crewforth 3.1.1 → 3.2.0-rc.2

package/kit/hooks/guard-question.sh

@@ -0,0 +1,73 @@
+#!/usr/bin/env bash
+# guard-question.sh - the approval question reaches the person, not a hook (§4.4, 3.2.0).
+#
+# WHY. In `auto` the user can approve a commit or a push by answering one fixed question (AskUserQuestion), and
+# hooks/prompt-approval.sh records the answer on PostToolUse. An answer is only worth recording if a person gave it.
+# Two things can give it instead: another PreToolUse hook that answers `allow` with the answers filled in, and a
+# PermissionRequest hook that answers the prompt before the person does (both measured on Claude Code 2.1.294).
+#
+# WHAT. Wired on PreToolUse for AskUserQuestion. Any question but the approval question gets no decision. The
+# approval question must be the fixed text with no answers, asked in `auto` in an attended session; then this
+# hook answers `ask`, which beats the first kind of hook in every mode, and only when no PermissionRequest hook
+# may be wired (the second kind; _crew_prh_scan). It also notes the call it asked, and prompt-approval.sh records
+# an answer to that call only. Everything it decides is defined in prompt-approval.sh (_crew_q_pre), sourced.
+#
+# A GATE, so an error of its own refuses the call (CREW-FAILCLOSED): a question let through with no `ask` is one a
+# hook can answer.
+# COST. Builtins on every AskUserQuestion; on the approval question the scan reads files and starts no process.
+set -uo pipefail
+# ---- CREW-LOCALE -----------------------------------------------------------------------------------------
+# Everything this gate matches with runs in the C locale, whatever the session's own is. Under a Turkish locale
+# the letters i and I are not each other's other case (their partners are İ and ı), and every case-insensitive
+# match here is written in ASCII. Measured under tr_TR.UTF-8 with the locale left as it came:
+#   GNU grep 3.11 / bash 5.2 on Linux: `grep -i init` does not find INIT (-F, -E and plain alike);
+#     bash's nocasematch does not match GIT against git; `[A-Za-z]` in a regex does not hold I; awk's tolower
+#     turns GIT into gıt. The suite, run whole under that locale, went from 4 failures to 30: a recursive
+#     Remove-Item, a write to a gate file, `git config --remove-section core`, a read of a nested .env and a
+#     staged key all passed.
+#   GNU grep 3.0 in Git Bash on Windows: `grep -iF` with an ASCII pattern aborts (exit 134), and the pre-commit
+#     scan for private strings read that as "no match".
+#   macOS (BSD grep, bash 3.2): none of it; tr_TR.UTF-8 folds i and I the ASCII way there.
+# The cost: a letter outside ASCII has no other case in the C locale. The two git hooks that scan a user's own
+# words look a second time under the session's locale for a pattern that holds such a letter (_CREW_LOCALE).
+# Byte-identical in every gate; the suite pins it.
+_CREW_LOCALE="${LC_ALL:-${LC_CTYPE:-${LANG:-}}}"
+case "$_CREW_LOCALE" in C|POSIX) _CREW_LOCALE="" ;; esac
+export LC_ALL=C
+# ---- /CREW-LOCALE
+# ---- CREW-FAILCLOSED ---------------------------------------------------------------------------------------
+# A gate that stops on an error of its own must refuse the call, not let it through. Claude Code blocks a tool call
+# on exit 2 only; a hook that dies with 1, or runs on past the rule that broke, has allowed it. Both happened in
+# one defect (measured, bash 5): a local array declared and not set is "unbound" under `set -u`, the rule that read
+# it was abandoned in the middle, the script went on with the NEXT top-level command and left with 0, and
+# `rm .claude/hooks/pre-commit` passed. bash does one of two things with such an error, by the kind of error:
+#   * it leaves the shell with a status that is neither 0 nor 2  -> the EXIT trap below turns that into a refusal;
+#   * it abandons the top-level command it was in and continues -> the whole gate IS one top-level command,
+#     _gate_main, which only ever ends by `exit`. If it RETURNS, it was abandoned, and the line after it refuses.
+# Not covered, and said so: an error inside a command substitution (only that subshell ends), and a command
+# that is not found (status 127, the script continues inside the same command).
+# Byte-identical in every PreToolUse gate; the suite pins it. No process is started.
+_crew_stop(){  # $1 = what happened
+  declare -F gatelog >/dev/null 2>&1 && gatelog BLOCK 4.5 "the gate stopped on an error of its own"
+  echo "GUARD (§4.5): this gate stopped on an error of its own ($1) before it finished judging the call, so the call is refused." >&2
+  echo "Nothing about the call itself was found. The error is the line above these two; it is a defect in Crewforth, not in what you ran. Run the doctor (bash .claude/eval/doctor.sh, Bash tool, not PowerShell) and report it." >&2
+  exit 2
+}
+trap '_crew_rc=$?; trap - EXIT; case "$_crew_rc" in 0|2) exit "$_crew_rc" ;; esac; _crew_stop "exit status $_crew_rc"' EXIT
+# ---- /CREW-FAILCLOSED
+_gate_main(){
+local here="${BASH_SOURCE%/*}"
+[ "$here" = "${BASH_SOURCE}" ] && here=.
+IFS= read -r -d '' INPUT || true
+case "$INPUT" in *'Crewforth approval'*) ;; *) exit 0 ;; esac      # not the approval question: nothing to decide
+if [ ! -f "$here/prompt-approval.sh" ]; then
+  echo "GUARD (§4.4): prompt-approval.sh is not beside this gate, so the approval question cannot be checked and is not asked. Update Crewforth; the user can type /crew-approve instead." >&2
+  exit 2
+fi
+. "$here/prompt-approval.sh"
+declare -F _crew_q_pre >/dev/null 2>&1 || { echo "GUARD (§4.4): prompt-approval.sh beside this gate is an older one, so the approval question is not asked. Update Crewforth; the user can type /crew-approve instead." >&2; exit 2; }
+_crew_q_pre
+exit 0
+}
+_gate_main "$@"
+_crew_stop "a command of the gate was abandoned"

package/kit/hooks/guard-write.sh

@@ -388,6 +388,7 @@ WHY_SCRIPT="This file is a gate script — rewriting it would disarm the trace/s
 WHY_DISC="This file is Crewforth's discipline document — it IS the text of §4.1-§4.5, so editing it empties the rules the gates enforce."
