tillerhand 3.28.2 → 3.28.4

package/.claude/hooks/commit-gate.mjs

@@ -41,12 +41,35 @@ export function changes() {
   return { files, signature: h.digest('hex') };
 }
 
-// git's global options may come before commit: git --no-pager commit, git -C x commit, git --git-dir=x commit
-const COMMIT = /\bgit\b(?:\s+(?:-[cC]\s+\S+|--?[\w-]+(?:=\S+)?))*\s+commit\b/;
+// git's global options may come before commit: git --no-pager commit, git -C x commit, git --git-dir=x commit; git.exe on Windows
+const commitRe = (verbs) => new RegExp(`\\bgit(?:\\.exe)?["']?(?:\\s+(?:-[cC]\\s+\\S+|--?[\\w-]+(?:=\\S+)?))*\\s+(?:${verbs.join('|')})(?=\\s|$|["';&|)])`);
+const COMMIT = commitRe(['commit']);
+const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+
+// git aliases that run commit ([alias] ci = commit, cm = !git commit), from git config and from an inline -c alias.x=commit
+export function commitPattern(command) {
+  if (!/\bgit/.test(command)) return COMMIT; // this hook runs on every Bash call: git config only when git is named
+  // An alias defined in the same command (git -c alias.x=…, git config alias.x …, GIT_CONFIG_* env) cannot be read beforehand:
+  // every git subcommand then counts as a commit (inline), and the chain check, which only knows plain commit, stops the command.
+  if (/GIT_CONFIG_|\balias\.[\w-]+=|\bconfig\b[^;&|\n]*\balias\./i.test(command)) return Object.assign(commitRe(['\\S+']), { inline: true });
+  let config = '';
+  try { config = git('config --get-regexp ^alias\\.'); } catch { /* no alias or no repo */ }
+  // Aliases are case-insensitive; one whose value names commit anywhere (a !shell alias too) or calls such an alias is a commit
+  const aliases = [...config.matchAll(/^alias\.(\S+)\s+(.*)$/gm)].map(([, name, value]) => [name.toLowerCase(), value]);
+  const names = new Set();
+  for (let grew = true; grew;) {
+    grew = false;
+    for (const [name, value] of aliases) {
+      const words = value.toLowerCase().split(/[^\w.-]+/);
+      if (!names.has(name) && (words.includes('commit') || words.some((w) => names.has(w)))) { names.add(name); grew = true; }
+    }
+  }
+  return names.size ? new RegExp(commitRe(['commit', ...[...names].map(escapeRe)]).source, 'i') : COMMIT;
+}
 
 // The hook sees the command before it runs: anything that can change files before the commit defeats the review.
 // Allowed: commit alone, with "git add" and "cd" before it. A heredoc and a $(cat <<'EOF' … EOF) message do not count as commands.
-export function chainIssue(command) {
+export function chainIssue(command, commit = COMMIT) {
   const k = command.replace(/<<-?\s*(['"]?)(\w+)\1[^\n]*\n[\s\S]*?\n[ \t]*\2[ \t]*(?=\n|$)/g, '<<HEREDOC')
     .replace(/\$\(\s*cat\s+<<HEREDOC\s*\)/g, 'MESAJ')
     .replace(/'[^']*'/g, "''")
@@ -54,7 +77,7 @@ export function chainIssue(command) {
     .replace(/\d*>&\d+/g, '');
   if (/\$\(|`/.test(k)) return 'komutta ikame var ($(...) veya `...`)';
   const parts = k.split(/&&|\|\||[;|&\n]/).map((s) => s.trim()).filter(Boolean);
-  return parts.every((s) => COMMIT.test(s) || /^git\s+add\b/.test(s) || /^cd\b/.test(s)) ? null : 'commit başka komutlarla zincirli';
+  return parts.every((s) => commit.test(s) || /^git\s+add\b/.test(s) || /^cd\b/.test(s)) ? null : 'commit başka komutlarla zincirli';
 }
 
