crewforth 3.1.0-rc.6 → 3.1.0-rc.7

package/CHANGELOG.md

@@ -122,7 +122,11 @@ versioning follows [SemVer](https://semver.org/).
   - `guard-agent-model.sh` holds the rules at the tool level and never rewrites a call; `agent-outcome.sh` runs the
     verify command and keeps the record. Which kind of change a task is, is the caller's judgement.
     `CREW_MODEL_ROUTING=off` turns all of it off; `fable` needs `CREW_ALLOW_FABLE=1`.
-  - **Known limits.** A test runner runs code the agent wrote (test files, `package.json` scripts, `conftest.py`, a
+  - **Known limits.** Model routing applies to `crew-*` agents only: Explore, general-purpose and a project's own
+    agents run on the session's model and are not in the record (a kit agent for documents is planned for 3.2.0).
+    The gate holds a floor, not a ceiling: nothing stops ordinary work from being given to Opus. Not measured on
+    Windows: Studio under a path that holds a space, and stopping a session from the panel; both were measured on
+    macOS. A test runner runs code the agent wrote (test files, `package.json` scripts, `conftest.py`, a
     `Makefile`): the list limits the command, not what the tests do. A failed card stays failed until the card
     changes. The shell rule that protects the routing files goes by their names. The list of critical paths is
     written at the first session, not at install; the gate reads the patterns, not the list. Managed policy is
@@ -184,6 +188,17 @@ versioning follows [SemVer](https://semver.org/).
   agent that reported before it was called, with the words `after Planner reported`; that wire is inferred from the
   order of events and is not a call from one agent to another, and the panel says so. Read from the transcript
   alone. Agents a workflow started are not called by the session, so they carry no place.
+- **Studio: the Models view.** A fourth tab (key `m`), read from the record of outcomes: for each kind of task
+  (agent, change, risk) the model, the tasks, how often the first try passed, how often it was repeated one model
+  up, and an estimated cost. A class with no verified call shows `—`, not 0%. A class the record holds one model up
+  is offered for lowering once its latest ten verified calls all passed first time; the offer is one button, **Copy
+  command**, for `/crew-loosen …`. Studio writes nothing. A floor you lowered reads **lowered**, with what raised
+  it and when you lowered it. The inspector shows a task's card (files, change, verify) and its steps: each call
+  of the card, what it ran on, what its verify command said.
+- **Studio: a session started in the panel can ask its question and have its plan approved, in the dock.** Such a
+  session had neither tool. It has both now, and the question or the plan waits in the strip where an approval
+  does; approving a plan can carry the mode the session goes on in.
+- **Studio: Reset layout**, and **Report**: an agent's hand-back is read as its report.
 - **Studio: which model did which work.** Every agent card carries a badge with the model it ran on, and a third
   line with its duration, new tokens and estimated cost. Two facts are kept apart: the model the call **asked** for
   and the model the agent **ran on**; when they differ the badge carries `≠`. The inspector has a **Model** section.
@@ -201,6 +216,11 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Changed
 
+- **Studio: every agent that is not Crewforth's is a Claude Code agent.** A type the panel did not know carried a
+  `?`; there is no list to go stale now. Its tooltip says where it is defined (the project, the user's folder, a
+  plugin, or Claude Code itself). **Density: Auto** chooses what fits.
+- **Studio: Expand all and Fold all reach every group**, the cards that stand for several agents of one type and
+  the groups inside an opened group included; what you open or fold by hand afterwards stays as you left it.
 - **Studio: agents are named by their role.** `crew-backend-expert` reads Backend, `general-purpose` General Purpose,
   in the graph, the Timeline, the List, the dock, the inspector and the conversation; the declared type is under the
   name in the inspector and on hover. A task cut short on a card is said in full on hover.
@@ -214,6 +234,12 @@ versioning follows [SemVer](https://semver.org/).
 - **Studio: a group of agents opens beside itself.** Several agents of one type are one card; in a window of 1024 px
   and up, clicking it puts its agents in the next column as ordinary cards, and opening another group folds the
   first. Below that width it opens downward as before.
+- **`/crew-approve`, with nothing after it, approves what was just refused.** In a trial the session said "send
+  `/crew-approve commit+push`" and stood still until someone noticed. The gate now writes down what it refused
+  (the session, commit, push or both, the moment), and the bare command approves that: the same session's, within
+  30 minutes, once. The refusal puts the command on a line of its own. What is approved is the gate's note of the
+  command it refused, never the model's choice: the note is closed to the session, and the bare command is refused
+  when scheduled or handed to another session, like the spelled-out forms, which still work.
 - **The approval of 3.1.0's release candidates was a text, `approve: commit` (`onay: commit`); it is the command
   `/crew-approve commit` now.** The same in every language, and recorded exactly as the text was. Only a command you
   type counts: measured on Claude Code 2.1.284, a typed command reaches the recording hook as typed, a skill the
@@ -317,6 +343,16 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Fixed
 
+- **Critical work with a verify command was refused every time where the Agent tool has no `run_in_background`.**
+  The gate asked for the field to be `false`. Where background tasks are off the tool has no such field (measured on
+  Claude Code 2.1.296: the call arrives with description, prompt, subagent_type and model, and runs in the
+  foreground), so the model could not send it and each call was refused, four times in a row in one session. Now
+  only a call that says `run_in_background: true` is refused; one that leaves the field out passes. Where the tool
+  does have the field, a call that leaves it out starts in the background: the session is then told, when the
+  launch comes back, to run the verify command itself once the agent has finished.
+- **Studio: no spool is left behind.** A server that stopped or was killed left its sessions' settings in the temp
+  directory, and they piled up; it removes them as it stops and sweeps when it starts. Two calls in plan mode (a
+  tool lookup, the plan file) no longer come to the dock.
 - **Studio: a card's text stays in the card.** `N in background` could push the session card's line past its edge;
   it has a line of its own, and every text part of a card is clipped inside it, whole on hover.
 - **Studio: the time moves in a live session.** The summary read the span of the session's own transcript, which

package/README.md

@@ -1,6 +1,6 @@
 <p align="center"><img src="https://raw.githubusercontent.com/Crewforth/crewforth/main/assets/logo.svg" alt="Crewforth" width="420"></p>
 
-**Crewforth is your engineering crew for Claude Code.** It adds subagents, skills, commands and hooks to Claude Code: 12 specialist agents that each own a domain, 40 skills that hold the method, 10 commands you start with `/crew-…`, and hooks that enforce the rules that matter.
+**Crewforth is your engineering crew for Claude Code.** It adds subagents, skills, commands and hooks to Claude Code: 12 specialist agents that each own a domain, 40 skills that hold the method, 12 commands you start with `/crew-…`, and hooks that enforce the rules that matter.
 
 ```bash
 npx crewforth init              # set up a new project
@@ -31,6 +31,7 @@ Then open Claude Code and run `/crew-doctor` to confirm the setup. Requires bash
 - **12 specialist agents**, from `crew-planner` to `crew-commit-agent`, each owning one domain.
 - **40 skills** holding the method: testing, migrations, API contracts, observability, accessibility, deployment.
