tillerhand 3.49.11 → 3.50.0

package/.claude/hooks/commit-gate.mjs

@@ -9,7 +9,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { execSync } from 'node:child_process';
-import { findRoot, isMain, reviewOff } from './shared.mjs';
+import { findRoot, isMain, reviewOff, parseInput, decisionText } from './shared.mjs';
 import { t } from './lang.mjs';
 import { unquote } from './destructive-guard.mjs';
 import { isTestFile, isTestConfig, digest, readRecord } from './test-guard.mjs';
@@ -174,16 +174,27 @@ export function maskOwnHook(command, dir) {
   });
 }
 
+// Claude Code stops a tool call with exit code 2 and the reason on stderr; Codex and Antigravity get their JSON decision
+// (shared.decisionText; Codex has no ask, so an ask is a deny there and the user runs the command themselves).
+let tool = 'claude';
+const decideOut = (decision, reason) => { console.log(decisionText(tool, decision, reason)); process.exit(0); };
+function stop(reason) {
+  if (tool !== 'claude') decideOut('deny', reason.trim());
+  process.stderr.write(reason);
+  process.exit(2);
+}
+
 async function hook() {
   let command = '', dir = root;
   try {
-    const input = JSON.parse(fs.readFileSync(0, 'utf8'));
+    const g = parseInput(JSON.parse(fs.readFileSync(0, 'utf8')) ?? {});
+    tool = g.tool;
     // A backslash-newline is a line continuation: bash joins the words ("git comm\<newline>it" is git commit), the
     // text rules may also need it as a space ("git commit\<newline>-m x"). Whichever spelling is a commit is checked.
-    const raw = String(input.tool_input?.command ?? '');
+    const raw = String(g.command ?? '');
     const joined = raw.replace(/\\\r?\n/g, '');
     command = [joined, unquote(joined)].some((c) => commitPattern(joined).test(c)) ? joined : raw.replace(/\\\r?\n/g, ' ');
-    if (typeof input.cwd === 'string' && input.cwd) dir = input.cwd;
+    if (g.dir) dir = g.dir;
   } catch {
     process.exit(0);
   }
@@ -191,11 +202,7 @@ async function hook() {
   // A commit whose message names --skip goes on to the commit checks below (a real --skip chained to a commit is stopped there).
   const open = unquote(command);
   const commit = commitPattern(command);
-  if (!commit.test(command) && [command, open].some((c) => /commit-gate\.mjs\b[^;&|\n]*--skip\b/i.test(c))) {
-    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask',
-      permissionDecisionReason: t(root, 'guard.commit.skipAsk') } }));
-    process.exit(0);
-  }
+  if (!commit.test(command) && [command, open].some((c) => /commit-gate\.mjs\b[^;&|\n]*--skip\b/i.test(c))) decideOut('ask', t(root, 'guard.commit.skipAsk'));
   // The gate command approval gives the commands in AGENTS.md permission to run: the user is asked (also covers spellings the permission list misses).
   // Only this project's commit-gate.mjs --approve is left out (maskOwnHook); both the raw and unquoted text are tested.
   const masked = maskOwnHook(command, dir);
@@ -203,26 +210,21 @@ async function hook() {
     // The prompt reads AGENTS.md now: a chain, an env variable, a node flag or a redirect must not change it after the
     // prompt and get another list approved. Only the exact spelling is accepted.
     if (!/^\s*node\s+(\.\/)?\.claude[\\/]hooks[\\/]gate\.mjs\s+(['"]?)--approve\2\s*$/.test(command)) {
-      console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny',
-        permissionDecisionReason: 'The gate command approval runs only with exactly this spelling, on its own (no chain, environment variable, flag or redirect): node .claude/hooks/gate.mjs --approve' } }));
-      process.exit(0);
+      decideOut('deny', 'The gate command approval runs only with exactly this spelling, on its own (no chain, environment variable, flag or redirect): node .claude/hooks/gate.mjs --approve');
     }
     // Loaded only here: every Bash call runs this hook, and gate.mjs pulls in the dashboard and edit-round modules
     const { approvedCommands, commandList, readAgents, unknownCommandKeys } = await import('./gate.mjs');
     const list = commandList(approvedCommands(root)) || t(root, 'guard.commit.noCommands');
     const unknown = unknownCommandKeys(readAgents(root));
     const note = unknown.length ? `\n${t(root, 'guard.commit.gateUnknownKeys', { keys: unknown.join(', ') })}` : '';
-    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask',
-      permissionDecisionReason: t(root, 'guard.commit.gateApprovalAsk', { list }) + note } }));
-    process.exit(0);
+    decideOut('ask', t(root, 'guard.commit.gateApprovalAsk', { list }) + note);
   }
   if (!commit.test(command) && !commit.test(open)) process.exit(0);
   if (!hasBoard() || boardReviewOff()) process.exit(0);
   const chain = chainIssue(command, commit.inline ? COMMIT : commit);
   if (chain) {
-    process.stderr.write(`Commit stopped: ${chain}. The gate reviews the changes as they were before the command runs; run the commit on its own ` +
+    stop(`Commit stopped: ${chain}. The gate reviews the changes as they were before the command runs; run the commit on its own ` +
       '(or only as "git add … && git commit"). Run push and other commands separately.\n');
-    process.exit(2);
   }
 
   let d;
@@ -241,19 +243,19 @@ async function hook() {
   // Deleted files are left to the guards that ask before a delete. Only code files: snapshots, images and fixtures are
   // written by the test runner, not by Write/Edit. A partially staged test (git apply --cached, skip-worktree) commits an
   // index blob the record does not describe, so it always stops.
+  // Only Claude Code records what test-writer wrote; on Codex and Antigravity test separation is a written rule (AGENTS.md)
   const written = readRecord(root);
-  const foreign = d.files.filter((f) => isTestFile(f) && isCodeFile(f) && !isTestConfig(f) && d.hashes[f] !== 'deleted' && written[f] !== d.hashes[f]);
+  const foreign = tool !== 'claude' ? [] : d.files.filter((f) => isTestFile(f) && isCodeFile(f) && !isTestConfig(f) && d.hashes[f] !== 'deleted' && written[f] !== d.hashes[f]);
   if (foreign.length && !(skipped && approval.signature === d.signature)) {
-    process.stderr.write(`Commit stopped: test-writer did not write these test files, or they changed after it wrote them, or they were partially staged: ${foreign.join(', ')}.\n` +
+    stop(`Commit stopped: test-writer did not write these test files, or they changed after it wrote them, or they were partially staged: ${foreign.join(', ')}.\n` +
       'Only the test-writer agent writes test files with Write/Edit (AGENTS.md rule 7); a test written by patch, script, shell, git mv or Codex/Antigravity does not count.\n' +
       'If a change is needed, have test-writer review the file and rewrite it with Write/Edit. If the user made the change themselves ' +
       'and explicitly asks to skip the review for this commit, use --skip "user request".\n');
-    process.exit(2);
   }
   if (approval?.signature === d.signature && (skipped || (gate?.signature === d.signature && gate.passed === true))) process.exit(0);
   if (approval?.signature === d.signature) {
     const failed = gate?.signature === d.signature ? gate.checks.filter((k) => k.status === 'failed').map((k) => k.name) : null;
-    process.stderr.write(failed && !failed.length && gate.empty
+    stop(failed && !failed.length && gate.empty
       ? 'Commit stopped: the deterministic gate is empty (no check ran). Fill in AGENTS.md → Commands and run the gate again.\n' +
         'If the user explicitly asks for this commit, use --skip "user request".\n'
       : failed
@@ -261,22 +263,22 @@ async function hook() {
         'If the user explicitly asks for an intermediate (WIP) commit, use --skip "user request".\n'
       : 'Commit stopped: the deterministic gate has not run for these changes (or the changes were modified after it ran). ' +
         'Run node .claude/hooks/gate.mjs --run; if nothing is red, renew the board approval and try the commit again.\n');
-    process.exit(2);
   }
 
   const delta = approval && !skipped ? sinceApproval(approval, d) : [];
-  process.stderr.write(
+  stop(
     (delta.length && delta.length < d.files.length
       ? `Commit stopped: files changed since the last approval (${approval.note}) were not reviewed: ${delta.join(', ')}.\n` +
         'The board looks only at the diff of these files; files approved earlier are not reviewed again.\n'
       : `Commit stopped: the board has not reviewed these changes (${d.files.length} files).\n`) +
       '0. Run the deterministic gate (lint, types, tests, Semgrep) with node .claude/hooks/gate.mjs --run; give its output to the members.\n' +
-      '1. Following .claude/board/rules.md §3, run at most 2 relevant board members for the changed files with model "haiku", on the diff only.\n' +
+      (tool === 'claude'
+        ? '1. Following .claude/board/rules.md §3, run at most 2 relevant board members for the changed files with model "haiku", on the diff only.\n'
+        : '1. Following .claude/board/rules.md §3, read the definitions of at most 2 relevant board members (.claude/agents/board-*.md) and review the diff as those roles yourself (single model).\n') +
       '2. If there is no REJECT: node .claude/hooks/commit-gate.mjs --approve "<members who took part>" and try the commit again.\n' +
       '3. If there is a REJECT, do not commit; ask the user about the finding and the options.\n' +
       'If the user explicitly wants to skip the review for this commit, use --skip "user request".\n'
   );
-  process.exit(2);
 }
 
 if (isMain(import.meta.url)) {

package/.claude/hooks/destructive-guard.mjs

@@ -11,11 +11,14 @@ import { readInput, decide, isMain, findRoot } from './shared.mjs';
 import { t } from './lang.mjs';
 import { isTestFile, isTestConfig } from './test-guard.mjs';
 import { readLock, readPlan, allowedInLock, inScope, realPath, relPath, protectedRule } from './freeze-guard.mjs';
+import { clutterIssue } from './structure-guard.mjs';
 
 // Texts of ask decisions go to the user (message keys); texts of deny decisions are plain English for the AI.
 // Helpers here have no root argument: the project root comes from findRoot().
 const tr = (k, vars) => t(findRoot(), k, vars);
 
