" ] || return 0
-        _v="${P:${#_k}}"; _k="${_k#/}"; _k="@${_k##*:}" ;;      # `@`: a command, so `crew-approve: commit` as text is not one
+        _v="${P:${#_k}}"; _vr="$_v"; _k="${_k#/}"; _k="@${_k##*:}" ;;      # `@`: a command, so `crew-approve: commit` as text is not one
     # The text form of 3.1.0's release candidates, kept: `approve: <what>` and `onay: <what>`.
     *:*) _k="${P%%:*}"; _v="${P#*:}" ;;
     *) return 0 ;;
@@ -384,6 +388,15 @@ _crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push, or
       case "$_v" in commit) OP=commit ;; push) OP=push ;; commit+push) OP=commit+push ;; esac ;;
   esac
   shopt -u nocasematch
+  # The second command is read as it is written, lower case, with exactly three words after it.
+  if [ "$_k" = "@crew-loosen" ]; then
+    local a b c d
+    IFS=$' \t' read -r a b c d <<< "$_vr"
+    [ -n "${c:-}" ] && [ -z "${d:-}" ] || return 0
+    case "$a" in crew-*) ;; *) return 0 ;; esac; case "$a$b" in *[!a-z0-9-]*) return 0 ;; esac
+    case "$c" in critical|normal) ;; *) return 0 ;; esac
+    OP=loosen; LO_AGENT="$a"; LO_CHANGE="$b"; LO_RISK="$c"
+  fi
 }
 
 [ "$_PA_LIB" = 1 ] && return 0
@@ -433,6 +446,43 @@ say(){  # $1 = for the user, $2 = for the model. Both are built from fixed text
 }
 no(){ say "Crewforth: approval NOT recorded - $1" "The user's message is an approval for $OP, but Crewforth could not record it: $1 Tell the user exactly that; the commit/push gate stays closed until they approve again."; }
 
+# ---- /crew-loosen: a floor model routing raised is lowered by the user, and by nobody else ----------------------
+# hooks/agent-outcome.sh raises a class's floor when its first try fails too often, and nothing lowers it again but
+# this. The same proof as for an approval that a person is typing into their own session: the turn is not a
+# notice or another session's message (above), the session is not a headless one, and it has a transcript already,
+# so this is not the prompt a command or a schedule started a session with. In every permission mode: this is not
+# a commit. ONE model down, ONCE for each time the floor was raised; the record of outcomes is counted afresh for
+# that class from here, so the old failures do not raise it straight back.
+if [ "$OP" = loosen ]; then
+  nol(){ say "Crewforth: floor NOT lowered - $1" "The user sent the command only the user can type /crew-loosen, for $LO_AGENT $LO_CHANGE $LO_RISK, and Crewforth did not lower anything: $1 Tell the user exactly that."; }
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) nol "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
+  { [ -n "$TP" ] && [ -s "$TP" ]; } || nol "this is the first message of this session, or the session keeps no transcript."
+  _lh="${BASH_SOURCE%/*}"; [ "$_lh" = "${BASH_SOURCE}" ] && _lh=.
+  [ -f "$_lh/guard-agent-model.sh" ] || nol "model routing is not installed beside this hook."
+  [ "${CREW_MODEL_ROUTING:-}" = off ] && nol "model routing is switched off (CREW_MODEL_ROUTING=off), so no floor is in force."
+  CLAUDE_PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$CWD}"; . "$_lh/guard-agent-model.sh"
+  declare -F _am_floor_now >/dev/null 2>&1 || nol "model routing beside this hook is an older one."
+  _am_state
+  _am_floor_now "$LO_AGENT" "$LO_CHANGE" "$LO_RISK"
+  [ -n "$_AMF_TIER" ] || nol "no raised floor is on record for $LO_AGENT / $LO_CHANGE / $LO_RISK (.claude/state/crew-model-floors.auto has no line for it)."
+  [ "$_AMF_LOOSE" = 0 ] || nol "that floor was already lowered once ($_AMF_TIER to $_AMF_TO, $_AMF_LTS). It is lowered once for each time it is raised."
+  _am_rank "$_AMF_TIER"; [ "$_AMR" -ge 2 ] || nol "the floor on record is $_AMF_TIER, and there is no model below it."
+  _am_name $((_AMR-1)); LTO="$_AMN"
+  LTS="$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null)"; case "$LTS" in [0-9][0-9][0-9][0-9]-*Z) ;; *) nol "the clock could not be read." ;; esac
+  LF="$_AMS/crew-model-loosened.tsv"
+  mkdir -p "$_AMS" 2>/dev/null || nol "the state folder could not be made."
+  [ -s "$LF" ] || { printf 'ts\tagent\tchange\trisk\tfrom\tto\n' > "$LF"; } 2>/dev/null || nol "the record could not be written."
+  LFROM="$_AMF_TIER"
+  { printf '%s\t%s\t%s\t%s\t%s\t%s\n' "$LTS" "$LO_AGENT" "$LO_CHANGE" "$LO_RISK" "$LFROM" "$LTO" >> "$LF"; } 2>/dev/null || nol "the record could not be written."
+  # Said only when it is TRUE: the floor is read back the way the gate will read it. A line that was written and
+  # does not count (a clock that went backwards, a floors file that changed underneath) is not a lowering.
+  _am_floor_now "$LO_AGENT" "$LO_CHANGE" "$LO_RISK"
+  { [ "$_AMF_LOOSE" = 1 ] && [ "$_AMF_EFF" = "$LTO" ]; } || nol "the line was written but the floor read back is still ${_AMF_EFF:-$LFROM}, so it is not in force (is the clock behind the time the floor was raised, $_AMF_WHEN?)."
+  say "Crewforth: floor lowered - $LO_AGENT / $LO_CHANGE / $LO_RISK from $LFROM to $LTO. Its outcomes are counted afresh from now." \
+      "The user lowered the calibration floor of $LO_AGENT / $LO_CHANGE / $LO_RISK from $LFROM to $LTO with their own command. The card's own rules still hold (critical work on opus, no verify command on sonnet or above, the agent's floor). If the class fails its first try too often again, the floor rises again."
+fi
+
 _json_slice "$INPUT" permission_mode >/dev/null; PM="$_JS"
 case "$PM" in
   auto|dontAsk) ;;