 WHY_LINK="A parent directory of this path is a symlink and it resolves into a gate directory, so the write would land on a gate file."
 WHY_MODEL="This file is what model routing decides from: the user's rules, a class's floor, the critical paths, or the record of a call and its result. Only the user and Crewforth's own hooks write it, so a session cannot lower its own floor or erase its own failure."
+WHY_REFUTER="This file is the refuter ledger: what crew-refuter concluded about a finding, written by Crewforth's hook from the agent's own task and answer. A findings document is held to it, so a session that writes it would verify its own findings."
 WHY_APPR="This file records the user's own approval for a commit or a push (§4.4). Only the user's message writes it, so a session cannot approve its own commit."
 WHY_GITCFG="This file holds core.hooksPath: writing it can switch the git hooks off without touching one of them. Settings go through git config, which the Bash guard reads."
 WHY_LONG="The path in this payload is longer than any filesystem accepts. It is refused rather than parsed, because parsing it is the slow path an attacker would aim at."
@@ -545,6 +546,10 @@ _is_gate(){   # 0 = gate file; sets GATE_RULE and GATE_WHY
     # Matched by name wherever it is: a linked worktree keeps its git directory elsewhere.
     */[Cc][Rr][Ee][Ww][Ff][Oo][Rr][Tt][Hh]-[Aa][Pp][Pp][Rr][Oo][Vv][Aa][Ll]|[Cc][Rr][Ee][Ww][Ff][Oo][Rr][Tt][Hh]-[Aa][Pp][Pp][Rr][Oo][Vv][Aa][Ll])
       GATE_RULE="approval-record edit (Write/Edit tools)"; GATE_WHY="$WHY_APPR"; return 0 ;;
+    # The refuter ledger (hooks/refuter-ledger.sh): what crew-refuter concluded, as the hook read it from the agent's
+    # own task and answer. findings.mjs --ledger trusts it; a session that writes it verifies its own findings.
+    */.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Cc][Rr][Ee][Ww]-[Rr][Ee][Ff][Uu][Tt][Ee][Rr].[Tt][Ss][Vv]|.[Cc][Ll][Aa][Uu][Dd][Ee]/[Ss][Tt][Aa][Tt][Ee]/[Cc][Rr][Ee][Ww]-[Rr][Ee][Ff][Uu][Tt][Ee][Rr].[Tt][Ss][Vv])
+      GATE_RULE="gate-file edit (refuter ledger)"; GATE_WHY="$WHY_REFUTER"; return 0 ;;
     # What model routing decides from (hooks/guard-agent-model.sh, hooks/agent-outcome.sh): the user's own rules,
     # the floors raised from the record of outcomes, the list of critical paths, and the records of calls and
     # results. A session that writes one lowers its own floor or wipes its own failure.
@@ -631,6 +636,22 @@ case "$INPUT" in *'"agent_id"'*)
       esac
     fi
   fi ;;
+*)
+  # The session's own write to a critical path (no agent_id: the main thread). Not refused (K7: the user may be
+  # doing exactly this, and an agent is a choice, not a rule); recorded, so it is seen: a NOTE line in the gate log,
+  # which Studio's Gates tab and the status line read. The same definition of "critical path" the agents are held
+  # to; a file outside the project is not the project's critical path.
+  if [ "${CREW_MODEL_ROUTING:-}" != off ] && [ -n "${FP:-}" ]; then
+    _gwm="${BASH_SOURCE%/*}"; [ "$_gwm" = "${BASH_SOURCE}" ] && _gwm=.
+    if [ -f "$_gwm/guard-agent-model.sh" ]; then
+      . "$_gwm/guard-agent-model.sh"
+      if declare -F _am_crit_path >/dev/null 2>&1 && _am_crit_path "$FP"; then
+        case "$_AMRP" in /*|[A-Za-z]:*) ;; *)
+          declare -F _am_log >/dev/null 2>&1 && _am_log "note: the session wrote a critical path itself, not through an agent: $_AMRP ($_AMW)" ;;
+        esac
+      fi
+    fi
+  fi ;;
 esac
 
 # ---- team board: you may not start work nobody knows you started -----------------------------------------------

package/kit/hooks/prompt-approval.sh

@@ -31,6 +31,24 @@
 #
 # COST. This runs on every prompt, so the ordinary one is builtins only: no process is started unless the
 # message is an approval (then git is asked what is staged). eval/smoke-test.sh pins both.
+#
+# THE SAME APPROVAL BY A CLICK (3.2.0). In `auto` the user can also answer ONE fixed question, asked with
+# AskUserQuestion: "Commit only" / "Commit + push" / "Push only" / "No". Two hooks on that tool share what is below:
+#   PreToolUse   guard-question.sh (_crew_q_pre): the question must be the fixed one (_CREW_Q_JSON), carry no
+#                answers, and be asked in `auto`; then it answers `ask`. A hook's `ask` beats another PreToolUse
+#                hook's `allow` that comes with filled-in answers, from every source and in every mode (measured:
+#                34 runs on Claude Code 2.1.294, and in the terminal by hand), so the question reaches the user.
+#   PostToolUse  this hook: the answer is read from the payload and recorded exactly as a typed approval would
+#                be, with the same proofs (an attended session, a transcript on disk, the session id) - and only
+#                when guard-question.sh asked THIS call (.claude/state/crew-approval-asked carries its tool_use_id).
+# WHAT `ask` DOES NOT STOP: a `PermissionRequest` hook. It answers the permission prompt that `ask` raises, before
+# the person does (measured, with `-p` and in the terminal), and it can do the same to the Bash prompt of the
+# §4.4 gate in `default` / `acceptEdits`. So both halves, and guard-bash.sh before it asks, first look for one
+# (_crew_prh_scan). Found, the click is closed and so is the gate's own prompt: the one approval left is the
+# typed one, which no hook can type. HONEST SCOPE: the scan reads the sources a hook can read (user, project and
+# local settings, the file-based managed settings, skill, agent and command front matter, installed plugins).
