crewforth 3.2.0-rc.1 → 3.2.0-rc.10

package/kit/hooks/guard-bash.sh

@@ -148,7 +148,14 @@ _join_cmd(){  # CMD -> CMD with its continued lines joined
 # ---- /CREW-JOIN
 # The 2.x names of the variables a user can set still work (one helper: eval/lib/crew-env.sh).
 _crew_d="${BASH_SOURCE%/*}"; [ "$_crew_d" = "${BASH_SOURCE}" ] && _crew_d=.
-[ -f "$_crew_d/../eval/lib/crew-env.sh" ] && . "$_crew_d/../eval/lib/crew-env.sh"; unset _crew_d
+[ -f "$_crew_d/../eval/lib/crew-env.sh" ] && . "$_crew_d/../eval/lib/crew-env.sh"
+# Where the gate log goes: one rule for every gate and reader (eval/lib/gate-log.sh).
+[ -f "$_crew_d/../eval/lib/gate-log.sh" ] && . "$_crew_d/../eval/lib/gate-log.sh"
+# What a stopped or asked command would have touched (eval/lib/preview.sh), read only when one is stopped or asked.
+_CREW_PV_LIB="$_crew_d/../eval/lib/preview.sh"; unset _crew_d
+# The preview of a command. ALWAYS called as "$(_pv_line …)": the command substitution is the subshell that keeps an
+# exit or a failure in the library from ending this hook or changing its decision (smoke plants both).
+_pv_line(){ [ -f "$_CREW_PV_LIB" ] || return 0; . "$_CREW_PV_LIB" 2>/dev/null && crew_preview "$1" "$2" 2>/dev/null && printf '%s' "${_CREW_PV:-}"; return 0; }
 # Read with the builtin, as guard-powershell.sh does: `INPUT="$(cat)"` is a subshell plus a process on EVERY call
 # of this hook. `read` returns 1 at end of input; the text is read regardless.
 IFS= read -r -d '' INPUT || true
@@ -168,20 +175,17 @@ IFS= read -r -d '' INPUT || true
 # token, and `/crew-gates` never prints it — the report is rule names and counts. Recording it by default would
 # buy nothing and add a place for a secret to sit. `CREW_GATE_LOG_CMD=1` puts it back for debugging a false
 # positive, which is the only thing it is good for.
-# Where the default log may go. An explicit CREW_GATE_LOG is the operator's call and is used as given. The
-# DEFAULT path is only used when writing there cannot surprise anyone: outside a git repo, or inside one where
-# the path is already ignored. A kit install gitignores .claude/, so this is the normal case — but the plugin
-# edition drops into repos the installer never touched, and this repo proved the failure itself: the suite left
-# a gate-log.tsv sitting in `git status` as an untracked file waiting to be committed. One `git check-ignore`
-# runs only when a decision is logged (a block, an approval prompt or a CLAUDE_GIT_OK allow); ordinary commands
-# never reach it.
+# Where the log goes. An explicit CREW_GATE_LOG is the operator's call and is used as given. .claude/gate-log.tsv
+# only where writing there cannot surprise anyone: outside a git repo, or where git ignores it (a kit install
+# ignores .claude/; the plugin edition drops into repos the installer never touched, and this repo proved the
+# failure: the suite left a gate-log.tsv in `git status` waiting to be committed). Elsewhere it goes inside the
+# repository's .git, which is never committed. git is asked only when a decision is logged (a block, an approval
+# prompt or a CLAUDE_GIT_OK allow); ordinary commands never reach it.
+# Since 3.2.0 a repository that tracks .claude/ gets the log inside its .git (eval/lib/gate-log.sh), where it was
+# not written at all before.
 _gatelog_path(){
-  if [ -n "${CREW_GATE_LOG:-}" ]; then printf '%s' "$CREW_GATE_LOG"; return; fi
-  [ -d ".claude" ] || return 0
-  if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
-    git check-ignore -q ".claude/gate-log.tsv" 2>/dev/null || return 0
-  fi
-  printf '%s' ".claude/gate-log.tsv"
+  declare -F crew_gate_log_write >/dev/null || return 0
+  crew_gate_log_write; printf '%s' "$_CREW_GL"
 }
 gatelog(){  # $1 = verdict (BLOCK|ASK|ALLOW)  $2 = section  $3 = rule
   # Resolve the path ONCE per hook run and remember it HERE, not inside _gatelog_path: that function is invoked
@@ -720,6 +724,8 @@ block(){
   gatelog BLOCK "$2" "$1"
   echo "GUARD (§$2): '$1' stopped AT THE TOOL LEVEL." >&2
   [ -z "${_BLOCK_NOTE:-}" ] || echo "$_BLOCK_NOTE" >&2
+  # What it would have touched, when the rule names a kind (_PV_KIND): read only, after the decision is made.
+  if [ -n "${_PV_KIND:-}" ]; then _pvo="$(_pv_line "$_PV_KIND" "${_PV_CMD:-$CMD}")"; [ -n "$_pvo" ] && echo "$_pvo" >&2; fi
   case "${3:-}" in
     loss)     echo "Nothing here is undone by retrying — but the refusal is not the end of the task. Do the same job the reversible way: name the paths instead of sweeping, and look first (git clean -n, ls) so you act on what you can see. Only if the broad form is genuinely required does the user run it in their own terminal." >&2 ;;
     history)  echo "This rewrites or discards work that is already committed. Ask the person who shares the branch; a new commit usually reaches the same end without rewriting." >&2 ;;
@@ -865,15 +871,15 @@ _push_forces(){   # $1 = one captured `git push …` span -> 0 when a force flag
 _git_d45(){  # $1 = command text; block() exits on the first rule it breaks
   local CMD="$1" HAS_GIT=0 _PUSHSEG _seg                                         # has() reads CMD: this one
   case "$CMD" in *[Gg][Ii][Tt]*) HAS_GIT=1 ;; esac
-  { git_has "$CMD" 'reset'  && has '--hard'; }                                                && block "git reset --hard" "4.5" history
+  { git_has "$CMD" 'reset'  && has '--hard'; }                                                && { _PV_KIND=reset; _PV_CMD="$CMD"; block "git reset --hard" "4.5" history; }