package/kit/settings.json

@@ -97,6 +97,17 @@
             "timeout": 600
           }
         ]
+      },
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/guard-agent-model.sh",
+            "timeout": 600
+          }
+        ]
       }
     ],
     "UserPromptSubmit": [
@@ -135,6 +146,43 @@
         ]
       }
     ],
+    "SubagentStart": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 60
+          }
+        ]
+      }
+    ],
+    "SubagentStop": [
+      {
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 600
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Agent|Task",
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 60
+          }
+        ]
+      }
+    ],
     "SessionStart": [
       {
         "matcher": "startup|resume|clear|compact|fork",
@@ -161,6 +209,12 @@
             "shell": "bash",
             "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/board-sync.sh",
             "timeout": 60
+          },
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/agent-outcome.sh",
+            "timeout": 60
           }
         ]
       },

package/kit/skills/crew-loosen/SKILL.md

@@ -0,0 +1,28 @@
+---
+name: crew-loosen
+description: Lower a model floor that Crewforth raised for a class of work (one model, once).
+argument-hint: "<agent> <change> <risk>"
+disable-model-invocation: true
+metadata:
+  kind: command
+---
+# /crew-loosen
+Argument: $ARGUMENTS
+
+The user typed this command. Typing it is the decision: `hooks/prompt-approval.sh` read the message itself and
+lowered the calibration floor of that class of work (agent × change × risk) by one model, in
+`.claude/state/crew-model-loosened.tsv`. Nothing in this text lowers anything, and you cannot do this for the user:
+the file is closed to you, and a prompt you schedule or hand to another session is refused.
+
+Read the line Crewforth added to this turn and say what it says:
+
+- **"floor lowered"**: tell the user from which model to which, and that the class is counted afresh: if its first
+  try fails too often again, the floor rises again.
+- **"floor NOT lowered"**: tell the user the reason it gives (no raised floor on record for that class, already
+  lowered once, the first message of a session, a headless session).
+- **No such line**: the arguments were not `<agent> <change> <risk>`: a `crew-…` agent, a kind of change from the
+  card (`feature`, `fix-known`, `test-write` …) and `critical` or `normal`. Say that, with the three as they stand
+  in `.claude/state/crew-model-floors.auto`.
+
+What this does not touch: critical work still runs on opus, work with no verify command on sonnet or above, and
+an agent's own floor stays. Only the floor that the record of outcomes raised is lowered.

