tillerhand 3.49.11 → 3.49.12

package/.claude/hooks/destructive-guard.mjs

@@ -11,11 +11,14 @@ import { readInput, decide, isMain, findRoot } from './shared.mjs';
 import { t } from './lang.mjs';
 import { isTestFile, isTestConfig } from './test-guard.mjs';
 import { readLock, readPlan, allowedInLock, inScope, realPath, relPath, protectedRule } from './freeze-guard.mjs';
+import { clutterIssue } from './structure-guard.mjs';
 
 // Texts of ask decisions go to the user (message keys); texts of deny decisions are plain English for the AI.
 // Helpers here have no root argument: the project root comes from findRoot().
 const tr = (k, vars) => t(findRoot(), k, vars);
 
+// _G_: options between command words (bounded, so a long repeated input stays linear); _L_: the rest of the command part
+const cmdRe = (src) => new RegExp(src.replaceAll('_G_', String.raw`(?:[^;&|\n]{0,100}\s)?`).replaceAll('_L_', String.raw`[^;&|\n]{0,300}`), 'i');
 const DESTRUCTIVE = [
   [/\bdrop\s+(table|database|schema|index|view|collection)\b/i, 'DROP deletes a data structure'],
   [/\btruncate\s+(table\s+)?\w/i, 'TRUNCATE empties a table'],
@@ -29,6 +32,8 @@ const DESTRUCTIVE = [
   [/\bfirebase\s+firestore:delete\b/i, 'Firestore data is being deleted'],
   [/\bheroku\s+pg:reset\b|\bdrop(Database|Collection)\s*\(|\bdeleteMany\s*\(\s*\{\s*\}\s*\)|\bartisan\s+migrate:(fresh|refresh|reset)\b|\btypeorm\b[^;]*\bschema:drop\b|\bknex\b[^;]*\bmigrate:rollback\b[^;]*--all\b|\bprisma\s+db\s+push\b[^;]*--accept-data-loss\b/i, 'Database data is being deleted or reset'],
   [/\b(terraform|tofu|pulumi)\s+destroy\b/i, 'Cloud infrastructure is being destroyed'],
+  // Options may come before the service and between it and the subcommand (aws --profile x s3 --region r rm, heroku -a x apps:destroy)
+  [cmdRe(String.raw`\baws(\.exe)?\s_G_(s3\s_G_rm\b(?=_L_\s--recursive\b)|s3\s_G_rb\b(?=_L_\s--force\b)|s3api\s_G_delete-bucket\b|rds\s_G_delete-db-(instance|cluster)\b|dynamodb\s_G_delete-table\b|ec2\s_G_terminate-instances\b)|\bgcloud\s_G_((sql|compute)\s_G_instances\s_G_delete|projects\s_G_delete)\b|\b(gsutil\s_G_rm|gcloud\s_G_storage\s_G_rm)\b(?=_L_\s(-[a-zA-Z]*r|--recursive)\b)|\baz\s_G_(group|resource)\s_G_delete\b|\bheroku\s_G_apps:destroy\b|\b(fly|flyctl)\s_G_(apps|volumes)\s_G_destroy\b|\bgh\s_G_repo\s_G_delete\b|\bsupabase\s_G_projects\s_G_delete\b|\bnetlify(-cli)?\s_G_sites:delete\b`), 'Cloud data, an app or a repository is being deleted for good'],
 ];
 
 // Database addresses other than localhost count as prod (or a shared environment)
@@ -50,6 +55,11 @@ const NEEDS_APPROVAL = [
   // A package spelling (npx netlify-cli, firebase-tools, wrangler@3) deploys the same way
   [/\b(fly|flyctl)\s+deploy\b|\brailway\s+up\b|\bnetlify(-cli)?(@[\w.-]+)?\s+deploy\b[^;]*--prod|\bfirebase(-tools)?(@[\w.-]+)?\s+deploy\b|\bwrangler(@[\w.-]+)?\s+(deploy|publish|pages\s+deploy)\b|\bgcloud\s+app\s+deploy\b|\b(serverless|sls)\s+deploy\b|\bcdk\s+deploy\b|\bpulumi\s+up\b|\bamplify\s+(push|publish)\b|\b(terraform|tofu)\s+apply\b|\bexpo\s+publish\b/i, 'guard.destructive.serverDeploy'],
   [/\beas(-cli(@[\w.-]+)?)?\s+(submit\b|build\b(?=[^;\n]*--auto-submit\b)|update:(rollback|republish)\b|update\b(?=[^;\n]*--(branch|channel|environment)(=|\s+)['"]?prod(uction)?\b)|deploy\b(?=[^;\n]*--prod\b))/i, 'guard.destructive.storeSubmit'],
+  // vercel/vc only as a command word (vercel.json in a path is not one); delete as a whole word (delete.yaml is not)
+  [cmdRe(String.raw`\bkubectl(\.exe)?\s_G_delete(?=\s|$)|\bhelm(\.exe)?\s_G_(uninstall|delete)(?=\s|$)|\brailway\s_G_(down|delete)(?=\s|$)|(?<![\w./-])(vercel|vc)(@[\w.-]+)?(\.cmd|\.exe)?\s_G_(rm|remove)(?=\s|$)`), 'guard.destructive.resourceDelete'],
+  [cmdRe(String.raw`\b(npm|pnpm|bun|yarn)(\.cmd|\.exe)?\s_G_(npm\s+)?(publish|unpublish|deprecate|dist-tag)(?=\s|$)(?!_L_--dry-run(?!=false)(?!_L_--no-dry-run))|\bgh\s_G_release\s_G_(create|delete)\b|\bcargo\s_G_publish\b(?!_L_--dry-run)|\btwine\s_G_upload\b|\b(lerna|changeset)\s_G_publish\b`), 'guard.destructive.publish'],
+  [cmdRe(String.raw`\bgit(\.exe)?\s_G_branch\b(?=_L_\s(-[a-zA-Z]*d[a-zA-Z]*|--delete)(?=\s|$))(?=_L_\s(refs/heads/)?(main|master|production)(?=\s|$))`), 'guard.destructive.branchDelete'],
+  [cmdRe(String.raw`\bdocker(\.exe)?\s_G_(system|image)\s+prune\b(?=_L_\s(-[a-zA-Z]*a[a-zA-Z]*|--all)(?=\s|$))`), 'guard.destructive.dockerPrune'],
   [/\bgit\s+push\b[^;]*\b(main|master|production)\b/i, 'guard.destructive.pushMain'],
   [/\bgit\s+(rebase|filter-branch|filter-repo)\b/i, 'guard.destructive.rewriteHistory'],
   [/\b(alembic\s+upgrade|prisma\s+migrate\s+deploy|supabase\s+db\s+push)\b/i, 'guard.destructive.migration'],
@@ -395,7 +405,24 @@ const INLINE = /\b(node|deno|bun)\s+(-e|--eval|-p|--print)\b|\bpython[\d.]*\s+-c
 const TEST_WRITER_ONLY = 'Only the test-writer agent writes to test files: whoever writes the code cannot change tests (AGENTS.md rule 7). If a test must be added or changed, call the test-writer agent (continue it with SendMessage if it exists).';
 // ctx: { tool, agent } of the call; only Claude Code tells which subagent runs it. Test files are written by the
 // test-writer agent only; test config files stay a question (evaluateOne).
+// Not every older rule is linear in the length: a command over MAX_COMMAND is not matched as a whole. Its short lines
+// (up to 50 000 characters of them) still are, so a deny stays a deny; otherwise it is asked, naming a guarded word.
+export const MAX_COMMAND = 10000;
+export const shortLines = (command) => {
+  let total = 0;
+  return command.split(/\r?\n/).filter((l) => l.length <= 1000 && (total += l.length) <= 50000);
+};
+const GUARDED_WORD = /\b(drop|truncate|destroy|delete|reset|prune|flush|publish|deploy|push|rm|remove|rollback|promote|submit)\b/i;
+function longCommand(command) {
+  const deny = shortLines(command).map((l) => strictest(evaluateOne(l), evaluateOne(unquote(l)), evaluateOne(blankQuoted(l))))
+    .find((r) => r?.decision === 'deny');
+  if (deny) return deny;
+  const word = command.match(GUARDED_WORD)?.[0];
+  return { decision: 'ask', reason: word ? tr('guard.destructive.tooLongWord', { length: command.length, word })
+    : tr('guard.destructive.tooLong', { length: command.length }) };
+}
 export function evaluate(command, ctx = {}) {
+  if (command.length > MAX_COMMAND) return longCommand(command);
   const testWrite = ctx.tool === 'claude' && ctx.agent !== 'test-writer' && writesTest(quotedTextOff(command).replace(/\s+/g, ' '), isTestCode)
     ? { decision: 'deny', reason: TEST_WRITER_ONLY } : null;
   // An inline script (node -e, python -c, bash -c) that names a test path may write it; the shell rules cannot see inside
@@ -442,7 +469,8 @@ if (isMain(import.meta.url)) {
   // Of the lists, the stricter wins (deny > ask). A guard that throws would let the command run: asked instead
   let results;
   try {
-    results = g ? [evaluate(g.command, g), g.tool !== 'claude' ? permissionEquivalent(g.command) : null, scopeIssue(g.command, g.dir, g.root)].filter(Boolean) : [];
+    results = !g ? [] : g.command.length > MAX_COMMAND
+      ? [evaluate(g.command, g), g.tool !== 'claude' ? strictest(...shortLines(g.command).map(permissionEquivalent)) : null].filter(Boolean) : [evaluate(g.command, g), g.tool !== 'claude' ? permissionEquivalent(g.command) : null, scopeIssue(g.command, g.dir, g.root), clutterIssue(g.command, g.dir, g.root)].filter(Boolean);
   } catch (e) {
     results = [{ decision: 'ask', reason: tr('guard.destructive.internalError', { error: String(e?.message ?? e).slice(0, 200) }) }];
   }