+# It cannot read settings handed over with `--settings`, managed settings delivered by a server, or a plugin
+# loaded with `--plugin-dir`: a PermissionRequest hook there is past it.
 set -uo pipefail
 # ---- CREW-LOCALE -----------------------------------------------------------------------------------------
 # Everything this gate matches with runs in the C locale, whatever the session's own is. Under a Turkish locale
@@ -56,7 +74,7 @@ export LC_ALL=C
 _PA_LIB=0; [ "${BASH_SOURCE[0]}" != "$0" ] && _PA_LIB=1
 if [ "$_PA_LIB" = 0 ]; then
   IFS= read -r -d '' INPUT || true
-  case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*) ;; *) exit 0 ;; esac
+  case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*|*'"hook_event_name"'*'"AskUserQuestion"'*|*'"AskUserQuestion"'*'"hook_event_name"'*) ;; *) exit 0 ;; esac
 fi
 # ---- CREW-JSON-PARSE ------------------------------------------------------------------------------------
 _json_find(){  # $1 = text, $2 = a literal -> _JF = the offset of its first occurrence, -1 when there is none
@@ -403,8 +421,301 @@ _crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | pe
   fi
 }
 
+# ---- THE APPROVAL QUESTION: one fixed text, asked by the model and answered by the user (3.2.0) ----------------
+# What the user is asked is never the model's wording: PreToolUse refuses any other, so the person always reads the
+# same four answers and what each one does. guard-bash.sh prints it from here for the model to ask.
+_CREW_Q_TEXT='Crewforth approval: may Claude commit what is staged now, push this branch, or both?'
+_CREW_Q_JSON='{"question":"'"$_CREW_Q_TEXT"'","header":"Approval","options":[{"label":"Commit only","description":"Commit exactly what is staged now. No push."},{"label":"Commit + push","description":"Commit what is staged now, then push that commit on this branch."},{"label":"Push only","description":"Push this branch as it is now. No new commit."},{"label":"No","description":"Neither commit nor push."}],"multiSelect":false}'
+_crew_q_op(){  # $1 = the label the user chose -> OP: commit | commit+push | push | no, or "" for anything else
+  case "$1" in
+    'Commit only') OP=commit ;; 'Commit + push') OP=commit+push ;; 'Push only') OP=push ;; 'No') OP=no ;; *) OP="" ;;
+  esac
+}
+
+# ---- IS A PermissionRequest HOOK WIRED WHERE THIS CAN SEE? -------------------------------------------------------
+# A PermissionRequest hook answers a permission prompt before the person does: the one `ask` raises for the approval
+# question, and the one guard-bash.sh raises for a commit in default / acceptEdits (both measured on 2.1.294, with
+# `-p` and in the terminal). Nothing in the answer tells it from a click. So the question is closed, and the gate's
+# prompt with it, whenever such a hook may be wired; the typed /crew-approve stays, because no hook can type.
+# Read here, as text (not parsed, so it errs towards "found"):
+#   settings      user (CLAUDE_CONFIG_DIR or ~/.claude: settings.json, settings.local.json), project (.claude/
+#                 settings.json, settings.local.json), the managed-settings.json files where guard-agent-model.sh
+#                 reads them, and Crewforth's own plugin hooks.json. FOUND: the event's name in any letter case, or a
+#                 `\u` escape in a file that has hooks (an escaped name is still the name).
+#   front matter  SKILL.md, agents/*.md and commands/*.md of the project, the user and every installed plugin.
+#                 Only the block between the first two `---` lines is read. FOUND: the event's name, or a backslash
+#                 in a front matter that has hooks (YAML spells a letter as \x52 or \u0052 in double quotes).
+#   plugins       every installed plugin (plugins/cache/<marketplace>/<plugin>/<version>): the .json files at its top,
+#                 in hooks/ and in .claude-plugin/ (hooks.json, a plugin.json with inline hooks). Same rule as settings.
+# NOT READ, and written as the limit in the docs: `--settings` given on the command line, managed settings a server
+# delivers, a plugin loaded with --plugin-dir. A hook added while the session runs is read at the next question:
+# the scan runs at every question and every commit, never cached.
+# _PRH names the first file found, for the message. No process is started; this runs only when a question or a
+# commit is decided, never on an ordinary prompt.
+_crew_prh_text(){  # $1 = json | fm, $2 = text -> 0 when it may wire a PermissionRequest hook
+  local t="$2" nc=0 r=1
+  shopt -q nocasematch && nc=1; shopt -s nocasematch
+  case "$t" in *permissionrequest*) r=0 ;; esac
+  if [ "$r" = 1 ]; then
+    case "$t" in *hooks*)
+      if [ "$1" = json ]; then
+        t="${t//\\\\/}"                       # an escaped backslash is not the start of an escape
+        case "$t" in *'\u'*|*'\U'*) r=0 ;; esac
+      else
+        case "$t" in *\\*) r=0 ;; esac
+      fi ;;
+    esac
+  fi
+  [ "$nc" = 0 ] && shopt -u nocasematch
+  return "$r"
+}
+_crew_prh_fm(){  # $1 = a markdown file -> _FM: its front matter, "" when it has none
+  local l n=0
+  _FM=""
+  { IFS= read -r l || [ -n "$l" ]; l="${l%$'\r'}"; [ "$l" = --- ] || return 0
+    while IFS= read -r l || [ -n "$l" ]; do
+      l="${l%$'\r'}"; [ "$l" = --- ] && return 0
+      _FM="$_FM$l"$'\n'; n=$((n+1)); [ "$n" -le 400 ] || return 0
+    done; } < "$1"
+}
+_crew_prh_scan(){  # -> 0 when a PermissionRequest hook may be wired; _PRH names where
+  local p="${CLAUDE_PROJECT_DIR:-${CWD:-${_CWD:-.}}}" u="${CLAUDE_CONFIG_DIR:-${HOME:-}/.claude}" f t list
+  local LC_ALL=C
+  p="${p//\\//}"; p="${p%/}"; u="${u//\\//}"; u="${u%/}"
+  _PRH=""
+  # The managed files are the ones guard-agent-model.sh reads (_am_settings_files), CREW_MANAGED_SETTINGS included:
+  # it can only add a file to look in, so it can only close the question. smoke-test.sh pins the two lists equal.