 - **12 commands**, each started with its `/crew-…` name: `/crew-plan`, `/crew-review`, `/crew-ship`, `/crew-handoff`, `/crew-brainstorm`, `/crew-update`, `/crew-doctor`, `/crew-gates`, `/crew-skill`, `/crew-studio`, `/crew-approve`, `/crew-loosen`.
+- In `auto` mode a commit or a push waits for you: type `/crew-approve` and what was just refused is approved, tied to what is staged.
 - **Safe adoption.** `adopt` lands everything on a branch, staged and uncommitted; `main` is never touched.
 
 ## Updating

package/kit/agents/crew-commit-agent.md

@@ -96,8 +96,10 @@ write is refused because the file is on a critical path, do not reach it another
   approval prompt only the user can answer — so present the message FIRST, then run the commit yourself and let the user
   approve it at the prompt. Never hand the user a command to paste into their own terminal. In `auto` and `dontAsk`
   the prompt reaches nobody: stage, then ask in this shape and with nothing after it — the message in ONE code block,
-  and under it one line, the sentence in the user's language and the command as it is: "If you approve, send only
-  this: `/crew-approve commit`" (or `/crew-approve push`, `/crew-approve commit+push`). The user approves by sending
+  and under it one sentence in the user's language ("If you approve, send only this:") followed by the command
+  on a line of its own: `/crew-approve`. With nothing after it, it approves what the gate just refused in this
+  session (a commit, a push, or both when both were refused); spelled out it is `/crew-approve commit`,
+  `/crew-approve push` or `/crew-approve commit+push`. The user approves by sending
   that command alone; a sentence that says yes is not an approval, and you cannot run `/crew-approve` for them. It covers what is staged on that HEAD. If the gate says the approval path is closed in this session (the
   recording hook is not wired), say so and offer Shift+Tab or their own terminal instead.
   Then run `git commit -m '…'` alone in its call (single-quoted, or from a here-document with a quoted delimiter),

package/kit/eval/smoke-test.sh

@@ -6951,7 +6951,7 @@ _pa_op(){ sed -n 's/^op=//p' "$_pa_rec" 2>/dev/null; }
 if [ "$UNITS" != 1 ]; then
   # The cases below feed payloads to the two hooks; like the other gate unit cases they belong to the source run.
   # An installed project keeps the two pins after them: the shared definitions and the wiring.
-  skip scope "approval by the user's own message: the unit cases run in the source checkout (scope=install)" 47
+  skip scope "approval by the user's own message: the unit cases run in the source checkout (scope=install)" 49
 elif [ ! -f "$HOOKS/prompt-approval.sh" ]; then
   fail "hooks/prompt-approval.sh is missing — in auto and dontAsk nothing can turn the user's own yes into an approval"
 else
@@ -7180,13 +7180,87 @@ done <<'PC'
 0 @@ claude --version
 0 @@ echo \"/crew-approve commit\"
 0 @@ grep -rn \"approve: commit\" kit | head
-0 @@ claude -p /crew-approve commit
+1 @@ claude -p /crew-approve commit
 PC
 if [ "$_pcn" != 18 ]; then fail "FIXTURE: the claude-call table has $_pcn rows, not 18"
-elif [ -z "$_pcbad" ]; then pass "a command that hands a Claude Code session an approval is refused in auto and in default (12 forms: quoted, escaped, an option's value, a variable, a pipe, npx / bunx / node, interactive); an ordinary claude -p and a command without claude are not touched (6)"
+elif [ -z "$_pcbad" ]; then pass "a command that hands a Claude Code session an approval is refused in auto and in default (13 forms: quoted, escaped, an option's value, a variable, a pipe, npx / bunx / node, interactive, and the unquoted one whose prompt is the bare command); an ordinary claude -p and a command without claude are not touched (5)"
 else fail "claude-call table:$_pcbad"; fi
 _pa_new
 
+# `/crew-approve` WITH NOTHING AFTER IT (3.1.0). In the trial the session said "send /crew-approve commit+push" and
+# stood still until the user noticed. Now the gate writes down what it refused (.claude/state/crew-approval-pending:
+# the session, the operation, the second), and the bare command approves that: the same session's, not older than
+# 30 minutes, once. What is approved is the gate's record of the command it refused, never the message's and never
+# the model's choice; every proof a spelled-out approval needs is still asked.
+_pa_pend="$_paw/.claude/state/crew-approval-pending"
+_pa_pop(){ sed -n 's/^op=//p' "$_pa_pend" 2>/dev/null; }
+_pbb=""
+# One refused commit; one refused push; a commit and then a push refused: each approved by the bare command.
+_pa_new; _pa_run auto 'git commit -m x'; [ "$_par/$(_pa_pop)" = "2/commit" ] || _pbb="$_pbb [a refused commit left: $_par/$(_pa_pop)]"
+_po="$(_pa_say auto '/crew-approve')"; case "$_po" in *'approved: commit (what this session was refused)'*'approval recorded'*) ;; *) _pbb="$_pbb [bare, commit: ${_po:0:110}]" ;; esac
+[ "$(_pa_op)" = commit ] || _pbb="$_pbb [the record after a bare approval of a commit: $(_pa_op)]"
+_pa_run auto 'git commit -m x'; { [ "$_par" = 0 ] && [ "$(gdec "$_pao")" = allow ]; } || _pbb="$_pbb the-approved-commit-is-still-refused:$_par"
+[ -z "$(_pa_pop)" ] || _pbb="$_pbb what-was-waiting-is-still-there-after-it-was-approved"
+_pa_new; ( cd "$_paw" && git commit -qm second ) >/dev/null 2>&1
+_pa_run auto 'git push origin feat/x'; [ "$_par/$(_pa_pop)" = "2/push" ] || _pbb="$_pbb [a refused push left: $_par/$(_pa_pop)]"
+_pa_say auto '/crew-approve' >/dev/null; [ "$(_pa_op)" = push ] || _pbb="$_pbb [the record after a bare approval of a push: $(_pa_op)]"
+_pa_run auto 'git push origin feat/x'; [ "$_par" = 0 ] || _pbb="$_pbb the-approved-push-is-still-refused:$_par"
+_pa_new; _pa_run auto 'git commit -m x'; _pa_run auto 'git push origin feat/x'; [ "$(_pa_pop)" = "commit+push" ] || _pbb="$_pbb [a commit then a push refused left: $(_pa_pop)]"
+_po="$(_pa_say dontAsk '/crewforth:crew-approve')"; case "$_po" in *'approved: commit+push'*) ;; *) _pbb="$_pbb [bare in the plugin's spelling: ${_po:0:90}]" ;; esac
+[ "$(_pa_op)" = "commit+push" ] || _pbb="$_pbb [the record after a bare approval of both: $(_pa_op)]"
+# Used once: a second bare command has nothing to approve.
+_po="$(_pa_say auto '/crew-approve')"; { [ -z "$(_pa_op)" ] && case "$_po" in *'approval NOT recorded'*'nothing is waiting'*) true ;; *) false ;; esac; } || _pbb="$_pbb [a second bare approval: op $(_pa_op), ${_po:0:80}]"
+# Nothing refused at all; refused in another session; refused more than 30 minutes ago.