package/.claude/hooks/guard-secrets.mjs

@@ -5,7 +5,10 @@
 //   2) Git pre-commit: `node .claude/hooks/guard-secrets.mjs --staged` scans the staged changes.
 // High-confidence patterns only; no generic "password=" search, to avoid false alarms.
 import { execSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
 import { readInput, decide, isMain } from './shared.mjs';
+import { boardAfter } from './freeze-guard.mjs';
 
 // (?<![A-Za-z0-9]) instead of \b: a key right after _ (OPENAI_sk-…, prod_sk_live_…) is found too.
 // Lookaheads and runs are bounded: an unbounded one is quadratic on a long run (-sb_secret_ × 50 000) and a hook
@@ -31,6 +34,19 @@ export function findSecrets(text) {
   return PATTERNS.filter(([, re]) => re.test(text)).map(([name]) => name);
 }
 
+// A key split across edits (MultiEdit, Antigravity chunks) or joined to the text around an edit only exists in the file
+// after the write: the result is rebuilt and the keys it has that the file on disk did not have are returned.
+function addedSecrets(f, dir) {
+  if (!f.edits) return [];
+  let disk;
+  try { disk = fs.readFileSync(path.resolve(dir, f.path), 'utf8'); } catch { return []; }
+  const after = boardAfter(disk, f);
+  if (after === null) return [];
+  const all = (s) => new Set(PATTERNS.flatMap(([name, re]) => [...s.matchAll(new RegExp(re.source, re.flags.replace('g', '') + 'g'))].map(([m]) => `${name}\0${m}`)));
+  const before = all(disk);
+  return [...all(after)].filter((k) => !before.has(k)).map((k) => k.split('\0')[0]);
+}
+
 function hookMode() {
   const g = readInput();
   if (!g) process.exit(0); // unreadable input: do not block the work
@@ -38,11 +54,16 @@ function hookMode() {
   if (g.tool !== 'claude' && findSecrets(g.command).length) {
     decide(g.tool, 'deny', `BLOCKED: the command contains a secret (${findSecrets(g.command).join(', ')}). Do not write the secret into a command or a file; read it from an environment variable.`);
   }
-  for (const { path, text } of g.files) {
-    const found = findSecrets(text);
+  // Antigravity: every tool's string arguments, so a write tool the parser does not know (create_file…) is scanned too
+  if (g.tool === 'antigravity' && findSecrets(g.reads.join('\n')).length) {
+    decide(g.tool, 'deny', `BLOCKED: the tool call contains a secret (${findSecrets(g.reads.join('\n')).join(', ')}). Do not write the secret into a file; read it from an environment variable.`);
+  }
+  for (const f of g.files) {
+    const { path: file, text } = f;
+    const found = [...new Set([...findSecrets(text), ...addedSecrets(f, g.dir)])];
     if (found.length) {
       decide(g.tool, 'deny',
-        `BLOCKED: a secret is being written to ${path} (${found.join(', ')}). ` +
+        `BLOCKED: a secret is being written to ${file} (${found.join(', ')}). ` +
           'Do not put the secret in code; read it from an environment variable and add the variable name to .env.example with an empty value.');
     }
   }

package/.claude/hooks/messages.mjs

@@ -391,6 +391,12 @@ export const MESSAGES = {
   'guard.destructive.pushMain': { en: 'Direct push to the main branch' },
   'guard.destructive.rewriteHistory': { en: 'Git history is being rewritten' },
   'guard.destructive.migration': { en: 'A migration is being applied (check the target environment)' },
+  'guard.destructive.resourceDelete': { en: 'A cluster resource, deployment, domain or environment variable is being deleted' },
+  'guard.destructive.publish': { en: 'A package or a release is being published (or unpublished)' },
+  'guard.destructive.branchDelete': { en: 'The main branch is being deleted' },
+  'guard.destructive.dockerPrune': { en: 'Every unused Docker image is being deleted' },
+  'guard.destructive.tooLong': { en: 'The command is too long for the shield to check ({length} characters)' },
+  'guard.destructive.tooLongWord': { en: 'The command is too long for the shield to check ({length} characters) and contains "{word}"' },
   'guard.destructive.remoteDb': { en: 'The command connects to a database other than localhost (could be prod). User approval required; the AI must not use prod access credentials.' },
   'guard.destructive.testShell': { en: 'A test file is being changed, moved or deleted with a shell command. Weakening a test to make it pass is forbidden (AGENTS.md rule 7); edit tests with a file tool. User approval required.' },
   'guard.destructive.inlineTest': { en: 'An inline script names a test path; it may write to a test file. Only the test-writer agent writes to test files (AGENTS.md rule 7). User approval required.' },
@@ -449,8 +455,14 @@ export const MESSAGES = {
   'guard.package.depFileUnclear': { en: 'Package gate: the new dependencies in {path} could not be read (the file does not parse or the edit cannot be placed). User approval required.' },
   'guard.package.error': { en: 'The package gate could not check this command ({error}). User approval required.' },
   'guard.package.ask': { en: 'Package gate warning: {list}. Before installing, make sure the package is really the one you want.' },
+  'guard.package.notRegistry': { en: 'not from the public registry ({source}); the gate cannot check it' },
+  'guard.package.otherEco': { en: 'the gate does not check the {eco} registry' },
+  'guard.package.configFile': { en: 'Package gate: {path} sets where packages are installed from (registry, index or credentials). User approval required.' },
   'guard.structure.offMap': { en: '"{rel}" is not in the structure map (.claude/structure.json). The right place is probably one of: {top}. If it is temporary or a trial, write it under sandbox/. If a new permanent place is needed, ask it as a technical decision and update the map (docs/architecture/structure.md).' },
   'guard.structure.prefix': { en: 'Structure: {reason}' },
+  'guard.structure.longPath': { en: 'A path of {length} characters is not checked against the structure map (over 1024). User approval required.' },
+  'guard.structure.brokenMap': { en: '.claude/structure.json does not parse, so "{rel}" cannot be checked against the map. Fix the map (it is JSON) or approve this file.' },
+  'guard.structure.clutterShell': { en: 'The command creates "{rel}", which matches a clutter pattern (backup, old version, copy or temp file). Git history is already the backup; use sandbox/ for experiments. User approval required.' },
   'guard.test.skip': { en: 'a test is skipped or focused alone (.skip / .only / skipIf / xit / pytest skip)' },
   'guard.test.expectRemoved': { en: 'an expectation (expect/assert) is deleted or commented out' },
   'guard.test.expectWeak': { en: 'an expectation is loosened (toBeTruthy, toBeDefined, expect.anything, expect without a matcher, assert True)' },

