tillerhand 3.49.12 → 3.50.1

package/.claude/hooks/commit-gate.mjs

@@ -3,22 +3,24 @@
 //   PreToolUse (Bash) hook: without review approval it stops the commit with exit code 2 and says what to do.
 //   node .claude/hooks/commit-gate.mjs --approve "<members who took part, or a note>"   binds the approval to the current changes.
 //   node .claude/hooks/commit-gate.mjs --skip "<reason>"   only when the user asks: skips the board and the gate (always asked).
+// Commands that make commits with no working-tree change to review (git merge, git revert…) and git calls the text cannot
+// read ($g commit, git $(echo commit)) have nothing to bind an approval to: the user is asked.
 // Exempt: no board set up, "Commit review: off" in docs/workflow/board.md, or only docs changed.
 // Commits the user makes from their own terminal are not affected (this is a Claude Code hook).
 import fs from 'node:fs';
 import path from 'node:path';
 import crypto from 'node:crypto';
 import { execSync } from 'node:child_process';
-import { findRoot, isMain, reviewOff } from './shared.mjs';
+import { findRoot, isMain, reviewOff, parseInput, decisionText } from './shared.mjs';
 import { t } from './lang.mjs';
-import { unquote } from './destructive-guard.mjs';
+import { unquote, MAX_COMMAND } from './destructive-guard.mjs';
 import { isTestFile, isTestConfig, digest, readRecord } from './test-guard.mjs';
 import { isCodeFile } from './edit-rounds.mjs';
 
 // Project root (the script's location) even when called from a subfolder: approval and gate must not be written elsewhere
 const root = findRoot();
 const approvalFile = path.join(root, '.claude', 'state', 'commit-approval.json');
-const git = (c) => execSync(`git ${c}`, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 });
+const git = (c) => execSync(`git ${c}`, { cwd: root, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024, timeout: 20000 });
 
 // Changes that will go into the commit: staged, unstaged in tracked files (git commit -a) and untracked new
 // files (git add -A && git commit). -z: non-ASCII or spaced paths are not quoted and escaped
@@ -56,8 +58,28 @@ export function changes() {
 export const sinceApproval = (approval, d) => d.files.filter((f) => !approval?.hashes || !Object.hasOwn(approval.hashes, f) || approval.hashes[f] !== d.hashes[f]);
 
 // git's global options may come before commit: git --no-pager commit, git -C x commit, git --git-dir=x commit; git.exe on Windows
-const commitRe = (verbs) => new RegExp(`\\bgit(?:\\.exe)?["']?(?:\\s+(?:-[cC]\\s+\\S+|--?[\\w-]+(?:=\\S+)?))*\\s+(?:${verbs.join('|')})(?=\\s|$|["';&|)])`);
+// Every option has one reading: with two, "-c -c -c …" or "--a --a --a …" backtracks exponentially, and a hook that times out lets the command run.
+const VALUE_OPTIONS = '(?:-[cC]|--(?:git-dir|work-tree|namespace|exec-path|super-prefix|config-env|attr-source))';
+// One shell word: git -C "my dir" commit, git -c user.name='A B' commit, git -C my\ dir commit
+const WORD = `(?:"[^"]*"|'[^']*'|\\\\.|[^\\s"'\\\\])+`;
+const GLOBALS = `(?:\\s+(?:${VALUE_OPTIONS}\\s+${WORD}|(?!${VALUE_OPTIONS}\\s)-[\\w-]+(?:=${WORD})?))*`;
+const VERB_END = '(?=\\s|$|["\';&|)])';
+// i: Windows runs GIT.exe as git. $GIT is a variable, not git by name.
+const commitRe = (verbs) => new RegExp(`(?<!\\$)\\bgit(?:\\.exe)?["']?${GLOBALS}\\s+["']?(?:${verbs.join('|')})${VERB_END}`, 'i');
 const COMMIT = commitRe(['commit']);
+// shortcut: these rules read text, so a quoted mention (grep "git merge") also asks; a script file, xargs git, base64 | sh or a mixed-quote spelling (git -C "a b" c"ommit") is not seen; a git hook would close that.
+const MAKES_COMMITS = ['merge', 'cherry-pick', 'revert', 'am', 'rebase', 'commit-tree', 'fast-import'];
+const OTHER_COMMIT = [
+  // git merge, git $(echo commit), git "$@"
+  commitRe([...MAKES_COMMITS, '[$`%@]\\S*']),
+  // $g commit, $(which git) merge, %g% commit
+  new RegExp(`(?:\\$\\{?\\w+\\}?|\\$\\([^)\\n]{0,200}\\)|\`[^\`\\n]{0,200}\`|%\\w+%)["']?${GLOBALS}\\s+["']?(?:commit|${MAKES_COMMITS.join('|')})${VERB_END}`, 'i'),
+];
+// Backing out makes no commit, but only as a whole command: git merge x # --abort still merges
+const BACK_OUT = new RegExp(`\\bgit(?:\\.exe)?${GLOBALS}\\s+(?:merge|cherry-pick|revert|am|rebase)\\s+--(?:abort|quit)(?=\\s*(?:$|[;&|\\n]))`, 'gi');
+const makesOtherCommit = (command) => OTHER_COMMIT.some((re) => re.test(command.replace(BACK_OUT, '')));
+// These rules are not linear in the length, and a hook that times out lets the command run: a long command that names any of this is asked unread
+const GATE_WORDS = new RegExp(`git|commit|${MAKES_COMMITS.join('|')}|gate\\.mjs`, 'i');
 const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 
 // git aliases that run commit ([alias] ci = commit, cm = !git commit), from git config and from an inline -c alias.x=commit
@@ -174,28 +196,41 @@ export function maskOwnHook(command, dir) {
   });
 }
 