+// _G_: options between command words (bounded, so a long repeated input stays linear); _L_: the rest of the command part
+const cmdRe = (src) => new RegExp(src.replaceAll('_G_', String.raw`(?:[^;&|\n]{0,100}\s)?`).replaceAll('_L_', String.raw`[^;&|\n]{0,300}`), 'i');
 const DESTRUCTIVE = [
   [/\bdrop\s+(table|database|schema|index|view|collection)\b/i, 'DROP deletes a data structure'],
   [/\btruncate\s+(table\s+)?\w/i, 'TRUNCATE empties a table'],
@@ -29,6 +32,9 @@ const DESTRUCTIVE = [
   [/\bfirebase\s+firestore:delete\b/i, 'Firestore data is being deleted'],
   [/\bheroku\s+pg:reset\b|\bdrop(Database|Collection)\s*\(|\bdeleteMany\s*\(\s*\{\s*\}\s*\)|\bartisan\s+migrate:(fresh|refresh|reset)\b|\btypeorm\b[^;]*\bschema:drop\b|\bknex\b[^;]*\bmigrate:rollback\b[^;]*--all\b|\bprisma\s+db\s+push\b[^;]*--accept-data-loss\b/i, 'Database data is being deleted or reset'],
   [/\b(terraform|tofu|pulumi)\s+destroy\b/i, 'Cloud infrastructure is being destroyed'],
+  // Options may come before the service and between it and the subcommand (aws --profile x s3 --region r rm, heroku -a x apps:destroy)
+  // The flag is looked for once, before the gaps are tried: the rule stays fast on a long repeated input
+  [cmdRe(String.raw`\baws(\.exe)?\s(?=_L_\s--recursive\b)_G_s3\s_G_rm\b|\baws(\.exe)?\s(?=_L_\s--force\b)_G_s3\s_G_rb\b|\baws(\.exe)?\s_G_(s3api\s_G_delete-bucket|rds\s_G_delete-db-(instance|cluster)|dynamodb\s_G_delete-table|ec2\s_G_terminate-instances)\b|\bgcloud\s_G_((sql|compute)\s_G_instances\s_G_delete|projects\s_G_delete)\b|\b(gsutil|gcloud)\s(?=_L_\s(-[a-zA-Z]*r|--recursive)\b)_G_(storage\s_G_)?rm\b|\baz\s_G_(group|resource)\s_G_delete\b|\bheroku\s_G_apps:destroy\b|\b(fly|flyctl)\s_G_(apps|volumes)\s_G_destroy\b|\bgh\s_G_repo\s_G_delete\b|\bsupabase\s_G_projects\s_G_delete\b|\bnetlify(-cli)?\s_G_sites:delete\b`), 'Cloud data, an app or a repository is being deleted for good'],
 ];
 
 // Database addresses other than localhost count as prod (or a shared environment)
@@ -50,6 +56,11 @@ const NEEDS_APPROVAL = [
   // A package spelling (npx netlify-cli, firebase-tools, wrangler@3) deploys the same way
   [/\b(fly|flyctl)\s+deploy\b|\brailway\s+up\b|\bnetlify(-cli)?(@[\w.-]+)?\s+deploy\b[^;]*--prod|\bfirebase(-tools)?(@[\w.-]+)?\s+deploy\b|\bwrangler(@[\w.-]+)?\s+(deploy|publish|pages\s+deploy)\b|\bgcloud\s+app\s+deploy\b|\b(serverless|sls)\s+deploy\b|\bcdk\s+deploy\b|\bpulumi\s+up\b|\bamplify\s+(push|publish)\b|\b(terraform|tofu)\s+apply\b|\bexpo\s+publish\b/i, 'guard.destructive.serverDeploy'],
   [/\beas(-cli(@[\w.-]+)?)?\s+(submit\b|build\b(?=[^;\n]*--auto-submit\b)|update:(rollback|republish)\b|update\b(?=[^;\n]*--(branch|channel|environment)(=|\s+)['"]?prod(uction)?\b)|deploy\b(?=[^;\n]*--prod\b))/i, 'guard.destructive.storeSubmit'],
+  // vercel/vc only as a command word (vercel.json in a path is not one); delete as a whole word (delete.yaml is not)
+  [cmdRe(String.raw`\bkubectl(\.exe)?\s_G_delete(?=\s|$)|\bhelm(\.exe)?\s_G_(uninstall|delete)(?=\s|$)|\brailway\s_G_(down|delete)(?=\s|$)|(?<![\w./-])(vercel|vc)(@[\w.-]+)?(\.cmd|\.exe)?\s_G_(rm|remove)(?=\s|$)`), 'guard.destructive.resourceDelete'],
+  [cmdRe(String.raw`\b(npm|pnpm|bun|yarn)(\.cmd|\.exe)?\s_G_(npm\s+)?(publish|unpublish|deprecate|dist-tag)(?=\s|$)(?!_L_--dry-run(?!=false)(?!_L_--no-dry-run))|\bgh\s_G_release\s_G_(create|delete)\b|\bcargo\s_G_publish\b(?!_L_--dry-run)|\btwine\s_G_upload\b|\b(lerna|changeset)\s_G_publish\b`), 'guard.destructive.publish'],
+  [cmdRe(String.raw`\bgit(\.exe)?\s_G_branch\b(?=_L_\s(-[a-zA-Z]*d[a-zA-Z]*|--delete)(?=\s|$))(?=_L_\s(refs/heads/)?(main|master|production)(?=\s|$))`), 'guard.destructive.branchDelete'],
+  [cmdRe(String.raw`\bdocker(\.exe)?\s_G_(system|image)\s+prune\b(?=_L_\s(-[a-zA-Z]*a[a-zA-Z]*|--all)(?=\s|$))`), 'guard.destructive.dockerPrune'],
   [/\bgit\s+push\b[^;]*\b(main|master|production)\b/i, 'guard.destructive.pushMain'],
   [/\bgit\s+(rebase|filter-branch|filter-repo)\b/i, 'guard.destructive.rewriteHistory'],
   [/\b(alembic\s+upgrade|prisma\s+migrate\s+deploy|supabase\s+db\s+push)\b/i, 'guard.destructive.migration'],
@@ -395,7 +406,24 @@ const INLINE = /\b(node|deno|bun)\s+(-e|--eval|-p|--print)\b|\bpython[\d.]*\s+-c
 const TEST_WRITER_ONLY = 'Only the test-writer agent writes to test files: whoever writes the code cannot change tests (AGENTS.md rule 7). If a test must be added or changed, call the test-writer agent (continue it with SendMessage if it exists).';
 // ctx: { tool, agent } of the call; only Claude Code tells which subagent runs it. Test files are written by the
 // test-writer agent only; test config files stay a question (evaluateOne).
+// Not every older rule is linear in the length: a command over MAX_COMMAND is not matched as a whole. Its short lines
+// (up to 50 000 characters of them) still are, so a deny stays a deny; otherwise it is asked, naming a guarded word.
+export const MAX_COMMAND = 10000;
+export const shortLines = (command) => {
+  let total = 0;
+  return command.split(/\r?\n/).filter((l) => l.length <= 1000 && (total += l.length) <= 50000);
+};
+const GUARDED_WORD = /\b(drop|truncate|destroy|delete|reset|prune|flush|publish|deploy|push|rm|remove|rollback|promote|submit)\b/i;
+function longCommand(command) {
+  const deny = shortLines(command).map((l) => strictest(evaluateOne(l), evaluateOne(unquote(l)), evaluateOne(blankQuoted(l))))
+    .find((r) => r?.decision === 'deny');
+  if (deny) return deny;
+  const word = command.match(GUARDED_WORD)?.[0];
+  return { decision: 'ask', reason: word ? tr('guard.destructive.tooLongWord', { length: command.length, word })
+    : tr('guard.destructive.tooLong', { length: command.length }) };
+}
 export function evaluate(command, ctx = {}) {
+  if (command.length > MAX_COMMAND) return longCommand(command);
   const testWrite = ctx.tool === 'claude' && ctx.agent !== 'test-writer' && writesTest(quotedTextOff(command).replace(/\s+/g, ' '), isTestCode)
     ? { decision: 'deny', reason: TEST_WRITER_ONLY } : null;
   // An inline script (node -e, python -c, bash -c) that names a test path may write it; the shell rules cannot see inside
@@ -442,7 +470,8 @@ if (isMain(import.meta.url)) {
   // Of the lists, the stricter wins (deny > ask). A guard that throws would let the command run: asked instead
   let results;
   try {
-    results = g ? [evaluate(g.command, g), g.tool !== 'claude' ? permissionEquivalent(g.command) : null, scopeIssue(g.command, g.dir, g.root)].filter(Boolean) : [];
+    results = !g ? [] : g.command.length > MAX_COMMAND
+      ? [evaluate(g.command, g), g.tool !== 'claude' ? strictest(...shortLines(g.command).map(permissionEquivalent)) : null].filter(Boolean) : [evaluate(g.command, g), g.tool !== 'claude' ? permissionEquivalent(g.command) : null, scopeIssue(g.command, g.dir, g.root), clutterIssue(g.command, g.dir, g.root)].filter(Boolean);
   } catch (e) {
     results = [{ decision: 'ask', reason: tr('guard.destructive.internalError', { error: String(e?.message ?? e).slice(0, 200) }) }];
   }

package/.claude/hooks/guard-secrets.mjs

@@ -5,7 +5,10 @@
 //   2) Git pre-commit: `node .claude/hooks/guard-secrets.mjs --staged` scans the staged changes.
 // High-confidence patterns only; no generic "password=" search, to avoid false alarms.
 import { execSync } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
 import { readInput, decide, isMain } from './shared.mjs';
+import { boardAfter } from './freeze-guard.mjs';
 
 // (?<![A-Za-z0-9]) instead of \b: a key right after _ (OPENAI_sk-…, prod_sk_live_…) is found too.
 // Lookaheads and runs are bounded: an unbounded one is quadratic on a long run (-sb_secret_ × 50 000) and a hook
@@ -31,6 +34,19 @@ export function findSecrets(text) {
   return PATTERNS.filter(([, re]) => re.test(text)).map(([name]) => name);
 }
 
+// A key split across edits (MultiEdit, Antigravity chunks) or joined to the text around an edit only exists in the file
+// after the write: the result is rebuilt and the keys it has that the file on disk did not have are returned.
+function addedSecrets(f, dir) {
+  if (!f.edits) return [];
+  let disk;
+  try { disk = fs.readFileSync(path.resolve(dir, f.path), 'utf8'); } catch { return []; }
+  const after = boardAfter(disk, f);
+  if (after === null) return [];
+  const all = (s) => new Set(PATTERNS.flatMap(([name, re]) => [...s.matchAll(new RegExp(re.source, re.flags.replace('g', '') + 'g'))].map(([m]) => `${name}\0${m}`)));
+  const before = all(disk);
+  return [...all(after)].filter((k) => !before.has(k)).map((k) => k.split('\0')[0]);
+}
+
 function hookMode() {
   const g = readInput();
   if (!g) process.exit(0); // unreadable input: do not block the work
@@ -38,11 +54,16 @@ function hookMode() {
   if (g.tool !== 'claude' && findSecrets(g.command).length) {
     decide(g.tool, 'deny', `BLOCKED: the command contains a secret (${findSecrets(g.command).join(', ')}). Do not write the secret into a command or a file; read it from an environment variable.`);
   }
-  for (const { path, text } of g.files) {
-    const found = findSecrets(text);
+  // Antigravity: every tool's string arguments, so a write tool the parser does not know (create_file…) is scanned too
+  if (g.tool === 'antigravity' && findSecrets(g.reads.join('\n')).length) {
+    decide(g.tool, 'deny', `BLOCKED: the tool call contains a secret (${findSecrets(g.reads.join('\n')).join(', ')}). Do not write the secret into a file; read it from an environment variable.`);
+  }
+  for (const f of g.files) {
+    const { path: file, text } = f;
+    const found = [...new Set([...findSecrets(text), ...addedSecrets(f, g.dir)])];
     if (found.length) {
       decide(g.tool, 'deny',
-        `BLOCKED: a secret is being written to ${path} (${found.join(', ')}). ` +
+        `BLOCKED: a secret is being written to ${file} (${found.join(', ')}). ` +
           'Do not put the secret in code; read it from an environment variable and add the variable name to .env.example with an empty value.');
     }
   }