   if [ "$HAS_GIT" = 1 ] && git_has "$CMD" 'push'; then
     _grep_out "$CMD" -oE 'git[[:space:]]+([^;&|]*[[:space:]])?push([^;&|]*)'; _PUSHSEG="$_GO"
     while IFS= read -r _seg; do
       [ -n "$_seg" ] || continue
-      _push_forces "$_seg" && { block "git push --force" "4.5" history; break; }
+      _push_forces "$_seg" && { _PV_KIND=push; _PV_CMD="$_seg"; block "git push --force" "4.5" history; break; }
     done <<< "$_PUSHSEG"
   fi
-  { git_has "$CMD" 'clean'  && has '-[A-Za-z]*f'; }                                           && block "git clean -f" "4.5" loss
+  { git_has "$CMD" 'clean'  && has '-[A-Za-z]*f'; }                                           && { _PV_KIND=clean; _PV_CMD="$CMD"; block "git clean -f" "4.5" loss; }
   return 0
 }
 # ---- the quoted argument of a command that does not run it ---------------------------------------------------
@@ -1109,7 +1115,7 @@ case "$CMD" in *branch*) _HAS_BRANCH=1 ;; *) _HAS_BRANCH=0 ;; esac
 # short cluster, so `rm -Rf /`, `rm -fR /`, `rm -f -r /` and `rm --recursive --force /` all walked past while
 # `rm -rf /` was blocked. Same class as the chmod hole found in evals/permission-pressure: one spelling gated,
 # another reaching the identical state. Case, flag order and the long form are all the same command.
-case "$CMD" in *[Rr][Mm]*) : ;; *) false ;; esac && _grep "$CMD" -qE 'rm +(-[A-Za-z]* +|--[a-z-]+ +)*(-[A-Za-z]*[rR][A-Za-z]*|--recursive)( +(-[A-Za-z]+|--[a-z-]+))* +.*(/|\*|~)' && block "destructive rm -rf" "4.5" loss
+case "$CMD" in *[Rr][Mm]*) : ;; *) false ;; esac && _grep "$CMD" -qE 'rm +(-[A-Za-z]* +|--[a-z-]+ +)*(-[A-Za-z]*[rR][A-Za-z]*|--recursive)( +(-[A-Za-z]+|--[a-z-]+))* +.*(/|\*|~)' && { _PV_KIND=rm; _PV_CMD="$CMD"; block "destructive rm -rf" "4.5" loss; }
 # ADDED (3.1.0): `.` and `..` as a target carry none of those three characters and are the widest targets there are —
 # `rm -rf .` at a project root takes the whole tree, `..` its parent (both passed). Narrower than the test above on
 # purpose, so that it adds no noise: `rm` must stand at a command position, `sudo` or not (`git rm -r --cached .`, `npm rm`,
@@ -1121,7 +1127,7 @@ case "$CMD" in *[Rr][Mm]*)
   _rmc="$CMD"
   # a backslash-newline continues the line (`rm -rf \⏎.`); folded only when one is there and the command is short
   case "$CMD" in *\\"$_RMNL"*) [ "${#CMD}" -le 4096 ] && _rmc="${CMD//\\$_RMNL/ }" ;; esac
-  [[ $_rmc =~ $_RMDOT ]] && block "destructive rm -rf" "4.5" loss ;; esac
+  [[ $_rmc =~ $_RMDOT ]] && { _PV_KIND=rm; _PV_CMD="$_rmc"; block "destructive rm -rf" "4.5" loss; } ;; esac
 # A whole-tree `git checkout -- .` / `git restore .` destroys every uncommitted change with no reflog and no
 # undo — the same loss as `reset --hard`, which has been gated since the beginning, by a command that was not.
 # Not hypothetical: a verification subagent ran exactly this over uncommitted work in this repo and took the
@@ -2431,7 +2437,7 @@ _p44_scan(){  # $1 = the collapsed `git push …` -> 0 when it is `git push [-u]
   return 0
 }
 _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise _APW says why not, for the message.
-  local k v op="" tr="" h="" b="" r="" u="" sid="" ts="" now age dir="${_CWD:-.}" hc=1 hp=1 cur tool
+  local k v op="" tr="" h="" b="" r="" u="" sid="" ts="" now age dir="${_CWD:-.}" hc=1 hp=1 cur tool tag _h2
   _APW="no approval from the user is on record"
   git_has "$CMD_SEEN" 'commit' && hc=0; git_has "$CMD_SEEN" 'push' && hp=0
   if [ "$hc" = 0 ] && [ "$hp" = 0 ]; then
@@ -2472,7 +2478,17 @@ _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise
   _p44_scan "$_A44_S" || { _APW="the push is not in the one form an approval covers, git push <remote> <branch> ($_P44_WHY)"; return 1; }
   [ -n "$b" ] && [ -n "$r" ] && [ -n "$u" ] || { _APW="the approval record could not be read"; return 1; }
   if [ "$_P44_REMOTE" != "$r" ]; then _APW="the user approved a push to $r, not to $_P44_REMOTE"; return 1; fi
-  case "$_P44_REF" in "$b"|HEAD) ;; *) _APW="the user approved a push of $b, not of $_P44_REF"; return 1 ;; esac
+  # A TAG ON THE APPROVED COMMIT is part of that push (a release is tagged on what was approved): `git push <remote>
+  # <tag>` passes when <tag> is a tag and not also a branch, and it points at the commit the approval covers. A tag
+  # on any other commit, --tags, and a refspec are refused as before.
+  tag=""
+  case "$_P44_REF" in
+    "$b"|HEAD) ;;
+    *[!A-Za-z0-9._/-]*|-*|*..*|*/) _APW="the user approved a push of $b, not of $_P44_REF"; return 1 ;;
+    *) if git -C "$dir" show-ref --verify --quiet "refs/tags/$_P44_REF" 2>/dev/null \
+          && ! git -C "$dir" show-ref --verify --quiet "refs/heads/$_P44_REF" 2>/dev/null; then tag="$_P44_REF"
+       else _APW="the user approved a push of $b, not of $_P44_REF"; return 1; fi ;;
+  esac
   cur="$(git -C "$dir" symbolic-ref --short -q HEAD 2>/dev/null || true)"
   [ "$cur" = "$b" ] || { _APW="the user approved a push of $b, and the branch checked out now is ${cur:-<detached>}"; return 1; }
   # Where the remote pushes TO, with pushurl and pushInsteadOf applied: the name alone can be pointed elsewhere.
@@ -2485,8 +2501,16 @@ _approval_ok(){  # 0 = the user's recorded approval covers THIS call. Otherwise
   cur="$(git -C "$dir" rev-parse --verify --quiet HEAD 2>/dev/null || echo NONE)"
   if [ "$op" = push ]; then