+// Claude Code stops a tool call with exit code 2 and the reason on stderr; Codex and Antigravity get their JSON decision
+// (shared.decisionText; Codex has no ask, so an ask is a deny there and the user runs the command themselves).
+let tool = 'claude';
+const decideOut = (decision, reason) => { console.log(decisionText(tool, decision, reason)); process.exit(0); };
+function stop(reason) {
+  if (tool !== 'claude') decideOut('deny', reason.trim());
+  process.stderr.write(reason);
+  process.exit(2);
+}
+
+const internalError = (e) => t(root, 'guard.commit.internalError', { error: String(e?.message ?? e).slice(0, 200) });
+
 async function hook() {
-  let command = '', dir = root;
+  let raw = '', dir = root;
   try {
-    const input = JSON.parse(fs.readFileSync(0, 'utf8'));
-    // A backslash-newline is a line continuation: bash joins the words ("git comm\<newline>it" is git commit), the
-    // text rules may also need it as a space ("git commit\<newline>-m x"). Whichever spelling is a commit is checked.
-    const raw = String(input.tool_input?.command ?? '');
-    const joined = raw.replace(/\\\r?\n/g, '');
-    command = [joined, unquote(joined)].some((c) => commitPattern(joined).test(c)) ? joined : raw.replace(/\\\r?\n/g, ' ');
-    if (typeof input.cwd === 'string' && input.cwd) dir = input.cwd;
+    const g = parseInput(JSON.parse(fs.readFileSync(0, 'utf8')) ?? {});
+    tool = g.tool;
+    raw = String(g.command ?? '');
+    if (g.dir) dir = g.dir;
   } catch {
     process.exit(0);
   }
+  if (raw.length > MAX_COMMAND) {
+    if ([raw, unquote(raw)].some((c) => GATE_WORDS.test(c))) decideOut('ask', t(root, 'guard.commit.tooLong'));
+    process.exit(0);
+  }
+  // A backslash-newline is a line continuation: bash joins the words ("git comm\<newline>it" is git commit), the
+  // text rules may also need it as a space ("git commit\<newline>-m x"). Whichever spelling is a commit is checked.
+  const joined = raw.replace(/\\\r?\n/g, '');
+  const command = [joined, unquote(joined)].some((c) => commitPattern(joined).test(c)) ? joined : raw.replace(/\\\r?\n/g, ' ');
   // --skip bypasses the gate and the board: the user is asked in every spelling (the AI must not write it on its own)
   // A commit whose message names --skip goes on to the commit checks below (a real --skip chained to a commit is stopped there).
   const open = unquote(command);
   const commit = commitPattern(command);
-  if (!commit.test(command) && [command, open].some((c) => /commit-gate\.mjs\b[^;&|\n]*--skip\b/i.test(c))) {
-    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask',
-      permissionDecisionReason: t(root, 'guard.commit.skipAsk') } }));
-    process.exit(0);
-  }
+  if (!commit.test(command) && [command, open].some((c) => /commit-gate\.mjs\b[^;&|\n]*--skip\b/i.test(c))) decideOut('ask', t(root, 'guard.commit.skipAsk'));
   // The gate command approval gives the commands in AGENTS.md permission to run: the user is asked (also covers spellings the permission list misses).
   // Only this project's commit-gate.mjs --approve is left out (maskOwnHook); both the raw and unquoted text are tested.
   const masked = maskOwnHook(command, dir);
@@ -203,33 +238,30 @@ async function hook() {
     // The prompt reads AGENTS.md now: a chain, an env variable, a node flag or a redirect must not change it after the
     // prompt and get another list approved. Only the exact spelling is accepted.
     if (!/^\s*node\s+(\.\/)?\.claude[\\/]hooks[\\/]gate\.mjs\s+(['"]?)--approve\2\s*$/.test(command)) {
-      console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'deny',
-        permissionDecisionReason: 'The gate command approval runs only with exactly this spelling, on its own (no chain, environment variable, flag or redirect): node .claude/hooks/gate.mjs --approve' } }));
-      process.exit(0);
+      decideOut('deny', 'The gate command approval runs only with exactly this spelling, on its own (no chain, environment variable, flag or redirect): node .claude/hooks/gate.mjs --approve');
     }
     // Loaded only here: every Bash call runs this hook, and gate.mjs pulls in the dashboard and edit-round modules
     const { approvedCommands, commandList, readAgents, unknownCommandKeys } = await import('./gate.mjs');
     const list = commandList(approvedCommands(root)) || t(root, 'guard.commit.noCommands');
     const unknown = unknownCommandKeys(readAgents(root));
     const note = unknown.length ? `\n${t(root, 'guard.commit.gateUnknownKeys', { keys: unknown.join(', ') })}` : '';
-    console.log(JSON.stringify({ hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: 'ask',
-      permissionDecisionReason: t(root, 'guard.commit.gateApprovalAsk', { list }) + note } }));
-    process.exit(0);
+    decideOut('ask', t(root, 'guard.commit.gateApprovalAsk', { list }) + note);
   }
+  // A plain commit stays with the commit checks below: what its message names is text
+  if (!commit.test(command) && [command, open].some(makesOtherCommit) && hasBoard() && !boardReviewOff()) decideOut('ask', t(root, 'guard.commit.otherCommitAsk'));
   if (!commit.test(command) && !commit.test(open)) process.exit(0);
   if (!hasBoard() || boardReviewOff()) process.exit(0);
   const chain = chainIssue(command, commit.inline ? COMMIT : commit);
   if (chain) {
-    process.stderr.write(`Commit stopped: ${chain}. The gate reviews the changes as they were before the command runs; run the commit on its own ` +
+    stop(`Commit stopped: ${chain}. The gate reviews the changes as they were before the command runs; run the commit on its own ` +
       '(or only as "git add … && git commit"). Run push and other commands separately.\n');
-    process.exit(2);
   }
 
