crewforth 3.2.0-rc.3 → 3.2.0-rc.5

package/CHANGELOG.md

@@ -84,8 +84,10 @@ versioning follows [SemVer](https://semver.org/).
   own findings to `.crewforth/review.json`, blockers through the refuter. What it could not check (no shellcheck,
   a file edited after staging, no Node) is said, never read as clean.
 
-- **In `auto`, approve a commit or a push with one click.** The refusal now also offers a fixed question, asked with
-  AskUserQuestion: Commit only, Commit + push, Push only, No. A new gate, `guard-question.sh`, answers `ask` on it,
+- **In `auto`, approve a commit or a push with one click.** A fixed question, asked with AskUserQuestion: Commit
+  only, Commit + push, Push only, No. It is handed to the session when `crew-commit-agent` is called, so `/crew-ship`
+  asks it with the message, and a refused commit offers it too (measured in real sessions: offered by the refusal
+  alone, it never came up, since the session asks before trying a commit). A new gate, `guard-question.sh`, answers `ask` on it,
   so a hook that fills in the answer cannot answer it for you (measured in 34 runs and by hand in the terminal), and
   `prompt-approval.sh` records your click exactly as it records `/crew-approve`: tied to what is staged, `HEAD`, the
   session, for 30 minutes.
@@ -151,6 +153,23 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Changed
 
+- **A typed approval is caught at the turn's end.** The one-click question reached the user only from a refused
+  commit or a call to the commit agent, and a session that wrote the message itself asked the user to type
+  `/crew-approve` without trying either: 9 of 18 typed asks in two real `auto` sessions. Now, when a reply asks for
+  `/crew-approve` in `auto` with the question open and it was not asked since the user's last message, the session
+  is told once to ask the click. It never blocks the turn; a question that was refused or dismissed leaves the typed
+  way, and a turn's end does not end an approval.
+
+- **A refused commit asks one way.** In `auto`, with the approval question open, the refusal offered the click and
+  the typed `/crew-approve` side by side, and a session picked the typed one 7 times in 9. The click is now the way
+  to ask, and the typed command is only the fallback for a question that cannot be asked.
+
+- **A task card on one line is read.** `files: … · change: … · verify: …` (with `;` or `|` too, after an optional
+  `Card:`, and `above:` on the same line) is read by its labels and held to the rules of the three-line card, and a
+  kind with a note in parentheses (`architecture (planning only)`) is that kind, on either form. Measured on one
+  machine's sessions: 37 calls had been refused for their card, every one followed by a second call; 17 of them now
+  pass on the first.
+
 - **A model is chosen to cost what the work needs.** Measured on a real project: 186 crew tasks, 0 on haiku, 73 (39%)
   above their card's floor, and no verify command ever passing, so the cheaper path never opened. Now:
   - the card's model is the default: a call above it runs on it (the gate rewrites the call's model), unless the
@@ -183,6 +202,10 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Security
 
+- **The session-link trailer is a trace.** Claude Code asks the model to end a commit message with a line linking the
+  session on claude.ai; the trace scan had no pattern for it, and six commits of a project with Crewforth installed
+  carried it to a remote. The trailer and its address are both caught now, in the message and in staged files.
+
 - **A `PermissionRequest` hook could approve a commit with nobody at the keyboard.** Such a hook answers a
   permission prompt before the person does, and the answer cannot be told from a click: measured, it approved the
   Bash prompt `guard-bash.sh` raises for a commit in `default`, and it answered the new question too. Before it
@@ -197,6 +220,13 @@ versioning follows [SemVer](https://semver.org/).
 
 ### Fixed
 
+- **A click on the approval question is recorded whatever order its keys come back in.** Claude Code hands the
+  answered question back either as it was asked or with its keys sorted, and the answer side matched it byte for
+  byte: in real `auto` sessions 30 of 30 answers in the asked order were recorded and 7 of 7 sorted ones refused
+  ("the question answered is not the fixed one"), so the user clicked and was then told to type `/crew-approve`. The
+  answer side now checks each text of the fixed question wherever it sits; the exact match stays where the question
+  is asked, and the answer is still bound to that call.
+
 - **The Crew Map says what a project is made of.** A Flutter project read as a pile of Gradle modules and its
   server as an external API (seen on a real project). The scanner now reads Dart: one module per `pubspec.yaml`,
   its packages and `path:` references, and a Flutter app's `android/` and `ios/` folders as platforms of the app.

package/VERSION

@@ -1 +1 @@
-3.2.0-rc.3
+3.2.0-rc.5

package/kit/agents/crew-commit-agent.md

@@ -94,16 +94,18 @@ write is refused because the file is on a critical path, do not reach it another
   proceed" is not approval (§4.4).
   The tool-level gate `guard-bash.sh` intercepts commit/push in **every** permission mode: in normal modes it raises an
   approval prompt only the user can answer — so present the message FIRST, then run the commit yourself and let the user
-  approve it at the prompt. Never hand the user a command to paste into their own terminal. In `auto` and `dontAsk`
-  the prompt reaches nobody: stage, then ask in this shape and with nothing after it — the message in ONE code block,
+  approve it at the prompt. Never hand the user a command to paste into their own terminal. In `auto`, when this agent
+  is called Crewforth hands the session the one-click approval question (below): ask it, with the message, instead of
+  asking for `/crew-approve`. In `dontAsk`, and in `auto` when Crewforth gives no question or says it is closed, the
+  prompt reaches nobody: ask in this shape and with nothing after it — the message in ONE code block,
   and under it one sentence in the user's language ("If you approve, send only this:") followed by the command
   on a line of its own: `/crew-approve`. With nothing after it, it approves what the gate just refused in this
   session (a commit, a push, or both when both were refused); spelled out it is `/crew-approve commit`,
   `/crew-approve push` or `/crew-approve commit+push`. The user approves by sending
   that command alone; a sentence that says yes is not an approval, and you cannot run `/crew-approve` for them. It covers what is staged on that HEAD. If the gate says the approval path is closed in this session (the
   recording hook is not wired), say so and offer Shift+Tab or their own terminal instead.
-  In `auto` the refusal may also offer the approval question: show the message, then call AskUserQuestion with
-  exactly the input the refusal prints (the fixed question and its four answers, no answers of your own). The
+  The approval question: call AskUserQuestion with exactly the input Crewforth prints (the fixed question and its four
+  answers, no answers of your own; never write the question yourself). The
   user's click is recorded the same way; read the line Crewforth adds and run what it names. Where a
   `PermissionRequest` hook may be wired the gate closes the question, and in `default` / `acceptEdits` its own
   prompt too, because such a hook can answer either before the user does: then `/crew-approve` is the way.

