tillerhand 3.27.0 → 3.27.1

package/.claude/hooks/budget.mjs

@@ -8,8 +8,8 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync, spawnSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
 import { isTestFile } from './test-guard.mjs';
+import { isMain } from './shared.mjs';
 
 export const BUDGET = { complexity: 15, function: 80, file: 400 };
 const LIZARD = ['pipx', 'run', 'lizard==1.24.1'];
@@ -58,7 +58,7 @@ function check() {
   console.log(`Karmaşıklık bütçesi uygun: ${files.length} dosya.`);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   if (process.argv.includes('--check')) check();
   else { console.error('Kullanım: node .claude/hooks/budget.mjs --check [--base <commit>]'); process.exit(1); }
 }

package/.claude/hooks/checkpoint.mjs

@@ -6,7 +6,7 @@
 // Rollback does not delete history: unsaved work is stashed first, files are set to the target state and
 // a NEW commit is made. So a rollback can be undone too. reset --hard is not used.
 import { execFileSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
+import { isMain } from './shared.mjs';
 
 // Tag prefix in users' repos: it stays as it is, existing tags must keep matching
 const TAG_PREFIX = 'calisan/';
@@ -47,7 +47,7 @@ export function restore(root, target) {
   return { changed: true, stashed, target: short, newCommit: git(root, 'rev-parse', '--short', 'HEAD') };
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   const arg = process.argv.slice(2);
   // ONLY the first argument sets the mode: the permission list matches by prefix ("--list:*", "--save:*"),

package/.claude/hooks/commit-gate.mjs

@@ -8,8 +8,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { execSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
-import { findRoot } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 import { unquote } from './destructive-guard.mjs';
 import { approvedCommands, commandList } from './gate.mjs'; // circular import: used at run time only
 
@@ -161,7 +160,7 @@ function hook() {
   process.exit(2);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isMain(import.meta.url)) {
   const i = process.argv.indexOf('--approve');
   if (i > -1) approve(process.argv[i + 1] || 'belirtilmedi');
   else hook();

package/.claude/hooks/council.mjs

@@ -4,8 +4,8 @@
 //   node .claude/hooks/council.mjs docs/workflow/council/<tutanak>.md
 // The tally is done in code: a model cannot add up the ranking wrong, the chair cannot change the count.
 import fs from 'node:fs';
-import { pathToFileURL } from 'node:url';
 import { sections, findSection } from './status-read.mjs';
+import { isMain } from './shared.mjs';
 
 const VOTE = /^\s*[-*]?\s*([A-Z]\d+)\s*[:=]\s*(DOĞRU|YANLIŞ|ABARTILI)(?!\p{L})/gimu; // \b does not work on Turkish letters (Ş)
 
@@ -99,7 +99,7 @@ export function writeMinutes(minutes, s) {
   return `${minutes.trimEnd()}\n\n${section}`;
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const file = process.argv[2];
   if (!file || !fs.existsSync(file)) { console.error('Kullanım: node .claude/hooks/council.mjs <tutanak.md>'); process.exit(1); }
   const text = fs.readFileSync(file, 'utf8');

package/.claude/hooks/destructive-guard.mjs

@@ -7,8 +7,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { readInput, decide } from './shared.mjs';
+import { readInput, decide, isMain } from './shared.mjs';
 import { isTestFile, isTestConfig } from './test-guard.mjs';
 import { readLock, readPlan, allowedInLock, inScope, realPath, relPath, protectedRule } from './freeze-guard.mjs';
 
