tillerhand 3.28.0 → 3.28.1

package/.claude/hooks/budget.mjs

@@ -9,7 +9,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync, spawnSync } from 'node:child_process';
 import { isTestFile } from './test-guard.mjs';
-import { isMain } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 export const BUDGET = { complexity: 15, function: 80, file: 400 };
 const LIZARD = ['pipx', 'run', 'lizard==1.24.1'];
@@ -41,7 +41,7 @@ export function changedFiles(root, base) {
 }
 
 function check() {
-  const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = findRoot();
   const i = process.argv.indexOf('--base');
   const files = selectFiles(changedFiles(root, i > 0 ? process.argv[i + 1] : ''));
   if (!files.length) { console.log('Karmaşıklık bütçesi: değişen kod dosyası yok.'); return; }

package/.claude/hooks/checkpoint.mjs

@@ -6,7 +6,7 @@
 // Rollback does not delete history: unsaved work is stashed first, files are set to the target state and
 // a NEW commit is made. So a rollback can be undone too. reset --hard is not used.
 import { execFileSync } from 'node:child_process';
-import { isMain } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 // Tag prefix in users' repos: it stays as it is, existing tags must keep matching
 const TAG_PREFIX = 'calisan/';
@@ -48,7 +48,7 @@ export function restore(root, target) {
 }
 
 if (isMain(import.meta.url)) {
-  const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = findRoot();
   const arg = process.argv.slice(2);
   // ONLY the first argument sets the mode: the permission list matches by prefix ("--list:*", "--save:*"),
   // so a trailing "--restore ... --yes" must not lead to an unapproved rollback.

package/.claude/hooks/commit-gate.mjs

@@ -20,15 +20,23 @@ const git = (c) => execSync(`git ${c}`, { cwd: root, encoding: 'utf8', stdio: ['
 
 // Changes that will go into the commit: staged, unstaged in tracked files (git commit -a) and untracked new
 // files (git add -A && git commit). -z: Turkish or spaced paths are not quoted and escaped
+// The signature is each changed file's content on disk, so "git add" of the approved content keeps the approval and the gate.
+// The commit takes the index: a file staged with other content than the disk (partial staging) also adds its index blob.
+// --no-renames: a staged rename must list the same two paths as the unstaged delete + new file.
 export function changes() {
+  const list = (c) => git(c).split('\0').filter(Boolean);
   // .claude/state/ (approval, gate result) is not part of the signature: writing an approval must not change it even if not in .gitignore
-  const untracked = git('ls-files --others --exclude-standard -z').split('\0').filter((f) => f && !f.startsWith('.claude/state/'));
-  const files = [...new Set([...git('diff --cached --name-only -z').split('\0'), ...git('diff --name-only -z').split('\0'), ...untracked].filter(Boolean))];
-  const h = crypto.createHash('sha256').update(git('diff --cached') + '\0' + git('diff'));
-  for (const f of untracked) {
+  const untracked = list('ls-files --others --exclude-standard -z').filter((f) => !f.startsWith('.claude/state/'));
+  const staged = new Set(list('diff --cached --no-renames --name-only -z')), unstaged = new Set(list('diff --no-renames --name-only -z'));
+  const files = [...new Set([...staged, ...unstaged, ...untracked])].sort();
+  const partial = files.filter((f) => staged.has(f) && unstaged.has(f));
+  const blobs = new Map(partial.length ? list('ls-files -s -z').map((l) => [l.slice(l.indexOf('\t') + 1), l.split(' ')[1]]) : []);
+  const h = crypto.createHash('sha256');
+  for (const f of files) {
     h.update(`\0${f}\0`);
-    try { h.update(fs.readFileSync(path.join(root, f))); } catch { /* unreadable file: the name is enough */ }
+    try { h.update(fs.readFileSync(path.join(root, f))); } catch { h.update('\0silindi'); }
   }
+  for (const f of partial) h.update(`\0index:${f}:${blobs.get(f)}`);
   return { files, signature: h.digest('hex') };
 }
 