   let d;
   try {
     d = changes();
-  } catch {
-    process.exit(0); // not a git repo
+  } catch (e) {
+    decideOut('ask', internalError(e)); // git failed or there is no repo: unread changes must not pass as reviewed
   }
   if (!d.files.length || docsOnly(d.files)) process.exit(0);
 
@@ -241,19 +273,19 @@ async function hook() {
   // Deleted files are left to the guards that ask before a delete. Only code files: snapshots, images and fixtures are
   // written by the test runner, not by Write/Edit. A partially staged test (git apply --cached, skip-worktree) commits an
   // index blob the record does not describe, so it always stops.
+  // Only Claude Code records what test-writer wrote; on Codex and Antigravity test separation is a written rule (AGENTS.md)
   const written = readRecord(root);
-  const foreign = d.files.filter((f) => isTestFile(f) && isCodeFile(f) && !isTestConfig(f) && d.hashes[f] !== 'deleted' && written[f] !== d.hashes[f]);
+  const foreign = tool !== 'claude' ? [] : d.files.filter((f) => isTestFile(f) && isCodeFile(f) && !isTestConfig(f) && d.hashes[f] !== 'deleted' && written[f] !== d.hashes[f]);
   if (foreign.length && !(skipped && approval.signature === d.signature)) {
-    process.stderr.write(`Commit stopped: test-writer did not write these test files, or they changed after it wrote them, or they were partially staged: ${foreign.join(', ')}.\n` +
+    stop(`Commit stopped: test-writer did not write these test files, or they changed after it wrote them, or they were partially staged: ${foreign.join(', ')}.\n` +
       'Only the test-writer agent writes test files with Write/Edit (AGENTS.md rule 7); a test written by patch, script, shell, git mv or Codex/Antigravity does not count.\n' +
       'If a change is needed, have test-writer review the file and rewrite it with Write/Edit. If the user made the change themselves ' +
       'and explicitly asks to skip the review for this commit, use --skip "user request".\n');
-    process.exit(2);
   }
   if (approval?.signature === d.signature && (skipped || (gate?.signature === d.signature && gate.passed === true))) process.exit(0);
   if (approval?.signature === d.signature) {
     const failed = gate?.signature === d.signature ? gate.checks.filter((k) => k.status === 'failed').map((k) => k.name) : null;
-    process.stderr.write(failed && !failed.length && gate.empty
+    stop(failed && !failed.length && gate.empty
       ? 'Commit stopped: the deterministic gate is empty (no check ran). Fill in AGENTS.md → Commands and run the gate again.\n' +
         'If the user explicitly asks for this commit, use --skip "user request".\n'
       : failed
@@ -261,22 +293,22 @@ async function hook() {
         'If the user explicitly asks for an intermediate (WIP) commit, use --skip "user request".\n'
       : 'Commit stopped: the deterministic gate has not run for these changes (or the changes were modified after it ran). ' +
         'Run node .claude/hooks/gate.mjs --run; if nothing is red, renew the board approval and try the commit again.\n');
-    process.exit(2);
   }
 
   const delta = approval && !skipped ? sinceApproval(approval, d) : [];
-  process.stderr.write(
+  stop(
     (delta.length && delta.length < d.files.length
       ? `Commit stopped: files changed since the last approval (${approval.note}) were not reviewed: ${delta.join(', ')}.\n` +
         'The board looks only at the diff of these files; files approved earlier are not reviewed again.\n'
       : `Commit stopped: the board has not reviewed these changes (${d.files.length} files).\n`) +
       '0. Run the deterministic gate (lint, types, tests, Semgrep) with node .claude/hooks/gate.mjs --run; give its output to the members.\n' +
-      '1. Following .claude/board/rules.md §3, run at most 2 relevant board members for the changed files with model "haiku", on the diff only.\n' +
+      (tool === 'claude'
+        ? '1. Following .claude/board/rules.md §3, run at most 2 relevant board members for the changed files with model "haiku", on the diff only.\n'
+        : '1. Following .claude/board/rules.md §3, read the definitions of at most 2 relevant board members (.claude/agents/board-*.md) and review the diff as those roles yourself (single model).\n') +
       '2. If there is no REJECT: node .claude/hooks/commit-gate.mjs --approve "<members who took part>" and try the commit again.\n' +
       '3. If there is a REJECT, do not commit; ask the user about the finding and the options.\n' +
       'If the user explicitly wants to skip the review for this commit, use --skip "user request".\n'
   );
-  process.exit(2);
 }
 