@@ -319,7 +318,7 @@ function evaluateOne(command) {
   return null;
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const g = readInput();
   // Of the lists, the stricter wins (deny > ask)
   const results = g ? [evaluate(g.command), g.tool !== 'claude' ? permissionEquivalent(g.command) : null, scopeIssue(g.command, g.dir, g.root)].filter(Boolean) : [];

package/.claude/hooks/edit-rounds.mjs

@@ -6,8 +6,7 @@
 // State: .claude/state/edit-rounds.json → { session, counts: { file: n }, pending: [note] }; reset when the session changes.
 import fs from 'node:fs';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { readInput, findRoot } from './shared.mjs';
+import { readInput, findRoot, isMain } from './shared.mjs';
 
 export const ROUND = 5;
 const CODE = /\.(m?[jt]sx?|cjs|py|go|rb|php|java|kt|swift|rs|sql|vue|svelte)$/i;
@@ -66,6 +65,6 @@ function inject() {
   process.exit(0);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   process.argv.includes('--inject') ? inject() : hook();
 }

package/.claude/hooks/freeze-guard.mjs

@@ -16,8 +16,7 @@
 //   node .claude/hooks/freeze-guard.mjs --plan-end                     close when the task is done
 import fs from 'node:fs';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { readInput, decide, findRoot } from './shared.mjs';
+import { readInput, decide, findRoot, isMain } from './shared.mjs';
 
 // Project root even when called from a subfolder: lock and plan are written where the hook reads them; paths are root-relative
 const root = findRoot();
@@ -157,7 +156,7 @@ function hook() {
   process.exit(0);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const [mode, value] = process.argv.slice(2);
   // A mistyped or removed flag must fail loudly: run as the hook it would pass silently and the AI would think the plan is saved
   if (mode?.startsWith('--') && !MODES.includes(mode)) {

package/.claude/hooks/gate.mjs

@@ -14,10 +14,9 @@ import os from 'node:os';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { spawnSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
 import { changes } from './commit-gate.mjs';
 import { isCodeFile } from './edit-rounds.mjs';
-import { findRoot } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 import { specInvariants } from './dashboard-data.mjs';
 
 // Keys of the AGENTS.md → Komutlar block (Turkish template text, matched as written)
@@ -139,7 +138,7 @@ export function runGate(root) {
   return { passed, text: [`## Kapı · ${files.length} dosya değişti`, ...checks.map(line), result].join('\n') };
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const arg = process.argv[2];
   if (arg === '--approve') { console.log(approve(findRoot())); process.exit(0); }
   if (arg !== '--run') { console.error('Kullanım: node .claude/hooks/gate.mjs --run | --approve'); process.exit(1); }

package/.claude/hooks/guard-secrets.mjs

@@ -5,8 +5,7 @@
 //   2) Git pre-commit: `node .claude/hooks/guard-secrets.mjs --staged` scans the staged changes.
 // High-confidence patterns only; no generic "password=" search, to avoid false alarms.
 import { execSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
-import { readInput, decide } from './shared.mjs';
+import { readInput, decide, isMain } from './shared.mjs';
 
 export const PATTERNS = [
   ['Anthropic/OpenAI anahtarı', /\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{32,}/],
@@ -59,6 +58,6 @@ function stagedMode() {
 }
 
 // Run only when called directly, not when tests import this file
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   process.argv.includes('--staged') ? stagedMode() : hookMode();
 }

package/.claude/hooks/package-gate.mjs

@@ -4,8 +4,8 @@
 //   Package missing                                                        -> denied (deny)
 //   Very new / few downloads / very close to a popular package / unverified -> the user is asked (ask)
 // The decision goes through Claude Code's permission UI; the AI cannot skip it.
-import { pathToFileURL } from 'node:url';
-import { readInput, decide } from './shared.mjs';
+
+import { readInput, decide, isMain } from './shared.mjs';
 
 export const THRESHOLD = { newDays: 30, npmWeeklyDownloads: 500 };
 
@@ -128,4 +128,4 @@ async function hook() {
   process.exit(0);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) hook();
+if (isMain(import.meta.url)) hook();

package/.claude/hooks/plugins-sync.mjs

@@ -9,7 +9,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
+import { isMain } from './shared.mjs';
 
