crewforth 3.4.0 → 3.5.0-rc.2

package/kit/hooks/precompact-snapshot.sh

@@ -38,7 +38,7 @@ if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
   BR="$(git rev-parse --abbrev-ref HEAD 2>/dev/null)" || BR=""
   [ -n "$BR" ] && LINES+=("branch $BR")
   # quotePath off: a name in Turkish (or any non-ASCII) is given as written, not as octal escapes (seen on Windows).
-  CH="$(git -c core.quotePath=false status --porcelain 2>/dev/null)" || CH=""
+  CH="$(git -c core.fsmonitor= -c core.quotePath=false status --porcelain 2>/dev/null)" || CH=""
   if [ -n "$CH" ]; then
     n=0; names=""
     while IFS= read -r l; do n=$((n+1)); [ "$n" -le 5 ] && names="${names:+$names, }${l:3}"; done <<< "$CH"
@@ -49,7 +49,11 @@ if [ -f "$LIB/gate-log.sh" ]; then
   . "$LIB/gate-log.sh"; crew_gate_log_read
   if [ -n "${_CREW_GL:-}" ] && [ -f "$_CREW_GL" ]; then
     last=""; while IFS= read -r l; do case "$l" in BLOCK$'\t'*) last="$l" ;; esac; done < "$_CREW_GL"
-    if [ -n "$last" ]; then IFS=$'\t' read -r _ rule why _ <<< "$last"; LINES+=("the last refusal in the gate log: ${rule} ${why:0:120}"); fi
+    # Head AND tail of a long reason: the cause of a refusal is often the last words of it (the path, the value), and
+    # a head-only cut dropped exactly that part.
+    if [ -n "$last" ]; then IFS=$'\t' read -r _ rule why _ <<< "$last"
+      [ "${#why}" -gt 120 ] && why="${why:0:70} … ${why: -45}"
+      LINES+=("the last refusal in the gate log: ${rule} ${why}"); fi
   fi
 fi
 fnd=""
@@ -60,16 +64,108 @@ for f in .crewforth/*.json; do
 done
 [ -n "$fnd" ] && LINES+=("findings on record: $fnd")
 [ -s docs/SESSION_STATE.md ] && LINES+=("a handover is at docs/SESSION_STATE.md")
-[ "${#LINES[@]}" -gt 0 ] || exit 0
 
-SUM=""; for l in "${LINES[@]}"; do SUM="${SUM:+$SUM; }$l"; done
-SUM="${SUM:0:1800}"
+# ---- what the transcript says: the user's own words, and the skills in use ----
+# A compaction summary retells the task, and a retelling can soften a hard "do not". So the first prompt and the
+# last three are kept as the user typed them, each cut at about 300 characters. And a skill's text is not always
+# brought back after a compaction (measured on local transcripts: 3 of 12 compactions that followed a Skill call
+# re-attached nothing), so the skill names are kept too. ONE grep over the transcript; the rest is builtins.
+# A prompt line in a transcript is already a JSON string, so it is stored as it is and never re-escaped; a cut
+# that splits an escape or a multibyte character is trimmed back to a whole one. Skipped: a prompt that opens with
+# a tag (command output, a notification, pasted content), a meta, sidechain or compaction-summary record, and any
+# prompt a secret pattern matches. <private>…</private> becomes [redacted], as the handover does.
+clip(){ local LC_ALL=C p="$1" t k c n o=""
+  # Left to right, one pass: each <private> to the NEXT </private> becomes [redacted]; an unclosed one hides the rest.
+  # (Cutting at the first <private> and the first </private> separately loops forever on "</private> … <private>x</private>".)
+  while case "$p" in *'<private>'*) true ;; *) false ;; esac; do
+    o="$o${p%%<private>*}[redacted]"; p="${p#*<private>}"
+    case "$p" in *'</private>'*) p="${p#*</private>}" ;; *) p="" ;; esac
+  done; p="$o$p"
+  if [ "${#p}" -gt 300 ]; then
+    p="${p:0:300}"
+    case "$p" in *\\u|*\\u?|*\\u??|*\\u???) p="${p%\\u*}" ;; esac
+    t="${p##*[!\\]}"; [ $(( ${#t} % 2 )) = 1 ] && p="${p%\\}"
+    # A UTF-8 character cut in half: walk back over continuation bytes to the lead byte, and drop the
+    # sequence only if it is shorter than its lead byte says (C locale: these compare as bytes).
+    k=0
+    while [ "$k" -lt 4 ] && [ "$k" -lt "${#p}" ]; do
+      c="${p: -$((k+1)):1}"
+      [[ "$c" < $'\x80' ]] && break
+      if [[ "$c" > $'\xbf' ]]; then
+        n=2; [[ "$c" > $'\xdf' ]] && n=3; [[ "$c" > $'\xef' ]] && n=4
+        [ $((k+1)) -lt "$n" ] && p="${p:0:$((${#p}-k-1))}"
+        break
+      fi
+      k=$((k+1))
+    done
+    p="$p ...(cut)"
+  fi
+  CLIP="$p"; }
+TP="$(field transcript_path)" || TP=""
+TP="${TP//\\\\//}"; TP="${TP//\\//}"
+SKILLS=""; PROMPTS=""
+if [ -n "$TP" ] && [ -f "$TP" ]; then
+  first=""; p1=""; p2=""; p3=""; sk=" "   # " a b ": a name moves to the end each time it is called again
+  while IFS= read -r l; do
+    case "$l" in
+      *'"name":"Skill","input":{"skill":"'*)
+        s="${l#*\"name\":\"Skill\",\"input\":\{\"skill\":\"}"; s="${s%%\"*}"
+        case "$s" in ''|*[!A-Za-z0-9:._-]*) continue ;; esac
+        sk="${sk// $s / }$s " ;;
+      *'"isMeta":true'*|*'"isSidechain":true'*|*'"isCompactSummary":true'*) ;;
+      *'"type":"user","message":{"role":"user","content":"'*)
+        v="${l#*\"type\":\"user\",\"message\":\{\"role\":\"user\",\"content\":\"}"
+        # Only the first ~300 bytes are kept, so a pasted megabyte is cut to 1200 first: bash's pattern removals
+        # on the whole string grow faster than its length (measured: 1 MB took 8 s, 2 MB passed the 30 s timeout).
+        # A prompt longer than that keeps no end marker and is cut where clip cuts it.
+        long=0; [ "${#v}" -gt 1200 ] && { v="${v:0:1200}"; long=1; }
+        # The string ends where the message object closes: before more record fields, or at the line's end.
+        case "$v" in *'"},"'*) v="${v%%\"\},\"*}"; long=0 ;; *'"}}'*) v="${v%\"\}\}*}"; long=0 ;; *) [ "$long" = 1 ] || continue ;; esac
+        case "$v" in ''|'<'*|'[Request interrupted'*) continue ;; esac
+        if [ "$long" = 0 ]; then t="${v##*[!\\]}"; [ $(( ${#t} % 2 )) = 1 ] && continue; fi   # the end was an escaped quote: not a whole prompt
+        [ -z "$first" ] && { first="$v"; continue; }
+        p1="$p2"; p2="$p3"; p3="$v" ;;
+    esac
+  # ONE awk picks the lines AND shortens them before bash sees them: bash's `read` takes a pipe one byte at a time,
+  # so a pasted 8 MB prompt cost 24 s on Git Bash (3 s per MB; PreCompact's timeout is 30 s) even though only the
+  # first 1200 bytes are kept. A Skill call becomes its own short piece; a prompt keeps 1400 bytes from where its
+  # record names it (more than the 1200 used, so an end marker in reach is kept), and the record flags that come
+  # after a long prompt are carried behind it, where the skip above still reads them.
+  done < <(LC_ALL=C awk '
+    { i = index($0, "\"name\":\"Skill\",\"input\":{\"skill\":\""); if (i) print substr($0, i, 300)
+      j = index($0, "\"type\":\"user\",\"message\":{\"role\":\"user\",\"content\":\"")
+      if (j && substr($0, j + 50, 1) != "<") {
+        f = ""
+        if (index($0, "\"isMeta\":true")) f = f " \"isMeta\":true"
+        if (index($0, "\"isSidechain\":true")) f = f " \"isSidechain\":true"
+        if (index($0, "\"isCompactSummary\":true")) f = f " \"isCompactSummary\":true"
+        print substr($0, j, 1400) f } }' "$TP" 2>/dev/null)
+  sk="${sk# }"; sk="${sk% }"; SKILLS="${sk// /, }"
+  # The four candidates go through the secret patterns in ONE grep; a line it names is dropped whole.
+  BL="$_here/secret-blocklist.txt"; keep=(); bad=" "; i=0
+  # Fails CLOSED: no pattern file, or a grep that errors (rc 2), keeps no prompt at all.
+  hits="$(printf '%s\n' "$first" "$p1" "$p2" "$p3" | LC_ALL=C grep -nE -f <(LC_ALL=C grep -vE '^#|^$' "$BL" 2>/dev/null) 2>/dev/null)"; rc=$?
+  if [ ! -s "$BL" ] || [ "$rc" -gt 1 ]; then bad=" 1 2 3 4 "
+  else while IFS=: read -r n _; do bad="$bad$n "; done <<< "$hits"; fi
+  for v in "$first" "$p1" "$p2" "$p3"; do
+    i=$((i+1))
+    [ -n "$v" ] || continue
+    case "$bad" in *" $i "*) continue ;; esac
+    clip "$v"; keep+=("$CLIP")
+  done
+  for v in "${keep[@]+"${keep[@]}"}"; do PROMPTS="${PROMPTS:+$PROMPTS\\n}- $v"; done
+fi
+[ "${#LINES[@]}" -gt 0 ] || [ -n "$SKILLS$PROMPTS" ] || exit 0
+
+SUM=""; for l in "${LINES[@]+"${LINES[@]}"}"; do SUM="${SUM:+$SUM; }$l"; done
+# Cut at the cap, and say so: a summary that just stops reads as complete.
+[ "${#SUM}" -gt 1800 ] && SUM="${SUM:0:1780} ...(truncated)"
 