package/kit/eval/smoke-test.sh

@@ -3665,6 +3665,8 @@ if [ "$_gc1" != 5 ] || [ "$_gc2" != 7 ]; then
 else
   gcj(){ printf '{"tool_name":"%s","permission_mode":"default","tool_input":{"command":"%s"},"cwd":"%s"}' "$1" "$2" "$_gcp"; }
   gwj(){ printf '{"tool_name":"Write","permission_mode":"default","tool_input":{"file_path":"%s/%s","content":"x"},"cwd":"%s"}' "$_gcp" "$1" "$_gcp"; }
+  # commit-msg 15 -> 16 (2026-10-18): one more line in trace-blocklist.txt, the session-link trailer that reached
+  # pushed commits; each line is one grep on every commit.
   GCT='guard-bash @@ 0 @@ 0 @@ Bash @@ git status --short
 guard-bash @@ 0 @@ 0 @@ Bash @@ ls -la
 guard-bash @@ 0 @@ 0 @@ Bash @@ git log --oneline -2 && git status --short | head; ls; cat CHANGELOG.md
@@ -3686,7 +3688,7 @@ guard-write @@ 0 @@ 0 @@ Write @@ .env
 guard-write @@ 2 @@ 0 @@ Write @@ .claude/hooks/guard-bash.sh
 guard-powershell @@ 0 @@ 0 @@ PowerShell @@ Get-ChildItem -Recurse src
 pre-commit @@ 0 @@ 22 @@ Script @@ -
-commit-msg @@ 0 @@ 15 @@ Script @@ msg'
+commit-msg @@ 0 @@ 16 @@ Script @@ msg'
   _gcn=0; _gcbad=""; _gcrow=""
   while IFS= read -r _gl; do [ -z "$_gl" ] && continue
     _gh="${_gl%% @@ *}"; _gl="${_gl#* @@ }"; _gr="${_gl%% @@ *}"; _gl="${_gl#* @@ }"; _gb="${_gl%% @@ *}"; _gl="${_gl#* @@ }"; _gt="${_gl%% @@ *}"; _gc="${_gl#* @@ }"
@@ -7992,8 +7994,8 @@ _paq_text="$(bash -c '. "$1"; printf "%s" "$_CREW_Q_TEXT"' _ "$HOOKS/prompt-appr
 _paq_pre(){ printf '{"session_id":"s","transcript_path":"%s","cwd":"%s","permission_mode":"%s","hook_event_name":"PreToolUse","tool_name":"AskUserQuestion","tool_input":{"questions":[%s]%s},"tool_use_id":"%s"}' "$_patr" "$_paw" "$1" "$2" "${3:-}" "${4:-tu1}" > "$_PA/q.json"
   if [ -n "$JSONQ" ]; then json_ok < "$_PA/q.json" || _paqbad="$_paqbad [pre payload is not JSON]"; fi
   _pao="$( cd "$_paw" && env -u CLAUDE_CODE_SESSION_ATTENDED $_PAQ_ENV ${_PAQ_X:-} bash "$HOOKS/guard-question.sh" < "$_PA/q.json" 2>"$_PA/qerr" )"; _par=$?; }
-# $1 = mode, $2 = the answer, $3 = tool_use_id
-_paq_post(){ printf '{"session_id":"s","transcript_path":"%s","cwd":"%s","permission_mode":"%s","hook_event_name":"PostToolUse","tool_name":"AskUserQuestion","tool_input":{"questions":[%s],"answers":{"%s":"%s"}},"tool_response":{"questions":[%s],"answers":{"%s":"%s"}},"tool_use_id":"%s"}' "$_patr" "$_paw" "$1" "$_paq_canon" "$_paq_text" "$2" "$_paq_canon" "$_paq_text" "$2" "${3:-tu1}" > "$_PA/q.json"
+# $1 = mode, $2 = the answer, $3 = tool_use_id, $4 = the questions array's content as Claude Code hands it back (default: as asked)
+_paq_post(){ printf '{"session_id":"s","transcript_path":"%s","cwd":"%s","permission_mode":"%s","hook_event_name":"PostToolUse","tool_name":"AskUserQuestion","tool_input":{"questions":[%s],"answers":{"%s":"%s"}},"tool_response":{"questions":[%s],"answers":{"%s":"%s"}},"tool_use_id":"%s"}' "$_patr" "$_paw" "$1" "${4:-$_paq_canon}" "$_paq_text" "$2" "${4:-$_paq_canon}" "$_paq_text" "$2" "${3:-tu1}" > "$_PA/q.json"
   if [ -n "$JSONQ" ]; then json_ok < "$_PA/q.json" || _paqbad="$_paqbad [post payload is not JSON]"; fi
   _pao="$( cd "$_paw" && env -u CLAUDE_CODE_SESSION_ATTENDED $_PAQ_ENV ${_PAQ_X:-} bash "$HOOKS/prompt-approval.sh" < "$_PA/q.json" 2>"$_PA/qerr" )"; _par=$?; }
 _paq_gate(){ printf '{"session_id":"s","cwd":"%s","permission_mode":"%s","tool_name":"Bash","tool_input":{"command":"%s"}}' "$_paw" "$1" "$2" > "$_PA/pl.json"
@@ -8006,6 +8008,11 @@ _paq_is(){ _paqn=$((_paqn+1)); [ "$2" = "$3" ] || _paqbad="$_paqbad [$1: got '$2
 _paq_post auto 'Commit only';                             _paq_is 'its answer is recorded' "$(_paq_rec)" commit
 _paq_gate auto 'git commit -m x';                         _paq_is 'the recorded click allows the commit' "$_par" 0
 _pa_new; : > "$_pa_rec"; _paq_pre auto "$_paq_canon" '' tu2; _paq_post auto 'Commit + push' tu2; _paq_is 'commit + push' "$(_paq_rec)" commit+push
+# Claude Code may hand the answered question back with its keys sorted and multiSelect gone: 7 of 7 such answers were
+# refused on a byte match (real `auto` sessions, 2026-10-18). This is that shape, as it was handed back.
+_paq_sorted="{\"header\":\"Approval\",\"options\":[{\"description\":\"Commit exactly what is staged now. No push.\",\"label\":\"Commit only\"},{\"description\":\"Commit what is staged now, then push that commit on this branch.\",\"label\":\"Commit + push\"},{\"description\":\"Push this branch as it is now. No new commit.\",\"label\":\"Push only\"},{\"description\":\"Neither commit nor push.\",\"label\":\"No\"}],\"question\":\"$_paq_text\"}"
+_pa_new; : > "$_pa_rec"; _paq_pre auto "$_paq_canon" '' tu10; _paq_post auto 'Commit + push' tu10 "$_paq_sorted"
+                                                          _paq_is 'the answered question handed back with its keys sorted' "$(_paq_rec)" commit+push
 # must-fail twins: each differs from the round trip in one thing
 _pa_new; : > "$_pa_rec"; _paq_post auto 'Commit only' tu3;  _paq_is 'an answer no PreToolUse asked for' "$(_paq_rec)" none
 _paq_pre auto "$_paq_canon" '' tu4; _paq_post auto 'Commit only' tu5; _paq_is 'an answer to another call' "$(_paq_rec)" none
@@ -8014,6 +8021,8 @@ _paq_pre auto "$_paq_canon" '' tu6; _paq_post auto 'Commit only' tu6; : > "$_pa_
 _paq_pre auto "$_paq_canon" '' tu7; _paq_post auto 'HOOK-CHOSE-Commit only' tu7; _paq_is 'an answer that is none of the four' "$(_paq_rec)" none
 _paq_pre auto "$_paq_canon" '' tu8; _paq_post auto 'No' tu8; _paq_is 'No' "$(_paq_rec)" none
 _paq_pre auto "$_paq_canon" '' tu9; _paq_post default 'Commit only' tu9; _paq_is 'an answer recorded outside auto' "$(_paq_rec)" none
+_paq_pre auto "$_paq_canon" '' tu11; _paq_post auto 'Commit only' tu11 "${_paq_sorted/No new commit./Then force-push.}"
+                                                          _paq_is 'sorted, with one text of the question changed' "$(_paq_rec)" none
 _paq_pre auto '{"question":"Crewforth approval: commit?","header":"Approval","options":[{"label":"Commit only","description":"x"}],"multiSelect":false}'
                                                           _paq_is 'another wording is refused' "$_par" 2
 _paq_pre auto "$_paq_canon" ',"answers":{"x":"Commit only"}'; _paq_is 'a call with answers is refused' "$_par" 2
@@ -8024,9 +8033,93 @@ _paq_pre bypassPermissions "$_paq_canon";                 _paq_is 'bypassPermiss
 _PAQ_X="CLAUDE_CODE_SESSION_ATTENDED=0"; _paq_pre auto "$_paq_canon"; unset _PAQ_X; _paq_is 'a headless session: refused' "$_par" 2
 _paq_pre auto '{"question":"Which colour?","header":"Colour","options":[{"label":"Red","description":"r"}],"multiSelect":false}'
                                                           _paq_is 'any other question: no decision' "$_par/$_pao" "0/"
-if [ "$_paqn" != 18 ]; then fail "FIXTURE: the approval-question table ran $_paqn cases, not 18"
-elif [ -z "$_paqbad" ]; then pass "the approval question: asked (ask) only as the fixed text, in auto, attended, with no answers; its answer recorded only for the call that was asked, once, and only as one of the four; the record allows the commit (18 cases, 13 must-fail)"
+if [ "$_paqn" != 20 ]; then fail "FIXTURE: the approval-question table ran $_paqn cases, not 20"
+elif [ -z "$_paqbad" ]; then pass "the approval question: asked (ask) only as the fixed text, in auto, attended, with no answers; its answer recorded only for the call that was asked, once, and only as one of the four, in whatever key order Claude Code hands it back; the record allows the commit (20 cases, 14 must-fail)"
 else fail "the approval question:$_paqbad"; fi
+# ...and the way to it. B-2 (a real `auto` session, 2026-10-17): /crew-ship asked for /crew-approve before any commit
+# was refused, so the refusal that prints the question never came and the click was never offered; telling the agent
+# to try the commit first did not help either (§4.4 says not to, and it did not). agent-outcome.sh now hands the
+# question over when crew-commit-agent is called; the text pinned here only says to ask it.
+_cqa="$AGENTS/crew-commit-agent.md"; _cqs="$SKILLS/crew-ship/SKILL.md"
+if [ ! -f "$_cqa" ] || [ ! -f "$_cqs" ]; then skip scope "the way to the approval question: crew-commit-agent or crew-ship is not installed here"
+elif grep -q 'question (below): ask it, with the message, instead of' "$_cqa" && grep -q 'one-click approval question when crew-commit-agent is called' "$_cqs"; then
+  pass "in auto the commit agent and /crew-ship ask the one-click question Crewforth hands over, before asking for /crew-approve"
+else fail "the commit agent or /crew-ship asks for /crew-approve before the one-click question Crewforth hands over (B-2)"; fi
+# The hand-over itself, run: agent-outcome.sh on PostToolUse of an Agent call. In `auto`, for crew-commit-agent, with
+# both halves of the question wired and no PermissionRequest hook, it adds the fixed question (_CREW_Q_JSON, read from