+_pa_new; rm -f "$_pa_pend"; _po="$(_pa_say auto '/crew-approve')"; { [ ! -s "$_pa_rec" ] && case "$_po" in *'nothing is waiting'*) true ;; *) false ;; esac; } || _pbb="$_pbb approved-with-nothing-waiting"
+_pa_run auto 'git commit -m x' Bash other-session; _po="$(_pa_say auto '/crew-approve')"; { [ ! -s "$_pa_rec" ] && case "$_po" in *'refused in another session'*) true ;; *) false ;; esac; } || _pbb="$_pbb another-sessions-refusal-was-approved"
+[ "$(_pa_pop)" = commit ] || _pbb="$_pbb the-other-sessions-refusal-was-used-up"
+printf 'sid=s\nop=commit+push\nts=%s\n' "$(( $(date +%s) - 1900 ))" > "$_pa_pend"; _po="$(_pa_say auto '/crew-approve')"; { [ ! -s "$_pa_rec" ] && case "$_po" in *'more than 30 minutes old'*) true ;; *) false ;; esac; } || _pbb="$_pbb a-refusal-31-minutes-old-was-approved"
+printf 'sid=s\nop=rm -rf\nts=%s\n' "$(date +%s)" > "$_pa_pend"; _pa_say auto '/crew-approve' >/dev/null; [ ! -s "$_pa_rec" ] || _pbb="$_pbb an-operation-that-is-not-one-was-approved"
+# The proofs a spelled-out approval needs are asked of the bare one: the mode, an attended session, a transcript.
+_pa_new; _pa_run auto 'git commit -m x'
+for _pm in default acceptEdits plan bypassPermissions; do _pa_say "$_pm" '/crew-approve' >/dev/null; [ -s "$_pa_rec" ] && _pbb="$_pbb bare-recorded-in-$_pm"; done
+[ "$(_pa_pop)" = commit ] || _pbb="$_pbb a-mode-that-records-nothing-used-up-what-was-waiting"
+_PA_ENV="CLAUDE_CODE_SESSION_ATTENDED=0" _pa_say auto '/crew-approve' >/dev/null; [ -s "$_pa_rec" ] && _pbb="$_pbb bare-recorded-in-a-headless-session"
+_pa_run auto 'git commit -m x'; _PA_TR="$_PA/never-written.jsonl" _pa_say auto '/crew-approve' >/dev/null; [ -s "$_pa_rec" ] && _pbb="$_pbb bare-recorded-as-a-sessions-first-message"
+for _pp in '/crew-approve now' 'please /crew-approve' '/crew-approved' '<task-notification>/crew-approve' 'Another Claude session sent a message:\n/crew-approve' '/crew-approve\n/crew-approve'; do
+  _pa_new; _pa_run auto 'git commit -m x'; _pa_say auto "$_pp" >/dev/null; [ -s "$_pa_rec" ] && _pbb="$_pbb [recorded for: $_pp]"; done
+[ -z "$_pbb" ] && pass "/crew-approve with nothing after it approves what the gate last refused in this session: a commit, a push, and both when both were refused (also in the plugin's spelling), once; with nothing refused, a refusal of another session, one 31 minutes old or an operation that is not one, nothing is recorded and the reason is said; it records in auto and dontAsk only, not in a headless session, not as a session's first message, and not for six messages that are not the command alone" \
+               || fail "bare /crew-approve:$_pbb"
+# The session cannot choose what the user's approval covers, nor have the bare command sent for it.
+_pbb=""; _pa_new; _pa_run auto 'git commit -m x'
+for _tk in 'Write|file_path' 'Edit|file_path' 'MultiEdit|file_path' 'NotebookEdit|notebook_path'; do
+  printf '{"session_id":"s","cwd":"%s","permission_mode":"acceptEdits","hook_event_name":"PreToolUse","tool_name":"%s","tool_input":{"%s":"%s","content":"sid=s","old_string":"commit","new_string":"commit+push","edits":[],"new_source":"x"}}' "$_paw" "${_tk%|*}" "${_tk#*|}" "$_pa_pend" \
+    | ( cd "$_paw" && CREW_NO_BOARD=1 CREW_GATE_LOG=/dev/null bash "$HOOKS/guard-write.sh" >/dev/null 2>&1 ); [ "$?" = 2 ] || _pbb="$_pbb [${_tk%|*} may write the pending record]"
+done
+while IFS= read -r _pl; do [ -z "$_pl" ] && continue
+  _pw="${_pl%% @@ *}"; _pc="${_pl#* @@ }"
+  _pa_run auto "$_pc"; [ "$_par" = "$_pw" ] || _pbb="$_pbb [$_pc → $_par, want $_pw]"
+done <<'PB'
+2 @@ printf 'sid=s\\nop=commit+push\\nts=1\\n' > .claude/state/crew-approval-pending
+2 @@ echo op=push >> .claude/state/crew-approval-pending
+2 @@ tee .claude/state/crew-approval-pending
+2 @@ cp /tmp/p .claude/state/crew-approval-pending
+2 @@ mv /tmp/p .claude/state/crew-approval-pending
+2 @@ sed -i s/commit/commit+push/ .claude/state/crew-approval-pending
+2 @@ cp /tmp/p .claude/state/crew-approval-p*
+2 @@ rm .claude/state/crew-approval-pending
+2 @@ cat .claude/state/crew-approval-pending
+2 @@ claude -p /crew-approve
+2 @@ claude -p \"/crew-approve\"
+2 @@ echo /crew-approve | claude -p
+2 @@ npx @anthropic-ai/claude-code -p /crewforth:crew-approve
+0 @@ grep -rn /crew-approve .claude/hooks
+0 @@ echo /crew-approve
+0 @@ claude -p \"explain what /crew-approve does\"
+PB
+[ "$(_pa_pop)" = commit ] || _pbb="$_pbb [what was waiting changed: $(_pa_pop)]"
+for _pt in CronCreate ScheduleWakeup; do
+  printf '{"session_id":"s","permission_mode":"auto","hook_event_name":"PreToolUse","tool_name":"%s","tool_input":{"cron":"* * * * *","delaySeconds":60,"prompt":"/crew-approve"}}' "$_pt" | bash "$HOOKS/guard-schedule.sh" >/dev/null 2>"$_PA/ps.err"
+  { [ "$?" = 2 ] && grep -q 'the user can type /crew-approve when they agree' "$_PA/ps.err"; } || _pbb="$_pbb [a scheduled bare /crew-approve passed $_pt]"
+done
+[ -z "$_pbb" ] && pass "the session cannot choose or send the bare approval: Write, Edit, MultiEdit and NotebookEdit refuse the pending record; 9 shell commands that write, copy, move, remove or name it are refused; a claude call handed the bare command (4 forms) and a scheduled one (2 tools) are refused; a grep for the word, an echo of it and a prompt that mentions it are not" \
+               || fail "bare /crew-approve cannot be arranged by the session:$_pbb"
+
 # ---- which modes ----------------------------------------------------------------------------------------------
 _pabad=""
 for _pm in auto dontAsk; do : > "$_pa_rec"; _pa_say "$_pm" 'approve: commit' >/dev/null; [ "$(_pa_op)" = commit ] || _pabad="$_pabad $_pm:no-record"; done
@@ -7674,11 +7748,12 @@ _parow=""
 _pa_want(){  # $1 = label, $2 = text that must be there, $3 = text that must not
   case "$_par/$_pae" in 2/*"$2"*) case "$_pae" in *"$3"*) _parow="$_parow [$1: says '$3']" ;; esac ;; *) _parow="$_parow [$1: rc $_par, no '$2']" ;; esac; }
 _pa_wire "$_PAW_ON"
-_pa_gate auto 'git commit -m x';          _pa_want 'wired, commit' 'send only this: /crew-approve commit' 'APPROVAL PATH IS CLOSED'
-                                          _pa_want 'wired, commit, one block' 'in ONE code block' 'send only this: /crew-approve push'
-_pa_gate dontAsk 'git push origin feat/x'; _pa_want 'wired, push' 'send only this: /crew-approve push' 'APPROVAL PATH IS CLOSED'