+  for f in "$u/settings.json" "$u/settings.local.json" "$p/.claude/settings.json" "$p/.claude/settings.local.json" \
+           "/Library/Application Support/ClaudeCode/managed-settings.json" "/etc/claude-code/managed-settings.json" \
+           "/c/Program Files/ClaudeCode/managed-settings.json" "/c/ProgramData/ClaudeCode/managed-settings.json" \
+           "${CREW_MANAGED_SETTINGS:-}" "${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT//\\//}/hooks/hooks.json}"; do
+    [ -n "$f" ] && [ -f "$f" ] || continue
+    t=""; IFS= read -r -d '' t < "$f" || true
+    _crew_prh_text json "$t" && { _PRH="$f"; return 0; }
+  done
+  # Globs, not `find`: no process is started, and this runs before every commit prompt (on Git Bash a process is
+  # 62-135 ms). A plugin is cache/<marketplace>/<plugin>/<version>/; a command or an agent may sit one folder down.
+  local ng=0 r=1
+  shopt -q nullglob && ng=1; shopt -s nullglob
+  for f in "$u"/plugins/cache/*/*/*/*.json "$u"/plugins/cache/*/*/*/hooks/*.json "$u"/plugins/cache/*/*/*/.claude-plugin/*.json; do
+    t=""; IFS= read -r -d '' t < "$f" || true
+    _crew_prh_text json "$t" && { _PRH="$f"; r=0; break; }
+  done
+  if [ "$r" = 1 ]; then
+    for f in "$p"/.claude/skills/*/SKILL.md "$p"/.claude/agents/*.md "$p"/.claude/agents/*/*.md "$p"/.claude/commands/*.md "$p"/.claude/commands/*/*.md \
+             "$u"/skills/*/SKILL.md "$u"/agents/*.md "$u"/agents/*/*.md "$u"/commands/*.md "$u"/commands/*/*.md \
+             "$u"/plugins/cache/*/*/*/skills/*/SKILL.md "$u"/plugins/cache/*/*/*/agents/*.md "$u"/plugins/cache/*/*/*/agents/*/*.md \
+             "$u"/plugins/cache/*/*/*/commands/*.md "$u"/plugins/cache/*/*/*/commands/*/*.md; do
+      _crew_prh_fm "$f"
+      [ -n "$_FM" ] && _crew_prh_text fm "$_FM" && { _PRH="$f"; r=0; break; }
+    done
+  fi
+  [ "$ng" = 0 ] && shopt -u nullglob
+  return "$r"
+}
+
+# ---- the approval question's context, and its PreToolUse half -----------------------------------------------
+# Shared by prompt-approval.sh (PostToolUse: it records the answer) and guard-question.sh (PreToolUse: it asks). The
+# PreToolUse half is a GATE and lives in a gate's file, so an error of its own refuses the call (CREW-FAILCLOSED)
+# instead of letting the question through with no `ask`; this file also answers UserPromptSubmit, where a refusal
+# would erase the user's message.
+_crew_q_ctx(){  # $INPUT -> CWD REC PM SID _QTU _QAD ASKED _QNOW; exits 0 (no decision) when the call is not the approval question
+  _json_keycount "$INPUT" hook_event_name; [ "$_KC" = 1 ] || exit 0
+  _json_keycount "$INPUT" tool_name; [ "$_KC" = 1 ] || exit 0
+  _json_slice "$INPUT" tool_name >/dev/null; [ "$_JS" = AskUserQuestion ] || exit 0
+  case "$INPUT" in *'Crewforth approval'*) ;; *) exit 0 ;; esac
+  _json_slice "$INPUT" cwd >/dev/null; _json_unescape "$_JS" >/dev/null; CWD="$_JU"
+  [ -n "$CWD" ] || CWD="${CLAUDE_PROJECT_DIR:-.}"
+  CWD="${CWD//\\//}"
+  _crew_appr_path "$CWD"; REC="$_AP"
+  _json_slice "$INPUT" permission_mode >/dev/null; PM="$_JS"
+  _json_slice "$INPUT" session_id >/dev/null; SID="$_JS"
+  _json_slice "$INPUT" tool_use_id >/dev/null; _QTU="$_JS"
+  _QAD="${CLAUDE_PROJECT_DIR:-$CWD}"; _QAD="${_QAD//\\//}"; _QAD="${_QAD%/}/.claude/state"; ASKED="$_QAD/crew-approval-asked"
+  if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _QNOW '%(%s)T' -1; else _QNOW="$(date +%s)"; fi
+}
+_crew_q_pre(){  # the PreToolUse decision: `ask`, or a refusal (exit 2) that says why
+  _crew_q_ctx
+  qno(){  # $1 = why, for the model. The call does not run; where it applies, the typed approval is named as the way left.
+    echo "GUARD (§4.4): the approval question was not asked: $1" >&2
+    [ "${2:-}" = nohint ] || echo "The way that always works is the user's own: the user can type /crew-approve (or /crew-approve commit, push, commit+push) as their whole message." >&2
+    exit 2
+  }
+  # The answers are the person's to give. The model's own are ignored by Claude Code (measured), and a call that
+  # carries some is not the plain question this hook asks.
+  _json_keycount "$INPUT" answers; [ "$_KC" = 0 ] || qno "the call carries answers; ask it with none."
+  _json_keycount "$INPUT" questions; [ "$_KC" = 1 ] || qno "the call carries more than one list of questions."
+  case "$INPUT" in *'"questions":['"$_CREW_Q_JSON"']'*) ;;
+    *) qno "it is not the fixed question. Ask exactly this AskUserQuestion input, nothing added or changed: {\"questions\":[$_CREW_Q_JSON]}" ;;
+  esac
+  case "$PM" in
+    auto) ;;
+    dontAsk) qno "in dontAsk Claude Code refuses a question that needs a person, so it would never reach the user." ;;
+    default|acceptEdits) _crew_prh_scan || qno "in $PM the commit or push itself asks the user: run the git command and the gate's own prompt appears." nohint
+                         qno "in $PM, with a PermissionRequest hook that may be wired ($_PRH), only the typed approval counts." ;;
+    *) qno "in ${PM:-an unknown mode} this approval is not open (bypassPermissions and plan fail closed)." ;;
+  esac
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) qno "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  case "$SID$_QTU" in *[!A-Za-z0-9._-]*) qno "the call carries no session or tool id this hook can bind the answer to." ;; esac
+  { [ -n "$SID" ] && [ -n "$_QTU" ]; } || qno "the call carries no session or tool id this hook can bind the answer to."