 export const docsOnly = (files) => files.every((f) => /\.(md|txt)$/i.test(f) || f.startsWith('docs/'));
@@ -131,8 +154,10 @@ async function hook() {
     process.exit(0);
   }
   // --skip bypasses the gate and the board: the user is asked in every spelling (the AI must not write it on its own)
+  // A commit whose message names --skip goes on to the commit checks below (a real --skip chained to a commit is stopped there).
   const open = unquote(command);
-  if ([command, open].some((c) => /commit-gate\.mjs\b[^;&|\n]*--skip\b/i.test(c))) {
+  const commit = commitPattern(command);
+  if (!commit.test(command) && [command, open].some((c) => /commit-gate\.mjs\b[^;&|\n]*--skip\b/i.test(c))) {
     console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask',
       permissionDecisionReason: 'Commit kapısı: --skip kurul denetimini ve deterministik kapıyı aşar. Sadece kullanıcı açıkça isterse onayla.' } }));
     process.exit(0);
@@ -155,9 +180,9 @@ async function hook() {
       permissionDecisionReason: `Kapı komut onayı: AGENTS.md → Komutlar'daki şu komutlar bundan sonra her kapıda çalışır:\n${list}\nGüvendiğin komutlarsa onayla.` } }));
     process.exit(0);
   }
-  if (!COMMIT.test(command) && !COMMIT.test(open)) process.exit(0);
+  if (!commit.test(command) && !commit.test(open)) process.exit(0);
   if (!hasBoard() || reviewOff()) process.exit(0);
-  const chain = chainIssue(command);
+  const chain = chainIssue(command, commit.inline ? COMMIT : commit);
   if (chain) {
     process.stderr.write(`Commit durduruldu: ${chain}. Kapı komut çalışmadan önceki değişiklikleri denetler; commit'i tek başına ` +
       '(veya yalnızca "git add … && git commit" ile) çalıştır. Push ve diğer komutları ayrı çalıştır.\n');

package/.github/workflows/kit-tests.yml

@@ -12,8 +12,8 @@ jobs:
     # kit.mjs install bu dosyayı projeye taşımaz.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       - name: Testler

package/.github/workflows/npm-publish.yml

@@ -1,7 +1,7 @@
 # Kitin npm paketini (tillerhand) yayınlar: v* tag'i push edilince. Projelere kopyalanmaz (kit/kit.mjs → KIT_ONLY).
 # Token yok: npm Trusted Publishing (OIDC). npmjs.com → tillerhand → Settings → Trusted Publisher: GitHub Actions,
 # burakdogrul / TillerHand / npm-publish.yml / environment: npm. Kaynak: docs.npmjs.com/trusted-publishers (2026-10-06).
-# Action'lar commit SHA'sına sabit (v4.4.0); yeni sürüme geçerken SHA'yı github.com/actions/<ad>/releases'tan al.
+# Action'lar commit SHA'sına sabit (checkout v7.0.1, setup-node v7.1.0); yeni sürüme geçerken SHA'yı github.com/actions/<ad>/releases'tan al.
 name: npm-publish
 
 on:
@@ -16,12 +16,13 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
+          package-manager-cache: false # no cache in a release workflow (cache poisoning)
       - name: Tag main'deki bir commit'i mi gösteriyor
         run: git merge-base --is-ancestor "$GITHUB_SHA" origin/main || { echo "Tag main dalında değil, yayın durdu."; exit 1; }
       - name: Sürümler aynı mı (tag, package.json, kit/VERSION)
@@ -42,10 +43,11 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 24
+          package-manager-cache: false # no cache in a release workflow (cache poisoning)
           registry-url: https://registry.npmjs.org
       - name: npm sürümü (Trusted Publishing 11.5.1+ ister)
         run: node -e "const [a,b,c]=process.argv[1].split('.').map(Number); process.exit(a>11||(a===11&&(b>5||(b===5&&c>=1)))?0:1)" "$(npm --version)"

package/README.en.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.28.2-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.28.4-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.28.2-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.28.4-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/kit/CHANGELOG.md

@@ -3,6 +3,23 @@
 Kit sürümü `kit/VERSION` dosyasında. Bir projeyi güncellemek: projede `/kit-update`.
 "Elle uyarla" notu olan maddeler projeye ait dosyalardadır; güncelleme bunlara dokunmaz.
 