-_pa_gate auto 'git commit -m x';          _pa_want 'wired, no text form' 'the command as it is' 'approve: '
-                                          _pa_want 'wired, no Turkish alias' 'the command as it is' 'onay:'
+_pa_gate auto 'git commit -m x';          _pa_want 'wired, commit' 'approves what was just refused here: commit.' 'APPROVAL PATH IS CLOSED'
+                                          _pa_want 'wired, commit, one block' 'in ONE code block' 'refused here: push'
+_pa_gate dontAsk 'git push origin feat/x'; _pa_want 'wired, push after the commit' 'approves what was just refused here: commit+push.' 'APPROVAL PATH IS CLOSED'
+grep -qx '/crew-approve' "$_PA/err" || _parow="$_parow [the command is not on a line of its own]"
+_pa_gate auto 'git commit -m x';          _pa_want 'wired, no text form' 'exactly as it is' 'approve: '
+                                          _pa_want 'wired, no Turkish alias' 'exactly as it is' 'onay:'
 rm -f "$_paw/.claude/settings.json"
 _pa_gate auto 'git commit -m x';          _pa_want 'no settings' 'APPROVAL PATH IS CLOSED' 'send only this'
                                           _pa_want 'no settings, the ways' 'Shift+Tab' 'ONE code block'
@@ -7687,7 +7762,7 @@ _pa_gate auto 'git push origin feat/x';   _pa_want 'named before the event only'
 _pa_wire '{"hooks":{"PreToolUse":[{"hooks":[{"type":"command","command":"bash .claude/hooks/guard-bash.sh"}]}]}}'
 _pa_gate auto 'git commit -m x';          _pa_want 'other events only' 'APPROVAL PATH IS CLOSED' 'send only this'
 rm -f "$_paw/.claude/settings.json"; _pa_wire "$_PAW_ON"; mv "$_paw/.claude/settings.json" "$_paw/.claude/settings.local.json"
-_pa_gate auto 'git commit -m x';          _pa_want 'wired in settings.local.json' 'send only this: /crew-approve commit' 'APPROVAL PATH IS CLOSED'
+_pa_gate auto 'git commit -m x';          _pa_want 'wired in settings.local.json' 'approves what was just refused here' 'APPROVAL PATH IS CLOSED'
 rm -f "$_paw/.claude/settings.local.json"
 if [ -z "$_parow" ]; then pass "the auto-mode refusal asks in one shape when the approval hook is wired, and says the path is closed when it is not (10 readings, each refused; the text form 'approve:' / 'onay:' is named in none)"
 else fail "the auto-mode refusal does not say what it should:$_parow"; fi
@@ -7902,9 +7977,11 @@ sec "== 12h3) model routing v2: the card, the risk class, verify-then-escalate,
 # three events it is wired to. Measured on Claude Code 2.1.294 before any of it was written: an agent's Edit carries
 # agent_id; it is the id SubagentStart was given and the agentId PostToolUse(Agent) returns; a SubagentStop that
 # answers "block" keeps the agent working; PostToolUse's additionalContext reaches the session; an Agent call that
-# leaves run_in_background out started in the background.
+# leaves run_in_background out started in the background. Measured on 2.1.296 as well: with background tasks off
+# (CLAUDE_CODE_DISABLE_BACKGROUND_TASKS=1) the Agent tool has no run_in_background at all, the call arrives with
+# description, prompt and subagent_type, and it runs in the foreground (status completed).
 _V2G="$HOOKS/guard-agent-model.sh"; _V2O="$HOOKS/agent-outcome.sh"
-if [ "$UNITS" != 1 ]; then skip scope "model routing v2: the unit cases run in the source checkout (scope=install)" 26
+if [ "$UNITS" != 1 ]; then skip scope "model routing v2: the unit cases run in the source checkout (scope=install)" 27
 elif [ ! -f "$_V2O" ] || [ ! -f "$_V2G" ]; then fail "hooks/agent-outcome.sh or guard-agent-model.sh is missing — nothing verifies an agent's work or holds the model to the risk"
 else
 _v2="$(mktemp -d)"; _v2="$(cd -P "$_v2" && pwd)"; _v2p="$_v2/p"
@@ -7965,8 +8042,10 @@ done <<'V2'
 0|crew-review-agent|opus|src/payments/**|audit|none|
 2|crew-security-expert|sonnet|src/ui/**|audit|none|
 0|crew-security-expert|opus|src/ui/**|audit|none|
-2|crew-backend-expert|opus|src/payments/p.ts|feature|true|
+0|crew-backend-expert|opus|src/payments/p.ts|feature|true|
+0|crew-backend-expert|opus|src/payments/p.ts|feature|true|fg
 2|crew-backend-expert|opus|src/payments/p.ts|feature|true|bg
+0|crew-backend-expert|opus|src/a.ts|security|true|
 0|crew-backend-expert|opus|src/payments/p.ts|feature|none|bg
 0|crew-backend-expert|sonnet|src/ui/a.ts|feature|true|bg
 2|crew-backend-expert|sonnet|src/ui/a.ts|tidy|true|
@@ -7976,9 +8055,37 @@ done <<'V2'
 0|crew-backend-expert|sonnet|src/ui/a.ts|feature|git commit -m x|
 0|crew-backend-expert|sonnet|src/ui/a.ts|feature|rm -rf /|
 V2
-if [ "$_v2n" != 45 ]; then fail "FIXTURE: the card table has $_v2n rows, not 45"
-elif [ -z "$_v2b" ]; then pass "the card decides the model: critical work (payments/, migrations, a .sql file, AuthController, userAuth, schema.prisma, and the four critical kinds of change) is refused below opus and passes on opus; verify none is refused on haiku; test-run passes on haiku, also on a critical path; test-write, audit and review are held to sonnet in normal work and to opus in critical work; critical work with a verify command is refused in the background and when the field is left out; a card that is not one is refused; a verify command never refuses the call, whatever it is (the hook decides whether to run it) (45 rows)"
+if [ "$_v2n" != 47 ]; then fail "FIXTURE: the card table has $_v2n rows, not 47"
+elif [ -z "$_v2b" ]; then pass "the card decides the model: critical work (payments/, migrations, a .sql file, AuthController, userAuth, schema.prisma, and the four critical kinds of change) is refused below opus and passes on opus; verify none is refused on haiku; test-run passes on haiku, also on a critical path; test-write, audit and review are held to sonnet in normal work and to opus in critical work; critical work with a verify command is refused when the call says run_in_background true, and passes with false and with the field left out (a session whose Agent tool has no such field cannot send it); a card that is not one is refused; a verify command never refuses the call, whatever it is (the hook decides whether to run it) (47 rows)"
 else fail "card table:$_v2b"; fi
+# The refusal names the way forward that exists (the field was sent, so it can be sent as false), and a call that
+# left the field out and was launched in the background is told so when the launch comes back.