@@ -98,11 +106,13 @@ function readApproval() {
 
 // This project's own commit-gate.mjs, resolved from the shell's folder ($CLAUDE_PROJECT_DIR, absolute, relative or ./ spelling),
 // is masked so it is not read as the gate approval; any other *gate.mjs (sandbox/.claude/hooks/commit-gate.mjs, a renamed
-// copy of gate.mjs) still is. A cd in the command moves the folder the text cannot follow: then nothing is masked.
+// copy of gate.mjs) still is. Only a single plain "node <path> --approve <note>" is masked: a chain, subshell, cd, env -C or
+// expansion can change the folder or the file the text names.
 const real = (p) => { try { return fs.realpathSync(p); } catch { return path.resolve(p); } };
 const samePath = (a, b) => (process.platform === 'win32' ? a.toLowerCase() === b.toLowerCase() : a === b);
+const PLAIN_APPROVE = /^\s*node\s+("[^"\n]*"|'[^'\n]*'|[^\s"'`;&|<>(){}]+)\s+--approve(\s+("[^"\n$`]*"|'[^'\n]*'|[^\s"'`$;&|<>(){}]+))?\s*$/;
 export function maskOwnHook(command, dir) {
-  if (/(^|[;&|(]\s*)(cd|pushd|popd|Set-Location|sl|chdir)\b/i.test(command)) return command;
+  if (!PLAIN_APPROVE.test(command)) return command;
   const own = real(path.join(root, '.claude', 'hooks', 'commit-gate.mjs'));
   return command.replace(/"([^"\n]*commit-gate\.mjs)"|'([^'\n]*commit-gate\.mjs)'|([^\s"';&|]*commit-gate\.mjs)\b/gi, (m, a, b, c) => {
     const p = (a ?? b ?? c).replace(/\$\{?CLAUDE_PROJECT_DIR\}?|%CLAUDE_PROJECT_DIR%|\$env:CLAUDE_PROJECT_DIR/gi, process.env.CLAUDE_PROJECT_DIR || root);

package/.claude/hooks/destructive-guard.mjs

@@ -294,14 +294,15 @@ function obfuscationOne(command) {
     ? { decision: 'ask', reason: 'Komut gizlenmiş görünüyor (satır sonu \\, $\'..\', $(...), `...` veya ${...}) ve korunan bir işlem içeriyor. Kullanıcı onayı gerekli.' } : null;
 }
 
-// A kit guard script (.claude/hooks) run with an indirect spelling: $VAR, $(..), `..`, ${..}, $'..' or a glob * ? (commit-gate.mjs $S,
+// A kit guard script (.claude/hooks) run with an indirect spelling: $VAR, $(..), `..`, ${..}, $'..', a glob * ?, xargs, a pipe or < (commit-gate.mjs $S,
 // --sk$()ip, commit-*.mjs). The text rules for --skip, --approve and --plan-* cannot see through them: asked (user decision 2026-10-25).
 // Heredocs and single-quoted text are not expanded; $CLAUDE_PROJECT_DIR is the documented way to name the folder.
 export function hookScriptIssue(command) {
   const k = command.replace(/<<-?\s*(['"]?)(\w+)\1[^\n]*\n[\s\S]*?\n[ \t]*\2[ \t]*(?=\n|$)/g, '').replace(/'[^']*'/g, "''")
     .replace(/"(?:[^"\\]|\\.)*"/g, (q) => q.replace(/[*?]/g, '')).replace(/\$\{?CLAUDE_PROJECT_DIR\}?|\$env:CLAUDE_PROJECT_DIR/gi, '');
   if (!/\bnode\b/i.test(k) || !/\.claude|hooks|commit-|gate|freeze/i.test(command)) return null;
-  return /\$\(|`|\$\{|\$'|\$[A-Za-z_]|[*?]/.test(k)
+  // Arguments from elsewhere count too: xargs, a pipe into node, an input redirect or <(...)
+  return /\$\(|`|\$\{|\$'|\$[A-Za-z_]|[*?]|\bxargs\b|\|[^|;&]*\bnode\b|<(?!<)/.test(k)
     ? { decision: 'ask', reason: 'Kitin koruma betiği dolaylı yazımla çalıştırılıyor ($DEĞİŞKEN, $(...), `...`, ${...} veya * ?); kural metni bunun içini göremez. Kullanıcı onayı gerekli.' } : null;
 }
 

package/.claude/hooks/notify.mjs

@@ -6,7 +6,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { isMain } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 export const THRESHOLD_SEC = 90;
 
@@ -21,7 +21,7 @@ export function winCommand(title, message) {
 if (isMain(import.meta.url)) main();
 
 function main() {
-  const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = findRoot();
 
   let input = {};
   try { input = JSON.parse(fs.readFileSync(0, 'utf8')); } catch { /* no input */ }

package/.claude/hooks/package-gate.mjs

@@ -82,10 +82,15 @@ export function normalize(part) {
   return s;
 }
 
+const NOT_REGISTRY = /^(\.|\/|file:|link:|git\+|git:|https?:|github:|workspace:)/;
 function npmName(arg) {
-  if (/^(\.|\/|file:|link:|git\+|git:|https?:|github:|workspace:)/.test(arg)) return null;
-  if (arg.startsWith('@')) { const i = arg.indexOf('@', 1); return i > 0 ? arg.slice(0, i) : arg; }
-  return arg.split('@')[0] || null;
+  if (NOT_REGISTRY.test(arg)) return null;
+  const at = arg.indexOf('@', 1), spec = at > 0 ? arg.slice(at + 1) : '';
+  // name@npm:other installs "other": the alias target is checked. name@github:x/y, @https:… are not from the registry
+  // (like a bare URL, not checked here); the name in front is not what gets installed.
+  if (spec.startsWith('npm:')) return npmName(spec.slice(4));
+  if (/[:/]/.test(spec)) return null;
+  return (at > 0 ? arg.slice(0, at) : arg) || null;
 }
 