package/.claude/hooks/package-gate.mjs

@@ -30,9 +30,57 @@ const COMMANDS = [
   [/^(npm|pnpm|bun)\s+(i|in|ins|inst|insta|instal|install|isnt|isnta|isntal|isntall|it|add)\b/i, 'npm'], [/^yarn\s+(global\s+)?add\b/i, 'npm'], [/^(npx\s+)?expo\s+install\b/i, 'npm'],
   // create/init <name> downloads and runs create-<name>; deno takes npm:<name> specifiers
   [/^(npm|pnpm|yarn|bun)\s+(create|init)\b/i, 'npm', 'create'], [/^deno\s+(add|install|run|x)\b/i, 'npm', 'deno'],
-  [/^uv\s+(add|pip\s+install|tool\s+install)\b/i, 'pypi'], [/^((python[\d.]*|py)(\s+-\d[\d.]*)?\s+-m\s+)?pip[\d.]*(\s+-\S+)*\s+install\b/i, 'pypi'],
+  // pip's own options can come before install, with a value (pip --index-url URL install x, pip --proxy P install x)
+  [/^uv\s+(add|pip\s+install|tool\s+install)\b/i, 'pypi'], [/^((python[\d.]*|py)(\s+-\d[\d.]*)?\s+-m\s+)?pip[\d.]*(\s+-\S+(\s+(?!install\b)[^\s-]\S*)?)*\s+install\b/i, 'pypi'],
   [/^(poetry|pdm)\s+add\b|^(pipenv|pipx)\s+install\b/i, 'pypi'],
+  // Registries the gate does not query: every package named there is asked (user decision 2026-10-30)
+  [/^cargo(\s+-\S+)*\s+(\+\S+\s+)?(add|install)\b/i, 'cargo'], [/^go\s+(get|install)\b/i, 'go'], [/^(gem\s+install|bundle\s+add)\b/i, 'gem'],
+  [/^composer\s+(global\s+)?require\b/i, 'composer'],
 ];
+const OTHER_VALUE = /^(--path|--version|--vers|--features|-F|--rename|--package|-p|--branch|--tag|--rev|--registry|--index|--root|--target|--profile|-C|--manifest-path|-v|-i|--install-dir|-n|--bindir|--source|-s|--git|-j|--jobs)$/;
+
+// Where an install argument comes from: 'local' (a path or file: link, already on this machine), 'remote' (git, a URL, a
+// GitHub shorthand user/repo: not the registry the gate checks, user decision 2026-10-30), or null (a registry name).
+// ~ is a path only as ~/ or ~\ (~1.2.3 is a semver range)
+const LOCAL = /^(\.{1,2}([\\/]|$)|[\\/]|~([\\/]|$)|[A-Za-z]:[\\/]|file:|link:|workspace:|portal:)/i;
+const REMOTE = /^(git\+|git:|ssh:|https?:|github:|gitlab:|bitbucket:|gist:)/i;
+function npmSource(arg) {
+  for (;;) {
+    if (LOCAL.test(arg)) return 'local';
+    if (REMOTE.test(arg)) return 'remote';
+    const at = arg.indexOf('@', 1), spec = at > 0 ? arg.slice(at + 1) : '';
+    if (spec.startsWith('npm:')) { arg = spec.slice(4); continue; }
+    if (LOCAL.test(spec)) return 'local';
+    if (/[:/]/.test(spec)) return 'remote';
+    return !arg.startsWith('@') && arg.includes('/') ? 'remote' : null;
+  }
+}
+function pypiSource(arg) {
+  if (LOCAL.test(arg)) return 'local';
+  if (REMOTE.test(arg)) return 'remote';
+  const ref = arg.match(/^[^@;]*@\s*(\S+)/)?.[1];
+  if (ref) return LOCAL.test(ref) ? 'local' : 'remote';
+  return /\.(whl|tar\.gz|zip)$/i.test(arg) ? 'local' : null;
+}
+// A registry other than the public one: what gets installed cannot be checked. Read on the whole command, so a variable
+// exported in an earlier statement (export PIP_INDEX_URL=…; pip install x) or a bare npm ci --registry … counts too.
+// FLAG counts when the command runs a package manager; CONFIG (config set, a write to a registry config file) always.
+// npm accepts an unambiguous prefix of a flag (--regist=…). Gaps are bounded: the text is linear to scan.
+const MANAGER = /\b(npm|pnpm|yarn|bun|npx|bunx|pnpx|pip[\d.]*|uv|uvx|poetry|pdm|pipenv|pipx)\b/i;
+// Registry config files: writing one points installs elsewhere (the file tools ask too, see gate())
+export const REGISTRY_CONFIG = /(^|[\\/])(\.npmrc|\.yarnrc(\.yml)?|\.pnpmrc|bunfig\.toml|pip\.conf|pip\.ini|uv\.toml|poetry\.toml|\.pypirc)$/i;
+const CONFIG_WRITE = /(>{1,2}|\b(tee|cp|copy|mv|move|ln|Set-Content|Add-Content|Out-File|Copy-Item|Move-Item|New-Item)\b[^;&|\n]{0,1000}?)\s*(-\w+\s+)?['"]?[^\s'";&|<>]*(\.npmrc|\.yarnrc(\.yml)?|\.pnpmrc|bunfig\.toml|pip\.conf|pip\.ini|uv\.toml|poetry\.toml|\.pypirc)(?![\w.-])/i;
+const OTHER_REGISTRY = {
+  npm: {
+    FLAG: /(^|[\s'"])--((@[\w.-]+:)?reg[a-z]*|userconfig)(?:(?:=|\s+)\S*|$)|\b(npm_config_(@[\w.-]+:)?registry|npm_config_userconfig|YARN_NPM_REGISTRY_SERVER|YARN_REGISTRY)\s*=\S*/i,
+    CONFIG: new RegExp(`\\b(npm|pnpm|yarn|bun)\\b[^;&|\\n]{0,200}\\bset\\b[^;&|\\n]{0,200}(registry|RegistryServer)\\S*(\\s+\\S+)?|${CONFIG_WRITE.source}`, 'i'),
+  },
+  pypi: {
+    FLAG: /(^|[\s'"])(--(extra-)?index-url|--index|--default-index|--find-links)(?:(?:=|\s+)\S*|$)|\b(PIP_(EXTRA_)?INDEX_URL|PIP_FIND_LINKS|PIP_CONFIG_FILE|UV_(EXTRA_)?INDEX(_URL)?|UV_DEFAULT_INDEX|UV_FIND_LINKS|UV_CONFIG_FILE)\s*=\S*/i,
+    CONFIG: /\bpip[\d.]*\b[^;&|\n]{0,200}\bconfig\b[^;&|\n]{0,200}\bset\b[^;&|\n]{0,200}(index-url|find-links|trusted-host)\S*(\s+\S+)?|\bpoetry\s+(source\s+add|config\s+(repositories|http-basic|certificates)\.)\S*(\s+\S+)?/i,
+  },
+};
+const remote = (eco, spec) => ({ eco, name: '', spec, unverifiable: true });
 // create-vite for vite, @scope/create for @scope, @scope/create-x for @scope/x (npm's own mapping)
 function createName(arg) {
   const n = npmName(arg);
@@ -103,7 +151,7 @@ export function normalize(part) {
   return s;
 }
 
-const NOT_REGISTRY = /^(\.|\/|file:|link:|git\+|git:|https?:|github:|workspace:)/;
+const NOT_REGISTRY = /^(\.|\/|~[\\/]|file:|link:|git\+|git:|https?:|github:|workspace:)/;
 function npmName(arg) {
   // name@npm:other installs "other": the alias target is checked (a loop: a deep a@npm:a@npm:… chain must not overflow
   // the stack). name@github:x/y, @https:… are not from the registry (like a bare URL, not checked here).
@@ -123,18 +171,37 @@ function pypiName(arg) {
 