     [ "$cur" = "$h" ] || { _APW="HEAD moved after the user approved the push (approved ${h:0:7}, now ${cur:0:7})"; return 1; }
+    if [ -n "$tag" ]; then
+      cur="$(git -C "$dir" rev-parse --verify --quiet "refs/tags/$tag^{commit}" 2>/dev/null || echo NONE)"
+      [ "$cur" = "$h" ] || { _APW="the tag $tag is on ${cur:0:7}, not on the commit the user approved for push (${h:0:7})"; return 1; }
+    fi
     return 0
   fi
+  if [ -n "$tag" ]; then
+    _h2="$cur"; cur="$(git -C "$dir" rev-parse --verify --quiet "refs/tags/$tag^{commit}" 2>/dev/null || echo NONE)"
+    [ "$cur" = "$_h2" ] || { _APW="the tag $tag is on ${cur:0:7}, not on the commit the user approved for push (${_h2:0:7})"; return 1; }
+  fi
   # commit+push: HEAD has to be the commit the approved index became.
   cur="$(git -C "$dir" rev-parse --verify --quiet 'HEAD^' 2>/dev/null || echo NONE)"
   if [ "$h" = NONE ] || [ "$cur" != "$h" ]; then
@@ -2518,16 +2542,7 @@ _appr_wired(){  # 0 = prompt-approval.sh is beside this hook and a settings file
 }
 # IS THE APPROVAL QUESTION WIRED? The same reading as above, for the two halves on AskUserQuestion (guard-question.sh
 # on PreToolUse, prompt-approval.sh on PostToolUse). Asked only to choose which way the refusal offers first.
-_q_wired(){
-  local f t d="${CLAUDE_PROJECT_DIR:-.}"
-  d="${d//\\//}"; d="${d%/}"
-  for f in "${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT//\\//}/hooks/hooks.json}" "$d/.claude/settings.json" "$d/.claude/settings.local.json" "${HOME:+${HOME//\\//}/.claude/settings.json}"; do
-    [ -n "$f" ] && [ -f "$f" ] || continue
-    t=""; IFS= read -r -d '' t < "$f" || true
-    case "$t" in *'"PreToolUse"'*AskUserQuestion*guard-question.sh*'"PostToolUse"'*AskUserQuestion*prompt-approval.sh*) return 0 ;; esac
-  done
-  return 1
-}
+_q_wired(){ declare -F _crew_q_wired >/dev/null 2>&1 && _crew_q_wired; }   # defined once, in prompt-approval.sh
 # MAY A PermissionRequest HOOK ANSWER THE PROMPT? One scan, defined in prompt-approval.sh (_crew_prh_scan) and read
 # from there. Without that file there is no other approval to fall back to, so the answer is "no" and the gate
 # asks as it always has.
@@ -2597,12 +2612,21 @@ _gate_written(){
       { printf 'sid=%s\nop=%s\nts=%s\n' "$_psid" "$_pw" "$_pn" > "$_pd/crew-approval-pending"; } 2>/dev/null || _pw=""
     fi
   fi
+  # ONE WAY TO ASK. With the question open, the refusal used to print it and then the typed way as an equal choice,
+  # and the session picked the typed one 7 times in 9 (a real `auto` session on rc.3, 2026-10-18): the user was told
+  # to type a command for what one click does. The typed way is now the fallback, said as one.
+  _QOFF=0
   if [ "$PERM_MODE" = auto ] && [ "$_PRF" = 0 ] && _q_wired && declare -F _crew_q_pre >/dev/null 2>&1 && [ -f "${BASH_SOURCE%/*}/guard-question.sh" ]; then
-    echo "ASK THE USER WITH ONE CLICK (stage first: the approval covers what is staged at that moment): show the commit message whole, in ONE code block, then call AskUserQuestion with exactly this input, nothing added or changed:" >&2
+    _QOFF=1
+    echo "$_CREW_Q_ASK" >&2
     echo "{\"questions\":[$_CREW_Q_JSON]}" >&2
-    echo "Their answer is recorded by Crewforth itself (the line it adds says so); then run the command it names. If they would rather type, the way below works as well." >&2
+    echo "Their answer is recorded by Crewforth itself (the line it adds says so); then run the command it names. Ask it this way only: do not also give the user a command to type." >&2
+  fi
+  if [ "$_QOFF" = 1 ]; then
+    echo "ONLY IF THAT QUESTION CANNOT BE ASKED (the tool call is refused, or the user dismisses it), ask instead, in their language, in this shape and with nothing after it:" >&2
+  else
+    echo "ASK THE USER NOW, in their language, in this shape and with nothing after it (stage first: the approval covers what is staged at that moment):" >&2
   fi
-  echo "ASK THE USER NOW, in their language, in this shape and with nothing after it (stage first: the approval covers what is staged at that moment):" >&2
   echo "  1. the commit message, whole, in ONE code block;" >&2
   if [ -n "$_pw" ]; then
     echo "  2. under it one sentence in their language (If you approve, send only this:), and then the command on a line of its own, exactly as it is:" >&2
@@ -3342,17 +3366,26 @@ if git_has "$CMD_SEEN" 'commit|push'; then
       BRANCH_WARN=""
       # symbolic-ref names the branch even before its first commit, where rev-parse answers "HEAD" and the very
       # first commit onto main went by without this line. A detached HEAD reads empty: not the default branch.
-      case "$(git symbolic-ref --short -q HEAD 2>/dev/null)" in
+      # Read from HEAD with builtins (the gate log's crew_git_dir finds the git dir, a linked worktree's too): the
+      # preview below pays one subshell to keep this hook's decision out of its reach, and this pays it back.
+      _hb=""; if declare -F crew_git_dir >/dev/null 2>&1 && crew_git_dir . && [ -f "$_CREW_GD/HEAD" ]; then
+        IFS= read -r _hb < "$_CREW_GD/HEAD"; _hb="${_hb%$'\r'}"; case "$_hb" in "ref: refs/heads/"*) _hb="${_hb#ref: refs/heads/}" ;; *) _hb="" ;; esac
+      else _hb="$(git symbolic-ref --short -q HEAD 2>/dev/null)"; fi
+      case "$_hb" in
         main|master) BRANCH_WARN="⚠️  This commits DIRECTLY to the default branch. Prefer a feature branch unless you meant to.
 