+## [3.28.4] - 2026-10-26
+
+### Değişen
+- **GitHub Actions sürümleri Node 24'e geçti** (GitHub, Node 20 ile çalışan action'ları zorla Node 24'te çalıştırıyordu ve uyarı veriyordu): `actions/checkout` v7, `actions/setup-node` v7, `gitleaks/gitleaks-action` v3, `astral-sh/setup-uv` v10. Şablonlardaki CI, bakım, canlı izleme ve ödeme webhook iş akışları güncellendi. Kitin npm yayın iş akışı commit SHA'sına sabit kalıyor ve paket önbelleğini kapatıyor (önbellek zehirlenmesine karşı).
+  - Elle uyarla: Projedeki iş akışını kendin değiştirdiysen `/kit-update` yeni sürümü `.kit-new` olarak bırakır; sürüm satırlarını oradan al.
+
+### Düzeltilen
+- **Commit alias'ı tespiti genişledi:** büyük/küçük harf duyarsız; başka bir alias'ı çağıran ya da değerinde `commit` geçen `!` kabuk alias'ları da commit sayılıyor. Aynı komutta tanımlanan alias (`git -c alias.x=…`, `git config alias.x …`, `GIT_CONFIG_*`) önceden okunamadığı için komut durduruluyor.
+
+## [3.28.3] - 2026-10-26
+
+### Düzeltilen
+- **Commit kapısı `git.exe commit`, tam yolla yazılan git ve commit'e açılan git alias'larını da görüyor** (`[alias] ci = commit`, `!git commit`, `git -c alias.x=commit x`). Bunlar önceden kapıya takılmıyordu.
+- **Mesajında `commit-gate.mjs --skip` geçen bir commit, kurul ve kapı denetiminden sorusuz geçebiliyordu.** Böyle bir commit artık normal commit denetiminden geçiyor.
+- **3.10.0'dan kalan geniş `tools.mjs` izni (`Bash(node .claude/hooks/tools.mjs:*)`) `/kit-update` ile kaldırılıyor.** Bu izin, sorulması gereken `--enable` ve `--commands` komutlarını da serbest bırakıyordu.
+  - Elle uyarla: yok.
+
 ## [3.28.2] - 2026-10-26
 
 ### Düzeltilen

package/kit/VERSION

@@ -1 +1 @@
-3.28.2
+3.28.4

package/kit/guide.html

@@ -287,7 +287,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.28.2</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.28.4</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="install"><span id="cmd">npx tillerhand init</span><button class="copy" type="button" data-copy="cmd">Kopyala</button></div>

package/kit/kit.mjs

@@ -119,7 +119,9 @@ const OLD_RULES = {
     // 3.19.1: in the project folder the CLI loads a repo's .playwright/cli.config.json (it can run a program); asked, not allowed
     ...['open', 'snapshot', 'console', 'requests', 'screenshot'].map((c) => `Bash(npx -y @playwright/cli@0.1.22 ${c}:*)`),
     // 3.28.0: --plan-end + --plan-save widened or dropped the scope shield unasked; both are asked now
-    'Bash(node .claude/hooks/freeze-guard.mjs --plan-save:*)', 'Bash(node .claude/hooks/freeze-guard.mjs --plan-end)'],
+    'Bash(node .claude/hooks/freeze-guard.mjs --plan-save:*)', 'Bash(node .claude/hooks/freeze-guard.mjs --plan-end)',
+    // 3.10.0 allowed every tools.mjs flag; --enable and --commands are asked since 3.10.1, the broad rule skipped that
+    'Bash(node .claude/hooks/tools.mjs:*)'],
   ask: ['Bash(node .claude/hooks/freeze-guard.mjs --plan-ekle:*)', 'Bash(node .claude/hooks/gate.mjs --onayla)', 'Bash(node .claude/hooks/tools.mjs --ac:*)'],
 };
 

package/kit/templates/addons/tr/types/web-saas/.github/workflows/payment-webhook.yml