 if (isMain(import.meta.url)) {
@@ -284,5 +316,5 @@ if (isMain(import.meta.url)) {
   if (i > -1) approve(process.argv[i + 1] || 'unspecified');
   else if (j > -1) save(`skipped: ${process.argv[j + 1] || 'user request'}`);
   else if (process.argv.includes('--status')) status();
-  else hook();
+  else hook().catch((e) => decideOut('ask', internalError(e))); // a crash exits 1, which does not block the commit
 }

package/.claude/hooks/destructive-guard.mjs

@@ -33,7 +33,8 @@ const DESTRUCTIVE = [
   [/\bheroku\s+pg:reset\b|\bdrop(Database|Collection)\s*\(|\bdeleteMany\s*\(\s*\{\s*\}\s*\)|\bartisan\s+migrate:(fresh|refresh|reset)\b|\btypeorm\b[^;]*\bschema:drop\b|\bknex\b[^;]*\bmigrate:rollback\b[^;]*--all\b|\bprisma\s+db\s+push\b[^;]*--accept-data-loss\b/i, 'Database data is being deleted or reset'],
   [/\b(terraform|tofu|pulumi)\s+destroy\b/i, 'Cloud infrastructure is being destroyed'],
   // Options may come before the service and between it and the subcommand (aws --profile x s3 --region r rm, heroku -a x apps:destroy)
-  [cmdRe(String.raw`\baws(\.exe)?\s_G_(s3\s_G_rm\b(?=_L_\s--recursive\b)|s3\s_G_rb\b(?=_L_\s--force\b)|s3api\s_G_delete-bucket\b|rds\s_G_delete-db-(instance|cluster)\b|dynamodb\s_G_delete-table\b|ec2\s_G_terminate-instances\b)|\bgcloud\s_G_((sql|compute)\s_G_instances\s_G_delete|projects\s_G_delete)\b|\b(gsutil\s_G_rm|gcloud\s_G_storage\s_G_rm)\b(?=_L_\s(-[a-zA-Z]*r|--recursive)\b)|\baz\s_G_(group|resource)\s_G_delete\b|\bheroku\s_G_apps:destroy\b|\b(fly|flyctl)\s_G_(apps|volumes)\s_G_destroy\b|\bgh\s_G_repo\s_G_delete\b|\bsupabase\s_G_projects\s_G_delete\b|\bnetlify(-cli)?\s_G_sites:delete\b`), 'Cloud data, an app or a repository is being deleted for good'],
+  // The flag is looked for once, before the gaps are tried: the rule stays fast on a long repeated input
+  [cmdRe(String.raw`\baws(\.exe)?\s(?=_L_\s--recursive\b)_G_s3\s_G_rm\b|\baws(\.exe)?\s(?=_L_\s--force\b)_G_s3\s_G_rb\b|\baws(\.exe)?\s_G_(s3api\s_G_delete-bucket|rds\s_G_delete-db-(instance|cluster)|dynamodb\s_G_delete-table|ec2\s_G_terminate-instances)\b|\bgcloud\s_G_((sql|compute)\s_G_instances\s_G_delete|projects\s_G_delete)\b|\b(gsutil|gcloud)\s(?=_L_\s(-[a-zA-Z]*r|--recursive)\b)_G_(storage\s_G_)?rm\b|\baz\s_G_(group|resource)\s_G_delete\b|\bheroku\s_G_apps:destroy\b|\b(fly|flyctl)\s_G_(apps|volumes)\s_G_destroy\b|\bgh\s_G_repo\s_G_delete\b|\bsupabase\s_G_projects\s_G_delete\b|\bnetlify(-cli)?\s_G_sites:delete\b`), 'Cloud data, an app or a repository is being deleted for good'],
 ];
 
 // Database addresses other than localhost count as prod (or a shared environment)

package/.claude/hooks/messages.mjs

@@ -378,6 +378,9 @@ export const MESSAGES = {
   'dashboardData.prodRefAction': { en: '.mcp.json → dev ref (docs/operations/accounts.md → Environments)' },
   'dashboardData.rlsMissing': { en: 'Supabase is in use but there is no RLS attacker test (tests/security/rls.mjs).' },
   'dashboardData.rlsAction': { en: 'Get the template with /kit-update, add the tables to TABLES' },
+  'guard.commit.otherCommitAsk': { en: 'Commit gate: this command can make a commit the board review and the deterministic gate cannot check (merge, revert, cherry-pick, am, rebase, commit-tree, fast-import, or git called through a variable). Approve only if the user asked for it.' },
+  'guard.commit.internalError': { en: 'The commit gate could not check this command ({error}). User approval required.' },
+  'guard.commit.tooLong': { en: 'Commit gate: this command is too long to check and it names git or a commit. Approve only if the user asked for it.' },
   'guard.commit.skipAsk': { en: 'Commit gate: --skip bypasses the board review and the deterministic gate. Approve only if the user explicitly asks.' },
   'guard.commit.noCommands': { en: '(no commands defined)' },
   'guard.commit.gateApprovalAsk': { en: 'Gate command approval: from now on the gate runs these commands from AGENTS.md → Commands every time:\n{list}\nApprove only if you trust them.' },