 function pypiName(arg) {
@@ -106,7 +111,7 @@ export function findPackages(command) {
     if (exec) {
       for (const { arg, fromFlag, unsure } of execArgs(args, eco, exec.positional)) {
         const name = eco === 'npm' ? npmName(arg) : pypiName(arg);
-        if (name) result.push({ eco, name, exec: true, ...(exec.local && !fromFlag && { local: true }), ...(unsure && { unsure: true }) });
+        if (name) result.push({ eco, name, exec: true, spec: arg, ...(exec.local && !fromFlag && { local: true }), ...(unsure && { unsure: true }) });
       }
       continue;
     }
@@ -181,7 +186,8 @@ async function hook() {
   // npx/bunx run a bin the project already installed without downloading: a local bin (tsc, eas) is not a package name
   const bin = (name) => /^\w[\w.-]*$/.test(name) && [g.dir, g.root].some((d) => fs.existsSync(path.join(d, 'node_modules', '.bin', name)));
   // The kit's own package (/start and /adopt run npx -y tillerhand@<version> install): the kit already trusts itself
-  const packages = findPackages(g.command).filter((p) => !(p.local && bin(p.name)) && !(p.eco === 'npm' && p.name === 'tillerhand'));
+  // Both only for the plain spelling: name@1.2 or name@npm:other downloads, it does not run the local bin or the kit's release
+  const packages = findPackages(g.command).filter((p) => !(p.local && p.spec === p.name && bin(p.name)) && !(p.eco === 'npm' && /^tillerhand(@\d+\.\d+\.\d+)?$/.test(p.spec ?? '')));
   if (!packages.length) process.exit(0);
   const results = await Promise.all(packages.map(async (p) => ({ ...p, ...(await check(p)) })));
   const missing = results.filter((s) => s.status === 'missing' && !s.unsure);

package/.claude/hooks/plugins-sync.mjs

@@ -9,7 +9,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
-import { isMain } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 // Windows paths are case-insensitive; other systems are case-sensitive
 const norm = (p) => (process.platform === 'win32' ? path.resolve(p).toLowerCase() : path.resolve(p));
@@ -34,7 +34,7 @@ export function disabledHere(wanted, installed, root) {
 }
 
 if (isMain(import.meta.url)) {
-  const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = findRoot();
   // No shell: arguments go straight to claude (claude is a single-file executable, .exe on Windows)
   const run = (...arg) => execFileSync('claude', arg, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'], timeout: 180000 });
   const reason = (h) => (h.stderr || h.stdout || h.message || '').toString().trim().split('\n')[0];

package/.claude/hooks/reminder.mjs

@@ -4,9 +4,10 @@
 // Kept short: every reminder costs tokens.
 import fs from 'node:fs';
 import path from 'node:path';
+import { findRoot } from './shared.mjs';
 
 export const INTERVAL = 12; // every 12 messages
-const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const root = findRoot();
 const counterFile = path.join(root, '.claude', 'state', 'reminder.json');
 
 let data = { session: '', count: 0 };

package/.claude/hooks/structure-guard.mjs

@@ -7,9 +7,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { execFileSync } from 'node:child_process';
-import { readInput, decide, isMain } from './shared.mjs';
+import { readInput, decide, findRoot, isMain } from './shared.mjs';
 
-const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+const root = findRoot();
 
 // "**" any depth, "*" any name inside one folder, "?" one character
 export function globRegex(pattern) {

package/.claude/hooks/tools.mjs

@@ -12,7 +12,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { missingPlugins } from './plugins-sync.mjs';
-import { isMain } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 // Keys are the package names users type (/tools ac tasarim): they stay Turkish
 export const PACKAGES = {
@@ -143,7 +143,7 @@ const tokenOf = (measurement, ids) => {
 };
 const NOTE = 'Açtıktan sonra /reload-plugins. Oturum ortasında açmak prompt önbelleğini bozar; en iyisi faz sınırında, /clear ile.';
 if (isMain(import.meta.url)) {
-  const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = findRoot();
   const [flag, name] = process.argv.slice(2);
   try {
     if (flag === '--enable' || flag === '--disable') {

package/.claude/hooks/usage.mjs

@@ -6,7 +6,7 @@
 //   node .claude/hooks/usage.mjs --json   machine-readable
 import fs from 'node:fs';
 import path from 'node:path';
-import { isMain } from './shared.mjs';
+import { findRoot, isMain } from './shared.mjs';
 
 export const THRESHOLDS = { five_hour: { yellow: 60, red: 85 }, seven_day: { yellow: 70, red: 90 } };
 const WINDOWS = { five_hour: '5 saatlik', seven_day: 'haftalık' };
@@ -83,7 +83,7 @@ export function summary(data, now = Date.now()) {
 }
 
 if (isMain(import.meta.url)) {
-  const root = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+  const root = findRoot();
   const data = readLimits(root);
   if (process.argv.includes('--json')) console.log(JSON.stringify({ ...data, level: level(data), thresholds: THRESHOLDS }));
   else console.log(summary(data));

package/README.en.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.28.0-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.28.1-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.28.0-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.28.1-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/kit/CHANGELOG.md