package/.claude/hooks/messages.mjs

@@ -391,6 +391,12 @@ export const MESSAGES = {
   'guard.destructive.pushMain': { en: 'Direct push to the main branch' },
   'guard.destructive.rewriteHistory': { en: 'Git history is being rewritten' },
   'guard.destructive.migration': { en: 'A migration is being applied (check the target environment)' },
+  'guard.destructive.resourceDelete': { en: 'A cluster resource, deployment, domain or environment variable is being deleted' },
+  'guard.destructive.publish': { en: 'A package or a release is being published (or unpublished)' },
+  'guard.destructive.branchDelete': { en: 'The main branch is being deleted' },
+  'guard.destructive.dockerPrune': { en: 'Every unused Docker image is being deleted' },
+  'guard.destructive.tooLong': { en: 'The command is too long for the shield to check ({length} characters)' },
+  'guard.destructive.tooLongWord': { en: 'The command is too long for the shield to check ({length} characters) and contains "{word}"' },
   'guard.destructive.remoteDb': { en: 'The command connects to a database other than localhost (could be prod). User approval required; the AI must not use prod access credentials.' },
   'guard.destructive.testShell': { en: 'A test file is being changed, moved or deleted with a shell command. Weakening a test to make it pass is forbidden (AGENTS.md rule 7); edit tests with a file tool. User approval required.' },
   'guard.destructive.inlineTest': { en: 'An inline script names a test path; it may write to a test file. Only the test-writer agent writes to test files (AGENTS.md rule 7). User approval required.' },
@@ -449,8 +455,14 @@ export const MESSAGES = {
   'guard.package.depFileUnclear': { en: 'Package gate: the new dependencies in {path} could not be read (the file does not parse or the edit cannot be placed). User approval required.' },
   'guard.package.error': { en: 'The package gate could not check this command ({error}). User approval required.' },
   'guard.package.ask': { en: 'Package gate warning: {list}. Before installing, make sure the package is really the one you want.' },
+  'guard.package.notRegistry': { en: 'not from the public registry ({source}); the gate cannot check it' },
+  'guard.package.otherEco': { en: 'the gate does not check the {eco} registry' },
+  'guard.package.configFile': { en: 'Package gate: {path} sets where packages are installed from (registry, index or credentials). User approval required.' },
   'guard.structure.offMap': { en: '"{rel}" is not in the structure map (.claude/structure.json). The right place is probably one of: {top}. If it is temporary or a trial, write it under sandbox/. If a new permanent place is needed, ask it as a technical decision and update the map (docs/architecture/structure.md).' },
   'guard.structure.prefix': { en: 'Structure: {reason}' },
+  'guard.structure.longPath': { en: 'A path of {length} characters is not checked against the structure map (over 1024). User approval required.' },
+  'guard.structure.brokenMap': { en: '.claude/structure.json does not parse, so "{rel}" cannot be checked against the map. Fix the map (it is JSON) or approve this file.' },
+  'guard.structure.clutterShell': { en: 'The command creates "{rel}", which matches a clutter pattern (backup, old version, copy or temp file). Git history is already the backup; use sandbox/ for experiments. User approval required.' },
   'guard.test.skip': { en: 'a test is skipped or focused alone (.skip / .only / skipIf / xit / pytest skip)' },
   'guard.test.expectRemoved': { en: 'an expectation (expect/assert) is deleted or commented out' },
   'guard.test.expectWeak': { en: 'an expectation is loosened (toBeTruthy, toBeDefined, expect.anything, expect without a matcher, assert True)' },

package/.claude/hooks/package-gate.mjs

@@ -30,9 +30,57 @@ const COMMANDS = [
   [/^(npm|pnpm|bun)\s+(i|in|ins|inst|insta|instal|install|isnt|isnta|isntal|isntall|it|add)\b/i, 'npm'], [/^yarn\s+(global\s+)?add\b/i, 'npm'], [/^(npx\s+)?expo\s+install\b/i, 'npm'],
   // create/init <name> downloads and runs create-<name>; deno takes npm:<name> specifiers
   [/^(npm|pnpm|yarn|bun)\s+(create|init)\b/i, 'npm', 'create'], [/^deno\s+(add|install|run|x)\b/i, 'npm', 'deno'],
-  [/^uv\s+(add|pip\s+install|tool\s+install)\b/i, 'pypi'], [/^((python[\d.]*|py)(\s+-\d[\d.]*)?\s+-m\s+)?pip[\d.]*(\s+-\S+)*\s+install\b/i, 'pypi'],
+  // pip's own options can come before install, with a value (pip --index-url URL install x, pip --proxy P install x)
+  [/^uv\s+(add|pip\s+install|tool\s+install)\b/i, 'pypi'], [/^((python[\d.]*|py)(\s+-\d[\d.]*)?\s+-m\s+)?pip[\d.]*(\s+-\S+(\s+(?!install\b)[^\s-]\S*)?)*\s+install\b/i, 'pypi'],
   [/^(poetry|pdm)\s+add\b|^(pipenv|pipx)\s+install\b/i, 'pypi'],
+  // Registries the gate does not query: every package named there is asked (user decision 2026-10-30)
+  [/^cargo(\s+-\S+)*\s+(\+\S+\s+)?(add|install)\b/i, 'cargo'], [/^go\s+(get|install)\b/i, 'go'], [/^(gem\s+install|bundle\s+add)\b/i, 'gem'],
+  [/^composer\s+(global\s+)?require\b/i, 'composer'],
 ];
+const OTHER_VALUE = /^(--path|--version|--vers|--features|-F|--rename|--package|-p|--branch|--tag|--rev|--registry|--index|--root|--target|--profile|-C|--manifest-path|-v|-i|--install-dir|-n|--bindir|--source|-s|--git|-j|--jobs)$/;
+
+// Where an install argument comes from: 'local' (a path or file: link, already on this machine), 'remote' (git, a URL, a
+// GitHub shorthand user/repo: not the registry the gate checks, user decision 2026-10-30), or null (a registry name).
+// ~ is a path only as ~/ or ~\ (~1.2.3 is a semver range)
+const LOCAL = /^(\.{1,2}([\\/]|$)|[\\/]|~([\\/]|$)|[A-Za-z]:[\\/]|file:|link:|workspace:|portal:)/i;
+const REMOTE = /^(git\+|git:|ssh:|https?:|github:|gitlab:|bitbucket:|gist:)/i;
+function npmSource(arg) {
+  for (;;) {
+    if (LOCAL.test(arg)) return 'local';
+    if (REMOTE.test(arg)) return 'remote';
+    const at = arg.indexOf('@', 1), spec = at > 0 ? arg.slice(at + 1) : '';
+    if (spec.startsWith('npm:')) { arg = spec.slice(4); continue; }
+    if (LOCAL.test(spec)) return 'local';
+    if (/[:/]/.test(spec)) return 'remote';
+    return !arg.startsWith('@') && arg.includes('/') ? 'remote' : null;
+  }
+}
+function pypiSource(arg) {
+  if (LOCAL.test(arg)) return 'local';
+  if (REMOTE.test(arg)) return 'remote';
+  const ref = arg.match(/^[^@;]*@\s*(\S+)/)?.[1];
+  if (ref) return LOCAL.test(ref) ? 'local' : 'remote';
+  return /\.(whl|tar\.gz|zip)$/i.test(arg) ? 'local' : null;
+}
+// A registry other than the public one: what gets installed cannot be checked. Read on the whole command, so a variable
+// exported in an earlier statement (export PIP_INDEX_URL=…; pip install x) or a bare npm ci --registry … counts too.
+// FLAG counts when the command runs a package manager; CONFIG (config set, a write to a registry config file) always.
+// npm accepts an unambiguous prefix of a flag (--regist=…). Gaps are bounded: the text is linear to scan.
+const MANAGER = /\b(npm|pnpm|yarn|bun|npx|bunx|pnpx|pip[\d.]*|uv|uvx|poetry|pdm|pipenv|pipx)\b/i;
+// Registry config files: writing one points installs elsewhere (the file tools ask too, see gate())
+export const REGISTRY_CONFIG = /(^|[\\/])(\.npmrc|\.yarnrc(\.yml)?|\.pnpmrc|bunfig\.toml|pip\.conf|pip\.ini|uv\.toml|poetry\.toml|\.pypirc)$/i;
+const CONFIG_WRITE = /(>{1,2}|\b(tee|cp|copy|mv|move|ln|Set-Content|Add-Content|Out-File|Copy-Item|Move-Item|New-Item)\b[^;&|\n]{0,1000}?)\s*(-\w+\s+)?['"]?[^\s'";&|<>]*(\.npmrc|\.yarnrc(\.yml)?|\.pnpmrc|bunfig\.toml|pip\.conf|pip\.ini|uv\.toml|poetry\.toml|\.pypirc)(?![\w.-])/i;
+const OTHER_REGISTRY = {
+  npm: {
+    FLAG: /(^|[\s'"])--((@[\w.-]+:)?reg[a-z]*|userconfig)(?:(?:=|\s+)\S*|$)|\b(npm_config_(@[\w.-]+:)?registry|npm_config_userconfig|YARN_NPM_REGISTRY_SERVER|YARN_REGISTRY)\s*=\S*/i,
+    CONFIG: new RegExp(`\\b(npm|pnpm|yarn|bun)\\b[^;&|\\n]{0,200}\\bset\\b[^;&|\\n]{0,200}(registry|RegistryServer)\\S*(\\s+\\S+)?|${CONFIG_WRITE.source}`, 'i'),
+  },
+  pypi: {
+    FLAG: /(^|[\s'"])(--(extra-)?index-url|--index|--default-index|--find-links)(?:(?:=|\s+)\S*|$)|\b(PIP_(EXTRA_)?INDEX_URL|PIP_FIND_LINKS|PIP_CONFIG_FILE|UV_(EXTRA_)?INDEX(_URL)?|UV_DEFAULT_INDEX|UV_FIND_LINKS|UV_CONFIG_FILE)\s*=\S*/i,
+    CONFIG: /\bpip[\d.]*\b[^;&|\n]{0,200}\bconfig\b[^;&|\n]{0,200}\bset\b[^;&|\n]{0,200}(index-url|find-links|trusted-host)\S*(\s+\S+)?|\bpoetry\s+(source\s+add|config\s+(repositories|http-basic|certificates)\.)\S*(\s+\S+)?/i,
+  },
+};
+const remote = (eco, spec) => ({ eco, name: '', spec, unverifiable: true });
 // create-vite for vite, @scope/create for @scope, @scope/create-x for @scope/x (npm's own mapping)
 function createName(arg) {
   const n = npmName(arg);
@@ -103,7 +151,7 @@ export function normalize(part) {
   return s;
 }
 