+# prompt-approval.sh) to the session's context; in any other mode, for any other agent, or with such a hook, nothing.
+_aq="$(mktemp -d)"; _aq="$(cd -P "$_aq" && pwd)"; mkdir -p "$_aq/p/.claude/state" "$_aq/ccd" "$_aq/home"
+printf '%s' '{"hooks":{"PreToolUse":[{"matcher":"AskUserQuestion","hooks":[{"type":"command","command":"bash .claude/hooks/guard-question.sh"}]}],"PostToolUse":[{"matcher":"AskUserQuestion","hooks":[{"type":"command","command":"bash .claude/hooks/prompt-approval.sh"}]}]}}' > "$_aq/p/.claude/settings.json"
+_aq_run(){ printf '{"hook_event_name":"PostToolUse","tool_name":"Agent","permission_mode":"%s","session_id":"s","tool_use_id":"toolu_aq1","cwd":"%s","tool_input":{"subagent_type":"%s","description":"d","prompt":"p"},"tool_response":{"status":"async_launched","agentId":"aq123abc"}}' "$1" "$_aq/p" "$2" > "$_aq/pl.json"
+  ( cd "$_aq/p" && env -u CREW_MODEL_ROUTING CLAUDE_PROJECT_DIR="$_aq/p" CLAUDE_CONFIG_DIR="$_aq/ccd" HOME="$_aq/home" CREW_GATE_LOG=/dev/null bash "$HOOKS/agent-outcome.sh" < "$_aq/pl.json" 2>/dev/null ); }
+_aqbad=""; _aqo="$(_aq_run auto crew-commit-agent)"
+case "$_aqo" in *"$_paq_text"*) ;; *) _aqbad="$_aqbad [auto, crew-commit-agent: the question was not handed over]" ;; esac
+if [ -n "$JSONQ" ] && [ -n "$_aqo" ]; then printf '%s' "$_aqo" | json_ok || _aqbad="$_aqbad [its output is not JSON]"; fi
+for _aqc in default:crew-commit-agent dontAsk:crew-commit-agent acceptEdits:crew-commit-agent auto:crew-review-agent; do
+  [ -z "$(_aq_run "${_aqc%%:*}" "${_aqc#*:}")" ] || _aqbad="$_aqbad [${_aqc%%:*}, ${_aqc#*:}: handed the question over]"
+done
+printf '%s' '{"hooks":{"PermissionRequest":[{"hooks":[{"type":"command","command":"x"}]}]}}' > "$_aq/ccd/settings.json"
+[ -z "$(_aq_run auto crew-commit-agent)" ] || _aqbad="$_aqbad [a PermissionRequest hook is wired: the question was still handed over]"
+rm -rf "$_aq"
+[ -z "$_aqbad" ] && pass "in auto, calling crew-commit-agent hands the session the fixed one-click question; not in default, acceptEdits or dontAsk, not for another agent, not with a PermissionRequest hook" \
+  || fail "the one-click question hand-over:$_aqbad"
+# THE CLICK BEFORE THE TYPED WAY, at the turn's end (2026-10-18: 9 of 18 typed asks in two real `auto` sessions on rc.4
+# came in a turn where no commit was tried, so neither the refusal nor the commit agent's hand-over offered the click).
+# prompt-approval.sh on Stop: the reply names /crew-approve, auto, the question open, not asked since the user's last
+# message -> the session is told once to ask the click. Every other case is a twin that differs in one thing.
+_sq="$(mktemp -d)"; _sq="$(cd -P "$_sq" && pwd)"; mkdir -p "$_sq/p/.claude/state" "$_sq/ccd" "$_sq/home"
+printf '%s' '{"hooks":{"PreToolUse":[{"matcher":"AskUserQuestion","hooks":[{"type":"command","command":"bash .claude/hooks/guard-question.sh"}]}],"PostToolUse":[{"matcher":"AskUserQuestion","hooks":[{"type":"command","command":"bash .claude/hooks/prompt-approval.sh"}]}]}}' > "$_sq/p/.claude/settings.json"
+_SQ_ENV="CLAUDE_PROJECT_DIR=$_sq/p CLAUDE_CONFIG_DIR=$_sq/ccd HOME=$_sq/home CREW_GATE_LOG=/dev/null"
+# $1 = mode, $2 = the reply, $3 = stop_hook_active, $4 = session id
+_sq_stop(){ printf '{"session_id":"%s","transcript_path":"%s/t.jsonl","cwd":"%s","permission_mode":"%s","hook_event_name":"Stop","stop_hook_active":%s,"last_assistant_message":"%s"}' "${4:-s1}" "$_sq" "$_sq/p" "$1" "${3:-false}" "$2" > "$_sq/pl.json"
+  ( cd "$_sq/p" && env $_SQ_ENV bash "$HOOKS/prompt-approval.sh" < "$_sq/pl.json" 2>/dev/null ); }
+_sq_ask='Review is clean. If you approve, send only this:\n/crew-approve commit+push'
+_sqbad=""; _sqn=0
+_sq_says(){ _sqn=$((_sqn+1)); case "$2" in *'ASK THE USER WITH ONE CLICK'*"$_paq_text"*) ;; *) _sqbad="$_sqbad [$1: the click was not asked for]" ;; esac
+  if [ -n "$JSONQ" ]; then printf '%s' "$2" | json_ok || _sqbad="$_sqbad [$1: the output is not JSON]"; fi; }
+_sq_quiet(){ _sqn=$((_sqn+1)); [ -z "$2" ] || _sqbad="$_sqbad [$1: said something: ${2:0:80}]"; }
+_sq_says  'auto, a typed ask, not asked this turn' "$(_sq_stop auto "$_sq_ask")"
+_sq_quiet 'stop_hook_active'                       "$(_sq_stop auto "$_sq_ask" true)"
+_sq_quiet 'dontAsk'                                "$(_sq_stop dontAsk "$_sq_ask")"
+_sq_quiet 'default'                                "$(_sq_stop default "$_sq_ask")"
+_sq_quiet 'a reply that names no /crew-approve'    "$(_sq_stop auto 'Done: the tests pass.')"
+# asked this turn: the PreToolUse half writes it down, even when it refuses the question
+printf '{"session_id":"s1","cwd":"%s","permission_mode":"dontAsk","hook_event_name":"PreToolUse","tool_name":"AskUserQuestion","tool_input":{"questions":[%s]},"tool_use_id":"tq1"}' "$_sq/p" "$_paq_canon" > "$_sq/pre.json"
+( cd "$_sq/p" && env $_SQ_ENV bash "$HOOKS/guard-question.sh" < "$_sq/pre.json" >/dev/null 2>&1 ); _sqr=$?
+[ "$_sqr" = 2 ] || _sqbad="$_sqbad [FIXTURE: the dontAsk question was not refused (rc $_sqr), so 'refused but asked' is not what runs]"
+_sq_quiet 'asked this turn (and refused)'          "$(_sq_stop auto "$_sq_ask")"
+_sq_says  'asked in another session'               "$(_sq_stop auto "$_sq_ask" false s2)"
+# the user's next message starts a new turn
+printf '{"session_id":"s1","cwd":"%s","permission_mode":"auto","hook_event_name":"UserPromptSubmit","prompt":"next"}' "$_sq/p" > "$_sq/ups.json"
+( cd "$_sq/p" && env $_SQ_ENV bash "$HOOKS/prompt-approval.sh" < "$_sq/ups.json" >/dev/null 2>&1 )
+_sq_says  'the user wrote since it was asked'      "$(_sq_stop auto "$_sq_ask")"
+printf '%s' '{"hooks":{"PermissionRequest":[{"hooks":[{"type":"command","command":"x"}]}]}}' > "$_sq/ccd/settings.json"
+_sq_quiet 'a PermissionRequest hook is wired'      "$(_sq_stop auto "$_sq_ask")"
+rm -rf "$_sq"
+# A Stop is not the user's next message: an approval recorded by a click survives the turn's end, even when the reply
+# quotes the tool's name (which sends the payload past the AskUserQuestion test).
+_pa_new; : > "$_pa_rec"; _paq_pre auto "$_paq_canon" '' ts1; _paq_post auto 'Commit only' ts1
+printf '{"session_id":"s","transcript_path":"%s","cwd":"%s","permission_mode":"auto","hook_event_name":"Stop","stop_hook_active":false,"last_assistant_message":"I asked with \\"AskUserQuestion\\"; run /crew-approve if not."}' "$_patr" "$_paw" > "$_PA/st.json"
+( cd "$_paw" && env $_PAQ_ENV bash "$HOOKS/prompt-approval.sh" < "$_PA/st.json" >/dev/null 2>&1 )
+_sqn=$((_sqn+1)); [ "$(_paq_rec)" = commit ] || _sqbad="$_sqbad [a Stop ended the recorded approval: '$(_paq_rec)']"
+if [ "$_sqn" != 10 ]; then fail "FIXTURE: the Stop-half table ran $_sqn cases, not 10"
+elif [ -z "$_sqbad" ]; then pass "at the turn's end a reply asking for /crew-approve, in auto with the question open and not asked since the user's last message, is sent back once to ask the click; not after a Stop continuation, outside auto, without the command, once asked (even refused), or with a PermissionRequest hook; a Stop leaves a recorded approval alone (10 cases, 6 must-stay-quiet)"
+else fail "the Stop half of the approval question:$_sqbad"; fi
+# ONE WAY TO ASK in the refusal (2026-10-18, a real `auto` session on rc.3: the refusal offered the question and the
+# typed command as equals, and the session told the user to type 7 times in 9). With the question open the typed way is
+# printed only as the fallback for a question that cannot be asked; with it closed (dontAsk), only the typed way.
+_pa_new
+( cd "$_paw" && printf '%s' '{"hooks":{"UserPromptSubmit":[{"hooks":[{"type":"command","command":"bash .claude/hooks/prompt-approval.sh"}]}],"PreToolUse":[{"matcher":"AskUserQuestion","hooks":[{"type":"command","command":"bash .claude/hooks/guard-question.sh"}]}],"PostToolUse":[{"matcher":"AskUserQuestion","hooks":[{"type":"command","command":"bash .claude/hooks/prompt-approval.sh"}]}]}}' > .claude/settings.json )
+_oabad=""
+_paq_gate auto 'git commit -m x'
+case "$_pae" in *'"questions":['*'do not also give the user a command to type.'*'ONLY IF THAT QUESTION CANNOT BE ASKED'*) ;; *) _oabad="$_oabad [auto, question open: not the click first and the typed way as its fallback]" ;; esac
+case "$_pae" in *'ASK THE USER NOW'*|*'the way below works as well'*) _oabad="$_oabad [auto, question open: the typed way is still offered as an equal]" ;; esac
+_paq_gate dontAsk 'git commit -m x'
+case "$_pae" in *'ASK THE USER NOW'*'/crew-approve'*) ;; *) _oabad="$_oabad [dontAsk: the typed way is not asked for]" ;; esac
+case "$_pae" in *'"questions":['*|*'ONLY IF THAT QUESTION'*) _oabad="$_oabad [dontAsk: the question is offered]" ;; esac
+_pa_new
+[ -z "$_oabad" ] && pass "a refused commit in auto offers the click and only falls back to the typed /crew-approve when the question cannot be asked; in dontAsk only the typed way" \
+  || fail "one way to ask:$_oabad"
 