 # ---- where it goes ----
 if [ -n "$GD" ] && [ -d "$GD" ]; then OUT="$GD/crewforth-session-snapshot.json"
 else mkdir -p .claude/state 2>/dev/null || exit 0; OUT=".claude/state/session-snapshot.json"; fi
 if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v NOW '%(%Y-%m-%dT%H:%M:%SZ)T' -1; else NOW="$(date -u +%Y-%m-%dT%H:%M:%SZ)"; fi
 ESC="$(printf '%s\n' "$SUM" | LC_ALL=C awk -f "$LIB/json-string.awk" 2>/dev/null)" || exit 0
-printf '{"session_id":"%s","trigger":"%s","at":"%s","summary":"%s"}\n' "$SID" "${TRIG//[!a-z]/}" "$NOW" "$ESC" > "$OUT.$$" 2>/dev/null && mv -f "$OUT.$$" "$OUT" 2>/dev/null
+printf '{"session_id":"%s","trigger":"%s","at":"%s","skills":"%s","prompts":"%s","summary":"%s"}\n' "$SID" "${TRIG//[!a-z]/}" "$NOW" "$SKILLS" "$PROMPTS" "$ESC" > "$OUT.$$" 2>/dev/null && mv -f "$OUT.$$" "$OUT" 2>/dev/null
 rm -f "$OUT.$$" 2>/dev/null
 exit 0