 " ;;
       esac
       _commit_agent_note
+      # What it takes or sends: the staged change for a commit, the commits for a push (read only).
+      _PVA=""; case "$CMD" in *push*) _PVA="$(_pv_line push-ask "$CMD")" ;; *) _PVA="$(_pv_line commit "$CMD")" ;; esac
       ask_user "§4.4 commit/push approval gate. Claude wants to run:
 
 $SHORT
 
-${BRANCH_WARN}${_CAN}Approve only if the commit message above was shown to you and you agree with it. Approving lets Claude run the command itself."
+${_PVA:+$_PVA
+
+}${BRANCH_WARN}${_CAN}Approve only if the commit message above was shown to you and you agree with it. Approving lets Claude run the command itself."
       ;;
     auto|dontAsk)
       _commit_agent_note; [ -n "$_CAN" ] && printf '%s' "$_CAN" >&2

package/kit/hooks/guard-commit-scan.sh

@@ -588,8 +588,11 @@ fi
 
 # The message carries its own trace risk (a co-author trailer lives there, not in the diff), and commit-msg is
 # what scans it. Reuse it on the -m value when there is one; an editor-composed message is not visible here and
-# stays the git hook's job.
-if [ "$FAILED" = 0 ] && [ -x "$DIR/commit-msg" ]; then
+# stays the git hook's job. It is scanned even when the staged content already failed: a refusal that names one
+# problem gets the commit retried with the other still in it (measured on a real project, 2026-10-21: a silenced
+# lint check was named, the session-link trailer in the same message was not, and the message was shown to the
+# user again).
+if [ -x "$DIR/commit-msg" ]; then
   # The message is tokenized the way a shell does (crew_opt_values), which matters because a real commit message
   # is MULTI-LINE: a line-oriented `sed` extraction found the subject and stopped, so a co-author trailer on line
   # 3 — the single most likely §4.1 violation, and the one the bare arm of the eval actually produced — went
@@ -640,6 +643,7 @@ $(bash "$DIR/commit-msg" "$MF" 2>&1)" || FAILED=1
         | sed -n 's/.*[[:space:]]--\{0,1\}[Ff]\(ile\)\{0,1\}[[:space:]=]\{1,\}\([^[:space:];&|]\{1,\}\).*/\2/p' | head -1)"
       MFILE="${MFILE%\"}"; MFILE="${MFILE#\"}"; MFILE="${MFILE%\'}"; MFILE="${MFILE#\'}"
       if _grep "$CMD" -qE '(^|[[:space:]])(-F|--file)([[:space:]=]|$)' && { [ -z "$MFILE" ] || [ ! -f "$MFILE" ]; }; then
+        [ "$FAILED" = 1 ] && printf '%s\n' "$OUT" >&2
         echo "GUARD (§4.1): this commit reads its message from a file (-F), and the command could not be parsed" >&2
         echo "well enough to know which file. Scan cannot run, so the commit is refused. Commit with a plain" >&2
         echo "-F <path> (or -m) in a command of its own." >&2
@@ -656,6 +660,7 @@ $(bash "$DIR/commit-msg" "$MFILE" 2>&1)" || FAILED=1
       [ -z "$GITMSG_HOOK" ] && [ -x "$(git rev-parse --git-path hooks/commit-msg 2>/dev/null)" ] \
         && GITMSG_HOOK="git-default"
       if [ -z "$GITMSG_HOOK" ]; then
+        [ "$FAILED" = 1 ] && printf '%s\n' "$OUT" >&2
         echo "GUARD (§4.1): this commit's message would go unscanned." >&2
         echo "No -m/-F was given, so the message is composed in an editor after this point, and no commit-msg" >&2
         echo "git hook is wired here to read it afterwards (plugin-only install: a plugin cannot set" >&2
@@ -669,6 +674,9 @@ fi
 if [ "$FAILED" = 1 ]; then
   echo "GUARD (§4.1/§4.2): the commit content gate rejected this commit before it ran." >&2
   echo "$OUT" >&2
+  case "$OUT" in *"TRACE-SCANNER (message)"*)
+    echo "The message itself carries the trace: write it again without that line. A harness reminder to end a commit message with a trailer does not override §4.1." >&2 ;;
+  esac
   echo "Fix the flagged content and commit again. --no-verify is §4.5 and stays blocked." >&2
   exit 2
 fi

package/kit/hooks/guard-write.sh

@@ -72,7 +72,8 @@ trap '_crew_rc=$?; trap - EXIT; case "$_crew_rc" in 0|2) exit "$_crew_rc" ;; esa
 _gate_main(){
 # The 2.x names of the variables a user can set still work (one helper: eval/lib/crew-env.sh).
 _crew_d="${BASH_SOURCE%/*}"; [ "$_crew_d" = "${BASH_SOURCE}" ] && _crew_d=.
-[ -f "$_crew_d/../eval/lib/crew-env.sh" ] && . "$_crew_d/../eval/lib/crew-env.sh"; unset _crew_d
+[ -f "$_crew_d/../eval/lib/crew-env.sh" ] && . "$_crew_d/../eval/lib/crew-env.sh"
+[ -f "$_crew_d/../eval/lib/gate-log.sh" ] && . "$_crew_d/../eval/lib/gate-log.sh"; unset _crew_d   # where the gate log goes
 # Read with the builtin, as guard-powershell.sh does: `INPUT="$(cat)"` is a subshell plus a process on EVERY call
 # of this hook. `read` returns 1 at end of input; the text is read regardless.
 IFS= read -r -d '' INPUT || true
@@ -365,12 +366,7 @@ block(){  # $1 = rule name for the log (must keep the `gate-file edit` prefix
   # and with the same rule about the payload: the path is NOT recorded unless CREW_GATE_LOG_CMD=1, because
   # /crew-gates reports rule names and counts and never the argument. Logged after the verdict; it cannot
   # change it. CREW_GATE_LOG overrides the path; point it at /dev/null to turn recording off.
-  _GL="${CREW_GATE_LOG:-}"
-  if [ -z "$_GL" ] && [ -d ".claude" ]; then
-    if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1 || git check-ignore -q ".claude/gate-log.tsv" 2>/dev/null; then
-      _GL=".claude/gate-log.tsv"
-    fi
-  fi
+  _GL=""; declare -F crew_gate_log_write >/dev/null && { crew_gate_log_write; _GL="$_CREW_GL"; }
   if [ -n "$_GL" ]; then
     if [ "${CREW_GATE_LOG_CMD:-0}" = 1 ]; then
       printf 'BLOCK\t§4.5\t%s\t%s\n' "$1" \