 export function findPackages(command) {
   const result = [];
+  for (const [eco, { FLAG, CONFIG }] of Object.entries(OTHER_REGISTRY)) {
+    const m = command.match(CONFIG) ?? (MANAGER.test(command) ? command.match(FLAG) : null);
+    if (m) result.push(remote(eco, m[0].trim().replace(/^['"]+|['";]+$/g, '')));
+  }
   // Every place a new command can start: chains, a newline, a background &, $( ), backticks, ( ) and { } groups.
-  // A redirect's & (2>&1, &>) is not a separator.
-  for (const part of command.split(/\n|&&|\|\||;|\||(?<![>&])&(?![>&])|\$\(|`|[(){}]/)) {
+  // A redirect's & (2>&1, &>) is not a separator. A # comment is not an argument.
+  for (const raw of command.split(/\n|&&|\|\||;|\||(?<![>&])&(?![>&])|\$\(|`|[(){}]/)) {
+    // A # comment ends the part only outside quotes and after an unescaped blank (--prefix "a #b", a\ #b are values)
+    const cut = raw.replace(/"(?:[^"\\]|\\.)*"?|'[^']*'?|\\[\s\S]/g, (q) => '_'.repeat(q.length)).search(/(^|\s)#/);
+    const part = cut < 0 ? raw : raw.slice(0, cut);
     const s = normalize(part);
     const match = COMMANDS.find(([re]) => re.test(s));
     const exec = match ? null : EXEC.find((e) => e.re.test(s));
     if (!match && !exec) continue;
     const re = match?.[0] ?? exec.re, eco = match?.[1] ?? exec.eco;
-    // Redirects (2>&1, > log, 2>/dev/null, &> x) are not arguments; a quoted "pkg>=1" has no space before ">" and stays
-    const args = s.replace(re, '').replace(/\s+(\d*|&)(>>?|<)(&\d+|\s*[^\s'"]+)/g, '').trim().split(/\s+/).map((x) => x.replace(/^['"(]+|['")]+$/g, '')).filter(Boolean);
+    // Redirects (2>&1, > log, 2>/dev/null, &> x) are not arguments; a quoted "pkg>=1" has no space before ">" and stays.
+    // Words are split like the shell does: a quoted value with spaces ("a #b") is one word
+    const args = (s.replace(re, '').replace(/\s+(\d*|&)(>>?|<)(&\d+|\s*[^\s'"]+)/g, '').trim().match(/(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g) ?? [])
+      .map((x) => x.replace(/["']/g, '').replace(/^\(+|\)+$/g, '')).filter(Boolean);
+    if (!POPULAR[eco]) {
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.startsWith('-')) { if (OTHER_VALUE.test(a) && args[++i] && a === '--git') result.push(remote(eco, args[i])); continue; }
+        if (!LOCAL.test(a)) result.push({ eco, name: a, unverifiable: true });
+      }
+      continue;
+    }
+    const source = eco === 'npm' ? npmSource : pypiSource;
     if (exec) {
       for (const { arg, fromFlag, unsure } of execArgs(args, eco, exec.positional)) {
+        if (source(arg) === 'remote') { result.push(remote(eco, arg)); continue; }
         const name = eco === 'npm' ? npmName(arg) : pypiName(arg);
         if (name) result.push({ eco, name, exec: true, spec: arg, ...(exec.local && !fromFlag && { local: true }), ...(unsure && { unsure: true }) });
       }
@@ -152,9 +219,23 @@ export function findPackages(command) {
     for (let i = 0; i < args.length; i++) {
       const a = args[i];
       if (a.startsWith('-')) {
-        if (/^(-r|--requirement|-e|--editable|-c|--constraint|--index-url|-i|--extra-index-url|--filter|--prefix|--group)$/.test(a)) i++; // flag that takes a value
+        if (eco === 'pypi') {
+          // pip short options take their value attached too: -ihttps://…, -fhttps://…, -egit+https://…, --editable=git+…
+          if (/^-[if]./.test(a)) result.push(remote(eco, a));
+          const v = a.match(/^(?:-[erc]|--(?:editable|requirement|constraint)=)(.+)$/)?.[1];
+          if (v && pypiSource(v) === 'remote') result.push(remote(eco, v));
+        }
+        // npm's -f is --force (no value): the pip-only flags count only for pip
+        if (/^(-r|--requirement|-e|--editable|-c|--constraint|--index-url|-i|--extra-index-url|--filter|--prefix|--group)$/.test(a)
+          || (eco === 'pypi' ? /^(-f|--find-links|--index|--default-index|--trusted-host|--source|-t|--target|--root|--platform|--python-version)$/ : /^--registry$/).test(a)) {
+          const v = args[i + 1];
+          // -e git+https://…, -r https://… install from a source the gate cannot check; so do -i/-f
+          if (eco === 'pypi' && v && (/^(-[if])$/.test(a) || (/^(-e|--editable|-r|--requirement|-c|--constraint)$/.test(a) && pypiSource(v) === 'remote'))) result.push(remote(eco, `${a} ${v}`));
+          i++; // flag that takes a value
+        }
         continue;
       }
+      if (source(a) === 'remote') { result.push(remote(eco, a)); continue; }
       const name = eco === 'npm' ? npmName(a) : pypiName(a);
       if (name) result.push({ eco, name });
     }
@@ -166,41 +247,137 @@ export function findPackages(command) {
 // 2026-10-30), so "edit package.json, then a bare npm ci" cannot skip the gate. null: the result does not parse (asked).
 const DEP_FILE = /(^|\/)(package\.json|pyproject\.toml|requirements[^/]*\.txt|requirements\/[^/]+\.txt)$/i;
 const NPM_SECTIONS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
-// An npm: alias installs its target: "x": "npm:evil@1" adds evil
-const npmDeps = (j) => new Set(NPM_SECTIONS.flatMap((k) => Object.entries(j?.[k] && typeof j[k] === 'object' ? j[k] : {})
-  .map(([n, v]) => (typeof v === 'string' && /^npm:/i.test(v) ? npmName(v.slice(4)) : n))).filter(Boolean));
-const requirementNames = (text) => new Set(text.split(/\r?\n/).map((s) => s.trim())
-  .filter((s) => s && !s.startsWith('#') && !s.startsWith('-')).map(pypiName).filter(Boolean));
-function pyprojectNames(text) {
-  const names = new Set();
-  let section = '', inArray = false;
+const obj = (x) => (x && typeof x === 'object' && !Array.isArray(x) ? x : {});
+// A package name without its version (foo@1.2 → foo, @s/x@1 → @s/x)
+const bare = (n) => n.replace(/(?<=.)@.*$/, '');
+// Override keys: npm overrides nest ({ foo: { ".": "1", bar: "2" } }), yarn resolutions are paths (**/bar, @s/a/b),
+// pnpm.overrides chain names (foo@<2>bar, foo>bar)
+function overrideDeps(o, out) {
+  for (const [k, v] of Object.entries(obj(o))) {
+    if (k === '.') continue;
+    out.push([bare(k), typeof v === 'string' ? v : typeof obj(v)['.'] === 'string' ? v['.'] : '']);
+    if (v && typeof v === 'object') overrideDeps(v, out);
+  }
+}
+function resolutionName(k) {
+  const parts = k.split('/').filter((p) => p && p !== '**');
+  let last = parts.pop() ?? '';
+  if (parts.at(-1)?.startsWith('@')) last = `${parts.pop()}/${last}`;
+  return bare(last);
+}
+// Every npm dependency the file declares, as { name, spec, remote }: an npm: alias names its target ("x": "npm:evil@1" adds evil);
+// a local spec (file:, link:, workspace:) is left out; a git, URL or user/repo spec is remote
+function npmDeps(j) {
+  const pairs = NPM_SECTIONS.flatMap((k) => Object.entries(obj(j?.[k])));
+  overrideDeps(j?.overrides, pairs);
+  for (const [k, v] of Object.entries(obj(j?.resolutions))) pairs.push([resolutionName(k), v]);
+  for (const [k, v] of Object.entries(obj(j?.pnpm?.overrides))) for (const n of k.split('>')) pairs.push([bare(n), n === k.split('>').at(-1) ? v : '']);
+  const out = [];
+  for (const [n, v] of pairs) {
+    const spec = typeof v === 'string' ? v : '';
+    // pnpm catalog: and yarn patch: resolve to the registry package of the same name
+    const arg = /^npm:/i.test(spec) ? spec.slice(4) : spec && !/^(catalog|patch):/i.test(spec) ? `${n}@${spec}` : n;
+    const source = npmSource(arg);
+    if (source === 'remote') out.push({ name: n, spec, remote: true });
+    else if (!source && !/^\$/.test(spec)) { const name = npmName(arg); if (name) out.push({ name, spec }); }
+  }
+  return out;
+}
+// requirements lines: a name, a git/URL line or an index/find-links option (remote), local paths and -r/-c are left out
+function requirementDeps(text) {
+  const out = [];
   for (const raw of text.split(/\r?\n/)) {
+    const s = raw.replace(/(^|\s)#.*$/, '').trim();
+    if (!s) continue;
+    // Short options may carry their value attached (-ihttps://…, -egit+https://…)
+    const opt = s.match(/^(--editable|--index-url|--extra-index-url|--find-links|--requirement|--constraint|-[eifrc])(?:=|\s+)?(.*)$/);
+    if (opt) {
+      if (/^(-[if]|--index-url|--extra-index-url|--find-links)$/.test(opt[1]) || pypiSource(opt[2]) === 'remote') out.push({ name: '', spec: s, remote: true });
+      continue;
+    }
+    if (s.startsWith('-')) continue;
+    out.push(...pep508(s));
+  }
+  return out;
+}
+const pep508 = (s) => {
+  const source = pypiSource(s);
+  if (source === 'remote') return [{ name: pypiName(s.replace(REMOTE, '')) ?? '', spec: s, remote: true }];
+  if (source === 'local') return [];
+  const name = pypiName(s);
+  return name ? [{ name, spec: s }] : [];
+};
+// pyproject.toml, by full dotted key (section + key, so [project] optional-dependencies.dev = […], a top-level
+// project.dependencies = […] and a quoted ["project"] header read the same):
+//   arrays of requirements: PY_ARRAY; one table entry per package (Poetry dependencies, uv sources): PY_TABLE, also as a
+//   sub-table header [tool.poetry.dependencies.x]; a custom index URL ([[tool.uv.index]], [[tool.poetry.source]]): PY_INDEX.
+// Array items are read token by token: a quoted "]" does not end the array, an { include-group = "x" } table is not a
+// name, a # comment ends the line.
+const PY_ARRAY = /^(project\.dependencies|project\.optional-dependencies\.[^.]+|dependency-groups\.[^.]+|tool\.uv\.(dev|constraint|override)-dependencies|build-system\.requires|tool\.pdm\.dev-dependencies\.[^.]+|tool\.hatch\.envs\.[^.]+\.(extra-)?dependencies)$/;
+const PY_TABLE = /^(tool\.poetry(\.group\.[^.]+)?\.(dev-)?dependencies|tool\.uv\.sources)\.([^.]+)$/;
+const PY_INDEX = /^(tool\.uv\.index|tool\.poetry\.source|tool\.pdm\.source)\.url$/;
+// A uv source only redirects a declared package: it adds no name, only a remote spec
+const tableEntry = (full, value) => {
+  const t = full.match(PY_TABLE), name = t?.[4].toLowerCase();
+  if (!t || name === 'python') return [];
+  if (/\b(git|url)\s*=/.test(value)) return [{ name, spec: value, remote: true }];
+  return /\bpath\s*=/.test(value) || t[1] === 'tool.uv.sources' ? [] : [{ name, spec: '' }];
+};
+function pyprojectDeps(text) {
+  const out = [];
+  let section = '', inArray = false, table = null;
+  // [tool.poetry.dependencies.x] declares x with its keys on the next lines: decided when the section ends
+  const flush = () => { if (table !== null) out.push(...tableEntry(section, table)); table = null; };
+  for (const raw of [...text.split(/\r?\n/), '[]']) {
     const line = raw.trim();
-    const head = line.match(/^\[([^\]"']+)\]$/);
-    if (head) { section = head[1].trim(); inArray = false; continue; }
-    if (section === 'project') {
-      if (/^dependencies\s*=\s*\[/.test(line)) inArray = true;
-      if (!inArray) continue;
-      for (const m of line.matchAll(/["']([^"']+)["']/g)) { const n = pypiName(m[1]); if (n) names.add(n); }
-      if (line.includes(']')) inArray = false;
-    } else if (/^tool\.poetry(\.group\.[\w-]+)?\.(dev-)?dependencies$/.test(section)) {
-      const k = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/);
-      if (k && k[1].toLowerCase() !== 'python') names.add(k[1].toLowerCase());
+    const head = inArray ? null : line.match(/^\[\[?([^\]]*)\]\]?$/);
+    if (head) {
+      flush();
+      section = head[1].replace(/["'\s]/g, '');
+      if (PY_TABLE.test(section)) table = '';
+      continue;
+    }
+    let rest = line;
+    if (!inArray) {
+      const key = line.match(/^((?:"[^"]*"|'[^']*'|[\w.-]+)(?:\s*\.\s*(?:"[^"]*"|'[^']*'|[\w.-]+))*)\s*=\s*(.*)$/);
+      if (!key) continue;
+      const k = key[1].replace(/["'\s]/g, ''), full = section ? `${section}.${k}` : k, value = key[2];
+      if (PY_ARRAY.test(full) && value.startsWith('[')) { inArray = true; rest = value.slice(1); }
+      else {
+        if (PY_TABLE.test(full)) out.push(...tableEntry(full, value));
+        else if (table !== null && /^(git|url|path)$/.test(k)) table += ` ${k} = ${value}`;
+        else if (PY_INDEX.test(full)) out.push({ name: '', spec: value, remote: true });
+        continue;
+      }
+    }
+    for (const [tok] of rest.matchAll(/"(?:[^"\\]|\\.)*"|'[^']*'|\{[^}]*\}?|\]|#.*$/g)) {
+      if (tok === ']') { inArray = false; break; }
+      if (tok.startsWith('#')) break;
+      if (tok.startsWith('{')) continue;
+      out.push(...pep508(tok.slice(1, -1)));
     }
   }
-  return names;
+  return out;
 }
+// What the write adds: a registry name not declared before (a version change is not checked), or a remote spec not there
+// before (asked, never checked). Returns [{ eco, name, spec?, unverifiable? }] or null when the result does not parse.
 export function addedDependencies(file, before, after) {
   const rel = file.replace(/\\/g, '/');
-  const added = (eco, a, b) => [...a].filter((n) => !b.has(n)).map((name) => ({ eco, name }));
+  const added = (eco, a, b) => {
+    const names = new Set(b.filter((d) => !d.remote).map((d) => d.name)), specs = new Set(b.map((d) => `${d.name}\0${d.spec}`));
+    const seen = new Set();
+    return a.filter((d) => (d.remote ? !specs.has(`${d.name}\0${d.spec}`) : !names.has(d.name)))
+      .filter((d) => { const k = `${d.remote}\0${d.name}\0${d.remote ? d.spec : ''}`; return !seen.has(k) && seen.add(k); })
+      .map((d) => (d.remote ? { eco, name: d.name, spec: d.spec, unverifiable: true } : { eco, name: d.name }));
+  };
   if (/(^|\/)package\.json$/i.test(rel)) {
     let a, b = {};
     try { a = JSON.parse(after); } catch { return null; }
     try { b = JSON.parse(before || '{}'); } catch { /* a broken file before: every name counts as added */ }
     return added('npm', npmDeps(a), npmDeps(b));
   }
-  if (/(^|\/)requirements[^/]*\.txt$|(^|\/)requirements\/[^/]+\.txt$/i.test(rel)) return added('pypi', requirementNames(after), requirementNames(before));
-  if (/(^|\/)pyproject\.toml$/i.test(rel)) return added('pypi', pyprojectNames(after), pyprojectNames(before));
+  if (/(^|\/)requirements[^/]*\.txt$|(^|\/)requirements\/[^/]+\.txt$/i.test(rel)) return added('pypi', requirementDeps(after), requirementDeps(before));
+  if (/(^|\/)pyproject\.toml$/i.test(rel)) return added('pypi', pyprojectDeps(after), pyprojectDeps(before));
   return [];
 }
 