 # A PermissionRequest HOOK, wherever this can read one, closes the question AND the gate's own prompt. Each source is
 # planted alone in an otherwise clean fixture; the clean fixture itself must answer "none" (calibration).
@@ -8484,6 +8577,27 @@ for _pr in 'Do the work.' 'Please do this:\nfiles: a\nchange: feature\nverify: t
 done
 [ -z "$_v2b" ] && pass "a crew call with no card, a card that is not at the top, a card with a line missing or one named twice is refused, with the three lines to write" \
                || fail "a task without a proper card passed:$_v2b"
+# The card on one line (2026-10-18: 17 of 39 card refusals on this machine were `files: … · change: … · verify: …`). It is
+# read by its labels and held to the same rules: what passes on three lines passes on one, and what fails there fails.
+_v2b=""; _v2one(){ printf '{"hook_event_name":"PreToolUse","tool_name":"Agent","tool_input":{"prompt":"%s\\n\\nDo it.","subagent_type":"crew-backend-expert","model":"%s"}}' "$1" "$2" > "$_v2/one.json"
+  ( cd "$_v2p" && _v2e bash "$_V2G" < "$_v2/one.json" >"$_v2/oneout" 2>"$_v2/err" ); _rc=$?; }
+for _pr in 'files: src/ui/a.ts · change: feature · verify: true' 'files: src/ui/a.ts; change: feature; verify: true' 'files: src/ui/a.ts | change: feature | verify: true' \
+           'Card: files: src/ui/a.ts, src/ui/b.ts · change: feature · verify: true.' 'Card — files: src/ui/a.ts · change: text · verify: none'; do
+  _v2one "$_pr" sonnet; [ "$_rc" = 0 ] || _v2b="$_v2b [refused: $_pr → $_rc $(head -c 120 "$_v2/err")]"
+done
+_v2one 'files: src/payments/p.ts · change: feature · verify: true' sonnet
+{ [ "$_rc" = 2 ] && ! grep -q 'opens with its task card' "$_v2/err"; } || _v2b="$_v2b [a one-line card on a critical path was not read as one (rc $_rc)]"
+_v2one 'files: src/ui/a.ts · change: feature · verify: true · above: the parser is subtle' opus
+{ [ "$_rc" = 0 ] && ! grep -q 'runs on sonnet' "$_v2/oneout"; } || _v2b="$_v2b [above: on the same line was not read (rc $_rc)]"
+_v2one 'files: src/ui/a.ts · change: feature (a small one) · verify: true' sonnet; [ "$_rc" = 0 ] || _v2b="$_v2b [a kind with a note in parentheses, one line → $_rc]"
+_v2one 'files: src/ui/a.ts · change: architecture (planning only) · verify: none' sonnet
+{ [ "$_rc" = 2 ] && grep -q 'runs on opus' "$_v2/err"; } || _v2b="$_v2b [architecture (planning only) was not read as architecture, which runs on opus (rc $_rc)]"
+_v2one 'files: src/ui/a.ts\nchange: refactor (no behaviour change)\nverify: true' sonnet; [ "$_rc" = 0 ] || _v2b="$_v2b [a kind with a note in parentheses, three lines → $_rc]"
+for _pr in 'files: a · change: archi (planning only) · verify: none' 'files: a · change: feature extra · verify: none' 'files: a · verify: true · change: text' 'files: a · change: feature' 'Do this. files: a · change: feature · verify: true'; do
+  _v2one "$_pr" sonnet; { [ "$_rc" = 2 ] && grep -q 'opens with its task card' "$_v2/err"; } || _v2b="$_v2b [passed: $_pr → $_rc]"
+done
+[ -z "$_v2b" ] && pass "a card on one line (· ; | separators, a Card: lead, above: on the line) is read by its labels and held to the three-line rules: a critical path still needs opus; a kind with a note in parentheses is the kind, on one line or three; a bad change, labels out of order, a missing verify or prose first are refused" \
+               || fail "the one-line card:$_v2b"
 