package/kit/hooks/prompt-approval.sh

@@ -69,6 +69,7 @@ _CREW_LOCALE="${LC_ALL:-${LC_CTYPE:-${LANG:-}}}"
 case "$_CREW_LOCALE" in C|POSIX) _CREW_LOCALE="" ;; esac
 export LC_ALL=C
 # ---- /CREW-LOCALE
+ASK_TREE=""; ASK_HEAD=""; ASK_BRANCH=""   # what an approval was asked for (the question, or a refused command); _pa_record compares
 # guard-schedule.sh SOURCES this file for one thing, _crew_appr_op: which text is an approval is decided here and
 # nowhere else. Sourced, the file defines its functions and returns before anything is read or written.
 _PA_LIB=0; [ "${BASH_SOURCE[0]}" != "$0" ] && _PA_LIB=1
@@ -605,11 +606,25 @@ _crew_q_pre(){  # the PreToolUse decision: `ask`, or a refusal (exit 2) that say
                          qno "in $PM, with a PermissionRequest hook that may be wired ($_PRH), only the typed approval counts." ;;
     *) qno "in ${PM:-an unknown mode} this approval is not open (bypassPermissions and plan fail closed)." ;;
   esac
-  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) qno "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) qno "this session has nobody in front of it (it was started with -p, by a program, or in the background with claude --bg or the agent view, which Claude Code counts as unattended even when you type into it; approve in a regular session, or commit in your own terminal)." ;; esac
   case "$SID$_QTU" in *[!A-Za-z0-9._-]*) qno "the call carries no session or tool id this hook can bind the answer to." ;; esac
   { [ -n "$SID" ] && [ -n "$_QTU" ]; } || qno "the call carries no session or tool id this hook can bind the answer to."
   _crew_prh_scan && qno "a PermissionRequest hook may be wired ($_PRH). Such a hook can answer the question before the user does, and the answer cannot be told from a click."
-  mkdir -p "$_QAD" 2>/dev/null && { printf 'sid=%s\ntool=%s\nts=%s\n' "$SID" "$_QTU" "$_QNOW" > "$ASKED"; } 2>/dev/null \
+  # WHAT THE QUESTION IS ABOUT, written down when it is asked: the tree the index writes and HEAD. The answer is
+  # recorded only if both are still the same, however long the user took (a question asked at night is answered in
+  # the morning); a change in between is a different thing from what the user was shown, so it is asked again.
+  local _qh _qt _qe _qb
+  _qh="$(git -C "$CWD" rev-parse --verify --quiet HEAD 2>/dev/null || echo NONE)"
+  _qb="$(git -C "$CWD" symbolic-ref --short -q HEAD 2>/dev/null)" || _qb=""; [ -n "$_qb" ] || _qb=-
+  case "$_qb" in *[!A-Za-z0-9._/+@-]*) qno "the branch name could not be written down." ;; esac
+  case "$_qh" in NONE) ;; *[!0-9a-f]*|'') qno "git could not name HEAD here." ;; esac
+  _qt="$(git -C "$CWD" -c core.fsmonitor= write-tree 2>/dev/null)"
+  case "$_qt" in *[!0-9a-f]*|'') qno "git could not write the tree of what is staged (an unresolved merge?)." ;; esac
+  if [ "$_qh" = NONE ]; then _qe=4b825dc642cb6eb9a060e54bf8d69288fbee4904; else _qe="$(git -C "$CWD" rev-parse --verify --quiet 'HEAD^{tree}' 2>/dev/null)"; fi
+  # NOTHING STAGED: every commit answer would be refused after the user gave it (field: 35 times in three projects,
+  # most of them "Commit + push" for a commit already made). So the question is not asked; a push alone is typed.
+  [ "$_qt" = "$_qe" ] && qno "nothing is staged, so there is no commit to approve. If the commit is already made and only the push is wanted, ask with no question: the user can type /crew-approve push as their whole message; to commit, stage the change with git add, show the commit message, then ask again." nohint
+  mkdir -p "$_QAD" 2>/dev/null && { printf 'sid=%s\ntool=%s\nts=%s\ntree=%s\nhead=%s\nbranch=%s\n' "$SID" "$_QTU" "$_QNOW" "$_qt" "$_qh" "$_qb" > "$ASKED"; } 2>/dev/null \
     || qno "the state folder could not be written, so the answer could not be bound to this question."
   printf '{"hookSpecificOutput":{"hookEventName":"PreToolUse","permissionDecision":"ask","permissionDecisionReason":"%s"}}\n' \
     "Crewforth §4.4: only the person in front of this session answers the approval question."
@@ -653,7 +668,7 @@ _pa_record(){
   # HONEST SCOPE: a session started with an emptied environment and driven through a pseudo-terminal for a second
   # message passes both. guard-bash.sh refuses the forms of that it can read; a program that types is past it.
   case "${CLAUDE_CODE_SESSION_ATTENDED-}" in
-    0) no "this session has nobody in front of it (it was started with -p, or by a program), and an approval is what a person types into their own session." ;;
+    0) no "this session has nobody in front of it (it was started with -p, by a program, or in the background with claude --bg or the agent view, which Claude Code counts as unattended even when you type into it; approve in a regular session, or commit in your own terminal), and an approval is what a person types into their own session." ;;
   esac
   _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
   { [ -n "$TP" ] && [ -s "$TP" ]; } || no "this is the first message of this session, or the session keeps no transcript (one started from inside another session keeps none). An approval answers a commit message the session has shown: have it shown, then approve."
@@ -665,19 +680,26 @@ _pa_record(){
 