@@ -273,6 +450,7 @@ async function gate(g) {
   // Both only for the plain spelling: name@1.2 or name@npm:other downloads, it does not run the local bin or the kit's release
   const packages = findPackages(g.command).filter((p) => !(p.local && p.spec === p.name && bin(p.name)) && !(p.eco === 'npm' && /^tillerhand(@\d+\.\d+\.\d+)?$/.test(p.spec ?? '')));
   for (const f of g.files) {
+    if (REGISTRY_CONFIG.test(String(f.path))) decide(g.tool, 'ask', t(g.root, 'guard.package.configFile', { path: f.path }));
     if (!DEP_FILE.test(String(f.path).replace(/\\/g, '/'))) continue;
     const full = path.resolve(g.dir, f.path);
     let disk = ''; try { disk = fs.readFileSync(full, 'utf8'); } catch { /* new file */ }
@@ -283,14 +461,17 @@ async function gate(g) {
   }
   if (!packages.length) return;
   if (packages.length > MAX_PACKAGES) decide(g.tool, 'ask', t(g.root, 'guard.package.tooMany', { count: packages.length, max: MAX_PACKAGES }));
-  const results = await Promise.all(packages.map(async (p) => ({ ...p, ...(await check(p)) })));
+  // A remote source or a registry the gate does not query is asked as is, without a fetch
+  const results = await Promise.all(packages.map(async (p) => ({ ...p, ...(p.unverifiable
+    ? { status: 'unverifiable', detail: POPULAR[p.eco] ? t(g.root, 'guard.package.notRegistry', { source: p.spec || p.name }) : t(g.root, 'guard.package.otherEco', { eco: p.eco }) }
+    : await check(p)) })));
   const missing = results.filter((s) => s.status === 'missing' && !s.unsure);
   if (missing.length) {
     decide(g.tool, 'deny', `Package gate: ${missing.map((s) => `${s.name} (${s.detail})`).join(', ')}. This name may be made up. Find the correct package name in the official docs; tell the user.`);
   }
   const suspect = results.filter((s) => s.status !== 'ok');
   if (suspect.length) {
-    decide(g.tool, 'ask', t(g.root, 'guard.package.ask', { list: suspect.map((s) => `${s.eco}:${s.name} — ${s.detail}`).join('; ') }));
+    decide(g.tool, 'ask', t(g.root, 'guard.package.ask', { list: suspect.map((s) => `${s.eco}:${s.name || s.spec} — ${s.detail}`).join('; ') }));
   }
   process.exit(0);
 }