-const NOT_REGISTRY = /^(\.|\/|file:|link:|git\+|git:|https?:|github:|workspace:)/;
+const NOT_REGISTRY = /^(\.|\/|~[\\/]|file:|link:|git\+|git:|https?:|github:|workspace:)/;
 function npmName(arg) {
   // name@npm:other installs "other": the alias target is checked (a loop: a deep a@npm:a@npm:… chain must not overflow
   // the stack). name@github:x/y, @https:… are not from the registry (like a bare URL, not checked here).
@@ -123,18 +171,37 @@ function pypiName(arg) {
 
 export function findPackages(command) {
   const result = [];
+  for (const [eco, { FLAG, CONFIG }] of Object.entries(OTHER_REGISTRY)) {
+    const m = command.match(CONFIG) ?? (MANAGER.test(command) ? command.match(FLAG) : null);
+    if (m) result.push(remote(eco, m[0].trim().replace(/^['"]+|['";]+$/g, '')));
+  }
   // Every place a new command can start: chains, a newline, a background &, $( ), backticks, ( ) and { } groups.
-  // A redirect's & (2>&1, &>) is not a separator.
-  for (const part of command.split(/\n|&&|\|\||;|\||(?<![>&])&(?![>&])|\$\(|`|[(){}]/)) {
+  // A redirect's & (2>&1, &>) is not a separator. A # comment is not an argument.
+  for (const raw of command.split(/\n|&&|\|\||;|\||(?<![>&])&(?![>&])|\$\(|`|[(){}]/)) {
+    // A # comment ends the part only outside quotes and after an unescaped blank (--prefix "a #b", a\ #b are values)
+    const cut = raw.replace(/"(?:[^"\\]|\\.)*"?|'[^']*'?|\\[\s\S]/g, (q) => '_'.repeat(q.length)).search(/(^|\s)#/);
+    const part = cut < 0 ? raw : raw.slice(0, cut);
     const s = normalize(part);
     const match = COMMANDS.find(([re]) => re.test(s));
     const exec = match ? null : EXEC.find((e) => e.re.test(s));
     if (!match && !exec) continue;
     const re = match?.[0] ?? exec.re, eco = match?.[1] ?? exec.eco;
-    // Redirects (2>&1, > log, 2>/dev/null, &> x) are not arguments; a quoted "pkg>=1" has no space before ">" and stays
-    const args = s.replace(re, '').replace(/\s+(\d*|&)(>>?|<)(&\d+|\s*[^\s'"]+)/g, '').trim().split(/\s+/).map((x) => x.replace(/^['"(]+|['")]+$/g, '')).filter(Boolean);
+    // Redirects (2>&1, > log, 2>/dev/null, &> x) are not arguments; a quoted "pkg>=1" has no space before ">" and stays.
+    // Words are split like the shell does: a quoted value with spaces ("a #b") is one word
+    const args = (s.replace(re, '').replace(/\s+(\d*|&)(>>?|<)(&\d+|\s*[^\s'"]+)/g, '').trim().match(/(?:[^\s"']+|"[^"]*"?|'[^']*'?)+/g) ?? [])
+      .map((x) => x.replace(/["']/g, '').replace(/^\(+|\)+$/g, '')).filter(Boolean);
+    if (!POPULAR[eco]) {
+      for (let i = 0; i < args.length; i++) {
+        const a = args[i];
+        if (a.startsWith('-')) { if (OTHER_VALUE.test(a) && args[++i] && a === '--git') result.push(remote(eco, args[i])); continue; }
+        if (!LOCAL.test(a)) result.push({ eco, name: a, unverifiable: true });
+      }
+      continue;
+    }
+    const source = eco === 'npm' ? npmSource : pypiSource;
     if (exec) {
       for (const { arg, fromFlag, unsure } of execArgs(args, eco, exec.positional)) {
+        if (source(arg) === 'remote') { result.push(remote(eco, arg)); continue; }
         const name = eco === 'npm' ? npmName(arg) : pypiName(arg);
         if (name) result.push({ eco, name, exec: true, spec: arg, ...(exec.local && !fromFlag && { local: true }), ...(unsure && { unsure: true }) });
       }
@@ -152,9 +219,23 @@ export function findPackages(command) {
     for (let i = 0; i < args.length; i++) {
       const a = args[i];
       if (a.startsWith('-')) {
-        if (/^(-r|--requirement|-e|--editable|-c|--constraint|--index-url|-i|--extra-index-url|--filter|--prefix|--group)$/.test(a)) i++; // flag that takes a value
+        if (eco === 'pypi') {
+          // pip short options take their value attached too: -ihttps://…, -fhttps://…, -egit+https://…, --editable=git+…
+          if (/^-[if]./.test(a)) result.push(remote(eco, a));
+          const v = a.match(/^(?:-[erc]|--(?:editable|requirement|constraint)=)(.+)$/)?.[1];
+          if (v && pypiSource(v) === 'remote') result.push(remote(eco, v));
+        }
+        // npm's -f is --force (no value): the pip-only flags count only for pip
+        if (/^(-r|--requirement|-e|--editable|-c|--constraint|--index-url|-i|--extra-index-url|--filter|--prefix|--group)$/.test(a)
+          || (eco === 'pypi' ? /^(-f|--find-links|--index|--default-index|--trusted-host|--source|-t|--target|--root|--platform|--python-version)$/ : /^--registry$/).test(a)) {
+          const v = args[i + 1];
+          // -e git+https://…, -r https://… install from a source the gate cannot check; so do -i/-f
+          if (eco === 'pypi' && v && (/^(-[if])$/.test(a) || (/^(-e|--editable|-r|--requirement|-c|--constraint)$/.test(a) && pypiSource(v) === 'remote'))) result.push(remote(eco, `${a} ${v}`));
+          i++; // flag that takes a value
+        }
         continue;
       }
+      if (source(a) === 'remote') { result.push(remote(eco, a)); continue; }
       const name = eco === 'npm' ? npmName(a) : pypiName(a);
       if (name) result.push({ eco, name });
     }
@@ -166,41 +247,137 @@ export function findPackages(command) {
 // 2026-10-30), so "edit package.json, then a bare npm ci" cannot skip the gate. null: the result does not parse (asked).
 const DEP_FILE = /(^|\/)(package\.json|pyproject\.toml|requirements[^/]*\.txt|requirements\/[^/]+\.txt)$/i;
 const NPM_SECTIONS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
-// An npm: alias installs its target: "x": "npm:evil@1" adds evil
-const npmDeps = (j) => new Set(NPM_SECTIONS.flatMap((k) => Object.entries(j?.[k] && typeof j[k] === 'object' ? j[k] : {})
-  .map(([n, v]) => (typeof v === 'string' && /^npm:/i.test(v) ? npmName(v.slice(4)) : n))).filter(Boolean));
-const requirementNames = (text) => new Set(text.split(/\r?\n/).map((s) => s.trim())
-  .filter((s) => s && !s.startsWith('#') && !s.startsWith('-')).map(pypiName).filter(Boolean));
-function pyprojectNames(text) {
-  const names = new Set();
-  let section = '', inArray = false;
+const obj = (x) => (x && typeof x === 'object' && !Array.isArray(x) ? x : {});
+// A package name without its version (foo@1.2 → foo, @s/x@1 → @s/x)
+const bare = (n) => n.replace(/(?<=.)@.*$/, '');
+// Override keys: npm overrides nest ({ foo: { ".": "1", bar: "2" } }), yarn resolutions are paths (**/bar, @s/a/b),
+// pnpm.overrides chain names (foo@<2>bar, foo>bar)
+function overrideDeps(o, out) {
+  for (const [k, v] of Object.entries(obj(o))) {
+    if (k === '.') continue;
+    out.push([bare(k), typeof v === 'string' ? v : typeof obj(v)['.'] === 'string' ? v['.'] : '']);
+    if (v && typeof v === 'object') overrideDeps(v, out);
+  }
+}
+function resolutionName(k) {
+  const parts = k.split('/').filter((p) => p && p !== '**');
+  let last = parts.pop() ?? '';
+  if (parts.at(-1)?.startsWith('@')) last = `${parts.pop()}/${last}`;
+  return bare(last);
+}
+// Every npm dependency the file declares, as { name, spec, remote }: an npm: alias names its target ("x": "npm:evil@1" adds evil);
+// a local spec (file:, link:, workspace:) is left out; a git, URL or user/repo spec is remote
+function npmDeps(j) {
+  const pairs = NPM_SECTIONS.flatMap((k) => Object.entries(obj(j?.[k])));
+  overrideDeps(j?.overrides, pairs);
+  for (const [k, v] of Object.entries(obj(j?.resolutions))) pairs.push([resolutionName(k), v]);
+  for (const [k, v] of Object.entries(obj(j?.pnpm?.overrides))) for (const n of k.split('>')) pairs.push([bare(n), n === k.split('>').at(-1) ? v : '']);
+  const out = [];
+  for (const [n, v] of pairs) {
+    const spec = typeof v === 'string' ? v : '';
+    // pnpm catalog: and yarn patch: resolve to the registry package of the same name
+    const arg = /^npm:/i.test(spec) ? spec.slice(4) : spec && !/^(catalog|patch):/i.test(spec) ? `${n}@${spec}` : n;
+    const source = npmSource(arg);
+    if (source === 'remote') out.push({ name: n, spec, remote: true });
+    else if (!source && !/^\$/.test(spec)) { const name = npmName(arg); if (name) out.push({ name, spec }); }
+  }
+  return out;
+}
+// requirements lines: a name, a git/URL line or an index/find-links option (remote), local paths and -r/-c are left out
+function requirementDeps(text) {
+  const out = [];
   for (const raw of text.split(/\r?\n/)) {
+    const s = raw.replace(/(^|\s)#.*$/, '').trim();
+    if (!s) continue;
+    // Short options may carry their value attached (-ihttps://…, -egit+https://…)
+    const opt = s.match(/^(--editable|--index-url|--extra-index-url|--find-links|--requirement|--constraint|-[eifrc])(?:=|\s+)?(.*)$/);
+    if (opt) {
+      if (/^(-[if]|--index-url|--extra-index-url|--find-links)$/.test(opt[1]) || pypiSource(opt[2]) === 'remote') out.push({ name: '', spec: s, remote: true });
+      continue;
+    }
+    if (s.startsWith('-')) continue;
+    out.push(...pep508(s));
+  }
+  return out;
+}
+const pep508 = (s) => {
+  const source = pypiSource(s);
+  if (source === 'remote') return [{ name: pypiName(s.replace(REMOTE, '')) ?? '', spec: s, remote: true }];
+  if (source === 'local') return [];
+  const name = pypiName(s);
+  return name ? [{ name, spec: s }] : [];
+};
+// pyproject.toml, by full dotted key (section + key, so [project] optional-dependencies.dev = […], a top-level
+// project.dependencies = […] and a quoted ["project"] header read the same):
+//   arrays of requirements: PY_ARRAY; one table entry per package (Poetry dependencies, uv sources): PY_TABLE, also as a
+//   sub-table header [tool.poetry.dependencies.x]; a custom index URL ([[tool.uv.index]], [[tool.poetry.source]]): PY_INDEX.
+// Array items are read token by token: a quoted "]" does not end the array, an { include-group = "x" } table is not a
+// name, a # comment ends the line.
+const PY_ARRAY = /^(project\.dependencies|project\.optional-dependencies\.[^.]+|dependency-groups\.[^.]+|tool\.uv\.(dev|constraint|override)-dependencies|build-system\.requires|tool\.pdm\.dev-dependencies\.[^.]+|tool\.hatch\.envs\.[^.]+\.(extra-)?dependencies)$/;
+const PY_TABLE = /^(tool\.poetry(\.group\.[^.]+)?\.(dev-)?dependencies|tool\.uv\.sources)\.([^.]+)$/;
+const PY_INDEX = /^(tool\.uv\.index|tool\.poetry\.source|tool\.pdm\.source)\.url$/;
+// A uv source only redirects a declared package: it adds no name, only a remote spec
+const tableEntry = (full, value) => {
+  const t = full.match(PY_TABLE), name = t?.[4].toLowerCase();
+  if (!t || name === 'python') return [];
+  if (/\b(git|url)\s*=/.test(value)) return [{ name, spec: value, remote: true }];
+  return /\bpath\s*=/.test(value) || t[1] === 'tool.uv.sources' ? [] : [{ name, spec: '' }];
+};
+function pyprojectDeps(text) {
+  const out = [];
+  let section = '', inArray = false, table = null;
+  // [tool.poetry.dependencies.x] declares x with its keys on the next lines: decided when the section ends
+  const flush = () => { if (table !== null) out.push(...tableEntry(section, table)); table = null; };
+  for (const raw of [...text.split(/\r?\n/), '[]']) {
     const line = raw.trim();
-    const head = line.match(/^\[([^\]"']+)\]$/);
-    if (head) { section = head[1].trim(); inArray = false; continue; }
-    if (section === 'project') {
-      if (/^dependencies\s*=\s*\[/.test(line)) inArray = true;
-      if (!inArray) continue;
-      for (const m of line.matchAll(/["']([^"']+)["']/g)) { const n = pypiName(m[1]); if (n) names.add(n); }
-      if (line.includes(']')) inArray = false;
-    } else if (/^tool\.poetry(\.group\.[\w-]+)?\.(dev-)?dependencies$/.test(section)) {
-      const k = line.match(/^["']?([A-Za-z0-9][\w.-]*)["']?\s*=/);
-      if (k && k[1].toLowerCase() !== 'python') names.add(k[1].toLowerCase());
+    const head = inArray ? null : line.match(/^\[\[?([^\]]*)\]\]?$/);
+    if (head) {
+      flush();
+      section = head[1].replace(/["'\s]/g, '');
+      if (PY_TABLE.test(section)) table = '';
+      continue;
+    }
+    let rest = line;
+    if (!inArray) {
+      const key = line.match(/^((?:"[^"]*"|'[^']*'|[\w.-]+)(?:\s*\.\s*(?:"[^"]*"|'[^']*'|[\w.-]+))*)\s*=\s*(.*)$/);
+      if (!key) continue;
+      const k = key[1].replace(/["'\s]/g, ''), full = section ? `${section}.${k}` : k, value = key[2];
+      if (PY_ARRAY.test(full) && value.startsWith('[')) { inArray = true; rest = value.slice(1); }
+      else {
+        if (PY_TABLE.test(full)) out.push(...tableEntry(full, value));
+        else if (table !== null && /^(git|url|path)$/.test(k)) table += ` ${k} = ${value}`;
+        else if (PY_INDEX.test(full)) out.push({ name: '', spec: value, remote: true });
+        continue;
+      }
+    }
+    for (const [tok] of rest.matchAll(/"(?:[^"\\]|\\.)*"|'[^']*'|\{[^}]*\}?|\]|#.*$/g)) {
+      if (tok === ']') { inArray = false; break; }
+      if (tok.startsWith('#')) break;
+      if (tok.startsWith('{')) continue;
+      out.push(...pep508(tok.slice(1, -1)));
     }
   }
-  return names;
+  return out;
 }
+// What the write adds: a registry name not declared before (a version change is not checked), or a remote spec not there
+// before (asked, never checked). Returns [{ eco, name, spec?, unverifiable? }] or null when the result does not parse.
 export function addedDependencies(file, before, after) {
   const rel = file.replace(/\\/g, '/');
-  const added = (eco, a, b) => [...a].filter((n) => !b.has(n)).map((name) => ({ eco, name }));
+  const added = (eco, a, b) => {
+    const names = new Set(b.filter((d) => !d.remote).map((d) => d.name)), specs = new Set(b.map((d) => `${d.name}\0${d.spec}`));
+    const seen = new Set();
+    return a.filter((d) => (d.remote ? !specs.has(`${d.name}\0${d.spec}`) : !names.has(d.name)))
+      .filter((d) => { const k = `${d.remote}\0${d.name}\0${d.remote ? d.spec : ''}`; return !seen.has(k) && seen.add(k); })
+      .map((d) => (d.remote ? { eco, name: d.name, spec: d.spec, unverifiable: true } : { eco, name: d.name }));
+  };
   if (/(^|\/)package\.json$/i.test(rel)) {
     let a, b = {};
     try { a = JSON.parse(after); } catch { return null; }
     try { b = JSON.parse(before || '{}'); } catch { /* a broken file before: every name counts as added */ }
     return added('npm', npmDeps(a), npmDeps(b));
   }
-  if (/(^|\/)requirements[^/]*\.txt$|(^|\/)requirements\/[^/]+\.txt$/i.test(rel)) return added('pypi', requirementNames(after), requirementNames(before));
-  if (/(^|\/)pyproject\.toml$/i.test(rel)) return added('pypi', pyprojectNames(after), pyprojectNames(before));
+  if (/(^|\/)requirements[^/]*\.txt$|(^|\/)requirements\/[^/]+\.txt$/i.test(rel)) return added('pypi', requirementDeps(after), requirementDeps(before));
+  if (/(^|\/)pyproject\.toml$/i.test(rel)) return added('pypi', pyprojectDeps(after), pyprojectDeps(before));
   return [];
 }
 