 // Windows paths are case-insensitive; other systems are case-sensitive
 const norm = (p) => (process.platform === 'win32' ? path.resolve(p).toLowerCase() : path.resolve(p));
@@ -33,7 +33,7 @@ export function disabledHere(wanted, installed, root) {
     .map(([id]) => id);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   // No shell: arguments go straight to claude (claude is a single-file executable, .exe on Windows)
   const run = (...arg) => execFileSync('claude', arg, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 180000 });

package/.claude/hooks/preview.mjs

@@ -9,9 +9,8 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
 import { approvedCommands, approvalNeeded, isApproved } from './gate.mjs';
-import { findRoot } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 const CLI = 'npx -y @playwright/cli@0.1.22';
 const SIZES = [['desktop', 1440, 900], ['mobile', 390, 844]];
@@ -120,7 +119,7 @@ export async function preview(root, task) {
   }
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const { code, text } = await preview(findRoot(), process.argv[2]);
   console.log(text);
   process.exit(code);

package/.claude/hooks/qa-report.mjs

@@ -7,9 +7,8 @@
 //   Exit code: 0 nothing failed, 1 a criterion failed, 2 nothing to report (no JUnit file, no PRD criterion, no test ran).
 import fs from 'node:fs';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
 import { prdCriteria, junitCases } from './dashboard-data.mjs';
-import { findRoot } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 // A pipe would split the table cell (the dashboard's table reader does not know \|)
 const cell = (s) => String(s ?? '').split(/\r?\n/)[0].trim().slice(0, 160).replace(/\|/g, '/');
@@ -62,7 +61,7 @@ export function qaReport(root, junit = 'test-results-qa/junit.xml', now = new Da
   return { code: count('kaldı') ? 1 : 0, text: `QA: ${summary} → ${file}${stale}` };
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const { code, text } = qaReport(findRoot(), process.argv[2]);
   console.log(text);
   process.exit(code);

package/.claude/hooks/shared.mjs

@@ -11,6 +11,17 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 
+// Was this file started as the program (not imported)? Compared as real paths: a project opened through a symlink or a
+// junction (macOS /tmp, linked folders, npx's node_modules/.bin) starts the script by its linked path, while
+// import.meta.url is the target. A plain comparison would skip the guard silently there.
+export function isMain(metaUrl) {
+  try {
+    return Boolean(process.argv[1]) && fs.realpathSync(process.argv[1]) === fs.realpathSync(fileURLToPath(metaUrl));
+  } catch {
+    return false;
+  }
+}
+
 const AG_WRITE = ['write_to_file', 'replace_file_content', 'multi_replace_file_content'];
 
 // Claude Code passes CLAUDE_PROJECT_DIR to hooks; Codex does not. Codex has no "ask", so a misdetection stays on the safe side.

package/.claude/hooks/structure-guard.mjs

@@ -7,8 +7,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
-import { pathToFileURL } from 'node:url';
-import { readInput, decide } from './shared.mjs';
+import { readInput, decide, isMain } from './shared.mjs';
 
 const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
 
@@ -80,6 +79,6 @@ function checkAll() {
   process.exit(1);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   process.argv.includes('--check') ? checkAll() : hook();
 }

package/.claude/hooks/test-guard.mjs

@@ -8,8 +8,7 @@
 //   It does not block: the user approves a justified change.
 import fs from 'node:fs';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
-import { readInput, decide } from './shared.mjs';
+import { readInput, decide, isMain } from './shared.mjs';
 
 const TEST = /(^|\/)(tests?|__tests__|e2e|spec)\/|\.(test|spec|e2e-spec)\.[cm]?[jt]sx?$|(^|\/)test_[^/]*\.py$|_test\.(py|go)$/i;
 export const isTestFile = (file) => TEST.test(file.replace(/\\/g, '/'));
@@ -77,4 +76,4 @@ function hook() {
   process.exit(0);
 }
 
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) hook();
+if (isMain(import.meta.url)) hook();

package/.claude/hooks/tools.mjs

@@ -11,8 +11,8 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
 import { missingPlugins } from './plugins-sync.mjs';
+import { isMain } from './shared.mjs';
 