package/.claude/i18n/tr.json

@@ -375,6 +375,9 @@
   "dashboardData.prodRefAction": ".mcp.json → dev ref (docs/operations/accounts.md → Environments)",
   "dashboardData.rlsMissing": "Supabase kullanılıyor ama RLS saldırgan testi yok (tests/security/rls.mjs).",
   "dashboardData.rlsAction": "/kit-update ile şablonu al, tabloları TABLES'a ekle",
+  "guard.commit.otherCommitAsk": "Commit kapısı: bu komut, kurul denetiminin ve deterministik kapının denetleyemeyeceği bir commit yapabilir (merge, revert, cherry-pick, am, rebase, commit-tree, fast-import veya değişkenle çağrılan git). Sadece kullanıcı istediyse onayla.",
+  "guard.commit.internalError": "Commit kapısı bu komutu denetleyemedi ({error}). Kullanıcı onayı gerekli.",
+  "guard.commit.tooLong": "Commit kapısı: bu komut denetlenemeyecek kadar uzun ve git veya commit geçiyor. Sadece kullanıcı istediyse onayla.",
   "guard.commit.skipAsk": "Commit kapısı: --skip kurul denetimini ve deterministik kapıyı aşar. Sadece kullanıcı açıkça isterse onayla.",
   "guard.commit.noCommands": "(tanımlı komut yok)",
   "guard.commit.gateApprovalAsk": "Kapı komut onayı: AGENTS.md → Commands bölümündeki şu komutlar bundan sonra her kapıda çalışır:\n{list}\nGüvendiğin komutlarsa onayla.",

package/AGENTS.md

@@ -37,7 +37,7 @@ The kit was written for Claude Code; these equivalents apply in these two tools:
 - **Wherever AskUserQuestion appears:** in Antigravity, the `ask_question` tool. If there is no question tool with options (Codex), write the options as a numbered list, put the recommended one first and mark it "(Recommended)", then wait for the answer. The decision is still the user's.
 - **Subagents** (board members, council, review agents in `.claude/agents/`): If you cannot run them, read the matching definition, assess as that role yourself and state "single model" in the report. The test separation (rule 7) cannot be enforced here by a hook: write the tests with the `test-writer` definition, before you think about the code, and show the red run; do not change the test file while writing the code.
 - **Model and effort** (`docs/workflow/models.md`): Start the subagent with the role's equivalent (Codex: model and reasoning effort in the prompt; Antigravity: `inherit`, `flash` or `pro`). If you cannot, run the role yourself and suggest the model in text.
-- **Protections** (secret block, destructive command shield, structure guard, edit lock, test protection, edit round counter, package gate and the equivalent of the Claude Code permission list) run as hooks: Codex `.codex/hooks.json`, Antigravity `.agents/hooks.json`. Writing to rule and protection files (`AGENTS.md`, `.claude/`, `.codex/`, `.agents/hooks.json`) needs approval. Do not try another route (for example a shell command) around a blocked action; tell the user why. Known limits: the commit gate (`commit-gate.mjs`, gate and board approval before a commit) is not wired in these tools, so before every commit run `node .claude/hooks/gate.mjs --run` and the board review yourself and commit only on GREEN; the shell rules read the command text and can miss unusual spellings.
+- **Protections** (secret block, destructive command shield, structure guard, edit lock, test protection, edit round counter, package gate, commit gate and the equivalent of the Claude Code permission list) run as hooks: Codex `.codex/hooks.json`, Antigravity `.agents/hooks.json`. Writing to rule and protection files (`AGENTS.md`, `.claude/`, `.codex/`, `.agents/hooks.json`) needs approval. Do not try another route (for example a shell command) around a blocked action; tell the user why. The commit gate stops a commit until `node .claude/hooks/gate.mjs --run` is green and the board review (you, as the relevant members) is approved with `commit-gate.mjs --approve`; it does not check who wrote a test file there. Known limit: the shell rules read the command text and can miss unusual spellings.
 - Skills that belong to Claude Code plugins (named `plugin:skill`) do not exist in these tools: skip that step. There is also no limit reading and no status line: the limit stays "-" in the status block.
 <!-- /kit:other-tools -->
 

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.12-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.50.1-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">
@@ -242,7 +242,7 @@ A new file outside the map is asked about, clutter like `*.bak` and `*-old.*` is
 | Test separation | Only the `test-writer` agent writes test files; the main session and the coding agent are blocked |
 | Test guard | Asks before a test is deleted, skipped or weakened |
 | Deterministic gate | No commit until lint, type check, tests and Semgrep have run; catches machine-specific paths written into code |
-| Commit gate | No commit without a board review and a green gate; a test file changed by a patch or a script stops it too |
+| Commit gate | No commit without a board review and a green gate; a test file changed by a patch or a script stops it too; merge, revert and other commands that make commits are asked |
 | Edit lock | With `/freeze <folder>` on, the AI writes only inside that folder |
 | Scope shield | Asks before writing to a file outside the approved plan |
 | Config approval | Rule and guard files never change without your approval |
@@ -277,7 +277,7 @@ Every command, setting, tool and skill is in the **[guide](https://burakdogrul.g
 