@@ -3,6 +3,19 @@
 Kit sürümü `kit/VERSION` dosyasında. Bir projeyi güncellemek: projede `/kit-update`.
 "Elle uyarla" notu olan maddeler projeye ait dosyalardadır; güncelleme bunlara dokunmaz.
 
+## [3.28.1] - 2026-10-26
+
+### Düzeltilen
+- **Onaylanan değişiklikleri `git add` ile sahnelemek commit kapısını ve kurul onayını geçersiz kılıyordu.** Değişiklik imzası artık dosyaların diskteki içeriğinden çıkıyor; aynı içeriği sahnelemek imzayı değiştirmiyor. Diskten farklı içerikle sahnelenen dosya (kısmi sahneleme) imzada ayrıca görünür, çünkü commit sahnedeki içeriği alır.
+- **Kitin klon klasöründe `kit.mjs install` commit edilmemiş işi siliyordu** (`kit/` klasörü, `README.md`). Commit edilmemiş değişiklik varsa kurulum artık başlamadan durur ve dosyaları listeler.
+- **Dokuz betik proje kökünü çalıştırıldığı klasörden buluyordu** (kayıt noktası, bütçe, bildirim, eklenti eşitleme, hatırlatıcı, yapı koruyucu, araçlar, limit). Codex alt klasörden çalıştırınca örneğin `checkpoint.mjs --restore` yalnız o klasörü geri alıyor ama "döndü" diyordu. Hepsi artık kökü aynı yoldan buluyor.
+- **3.28.0'daki güvenlik düzeltmelerinde kalan açıklar:**
+  - npm takma adı (`zod@npm:baska-paket`) asıl kurulan paketi gizliyordu. Paket kapısı artık hedef paketi denetliyor. Bu açık 3.28.0'dan önce de vardı.
+  - `tillerhand` muafiyeti ve projede kurulu komut muafiyeti yalnız düz yazımda geçerli. `tillerhand@npm:…` ya da `tsc@5` gibi yazımlar denetleniyor.
+  - Commit kapısındaki muafiyet yalnız tek başına çalışan `node <yol> --approve <not>` komutu için geçerli. Zincir, alt kabuk ya da `env -C` içeren komutta muafiyet yok.
+  - Koruma betiğine argüman `xargs`, pipe ya da `<` ile verilirse kullanıcıya sorulur.
+  - Elle uyarla: yok.
+
 ## [3.28.0] - 2026-10-25
 
 ### Değişen

package/kit/VERSION

@@ -1 +1 @@
-3.28.0
+3.28.1

package/kit/guide.html

@@ -287,7 +287,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.28.0</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.28.1</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="install"><span id="cmd">npx tillerhand init</span><button class="copy" type="button" data-copy="cmd">Kopyala</button></div>

package/kit/kit.mjs

@@ -355,6 +355,11 @@ function install({ type, addons, keepKit, project, tool }) {
   if (project && path.resolve(project) !== ROOT) return installIntoProject(path.resolve(project), type, addons, tool);
   const tools = validateTools(tool);
   if (fs.existsSync(path.join(ROOT, '.kit.json'))) throw new Error('Kit bu projede zaten kurulu (.kit.json var).');
+  // This folder is about to lose kit/, README.md and the kit-only files: uncommitted work there could not be brought back
+  const st = spawnSync('git', ['status', '--porcelain', '--', '.'], { cwd: ROOT, encoding: 'utf8' });
+  if (st.status === 0 && st.stdout.trim()) {
+    throw new Error(`Commit edilmemiş değişiklik var; kurulum kit/ klasörünü siler ve README.md'yi değiştirir. Önce commit et ya da git stash ile kaydet:\n${st.stdout.trimEnd().split('\n').slice(0, 10).join('\n')}`);
+  }
 
   const { copies, patches } = layers(null, layerNames(type, addons));
   for (const [rel, source] of copies) copy(source, path.join(ROOT, rel));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.28.0",
+  "version": "3.28.1",
   "description": "Claude Code, Codex ve Antigravity için Türkçe vibe coding kiti: kurallar, komutlar, korumalar ve proje şablonları.",
   "license": "MIT",
   "type": "module",