package/kit/studio/server/hooks/studio-gate.sh

@@ -51,8 +51,17 @@ _field() {                                 # _field <key>  -> value on stdout
 #
 # This approves the call the viewer was shown. It does not unblock anything:
 # another hook that exits 2 still blocks, and this hook's own denials are exit 2.
+# The mode is the spool's `mode` file when there is one, and the mode the hook was configured with otherwise. The
+# file starts as the mode the session started in and changes in exactly one way: the viewer approves a plan, in
+# the panel, into acceptEdits or default (permissions.js `decide`). A session that started in plan mode could not
+# otherwise ever have an allowance said out loud, plan approved or not. The check against what the harness itself
+# reports, below, stays: a file that says `default` approves nothing while the session is still in `plan`.
 _grant() {
-  case "${CREW_GATE_MODE:-}" in
+  local gm="${CREW_GATE_MODE:-}"
+  if [ -f "$SPOOL/mode" ]; then
+    read -r gm < "$SPOOL/mode" 2>/dev/null || gm=""
+  fi
+  case "$gm" in
     acceptEdits|default) ;;
     *) exit 0 ;;
   esac
@@ -69,6 +78,57 @@ TUID="$(_field tool_use_id || true)"
 SID="$(_field session_id || true)"
 [ -n "$TOOL" ] || exit 0                   # nothing to ask about
 
+# ---- two calls the viewer is not asked about ---------------------------------
+# Silence here is not an approval. The hook says nothing, and Claude Code decides the call as it would with no
+# panel: its own mode rules and every other hook still apply.
+#
+# ToolSearch looks up a tool's definition and changes nothing. A session reaches for it before the tools it has
+# to load first, ExitPlanMode among them, and asking the viewer to allow a lookup taught them to click through.
+[ "$TOOL" = "ToolSearch" ] && exit 0
+
+# The plan file. In plan mode Claude Code writes its plan to a file of its own before it asks to leave the mode,
+# and plan mode lets it write that file and no other. The viewer could only refuse it, and a plan they have not
+# been shown yet is not something to refuse: the plan itself comes to the panel with ExitPlanMode.
+#
+# Every condition has to hold, and anything that cannot be checked is asked about as before:
+#   - the session is in plan mode, by Claude Code's own report in this call
+#   - the tool is Write (an Edit is asked about)
+#   - the file is named *.md (as written: not .MD, not "x.md/" or "x.md."), and the path has no ".." in it
+#   - the path is spelled the way this platform spells one: "\" separates directories on Windows (MSYS, Cygwin)
+#     and nowhere else, so on any other system a path with a "\" in it is asked about
+#   - the file is not a symbolic link
+#   - the directory it is in, resolved, IS Claude Code's plans directory, resolved: not a directory under it
+# The two directories are resolved by the same builtin (cd -P) and compared as it reports them, so how a path is
+# spelled (C:\… or /c/…, a link on the way) does not matter. No process is started.
+_plan_file() {
+  [ "$TOOL" = "Write" ] || return 1
+  [ "$(_field permission_mode || true)" = "plan" ] || return 1
+  local fp; fp="$(_field file_path || true)"
+  [ -n "$fp" ] || return 1
+  case "$fp" in *..*) return 1 ;; esac
+  case "$fp" in *.md) ;; *) return 1 ;; esac
+  local dir
+  case "${OSTYPE:-}" in
+    msys*|cygwin*)
+      fp="${fp//\\\\/\\}"                   # JSON writes one backslash as two
+      dir="${fp%[/\\]*}" ;;
+    *)
+      case "$fp" in *\\*) return 1 ;; esac    # not a separator here: a name with one in it is not the plan file
+      dir="${fp%/*}" ;;
+  esac
+  [ "$dir" != "$fp" ] && [ -n "$dir" ] || return 1
+  [ -L "$fp" ] && return 1
+  [ -e "$fp" ] && [ ! -f "$fp" ] && return 1
+  local plans="${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}/plans" was="$PWD" at want
+  cd -P -- "$dir" 2>/dev/null || return 1
+  at="$PWD"
+  if ! cd -P -- "$plans" 2>/dev/null; then cd -- "$was" 2>/dev/null; return 1; fi
+  want="$PWD"
+  cd -- "$was" 2>/dev/null
+  [ -n "$at" ] && [ "$at" = "$want" ]
+}
+_plan_file && exit 0
+
 # Ids become filenames; anything unexpected is refused rather than sanitised
 # into something that might escape the spool.
 case "$TUID" in
@@ -76,6 +136,21 @@ case "$TUID" in
 esac
 