@@ -273,6 +450,7 @@ async function gate(g) {
   // Both only for the plain spelling: name@1.2 or name@npm:other downloads, it does not run the local bin or the kit's release
   const packages = findPackages(g.command).filter((p) => !(p.local && p.spec === p.name && bin(p.name)) && !(p.eco === 'npm' && /^tillerhand(@\d+\.\d+\.\d+)?$/.test(p.spec ?? '')));
   for (const f of g.files) {
+    if (REGISTRY_CONFIG.test(String(f.path))) decide(g.tool, 'ask', t(g.root, 'guard.package.configFile', { path: f.path }));
     if (!DEP_FILE.test(String(f.path).replace(/\\/g, '/'))) continue;
     const full = path.resolve(g.dir, f.path);
     let disk = ''; try { disk = fs.readFileSync(full, 'utf8'); } catch { /* new file */ }
@@ -283,14 +461,17 @@ async function gate(g) {
   }
   if (!packages.length) return;
   if (packages.length > MAX_PACKAGES) decide(g.tool, 'ask', t(g.root, 'guard.package.tooMany', { count: packages.length, max: MAX_PACKAGES }));
-  const results = await Promise.all(packages.map(async (p) => ({ ...p, ...(await check(p)) })));
+  // A remote source or a registry the gate does not query is asked as is, without a fetch
+  const results = await Promise.all(packages.map(async (p) => ({ ...p, ...(p.unverifiable
+    ? { status: 'unverifiable', detail: POPULAR[p.eco] ? t(g.root, 'guard.package.notRegistry', { source: p.spec || p.name }) : t(g.root, 'guard.package.otherEco', { eco: p.eco }) }
+    : await check(p)) })));
   const missing = results.filter((s) => s.status === 'missing' && !s.unsure);
   if (missing.length) {
     decide(g.tool, 'deny', `Package gate: ${missing.map((s) => `${s.name} (${s.detail})`).join(', ')}. This name may be made up. Find the correct package name in the official docs; tell the user.`);
   }
   const suspect = results.filter((s) => s.status !== 'ok');
   if (suspect.length) {
-    decide(g.tool, 'ask', t(g.root, 'guard.package.ask', { list: suspect.map((s) => `${s.eco}:${s.name} — ${s.detail}`).join('; ') }));
+    decide(g.tool, 'ask', t(g.root, 'guard.package.ask', { list: suspect.map((s) => `${s.eco}:${s.name || s.spec} — ${s.detail}`).join('; ') }));
   }
   process.exit(0);
 }

package/.claude/hooks/shared.mjs

@@ -97,7 +97,8 @@ export function parseInput(g) {
   }
   const t = g.tool_input ?? {};
   const command = isText(t.command) ? t.command : Array.isArray(t.command) ? t.command.join(' ') : t.command == null ? '' : JSON.stringify(t.command);
-  if (g.tool_name === 'apply_patch') result.files = patchFiles(command);
+  // Codex can pass the patch text in tool_input.input instead of command
+  if (g.tool_name === 'apply_patch') result.files = patchFiles(command || (isText(t.input) ? t.input : t.input == null ? '' : JSON.stringify(t.input)));
   else result.command = command;
   const file = t.file_path ?? t.notebook_path;
   if (file) {

package/.claude/hooks/structure-guard.mjs

@@ -27,19 +27,25 @@ export function globRegex(pattern) {
 }
 
 export function readMap(dir = root) {
+  let text;
+  try { text = fs.readFileSync(path.join(dir, '.claude', 'structure.json'), 'utf8'); } catch { return null; }
+  // A map that exists but does not parse must not switch the guard off: every new file is asked
   try {
-    const m = JSON.parse(fs.readFileSync(path.join(dir, '.claude', 'structure.json'), 'utf8'));
+    const m = JSON.parse(text);
     return { allow: (m.allow ?? []).map(globRegex), deny: (m.deny ?? []).map(globRegex), raw: m };
   } catch {
-    return null;
+    return { broken: true };
   }
 }
 
 // Returns: null (fine) | { decision: 'deny' | 'ask', reason }
 export function check(rel, map) {
   if (!map) return null;
+  // The globs are not linear in the path length: a very long path is asked, not matched
+  if (rel.length > 1024) return { decision: 'ask', reason: t(root, 'guard.structure.longPath', { length: rel.length }) };
   rel = rel.replace(/\\/g, '/').replace(/^\.\//, '');
   if (rel.startsWith('sandbox/')) return null;
+  if (map.broken) return { decision: 'ask', reason: t(root, 'guard.structure.brokenMap', { rel }) };
   const denied = map.deny.find((re) => re.test(rel));
   if (denied) {
     return { decision: 'deny', reason: `"${rel}" matches a clutter pattern (backup, old version, copy or temp file). Git history is already the backup; use sandbox/ for experiments.` };
@@ -52,6 +58,46 @@ export function check(rel, map) {
   };
 }
 