@@ -14,8 +14,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
       # Node 22.18+ .ts modülünü doğrudan çalıştırır; bağımlılık kurulumu gerekmez

package/kit/templates/backend/.github/workflows/ci.yml

@@ -27,8 +27,8 @@ jobs:
       ENV: test
       DATABASE_URL: postgresql+psycopg://app:app@localhost:5432/app_test
     steps:
-      - uses: actions/checkout@v4
-      - uses: astral-sh/setup-uv@v5
+      - uses: actions/checkout@v7
+      - uses: astral-sh/setup-uv@v10
       - run: uv sync --locked
       - run: uv run ruff check .
       - run: uv run ruff format --check .
@@ -43,14 +43,14 @@ jobs:
   structure:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Klasör yapısı (.claude/structure.json)
         run: node .claude/hooks/structure-guard.mjs --check
 
   karmasiklik:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # base commit'iyle karşılaştırmak için
       - name: Karmaşıklık bütçesi (değişen dosyalar; fonksiyon karmaşıklığı 15, fonksiyon 80, dosya 400 satır)
@@ -63,14 +63,14 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Statik güvenlik analizi (yüksek önemli bulgular CI'ı durdurur)
         run: semgrep scan --config p/default --config p/owasp-top-ten --severity ERROR --error
 
   kopya-kod:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Kopya kod oranı (eşik %5)
         run: npx --yes jscpd@4 --threshold 5 --silent --ignore "**/node_modules/**,**/.next/**,**/dist/**,**/build/**,**/.venv/**,**/coverage/**,**/.expo/**" .
 
@@ -81,11 +81,11 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # tüm geçmiş taranır
       # Kişisel hesapta ücretsiz; organizasyon deposunda GITLEAKS_LICENSE sırrı gerekir
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Token salt okunur: PR yorumu kapalı, sızıntı işi kırmızı yapar

package/kit/templates/backend/.github/workflows/claude-ci-fix.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
       - name: Başarısız adımların kaydı

package/kit/templates/backend/.github/workflows/claude-maintenance.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 50
       - uses: anthropics/claude-code-action@v1

package/kit/templates/backend/.github/workflows/live-monitoring.yml

@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Sağlık ve yanıt süresi
         run: |
           t=$(curl -fsS -o /dev/null --max-time 10 -w '%{time_total}' "${{ vars.LIVE_URL }}/health")
@@ -31,7 +31,7 @@ jobs:
           awk -v t="$t" -v max="$MAX" 'BEGIN { exit (t > max) }'
         env:
           MAX: ${{ vars.LIVE_MAX_SECONDS || '2' }}
-      - uses: astral-sh/setup-uv@v5
+      - uses: astral-sh/setup-uv@v10
         if: hashFiles('tests/live/**') != ''
       - name: Kritik uçlar (canlı)
         if: hashFiles('tests/live/**') != ''

package/kit/templates/mobile/.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
   kontrol:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -31,14 +31,14 @@ jobs:
   structure:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Klasör yapısı (.claude/structure.json)
         run: node .claude/hooks/structure-guard.mjs --check
 
   karmasiklik:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # base commit'iyle karşılaştırmak için
       - name: Karmaşıklık bütçesi (değişen dosyalar; fonksiyon karmaşıklığı 15, fonksiyon 80, dosya 400 satır)
@@ -51,8 +51,8 @@ jobs:
   rls:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         if: hashFiles('supabase/config.toml') != ''
         with:
           node-version: 22
@@ -75,14 +75,14 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Statik güvenlik analizi (yüksek önemli bulgular CI'ı durdurur)
         run: semgrep scan --config p/default --config p/owasp-top-ten --severity ERROR --error
 
   kopya-kod:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Kopya kod oranı (eşik %5)
         run: npx --yes jscpd@4 --threshold 5 --silent --ignore "**/node_modules/**,**/.next/**,**/dist/**,**/build/**,**/.venv/**,**/coverage/**,**/.expo/**" .
 