package/kit/hooks/precompact-snapshot.sh

@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+# PreCompact hook — just before the context is compacted, write down the state of the work in a few lines, so the
+# session that comes back after the compaction is told it (session-rehydrate.sh reads it on SessionStart, source
+# compact). A compaction summary is the model's own retelling; this is what the files and the gates say.
+#
+# What it writes, at most ~2 KB: the branch, the uncommitted files (five named, the rest counted), the last refusal in
+# the gate log, how many findings each document under .crewforth/ holds, and whether a handover
+# (docs/SESSION_STATE.md) is there. With the session id and the trigger, so a snapshot is only read back into the
+# session that wrote it.
+#
+# Where: inside the repository's git directory (crewforth-session-snapshot.json), so it is never committed even in a
+# project that tracks .claude/; outside a repository, .claude/state/session-snapshot.json.
+#
+# NEVER BLOCKS. PreCompact exit 2 blocks the compaction (docs: hooks, PreCompact), and blocking an automatic one at
+# the context limit fails the request that needed it. Every path here ends in exit 0, and nothing is printed: a
+# PreCompact hook's output does not reach the summary.
+set -u
+IN="$(cat 2>/dev/null || true)"
+_here="${BASH_SOURCE%[/\\]*}"; [ "$_here" = "${BASH_SOURCE}" ] && _here=.
+LIB="$_here/../eval/lib"
+
+ROOT="${CLAUDE_PROJECT_DIR:-}"
+[ -n "$ROOT" ] || ROOT="$(printf '%s' "$IN" | sed -n 's/.*"cwd"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1)"
+[ -n "$ROOT" ] || ROOT="$PWD"
+ROOT="${ROOT//\\\\//}"; ROOT="${ROOT//\\//}"
+cd "$ROOT" 2>/dev/null || exit 0
+
+field(){ local v="${IN#*\"$1\"}"; [ "$v" = "$IN" ] && return 1; v="${v#*:}"; v="${v#"${v%%[![:space:]]*}"}"; case "$v" in \"*) v="${v#\"}"; printf '%s' "${v%%\"*}" ;; *) printf '%s' "${v%%[,\}]*}" ;; esac; }
+SID="$(field session_id)" || SID=""
+TRIG="$(field trigger)" || TRIG=""
+case "$SID" in ''|*[!A-Za-z0-9._-]*) exit 0 ;; esac   # a snapshot no session can claim is not written
+
+# ---- what the files and the gates say ----
+LINES=()
+GD=""
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  GD="$(git rev-parse --absolute-git-dir 2>/dev/null)" || GD=""
+  BR="$(git rev-parse --abbrev-ref HEAD 2>/dev/null)" || BR=""
+  [ -n "$BR" ] && LINES+=("branch $BR")
+  # quotePath off: a name in Turkish (or any non-ASCII) is given as written, not as octal escapes (seen on Windows).
+  CH="$(git -c core.quotePath=false status --porcelain 2>/dev/null)" || CH=""
+  if [ -n "$CH" ]; then
+    n=0; names=""
+    while IFS= read -r l; do n=$((n+1)); [ "$n" -le 5 ] && names="${names:+$names, }${l:3}"; done <<< "$CH"
+    LINES+=("$n uncommitted file(s): $names$([ "$n" -gt 5 ] && printf ', and %d more' $((n-5)))")
+  else LINES+=("nothing uncommitted"); fi
+fi
+if [ -f "$LIB/gate-log.sh" ]; then
+  . "$LIB/gate-log.sh"; crew_gate_log_read
+  if [ -n "${_CREW_GL:-}" ] && [ -f "$_CREW_GL" ]; then
+    last=""; while IFS= read -r l; do case "$l" in BLOCK$'\t'*) last="$l" ;; esac; done < "$_CREW_GL"
+    if [ -n "$last" ]; then IFS=$'\t' read -r _ rule why _ <<< "$last"; LINES+=("the last refusal in the gate log: ${rule} ${why:0:120}"); fi
+  fi
+fi
+fnd=""
+for f in .crewforth/*.json; do
+  [ -f "$f" ] || continue
+  c=0; while IFS= read -r l; do case "$l" in *'"rule": '*) c=$((c+1)) ;; esac; done < "$f"
+  [ "$c" -gt 0 ] && { b="${f##*/}"; fnd="${fnd:+$fnd, }${b%.json} $c"; }
+done
+[ -n "$fnd" ] && LINES+=("findings on record: $fnd")
+[ -s docs/SESSION_STATE.md ] && LINES+=("a handover is at docs/SESSION_STATE.md")
+[ "${#LINES[@]}" -gt 0 ] || exit 0
+
+SUM=""; for l in "${LINES[@]}"; do SUM="${SUM:+$SUM; }$l"; done
+SUM="${SUM:0:1800}"
+
+# ---- where it goes ----
+if [ -n "$GD" ] && [ -d "$GD" ]; then OUT="$GD/crewforth-session-snapshot.json"
+else mkdir -p .claude/state 2>/dev/null || exit 0; OUT=".claude/state/session-snapshot.json"; fi
+if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v NOW '%(%Y-%m-%dT%H:%M:%SZ)T' -1; else NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"; fi
+ESC="$(printf '%s\n' "$SUM" | LC_ALL=C awk -f "$LIB/json-string.awk" 2>/dev/null)" || exit 0
+printf '{"session_id":"%s","trigger":"%s","at":"%s","summary":"%s"}\n' "$SID" "${TRIG//[!a-z]/}" "$NOW" "$ESC" > "$OUT.$$" 2>/dev/null && mv -f "$OUT.$$" "$OUT" 2>/dev/null
+rm -f "$OUT.$$" 2>/dev/null
+exit 0

package/kit/hooks/prompt-approval.sh

@@ -74,7 +74,7 @@ export LC_ALL=C
 _PA_LIB=0; [ "${BASH_SOURCE[0]}" != "$0" ] && _PA_LIB=1
 if [ "$_PA_LIB" = 0 ]; then
   IFS= read -r -d '' INPUT || true
-  case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*|*'"hook_event_name"'*'"AskUserQuestion"'*|*'"AskUserQuestion"'*'"hook_event_name"'*) ;; *) exit 0 ;; esac
+  case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*|*'"hook_event_name"'*'"AskUserQuestion"'*|*'"AskUserQuestion"'*'"hook_event_name"'*|*'"hook_event_name"'*'"Stop"'*) ;; *) exit 0 ;; esac
 fi
 # ---- CREW-JSON-PARSE ------------------------------------------------------------------------------------
 _json_find(){  # $1 = text, $2 = a literal -> _JF = the offset of its first occurrence, -1 when there is none
@@ -426,6 +426,19 @@ _crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | pe
 # same four answers and what each one does. guard-bash.sh prints it from here for the model to ask.
 _CREW_Q_TEXT='Crewforth approval: may Claude commit what is staged now, push this branch, or both?'
 _CREW_Q_JSON='{"question":"'"$_CREW_Q_TEXT"'","header":"Approval","options":[{"label":"Commit only","description":"Commit exactly what is staged now. No push."},{"label":"Commit + push","description":"Commit what is staged now, then push that commit on this branch."},{"label":"Push only","description":"Push this branch as it is now. No new commit."},{"label":"No","description":"Neither commit nor push."}],"multiSelect":false}'
+# THE ANSWERED QUESTION, IN ANY KEY ORDER. Claude Code hands PostToolUse the question back either as it was asked or
+# re-serialised with its keys sorted (`header,options[description,label],question`, sometimes without multiSelect):
+# 30 of 30 answers in the asked order were recorded and 7 of 7 sorted ones refused, on a byte match (real sessions,
+# 2.1.299 and 2.1.302, 2026-10-18). So the answer side checks every "key":"text" pair of the fixed question, wherever
+# it sits; the exact match stays on PreToolUse, and the tool id binds the answer to the call that passed it.
+_crew_q_is(){  # $1 = a payload -> 0 when it carries every "key":"text" pair of _CREW_Q_JSON
+  local rest="$_CREW_Q_JSON" re='("[A-Za-z]+":"[^"]*")' p
+  while [[ $rest =~ $re ]]; do
+    p="${BASH_REMATCH[1]}"
+    case "$1" in *"$p"*) ;; *) return 1 ;; esac
+    rest="${rest#*"$p"}"
+  done
+}
 _crew_q_op(){  # $1 = the label the user chose -> OP: commit | commit+push | push | no, or "" for anything else
   case "$1" in
     'Commit only') OP=commit ;; 'Commit + push') OP=commit+push ;; 'Push only') OP=push ;; 'No') OP=no ;; *) OP="" ;;
@@ -514,11 +527,36 @@ _crew_prh_scan(){  # -> 0 when a PermissionRequest hook may be wired; _PRH names
   return "$r"
 }
 