package/.claude/hooks/shared.mjs

@@ -97,7 +97,8 @@ export function parseInput(g) {
   }
   const t = g.tool_input ?? {};
   const command = isText(t.command) ? t.command : Array.isArray(t.command) ? t.command.join(' ') : t.command == null ? '' : JSON.stringify(t.command);
-  if (g.tool_name === 'apply_patch') result.files = patchFiles(command);
+  // Codex can pass the patch text in tool_input.input instead of command
+  if (g.tool_name === 'apply_patch') result.files = patchFiles(command || (isText(t.input) ? t.input : t.input == null ? '' : JSON.stringify(t.input)));
   else result.command = command;
   const file = t.file_path ?? t.notebook_path;
   if (file) {

package/.claude/hooks/structure-guard.mjs

@@ -27,19 +27,25 @@ export function globRegex(pattern) {
 }
 
 export function readMap(dir = root) {
+  let text;
+  try { text = fs.readFileSync(path.join(dir, '.claude', 'structure.json'), 'utf8'); } catch { return null; }
+  // A map that exists but does not parse must not switch the guard off: every new file is asked
   try {
-    const m = JSON.parse(fs.readFileSync(path.join(dir, '.claude', 'structure.json'), 'utf8'));
+    const m = JSON.parse(text);
     return { allow: (m.allow ?? []).map(globRegex), deny: (m.deny ?? []).map(globRegex), raw: m };
   } catch {
-    return null;
+    return { broken: true };
   }
 }
 
 // Returns: null (fine) | { decision: 'deny' | 'ask', reason }
 export function check(rel, map) {
   if (!map) return null;
+  // The globs are not linear in the path length: a very long path is asked, not matched
+  if (rel.length > 1024) return { decision: 'ask', reason: t(root, 'guard.structure.longPath', { length: rel.length }) };
   rel = rel.replace(/\\/g, '/').replace(/^\.\//, '');
   if (rel.startsWith('sandbox/')) return null;
+  if (map.broken) return { decision: 'ask', reason: t(root, 'guard.structure.brokenMap', { rel }) };
   const denied = map.deny.find((re) => re.test(rel));
   if (denied) {
     return { decision: 'deny', reason: `"${rel}" matches a clutter pattern (backup, old version, copy or temp file). Git history is already the backup; use sandbox/ for experiments.` };
@@ -52,6 +58,46 @@ export function check(rel, map) {
   };
 }
 
+// Shell side, clutter only: a file a command creates that does not exist yet (a redirect target, the destination of
+// cp/mv/copy/ln, the arguments of tee, touch, New-Item, Out-File, Set-Content) is checked against the deny list.
+// Asked, not denied: the shell text is read by heuristics. Off-map files are not asked here (the Write hook does that).
+// No map or a broken map: silent.
+// shortcut: text-based (quoted words, variables, globs and bash -c bodies are skipped; cd followed in order only).
+const CREATORS = /^(cp|copy|mv|move|ln|copy-item|move-item|cpi|mi)$/;
+const MAKERS = /^(tee|touch|new-item|ni|out-file|set-content|add-content)$/;
+const PREFIX = /^(\w+=\S*|sudo|env|time|nohup|command|exec|do|then|else)$/i;
+const HIDDEN = ' <>;&|#=()\n';
+export function clutterIssue(command, dir, root) {
+  const map = readMap(root);
+  if (!map || map.broken) return null;
+  // Text is not a target: a heredoc body goes (its first line, with its redirects, stays); a quoted string becomes one
+  // word, its blanks and shell characters hidden in private-use characters (U+E000…) until it is used as a path, so
+  // "a > b.bak" is no redirect but "a (1).ts" is still a name; arrows (=>, ->) go; >| >& &> are plain redirects
+  const text = command.replace(/(<<-?\s*(['"]?)(\w+)\2[^\n]*)\n[\s\S]*?\n[ \t]*\3[ \t]*(?=\n|$)/g, '$1')
+    .replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, (q) => q.slice(1, -1).replace(/[\s<>;&|#=()]/g, (c) => String.fromCharCode(0xe000 + HIDDEN.indexOf(c === '\t' ? ' ' : c))))
+    .replace(/[=-]>/g, ' ').replace(/\d*>&\d+/g, ' ').replace(/>\||>&|&>/g, '>');
+  let cwd = dir;
+  for (const raw of text.split(/&&|\|\||[;|\n&]/)) {
+    const part = raw.replace(/(^|\s)#.*$/, '').replace(/^[\s({!]+|[\s)}]+$/g, '');
+    const redirects = [...part.matchAll(/\d?>{1,2}\s*([^\s;&|<>]+)/g)].map((m) => m[1]);
+    const words = part.replace(/\d?>{1,2}\s*\S+/g, ' ').trim().split(/\s+/);
+    while (words.length && PREFIX.test(words[0])) words.shift();
+    const name = path.basename(words[0] ?? '').toLowerCase().replace(/\.(exe|cmd)$/, '');
+    const dest = words.findIndex((w) => /^-destination$/i.test(w));
+    const args = words.slice(1).filter((w) => w && !w.startsWith('-'));
+    if (/^(cd|pushd|set-location)$/.test(name)) { cwd = path.resolve(cwd, args[0] ?? '.'); continue; }
+    const made = CREATORS.test(name) ? (dest > -1 ? [words[dest + 1] ?? ''] : args.slice(-1)) : MAKERS.test(name) ? args : [];
+    for (const w of [...redirects, ...made]) {
+      if (!w || /[$`*?{]/.test(w)) continue;
+      const x = w.replace(/[-]/g, (c) => HIDDEN[c.charCodeAt(0) - 0xe000]);
+      const full = path.resolve(cwd, x), rel = path.relative(root, full);
+      if (rel.startsWith('..') || path.isAbsolute(rel) || fs.existsSync(full)) continue;
+      if (check(rel, map)?.decision === 'deny') return { decision: 'ask', reason: t(root, 'guard.structure.clutterShell', { rel: rel.replace(/\\/g, '/') }) };
+    }
+  }
+  return null;
+}
+
 function hook() {
   const g = readInput();
   if (!g) process.exit(0);
@@ -70,6 +116,7 @@ function hook() {
 function checkAll() {
   const map = readMap();
   if (!map) { console.log('No structure map (.claude/structure.json); check skipped.'); return; }
+  if (map.broken) { console.error('.claude/structure.json does not parse (it must be JSON); the structure cannot be checked.'); process.exit(1); }
   const files = execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' }).split('\n').filter(Boolean);
   const violations = files.map((f) => [f, check(f, map)]).filter(([, s]) => s);
   if (!violations.length) { console.log(`Structure OK: ${files.length} files.`); return; }