 ## Codex and Antigravity
 
-The kit is built for Claude Code; its rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. There the board runs on a single model, and the question UI, status bar and commit gate are not available. These tools don't report which agent is running, so test separation stays a written rule there. Install with `node <kit>/kit/kit.mjs init --tool codex` (or `antigravity`).
+The kit is built for Claude Code; its rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. There the board runs on a single model, and the question UI and status bar are not available; the commit gate works there too. These tools don't report which agent is running, so test separation stays a written rule there. Install with `node <kit>/kit/kit.mjs init --tool codex` (or `antigravity`).
 
 ## Measured
 

package/README.tr.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.12-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.50.1-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">
@@ -242,7 +242,7 @@ Harita dışı yeni dosya sorulur, `*.bak` ve `*-old.*` gibi dağınıklık dosy
 | Test ayrımı | Test dosyasına yalnız `test-writer` ajanı yazar; ana oturum ve kod ajanı denerse engellenir |
 | Test koruması | Silinen, atlanan veya gevşetilen testi sorar |
 | Deterministik kapı | Lint, tip, test ve Semgrep çalışmadan commit açılmaz; koda yazılmış makineye özel yolu yakalar |
-| Commit kapısı | Kurul denetimi ve yeşil kapı olmadan commit atılmaz; patch veya betikle değişen test dosyası da durur |
+| Commit kapısı | Kurul denetimi ve yeşil kapı olmadan commit atılmaz; patch veya betikle değişen test dosyası da durur; merge, revert gibi commit üreten komutlar sorulur |
 | Düzenleme kilidi | `/freeze <klasör>` açıkken AI sadece o klasöre yazar |
 | Kapsam kalkanı | Onaylı planın dışındaki dosyaya yazım sorulur |
 | Yapılandırma onayı | Kural ve koruma dosyaları onayın olmadan değişmez |
@@ -277,7 +277,7 @@ Tüm komutlar, ayarlar, araçlar ve skill'ler **[rehberde](https://burakdogrul.g
 
 ## Codex ve Antigravity
 
-Kit Claude Code için yazıldı; kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü, durum çubuğu ve commit kapısı bu araçlarda yok. Bu araçlar ajan kimliği bildirmediği için test ayrımı orada kural metninde kalır. Kurulum: `node <kit>/kit/kit.mjs init --tool codex` (veya `antigravity`).
+Kit Claude Code için yazıldı; kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü ve durum çubuğu bu araçlarda yok, commit kapısı orada da çalışır. Bu araçlar ajan kimliği bildirmediği için test ayrımı orada kural metninde kalır. Kurulum: `node <kit>/kit/kit.mjs init --tool codex` (veya `antigravity`).
 
 ## Ölçüm
 

package/kit/CHANGELOG.md

@@ -3,6 +3,22 @@
 The kit version is in `kit/VERSION`. To update a project, run `/kit-update` in it.
 Items with an "Adapt by hand" note concern files owned by the project; the update does not touch them.
 
+## [3.50.1] - 2026-11-01
+
+### Fixed
+- **The commit gate now asks about other commands that make commits.** `git merge`, `cherry-pick`, `revert`, `am`, `rebase`, `commit-tree` and `fast-import` are asked even on a clean tree, since a review cannot be bound to them. So is git called in a way the text cannot show (`$g commit`, `git $(echo commit)`, `git "$@"`). On Codex, which has no question, the command is blocked and the user runs it. A lone `--abort` or `--quit` is not asked. A quoted mention such as `grep "git merge"` is also asked.
+- **An error inside the commit gate no longer lets a commit through.** When git fails, or the hook itself crashes, the command is asked instead of passing.
+- **Long or repetitive commands can no longer time the commit gate out.** Text such as `git --a --a --a …` made matching exponentially slow, and a hook that times out lets the command run. Matching no longer backtracks that way, and a command over 10 000 characters that names git or a commit is asked without being read.
+- **A global option's value no longer hides the subcommand.** `git -C "my dir" commit`, `git -c user.name="A B" commit`, `git --work-tree . commit` and `git --attr-source HEAD commit` used to pass as if they were not commits. `GIT commit` now counts as git too.
+
+## [3.50.0] - 2026-10-30
+
+### Added
+- **The commit gate runs on Codex and Antigravity.** A commit stops there too until the deterministic gate (`gate.mjs --run`) is green and the board review is approved with `commit-gate.mjs --approve`; a commit chained to other commands stops as well. The stop comes as the tool's own decision. Since these tools run one model, the AI reviews the diff as the relevant board members itself. `commit-gate.mjs --skip` and the gate command approval are asked on Antigravity and left to you on Codex (it has no approval prompt). Test separation stays a written rule there: these tools do not report which agent wrote a test file.
+
+### Fixed
+- The cloud deletion rule of the shield no longer slows down on a long repeated command (`aws s3 rm` × 999: 24 ms).
+
 ## [3.49.12] - 2026-10-30
 