 # ---- at write time: the card can leave a file out --------------------------------------------------------------
 _v2new; _v2b=""

package/kit/hooks/agent-outcome.sh

@@ -404,6 +404,24 @@ case "$EV" in
         fi
       fi
     fi
+    # THE ONE-CLICK APPROVAL, OFFERED WHEN THE COMMIT MESSAGE IS ASKED FOR (B-2). In `auto` the click used to reach the
+    # user only inside a refused commit, and a session that asked for /crew-approve first never tried one (§4.4 says
+    # not to), so it was never offered. A call to crew-commit-agent is when the message is on its way: the session is
+    # told then, in foreground and background alike (a background launch answers here at once). Whether the question
+    # is open, and its words, come from prompt-approval.sh, as the refusal's do. Its verify is `none` (change: text),
+    # so no outcome below is lost by answering here; the model it ran on is already kept above.
+    _json_slice "$INPUT" subagent_type >/dev/null
+    if [ "$_JS" = crew-commit-agent ] && [ -f "$_ao_here/prompt-approval.sh" ]; then
+      _json_slice "$INPUT" permission_mode >/dev/null; _AOPM="$_JS"
+      if [ "$_AOPM" = auto ]; then
+        declare -F _crew_q_open >/dev/null 2>&1 || . "$_ao_here/prompt-approval.sh"
+        if declare -F _crew_q_open >/dev/null 2>&1 && _crew_q_open auto; then
+          _ao_json "Crewforth: when you show the user the commit message this agent proposes, ask with one click before anything else. $_CREW_Q_ASK {\"questions\":[$_CREW_Q_JSON]} Their answer is recorded by Crewforth itself (the line it adds says so); then run the commit it names. If that question is refused, the user can type /crew-approve instead, as the refusal says."
+          printf '{"hookSpecificOutput":{"hookEventName":"PostToolUse","additionalContext":"%s"}}\n' "$_AOJ"
+          exit 0
+        fi
+      fi
+    fi
     R="$_AMD/results/$AID"
     if [ ! -f "$R" ]; then
       # No result yet: the agent was launched in the background (measured, 2.1.294 and 2.1.296: an Agent call that

package/kit/hooks/guard-agent-model.sh

@@ -431,11 +431,44 @@ _am_all_prose(){  # after _am_card -> 0 when every file of the card is prose
 