+// Shell side, clutter only: a file a command creates that does not exist yet (a redirect target, the destination of
+// cp/mv/copy/ln, the arguments of tee, touch, New-Item, Out-File, Set-Content) is checked against the deny list.
+// Asked, not denied: the shell text is read by heuristics. Off-map files are not asked here (the Write hook does that).
+// No map or a broken map: silent.
+// shortcut: text-based (quoted words, variables, globs and bash -c bodies are skipped; cd followed in order only).
+const CREATORS = /^(cp|copy|mv|move|ln|copy-item|move-item|cpi|mi)$/;
+const MAKERS = /^(tee|touch|new-item|ni|out-file|set-content|add-content)$/;
+const PREFIX = /^(\w+=\S*|sudo|env|time|nohup|command|exec|do|then|else)$/i;
+const HIDDEN = ' <>;&|#=()\n';
+export function clutterIssue(command, dir, root) {
+  const map = readMap(root);
+  if (!map || map.broken) return null;
+  // Text is not a target: a heredoc body goes (its first line, with its redirects, stays); a quoted string becomes one
+  // word, its blanks and shell characters hidden in private-use characters (U+E000…) until it is used as a path, so
+  // "a > b.bak" is no redirect but "a (1).ts" is still a name; arrows (=>, ->) go; >| >& &> are plain redirects
+  const text = command.replace(/(<<-?\s*(['"]?)(\w+)\2[^\n]*)\n[\s\S]*?\n[ \t]*\3[ \t]*(?=\n|$)/g, '$1')
+    .replace(/"(?:[^"\\]|\\.)*"|'[^']*'/g, (q) => q.slice(1, -1).replace(/[\s<>;&|#=()]/g, (c) => String.fromCharCode(0xe000 + HIDDEN.indexOf(c === '\t' ? ' ' : c))))
+    .replace(/[=-]>/g, ' ').replace(/\d*>&\d+/g, ' ').replace(/>\||>&|&>/g, '>');
+  let cwd = dir;
+  for (const raw of text.split(/&&|\|\||[;|\n&]/)) {
+    const part = raw.replace(/(^|\s)#.*$/, '').replace(/^[\s({!]+|[\s)}]+$/g, '');
+    const redirects = [...part.matchAll(/\d?>{1,2}\s*([^\s;&|<>]+)/g)].map((m) => m[1]);
+    const words = part.replace(/\d?>{1,2}\s*\S+/g, ' ').trim().split(/\s+/);
+    while (words.length && PREFIX.test(words[0])) words.shift();
+    const name = path.basename(words[0] ?? '').toLowerCase().replace(/\.(exe|cmd)$/, '');
+    const dest = words.findIndex((w) => /^-destination$/i.test(w));
+    const args = words.slice(1).filter((w) => w && !w.startsWith('-'));
+    if (/^(cd|pushd|set-location)$/.test(name)) { cwd = path.resolve(cwd, args[0] ?? '.'); continue; }
+    const made = CREATORS.test(name) ? (dest > -1 ? [words[dest + 1] ?? ''] : args.slice(-1)) : MAKERS.test(name) ? args : [];
+    for (const w of [...redirects, ...made]) {
+      if (!w || /[$`*?{]/.test(w)) continue;
+      const x = w.replace(/[-]/g, (c) => HIDDEN[c.charCodeAt(0) - 0xe000]);
+      const full = path.resolve(cwd, x), rel = path.relative(root, full);
+      if (rel.startsWith('..') || path.isAbsolute(rel) || fs.existsSync(full)) continue;
+      if (check(rel, map)?.decision === 'deny') return { decision: 'ask', reason: t(root, 'guard.structure.clutterShell', { rel: rel.replace(/\\/g, '/') }) };
+    }
+  }
+  return null;
+}
+
 function hook() {
   const g = readInput();
   if (!g) process.exit(0);
@@ -70,6 +116,7 @@ function hook() {
 function checkAll() {
   const map = readMap();
   if (!map) { console.log('No structure map (.claude/structure.json); check skipped.'); return; }
+  if (map.broken) { console.error('.claude/structure.json does not parse (it must be JSON); the structure cannot be checked.'); process.exit(1); }
   const files = execFileSync('git', ['ls-files'], { cwd: root, encoding: 'utf8' }).split('\n').filter(Boolean);
   const violations = files.map((f) => [f, check(f, map)]).filter(([, s]) => s);
   if (!violations.length) { console.log(`Structure OK: ${files.length} files.`); return; }

package/.claude/i18n/tr.json

@@ -388,6 +388,12 @@
   "guard.destructive.pushMain": "Ana dala doğrudan push",
   "guard.destructive.rewriteHistory": "Git geçmişi yeniden yazılıyor",
   "guard.destructive.migration": "Migration uygulanıyor (hedef ortamı kontrol et)",
+  "guard.destructive.resourceDelete": "Bir küme kaynağı, deploy, alan adı ya da ortam değişkeni siliniyor",
+  "guard.destructive.publish": "Bir paket ya da sürüm yayımlanıyor (ya da yayından kaldırılıyor)",
+  "guard.destructive.branchDelete": "Ana dal siliniyor",
+  "guard.destructive.dockerPrune": "Kullanılmayan bütün Docker imajları siliniyor",
+  "guard.destructive.tooLong": "Komut kalkanın denetlemesi için fazla uzun ({length} karakter)",
+  "guard.destructive.tooLongWord": "Komut kalkanın denetlemesi için fazla uzun ({length} karakter) ve \"{word}\" içeriyor",
   "guard.destructive.remoteDb": "Komut localhost dışındaki bir veritabanına bağlanıyor (prod olabilir). Kullanıcı onayı gerekli; AI prod erişim bilgisi kullanmamalı.",
   "guard.destructive.testShell": "Test dosyası kabuk komutuyla değiştiriliyor, taşınıyor veya siliniyor. Testi geçirmek için testi zayıflatmak yasak (AGENTS.md kural 7); test düzenlemesini dosya aracıyla yap. Kullanıcı onayı gerekli.",
   "guard.destructive.inlineTest": "Satır içi betik bir test yolunu anıyor; test dosyasına yazıyor olabilir. Test dosyasına yalnız test-writer ajanı yazar (AGENTS.md kural 7). Kullanıcı onayı gerekli.",
@@ -446,8 +452,14 @@
   "guard.package.depFileUnclear": "Paket kapısı: {path} içindeki yeni bağımlılıklar okunamadı (dosya ayrıştırılamıyor ya da düzenleme yerleştirilemiyor). Kullanıcı onayı gerekli.",
   "guard.package.error": "Paket kapısı bu komutu denetleyemedi ({error}). Kullanıcı onayı gerekli.",
   "guard.package.ask": "Paket kapısı uyarısı: {list}. Kurmadan önce paketin gerçekten istenen paket olduğundan emin ol.",
+  "guard.package.notRegistry": "açık kayıt dışından ({source}); kapı bunu denetleyemez",
+  "guard.package.otherEco": "kapı {eco} kaydını denetlemez",
+  "guard.package.configFile": "Paket kapısı: {path} paketlerin nereden kurulacağını belirliyor (kayıt, dizin ya da kimlik bilgisi). Kullanıcı onayı gerekli.",
   "guard.structure.offMap": "\"{rel}\" yapı haritasında yok (.claude/structure.json). Doğru yer muhtemelen şunlardan biri: {top}. Geçici veya deneme ise sandbox/ altına yaz. Kalıcı yeni bir yer gerekiyorsa bunu teknik karar olarak sor ve haritayı güncelle (docs/architecture/structure.md).",
   "guard.structure.prefix": "Yapı: {reason}",
+  "guard.structure.longPath": "{length} karakterlik bir yol yapı haritasıyla denetlenmez (1024 üstü). Kullanıcı onayı gerekli.",
+  "guard.structure.brokenMap": ".claude/structure.json ayrıştırılamıyor, bu yüzden \"{rel}\" haritayla denetlenemiyor. Haritayı düzelt (JSON) ya da bu dosyayı onayla.",
+  "guard.structure.clutterShell": "Komut \"{rel}\" dosyasını oluşturuyor; bu bir dağınıklık desenine uyuyor (yedek, eski sürüm, kopya ya da geçici dosya). Git geçmişi zaten yedek; denemeler için sandbox/ kullan. Kullanıcı onayı gerekli.",
   "guard.test.skip": "test atlanıyor veya tek teste odaklanıyor (.skip / .only / skipIf / xit / pytest skip)",
   "guard.test.expectRemoved": "beklenti (expect/assert) siliniyor veya yoruma alınıyor",
   "guard.test.expectWeak": "beklenti gevşetiliyor (toBeTruthy, toBeDefined, expect.anything, matcher'sız expect, assert True)",

package/AGENTS.md

@@ -37,7 +37,7 @@ The kit was written for Claude Code; these equivalents apply in these two tools:
 - **Wherever AskUserQuestion appears:** in Antigravity, the `ask_question` tool. If there is no question tool with options (Codex), write the options as a numbered list, put the recommended one first and mark it "(Recommended)", then wait for the answer. The decision is still the user's.
 - **Subagents** (board members, council, review agents in `.claude/agents/`): If you cannot run them, read the matching definition, assess as that role yourself and state "single model" in the report. The test separation (rule 7) cannot be enforced here by a hook: write the tests with the `test-writer` definition, before you think about the code, and show the red run; do not change the test file while writing the code.
 - **Model and effort** (`docs/workflow/models.md`): Start the subagent with the role's equivalent (Codex: model and reasoning effort in the prompt; Antigravity: `inherit`, `flash` or `pro`). If you cannot, run the role yourself and suggest the model in text.
-- **Protections** (secret block, destructive command shield, structure guard, edit lock, test protection, edit round counter, package gate and the equivalent of the Claude Code permission list) run as hooks: Codex `.codex/hooks.json`, Antigravity `.agents/hooks.json`. Writing to rule and protection files (`AGENTS.md`, `.claude/`, `.codex/`, `.agents/hooks.json`) needs approval. Do not try another route (for example a shell command) around a blocked action; tell the user why. Known limits: the commit gate (`commit-gate.mjs`, gate and board approval before a commit) is not wired in these tools, so before every commit run `node .claude/hooks/gate.mjs --run` and the board review yourself and commit only on GREEN; the shell rules read the command text and can miss unusual spellings.
+- **Protections** (secret block, destructive command shield, structure guard, edit lock, test protection, edit round counter, package gate, commit gate and the equivalent of the Claude Code permission list) run as hooks: Codex `.codex/hooks.json`, Antigravity `.agents/hooks.json`. Writing to rule and protection files (`AGENTS.md`, `.claude/`, `.codex/`, `.agents/hooks.json`) needs approval. Do not try another route (for example a shell command) around a blocked action; tell the user why. The commit gate stops a commit until `node .claude/hooks/gate.mjs --run` is green and the board review (you, as the relevant members) is approved with `commit-gate.mjs --approve`; it does not check who wrote a test file there. Known limit: the shell rules read the command text and can miss unusual spellings.
 - Skills that belong to Claude Code plugins (named `plugin:skill`) do not exist in these tools: skip that step. There is also no limit reading and no status line: the limit stays "-" in the status block.
 <!-- /kit:other-tools -->
 

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.11-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.50.0-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">
@@ -236,8 +236,8 @@ A new file outside the map is asked about, clutter like `*.bak` and `*-old.*` is
 | Guardrail | What it does |
 |---|---|
 | Secret guard | Blocks API keys written into code or docs |
-| Destructive-command shield | Blocks `DROP`, unconditional `DELETE`, `db reset`; asks before prod deploys and rollbacks |
-| Package gate | Blocks packages that don't exist (on install and on `npx`, `uvx` runs); asks about very new ones or lookalikes of popular ones |
+| Destructive-command shield | Blocks `DROP`, unconditional `DELETE`, `db reset` and cloud data deletion; asks before prod deploys, rollbacks and publishing |
+| Package gate | Blocks packages that don't exist (on install, on `npx`, `uvx` runs and in dependency files); asks about very new ones, lookalikes of popular ones and sources it can't check (git, URLs, other registries) |
 | Structure guard | Asks about files outside the map, blocks clutter files |
 | Test separation | Only the `test-writer` agent writes test files; the main session and the coding agent are blocked |
 | Test guard | Asks before a test is deleted, skipped or weakened |
@@ -277,7 +277,7 @@ Every command, setting, tool and skill is in the **[guide](https://burakdogrul.g
 
 ## Codex and Antigravity
 
-The kit is built for Claude Code; its rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. There the board runs on a single model, and the question UI, status bar and commit gate are not available. These tools don't report which agent is running, so test separation stays a written rule there. Install with `node <kit>/kit/kit.mjs init --tool codex` (or `antigravity`).
+The kit is built for Claude Code; its rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. There the board runs on a single model, and the question UI and status bar are not available; the commit gate works there too. These tools don't report which agent is running, so test separation stays a written rule there. Install with `node <kit>/kit/kit.mjs init --tool codex` (or `antigravity`).
 