+_v2new; _v2b=""
+_v2call crew-backend-expert opus 'src/payments/p.ts' feature true ',"run_in_background":true'
+{ [ "$_v2rc" = 2 ] && grep -q 'is not sent to the background' "$_v2/err" && grep -q 'run_in_background set to false' "$_v2/err"; } || _v2b="$_v2b [true: rc $_v2rc, $(cut -c1-80 "$_v2/err")]"
+grep -q 'left out' "$_v2/err" && _v2b="$_v2b [the refusal still tells the session what happens when the field is left out]"
+_v2call crew-backend-expert opus 'src/payments/p.ts' feature true ',"run_in_background": true'; [ "$_v2rc" = 2 ] || _v2b="$_v2b [true after a space: rc $_v2rc]"
+_v2call crew-backend-expert opus 'src/payments/p.ts' feature true ',"run_in_background":"true"'; [ "$_v2rc" = 0 ] || _v2b="$_v2b [a string, which is not the boolean: rc $_v2rc]"
+# $1 agent id, $2 status -> what the hook prints
+# $3 = the call's tool_use_id (default: one no record is named after)
+_v2launch(){ printf '{"session_id":"s","hook_event_name":"PostToolUse","tool_name":"Agent","tool_input":{"prompt":"p"},"tool_response":{"status":"%s","agentId":"%s","isAsync":true},"tool_use_id":"%s"}' "$2" "$1" "${3:-tu-none}" | ( cd "$_v2p" && _v2e bash "$_V2O" 2>/dev/null ); }
+# The order a real session has (measured on Claude Code 2.1.296): the launch is answered BEFORE SubagentStart, so the
+# record is still the call's own, named after its tool_use_id.
+_v2new; _v2call crew-backend-expert opus 'src/payments/p.ts' feature true
+_tid="$(sed -n 's/.*"tool_use_id":"\([^"]*\)".*/\1/p' "$_v2/c.json")"
+_o="$(_v2launch la0 async_launched "$_tid")"; case "$_o" in *'launched in the background'*'(true)'*) ;; *) _v2b="$_v2b [a launch answered before the agent started is not told: ${_o:0:80}]" ;; esac
+_o="$(_v2launch la0 async_launched tu-of-another-call)"; [ -z "$_o" ] || _v2b="$_v2b [told from a record of another call]"
+_v2start la0; _v2stop la0 >/dev/null; [ -n "$(_v2row la0)" ] || _v2b="$_v2b [the launch notice used up the call's record: no line for the agent]"
+# ...and the other order: the agent has its record already.
+_v2new; _v2call crew-backend-expert opus 'src/payments/p.ts' feature true; _v2start la1
+_o="$(_v2launch la1 async_launched)"; case "$_o" in *'"additionalContext":"Crewforth: this critical work was launched in the background'*'run the verify command yourself with the Bash tool (true)'*) ;; *) _v2b="$_v2b [a background launch of critical work is not told: ${_o:0:80}]" ;; esac
+printf '%s' "$_o" | node -e 'let s="";process.stdin.on("data",d=>s+=d).on("end",()=>{JSON.parse(s)})' 2>/dev/null || { command -v node >/dev/null 2>&1 && _v2b="$_v2b [what it prints is not JSON]"; }
+_o="$(_v2launch la1 completed)"; [ -z "$_o" ] || _v2b="$_v2b [a call that is not a launch is told it was one]"
+_v2new; _v2call crew-backend-expert opus 'src/payments/p.ts' feature none; _v2start la2; _o="$(_v2launch la2 async_launched)"; [ -z "$_o" ] || _v2b="$_v2b [told for a card with no verify command]"
+_v2new; _v2call crew-backend-expert sonnet 'src/ui/a.ts' feature true; _v2start la3; _o="$(_v2launch la3 async_launched)"; [ -z "$_o" ] || _v2b="$_v2b [told for normal work]"
+_o="$(_v2launch nobody async_launched)"; [ -z "$_o" ] || _v2b="$_v2b [told for an agent with no record]"
+[ -z "$_v2b" ] && pass "run_in_background on critical work with a verify command: true is refused with the way forward (set it to false), in both spellings of the JSON; a string is not the boolean; a call that left the field out and came back as a background launch is told to run the verify command itself when the agent ends, whether the launch is answered before the agent starts (what Claude Code 2.1.296 does) or after, and the agent still gets its line; nothing is said for a finished call, a card with no verify command, normal work or an agent with no record" \
+               || fail "run_in_background, critical work:$_v2b"
 # "In normal work an author on Opus does not pull the review up": the one deliberate change of an instruction.
 _v2call crew-backend-expert opus 'src/ui/a.ts' feature true; _r1=$_v2rc; _v2call crew-review-agent sonnet 'src/ui/a.ts' audit none; _r2=$_v2rc
 [ "$_r1/$_r2" = 0/0 ] && pass "normal work written on opus is reviewed on sonnet: the gate allows both calls (the instruction 'audit ≥ author' is gone; no gate held it)" \

package/kit/hooks/agent-outcome.sh

@@ -24,8 +24,9 @@
 #                        Only ever up: lowering a floor is the user's decision and nothing here does it.
 #   PostToolUse (Agent)  a foreground call has come back. If its verify failed, or its report closed with
 #                        confidence: low, the session is told to repeat the task once, one model up, and to ask
-#                        the user if that fails too. A background call comes back before its agent has finished,
-#                        so nothing is said then; the record and the gate still hold.
+#                        the user if that fails too. A background call comes back before its agent has finished:
+#                        for critical work with a verify command the session is told to run that command itself
+#                        when the agent ends; the record and the gate still hold.
 #   SessionStart, --scan the project's critical paths are listed in .claude/state/crew-critical-paths.auto, when the
 #                        list of files has changed. A generated file: the gate does not read it, it reads the paths.
 #
@@ -389,7 +390,27 @@ case "$EV" in
         fi
       fi
     fi
-    R="$_AMD/results/$AID"; [ -f "$R" ] || exit 0
+    R="$_AMD/results/$AID"
+    if [ ! -f "$R" ]; then
+      # No result yet: the agent was launched in the background (measured, 2.1.294 and 2.1.296: an Agent call that
+      # leaves run_in_background out, where the tool has the field, answers status async_launched). For critical
+      # work with a verify command the session is told now, since this hook will not be asked again when it ends.
+      # Measured on 2.1.296: the answer to a launch comes BEFORE SubagentStart, so the call's record is still where the
+      # gate left it, named after the call (tool_use_id); after SubagentStart it is under the agent's id.