   HEAD_NOW="$(git -C "$CWD" rev-parse --verify --quiet HEAD 2>/dev/null || echo NONE)"
   case "$HEAD_NOW" in NONE) ;; *[!0-9a-f]*|'') no "git could not name HEAD here." ;; esac
+  [ -n "$ASK_HEAD" ] && [ "$HEAD_NOW" != "$ASK_HEAD" ] && no "HEAD moved after the approval was asked for, so the answer is not about this branch as it is now. Ask again."
+  if [ -n "$ASK_BRANCH" ]; then
+    _cb="$(git -C "$CWD" symbolic-ref --short -q HEAD 2>/dev/null)" || _cb=""; [ -n "$_cb" ] || _cb=-
+    [ "$_cb" = "$ASK_BRANCH" ] || no "the branch changed after the approval was asked for ($ASK_BRANCH, now $_cb). Ask again."
+  fi
   TREE=""; BR=""; RM=""; URL=""
   case "$OP" in commit*)
     # THE TREE THE INDEX WRITES, not the text of the staged diff: what `git diff` prints is configurable
     # (`diff.external`, a textconv filter), and with it two different staged changes can print the same text.
-    TREE="$(git -C "$CWD" write-tree 2>/dev/null)"
+    TREE="$(git -C "$CWD" -c core.fsmonitor= write-tree 2>/dev/null)"
     case "$TREE" in *[!0-9a-f]*|'') no "git could not write the tree of what is staged (an unresolved merge?)." ;; esac
     if [ "$HEAD_NOW" = NONE ]; then _ht=4b825dc642cb6eb9a060e54bf8d69288fbee4904      # the empty tree
     else _ht="$(git -C "$CWD" rev-parse --verify --quiet 'HEAD^{tree}' 2>/dev/null)"; fi
     # A commit+push with nothing staged is most often a push alone, answered with the option people pick first (field
     # report, 3.2.1: twice in a row). It is not turned into a push approval, which the user did not give; the line
     # names the one they can.
+    # What was asked about, or refused, is what is approved: the staged tree written down then is the one now.
+    [ -n "$ASK_TREE" ] && [ "$TREE" != "$ASK_TREE" ] && no "what is staged changed after the approval was asked for, so the answer is not about what is staged now. Show the commit message again and ask again."
     if [ "$TREE" = "$_ht" ]; then
-      [ "$OP" = commit+push ] && no "nothing is staged, so there is no commit to approve. For a push of the branch as it is, the answer is Push only (or the user can type /crew-approve push); for a commit, stage it with git add, show the commit message, then ask again."
+      [ "$OP" = commit+push ] && no "nothing is staged, so there is no commit to approve. For a push of the branch as it is, the user can type /crew-approve push; for a commit, stage it with git add, show the commit message, then ask again."
       no "nothing is staged, so there is nothing to approve. Stage the change with git add, show the commit message, then ask again."
     fi ;;
   esac
@@ -735,20 +757,24 @@ _pa_record(){
 # ---- THE APPROVAL QUESTION (PreToolUse and PostToolUse of AskUserQuestion) -----------------------------------
 # Only the fixed question is this hook's business: any other question gets no decision from it, here or later.
 _pa_question(){
-  local _as="" _at="" _au="" _al _an
+  local _as="" _at="" _au="" _al _an _aq="" _ah="" _ab=""
   _crew_q_ctx
   # PostToolUse: the user has answered. Recorded only if THIS call was asked by the half above.
   SRC="answer to the approval question"; SRC_BY="by answering the approval question"; OP="a commit or a push"
   [ -n "$SID" ] && [ -n "$_QTU" ] || no "the answer carries no session or tool id."
   if [ -f "$ASKED" ]; then
     while IFS= read -r _al || [ -n "$_al" ]; do
-      case "$_al" in sid=*) _as="${_al#sid=}" ;; tool=*) _au="${_al#tool=}" ;; ts=*) _at="${_al#ts=}" ;; esac
+      case "$_al" in sid=*) _as="${_al#sid=}" ;; tool=*) _au="${_al#tool=}" ;; ts=*) _at="${_al#ts=}" ;; tree=*) _aq="${_al#tree=}" ;; head=*) _ah="${_al#head=}" ;; branch=*) _ab="${_al#branch=}" ;; esac
     done < "$ASKED"
   fi
   { [ "$_as" = "$SID" ] && [ "$_au" = "$_QTU" ]; } || no "Crewforth did not ask this question (guard-question.sh, its PreToolUse half, is not wired or did not pass it), so the answer cannot be shown to have come from the user."
   : > "$ASKED" 2>/dev/null                                 # one question, one answer
   case "$_at$_QNOW" in *[!0-9]*|'') no "the time of the question could not be read." ;; esac
-  [ $((_QNOW - _at)) -ge 0 ] && [ $((_QNOW - _at)) -le 1800 ] || no "the question was asked more than 30 minutes ago."
+  [ $((_QNOW - _at)) -ge 0 ] || no "the time of the question is in the future."
+  # A question written down with its tree and HEAD holds until the answer, however long that takes: _pa_record
+  # compares them. One written before that (no tree, no head) keeps the old 30 minutes.
+  if [ -n "$_aq" ] && [ -n "$_ah" ] && [ -n "$_ab" ]; then ASK_TREE="$_aq"; ASK_HEAD="$_ah"; ASK_BRANCH="$_ab"
+  else [ $((_QNOW - _at)) -le 1800 ] || no "the question was asked more than 30 minutes ago."; fi
   _crew_q_is "$INPUT" || no "the question answered is not the fixed one."
   [ "$PM" = auto ] || no "the approval question is recorded in auto only, and this session is in ${PM:-an unknown mode}."
   _crew_prh_scan && no "a PermissionRequest hook may be wired ($_PRH), and it can answer the question before you do. The approval that still works is typed: the user can type /crew-approve instead."
@@ -761,7 +787,7 @@ _pa_question(){
     no) [ -n "$REC" ] && { : > "$REC"; } 2>/dev/null
         say "Crewforth: not approved - you answered No." "The user answered No to the approval question. Do not commit or push; ask what they want changed." ;;
   esac
-  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) no "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) no "this session has nobody in front of it (it was started with -p, by a program, or in the background with claude --bg or the agent view, which Claude Code counts as unattended even when you type into it; approve in a regular session, or commit in your own terminal)." ;; esac
   _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
   { [ -n "$TP" ] && [ -s "$TP" ]; } || no "the session keeps no transcript on disk (one started from inside another session keeps none)."
   BARE=0
@@ -858,7 +884,7 @@ _crew_appr_op "$_JU"
 # that class from here, so the old failures do not raise it straight back.
 if [ "$OP" = loosen ]; then
   nol(){ say "Crewforth: floor NOT lowered - $1" "The user sent the command only the user can type /crew-loosen, for $LO_AGENT $LO_CHANGE $LO_RISK, and Crewforth did not lower anything: $1 Tell the user exactly that."; }
-  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) nol "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) nol "this session has nobody in front of it (it was started with -p, by a program, or in the background with claude --bg or the agent view, which Claude Code counts as unattended even when you type into it; approve in a regular session, or commit in your own terminal)." ;; esac
   _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
   { [ -n "$TP" ] && [ -s "$TP" ]; } || nol "this is the first message of this session, or the session keeps no transcript."
   _lh="${BASH_SOURCE%/*}"; [ "$_lh" = "${BASH_SOURCE}" ] && _lh=.
@@ -902,7 +928,7 @@ fi
 # + % - and spaces, so it can neither chain another (the gate would refuse a chain anyway) nor need escaping here.
 if [ "$OP" = allowverify ]; then
   noa(){ say "Crewforth: verify command NOT allowed - $1" "The user sent the command only the user can type /crew-allow-verify, and Crewforth added no rule: $1 Tell the user exactly that."; }
-  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) noa "this session has nobody in front of it (it was started with -p, or by a program)." ;; esac
+  case "${CLAUDE_CODE_SESSION_ATTENDED-}" in 0) noa "this session has nobody in front of it (it was started with -p, by a program, or in the background with claude --bg or the agent view, which Claude Code counts as unattended even when you type into it; approve in a regular session, or commit in your own terminal)." ;; esac
   _json_slice "$INPUT" transcript_path >/dev/null; _json_unescape "$_JS" >/dev/null; TP="${_JU//\\//}"
   { [ -n "$TP" ] && [ -s "$TP" ]; } || noa "this is the first message of this session, or the session keeps no transcript."
   _lh="${BASH_SOURCE%/*}"; [ "$_lh" = "${BASH_SOURCE}" ] && _lh=.
@@ -942,7 +968,8 @@ fi
 # ---- `/crew-approve` with nothing after it: what this session was last refused ---------------------------------
 # guard-bash.sh, when it refuses a commit or a push in auto / dontAsk, writes down what it refused
 # (.claude/state/crew-approval-pending: the session, commit | push | commit+push, the second). The bare command
-# approves THAT and nothing else: the same session's, not older than 30 minutes. What is approved is therefore
+# approves THAT and nothing else: the same session's, with HEAD, the branch and (for a commit) the staged tree still
+# as they were when it was refused — or, for a record that does not carry them, not older than 30 minutes. What is approved is therefore
 # never read from the message and never from the model: the gate wrote it, from the command it refused. From here
 # on the flow is the one a spelled-out approval takes, with every proof it asks for (the mode, a session that is
 # attended, a transcript on disk) and the same record at the end.
@@ -956,7 +983,7 @@ if [ "$OP" = pending ]; then
   _bs=""; _bo=""; _bt=""
   if [ -f "$_bp" ]; then
     while IFS= read -r _bl || [ -n "$_bl" ]; do
-      case "$_bl" in sid=*) _bs="${_bl#sid=}" ;; op=*) _bo="${_bl#op=}" ;; ts=*) _bt="${_bl#ts=}" ;; esac
+      case "$_bl" in sid=*) _bs="${_bl#sid=}" ;; op=*) _bo="${_bl#op=}" ;; ts=*) _bt="${_bl#ts=}" ;; tree=*) ASK_TREE="${_bl#tree=}" ;; head=*) ASK_HEAD="${_bl#head=}" ;; branch=*) ASK_BRANCH="${_bl#branch=}" ;; esac
     done < "$_bp"
   fi
   if [ "${BASH_VERSINFO[0]}" -ge 5 ] || { [ "${BASH_VERSINFO[0]}" -eq 4 ] && [ "${BASH_VERSINFO[1]}" -ge 2 ]; }; then printf -v _bn '%(%s)T' -1; else _bn="$(date +%s)"; fi
@@ -964,7 +991,16 @@ if [ "$OP" = pending ]; then
   case "$_bo" in commit|push|commit+push) ;; *) no "nothing is waiting for approval in this session: no commit or push was refused. Have the commit message shown and the commit tried first; or name it: the user can type /crew-approve commit, push or commit+push." ;; esac
   { [ -n "$_bsid" ] && [ "$_bs" = "$_bsid" ]; } || no "what is waiting for approval was refused in another session, not this one. Nothing is approved; have it tried here first."
   case "$_bt$_bn" in *[!0-9]*|'') no "the time of what is waiting could not be read." ;; esac
-  [ $((_bn - _bt)) -ge 0 ] && [ $((_bn - _bt)) -le 1800 ] || no "what was waiting for approval ($_bo) is more than 30 minutes old. Nothing is approved; have it tried again first."
+  [ $((_bn - _bt)) -ge 0 ] || no "the time of what is waiting is in the future."
+  # Written down with HEAD and the branch (and, for a commit, the staged tree) when it was refused: it holds until the
+  # user approves, however long that takes, as long as those are unchanged (_pa_record compares them). A record
+  # without them — an older one, or a commit whose tree could not be written — keeps 30 minutes, and compares nothing.
+  case "$_bo" in commit*) [ -n "$ASK_TREE" ] || ASK_HEAD="" ;; esac
+  [ -n "$ASK_BRANCH" ] || ASK_HEAD=""
+  [ -n "$ASK_HEAD" ] || { ASK_TREE=""; ASK_BRANCH=""; }
+  if [ -z "$ASK_HEAD" ]; then
+    [ $((_bn - _bt)) -le 1800 ] || no "what was waiting for approval ($_bo) is more than 30 minutes old. Nothing is approved; have it tried again first."
+  fi
   OP="$_bo"                                                 # used up further down, once the approval is on record
 fi
 