 ## Measured
 

package/README.tr.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.11-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.50.0-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">
@@ -236,8 +236,8 @@ Harita dışı yeni dosya sorulur, `*.bak` ve `*-old.*` gibi dağınıklık dosy
 | Katman | Ne yapar |
 |---|---|
 | Sır engeli | Koda veya dokümana yazılan API anahtarını engeller |
-| Yıkıcı komut kalkanı | `DROP`, koşulsuz `DELETE`, `db reset` engellenir; prod deploy ve geri alma sorulur |
-| Paket kapısı | Var olmayan paketi engeller (kurulumda ve `npx`, `uvx` ile çalıştırmada); çok yeni veya popüler bir pakete benzeyeni sorar |
+| Yıkıcı komut kalkanı | `DROP`, koşulsuz `DELETE`, `db reset` ve bulut verisini silmek engellenir; prod deploy, geri alma ve yayımlama sorulur |
+| Paket kapısı | Var olmayan paketi engeller (kurulumda, `npx`, `uvx` ile çalıştırmada ve bağımlılık dosyalarında); çok yeni, popüler bir pakete benzeyen ve denetleyemediği kaynakları (git, URL, başka kayıt) sorar |
 | Yapı koruyucu | Harita dışı dosyayı sorar, dağınıklık dosyalarını engeller |
 | Test ayrımı | Test dosyasına yalnız `test-writer` ajanı yazar; ana oturum ve kod ajanı denerse engellenir |
 | Test koruması | Silinen, atlanan veya gevşetilen testi sorar |
@@ -277,7 +277,7 @@ Tüm komutlar, ayarlar, araçlar ve skill'ler **[rehberde](https://burakdogrul.g
 
 ## Codex ve Antigravity
 
-Kit Claude Code için yazıldı; kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü, durum çubuğu ve commit kapısı bu araçlarda yok. Bu araçlar ajan kimliği bildirmediği için test ayrımı orada kural metninde kalır. Kurulum: `node <kit>/kit/kit.mjs init --tool codex` (veya `antigravity`).
+Kit Claude Code için yazıldı; kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü ve durum çubuğu bu araçlarda yok, commit kapısı orada da çalışır. Bu araçlar ajan kimliği bildirmediği için test ayrımı orada kural metninde kalır. Kurulum: `node <kit>/kit/kit.mjs init --tool codex` (veya `antigravity`).
 
 ## Ölçüm
 

package/kit/CHANGELOG.md

@@ -3,6 +3,27 @@
 The kit version is in `kit/VERSION`. To update a project, run `/kit-update` in it.
 Items with an "Adapt by hand" note concern files owned by the project; the update does not touch them.
 
+## [3.50.0] - 2026-10-30
+
+### Added
+- **The commit gate runs on Codex and Antigravity.** A commit stops there too until the deterministic gate (`gate.mjs --run`) is green and the board review is approved with `commit-gate.mjs --approve`; a commit chained to other commands stops as well. The stop comes as the tool's own decision. Since these tools run one model, the AI reviews the diff as the relevant board members itself. `commit-gate.mjs --skip` and the gate command approval are asked on Antigravity and left to you on Codex (it has no approval prompt). Test separation stays a written rule there: these tools do not report which agent wrote a test file.
+
+### Fixed
+- The cloud deletion rule of the shield no longer slows down on a long repeated command (`aws s3 rm` × 999: 24 ms).
+
+## [3.49.12] - 2026-10-30
+
+### Security
+- **The package gate asks about installs it cannot check.** A git source, a URL or a GitHub shorthand (`npm i github:a/b`, `npm i user/repo`, `pip install git+https://…`, `npx github:a/b`) and a different registry or index (`--registry`, `--@scope:registry`, `--userconfig`, `pip install -i`/`--index-url`/`--extra-index-url`/`--find-links`, attached `-ihttps://…` too, an `npm_config_registry=` or `PIP_INDEX_URL=` set anywhere in the command, `npm config set registry` and `pip config set …index-url` in any spelling, `poetry source add`, a shell write to `.npmrc`, `.yarnrc.yml`, `pip.conf`, `uv.toml`, `poetry.toml`, `.pypirc` or `bunfig.toml`) are asked instead of passing unchecked. Writing one of those registry config files with a file tool is asked too. Local paths (`./lib`, `~/x`, `file:`, `-e .`) stay free.
+- `cargo add`/`install`, `go get`/`install`, `gem install`, `bundle add` and `composer require` are asked: the gate does not query those registries. Local installs (`cargo install --path .`, `go install ./cmd/x`) stay free.
+- **Dependency files:** in `package.json` a dependency whose source changes to git, a URL or `user/repo` is asked, and names added under `overrides`, `resolutions` and `pnpm.overrides` are checked. `pyproject.toml` also reads `[project.optional-dependencies]`, `[dependency-groups]`, `[tool.uv] dev-dependencies`, `[build-system] requires`, PDM and Hatch dependency lists, dotted keys and Poetry sub-tables; a quoted `]` no longer ends the list early; a direct reference (`pkg @ git+https://…`), a Poetry `git`/`url` table, a `[tool.uv.sources]` git source and a custom index (`[[tool.uv.index]]`) are asked. In `requirements*.txt` a git or URL line, an index option and a remote `-r` file are asked.
+- **More cloud deletions are blocked:** `aws s3 rm --recursive`, `aws s3 rb --force`, `aws s3api delete-bucket`, `aws rds delete-db-instance`/`delete-db-cluster`, `aws dynamodb delete-table`, `gcloud projects delete`, `az resource delete`, `aws ec2 terminate-instances`, `gcloud sql`/`compute instances delete`, `gsutil rm -r`, `az group delete`, `heroku apps:destroy`, `fly apps`/`volumes destroy`, `supabase projects delete`, `netlify sites:delete` and `gh repo delete`, also with options before or after the service (`aws --profile x s3 --region r …`, `heroku -a x …`).
+- **More deletions and publishes ask you:** `kubectl delete`, `helm uninstall`, `railway down`, `vercel remove`/`env rm`/`domains rm`, deleting the main branch (`git branch -D main`), `npm`/`pnpm`/`yarn publish` and `unpublish`, with workspace flags too (not `--dry-run`), `npm deprecate`/`dist-tag`, `cargo publish`, `twine upload`, `lerna`/`changeset publish`, `gh release create`/`delete`, `docker system prune -a`; options before the subcommand (`helm -n ns uninstall`) and `.exe`/`.cmd` tool names do not hide them.
+- **Clutter files made from the shell are asked:** `cp a.ts a.bak`, `mv a.ts a-old.ts`, `echo x > notes-old.md`, `tee a.bak`, `Copy-Item a.ts a.bak` meet the same clutter list as the file tools. They are asked rather than blocked, since the shell text is read by heuristics; quoted text, heredocs and arrows (`=>`) are not taken for file names.
+- A shell command over 10 000 characters is not matched as a whole (some shield rules are not linear in the length, and a slow hook holds up the session): its short lines are still checked, so a blocked command stays blocked; otherwise it is asked, naming a guarded word it contains.
+- A `.claude/structure.json` that does not parse no longer switches the structure guard off: new files are asked and `--check` fails. A path over 1024 characters is asked instead of matched.
+- **The secret guard sees keys split across edits:** a key that only appears once a MultiEdit's (or an Antigravity chunk edit's) pieces land in the file is blocked. On Antigravity every tool's arguments are scanned, so a write tool the guard does not know is covered; on Codex a patch passed in `input` instead of `command` is read.
+
 ## [3.49.11] - 2026-10-30
 