+      A="$_AMD/agents/$AID"
+      if [ ! -f "$A" ]; then
+        _json_slice "$INPUT" tool_use_id >/dev/null; TID="$_JS"; A=""
+        case "$TID" in ''|*[!A-Za-z0-9._-]*) exit 0 ;; esac
+        for f in "$_AMD/pending"/*-"$TID"; do [ -f "$f" ] && A="$f"; done
+        [ -n "$A" ] || exit 0
+      fi
+      case "$INPUT" in *'"status":"async_launched"'*|*'"status": "async_launched"'*) ;; *) exit 0 ;; esac
+      _am_rec_get "$A" risk; [ "$_AMV" = critical ] || exit 0
+      _am_rec_get "$A" verify; VCMD="$_AMV"; case "$VCMD" in ''|none) exit 0 ;; esac
+      _ao_json "Crewforth: this critical work was launched in the background, so whether its verify command passed will not be told to you here. When the agent has finished, run the verify command yourself with the Bash tool ($VCMD) and judge the result before you build on the work or report it done."
+      printf '{"hookSpecificOutput":{"hookEventName":"PostToolUse","additionalContext":"%s"}}\n' "$_AOJ"
+      exit 0
+    fi
     _am_rec_get "$R" verify; RES="$_AMV"; _am_rec_get "$R" confidence; CONF="$_AMV"; _am_rec_get "$R" tier; TI="$_AMV"
     _am_rec_get "$R" esc; ESC="$_AMV"; _am_rec_get "$R" cmd; VCMD="$_AMV"
     case "$RES" in fail|blocked|timeout) ;; *) [ "$CONF" = low ] || exit 0 ;; esac

package/kit/hooks/context-usage.sh

@@ -103,7 +103,7 @@ if [ -n "${IN:-}" ] && [ -n "${PSID:-}" ]; then
           # In auto and dontAsk the user's own message is the approval (hooks/prompt-approval.sh); plan and
           # bypassPermissions have no such route.
           case "$PM" in
-            auto|dontAsk) PMHOW="stage the change, show the message in ONE code block and under it one line in the user's language, 'If you approve, send only this: /crew-approve commit' (or /crew-approve push, /crew-approve commit+push; the command stays as it is in every language, and only the user can type it); the user approves by sending that command alone. It covers what is staged at that moment, for 30 minutes, until their next message; never write it for them" ;;
+            auto|dontAsk) PMHOW="stage the change, show the message in ONE code block and under it one line in the user's language, 'If you approve, send only this:' and then, on a line of its own, the command the gate's refusal names: /crew-approve (it approves what the gate just refused; spelled out it is /crew-approve commit, push or commit+push; the command stays as it is in every language, and only the user can type it); the user approves by sending that command alone. It covers what is staged at that moment, for 30 minutes, until their next message; never write it for them" ;;
             *)            PMHOW="a real yes still comes first, then the user switches mode (or exports CLAUDE_GIT_OK=1 in headless/CI)" ;;
           esac
           echo "🔒 Permission mode: $PM. git commit/push fail closed in this mode (§4.4). Only when a commit or push comes up: say so before you ask for approval; $PMHOW. Otherwise do not mention it."

package/kit/hooks/guard-agent-model.sh

@@ -21,7 +21,8 @@
 #   * a class that failed too often is held one model up (crew-model-floors.auto, written by hooks/agent-outcome.sh),
 #     until the user lowers it again with /crew-loosen (one model, once for each raise).
 #   * a card whose verify failed is not run again on the same or a lower model, and not a third time at all.
-#   * critical work with a verify command runs in the foreground, where its result reaches the session.
+#   * critical work with a verify command is not sent to the background (run_in_background true), where its
+#     result does not reach the session. A call that leaves the field out passes: not every Agent tool has it.
 # THE WORDING IS READ BY ANOTHER PROGRAM (the Studio panel): a refusal is one line that begins
 # `GUARD (agent model):`, and a floor is said as ` runs on <model> or above`. The suite pins both.
 #
@@ -799,9 +800,15 @@ _json_keycount "$ti" run_in_background
 if [ "$_KC" -gt 1 ]; then echo "GUARD (agent model): this call names run_in_background more than once, so where it runs cannot be read and the call is refused. Send one." >&2; _am_log "an ambiguous call"; exit 2; fi
 _json_find "$ti" '"run_in_background"'; bg=unset
 if [ "$_KC" = 1 ] && [ "$_JF" -ge 0 ]; then f="${ti:_JF+19:12}"; f="${f//[$' \t\n\r']/}"; case "$f" in :false*) bg=false ;; :true*) bg=true ;; esac; fi
-if [ "$CARD_RISK" = critical ] && [ "$CARD_VERIFY" != none ] && [ "$bg" != false ]; then
-  echo "GUARD (agent model): critical work with a verify command runs in the foreground, where its result comes back to you: repeat the same call with run_in_background set to false (left out, an agent starts in the background)." >&2
-  _am_log "critical work not in the foreground"; exit 2
+# Measured on Claude Code 2.1.294 and 2.1.296. Where the Agent tool has run_in_background, a call that leaves it out
+# starts in the background. Where background tasks are off the tool has NO such parameter: the model cannot send it
+# and the call runs in the foreground. The payload of the two is the same, so a call that leaves the field out is
+# let through. (Asking for `false` refused every critical call with a verify command in a session whose tool has
+# no such field, each time.) Only a call that SAYS background is refused; agent-outcome.sh tells the session when a
+# call that left the field out turned out to be launched in the background.
+if [ "$CARD_RISK" = critical ] && [ "$CARD_VERIFY" != none ] && [ "$bg" = true ]; then
+  echo "GUARD (agent model): critical work with a verify command is not sent to the background, where its result does not come back to you: repeat the same call with run_in_background set to false." >&2
+  _am_log "critical work sent to the background"; exit 2
 fi
 # The verify command is NOT judged here. Whether the hook runs it is decided when it would start (_am_verify_ok, in
 # hooks/agent-outcome.sh): a command it will not run is recorded as blocked and the session is told to run it

package/kit/hooks/guard-bash.sh

@@ -1823,7 +1823,7 @@ _appr_named(){  # sets _APN: 1 = the record is named, 2 = the hook is fed, 3 = a
   t="$CMD_UQ"; _APN=0
   shopt -q nocasematch && nc=1; shopt -s nocasematch
   case "$t" in
-    *crewforth-appr*) _APN=1 ;;
+    *crewforth-appr*|*crew-approval-pending*) _APN=1 ;;
   esac
   [ "$nc" = 0 ] && shopt -u nocasematch
   # FED means the hook is what the input goes INTO: it stands after a pipe, or shares its command with an input
@@ -1857,9 +1857,13 @@ _appr_named
 _appr_word(){  # $1 = a word of the command -> 0 when it, or what follows its first `=`, is an approval
   local w="$1"
   [ "${#w}" -le 160 ] || return 1
-  _crew_appr_op "$w"; [ -n "$OP" ] && return 0
-  case "$w" in *=*) _crew_appr_op "${w#*=}"; [ -n "$OP" ] && return 0 ;; esac
-  return 1
+  _crew_appr_op "$w"; [ -z "$OP" ] && case "$w" in *=*) _crew_appr_op "${w#*=}" ;; esac
+  [ -n "$OP" ] || return 1
+  # `/crew-approve` with nothing after it is a single word, and a single word turns up where nothing is started:
+  # `grep -rn /crew-approve .claude/hooks`. It counts only in a command one of whose words IS claude (also
+  # claude.exe, a path that ends in it, the package's name): then it is a prompt, or about to be piped into one.