+# ---- IS THE QUESTION OPEN HERE? One answer for every hook that offers it ------------------------------------------
+# guard-bash.sh offers it in a refusal; agent-outcome.sh offers it when crew-commit-agent is called in `auto`, so the
+# click is on offer before any commit is tried (B-2, a real session: with the refusal as the only way to it, a session
+# that asked for /crew-approve first never showed it). The text the user is asked stays _CREW_Q_JSON, here only.
+_CREW_Q_HERE="${BASH_SOURCE[0]%/*}"; [ "$_CREW_Q_HERE" = "${BASH_SOURCE[0]}" ] && _CREW_Q_HERE=.
+_crew_q_wired(){  # 0 = a settings file wires both halves on AskUserQuestion (guard-question.sh, then this file)
+  local f t d="${CLAUDE_PROJECT_DIR:-.}"
+  d="${d//\\//}"; d="${d%/}"
+  for f in "${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT//\\//}/hooks/hooks.json}" "$d/.claude/settings.json" "$d/.claude/settings.local.json" "${HOME:+${HOME//\\//}/.claude/settings.json}"; do
+    [ -n "$f" ] && [ -f "$f" ] || continue
+    t=""; IFS= read -r -d '' t < "$f" || true
+    case "$t" in *'"PreToolUse"'*AskUserQuestion*guard-question.sh*'"PostToolUse"'*AskUserQuestion*prompt-approval.sh*) return 0 ;; esac
+  done
+  return 1
+}
+_crew_q_open(){  # $1 = permission mode -> 0 when the click may be offered: auto, both halves wired and beside this file, no PermissionRequest hook
+  [ "$1" = auto ] && [ -f "$_CREW_Q_HERE/guard-question.sh" ] && _crew_q_wired && ! _crew_prh_scan
+}
+# What the session is told to do, the same words wherever it is offered.
+_CREW_Q_ASK='ASK THE USER WITH ONE CLICK (stage first: the approval covers what is staged at that moment): show the commit message whole, in ONE code block, then call AskUserQuestion with exactly this input, nothing added or changed:'
+
 # ---- the approval question's context, and its PreToolUse half -----------------------------------------------
 # Shared by prompt-approval.sh (PostToolUse: it records the answer) and guard-question.sh (PreToolUse: it asks). The
 # PreToolUse half is a GATE and lives in a gate's file, so an error of its own refuses the call (CREW-FAILCLOSED)
 # instead of letting the question through with no `ask`; this file also answers UserPromptSubmit, where a refusal
 # would erase the user's message.
+_crew_q_dir(){  # $1 = cwd -> _QAD (the state folder), ASKED (the call PreToolUse let through), TRIED (asked since the user's last message)
+  _QAD="${CLAUDE_PROJECT_DIR:-$1}"; _QAD="${_QAD//\\//}"; _QAD="${_QAD%/}/.claude/state"
+  ASKED="$_QAD/crew-approval-asked"; TRIED="$_QAD/crew-approval-tried"
+}
 _crew_q_ctx(){  # $INPUT -> CWD REC PM SID _QTU _QAD ASKED _QNOW; exits 0 (no decision) when the call is not the approval question
   _json_keycount "$INPUT" hook_event_name; [ "$_KC" = 1 ] || exit 0
   _json_keycount "$INPUT" tool_name; [ "$_KC" = 1 ] || exit 0
@@ -531,11 +569,14 @@ _crew_q_ctx(){  # $INPUT -> CWD REC PM SID _QTU _QAD ASKED _QNOW; exits 0 (no de
   _json_slice "$INPUT" permission_mode >/dev/null; PM="$_JS"
   _json_slice "$INPUT" session_id >/dev/null; SID="$_JS"
   _json_slice "$INPUT" tool_use_id >/dev/null; _QTU="$_JS"
-  _QAD="${CLAUDE_PROJECT_DIR:-$CWD}"; _QAD="${_QAD//\\//}"; _QAD="${_QAD%/}/.claude/state"; ASKED="$_QAD/crew-approval-asked"
+  _crew_q_dir "$CWD"
   if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _QNOW '%(%s)T' -1; else _QNOW="$(date +%s)"; fi
 }
 _crew_q_pre(){  # the PreToolUse decision: `ask`, or a refusal (exit 2) that says why
   _crew_q_ctx
+  # Asked at all, whatever the decision below: a question refused here, or dismissed by the user, leaves the typed
+  # way as the one that is left, and the Stop half (_pa_stop) must not send the session back to ask it again.
+  [ -n "$SID" ] && [ -d "$_QAD" ] && { printf 'sid=%s\n' "$SID" > "$TRIED"; } 2>/dev/null
   qno(){  # $1 = why, for the model. The call does not run; where it applies, the typed approval is named as the way left.
     echo "GUARD (§4.4): the approval question was not asked: $1" >&2
     [ "${2:-}" = nohint ] || echo "The way that always works is the user's own: the user can type /crew-approve (or /crew-approve commit, push, commit+push) as their whole message." >&2
@@ -666,9 +707,9 @@ _pa_record(){
     commit)      WHAT="commit of what is staged now (tree $_d) on HEAD $_h"
                  HOW="Run git commit -m with the message, alone in its call: no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained. Single-quote the message, or read it from a here-document with a quoted delimiter. The review record of §4.6 is still required." ;;
     push)        WHAT="push of $BR at $_h to $RM"
-                 HOW="Run exactly: git push $RM $BR (alone in its call: the remote and the branch written out, no cd, no pipe, nothing chained)." ;;