package/kit/hooks/route-hint.sh

@@ -36,11 +36,12 @@
 # nothing works" report from Windows users, and it is not a Claude Code bug: Crewforth was spending the budget.
 #
 # Everything below is therefore one awk invocation over the component files, with the normalisation and the
-# matching done inside awk. Total external processes: FIVE — cat, sed, sed, head, awk. (The count said four
-# until it was traced with `bash -x` on Windows; the `cat` on the next line reads stdin and had been read
-# past.) Measured end to end here: 5 spawns, ~328 ms per prompt idle. eval/smoke-test.sh §7y pins the shape.
+# matching done inside awk. Total external processes: FOUR — sed, sed, head, awk; stdin is read with the `read`
+# builtin (it was a `cat`, the fifth). eval/smoke-test.sh §7y pins the shape. With no awk or sed on PATH there is
+# nothing to match with, so the hook says nothing and exits 0 rather than printing "command not found" into a session.
 set -uo pipefail
-IN="$(cat)"
+command -v awk >/dev/null 2>&1 && command -v sed >/dev/null 2>&1 && command -v head >/dev/null 2>&1 || exit 0
+IN=""; IFS= read -r -d '' IN || true
 case "$IN" in *'"hook_event_name"'*UserPromptSubmit*) ;; *) exit 0 ;; esac
 