package/.claude/i18n/tr.json

@@ -388,6 +388,12 @@
   "guard.destructive.pushMain": "Ana dala doğrudan push",
   "guard.destructive.rewriteHistory": "Git geçmişi yeniden yazılıyor",
   "guard.destructive.migration": "Migration uygulanıyor (hedef ortamı kontrol et)",
+  "guard.destructive.resourceDelete": "Bir küme kaynağı, deploy, alan adı ya da ortam değişkeni siliniyor",
+  "guard.destructive.publish": "Bir paket ya da sürüm yayımlanıyor (ya da yayından kaldırılıyor)",
+  "guard.destructive.branchDelete": "Ana dal siliniyor",
+  "guard.destructive.dockerPrune": "Kullanılmayan bütün Docker imajları siliniyor",
+  "guard.destructive.tooLong": "Komut kalkanın denetlemesi için fazla uzun ({length} karakter)",
+  "guard.destructive.tooLongWord": "Komut kalkanın denetlemesi için fazla uzun ({length} karakter) ve \"{word}\" içeriyor",
   "guard.destructive.remoteDb": "Komut localhost dışındaki bir veritabanına bağlanıyor (prod olabilir). Kullanıcı onayı gerekli; AI prod erişim bilgisi kullanmamalı.",
   "guard.destructive.testShell": "Test dosyası kabuk komutuyla değiştiriliyor, taşınıyor veya siliniyor. Testi geçirmek için testi zayıflatmak yasak (AGENTS.md kural 7); test düzenlemesini dosya aracıyla yap. Kullanıcı onayı gerekli.",
   "guard.destructive.inlineTest": "Satır içi betik bir test yolunu anıyor; test dosyasına yazıyor olabilir. Test dosyasına yalnız test-writer ajanı yazar (AGENTS.md kural 7). Kullanıcı onayı gerekli.",
@@ -446,8 +452,14 @@
   "guard.package.depFileUnclear": "Paket kapısı: {path} içindeki yeni bağımlılıklar okunamadı (dosya ayrıştırılamıyor ya da düzenleme yerleştirilemiyor). Kullanıcı onayı gerekli.",
   "guard.package.error": "Paket kapısı bu komutu denetleyemedi ({error}). Kullanıcı onayı gerekli.",
   "guard.package.ask": "Paket kapısı uyarısı: {list}. Kurmadan önce paketin gerçekten istenen paket olduğundan emin ol.",
+  "guard.package.notRegistry": "açık kayıt dışından ({source}); kapı bunu denetleyemez",
+  "guard.package.otherEco": "kapı {eco} kaydını denetlemez",
+  "guard.package.configFile": "Paket kapısı: {path} paketlerin nereden kurulacağını belirliyor (kayıt, dizin ya da kimlik bilgisi). Kullanıcı onayı gerekli.",
   "guard.structure.offMap": "\"{rel}\" yapı haritasında yok (.claude/structure.json). Doğru yer muhtemelen şunlardan biri: {top}. Geçici veya deneme ise sandbox/ altına yaz. Kalıcı yeni bir yer gerekiyorsa bunu teknik karar olarak sor ve haritayı güncelle (docs/architecture/structure.md).",
   "guard.structure.prefix": "Yapı: {reason}",
+  "guard.structure.longPath": "{length} karakterlik bir yol yapı haritasıyla denetlenmez (1024 üstü). Kullanıcı onayı gerekli.",
+  "guard.structure.brokenMap": ".claude/structure.json ayrıştırılamıyor, bu yüzden \"{rel}\" haritayla denetlenemiyor. Haritayı düzelt (JSON) ya da bu dosyayı onayla.",
+  "guard.structure.clutterShell": "Komut \"{rel}\" dosyasını oluşturuyor; bu bir dağınıklık desenine uyuyor (yedek, eski sürüm, kopya ya da geçici dosya). Git geçmişi zaten yedek; denemeler için sandbox/ kullan. Kullanıcı onayı gerekli.",
   "guard.test.skip": "test atlanıyor veya tek teste odaklanıyor (.skip / .only / skipIf / xit / pytest skip)",
   "guard.test.expectRemoved": "beklenti (expect/assert) siliniyor veya yoruma alınıyor",
   "guard.test.expectWeak": "beklenti gevşetiliyor (toBeTruthy, toBeDefined, expect.anything, matcher'sız expect, assert True)",

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.11-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.12-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">
@@ -236,8 +236,8 @@ A new file outside the map is asked about, clutter like `*.bak` and `*-old.*` is
 | Guardrail | What it does |
 |---|---|
 | Secret guard | Blocks API keys written into code or docs |
-| Destructive-command shield | Blocks `DROP`, unconditional `DELETE`, `db reset`; asks before prod deploys and rollbacks |
-| Package gate | Blocks packages that don't exist (on install and on `npx`, `uvx` runs); asks about very new ones or lookalikes of popular ones |
+| Destructive-command shield | Blocks `DROP`, unconditional `DELETE`, `db reset` and cloud data deletion; asks before prod deploys, rollbacks and publishing |
+| Package gate | Blocks packages that don't exist (on install, on `npx`, `uvx` runs and in dependency files); asks about very new ones, lookalikes of popular ones and sources it can't check (git, URLs, other registries) |
 | Structure guard | Asks about files outside the map, blocks clutter files |
 | Test separation | Only the `test-writer` agent writes test files; the main session and the coding agent are blocked |
 | Test guard | Asks before a test is deleted, skipped or weakened |

package/README.tr.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.11-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.12-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">
@@ -236,8 +236,8 @@ Harita dışı yeni dosya sorulur, `*.bak` ve `*-old.*` gibi dağınıklık dosy
 | Katman | Ne yapar |
 |---|---|
 | Sır engeli | Koda veya dokümana yazılan API anahtarını engeller |
-| Yıkıcı komut kalkanı | `DROP`, koşulsuz `DELETE`, `db reset` engellenir; prod deploy ve geri alma sorulur |
-| Paket kapısı | Var olmayan paketi engeller (kurulumda ve `npx`, `uvx` ile çalıştırmada); çok yeni veya popüler bir pakete benzeyeni sorar |
+| Yıkıcı komut kalkanı | `DROP`, koşulsuz `DELETE`, `db reset` ve bulut verisini silmek engellenir; prod deploy, geri alma ve yayımlama sorulur |
+| Paket kapısı | Var olmayan paketi engeller (kurulumda, `npx`, `uvx` ile çalıştırmada ve bağımlılık dosyalarında); çok yeni, popüler bir pakete benzeyen ve denetleyemediği kaynakları (git, URL, başka kayıt) sorar |
 | Yapı koruyucu | Harita dışı dosyayı sorar, dağınıklık dosyalarını engeller |
 | Test ayrımı | Test dosyasına yalnız `test-writer` ajanı yazar; ana oturum ve kod ajanı denerse engellenir |
 | Test koruması | Silinen, atlanan veya gevşetilen testi sorar |

package/kit/CHANGELOG.md

@@ -3,6 +3,19 @@
 The kit version is in `kit/VERSION`. To update a project, run `/kit-update` in it.
 Items with an "Adapt by hand" note concern files owned by the project; the update does not touch them.
 
+## [3.49.12] - 2026-10-30
+
+### Security
+- **The package gate asks about installs it cannot check.** A git source, a URL or a GitHub shorthand (`npm i github:a/b`, `npm i user/repo`, `pip install git+https://…`, `npx github:a/b`) and a different registry or index (`--registry`, `--@scope:registry`, `--userconfig`, `pip install -i`/`--index-url`/`--extra-index-url`/`--find-links`, attached `-ihttps://…` too, an `npm_config_registry=` or `PIP_INDEX_URL=` set anywhere in the command, `npm config set registry` and `pip config set …index-url` in any spelling, `poetry source add`, a shell write to `.npmrc`, `.yarnrc.yml`, `pip.conf`, `uv.toml`, `poetry.toml`, `.pypirc` or `bunfig.toml`) are asked instead of passing unchecked. Writing one of those registry config files with a file tool is asked too. Local paths (`./lib`, `~/x`, `file:`, `-e .`) stay free.
+- `cargo add`/`install`, `go get`/`install`, `gem install`, `bundle add` and `composer require` are asked: the gate does not query those registries. Local installs (`cargo install --path .`, `go install ./cmd/x`) stay free.
+- **Dependency files:** in `package.json` a dependency whose source changes to git, a URL or `user/repo` is asked, and names added under `overrides`, `resolutions` and `pnpm.overrides` are checked. `pyproject.toml` also reads `[project.optional-dependencies]`, `[dependency-groups]`, `[tool.uv] dev-dependencies`, `[build-system] requires`, PDM and Hatch dependency lists, dotted keys and Poetry sub-tables; a quoted `]` no longer ends the list early; a direct reference (`pkg @ git+https://…`), a Poetry `git`/`url` table, a `[tool.uv.sources]` git source and a custom index (`[[tool.uv.index]]`) are asked. In `requirements*.txt` a git or URL line, an index option and a remote `-r` file are asked.
+- **More cloud deletions are blocked:** `aws s3 rm --recursive`, `aws s3 rb --force`, `aws s3api delete-bucket`, `aws rds delete-db-instance`/`delete-db-cluster`, `aws dynamodb delete-table`, `gcloud projects delete`, `az resource delete`, `aws ec2 terminate-instances`, `gcloud sql`/`compute instances delete`, `gsutil rm -r`, `az group delete`, `heroku apps:destroy`, `fly apps`/`volumes destroy`, `supabase projects delete`, `netlify sites:delete` and `gh repo delete`, also with options before or after the service (`aws --profile x s3 --region r …`, `heroku -a x …`).
+- **More deletions and publishes ask you:** `kubectl delete`, `helm uninstall`, `railway down`, `vercel remove`/`env rm`/`domains rm`, deleting the main branch (`git branch -D main`), `npm`/`pnpm`/`yarn publish` and `unpublish`, with workspace flags too (not `--dry-run`), `npm deprecate`/`dist-tag`, `cargo publish`, `twine upload`, `lerna`/`changeset publish`, `gh release create`/`delete`, `docker system prune -a`; options before the subcommand (`helm -n ns uninstall`) and `.exe`/`.cmd` tool names do not hide them.
+- **Clutter files made from the shell are asked:** `cp a.ts a.bak`, `mv a.ts a-old.ts`, `echo x > notes-old.md`, `tee a.bak`, `Copy-Item a.ts a.bak` meet the same clutter list as the file tools. They are asked rather than blocked, since the shell text is read by heuristics; quoted text, heredocs and arrows (`=>`) are not taken for file names.
+- A shell command over 10 000 characters is not matched as a whole (some shield rules are not linear in the length, and a slow hook holds up the session): its short lines are still checked, so a blocked command stays blocked; otherwise it is asked, naming a guarded word it contains.
+- A `.claude/structure.json` that does not parse no longer switches the structure guard off: new files are asked and `--check` fails. A path over 1024 characters is asked instead of matched.
+- **The secret guard sees keys split across edits:** a key that only appears once a MultiEdit's (or an Antigravity chunk edit's) pieces land in the file is blocked. On Antigravity every tool's arguments are scanned, so a write tool the guard does not know is covered; on Codex a patch passed in `input` instead of `command` is read.
+
 ## [3.49.11] - 2026-10-30
 