+  if [ "$OP" = pending ] && [ "$_AWC" != 1 ]; then OP=""; return 1; fi
+  return 0
 }
 _appr_in_claude_call(){  # 0 = a word of this command is an approval (OP names it)
   # The command AS IT WAS SENT: the prompt of a plain `claude -p "…"` has been taken out of CMD by now (it is text for
@@ -1871,7 +1875,10 @@ _appr_in_claude_call(){  # 0 = a word of this command is an approval (OP names i
   [ -f "$here/prompt-approval.sh" ] || return 1          # no recording hook: no approval can be recorded at all
   declare -F _crew_appr_op >/dev/null 2>&1 || . "$here/prompt-approval.sh"
   declare -F _crew_appr_op >/dev/null 2>&1 || return 1
-  OP=""
+  OP=""; _AWC=0
+  case " ${CMD_UQ//[;|&()]/ } " in
+    *[[:space:]]claude[[:space:]]*|*[[:space:]]claude.exe[[:space:]]*|*[[:space:]]claude.cmd[[:space:]]*|*/claude[[:space:]]*|*/claude.exe[[:space:]]*|*claude-code*) _AWC=1 ;;
+  esac
   while :; do
     pre="${s%%[\"\'\\$' \t\n;|&()<>']*}"
     [ -n "$pre" ] && { w="$w$pre"; inw=1; }
@@ -3254,10 +3261,39 @@ ${BRANCH_WARN}Approve only if the commit message above was shown to you and you
         exit 2
       fi
       _aps=push; git_has "$CMD_SEEN" 'commit' && _aps=commit
+      # WHAT WAS REFUSED IS WRITTEN DOWN, so that the user can approve it with `/crew-approve` and nothing after it:
+      # the session, the operation and the second, in .claude/state/crew-approval-pending. The operation is what
+      # THIS gate saw in the command it refused; a commit refused and then a push refused in the same session
+      # within 30 minutes are one thing waiting, commit+push. The file is closed to the session (guard-write.sh,
+      # and the name rule above): a session that could write it would choose what the user's approval covers.
+      _pw=""
+      if ! { git_has "$CMD_SEEN" 'commit' && git_has "$CMD_SEEN" 'push'; }; then
+        _pd="${CLAUDE_PROJECT_DIR:-${_CWD:-.}}"; _pd="${_pd//\\//}"; _pd="${_pd%/}/.claude/state"
+        _json_slice "$INPUT" session_id >/dev/null; _psid="$_JS"
+        case "$_psid" in ''|*[!A-Za-z0-9._-]*) _psid="" ;; esac
+        if [ -n "$_psid" ] && mkdir -p "$_pd" 2>/dev/null; then
+          if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _pn '%(%s)T' -1; else _pn="$(date +%s)"; fi
+          _po=""; _ps=""; _pt=""
+          if [ -f "$_pd/crew-approval-pending" ]; then
+            while IFS= read -r _pl || [ -n "$_pl" ]; do case "$_pl" in sid=*) _ps="${_pl#sid=}" ;; op=*) _po="${_pl#op=}" ;; ts=*) _pt="${_pl#ts=}" ;; esac; done < "$_pd/crew-approval-pending"
+          fi
+          _pw="$_aps"
+          case "$_pt" in ''|*[!0-9]*) _pt=0 ;; esac
+          if [ "$_ps" = "$_psid" ] && [ $((_pn - _pt)) -ge 0 ] && [ $((_pn - _pt)) -le 1800 ]; then
+            case "$_po:$_aps" in commit:push|push:commit|commit+push:*) _pw="commit+push" ;; esac
+          fi
+          { printf 'sid=%s\nop=%s\nts=%s\n' "$_psid" "$_pw" "$_pn" > "$_pd/crew-approval-pending"; } 2>/dev/null || _pw=""
+        fi
+      fi
       echo "ASK THE USER NOW, in their language, in this shape and with nothing after it (stage first: the approval covers what is staged at that moment):" >&2
       echo "  1. the commit message, whole, in ONE code block;" >&2
-      echo "  2. under it ONE line, the sentence in their language and the command as it is (only the user can type it):  If you approve, send only this: /crew-approve $_aps" >&2
-      echo "     Name the one the user can type for this call: /crew-approve commit, /crew-approve push, or /crew-approve commit+push when a push follows the commit." >&2
+      if [ -n "$_pw" ]; then
+        echo "  2. under it one sentence in their language (If you approve, send only this:), and then the command on a line of its own, exactly as it is:" >&2
+        echo "/crew-approve"$'\n'"     That line is the whole message, and only the user can type it. It approves what was just refused here: $_pw. (Spelled out, the user can type /crew-approve commit, push or commit+push instead.)" >&2
+      else
+        echo "  2. under it ONE line, the sentence in their language and the command as it is (only the user can type it):  If you approve, send only this: /crew-approve $_aps" >&2
+        echo "     Name the one the user can type for this call: /crew-approve commit, /crew-approve push, or /crew-approve commit+push when a push follows the commit." >&2
+      fi
       echo "Their message has to be that command alone, typed by them: a sentence such as 'go ahead and commit' is not an approval, and you cannot run the command for them. It is tied to the staged tree and HEAD, lasts 30 minutes and ends at their next message." >&2
       echo "Then run the command ALONE in its call (no cd, no pipe, nothing chained): git commit -m '…', or git push <remote> <branch>." >&2
       echo "The other ways: Shift+Tab to default/acceptEdits (this gate then asks them directly), or the command in their own terminal." >&2

package/kit/hooks/guard-schedule.sh

@@ -86,7 +86,8 @@ while IFS= read -r sv; do
       echo "Schedule the work without it. If a floor looks too high, say so: the user can type /crew-loosen $LO_AGENT $LO_CHANGE $LO_RISK themselves." >&2
     else
       echo "GUARD (§4.4): this call schedules a prompt that is an approval for a commit or a push ($OP). An approval is what the user types; a prompt a tool schedules would approve in their place, so the call is refused." >&2
-      echo "Schedule the work without it. For the approval itself, show the commit message and ask: the user can type /crew-approve $OP when they agree." >&2
+      _so=" $OP"; [ "$OP" = pending ] && _so=""
+      echo "Schedule the work without it. For the approval itself, show the commit message and ask: the user can type /crew-approve$_so when they agree." >&2
     fi
     exit 2
   fi

package/kit/hooks/prompt-approval.sh

@@ -358,7 +358,7 @@ _crew_appr_path(){  # $1 = a directory -> _AP: the record's path in that worktre
 
 # ---- WHICH TEXT IS AN APPROVAL: one function, asked here of the user's prompt and by guard-schedule.sh of a
 # prompt a tool is about to schedule ---------------------------------------------------------------------------
-_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | loosen, or "" when the text is neither
+_crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | pending | loosen, or "" when the text is none
   # `loosen` is the other thing only the user's own message does: `/crew-loosen <agent> <change> <risk>` lowers a
   # floor that model routing raised (3.1.0). It is matched HERE so that everything that refuses to hand a session
   # an approval (a scheduled prompt, a `claude -p` call) refuses to hand it this as well: one question, one answer.
@@ -374,7 +374,11 @@ _crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | lo
     # THE COMMAND: `/crew-approve <what>`, or `/<plugin>:crew-approve <what>` as a plugin names its commands. Measured
     # on Claude Code 2.1.284: a command the user types reaches UserPromptSubmit with `prompt` as typed, and a skill
     # the model starts with the Skill tool raises PreToolUse and PostToolUse only, never that event.
-    /*) _k="${P%%[$' \t']*}"; [ "$_k" != "$P" ] || return 0
+    # With NOTHING after it, `/crew-approve` approves what this session was last refused (3.1.0): OP is `pending`
+    # here, and the hook's own flow looks up what that is. It is an approval like the others to everything that
+    # asks this function, so a scheduled or handed-over `/crew-approve` is refused the same way.