 REQ="$SPOOL/req"; ANS="$SPOOL/ans"; ALWAYS="$SPOOL/always"
+
+# The two tools that need a person. Claude Code offers them in a headless session only because Studio names a
+# permission host for it (studio-host.mjs); what answers them is this hook, from what the viewer chose in the
+# panel. A question and a plan take longer to read than one command, so they wait longer before the denial.
+ASK=0
+case "$TOOL" in
+  AskUserQuestion|ExitPlanMode) ASK=1; WAIT="${CREW_GATE_WAIT_ASK:-$WAIT}" ;;
+esac
+# The hook is wired twice: once for every tool, with the harness's ordinary limit, and once for these two alone,
+# with the longer one they need. Each copy answers its own and leaves the other's at once, in silence: silence is
+# no decision, so the copy that does answer decides. With no role (a settings file from before there were two)
+# this copy answers everything.
+case "${CREW_GATE_ROLE:-}:$ASK" in
+  general:1|ask:0) exit 0 ;;
+esac
 mkdir -p "$REQ" "$ANS" "$ALWAYS" 2>/dev/null || exit 0
 
 # A tool the panel already blanket-approved for this session skips the round trip.
@@ -187,10 +262,21 @@ esac
 START=$SECONDS
 while :; do
   if [ -f "$ANS/$TUID" ]; then
-    read -r VERDICT < "$ANS/$TUID" 2>/dev/null || VERDICT=deny
+    VERDICT=deny; OUT=""
+    # Two lines at most: the verdict, and for an answered question or an approved plan the output to print.
+    { IFS= read -r VERDICT; IFS= read -r OUT; } < "$ANS/$TUID" 2>/dev/null || :
     rm -f "$ANS/$TUID" "$REQ/$TUID.json" 2>/dev/null
-    case "$VERDICT" in
-      allow|always) _grant ;;
+    case "$ASK:$VERDICT" in
+      0:allow|0:always) _grant ;;
+      # The viewer's answers, or their approval of the plan, exactly as the server wrote them: `allow` with the
+      # tool's input, which is how the hooks reference says a hook answers these two tools. Printed only for them,
+      # and only when there is something to print.
+      1:output) [ -n "$OUT" ] || { printf 'studio: the answer could not be read — denied\n' >&2; exit 2; }
+                printf '%s\n' "$OUT"; exit 0 ;;
+      # A plan approved with a change of mode. The hook cannot change the mode, so it says nothing and the
+      # permission host, which can, answers from what the viewer chose.
+      1:host) [ "$TOOL" = ExitPlanMode ] && exit 0
+              printf 'studio: denied in the panel\n' >&2; exit 2 ;;
       *) printf 'studio: denied in the panel\n' >&2; exit 2 ;;
     esac
   fi