+  _crew_prh_scan && qno "a PermissionRequest hook may be wired ($_PRH). Such a hook can answer the question before the user does, and the answer cannot be told from a click."
+  mkdir -p "$_QAD" 2>/dev/null && { printf 'sid=%s\ntool=%s\nts=%s\n' "$SID" "$_QTU" "$_QNOW" > "$ASKED"; } 2>/dev/null \
+    || qno "the state folder could not be written, so the answer could not be bound to this question."
+  printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"%s"}}\n' \
+    "Crewforth §4.4: only the person in front of this session answers the approval question."
+  exit 0
+}
+
 [ "$_PA_LIB" = 1 ] && return 0
 
+# Whatever records an approval says why when it does not - to the user and to the model - instead of leaving a
+# commit to fail later with no explanation. EVN is the event this hook answers, SRC what the user gave.
+EVN=UserPromptSubmit; SRC="message"; SRC_BY="in their own message"
+say(){  # $1 = for the user, $2 = for the model. Both are built from fixed text and values checked below.
+  printf '{"systemMessage":"%s","hookSpecificOutput":{"hookEventName":"%s","additionalContext":"%s"}}\n' "$1" "$EVN" "$2"
+  exit 0
+}
+no(){ say "Crewforth: approval NOT recorded - $1" "The user's $SRC is an approval for $OP, but Crewforth could not record it: $1 Tell the user exactly that; the commit/push gate stays closed until they approve again."; }
+
+# ---- THE RECORD: what was approved, measured from git now, never taken from the message or the answer ---------
+# Every route ends here (the typed approval, the bare /crew-approve, the approval question); each one has already
+# checked the permission mode it records in, and sets OP, CWD, REC and SRC_BY.
+_pa_record(){
+  [ -n "$REC" ] || no "this directory is not inside a git repository."
+
+  # A PERSON, IN A SESSION THAT HAS SHOWN THEM SOMETHING. A session can start another one and hand it the approval as
+  # its prompt: `claude -p "/crew-approve commit"`, or an interactive one driven through a pseudo-terminal. That
+  # session's only message is the approval, this hook would record it, and the session would then commit: the first
+  # session has approved for the user. Measured on Claude Code 2.1.294 (macOS), from a hook that printed what it saw:
+  #   started how                                CLAUDE_CODE_SESSION_ATTENDED   the transcript file when this hook runs
+  #   claude -p, from a session's Bash           0 (set to 1 by the caller: still 0)   not there (first message)
+  #   claude -p, from an emptied environment     0                               not there (first message)
+  #   interactive, in a pty, from a session      1                               not there, and never written: a
+  #                                                                              session started inside another keeps none
+  #   interactive, in a pty, emptied environment 1                               not there at the first message; there after
+  #   the desktop app, a conversation under way  1                               there
+  # Nothing else told them apart: the payload has the same fields, CLAUDECODE and CLAUDE_CODE_CHILD_SESSION are 1 in
+  # all of them, CLAUDE_CODE_ENTRYPOINT is inherited from the outer session, and no hook has a terminal on stdin.
+  # So two things are asked. Neither is a documented contract, and both fail towards NOT recording:
+  #   1. the session is not a headless one;
+  #   2. the session's transcript is already on disk when the approval arrives, so the approval is not the session's
+  #      first message and the session is not one that keeps no transcript.
+  # HONEST SCOPE: a session started with an emptied environment and driven through a pseudo-terminal for a second
+  # message passes both. guard-bash.sh refuses the forms of that it can read; a program that types is past it.
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in
+    0) no "this session has nobody in front of it (it was started with -p, or by a program), and an approval is what a person types into their own session." ;;
+  esac
+  _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
+  { [ -n "$TP" ] && [ -s "$TP" ]; } || no "this is the first message of this session, or the session keeps no transcript (one started from inside another session keeps none). An approval answers a commit message the session has shown: have it shown, then approve."
+
+  # The session the user is writing in. guard-bash.sh accepts the record only from that one: a session started by a
+  # command can be handed any prompt.
+  _json_slice "$INPUT" session_id >/dev/null; SID="$_JS"
+  case "$SID" in ''|*[!A-Za-z0-9._-]*) no "this prompt carries no session id to bind the approval to." ;; esac
+
+  HEAD_NOW="$(git -C "$CWD" rev-parse --verify --quiet HEAD 2>/dev/null || echo NONE)"
+  case "$HEAD_NOW" in NONE) ;; *[!0-9a-f]*|'') no "git could not name HEAD here." ;; esac
+  TREE=""; BR=""; RM=""; URL=""
+  case "$OP" in commit*)
+    # THE TREE THE INDEX WRITES, not the text of the staged diff: what `git diff` prints is configurable
+    # (`diff.external`, a textconv filter), and with it two different staged changes can print the same text.
+    TREE="$(git -C "$CWD" write-tree 2>/dev/null)"
+    case "$TREE" in *[!0-9a-f]*|'') no "git could not write the tree of what is staged (an unresolved merge?)." ;; esac
+    if [ "$HEAD_NOW" = NONE ]; then _ht=4b825dc642cb6eb9a060e54bf8d69288fbee4904      # the empty tree
+    else _ht="$(git -C "$CWD" rev-parse --verify --quiet 'HEAD^{tree}' 2>/dev/null)"; fi
+    [ "$TREE" != "$_ht" ] || no "nothing is staged, so there is nothing to approve. Stage the change with git add, show the commit message, then ask again." ;;
+  esac
+  case "$OP" in *push)
+    [ "$OP" = push ] && [ "$HEAD_NOW" = NONE ] && no "there is no commit to push yet."
+    BR="$(git -C "$CWD" symbolic-ref --short -q HEAD 2>/dev/null || true)"
+    [ -n "$BR" ] || no "HEAD is detached, so there is no branch to bind the push to."