+                 HOW="Run exactly: git push $RM $BR (alone in its call: the remote and the branch written out, no cd, no pipe, nothing chained). A tag on that commit goes the same way: git push $RM <tag>." ;;
     commit+push) WHAT="commit of what is staged now (tree $_d) on HEAD $_h, then push of that commit on $BR to $RM"
-                 HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR" ;;
+                 HOW="Run git commit -m with the message, alone in its call (no other option than -q, -s or -v, no paths, no cd, no pipe, nothing chained; single-quote the message; §4.6 still applies), then in a separate call exactly: git push $RM $BR (a tag on the new commit: git push $RM <tag>)" ;;
   esac
   [ -n "$_u" ] && _u=" ($RM pushes to $_u)"
   _bw=""; [ "$BARE" = 1 ] && _bw="approved: $OP (what this session was refused). "
@@ -693,7 +734,7 @@ _pa_question(){
   : > "$ASKED" 2>/dev/null                                 # one question, one answer
   case "$_at$_QNOW" in *[!0-9]*|'') no "the time of the question could not be read." ;; esac
   [ $((_QNOW - _at)) -ge 0 ] && [ $((_QNOW - _at)) -le 1800 ] || no "the question was asked more than 30 minutes ago."
-  case "$INPUT" in *'"questions":['"$_CREW_Q_JSON"']'*) ;; *) no "the question answered is not the fixed one." ;; esac
+  _crew_q_is "$INPUT" || no "the question answered is not the fixed one."
   [ "$PM" = auto ] || no "the approval question is recorded in auto only, and this session is in ${PM:-an unknown mode}."
   _crew_prh_scan && no "a PermissionRequest hook may be wired ($_PRH), and it can answer the question before you do. The approval that still works is typed: the user can type /crew-approve instead."
   _json_keycount "$INPUT" "$_CREW_Q_TEXT"; _an=$_KC
@@ -711,6 +752,32 @@ _pa_question(){
   BARE=0
   _pa_record
 }
+# ---- THE CLICK BEFORE THE TYPED WAY (Stop) -------------------------------------------------------------------
+# The click reached the user only from a refused commit or a call to crew-commit-agent, and a session that wrote the
+# message itself asked the user to type /crew-approve without trying either: 9 of 18 typed asks in two real `auto`
+# sessions on rc.4 (2026-10-18) came in a turn where no commit was tried, most right after crew-review-agent. So the
+# turn's end is where it is caught: the reply names /crew-approve, the question is open, and it was not asked since
+# the user's last message. Then the session is told, once, to ask the click; it never blocks, and stop_hook_active
+# lets the turn end the next time whatever was said.
+_pa_stop(){
+  case "$INPUT" in *'"stop_hook_active":true'*|*'"stop_hook_active": true'*) exit 0 ;; esac
+  _json_slice "$INPUT" permission_mode >/dev/null; [ "$_JS" = auto ] || exit 0
+  _json_slice "$INPUT" last_assistant_message >/dev/null
+  case "$_JS" in *'/crew-approve'*) ;; *) exit 0 ;; esac
+  _json_slice "$INPUT" session_id >/dev/null; SID="$_JS"; [ -n "$SID" ] || exit 0
+  _json_slice "$INPUT" cwd >/dev/null; _json_unescape "$_JS" >/dev/null; _crew_q_dir "${_JU:-.}"
+  _crew_q_open auto || exit 0
+  _al=""; [ -f "$TRIED" ] && { IFS= read -r _al < "$TRIED"; } 2>/dev/null
+  [ "$_al" = "sid=$SID" ] && exit 0
+  _ao="Crewforth: your reply asks for a typed approval, and the one-click approval question was not asked since the user's last message. If that is a commit or a push waiting for approval, ask with one click now instead: $_CREW_Q_ASK {\"questions\":[$_CREW_Q_JSON]} Their answer is recorded by Crewforth itself (the line it adds says so). If the question is refused or dismissed, the user can type /crew-approve instead. If you only mentioned the command, end your turn."
+  _ao="${_ao//\\/\\\\}"; _ao="${_ao//\"/\\\"}"     # fixed ASCII text on one line: a backslash and a quote are all it holds
+  printf '{"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":"%s"}}\n' "$_ao"
+  exit 0
+}
+_json_keycount "$INPUT" hook_event_name
+if [ "$_KC" = 1 ]; then _json_slice "$INPUT" hook_event_name >/dev/null; [ "$_JS" = Stop ] && _pa_stop; fi
+case "$INPUT" in *'"hook_event_name"'*'"Stop"'*) exit 0 ;; esac   # a Stop is never a prompt: it must not end an approval below
+
 case "$INPUT" in *'"AskUserQuestion"'*)
   _json_slice "$INPUT" hook_event_name >/dev/null
   case "$_JS" in PostToolUse) EVN="$_JS"; _pa_question ;; esac ;;
@@ -745,6 +812,8 @@ _crew_appr_path "$CWD"; REC="$_AP"
 # THE USER'S NEXT MESSAGE ENDS THE APPROVAL, whatever it says. Emptied with a redirection, which is a builtin:
 # `rm` would be a process on a hook that runs on every prompt.
 if [ -n "$REC" ] && [ -s "$REC" ]; then : > "$REC" 2>/dev/null || true; fi
+# ...and starts a new turn for the Stop half: the question has not been asked since this message.
+_crew_q_dir "$CWD"; [ -s "$TRIED" ] && { : > "$TRIED"; } 2>/dev/null
 