package/kit/studio/server/hooks/studio-host.mjs

@@ -0,0 +1,92 @@
+#!/usr/bin/env node
+// The permission host of a session Studio starts: an MCP server over stdio with one tool, `approve`, named to
+// Claude Code with --permission-prompt-tool.
+//
+// WHY IT EXISTS. In a `-p` run Claude Code offers the two tools that need a person, AskUserQuestion and
+// ExitPlanMode, only when the run has a permission host. Measured on Claude Code 2.1.294: with no host neither
+// is in the session's tool list; with this one both are. A session without them asked its question as prose and
+// could not leave plan mode at all.
+//
+// WHAT IT ANSWERS. Nothing, with one exception. Every prompt that reaches it is DENIED: the place a call is
+// allowed in Studio is the dock, through the PreToolUse hook (studio-gate.sh), before the call gets here. A call
+// that reaches this host is one the hook said nothing about, and before there was a host Claude Code refused
+// those itself, because nobody could answer. Denying here keeps that exactly.
+//
+// The exception is a plan the viewer approved WITH a change of mode. The hook cannot change the mode; the
+// permission host can, in its answer (measured: `updatedPermissions: [{ type: "setMode", … }]` moved a session
+// from plan to acceptEdits). So for that one case the hook stays silent, and this host finds what the viewer
+// decided in the spool — `host/<tool_use_id>.json`, written by the server when the answer was given — and
+// answers with it. The mode is one of two words, checked here as well as where it was written.
+//
+// No dependency: the protocol is three JSON-RPC methods on newline-delimited stdio.
+//
+// Usage: studio-host.mjs <spool-dir>
+import fs from 'node:fs';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const SPOOL = process.argv[2] ?? '';
+const MODES = ['acceptEdits', 'default'];
+const DENIED = 'Crewforth Studio: nobody answers this prompt here. A call is allowed in the Studio dock before it runs, or it is refused.';
+
+const send = (o) => process.stdout.write(`${JSON.stringify(o)}\n`);
+const text = (o) => ({ content: [{ type: 'text', text: JSON.stringify(o) }] });
+
+/** What the viewer decided for this call, when the decision is one only the host can deliver. Read once. */
+export function decisionFor(spool, toolName, toolUseId) {
+  if (toolName !== 'ExitPlanMode' || typeof toolUseId !== 'string' || !/^[A-Za-z0-9_-]+$/.test(toolUseId) || !spool) return null;
+  const file = path.join(spool, 'host', `${toolUseId}.json`);
+  let said;
+  try { said = JSON.parse(fs.readFileSync(file, 'utf8')); } catch { return null; }
+  try { fs.rmSync(file); } catch { /* answered once either way: the hook asks again for a new call */ }
+  return MODES.includes(said?.mode) ? said.mode : null;
+}
+
+export function answer(spool, args) {
+  const mode = decisionFor(spool, args?.tool_name, args?.tool_use_id);
+  if (!mode) return { behavior: 'deny', message: DENIED };
+  return {
+    behavior: 'allow',
+    updatedInput: args.input ?? {},
+    updatedPermissions: [{ type: 'setMode', mode, destination: 'session' }],
+  };
+}
+
+function serve() {
+  let buf = '';
+  process.stdin.on('data', (d) => {
+    buf += d;
+    let i;
+    while ((i = buf.indexOf('\n')) !== -1) {
+      const line = buf.slice(0, i).trim();
+      buf = buf.slice(i + 1);
+      if (!line) continue;
+      let m;
+      try { m = JSON.parse(line); } catch { continue; }
+      if (m.method === 'initialize') {
+        send({ jsonrpc: '2.0', id: m.id, result: { protocolVersion: m.params?.protocolVersion ?? '2025-06-18', capabilities: { tools: {} }, serverInfo: { name: 'crew-studio-host', version: '1' } } });
+      } else if (m.method === 'tools/list') {
+        send({
+          jsonrpc: '2.0',
+          id: m.id,
+          result: { tools: [{
+            name: 'approve',
+            description: 'Answers a permission prompt of a session Crewforth Studio started.',
+            inputSchema: { type: 'object', properties: { tool_name: { type: 'string' }, input: { type: 'object' }, tool_use_id: { type: 'string' } }, required: ['tool_name', 'input'] },
+          }] },
+        });
+      } else if (m.method === 'tools/call') {
+        send({ jsonrpc: '2.0', id: m.id, result: text(answer(SPOOL, m.params?.arguments)) });
+      } else if (m.id !== undefined) {
+        // Anything else that expects an answer gets an empty one; a notification gets none.
+        send({ jsonrpc: '2.0', id: m.id, result: {} });
+      }
+    }
+  });
+}
+
+// Imported by the selfcheck for `answer`; run by Claude Code as the server.
+// Node names the main module by its real path, so the path it was started with is resolved the same way.
+let main = false;
+try { main = pathToFileURL(fs.realpathSync(process.argv[1])).href === import.meta.url; } catch { /* not started as a script */ }
+if (main) serve();