 ### Security

package/kit/VERSION

@@ -1 +1 @@
-3.49.11
+3.50.0

package/kit/guide.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.11</b> Starter kit for Claude Code · MIT</span>
+      <span class="pill"><b>v3.50.0</b> Starter kit for Claude Code · MIT</span>
       <h1>The AI builds.<br><em>You steer.</em></h1>
       <p class="sub">TillerHand takes a product from idea to production and maintenance with Claude Code. At every important decision the AI gives you the options, its recommendation and the cost of each option. An expert board reviews the work, and guardrails stop mistakes before they happen.</p>
       <div class="setup">
@@ -941,9 +941,9 @@ npx tillerhand init
     <thead><tr><th>Layer</th><th>What it does</th></tr></thead>
     <tbody>
       <tr><td>Secret block</td><td>Blocks API keys (Anthropic, OpenAI, Stripe, AWS, GitHub, Supabase…) written to code or docs; also scans before a commit</td></tr>
-      <tr><td>Destructive command shield</td><td><code>DROP</code>, <code>TRUNCATE</code>, unconditional <code>DELETE</code>, <code>db reset</code> and pulling prod environment variables onto the machine are blocked; prod deploy, rollback, store submission and migrations are asked</td></tr>
-      <tr><td>Package gate</td><td>A package that is installed, or downloaded and run with <code>npx</code> or <code>uvx</code>, is checked against the registry: if it doesn't exist it is blocked; if it is very new, rarely downloaded or looks like a popular package, it is asked</td></tr>
-      <tr><td>Structure guard</td><td>A new file outside the map is asked; clutter such as <code>*.bak</code>, <code>*-old.*</code>, copies and <code>temp/</code> is blocked</td></tr>
+      <tr><td>Destructive command shield</td><td><code>DROP</code>, <code>TRUNCATE</code>, unconditional <code>DELETE</code>, <code>db reset</code> pulling prod environment variables onto the machine and deleting cloud data (S3 buckets, databases, resource groups, apps, repositories) are blocked; prod deploy, rollback, store submission, migrations, cluster and hosting deletes, package and release publishing and deleting the main branch are asked</td></tr>
+      <tr><td>Package gate</td><td>A package that is installed, or downloaded and run with <code>npx</code> or <code>uvx</code>, is checked against the registry: if it doesn't exist it is blocked; if it is very new, rarely downloaded or looks like a popular package, it is asked. A git or URL source, another registry or index, and cargo, go, gem and composer installs are asked, since they cannot be checked. Dependencies the AI adds to <code>package.json</code>, <code>requirements.txt</code> or <code>pyproject.toml</code> go through the same check</td></tr>
+      <tr><td>Structure guard</td><td>A new file outside the map is asked; clutter such as <code>*.bak</code>, <code>*-old.*</code>, copies and <code>temp/</code> is blocked; made from the shell (<code>cp a.ts a.bak</code>) it is asked</td></tr>
       <tr><td>Config approval</td><td><code>CLAUDE.md</code>, <code>AGENTS.md</code>, <code>.claude/</code>, <code>.codex/</code>, <code>.mcp.json</code> and workflow files don't change without your approval</td></tr>
       <tr><td>Test separation</td><td>The tests are written before the code by a separate agent (<code>test-writer</code>, a different model is recommended), not by whoever writes the code. Nobody but this agent can write to a test file: the main session and the code agent are blocked if they try. A test file changed indirectly by a patch or script also stops at the commit gate. So whoever writes the code can't shape the test to fit their own code</td></tr>
       <tr><td>Test protection</td><td>Deleting or commenting out an assertion, <code>.skip</code>/<code>.only</code>, a loosened assertion, deleting or moving a test file, and narrowing coverage in the test config are asked; so is writing to a test file through the shell</td></tr>
@@ -1137,7 +1137,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <section id="tools">
   <p class="path">With another tool</p>
   <h2>Codex and Antigravity</h2>
-  <p class="lead">TillerHand was written for Claude Code. The rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. The board runs on a single model; the question UI, the status line and the commit gate are not available in these tools.</p>
+  <p class="lead">TillerHand was written for Claude Code. The rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. The board runs on a single model; the question UI and the status line are not available in these tools. The commit gate works there too.</p>
 <pre class="term">npx tillerhand init --tool codex          <span class="c"># or antigravity, or claude,codex</span>
 <span class="c"># add a tool to an existing project</span>
 /kit-update --tool claude,codex</pre>
@@ -1151,7 +1151,8 @@ Next: G-013 password reset · pending decision: email service</pre>
       <tr><td>Questions with options</td><td>AskUserQuestion</td><td>Numbered plain text</td><td>ask_question</td></tr>
       <tr><td>Board and council</td><td>Separate agents and models</td><td>One model takes the roles in turn</td><td>One model</td></tr>
       <tr><td>Test separation</td><td>Enforced by a hook: only test-writer writes to a test file</td><td>A written rule (no agent identity)</td><td>A written rule (no agent identity)</td></tr>
-      <tr><td>Status line, limit, dashboard refresh, commit gate</td><td>Yes</td><td>No</td><td>No</td></tr>
+      <tr><td>Status line, limit, dashboard refresh</td><td>Yes</td><td>No</td><td>No</td></tr>
+      <tr><td>Commit gate</td><td>Yes</td><td>Yes; a stop is a block, the AI reviews as the board itself</td><td>Yes; the AI reviews as the board itself</td></tr>
     </tbody>
   </table></div>
   <div class="note">The commands have a single source (<code>.claude/commands/</code>); the copies under <code>.agents/skills/</code> are generated by <code>init</code>, <code>install</code> and <code>update</code>. Codex runs the project's hooks only when you trust the folder and approve them with <code>/hooks</code>; do this in the first session. On first use, try writing a secret to see the guardrails work.</div>
@@ -1241,7 +1242,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Version 3.49.11 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
+    <span>Version 3.50.0 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
   </div>
 </footer>
 

package/kit/guide.tr.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.11</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.50.0</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="setup">
@@ -944,9 +944,9 @@ npx tillerhand init
     <thead><tr><th>Katman</th><th>Ne yapar</th></tr></thead>
     <tbody>
       <tr><td>Sır engeli</td><td>Koda veya dokümana yazılan API anahtarını (Anthropic, OpenAI, Stripe, AWS, GitHub, Supabase…) engeller; commit öncesi de tarar</td></tr>
-      <tr><td>Yıkıcı komut kalkanı</td><td><code>DROP</code>, <code>TRUNCATE</code>, koşulsuz <code>DELETE</code>, <code>db reset</code> ve prod ortam değişkenlerini makineye çekmek engellenir; prod deploy, geri alma, mağazaya gönderim ve migration sorulur</td></tr>
-      <tr><td>Paket kapısı</td><td>Kurulan ya da <code>npx</code>, <code>uvx</code> ile indirilip çalıştırılan paket kayıt defterinden doğrulanır: yoksa engellenir; çok yeni, az indirilmiş veya popüler bir pakete benziyorsa sorulur</td></tr>
-      <tr><td>Yapı koruyucu</td><td>Harita dışı yeni dosya sorulur; <code>*.bak</code>, <code>*-old.*</code>, kopya ve <code>temp/</code> gibi dağınıklıklar engellenir</td></tr>
+      <tr><td>Yıkıcı komut kalkanı</td><td><code>DROP</code>, <code>TRUNCATE</code>, koşulsuz <code>DELETE</code>, <code>db reset</code> , prod ortam değişkenlerini makineye çekmek ve bulut verisini silmek (S3 kovası, veritabanı, kaynak grubu, uygulama, depo) engellenir; prod deploy, geri alma, mağazaya gönderim, migration, küme ve barındırma silmeleri, paket ve sürüm yayımlama ve ana dalı silmek sorulur</td></tr>
+      <tr><td>Paket kapısı</td><td>Kurulan ya da <code>npx</code>, <code>uvx</code> ile indirilip çalıştırılan paket kayıt defterinden doğrulanır: yoksa engellenir; çok yeni, az indirilmiş veya popüler bir pakete benziyorsa sorulur. Git ya da URL kaynağı, başka bir kayıt ya da dizin ve cargo, go, gem, composer kurulumları denetlenemediği için sorulur. AI'nın <code>package.json</code>, <code>requirements.txt</code> ya da <code>pyproject.toml</code>'a eklediği bağımlılıklar da aynı denetimden geçer</td></tr>
+      <tr><td>Yapı koruyucu</td><td>Harita dışı yeni dosya sorulur; <code>*.bak</code>, <code>*-old.*</code>, kopya ve <code>temp/</code> gibi dağınıklıklar engellenir; kabukta oluşturulursa (<code>cp a.ts a.bak</code>) sorulur</td></tr>
       <tr><td>Yapılandırma onayı</td><td><code>CLAUDE.md</code>, <code>AGENTS.md</code>, <code>.claude/</code>, <code>.codex/</code>, <code>.mcp.json</code> ve iş akışı dosyaları onayın olmadan değişmez</td></tr>
       <tr><td>Test ayrımı</td><td>Testleri kodu yazan değil, ayrı bir ajan (<code>test-writer</code>, farklı model önerilir) koddan önce yazar. Test dosyasına bu ajan dışında kimse yazamaz: ana oturum ve kod ajanı denerse engellenir. Patch veya betikle dolaylı değişen test dosyası da commit kapısında durur. Böylece kodu yazan testi kendi koduna göre şekillendiremez</td></tr>
       <tr><td>Test koruması</td><td>Beklenti silmek veya yoruma almak, <code>.skip</code>/<code>.only</code>, gevşek beklenti, test dosyasını silmek veya taşımak ve test ayarında kapsamı daraltmak sorulur; kabukla test dosyasına yazmak da</td></tr>
@@ -1141,7 +1141,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <section id="araclar">
   <p class="path">Başka araçla</p>
   <h2>Codex ve Antigravity</h2>
-  <p class="lead">TillerHand Claude Code için yazıldı. Kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü, durum çubuğu ve commit kapısı bu araçlarda yok.</p>
+  <p class="lead">TillerHand Claude Code için yazıldı. Kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü ve durum çubuğu bu araçlarda yok. Commit kapısı orada da çalışır.</p>
 <pre class="term">npx tillerhand init --tool codex          <span class="c"># ya da antigravity, ya da claude,codex</span>
 <span class="c"># var olan projeye araç eklemek</span>
 /kit-update --tool claude,codex</pre>
@@ -1155,7 +1155,8 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
       <tr><td>Seçenekli sorular</td><td>AskUserQuestion</td><td>Numaralı düz metin</td><td>ask_question</td></tr>
       <tr><td>Kurul ve konsey</td><td>Ayrı ajanlar ve modeller</td><td>Tek model rolleri sırayla üstlenir</td><td>Tek model</td></tr>
       <tr><td>Test ayrımı</td><td>Hook zorlar: test dosyasına yalnız test-writer yazar</td><td>Kural metinde (ajan kimliği yok)</td><td>Kural metinde (ajan kimliği yok)</td></tr>
-      <tr><td>Durum çubuğu, limit, pano yenileme, commit kapısı</td><td>Var</td><td>Yok</td><td>Yok</td></tr>
+      <tr><td>Durum çubuğu, limit, pano yenileme</td><td>Var</td><td>Yok</td><td>Yok</td></tr>
+      <tr><td>Commit kapısı</td><td>Var</td><td>Var; durdurma engel olarak gelir, AI kurul rollerini kendisi üstlenir</td><td>Var; AI kurul rollerini kendisi üstlenir</td></tr>
     </tbody>
   </table></div>
   <div class="note">Komutların kaynağı tektir (<code>.claude/commands/</code>); <code>.agents/skills/</code> altındaki kopyaları <code>init</code>, <code>install</code> ve <code>update</code> üretir. Codex proje hook'larını sadece klasöre güvendiğinde ve <code>/hooks</code> ile onayladığında çalıştırır; bunu ilk oturumda yap. İlk kullanımda bir sır yazma denemesiyle korumaların çalıştığını gör.</div>
@@ -1245,7 +1246,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Sürüm 3.49.11 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
+    <span>Sürüm 3.50.0 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
   </div>
 </footer>
 

package/kit/tools/antigravity/.agents/hooks.json

@@ -48,7 +48,8 @@
         "hooks": [
           { "type": "command", "command": "node .claude/hooks/guard-secrets.mjs" },
           { "type": "command", "command": "node .claude/hooks/destructive-guard.mjs" },
-          { "type": "command", "command": "node .claude/hooks/package-gate.mjs", "timeout": 30 }
+          { "type": "command", "command": "node .claude/hooks/package-gate.mjs", "timeout": 30 },
+          { "type": "command", "command": "node .claude/hooks/commit-gate.mjs" }
         ]
       }
     ]

package/kit/tools/codex/.codex/hooks.json

@@ -24,7 +24,8 @@
         "hooks": [
           { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-secrets.mjs\"", "commandWindows": "node .claude/hooks/guard-secrets.mjs" },
           { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/destructive-guard.mjs\"", "commandWindows": "node .claude/hooks/destructive-guard.mjs" },
-          { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/package-gate.mjs\"", "commandWindows": "node .claude/hooks/package-gate.mjs", "timeout": 30 }
+          { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/package-gate.mjs\"", "commandWindows": "node .claude/hooks/package-gate.mjs", "timeout": 30 },
+          { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/commit-gate.mjs\"", "commandWindows": "node .claude/hooks/commit-gate.mjs" }
         ]
       }
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.49.11",
+  "version": "3.50.0",
   "description": "Vibe coding kit for Claude Code, Codex and Antigravity: rules, commands, guards and project templates.",
   "license": "MIT",
   "type": "module",