+    RM="$(git -C "$CWD" config --get "branch.$BR.pushRemote" 2>/dev/null)" \
+      || RM="$(git -C "$CWD" config --get remote.pushDefault 2>/dev/null)" \
+      || RM="$(git -C "$CWD" config --get "branch.$BR.remote" 2>/dev/null)" || RM=""
+    case "$RM" in ''|.)
+      RM="$(git -C "$CWD" remote 2>/dev/null)"
+      case "$RM" in ''|*$'\n'*) no "this branch has no upstream and the repository does not have exactly one remote, so the push target is not known. Set the upstream, or approve the commit alone." ;; esac ;;
+    esac
+    # Both values go into JSON and into a line-per-field record, so anything outside this set is refused, not escaped.
+    case "$BR$RM" in *[!A-Za-z0-9._/@+-]*) no "the branch or remote name has a character this record does not carry." ;; esac
+    # Where that remote pushes TO, with pushurl and pushInsteadOf applied. The name alone can be pointed elsewhere
+    # after the approval (`git config remote.origin.pushurl …`), so the address is part of what was approved.
+    URL="$(git -C "$CWD" remote get-url --push "$RM" 2>/dev/null)"
+    case "$URL" in ''|*$'\n'*) no "the remote $RM does not push to exactly one address." ;; esac ;;
+  esac
+  if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then
+    printf -v TS '%(%s)T' -1
+  else TS="$(date +%s)"; fi
+  case "$TS" in ''|*[!0-9]*) no "the clock could not be read." ;; esac
+
+  { printf 'v=1\nop=%s\ntree=%s\nhead=%s\nbranch=%s\nremote=%s\nurl=%s\nsid=%s\nts=%s\n' "$OP" "$TREE" "$HEAD_NOW" "$BR" "$RM" "$URL" "$SID" "$TS" > "$REC"; } 2>/dev/null \
+    || no "the record could not be written in the git directory."
+  # What was waiting has been approved: it is not approved a second time. Only here, after every proof and the record
+  # itself: a bare command that recorded nothing (a headless session, a first message) leaves it for the user.
+  [ "$BARE" = 1 ] && { : > "$_bp"; } 2>/dev/null
+
+  _h="${HEAD_NOW:0:7}"; _d="${TREE:0:7}"
+  # THE ADDRESS IS SHOWN TO THE USER, not only compared: a rewrite set BEFORE the approval (`url.<x>.insteadOf`) is
+  # already in what git reports, so the record and the push agree and only the person can tell that "origin" is not
+  # where they think (review). Shown to the user alone, with any `user:secret@` taken out, and never put in front of
+  # the model.
+  _u="$URL"
+  case "$_u" in *://*@*) _ua="${_u#*://}"; case "${_ua%%/*}" in *@*) _u="${_u%%://*}://${_ua#*@}" ;; esac ;; esac
+  case "$_u" in *[\"\\]*|*[![:print:]]*) _u="an address this line cannot print; check it with: git remote get-url --push $RM" ;; esac
+  case "$OP" in
+    commit)      WHAT="commit of what is staged now (tree $_d) on HEAD $_h"
+                 HOW="Run git commit -m with the message, alone in its call: no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained. Single-quote the message, or read it from a here-document with a quoted delimiter. The review record of §4.6 is still required." ;;
+    push)        WHAT="push of $BR at $_h to $RM"
+                 HOW="Run exactly: git push $RM $BR (alone in its call: the remote and the branch written out, no cd, no pipe, nothing chained)." ;;
+    commit+push) WHAT="commit of what is staged now (tree $_d) on HEAD $_h, then push of that commit on $BR to $RM"
+                 HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR" ;;
+  esac
+  [ -n "$_u" ] && _u=" ($RM pushes to $_u)"
+  _bw=""; [ "$BARE" = 1 ] && _bw="approved: $OP (what this session was refused). "
+  say "Crewforth: ${_bw}approval recorded - $WHAT$_u. Valid for 30 minutes; your next message ends it." \
+      "The user approved this $SRC_BY and Crewforth recorded it: $WHAT. $HOW The approval covers what was staged and where HEAD was at that moment, in this session: if either changes it no longer applies and the user approves again. It ends in 30 minutes or at the user's next message. Force-push and the rest of §4.5 are not opened by it."
+}
+
+# ---- THE APPROVAL QUESTION (PreToolUse and PostToolUse of AskUserQuestion) -----------------------------------
+# Only the fixed question is this hook's business: any other question gets no decision from it, here or later.
+_pa_question(){
+  local _as="" _at="" _au="" _al _an
+  _crew_q_ctx
+  # PostToolUse: the user has answered. Recorded only if THIS call was asked by the half above.
+  SRC="answer to the approval question"; SRC_BY="by answering the approval question"; OP="a commit or a push"
+  [ -n "$SID" ] && [ -n "$_QTU" ] || no "the answer carries no session or tool id."
+  if [ -f "$ASKED" ]; then
+    while IFS= read -r _al || [ -n "$_al" ]; do
+      case "$_al" in sid=*) _as="${_al#sid=}" ;; tool=*) _au="${_al#tool=}" ;; ts=*) _at="${_al#ts=}" ;; esac
+    done < "$ASKED"
+  fi
+  { [ "$_as" = "$SID" ] && [ "$_au" = "$_QTU" ]; } || no "Crewforth did not ask this question (guard-question.sh, its PreToolUse half, is not wired or did not pass it), so the answer cannot be shown to have come from the user."
+  : > "$ASKED" 2>/dev/null                                 # one question, one answer
+  case "$_at$_QNOW" in *[!0-9]*|'') no "the time of the question could not be read." ;; esac
+  [ $((_QNOW - _at)) -ge 0 ] && [ $((_QNOW - _at)) -le 1800 ] || no "the question was asked more than 30 minutes ago."
+  case "$INPUT" in *'"questions":['"$_CREW_Q_JSON"']'*) ;; *) no "the question answered is not the fixed one." ;; esac
+  [ "$PM" = auto ] || no "the approval question is recorded in auto only, and this session is in ${PM:-an unknown mode}."
+  _crew_prh_scan && no "a PermissionRequest hook may be wired ($_PRH), and it can answer the question before you do. The approval that still works is typed: the user can type /crew-approve instead."