 # Two editions, two layouts: a full install puts the components under .claude/, the plugin ships them beside the
@@ -150,7 +151,26 @@ function readonly(   w, n, f, l) {
       w[l] !~ /^(oku|okur|okuyun|okuyabilir|anlat|anlatir|anlatin|acikla|aciklar|aciklayin|ozetle|ozetler|ozetleyin)$/) return 0
   return !hasw("and|then|ve|sonra|(fix|add|updat|writ|wrote|chang|implement|creat|remov|delet|refactor|build|buil|mak|renam|edit|migrat|mov|deploy|ship|instal|upgrad|review|audit|check|test|debug|investigat|optimi[sz]|improv|translat|draft|generat|setup|set|harden|resolv|run|merg|publish|configur|propos|analy[sz])[a-z]?[a-z]?[a-z]?[a-z]?|why|bug|bugs|crash[a-z]*|fail[a-z]*|error[a-z]*|broken|duzelt[a-z]*|ekle[a-z]*|guncelle[a-z]*|yaz[a-z]*|degistir[a-z]*|olustur[a-z]*|sil[a-z]*|kaldir[a-z]*|yap[a-z]*|kur[a-z]*|tasi[a-z]*|incele[a-z]*|denetle[a-z]*|cevir[a-z]*|duzenle[a-z]*|iyilestir[a-z]*|yayinla[a-z]*|cikar[a-z]*|hizlandir[a-z]*|uygula[a-z]*|coz[a-z]*|gelistir[a-z]*|sadelestir[a-z]*|analiz[a-z]*|neden|hata[a-z]*|cokuyor|bozuk[a-z]*")
 }
-BEGIN { np = " " norm(ENVIRON["CREW_PROMPT"]) " "; bestA=0; bestS=0; nameA=""; nameS=""; if (readonly()) exit }
+# What the user QUOTES or turns DOWN is not the request. A pasted error, a command in backticks or a quoted label can
+# carry a trigger word ("the log says `run a security audit` failed"), and "do not review this, just push" names
+# the reviewer it declines. So before scoring: fenced blocks, backtick spans and double-quoted spans (escaped in the
+# payload as \") become a space, and a clause that opens with a negator (do not, dont, never, not, without, no need
+# to; not "do not forget/skip/miss/ignore", which asks for the thing) or closes with a Turkish one (degil, yapma,
+# etme, gerek yok) is dropped. Clauses end at . , ; ! ? or a newline. Still one awk, no process.
+function asked(raw,   n, c, i, out, x) {
+  gsub(/```[^`]*```/, " ", raw); gsub(/`[^`]*`/, " ", raw); gsub(/\\"[^"]*\\"/, " ", raw)
+  n = split(raw, c, /[.,;!?]|\\n/); out = ""
+  for (i = 1; i <= n; i++) {
+    x = norm(c[i]); if (x == "") continue
+    if (x ~ /^(don t|dont|do not|never|not|without|no need to)( |$)/ && x !~ /^(don t|dont|do not|never) (forget|skip|miss|ignore)( |$)/) continue
+    if (x ~ /(^| )(degil|yapma|etme|gerek yok)$/) continue
+    out = out " " x
+  }
+  return out
+}
+BEGIN { np = asked(ENVIRON["CREW_PROMPT"]) " "; bestA=0; bestS=0; bestX=0; nameA=""; nameS=""; nameX=""
+  ALSO["dependency-audit"] = 1
+  if (readonly()) exit }
 seen[FILENAME] { next }                                    # one Trigger-phrases line per component, the first
 {
   if (tolower($0) !~ /trigger phrases:/) next
@@ -187,18 +207,25 @@ seen[FILENAME] { next }                                    # one Trigger-phrases
   # keeps its own best and the preference is applied at the END, among candidates that clear the floor.
   if (kind == "agent") { if (score > bestA) { bestA=score; nameA=name } }
   else                 { if (score > bestS) { bestS=score; nameS=name } }
+  # A RIDE-ALONG skill is named BESIDE the agent instead of losing to it. Its trigger is an event inside the work
+  # of another domain: "add axios to the web app" is a request for crew-frontend-expert, and adding the package
+  # is what dependency-audit judges. Under agent-outranks-skill it was never named (one project measured 21
+  # lockfile commits against 0 audits), so it gets its own slot, scored the same way, and no process.
+  # NO APOSTROPHE anywhere in this program: it sits inside a single-quoted shell string, and one closes it.
+  if (kind == "skill" && name in ALSO && score >= 6 && score > bestX) { bestX=score; nameX=name }
 }
 # Silence is the default. No match, or a match too weak to be sure, means the main thread decides as before.
 # The agent is preferred only when it is credible on its own: a weak agent match no longer buries a strong skill.
 END {
-  if      (bestA >= 6) print "agent\t" nameA
-  else if (bestS >= 6) print "skill\t" nameS
+  if      (bestA >= 6) print "agent\t" nameA "\t" nameX
+  else if (bestS >= 6) print "skill\t" nameS "\t"
 }
 ' "${FILES[@]}" 2>/dev/null)"
 
 [ -n "$RES" ] || exit 0
 BESTKIND="${RES%%	*}"; BEST="${RES#*	}"
 [ -n "$BEST" ] && [ "$BEST" != "$RES" ] || exit 0
+ALSO="${BEST#*	}"; [ "$ALSO" = "$BEST" ] && ALSO=""; BEST="${BEST%%	*}"
 
 # The wording is an INSTRUCTION, not a suggestion, and that distinction is the whole experiment. The first
 # version hedged — "unless it is a one-line edit", "if it is genuinely not that agent's work, say so" — which
@@ -210,5 +237,7 @@ if [ "$BESTKIND" = skill ]; then
   MSG="Use the \`$BEST\` skill for this task."
 else
   MSG="Use the $BEST subagent for this task."
+  # Not "Use the …": that sentence names THE owner, and every reader of this hook's answer parses it as such.
+  [ -n "$ALSO" ] && MSG="$MSG Also apply the \`$ALSO\` skill: the commit gate (§4.7) asks for its record."
 fi
 printf '{"hookSpecificOutput":{"hookEventName":"UserPromptSubmit","additionalContext":"%s"}}\n' "$MSG"

package/kit/hooks/secret-blocklist.txt

@@ -17,6 +17,9 @@
 -----BEGIN ([A-Z]+ )?PRIVATE KEY-----
 #test: -----BEGIN RSA PRIVATE KEY-----
 #test: -----BEGIN PRIVATE KEY-----
+#test: -----BEGIN ENCRYPTED PRIVATE KEY-----
+-----BEGIN PGP PRIVATE KEY BLOCK-----
+#test: -----BEGIN PGP PRIVATE KEY BLOCK-----
 
 # AWS access key id
 (AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|A3T)[A-Z0-9]{16}
@@ -35,11 +38,20 @@ AIza[A-Za-z0-9_-]{35}
 # Slack token
 xox[baprs]-[A-Za-z0-9-]{10,}
 #test: SLACK_TOKEN=xoxb-{{A12}}
+# Slack refresh token and app-level token (the class above stops at xox[baprs])
+xoxe(\.xox[bp])?-[A-Za-z0-9-]{20,}
+#test: SLACK_REFRESH=xoxe-1-{{A40}}
+xapp-[0-9]-[A-Za-z0-9-]{20,}
+#test: SLACK_APP_TOKEN=xapp-1-{{A24}}
 
 # Stripe live secret / restricted key
 (sk|rk)_live_[A-Za-z0-9]{20,}
 #test: STRIPE=sk_live_{{A24}}
 
+# Stripe webhook signing secret
+whsec_[A-Za-z0-9]{24,}
+#test: STRIPE_WEBHOOK_SECRET=whsec_{{A32}}
+
 # OpenAI / Anthropic API keys
 sk-(ant-|proj-)?[A-Za-z0-9_-]{24,}
 #test: API_KEY=sk-ant-{{A24}}
@@ -48,6 +60,42 @@ sk-(ant-|proj-)?[A-Za-z0-9_-]{24,}
 npm_[A-Za-z0-9]{36}
 #test: //registry.npmjs.org/:_authToken=npm_{{A36}}
 