@@ -93,11 +93,11 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # tüm geçmiş taranır
       # Kişisel hesapta ücretsiz; organizasyon deposunda GITLEAKS_LICENSE sırrı gerekir
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Token salt okunur: PR yorumu kapalı, sızıntı işi kırmızı yapar

package/kit/templates/mobile/.github/workflows/claude-ci-fix.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
       - name: Başarısız adımların kaydı

package/kit/templates/mobile/.github/workflows/claude-maintenance.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 50
       - uses: anthropics/claude-code-action@v1

package/kit/templates/web-saas/.github/workflows/ci.yml

@@ -15,8 +15,8 @@ jobs:
   kontrol:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm
@@ -37,8 +37,8 @@ jobs:
   # e2e:
   #   runs-on: ubuntu-latest
   #   steps:
-  #     - uses: actions/checkout@v4
-  #     - uses: actions/setup-node@v4
+  #     - uses: actions/checkout@v7
+  #     - uses: actions/setup-node@v7
   #       with: { node-version: 22, cache: npm }
   #     - run: npm ci
   #     - run: npx playwright install --with-deps chromium
@@ -47,14 +47,14 @@ jobs:
   structure:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Klasör yapısı (.claude/structure.json)
         run: node .claude/hooks/structure-guard.mjs --check
 
   karmasiklik:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # base commit'iyle karşılaştırmak için
       - name: Karmaşıklık bütçesi (değişen dosyalar; fonksiyon karmaşıklığı 15, fonksiyon 80, dosya 400 satır)
@@ -67,8 +67,8 @@ jobs:
   rls:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         if: hashFiles('supabase/config.toml') != ''
         with:
           node-version: 22
@@ -91,14 +91,14 @@ jobs:
     container:
       image: semgrep/semgrep
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Statik güvenlik analizi (yüksek önemli bulgular CI'ı durdurur)
         run: semgrep scan --config p/default --config p/owasp-top-ten --severity ERROR --error
 
   kopya-kod:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
       - name: Kopya kod oranı (eşik %5)
         run: npx --yes jscpd@4 --threshold 5 --silent --ignore "**/node_modules/**,**/.next/**,**/dist/**,**/build/**,**/.venv/**,**/coverage/**,**/.expo/**" .
 
@@ -109,11 +109,11 @@ jobs:
       contents: read
       pull-requests: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0 # tüm geçmiş taranır
       # Kişisel hesapta ücretsiz; organizasyon deposunda GITLEAKS_LICENSE sırrı gerekir
-      - uses: gitleaks/gitleaks-action@v2
+      - uses: gitleaks/gitleaks-action@v3
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # Token salt okunur: PR yorumu kapalı, sızıntı işi kırmızı yapar

package/kit/templates/web-saas/.github/workflows/claude-ci-fix.yml

@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           ref: ${{ github.event.workflow_run.head_branch }}
       - name: Başarısız adımların kaydı

package/kit/templates/web-saas/.github/workflows/claude-maintenance.yml

@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 50
       - uses: anthropics/claude-code-action@v1

package/kit/templates/web-saas/.github/workflows/live-monitoring.yml

@@ -23,8 +23,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
         with:
           node-version: 22
           cache: npm

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.28.2",
+  "version": "3.28.4",
   "description": "Claude Code, Codex ve Antigravity için Türkçe vibe coding kiti: kurallar, komutlar, korumalar ve proje şablonları.",
   "license": "MIT",
   "type": "module",