+  _json_keycount "$INPUT" "$_CREW_Q_TEXT"; _an=$_KC
+  case "$_an" in 1|2) ;; *) no "the answer could not be read." ;; esac
+  _json_slice "$INPUT" "$_CREW_Q_TEXT" >/dev/null
+  _crew_q_op "$_JS"
+  case "$OP" in
+    '') OP="a commit or a push"; no "the answer was none of the four the question offers." ;;
+    no) [ -n "$REC" ] && { : > "$REC"; } 2>/dev/null
+        say "Crewforth: not approved - you answered No." "The user answered No to the approval question. Do not commit or push; ask what they want changed." ;;
+  esac
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) no "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
+  { [ -n "$TP" ] && [ -s "$TP" ]; } || no "the session keeps no transcript on disk (one started from inside another session keeps none)."
+  BARE=0
+  _pa_record
+}
+case "$INPUT" in *'"AskUserQuestion"'*)
+  _json_slice "$INPUT" hook_event_name >/dev/null
+  case "$_JS" in PostToolUse) EVN="$_JS"; _pa_question ;; esac ;;
+esac
+
 # A second "prompt" key cannot come from the text of a prompt (inside a JSON string every quote is escaped), so
 # more than one means the payload is not the shape this hook knows, and nothing is read from it.
 _json_keycount "$INPUT" prompt; _n_prompt=$_KC
@@ -443,12 +754,7 @@ _crew_appr_op "$_JU"
 [ -n "$OP" ] || exit 0
 
 # From here on the message IS an approval, so every way of not recording it says why - to the user and to the
-# model - instead of leaving a commit to fail later with no explanation.
-say(){  # $1 = for the user, $2 = for the model. Both are built from fixed text and values checked below.
-  printf '{"systemMessage":"%s","hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"%s"}}\n' "$1" "$2"
-  exit 0
-}
-no(){ say "Crewforth: approval NOT recorded - $1" "The user's message is an approval for $OP, but Crewforth could not record it: $1 Tell the user exactly that; the commit/push gate stays closed until they approve again."; }
+# model - instead of leaving a commit to fail later with no explanation (say / no, above).
 
 # ---- /crew-loosen: a floor model routing raised is lowered by the user, and by nobody else ----------------------
 # hooks/agent-outcome.sh raises a class's floor when its first try fails too often, and nothing lowers it again but
@@ -498,7 +804,7 @@ BARE=0
 if [ "$OP" = pending ]; then
   BARE=1
   _json_slice "$INPUT" permission_mode >/dev/null
-  case "$_JS" in auto|dontAsk) ;; *) exit 0 ;; esac          # elsewhere the gate asks the user itself; nothing waits here
+  case "$_JS" in auto|dontAsk) ;; default|acceptEdits) _crew_prh_scan || exit 0 ;; *) exit 0 ;; esac   # elsewhere the gate asks the user itself, unless a PermissionRequest hook may answer it
   _json_slice "$INPUT" session_id >/dev/null; _bsid="$_JS"
   _bp="${CLAUDE_PROJECT_DIR:-$CWD}"; _bp="${_bp//\\//}"; _bp="${_bp%/}/.claude/state/crew-approval-pending"
   _bs=""; _bo=""; _bt=""
@@ -519,100 +825,11 @@ fi
 _json_slice "$INPUT" permission_mode >/dev/null; PM="$_JS"
 case "$PM" in
   auto|dontAsk) ;;
-  # Where a prompt reaches the user the gate asks them itself; in plan and bypassPermissions this route is not
-  # open (a decision, 3.1.0). Nothing is recorded and nothing is said: guard-bash.sh explains when it refuses.
+  # Where a prompt reaches the user the gate asks them itself, and nothing is recorded or said here. Except where a
+  # PermissionRequest hook may be wired (3.2.0): it can answer that prompt before the person does, so guard-bash.sh
+  # does not raise it and the typed approval is the one way left, in these modes too. In plan and bypassPermissions
+  # this route is not open (a decision, 3.1.0): guard-bash.sh explains when it refuses.
+  default|acceptEdits) _crew_prh_scan || exit 0 ;;
   *) exit 0 ;;
 esac
-[ -n "$REC" ] || no "this directory is not inside a git repository."
-
-# A PERSON, IN A SESSION THAT HAS SHOWN THEM SOMETHING. A session can start another one and hand it the approval as
-# its prompt: `claude -p "/crew-approve commit"`, or an interactive one driven through a pseudo-terminal. That
-# session's only message is the approval, this hook would record it, and the session would then commit: the first
-# session has approved for the user. Measured on Claude Code 2.1.294 (macOS), from a hook that printed what it saw:
-#   started how                                CLAUDE_CODE_SESSION_ATTENDED   the transcript file when this hook runs
-#   claude -p, from a session's Bash           0 (set to 1 by the caller: still 0)   not there (first message)
-#   claude -p, from an emptied environment     0                               not there (first message)
-#   interactive, in a pty, from a session      1                               not there, and never written: a
-#                                                                              session started inside another keeps none
-#   interactive, in a pty, emptied environment 1                               not there at the first message; there after
-#   the desktop app, a conversation under way  1                               there
-# Nothing else told them apart: the payload has the same fields, CLAUDECODE and CLAUDE_CODE_CHILD_SESSION are 1 in
-# all of them, CLAUDE_CODE_ENTRYPOINT is inherited from the outer session, and no hook has a terminal on stdin.
-# So two things are asked. Neither is a documented contract, and both fail towards NOT recording:
-#   1. the session is not a headless one;
-#   2. the session's transcript is already on disk when the approval arrives, so the approval is not the session's
-#      first message and the session is not one that keeps no transcript.
-# HONEST SCOPE: a session started with an emptied environment and driven through a pseudo-terminal for a second
-# message passes both. guard-bash.sh refuses the forms of that it can read; a program that types is past it.
-case "${CLAUDE_CODE_SESSION_ATTENDED-}" in
-  0) no "this session has nobody in front of it (it was started with -p, or by a program), and an approval is what a person types into their own session." ;;
-esac
-_json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
-{ [ -n "$TP" ] && [ -s "$TP" ]; } || no "this is the first message of this session, or the session keeps no transcript (one started from inside another session keeps none). An approval answers a commit message the session has shown: have it shown, then approve."