+# GitLab personal, deploy and runner tokens
+gl(pat|dt|rt)-[A-Za-z0-9_-]{20,}
+#test: GITLAB_TOKEN=glpat-{{A20}}
+#test: CI_RUNNER=glrt-{{A24}}
+
+# Hugging Face access token
+hf_[A-Za-z0-9]{30,}
+#test: HF_TOKEN=hf_{{A34}}
+
+# Docker Hub personal access token
+dckr_pat_[A-Za-z0-9_-]{27,}
+#test: DOCKER_PAT=dckr_pat_{{A27}}
+
+# DigitalOcean personal, OAuth and refresh tokens (hex; upper case accepted so the sample can be written)
+do[por]_v1_[A-Fa-f0-9]{64}
+#test: DO_TOKEN=dop_v1_{{A64}}
+
+# Shopify access, custom-app, private-app tokens and shared secret
+shp(at|ca|pa|ss)_[A-Fa-f0-9]{32}
+#test: SHOPIFY=shpat_{{A32}}
+
+# PyPI upload token (the macaroon always starts the same way)
+pypi-AgE[A-Za-z0-9_-]{50,}
+#test: password = pypi-AgE{{A60}}
+
+# AWS secret access key, recognised by the key that names it: the value alone is 40 characters of base64 with no prefix
+(aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)[[:space:]"']*[:=][[:space:]"']*[A-Za-z0-9/+]{40}
+#test: aws_secret_access_key = {{A40}}
+#test: "SecretAccessKey": "{{A40}}"
+
+# A password inside a URL: scheme://user:password@host. A placeholder ($VAR, ${VAR}, <pass>, {{x}}) starts with a
+# character the first class excludes, so the ordinary way of writing one about stays committable.
+[A-Za-z][A-Za-z0-9+.-]*://[^/[:space:]:@]+:[A-Za-z0-9!#%&*+,.;=?^_|~-][^/[:space:]:@<{}]{5,}@
+#test: DATABASE_URL=postgres://app:{{A12}}@db.internal:5432/app
+#test: https://deploy:{{A20}}@git.example.com/repo.git
+
 # SendGrid API key
 SG\.[A-Za-z0-9_-]{16,32}\.[A-Za-z0-9_-]{16,}
 #test: SENDGRID_API_KEY=SG.{{A16}}.{{A20}}
@@ -56,7 +104,7 @@ SG\.[A-Za-z0-9_-]{16,32}\.[A-Za-z0-9_-]{16,}
 eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{10,}
 #test: Authorization: Bearer eyJAAAAAAAAAA.eyJAAAAAA.AAAAAAAAAA
 
-# A credential carried in a URL query. THE CLASS EVERY PATTERN ABOVE STRUCTURALLY CANNOT SEE: all eleven
+# A credential carried in a URL query. THE CLASS EVERY PATTERN ABOVE STRUCTURALLY CANNOT SEE: all the others
 # recognise a credential by its own SHAPE -- AKIA, ghp_, AIza, xox, sk_live_, sk-ant-, npm_, SG., a JWT, a PEM
 # header -- and a token with no issuer prefix has no shape to recognise. Measured on a published install with
 # the real hook: `http://127.0.0.1:7911/?token=<uuid>`, a bare uuid, and `token=` plus 32 hex all committed
@@ -80,3 +128,9 @@ eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{10,}
 #test-clean: const apiKey = process.env.STRIPE_SECRET_KEY
 #test-clean: # set GITHUB_TOKEN in the CI environment, never in the repo
 #test-clean: private key handling is documented in docs/security.md
+#test-clean: DATABASE_URL=postgres://app:${DB_PASSWORD}@db:5432/app
+#test-clean: REDIS_URL=redis://default:$REDIS_PASSWORD@cache:6379
+#test-clean: clone it with git@gitlab.com:group/project.git or https://user@example.com/repo
+#test-clean: from huggingface_hub import hf_hub_download
+#test-clean: AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+#test-clean: the dev server listens on http://localhost:3000/api

package/kit/hooks/session-guard.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Stop hook — when session fill crosses a threshold it GUARANTEES the handoff recommendation reaches the USER.
+# Stop hook — when session fill crosses a threshold it prints the handoff recommendation to the USER (systemMessage).
 # Session management = a gate at the threshold, not a wish. But the gate must not nag or burn tokens:
 #   - It surfaces the recommendation as a neutral `systemMessage` (user-facing warning), NOT a hook error.
 #     (Claude Code renders a BLOCKING Stop hook — exit 2 — as "Stop hook error: ...". We deliberately never block.)
@@ -9,15 +9,17 @@
 #   - It NEVER blocks the stop: every path exits 0. A measurement failure fails open, silently.
 # context-usage.sh does the measurement. No automatic /clear — approval is the user's (§4.4).
 # The model is nudged separately every turn by context-usage.sh (UserPromptSubmit); this hook is the
-# guaranteed USER-facing alert. A new session (or /clear) mints a new session_id and re-arms both thresholds.
+# USER-facing alert, and it is silent when the measurement fails. A new session (or /clear) mints a new session_id and re-arms both thresholds.
 set -uo pipefail
 HERE="$(cd "$(dirname "$0")" && pwd)"
-IN="$(cat 2>/dev/null || true)"
+# Bounded: a pipe Claude Code keeps open (a Windows pipe can close late) must not hold the stop for the hook's whole
+# timeout. A builtin read with a deadline: the payload is one line with no newline, so it ends at EOF, normally at
+# once. Nothing in time means nothing to measure, and this hook then stays silent, as on any other failure.
+IN=""; IFS= read -r -d '' -t "${CREW_STDIN_TIMEOUT:-2}" IN 2>/dev/null; [ "$?" -gt 128 ] && exit 0
 
-# Loop guard: if this Stop is already a Stop-hook continuation, do nothing (defensive; we never block anyway).
-case "$IN" in
-  *'"stop_hook_active":true'*|*'"stop_hook_active": true'*) exit 0 ;;
-esac
+# No `stop_hook_active` guard. The flag says SOME Stop hook blocked this turn — another plugin's, typically, since
+# this one never does — and honouring it silenced the fill warning on exactly those turns. The loop it guards
+# against cannot happen here: nothing below blocks, and each warning is deduplicated per session and tier.
 