 # ---- THE CARD ---------------------------------------------------------------------------------------------------
 _AM_CHANGES=' text feature fix-known fix-unknown refactor migration security architecture test-run test-write audit '
+_am_trim(){  # $1 -> _AMT: no white space around it, and no separator or full stop left at its end (one-line cards)
+  local v="$1" o
+  while :; do case "$v" in [$' \t']*) v="${v:1}" ;; *) break ;; esac; done
+  while :; do o="$v"
+    case "$v" in *[$' \t']) v="${v%?}" ;; *'·') v="${v%'·'}" ;; *'—') v="${v%'—'}" ;; *'–') v="${v%'–'}" ;; *[\|\;,.]) v="${v%?}" ;; esac
+    [ "$v" = "$o" ] && break
+  done
+  _AMT="$v"
+}
+# THE CARD ON ONE LINE. Sessions write it as `files: … · change: … · verify: …` (measured on this machine's transcripts,
+# 2026-10-18: 17 of the 39 calls refused for their card, in 6 projects; the next call was the same card on three lines).
+# It is read by its labels, in that order, after an optional `Card:` / `Card —`; `above: <why>` may close the line. The
+# fields are then held to exactly the rules of the three-line card below, so nothing passes here that would not there.
+_am_card_line(){  # $1 = the first line of the task -> 0 and CARD_* set (unchecked); 1 when it is not a one-line card
+  local l="$1" r f c v a=""
+  case "$l" in [Cc]ard*) l="${l#[Cc]ard}"; l="${l#\*\*}"
+    while :; do case "$l" in [$' \t:*']*|'—'*|'–'*|-*) case "$l" in '—'*) l="${l#'—'}" ;; '–'*) l="${l#'–'}" ;; *) l="${l:1}" ;; esac ;; *) break ;; esac; done ;;
+  esac
+  case "$l" in files:*) ;; *) return 1 ;; esac
+  r="${l#files:}"
+  case "$r" in *change:*verify:*) ;; *) return 1 ;; esac
+  f="${r%%change:*}"; r="${r#*change:}"; c="${r%%verify:*}"; v="${r#*verify:}"
+  case "$v" in *above:*) a="${v#*above:}"; v="${v%%above:*}" ;; esac
+  _am_trim "$f"; CARD_FILES="$_AMT"; _am_trim "$c"; CARD_CHANGE="$_AMT"; _am_trim "$v"; CARD_VERIFY="$_AMT"
+  [ -n "$a" ] && { _am_trim "$a"; CARD_ABOVE="${_AMT:0:200}"; }
+  return 0
+}
 _am_card(){  # $1 = a task text -> 0 and CARD_FILES, CARD_CHANGE, CARD_VERIFY (CARD_ABOVE); 1 and CARD_WHY
-  local s="$1" l k v n=0 seen=""
+  local s="$1" l k v n=0 seen="" one=0
   CARD_FILES=""; CARD_CHANGE=""; CARD_VERIFY=""; CARD_WHY=""; CARD_ABOVE=""
   s="${s//$'\r'/}"
-  while [ "$n" -lt 3 ] && [ -n "$s" ]; do
+  # One line first: the first line that is not empty, read by its labels; the three-line reading otherwise.
+  l="$s"; while :; do case "$l" in [$' \t\n']*) l="${l:1}" ;; *) break ;; esac; done; l="${l%%$'\n'*}"
+  if _am_card_line "$l"; then
+    one=1; n=3
+    s="${s#*"$l"}"; s="${s#$'\n'}"
+  fi
+  while [ "$one" = 0 ] && [ "$n" -lt 3 ] && [ -n "$s" ]; do
     l="${s%%$'\n'*}"; if [ "$l" = "$s" ]; then s=""; else s="${s#*$'\n'}"; fi
     while :; do case "$l" in [$' \t']*) l="${l:1}" ;; *) break ;; esac; done
     [ -n "$l" ] || continue
@@ -455,12 +488,16 @@ _am_card(){  # $1 = a task text -> 0 and CARD_FILES, CARD_CHANGE, CARD_VERIFY (C
   done
   [ "$n" = 3 ] || { CARD_WHY="the task does not begin with the three lines files:, change:, verify:"; return 1; }
   [ -n "$CARD_FILES" ] || { CARD_WHY="files: is empty (name the files or globs, or the folder)"; return 1; }
+  # A note in parentheses after the kind is the session's own comment, as `none (…)` is for verify: `architecture
+  # (planning only)` is architecture (4 of the cards refused on this machine, 2026-10-18). Only a kind on the list, and
+  # only a note that is the whole rest of the value in parentheses.
+  case "$CARD_CHANGE" in *' ('*')') v="${CARD_CHANGE%% (*}"; case "$_AM_CHANGES" in *" $v "*) CARD_CHANGE="$v" ;; esac ;; esac
   case "$_AM_CHANGES" in *" $CARD_CHANGE "*) ;; *) CARD_WHY="change: is '${CARD_CHANGE:0:40}', not one of:$_AM_CHANGES"; return 1 ;; esac
   [ -n "$CARD_VERIFY" ] || { CARD_WHY="verify: is empty (a command, or none)"; return 1; }
   case "$CARD_VERIFY" in none|None|NONE|-|'none '*|'none('*|'None '*|'NONE '*) CARD_VERIFY=none ;; esac   # "none (the author ran it)" is none
   # Optional, right after the three: `above: <why>` keeps a model above the card's floor. Without it a call above
   # the floor is run on the floor (the cost of a model nobody needed is what this gate exists to stop).
-  while [ -n "$s" ]; do
+  while [ -z "$CARD_ABOVE" ] && [ -n "$s" ]; do
     l="${s%%$'\n'*}"; if [ "$l" = "$s" ]; then s=""; else s="${s#*$'\n'}"; fi
     while :; do case "$l" in [$' \t']*) l="${l:1}" ;; *) break ;; esac; done
     [ -n "$l" ] || continue

package/kit/hooks/guard-bash.sh

@@ -2524,16 +2524,7 @@ _appr_wired(){  # 0 = prompt-approval.sh is beside this hook and a settings file
 }
 # IS THE APPROVAL QUESTION WIRED? The same reading as above, for the two halves on AskUserQuestion (guard-question.sh
 # on PreToolUse, prompt-approval.sh on PostToolUse). Asked only to choose which way the refusal offers first.
-_q_wired(){
-  local f t d="${CLAUDE_PROJECT_DIR:-.}"
-  d="${d//\\//}"; d="${d%/}"
-  for f in "${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT//\\//}/hooks/hooks.json}" "$d/.claude/settings.json" "$d/.claude/settings.local.json" "${HOME:+${HOME//\\//}/.claude/settings.json}"; do
-    [ -n "$f" ] && [ -f "$f" ] || continue
-    t=""; IFS= read -r -d '' t < "$f" || true
-    case "$t" in *'"PreToolUse"'*AskUserQuestion*guard-question.sh*'"PostToolUse"'*AskUserQuestion*prompt-approval.sh*) return 0 ;; esac
-  done
-  return 1
-}
+_q_wired(){ declare -F _crew_q_wired >/dev/null 2>&1 && _crew_q_wired; }   # defined once, in prompt-approval.sh
 # MAY A PermissionRequest HOOK ANSWER THE PROMPT? One scan, defined in prompt-approval.sh (_crew_prh_scan) and read
 # from there. Without that file there is no other approval to fall back to, so the answer is "no" and the gate
 # asks as it always has.
@@ -2603,12 +2594,21 @@ _gate_written(){
       { printf 'sid=%s\nop=%s\nts=%s\n' "$_psid" "$_pw" "$_pn" > "$_pd/crew-approval-pending"; } 2>/dev/null || _pw=""
     fi
   fi
+  # ONE WAY TO ASK. With the question open, the refusal used to print it and then the typed way as an equal choice,
+  # and the session picked the typed one 7 times in 9 (a real `auto` session on rc.3, 2026-10-18): the user was told
+  # to type a command for what one click does. The typed way is now the fallback, said as one.
+  _QOFF=0
   if [ "$PERM_MODE" = auto ] && [ "$_PRF" = 0 ] && _q_wired && declare -F _crew_q_pre >/dev/null 2>&1 && [ -f "${BASH_SOURCE%/*}/guard-question.sh" ]; then
-    echo "ASK THE USER WITH ONE CLICK (stage first: the approval covers what is staged at that moment): show the commit message whole, in ONE code block, then call AskUserQuestion with exactly this input, nothing added or changed:" >&2
+    _QOFF=1
+    echo "$_CREW_Q_ASK" >&2
     echo "{\"questions\":[$_CREW_Q_JSON]}" >&2
-    echo "Their answer is recorded by Crewforth itself (the line it adds says so); then run the command it names. If they would rather type, the way below works as well." >&2
+    echo "Their answer is recorded by Crewforth itself (the line it adds says so); then run the command it names. Ask it this way only: do not also give the user a command to type." >&2
+  fi
+  if [ "$_QOFF" = 1 ]; then
+    echo "ONLY IF THAT QUESTION CANNOT BE ASKED (the tool call is refused, or the user dismisses it), ask instead, in their language, in this shape and with nothing after it:" >&2
+  else
+    echo "ASK THE USER NOW, in their language, in this shape and with nothing after it (stage first: the approval covers what is staged at that moment):" >&2
   fi
-  echo "ASK THE USER NOW, in their language, in this shape and with nothing after it (stage first: the approval covers what is staged at that moment):" >&2
   echo "  1. the commit message, whole, in ONE code block;" >&2
   if [ -n "$_pw" ]; then
     echo "  2. under it one sentence in their language (If you approve, send only this:), and then the command on a line of its own, exactly as it is:" >&2