 ### Security

package/kit/VERSION

@@ -1 +1 @@
-3.49.12
+3.50.1

package/kit/guide.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.12</b> Starter kit for Claude Code · MIT</span>
+      <span class="pill"><b>v3.50.1</b> Starter kit for Claude Code · MIT</span>
       <h1>The AI builds.<br><em>You steer.</em></h1>
       <p class="sub">TillerHand takes a product from idea to production and maintenance with Claude Code. At every important decision the AI gives you the options, its recommendation and the cost of each option. An expert board reviews the work, and guardrails stop mistakes before they happen.</p>
       <div class="setup">
@@ -948,7 +948,7 @@ npx tillerhand init
       <tr><td>Test separation</td><td>The tests are written before the code by a separate agent (<code>test-writer</code>, a different model is recommended), not by whoever writes the code. Nobody but this agent can write to a test file: the main session and the code agent are blocked if they try. A test file changed indirectly by a patch or script also stops at the commit gate. So whoever writes the code can't shape the test to fit their own code</td></tr>
       <tr><td>Test protection</td><td>Deleting or commenting out an assertion, <code>.skip</code>/<code>.only</code>, a loosened assertion, deleting or moving a test file, and narrowing coverage in the test config are asked; so is writing to a test file through the shell</td></tr>
       <tr><td>Deterministic gate</td><td><code>gate.mjs --run</code>: lint, type check, tests and Semgrep run; the output feeds the board, and a red check counts as REJECT. If the "must not change" behaviors in the spec have no test or the test is red, the gate is red. It is also red if an added line contains a path specific to this machine (the full path of the project folder or the home folder). A new or changed command is first shown to you for approval</td></tr>
-      <tr><td>Commit gate</td><td>No commit without a board review and a green gate for the same changes; the task-end approval also counts for the commit, so the same change is not reviewed twice; skipping the review (<code>--skip</code>) is asked every time</td></tr>
+      <tr><td>Commit gate</td><td>No commit without a board review and a green gate for the same changes; the task-end approval also counts for the commit, so the same change is not reviewed twice; skipping the review (<code>--skip</code>) and commands that make commits with nothing to review (<code>git merge</code>, <code>git revert</code>…) are asked every time</td></tr>
       <tr><td>Edit lock</td><td>While <code>/freeze &lt;folder&gt;</code> is on, the AI writes only to that folder; writing outside through the shell is asked, and a symlink can't escape it</td></tr>
       <tr><td>Scope shield</td><td>After <code>/plan-task</code> approval, the plan's file list is saved; writing to an existing file not on the list is asked. Turning the shield on and off is asked too</td></tr>
       <tr><td>Edit round counter</td><td>When the same code file is edited for the 5th and 10th time in a session, a Semgrep and security review reminder appears</td></tr>
@@ -1137,7 +1137,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <section id="tools">
   <p class="path">With another tool</p>
   <h2>Codex and Antigravity</h2>
-  <p class="lead">TillerHand was written for Claude Code. The rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. The board runs on a single model; the question UI, the status line and the commit gate are not available in these tools.</p>
+  <p class="lead">TillerHand was written for Claude Code. The rules, commands and guardrails also work in OpenAI Codex and Google Antigravity. The board runs on a single model; the question UI and the status line are not available in these tools. The commit gate works there too.</p>
 <pre class="term">npx tillerhand init --tool codex          <span class="c"># or antigravity, or claude,codex</span>
 <span class="c"># add a tool to an existing project</span>
 /kit-update --tool claude,codex</pre>
@@ -1151,7 +1151,8 @@ Next: G-013 password reset · pending decision: email service</pre>
       <tr><td>Questions with options</td><td>AskUserQuestion</td><td>Numbered plain text</td><td>ask_question</td></tr>
       <tr><td>Board and council</td><td>Separate agents and models</td><td>One model takes the roles in turn</td><td>One model</td></tr>
       <tr><td>Test separation</td><td>Enforced by a hook: only test-writer writes to a test file</td><td>A written rule (no agent identity)</td><td>A written rule (no agent identity)</td></tr>
-      <tr><td>Status line, limit, dashboard refresh, commit gate</td><td>Yes</td><td>No</td><td>No</td></tr>
+      <tr><td>Status line, limit, dashboard refresh</td><td>Yes</td><td>No</td><td>No</td></tr>
+      <tr><td>Commit gate</td><td>Yes</td><td>Yes; a stop is a block, the AI reviews as the board itself</td><td>Yes; the AI reviews as the board itself</td></tr>
     </tbody>
   </table></div>
   <div class="note">The commands have a single source (<code>.claude/commands/</code>); the copies under <code>.agents/skills/</code> are generated by <code>init</code>, <code>install</code> and <code>update</code>. Codex runs the project's hooks only when you trust the folder and approve them with <code>/hooks</code>; do this in the first session. On first use, try writing a secret to see the guardrails work.</div>
@@ -1241,7 +1242,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Version 3.49.12 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
+    <span>Version 3.50.1 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
   </div>
 </footer>
 