-
-# The session the user is writing in. guard-bash.sh accepts the record only from that one: a session started by a
-# command can be handed any prompt.
-_json_slice "$INPUT" session_id >/dev/null; SID="$_JS"
-case "$SID" in ''|*[!A-Za-z0-9._-]*) no "this prompt carries no session id to bind the approval to." ;; esac
-
-HEAD_NOW="$(git -C "$CWD" rev-parse --verify --quiet HEAD 2>/dev/null || echo NONE)"
-case "$HEAD_NOW" in NONE) ;; *[!0-9a-f]*|'') no "git could not name HEAD here." ;; esac
-TREE=""; BR=""; RM=""; URL=""
-case "$OP" in commit*)
-  # THE TREE THE INDEX WRITES, not the text of the staged diff: what `git diff` prints is configurable
-  # (`diff.external`, a textconv filter), and with it two different staged changes can print the same text.
-  TREE="$(git -C "$CWD" write-tree 2>/dev/null)"
-  case "$TREE" in *[!0-9a-f]*|'') no "git could not write the tree of what is staged (an unresolved merge?)." ;; esac
-  if [ "$HEAD_NOW" = NONE ]; then _ht=4b825dc642cb6eb9a060e54bf8d69288fbee4904      # the empty tree
-  else _ht="$(git -C "$CWD" rev-parse --verify --quiet 'HEAD^{tree}' 2>/dev/null)"; fi
-  [ "$TREE" != "$_ht" ] || no "nothing is staged, so there is nothing to approve. Stage the change with git add, show the commit message, then ask again." ;;
-esac
-case "$OP" in *push)
-  [ "$OP" = push ] && [ "$HEAD_NOW" = NONE ] && no "there is no commit to push yet."
-  BR="$(git -C "$CWD" symbolic-ref --short -q HEAD 2>/dev/null || true)"
-  [ -n "$BR" ] || no "HEAD is detached, so there is no branch to bind the push to."
-  RM="$(git -C "$CWD" config --get "branch.$BR.pushRemote" 2>/dev/null)" \
-    || RM="$(git -C "$CWD" config --get remote.pushDefault 2>/dev/null)" \
-    || RM="$(git -C "$CWD" config --get "branch.$BR.remote" 2>/dev/null)" || RM=""
-  case "$RM" in ''|.)
-    RM="$(git -C "$CWD" remote 2>/dev/null)"
-    case "$RM" in ''|*$'\n'*) no "this branch has no upstream and the repository does not have exactly one remote, so the push target is not known. Set the upstream, or approve the commit alone." ;; esac ;;
-  esac
-  # Both values go into JSON and into a line-per-field record, so anything outside this set is refused, not escaped.
-  case "$BR$RM" in *[!A-Za-z0-9._/@+-]*) no "the branch or remote name has a character this record does not carry." ;; esac
-  # Where that remote pushes TO, with pushurl and pushInsteadOf applied. The name alone can be pointed elsewhere
-  # after the approval (`git config remote.origin.pushurl …`), so the address is part of what was approved.
-  URL="$(git -C "$CWD" remote get-url --push "$RM" 2>/dev/null)"
-  case "$URL" in ''|*$'\n'*) no "the remote $RM does not push to exactly one address." ;; esac ;;
-esac
-if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then
-  printf -v TS '%(%s)T' -1
-else TS="$(date +%s)"; fi
-case "$TS" in ''|*[!0-9]*) no "the clock could not be read." ;; esac
-
-{ printf 'v=1\nop=%s\ntree=%s\nhead=%s\nbranch=%s\nremote=%s\nurl=%s\nsid=%s\nts=%s\n' "$OP" "$TREE" "$HEAD_NOW" "$BR" "$RM" "$URL" "$SID" "$TS" > "$REC"; } 2>/dev/null \
-  || no "the record could not be written in the git directory."
-# What was waiting has been approved: it is not approved a second time. Only here, after every proof and the record
-# itself: a bare command that recorded nothing (a headless session, a first message) leaves it for the user.
-[ "$BARE" = 1 ] && { : > "$_bp"; } 2>/dev/null
-
-_h="${HEAD_NOW:0:7}"; _d="${TREE:0:7}"
-# THE ADDRESS IS SHOWN TO THE USER, not only compared: a rewrite set BEFORE the approval (`url.<x>.insteadOf`) is
-# already in what git reports, so the record and the push agree and only the person can tell that "origin" is not
-# where they think (review). Shown to the user alone, with any `user:secret@` taken out, and never put in front of
-# the model.
-_u="$URL"
-case "$_u" in *://*@*) _ua="${_u#*://}"; case "${_ua%%/*}" in *@*) _u="${_u%%://*}://${_ua#*@}" ;; esac ;; esac
-case "$_u" in *[\"\\]*|*[![:print:]]*) _u="an address this line cannot print; check it with: git remote get-url --push $RM" ;; esac
-case "$OP" in
-  commit)      WHAT="commit of what is staged now (tree $_d) on HEAD $_h"
-               HOW="Run git commit -m with the message, alone in its call: no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained. Single-quote the message, or read it from a here-document with a quoted delimiter. The review record of §4.6 is still required." ;;
-  push)        WHAT="push of $BR at $_h to $RM"
-               HOW="Run exactly: git push $RM $BR (alone in its call: the remote and the branch written out, no cd, no pipe, nothing chained)." ;;
-  commit+push) WHAT="commit of what is staged now (tree $_d) on HEAD $_h, then push of that commit on $BR to $RM"
-               HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR" ;;
-esac
-[ -n "$_u" ] && _u=" ($RM pushes to $_u)"
-_bw=""; [ "$BARE" = 1 ] && _bw="approved: $OP (what this session was refused). "
-say "Crewforth: ${_bw}approval recorded - $WHAT$_u. Valid for 30 minutes; your next message ends it." \
-    "The user approved this in their own message and Crewforth recorded it: $WHAT. $HOW The approval covers what was staged and where HEAD was at that moment, in this session: if either changes it no longer applies and the user approves again. It ends in 30 minutes or at the user's next message. Force-push and the rest of §4.5 are not opened by it."
+_pa_record