package/kit/hooks/prompt-approval.sh

@@ -74,7 +74,7 @@ export LC_ALL=C
 _PA_LIB=0; [ "${BASH_SOURCE[0]}" != "$0" ] && _PA_LIB=1
 if [ "$_PA_LIB" = 0 ]; then
   IFS= read -r -d '' INPUT || true
-  case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*|*'"hook_event_name"'*'"AskUserQuestion"'*|*'"AskUserQuestion"'*'"hook_event_name"'*) ;; *) exit 0 ;; esac
+  case "$INPUT" in *'"hook_event_name"'*UserPromptSubmit*|*'"hook_event_name"'*'"AskUserQuestion"'*|*'"AskUserQuestion"'*'"hook_event_name"'*|*'"hook_event_name"'*'"Stop"'*) ;; *) exit 0 ;; esac
 fi
 # ---- CREW-JSON-PARSE ------------------------------------------------------------------------------------
 _json_find(){  # $1 = text, $2 = a literal -> _JF = the offset of its first occurrence, -1 when there is none
@@ -426,6 +426,19 @@ _crew_appr_op(){  # $1 = a text, decoded -> OP: commit | push | commit+push | pe
 # same four answers and what each one does. guard-bash.sh prints it from here for the model to ask.
 _CREW_Q_TEXT='Crewforth approval: may Claude commit what is staged now, push this branch, or both?'
 _CREW_Q_JSON='{"question":"'"$_CREW_Q_TEXT"'","header":"Approval","options":[{"label":"Commit only","description":"Commit exactly what is staged now. No push."},{"label":"Commit + push","description":"Commit what is staged now, then push that commit on this branch."},{"label":"Push only","description":"Push this branch as it is now. No new commit."},{"label":"No","description":"Neither commit nor push."}],"multiSelect":false}'
+# THE ANSWERED QUESTION, IN ANY KEY ORDER. Claude Code hands PostToolUse the question back either as it was asked or
+# re-serialised with its keys sorted (`header,options[description,label],question`, sometimes without multiSelect):
+# 30 of 30 answers in the asked order were recorded and 7 of 7 sorted ones refused, on a byte match (real sessions,
+# 2.1.299 and 2.1.302, 2026-10-18). So the answer side checks every "key":"text" pair of the fixed question, wherever
+# it sits; the exact match stays on PreToolUse, and the tool id binds the answer to the call that passed it.
+_crew_q_is(){  # $1 = a payload -> 0 when it carries every "key":"text" pair of _CREW_Q_JSON
+  local rest="$_CREW_Q_JSON" re='("[A-Za-z]+":"[^"]*")' p
+  while [[ $rest =~ $re ]]; do
+    p="${BASH_REMATCH[1]}"
+    case "$1" in *"$p"*) ;; *) return 1 ;; esac
+    rest="${rest#*"$p"}"
+  done
+}
 _crew_q_op(){  # $1 = the label the user chose -> OP: commit | commit+push | push | no, or "" for anything else
   case "$1" in
     'Commit only') OP=commit ;; 'Commit + push') OP=commit+push ;; 'Push only') OP=push ;; 'No') OP=no ;; *) OP="" ;;
@@ -514,11 +527,36 @@ _crew_prh_scan(){  # -> 0 when a PermissionRequest hook may be wired; _PRH names
   return "$r"
 }
 
+# ---- IS THE QUESTION OPEN HERE? One answer for every hook that offers it ------------------------------------------
+# guard-bash.sh offers it in a refusal; agent-outcome.sh offers it when crew-commit-agent is called in `auto`, so the
+# click is on offer before any commit is tried (B-2, a real session: with the refusal as the only way to it, a session
+# that asked for /crew-approve first never showed it). The text the user is asked stays _CREW_Q_JSON, here only.
+_CREW_Q_HERE="${BASH_SOURCE[0]%/*}"; [ "$_CREW_Q_HERE" = "${BASH_SOURCE[0]}" ] && _CREW_Q_HERE=.
+_crew_q_wired(){  # 0 = a settings file wires both halves on AskUserQuestion (guard-question.sh, then this file)
+  local f t d="${CLAUDE_PROJECT_DIR:-.}"
+  d="${d//\\//}"; d="${d%/}"
+  for f in "${CLAUDE_PLUGIN_ROOT:+${CLAUDE_PLUGIN_ROOT//\\//}/hooks/hooks.json}" "$d/.claude/settings.json" "$d/.claude/settings.local.json" "${HOME:+${HOME//\\//}/.claude/settings.json}"; do
+    [ -n "$f" ] && [ -f "$f" ] || continue
+    t=""; IFS= read -r -d '' t < "$f" || true
+    case "$t" in *'"PreToolUse"'*AskUserQuestion*guard-question.sh*'"PostToolUse"'*AskUserQuestion*prompt-approval.sh*) return 0 ;; esac
+  done
+  return 1
+}
+_crew_q_open(){  # $1 = permission mode -> 0 when the click may be offered: auto, both halves wired and beside this file, no PermissionRequest hook
+  [ "$1" = auto ] && [ -f "$_CREW_Q_HERE/guard-question.sh" ] && _crew_q_wired && ! _crew_prh_scan
+}
+# What the session is told to do, the same words wherever it is offered.
+_CREW_Q_ASK='ASK THE USER WITH ONE CLICK (stage first: the approval covers what is staged at that moment): show the commit message whole, in ONE code block, then call AskUserQuestion with exactly this input, nothing added or changed:'
+
 # ---- the approval question's context, and its PreToolUse half -----------------------------------------------
 # Shared by prompt-approval.sh (PostToolUse: it records the answer) and guard-question.sh (PreToolUse: it asks). The
 # PreToolUse half is a GATE and lives in a gate's file, so an error of its own refuses the call (CREW-FAILCLOSED)
 # instead of letting the question through with no `ask`; this file also answers UserPromptSubmit, where a refusal
 # would erase the user's message.
+_crew_q_dir(){  # $1 = cwd -> _QAD (the state folder), ASKED (the call PreToolUse let through), TRIED (asked since the user's last message)
+  _QAD="${CLAUDE_PROJECT_DIR:-$1}"; _QAD="${_QAD//\\//}"; _QAD="${_QAD%/}/.claude/state"
+  ASKED="$_QAD/crew-approval-asked"; TRIED="$_QAD/crew-approval-tried"
+}
 _crew_q_ctx(){  # $INPUT -> CWD REC PM SID _QTU _QAD ASKED _QNOW; exits 0 (no decision) when the call is not the approval question
   _json_keycount "$INPUT" hook_event_name; [ "$_KC" = 1 ] || exit 0
   _json_keycount "$INPUT" tool_name; [ "$_KC" = 1 ] || exit 0
@@ -531,11 +569,14 @@ _crew_q_ctx(){  # $INPUT -> CWD REC PM SID _QTU _QAD ASKED _QNOW; exits 0 (no de
   _json_slice "$INPUT" permission_mode >/dev/null; PM="$_JS"
   _json_slice "$INPUT" session_id >/dev/null; SID="$_JS"
   _json_slice "$INPUT" tool_use_id >/dev/null; _QTU="$_JS"
-  _QAD="${CLAUDE_PROJECT_DIR:-$CWD}"; _QAD="${_QAD//\\//}"; _QAD="${_QAD%/}/.claude/state"; ASKED="$_QAD/crew-approval-asked"
+  _crew_q_dir "$CWD"
   if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _QNOW '%(%s)T' -1; else _QNOW="$(date +%s)"; fi
 }
 _crew_q_pre(){  # the PreToolUse decision: `ask`, or a refusal (exit 2) that says why
   _crew_q_ctx
+  # Asked at all, whatever the decision below: a question refused here, or dismissed by the user, leaves the typed
+  # way as the one that is left, and the Stop half (_pa_stop) must not send the session back to ask it again.
+  [ -n "$SID" ] && [ -d "$_QAD" ] && { printf 'sid=%s\n' "$SID" > "$TRIED"; } 2>/dev/null
   qno(){  # $1 = why, for the model. The call does not run; where it applies, the typed approval is named as the way left.
     echo "GUARD (§4.4): the approval question was not asked: $1" >&2
     [ "${2:-}" = nohint ] || echo "The way that always works is the user's own: the user can type /crew-approve (or /crew-approve commit, push, commit+push) as their whole message." >&2
@@ -693,7 +734,7 @@ _pa_question(){
   : > "$ASKED" 2>/dev/null                                 # one question, one answer
   case "$_at$_QNOW" in *[!0-9]*|'') no "the time of the question could not be read." ;; esac
   [ $((_QNOW - _at)) -ge 0 ] && [ $((_QNOW - _at)) -le 1800 ] || no "the question was asked more than 30 minutes ago."
-  case "$INPUT" in *'"questions":['"$_CREW_Q_JSON"']'*) ;; *) no "the question answered is not the fixed one." ;; esac
+  _crew_q_is "$INPUT" || no "the question answered is not the fixed one."
   [ "$PM" = auto ] || no "the approval question is recorded in auto only, and this session is in ${PM:-an unknown mode}."
   _crew_prh_scan && no "a PermissionRequest hook may be wired ($_PRH), and it can answer the question before you do. The approval that still works is typed: the user can type /crew-approve instead."
   _json_keycount "$INPUT" "$_CREW_Q_TEXT"; _an=$_KC
@@ -711,6 +752,32 @@ _pa_question(){
   BARE=0
   _pa_record
 }
+# ---- THE CLICK BEFORE THE TYPED WAY (Stop) -------------------------------------------------------------------
+# The click reached the user only from a refused commit or a call to crew-commit-agent, and a session that wrote the
+# message itself asked the user to type /crew-approve without trying either: 9 of 18 typed asks in two real `auto`
+# sessions on rc.4 (2026-10-18) came in a turn where no commit was tried, most right after crew-review-agent. So the
+# turn's end is where it is caught: the reply names /crew-approve, the question is open, and it was not asked since
+# the user's last message. Then the session is told, once, to ask the click; it never blocks, and stop_hook_active
+# lets the turn end the next time whatever was said.
+_pa_stop(){
+  case "$INPUT" in *'"stop_hook_active":true'*|*'"stop_hook_active": true'*) exit 0 ;; esac
+  _json_slice "$INPUT" permission_mode >/dev/null; [ "$_JS" = auto ] || exit 0
+  _json_slice "$INPUT" last_assistant_message >/dev/null
+  case "$_JS" in *'/crew-approve'*) ;; *) exit 0 ;; esac
+  _json_slice "$INPUT" session_id >/dev/null; SID="$_JS"; [ -n "$SID" ] || exit 0
+  _json_slice "$INPUT" cwd >/dev/null; _json_unescape "$_JS" >/dev/null; _crew_q_dir "${_JU:-.}"
+  _crew_q_open auto || exit 0
+  _al=""; [ -f "$TRIED" ] && { IFS= read -r _al < "$TRIED"; } 2>/dev/null
+  [ "$_al" = "sid=$SID" ] && exit 0
+  _ao="Crewforth: your reply asks for a typed approval, and the one-click approval question was not asked since the user's last message. If that is a commit or a push waiting for approval, ask with one click now instead: $_CREW_Q_ASK {\"questions\":[$_CREW_Q_JSON]} Their answer is recorded by Crewforth itself (the line it adds says so). If the question is refused or dismissed, the user can type /crew-approve instead. If you only mentioned the command, end your turn."
+  _ao="${_ao//\\/\\\\}"; _ao="${_ao//\"/\\\"}"     # fixed ASCII text on one line: a backslash and a quote are all it holds
+  printf '{"hookSpecificOutput":{"hookEventName":"Stop","additionalContext":"%s"}}\n' "$_ao"
+  exit 0
+}
+_json_keycount "$INPUT" hook_event_name
+if [ "$_KC" = 1 ]; then _json_slice "$INPUT" hook_event_name >/dev/null; [ "$_JS" = Stop ] && _pa_stop; fi
+case "$INPUT" in *'"hook_event_name"'*'"Stop"'*) exit 0 ;; esac   # a Stop is never a prompt: it must not end an approval below
+
 case "$INPUT" in *'"AskUserQuestion"'*)
   _json_slice "$INPUT" hook_event_name >/dev/null
   case "$_JS" in PostToolUse) EVN="$_JS"; _pa_question ;; esac ;;
@@ -745,6 +812,8 @@ _crew_appr_path "$CWD"; REC="$_AP"
 # THE USER'S NEXT MESSAGE ENDS THE APPROVAL, whatever it says. Emptied with a redirection, which is a builtin:
 # `rm` would be a process on a hook that runs on every prompt.
 if [ -n "$REC" ] && [ -s "$REC" ]; then : > "$REC" 2>/dev/null || true; fi
+# ...and starts a new turn for the Stop half: the question has not been asked since this message.
+_crew_q_dir "$CWD"; [ -s "$TRIED" ] && { : > "$TRIED"; } 2>/dev/null
 