 # Per-session dedup key: session_id from the Stop stdin JSON (documented field), else the transcript
 # filename. Sanitized to a safe filename fragment. Without any key we fall back to a shared marker
@@ -71,14 +73,41 @@ if [ -n "$TP" ] && [ -f "$TP" ]; then
 fi
 marker(){ printf '%s/crew-session-guard.%s.c%s.%s' "${TMPDIR:-/tmp}" "$KEY" "$COMP" "$1"; }
 
+# What the last compaction kept, from its own record: `compactMetadata` carries `preTokens` and `postTokens`
+# (measured on this machine's transcripts: 71 of 98 boundary records carry both; the other 27 carry no metadata at
+# all, and then the line says nothing). Read only on the rare path that speaks about a compaction, so its two
+# processes are not paid on an ordinary Stop. Sets CNUM ("345k → 20k tokens") and CTRIG (auto / manual).
+CNUM=""; CTRIG=""; CINFO=""
+compnums(){
+  local cb pre post
+  cb="$(grep '"compact_boundary"' "$TP" 2>/dev/null | tail -n 1)"
+  case "$cb" in *'"trigger":"manual"'*|*'"trigger": "manual"'*) CTRIG=manual ;; *'"trigger"'*) CTRIG=auto ;; esac
+  pre="${cb#*\"preTokens\":}"; [ "$pre" != "$cb" ] || return 0; pre="${pre# }"; pre="${pre%%[!0-9]*}"
+  post="${cb#*\"postTokens\":}"; [ "$post" != "$cb" ] || return 0; post="${post# }"; post="${post%%[!0-9]*}"
+  case "$pre$post" in ''|*[!0-9]*) return 0 ;; esac
+  [ -n "$pre" ] && [ -n "$post" ] || return 0
+  CNUM="$(( (pre + 500) / 1000 ))k → $(( (post + 500) / 1000 ))k tokens"
+}
+
 # An AUTO compaction is not a milestone, it is a loss: state nobody chose to drop is already gone, and the fill
 # reading right after it is reassuringly low precisely because the context was thrown away. Announce it once per
 # generation, independently of the fill tier — waiting for 75% would report the loss long after it happened.
-if [ "${AUTOC:-0}" -gt 0 ] && [ ! -e "$(marker autocompact)" ]; then
-  : > "$(marker autocompact)" 2>/dev/null || true
-  printf '{"systemMessage":"⚠️ Auto-compaction has fired %s time(s) this session — context was dropped that nobody chose to drop. Check that docs/SESSION_STATE.md still matches reality, and hand off at the next phase boundary instead of riding the fill up to another one."}\n' "$AUTOC"
-  exit 0
+# The generation is judged by ITS OWN record, the last boundary: a manual /compact after an earlier auto one opens a
+# generation of its own, and must not re-announce the old loss with the new compaction's numbers.
+# A MANUAL compaction is a choice, so it gets no warning — only what it kept, once per generation, so the user can
+# see what the next stretch of the session starts from. Silent when the record carries no numbers.
+if [ "${COMP:-0}" -gt 0 ] && [ ! -e "$(marker compacted)" ]; then
+  : > "$(marker compacted)" 2>/dev/null || true
+  compnums
+  if [ "$CTRIG" = auto ]; then
+    printf '{"systemMessage":"⚠️ Auto-compaction has fired %s time(s) this session%s — context was dropped that nobody chose to drop. Check that docs/SESSION_STATE.md still matches reality, and hand off at the next phase boundary instead of riding the fill up to another one."}\n' "$AUTOC" "${CNUM:+ (the last one: $CNUM)}"
+    exit 0
+  fi
+  [ "$CTRIG" = manual ] && [ -n "$CNUM" ] && CINFO="Compaction $COMP (manual): $CNUM."
 fi
+# Every exit after this point goes through bye, so the compaction line is never lost to a turn that has no fill
+# reading, and never preempts a fill warning on the same turn: the two share one systemMessage.
+bye(){ [ -n "$CINFO" ] && printf '{"systemMessage":"%s"}\n' "$CINFO"; exit 0; }
 
 # Real context%, from context-usage.sh's measurement. Fail-open on any error.
 #
@@ -104,7 +133,7 @@ if [ -z "$PCT" ]; then
   # --verbose here: this line reaches the USER at most twice per session, so the raw token counts are free.
   LINE="$(printf '%s' "$IN" | bash "$HERE/context-usage.sh" --verbose 2>/dev/null || true)"
   LINE="${LINE%%$'\n'*}"                     # first line, without paying `head` a process for it
-  [ -n "$LINE" ] || exit 0
+  [ -n "$LINE" ] || bye
   # Pull the percentage back out of the "🔋 Session: %77.2 (...)" line. context-usage.sh pins LC_ALL=C, so the
   # decimal separator is always '.' whatever the locale. No number -> cannot classify -> stay silent (fail open).
   # Pure expansion rather than `sed | head`: take everything after the first '%', then stop at the first
@@ -114,7 +143,7 @@ if [ -z "$PCT" ]; then
   [ "$PCT" != "$LINE" ] || PCT=""
   PCT="${PCT%%[!0-9.]*}"
   case "$PCT" in ''|*[!0-9.]*|.*) PCT="" ;; esac
-  [ -n "$PCT" ] || exit 0
+  [ -n "$PCT" ] || bye
 fi
 
 # The reply's own 🔋 line, held against the reading. The discipline says that figure is copied from the hook's
@@ -147,7 +176,7 @@ fi
 # turn bought nothing here: the thresholds are whole numbers, so truncating is exactly equivalent — 89.9 is below
 # 90 either way — and dropping the decimal also drops the locale hazard the awk calls existed to pin down.
 INT="${PCT%%.*}"; INT="${INT:-0}"
-case "$INT" in ''|*[!0-9]*) exit 0 ;; esac
+case "$INT" in ''|*[!0-9]*) bye ;; esac
 TIER=""
 [ "$INT" -ge 90 ] && TIER=90
 [ -n "$TIER" ] || { [ "$INT" -ge 75 ] && TIER=75; }
@@ -165,11 +194,12 @@ if [ -n "$TIER" ] && [ ! -e "$(marker "$TIER")" ]; then
     MSG=">75% threshold. Recommended: apply the handoff skill, write docs/SESSION_STATE.md, then /clear. Manual; your call."
   fi
 fi
-[ -n "$MSG$WRONG" ] || exit 0
+[ -n "$MSG$WRONG" ] || bye
 
 # JSON-escape backslash + double-quote in the measured line before embedding it.
 SAFE="$(printf '%s' "$LINE" | sed 's/\\/\\\\/g; s/"/\\"/g')"
 OUT="${MSG:+$SAFE | $MSG}"
+[ -n "$CINFO" ] && OUT="$CINFO${OUT:+ · $OUT}"
 [ -n "$WRONG" ] && OUT="⚠️ The 🔋 line in this reply says $WRONG, but the fill measured from the transcript is: $SAFE. The reply's figure is not a measurement — do not decide a handoff on it.${OUT:+ · $OUT}"
 # exit 0 + systemMessage: a neutral, user-facing warning (NOT a hook error, does NOT force an extra turn).
 printf '{"systemMessage":"%s"}\n' "$OUT"