 ### Security

package/kit/VERSION

@@ -1 +1 @@
-3.49.11
+3.49.12

package/kit/guide.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.11</b> Starter kit for Claude Code · MIT</span>
+      <span class="pill"><b>v3.49.12</b> Starter kit for Claude Code · MIT</span>
       <h1>The AI builds.<br><em>You steer.</em></h1>
       <p class="sub">TillerHand takes a product from idea to production and maintenance with Claude Code. At every important decision the AI gives you the options, its recommendation and the cost of each option. An expert board reviews the work, and guardrails stop mistakes before they happen.</p>
       <div class="setup">
@@ -941,9 +941,9 @@ npx tillerhand init
     <thead><tr><th>Layer</th><th>What it does</th></tr></thead>
     <tbody>
       <tr><td>Secret block</td><td>Blocks API keys (Anthropic, OpenAI, Stripe, AWS, GitHub, Supabase…) written to code or docs; also scans before a commit</td></tr>
-      <tr><td>Destructive command shield</td><td><code>DROP</code>, <code>TRUNCATE</code>, unconditional <code>DELETE</code>, <code>db reset</code> and pulling prod environment variables onto the machine are blocked; prod deploy, rollback, store submission and migrations are asked</td></tr>
-      <tr><td>Package gate</td><td>A package that is installed, or downloaded and run with <code>npx</code> or <code>uvx</code>, is checked against the registry: if it doesn't exist it is blocked; if it is very new, rarely downloaded or looks like a popular package, it is asked</td></tr>
-      <tr><td>Structure guard</td><td>A new file outside the map is asked; clutter such as <code>*.bak</code>, <code>*-old.*</code>, copies and <code>temp/</code> is blocked</td></tr>
+      <tr><td>Destructive command shield</td><td><code>DROP</code>, <code>TRUNCATE</code>, unconditional <code>DELETE</code>, <code>db reset</code> pulling prod environment variables onto the machine and deleting cloud data (S3 buckets, databases, resource groups, apps, repositories) are blocked; prod deploy, rollback, store submission, migrations, cluster and hosting deletes, package and release publishing and deleting the main branch are asked</td></tr>
+      <tr><td>Package gate</td><td>A package that is installed, or downloaded and run with <code>npx</code> or <code>uvx</code>, is checked against the registry: if it doesn't exist it is blocked; if it is very new, rarely downloaded or looks like a popular package, it is asked. A git or URL source, another registry or index, and cargo, go, gem and composer installs are asked, since they cannot be checked. Dependencies the AI adds to <code>package.json</code>, <code>requirements.txt</code> or <code>pyproject.toml</code> go through the same check</td></tr>
+      <tr><td>Structure guard</td><td>A new file outside the map is asked; clutter such as <code>*.bak</code>, <code>*-old.*</code>, copies and <code>temp/</code> is blocked; made from the shell (<code>cp a.ts a.bak</code>) it is asked</td></tr>
       <tr><td>Config approval</td><td><code>CLAUDE.md</code>, <code>AGENTS.md</code>, <code>.claude/</code>, <code>.codex/</code>, <code>.mcp.json</code> and workflow files don't change without your approval</td></tr>
       <tr><td>Test separation</td><td>The tests are written before the code by a separate agent (<code>test-writer</code>, a different model is recommended), not by whoever writes the code. Nobody but this agent can write to a test file: the main session and the code agent are blocked if they try. A test file changed indirectly by a patch or script also stops at the commit gate. So whoever writes the code can't shape the test to fit their own code</td></tr>
       <tr><td>Test protection</td><td>Deleting or commenting out an assertion, <code>.skip</code>/<code>.only</code>, a loosened assertion, deleting or moving a test file, and narrowing coverage in the test config are asked; so is writing to a test file through the shell</td></tr>
@@ -1241,7 +1241,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Version 3.49.11 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
+    <span>Version 3.49.12 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
   </div>
 </footer>
 

package/kit/guide.tr.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.11</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.49.12</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="setup">
@@ -944,9 +944,9 @@ npx tillerhand init
     <thead><tr><th>Katman</th><th>Ne yapar</th></tr></thead>
     <tbody>
       <tr><td>Sır engeli</td><td>Koda veya dokümana yazılan API anahtarını (Anthropic, OpenAI, Stripe, AWS, GitHub, Supabase…) engeller; commit öncesi de tarar</td></tr>
-      <tr><td>Yıkıcı komut kalkanı</td><td><code>DROP</code>, <code>TRUNCATE</code>, koşulsuz <code>DELETE</code>, <code>db reset</code> ve prod ortam değişkenlerini makineye çekmek engellenir; prod deploy, geri alma, mağazaya gönderim ve migration sorulur</td></tr>
-      <tr><td>Paket kapısı</td><td>Kurulan ya da <code>npx</code>, <code>uvx</code> ile indirilip çalıştırılan paket kayıt defterinden doğrulanır: yoksa engellenir; çok yeni, az indirilmiş veya popüler bir pakete benziyorsa sorulur</td></tr>
-      <tr><td>Yapı koruyucu</td><td>Harita dışı yeni dosya sorulur; <code>*.bak</code>, <code>*-old.*</code>, kopya ve <code>temp/</code> gibi dağınıklıklar engellenir</td></tr>
+      <tr><td>Yıkıcı komut kalkanı</td><td><code>DROP</code>, <code>TRUNCATE</code>, koşulsuz <code>DELETE</code>, <code>db reset</code> , prod ortam değişkenlerini makineye çekmek ve bulut verisini silmek (S3 kovası, veritabanı, kaynak grubu, uygulama, depo) engellenir; prod deploy, geri alma, mağazaya gönderim, migration, küme ve barındırma silmeleri, paket ve sürüm yayımlama ve ana dalı silmek sorulur</td></tr>
+      <tr><td>Paket kapısı</td><td>Kurulan ya da <code>npx</code>, <code>uvx</code> ile indirilip çalıştırılan paket kayıt defterinden doğrulanır: yoksa engellenir; çok yeni, az indirilmiş veya popüler bir pakete benziyorsa sorulur. Git ya da URL kaynağı, başka bir kayıt ya da dizin ve cargo, go, gem, composer kurulumları denetlenemediği için sorulur. AI'nın <code>package.json</code>, <code>requirements.txt</code> ya da <code>pyproject.toml</code>'a eklediği bağımlılıklar da aynı denetimden geçer</td></tr>
+      <tr><td>Yapı koruyucu</td><td>Harita dışı yeni dosya sorulur; <code>*.bak</code>, <code>*-old.*</code>, kopya ve <code>temp/</code> gibi dağınıklıklar engellenir; kabukta oluşturulursa (<code>cp a.ts a.bak</code>) sorulur</td></tr>
       <tr><td>Yapılandırma onayı</td><td><code>CLAUDE.md</code>, <code>AGENTS.md</code>, <code>.claude/</code>, <code>.codex/</code>, <code>.mcp.json</code> ve iş akışı dosyaları onayın olmadan değişmez</td></tr>
       <tr><td>Test ayrımı</td><td>Testleri kodu yazan değil, ayrı bir ajan (<code>test-writer</code>, farklı model önerilir) koddan önce yazar. Test dosyasına bu ajan dışında kimse yazamaz: ana oturum ve kod ajanı denerse engellenir. Patch veya betikle dolaylı değişen test dosyası da commit kapısında durur. Böylece kodu yazan testi kendi koduna göre şekillendiremez</td></tr>
       <tr><td>Test koruması</td><td>Beklenti silmek veya yoruma almak, <code>.skip</code>/<code>.only</code>, gevşek beklenti, test dosyasını silmek veya taşımak ve test ayarında kapsamı daraltmak sorulur; kabukla test dosyasına yazmak da</td></tr>
@@ -1245,7 +1245,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Sürüm 3.49.11 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
+    <span>Sürüm 3.49.12 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
   </div>
 </footer>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.49.11",
+  "version": "3.49.12",
   "description": "Vibe coding kit for Claude Code, Codex and Antigravity: rules, commands, guards and project templates.",
   "license": "MIT",
   "type": "module",