 # ---- is this message an approval? ------------------------------------------------------------------------
 [ "$_n_prompt" = 1 ] || exit 0

package/kit/hooks/trace-blocklist.txt

@@ -12,6 +12,15 @@
 
 Co-Authored-By
 #test: Co-Authored-By: An Assistant <noreply@example.com>
+# The session-link trailer Claude Code asks the model to end a commit message with: it reached six pushed commits of a
+# project with Crewforth installed (2026-10-18), because nothing here named it. The trailer and the address are both
+# caught, so a message that keeps only one of them is still stopped. One line, not two: each line is one grep on every
+# commit (a process, 62-135 ms on Git Bash).
+Claude-Session:|claude\.ai/code/session_
+#test: Claude-Session: https://claude.ai/code/session_0123456789abcdef
+#test: see https://claude.ai/code/session_0123456789abcdef for the run
+#test-clean: the claude session limit is reached
+#test-clean: https://claude.ai/code is the web app
 # "Generated by/with" alone matched every machine-written header in existence — a pubspec.lock, an EF Core
 # scaffold, protoc, openapi-generator. A live --dotnet install could not make its FIRST commit because the
 # cloned base carries a Dart lockfile saying "Generated by pub". §4.1 is about AI AUTHORSHIP, so the pattern

package/kit/settings.json

@@ -153,6 +153,12 @@
             "shell": "bash",
             "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/session-guard.sh",
             "timeout": 60
+          },
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "cd \"$CLAUDE_PROJECT_DIR\" 2>/dev/null; bash .claude/hooks/prompt-approval.sh",
+            "timeout": 60
           }
         ]
       }

package/kit/skills/crew-ship/SKILL.md

@@ -9,7 +9,9 @@ Closure flow — in order:
 1. **DoD gate:** was `/simplify` applied · are tests green (@agent-crew-test-expert) · (if SonarQube is used) `sonarqube-check` 0/0/0/0.
    If any one is red, **STOP**, report what is missing; no deferral.
 2. If clean, @agent-crew-commit-agent (commit-message) **proposes** an atomic Conventional Commit from the staged diff.
-3. Commit runs ONLY if the user says "commit" (§4.4). "Done" is not approval.
+3. Commit runs ONLY if the user says "commit" (§4.4). "Done" is not approval. In `auto`, Crewforth hands the session the
+   one-click approval question when crew-commit-agent is called: ask it with the message; the typed `/crew-approve` is
+   for when no question is offered.
 4. **Close the board item too** (`teamboard`), when one is held. Closing work is one movement: ask what shipped,
    run `board.sh done <id> "<note>"`, name the items it unblocked, and offer the next one as options. Do not
    leave this to the user to remember — a claim nobody closes reads to the whole team as still in progress, and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crewforth",
-  "version": "3.2.0-rc.3",
+  "version": "3.2.0-rc.5",
   "description": "Crewforth — your engineering crew for Claude Code: agents, skills and tool-level gates, in any stack.",
   "bin": {
     "crewforth": "bin/cli.js"