 // Keys are the package names users type (/tools ac tasarim): they stay Turkish
 export const PACKAGES = {
@@ -142,7 +142,7 @@ const tokenOf = (measurement, ids) => {
   return found.length ? `~${found.reduce((s, o) => s + o.skillTokens + o.agentTokens, 0)} token` : '? token (kurulu değil)';
 };
 const NOTE = 'Açtıktan sonra /reload-plugins. Oturum ortasında açmak prompt önbelleğini bozar; en iyisi faz sınırında, /clear ile.';
-if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href) {
+if (isMain(import.meta.url)) {
   const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   const [flag, name] = process.argv.slice(2);
   try {

package/.claude/hooks/usage.mjs

@@ -6,7 +6,7 @@
 //   node .claude/hooks/usage.mjs --json   machine-readable
 import fs from 'node:fs';
 import path from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { isMain } from './shared.mjs';
 
 export const THRESHOLDS = { five_hour: { yellow: 60, red: 85 }, seven_day: { yellow: 70, red: 90 } };
 const WINDOWS = { five_hour: '5 saatlik', seven_day: 'haftalık' };
@@ -82,7 +82,7 @@ export function summary(data, now = Date.now()) {
   return `${parts.join(' · ')} · seviye: ${LEVEL_LABEL[level(data)]} · ${data.ageMin} dk önce okundu${stale}`;
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+if (isMain(import.meta.url)) {
   const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
   const data = readLimits(root);
   if (process.argv.includes('--json')) console.log(JSON.stringify({ ...data, level: level(data), thresholds: THRESHOLDS }));

package/kit/CHANGELOG.md

@@ -3,6 +3,13 @@
 Kit sürümü `kit/VERSION` dosyasında. Bir projeyi güncellemek: projede `/kit-update`.
 "Elle uyarla" notu olan maddeler projeye ait dosyalardadır; güncelleme bunlara dokunmaz.
 
+## [3.27.1] - 2026-10-25
+
+### Düzeltilen
+- **Koruma hook'ları, proje sembolik bağlantı veya junction üzerinden açılınca sessizce çalışmıyordu.** Sır engeli, yıkıcı komut kalkanı, commit kapısı, yapı ve test korumaları dahil 17 betik, başlatıldıkları yolu gerçek yolla karşılaştırırken bağlantıyı çözmüyordu; macOS'ta `/tmp` gibi bağlantılı klasörlerde veya bağlantılı proje klasörlerinde hiçbir şey yapmadan çıkıyorlardı. Artık iki yol da gerçek yola çevrilip karşılaştırılıyor (`shared.mjs` → `isMain`).
+- **`npx tillerhand init` Linux ve macOS'ta hiçbir şey yapmıyordu** (aynı neden: npx kiti `node_modules/.bin` bağlantısıyla başlatıyor). Windows'ta çalışıyordu. 3.27.0'ı Linux veya macOS'ta denediysen tekrar çalıştır.
+  - Elle uyarla: yok; `/kit-update` hook'ları yeniler.
+
 ## [3.27.0] - 2026-10-25
 
 ### Yeni

package/kit/VERSION

@@ -1 +1 @@
-3.27.0
+3.27.1

package/kit/kit.mjs

@@ -474,7 +474,9 @@ async function askTools() {
   return c.split(',').map((s) => TOOLS[Number(s.trim()) - 1] ?? s.trim().toLowerCase()).filter(Boolean);
 }
 
-if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+// Real paths: npx starts the CLI through a link (node_modules/.bin/tillerhand), while import.meta.url is the target
+const realArg = () => { try { return fs.realpathSync(process.argv[1]); } catch { return ''; } };
+if (process.argv[1] && realArg() === fs.realpathSync(fileURLToPath(import.meta.url))) {
   const [command, ...rest] = process.argv.slice(2);
   try {
     const a = parseArgs(rest);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.27.0",
+  "version": "3.27.1",
   "description": "Claude Code, Codex ve Antigravity için Türkçe vibe coding kiti: kurallar, komutlar, korumalar ve proje şablonları.",
   "license": "MIT",
   "type": "module",