+    /*) _k="${P%%[$' \t']*}"
+        if [ "$_k" = "$P" ]; then _k="${_k#/}"; [ "${_k##*:}" = crew-approve ] && OP=pending; return 0; fi
         _v="${P:${#_k}}"; _vr="$_v"; _k="${_k#/}"; _k="@${_k##*:}" ;;      # `@`: a command, so `crew-approve: commit` as text is not one
     # The text form of 3.1.0's release candidates, kept: `approve: <what>` and `onay: <what>`.
     *:*) _k="${P%%:*}"; _v="${P#*:}" ;;
@@ -483,6 +487,35 @@ if [ "$OP" = loosen ]; then
       "The user lowered the calibration floor of $LO_AGENT / $LO_CHANGE / $LO_RISK from $LFROM to $LTO with their own command. The card's own rules still hold (critical work on opus, no verify command on sonnet or above, the agent's floor). If the class fails its first try too often again, the floor rises again."
 fi
 
+# ---- `/crew-approve` with nothing after it: what this session was last refused ---------------------------------
+# guard-bash.sh, when it refuses a commit or a push in auto / dontAsk, writes down what it refused
+# (.claude/state/crew-approval-pending: the session, commit | push | commit+push, the second). The bare command
+# approves THAT and nothing else: the same session's, not older than 30 minutes. What is approved is therefore
+# never read from the message and never from the model: the gate wrote it, from the command it refused. From here
+# on the flow is the one a spelled-out approval takes, with every proof it asks for (the mode, a session that is
+# attended, a transcript on disk) and the same record at the end.
+BARE=0
+if [ "$OP" = pending ]; then
+  BARE=1
+  _json_slice "$INPUT" permission_mode >/dev/null
+  case "$_JS" in auto|dontAsk) ;; *) exit 0 ;; esac          # elsewhere the gate asks the user itself; nothing waits here
+  _json_slice "$INPUT" session_id >/dev/null; _bsid="$_JS"
+  _bp="${CLAUDE_PROJECT_DIR:-$CWD}"; _bp="${_bp//\\//}"; _bp="${_bp%/}/.claude/state/crew-approval-pending"
+  _bs=""; _bo=""; _bt=""
+  if [ -f "$_bp" ]; then
+    while IFS= read -r _bl || [ -n "$_bl" ]; do
+      case "$_bl" in sid=*) _bs="${_bl#sid=}" ;; op=*) _bo="${_bl#op=}" ;; ts=*) _bt="${_bl#ts=}" ;; esac
+    done < "$_bp"
+  fi
+  if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _bn '%(%s)T' -1; else _bn="$(date +%s)"; fi
+  OP="a commit or a push"
+  case "$_bo" in commit|push|commit+push) ;; *) no "nothing is waiting for approval in this session: no commit or push was refused. Have the commit message shown and the commit tried first; or name it: the user can type /crew-approve commit, push or commit+push." ;; esac
+  { [ -n "$_bsid" ] && [ "$_bs" = "$_bsid" ]; } || no "what is waiting for approval was refused in another session, not this one. Nothing is approved; have it tried here first."
+  case "$_bt$_bn" in *[!0-9]*|'') no "the time of what is waiting could not be read." ;; esac
+  [ $((_bn - _bt)) -ge 0 ] && [ $((_bn - _bt)) -le 1800 ] || no "what was waiting for approval ($_bo) is more than 30 minutes old. Nothing is approved; have it tried again first."
+  OP="$_bo"                                                 # used up further down, once the approval is on record
+fi
+
 _json_slice "$INPUT" permission_mode >/dev/null; PM="$_JS"
 case "$PM" in
   auto|dontAsk) ;;
@@ -559,6 +592,9 @@ case "$TS" in ''|*[!0-9]*) no "the clock could not be read." ;; esac
 
 { printf 'v=1\nop=%s\ntree=%s\nhead=%s\nbranch=%s\nremote=%s\nurl=%s\nsid=%s\nts=%s\n' "$OP" "$TREE" "$HEAD_NOW" "$BR" "$RM" "$URL" "$SID" "$TS" > "$REC"; } 2>/dev/null \
   || no "the record could not be written in the git directory."
+# What was waiting has been approved: it is not approved a second time. Only here, after every proof and the record
+# itself: a bare command that recorded nothing (a headless session, a first message) leaves it for the user.
+[ "$BARE" = 1 ] && { : > "$_bp"; } 2>/dev/null
 
 _h="${HEAD_NOW:0:7}"; _d="${TREE:0:7}"
 # THE ADDRESS IS SHOWN TO THE USER, not only compared: a rewrite set BEFORE the approval (`url.<x>.insteadOf`) is
@@ -577,5 +613,6 @@ case "$OP" in
                HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR" ;;
 esac
 [ -n "$_u" ] && _u=" ($RM pushes to $_u)"
-say "Crewforth: approval recorded - $WHAT$_u. Valid for 30 minutes; your next message ends it." \
+_bw=""; [ "$BARE" = 1 ] && _bw="approved: $OP (what this session was refused). "
+say "Crewforth: ${_bw}approval recorded - $WHAT$_u. Valid for 30 minutes; your next message ends it." \
     "The user approved this in their own message and Crewforth recorded it: $WHAT. $HOW The approval covers what was staged and where HEAD was at that moment, in this session: if either changes it no longer applies and the user approves again. It ends in 30 minutes or at the user's next message. Force-push and the rest of §4.5 are not opened by it."

package/kit/skills/crew-approve/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: crew-approve
 description: Approve the commit or push Claude just showed you (auto and dontAsk modes).
-argument-hint: "[commit | push | commit+push]"
+argument-hint: "[commit | push | commit+push]  (nothing: what was just refused)"
 disable-model-invocation: true
 metadata:
   kind: command
@@ -19,6 +19,9 @@ Read the line Crewforth added to this turn and do what it says:
   `git commit -m '…'` with the message you showed (single-quoted, or from a here-document with a quoted delimiter);
   a push is `git push <remote> <branch>`. The review record of §4.6 is still required.
 - **"approval NOT recorded"**: tell the user the reason it gives, and run nothing.
+- **With no argument** the command approves what the gate last refused in this session (the line says which:
+  "approved: commit+push"); when nothing was refused, or it was more than 30 minutes ago, nothing is recorded and
+  the line says so.
 - **No such line**: the session is in a mode where the gate asks the user itself (`default`, `acceptEdits`), or
   the argument was not `commit`, `push` or `commit+push`. Say which, and in the first case run the command and let
   the gate's own prompt ask.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewforth",
-  "version": "3.1.0-rc.6",
+  "version": "3.1.0-rc.7",
   "description": "Crewforth — your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
   "bin": {
     "crewforth": "bin/cli.js"