 # ---- is this message an approval? ------------------------------------------------------------------------
 [ "$_n_prompt" = 1 ] || exit 0

package/kit/hooks/session-rehydrate.sh

@@ -68,11 +68,34 @@ if [ -f "$ROOT/.claude/hooks/pre-commit" ] && git -C "$ROOT" rev-parse --git-dir
   esac
 fi
 [ -n "$HOOKMSG" ] && MSG="${MSG:+$MSG }$HOOKMSG"
-[ -n "$MSG" ] || exit 0   # no handover to offer and nothing to say about language -> stay silent
+
+# THE STATE BEFORE THE COMPACTION. precompact-snapshot.sh wrote it just before this context was compacted: the
+# branch, the uncommitted files, the last gate refusal, the findings on record. Read back only after a compaction and
+# only into the session that wrote it (same session id); its summary is already JSON-escaped, so it is put into the
+# output as it is, and the rest of MSG stays fixed text that needs no escaping and no extra process.
+SNAP=""
+_rh="${BASH_SOURCE%[/\\]*}"; [ "$_rh" = "${BASH_SOURCE}" ] && _rh=.
+if [ "$SRC" = compact ] && [ -f "$_rh/../eval/lib/gate-log.sh" ]; then
+  . "$_rh/../eval/lib/gate-log.sh"
+  _sf=""
+  if crew_git_dir "$ROOT" && [ -f "$_CREW_GD/crewforth-session-snapshot.json" ]; then _sf="$_CREW_GD/crewforth-session-snapshot.json"
+  elif [ -f "$ROOT/.claude/state/session-snapshot.json" ]; then _sf="$ROOT/.claude/state/session-snapshot.json"; fi
+  _sid(){ _SID=""; local v="${1#*\"session_id\"}"; [ "$v" = "$1" ] && return 0; v="${v#*\"}"; _SID="${v%%\"*}"; }
+  if [ -n "$_sf" ] && IFS= read -r _sj < "$_sf" 2>/dev/null; then
+    _sid "$IN"; _mine="$_SID"; _sid "$_sj"
+    case "$_sj" in *'"summary":"'*)
+      if [ -n "$_mine" ] && [ "$_mine" = "$_SID" ]; then
+        _sum="${_sj#*\"summary\":\"}"; _sum="${_sum%\"\}*}"
+        SNAP="Before this context was compacted, Crewforth wrote down the state of the work from the files and the gates: $_sum. It is a record of that moment; check the files before relying on it."
+      fi ;;
+    esac
+  fi
+fi
+[ -n "$MSG$SNAP" ] || exit 0   # nothing to offer -> stay silent
 
 # hookSpecificOutput.additionalContext is the documented channel that injects text into the model's context.
 # ONE PATH, no jq: MSG is built from fixed constants with no quote, backslash, control character or newline, so it needs no
 # escaping and every machine emits the same bytes. If you ever make MSG dynamic, escape it the way board-sync.sh
 # does (jq-identical, measured) — a raw quote or tab here makes JSON the CLI silently drops.
-printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"%s"}}\n' "$MSG"
+printf '{"hookSpecificOutput":{"hookEventName":"SessionStart","additionalContext":"%s%s%s"}}\n' "$MSG" "${MSG:+${SNAP:+ }}" "$SNAP"
 exit 0

package/kit/hooks/session-update-check.sh

@@ -44,7 +44,9 @@
 set -uo pipefail
 # The 2.x names of the variables a user can set still work (one helper: eval/lib/crew-env.sh).
 _crew_d="${BASH_SOURCE%/*}"; [ "$_crew_d" = "${BASH_SOURCE}" ] && _crew_d=.
-[ -f "$_crew_d/../eval/lib/crew-env.sh" ] && . "$_crew_d/../eval/lib/crew-env.sh"; unset _crew_d
+[ -f "$_crew_d/../eval/lib/crew-env.sh" ] && . "$_crew_d/../eval/lib/crew-env.sh"
+# How an install's own version is read and ordered (an rc before its final): one definition, eval/lib/version.sh.
+[ -f "$_crew_d/../eval/lib/version.sh" ] && . "$_crew_d/../eval/lib/version.sh"; unset _crew_d
 
 URL="${CREW_UPDATE_URL:-https://registry.npmjs.org/-/package/crewforth/dist-tags}"
 # plugin-stable, not main: the marketplace installs the plugin from that branch, and only an approved release
@@ -139,7 +141,10 @@ PJSON="$PR_ROOT/.claude-plugin/plugin.json"
 # plugin's copy steps aside whenever a project install is present, instead of asking the project's question too.
 if [ "$IS_PLUGIN" = 1 ] && [ -f "$CL/VERSION" ]; then exit 0; fi
 if [ -f "$CL/VERSION" ]; then
-  read -r _cv < "$CL/VERSION" 2>/dev/null || _cv=""; CUR="$(sane_version "$_cv")" || exit 0
+  # The install's own file, so an rc (X.Y.Z-rc.N) is a version here; what npm answers is still held to X.Y.Z.
+  read -r _cv < "$CL/VERSION" 2>/dev/null || _cv=""
+  declare -F crew_local_version >/dev/null || exit 0
+  CUR="$(crew_local_version "$_cv")" || exit 0
   STATE="$CL/.state"                                            # repo-local: the install lives in the repo
   FEED="${CREW_UPDATE_URL:-$URL}"; KEY=latest; EDITION=project
   ANSWER='bash .claude/hooks/session-update-check.sh --answer'
@@ -186,12 +191,8 @@ fi
 [ -n "$LATEST" ] || exit 0
 LATEST="$(sane_version "$LATEST")" || exit 0
 
-# Numeric field compare, one awk. Pre-release suffixes degrade to their numeric prefix (`1-rc2` -> 1), which is
-# the harmless direction: it can suppress a question, never invent one.
-awk -v a="$LATEST" -v b="$CUR" 'BEGIN{
-  split(a,x,"."); split(b,y,".");
-  for(i=1;i<=3;i++){ if(x[i]+0 > y[i]+0) exit 0; if(x[i]+0 < y[i]+0) exit 1 }
-  exit 1 }' || exit 0
+# One awk, eval/lib/version.sh's order: 3.2.0 is newer than an installed 3.2.0-rc.1, so the rc's user is asked.
+awk -v a="$LATEST" -v b="$CUR" "${CREW_VCMP_AWK:-}"' BEGIN { exit !(vcmp(a, b) > 0) }' 2>/dev/null || exit 0
 
 # Skipped for good? Asked (or answered "later") within the last day?
 if [ -f "$STATE/update-skip" ]; then read -r _sk < "$STATE/update-skip" 2>/dev/null || _sk=""; [ "${_sk//[!0-9.]/}" = "$LATEST" ] && exit 0; fi

package/kit/hooks/trace-blocklist.txt

@@ -12,6 +12,15 @@
 
 Co-Authored-By
 #test: Co-Authored-By: An Assistant <noreply@example.com>
+# The session-link trailer Claude Code asks the model to end a commit message with: it reached six pushed commits of a
+# project with Crewforth installed (2026-10-18), because nothing here named it. The trailer and the address are both
+# caught, so a message that keeps only one of them is still stopped. One line, not two: each line is one grep on every
+# commit (a process, 62-135 ms on Git Bash).
+Claude-Session:|claude\.ai/code/session_
+#test: Claude-Session: https://claude.ai/code/session_0123456789abcdef
+#test: see https://claude.ai/code/session_0123456789abcdef for the run
+#test-clean: the claude session limit is reached
+#test-clean: https://claude.ai/code is the web app
 # "Generated by/with" alone matched every machine-written header in existence — a pubspec.lock, an EF Core
 # scaffold, protoc, openapi-generator. A live --dotnet install could not make its FIRST commit because the
 # cloned base carries a Dart lockfile saying "Generated by pub". §4.1 is about AI AUTHORSHIP, so the pattern