package/kit/guide.tr.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.12</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.50.1</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="setup">
@@ -951,7 +951,7 @@ npx tillerhand init
       <tr><td>Test ayrımı</td><td>Testleri kodu yazan değil, ayrı bir ajan (<code>test-writer</code>, farklı model önerilir) koddan önce yazar. Test dosyasına bu ajan dışında kimse yazamaz: ana oturum ve kod ajanı denerse engellenir. Patch veya betikle dolaylı değişen test dosyası da commit kapısında durur. Böylece kodu yazan testi kendi koduna göre şekillendiremez</td></tr>
       <tr><td>Test koruması</td><td>Beklenti silmek veya yoruma almak, <code>.skip</code>/<code>.only</code>, gevşek beklenti, test dosyasını silmek veya taşımak ve test ayarında kapsamı daraltmak sorulur; kabukla test dosyasına yazmak da</td></tr>
       <tr><td>Deterministik kapı</td><td><code>gate.mjs --run</code>: lint, tip kontrolü, test ve Semgrep çalışır; çıktı kurula girdi olur, kırmızı kontrol REJECT sayılır. Spec'teki "değişmemesi gereken" davranışların testi yoksa veya kırmızıysa kapı kırmızıdır. Eklenen bir satırda bu makineye özel bir yol (proje klasörünün ya da ev klasörünün tam yolu) varsa da kırmızıdır. Yeni veya değişen komut önce sana gösterilip onaylatılır</td></tr>
-      <tr><td>Commit kapısı</td><td>Kurul denetimi ve aynı değişiklikler için yeşil kapı olmadan commit atılmaz; görev sonu onayı commit için de geçerli, aynı değişiklik iki kez denetlenmez; denetimi atlamak (<code>--skip</code>) her seferinde sorulur</td></tr>
+      <tr><td>Commit kapısı</td><td>Kurul denetimi ve aynı değişiklikler için yeşil kapı olmadan commit atılmaz; görev sonu onayı commit için de geçerli, aynı değişiklik iki kez denetlenmez; denetimi atlamak (<code>--skip</code>) ve denetlenecek değişiklik olmadan commit üreten komutlar (<code>git merge</code>, <code>git revert</code>…) her seferinde sorulur</td></tr>
       <tr><td>Düzenleme kilidi</td><td><code>/freeze &lt;klasör&gt;</code> açıkken AI sadece o klasöre yazar; kabukla dışarı yazmak sorulur, sembolik bağdan kaçılamaz</td></tr>
       <tr><td>Kapsam kalkanı</td><td><code>/plan-task</code> onayından sonra planın dosya listesi kaydedilir; listede olmayan mevcut dosyaya yazım sorulur. Kalkanı açmak ve kapatmak da sorulur</td></tr>
       <tr><td>Düzenleme turu sayacı</td><td>Aynı kod dosyası bir oturumda 5., 10. kez düzenlenince Semgrep ve güvenlik incelemesi hatırlatılır</td></tr>
@@ -1141,7 +1141,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <section id="araclar">
   <p class="path">Başka araçla</p>
   <h2>Codex ve Antigravity</h2>
-  <p class="lead">TillerHand Claude Code için yazıldı. Kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü, durum çubuğu ve commit kapısı bu araçlarda yok.</p>
+  <p class="lead">TillerHand Claude Code için yazıldı. Kurallar, komutlar ve korumalar OpenAI Codex ve Google Antigravity'de de çalışır. Kurul tek modelle yürür; soru arayüzü ve durum çubuğu bu araçlarda yok. Commit kapısı orada da çalışır.</p>
 <pre class="term">npx tillerhand init --tool codex          <span class="c"># ya da antigravity, ya da claude,codex</span>
 <span class="c"># var olan projeye araç eklemek</span>
 /kit-update --tool claude,codex</pre>
@@ -1155,7 +1155,8 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
       <tr><td>Seçenekli sorular</td><td>AskUserQuestion</td><td>Numaralı düz metin</td><td>ask_question</td></tr>
       <tr><td>Kurul ve konsey</td><td>Ayrı ajanlar ve modeller</td><td>Tek model rolleri sırayla üstlenir</td><td>Tek model</td></tr>
       <tr><td>Test ayrımı</td><td>Hook zorlar: test dosyasına yalnız test-writer yazar</td><td>Kural metinde (ajan kimliği yok)</td><td>Kural metinde (ajan kimliği yok)</td></tr>
-      <tr><td>Durum çubuğu, limit, pano yenileme, commit kapısı</td><td>Var</td><td>Yok</td><td>Yok</td></tr>
+      <tr><td>Durum çubuğu, limit, pano yenileme</td><td>Var</td><td>Yok</td><td>Yok</td></tr>
+      <tr><td>Commit kapısı</td><td>Var</td><td>Var; durdurma engel olarak gelir, AI kurul rollerini kendisi üstlenir</td><td>Var; AI kurul rollerini kendisi üstlenir</td></tr>
     </tbody>
   </table></div>
   <div class="note">Komutların kaynağı tektir (<code>.claude/commands/</code>); <code>.agents/skills/</code> altındaki kopyaları <code>init</code>, <code>install</code> ve <code>update</code> üretir. Codex proje hook'larını sadece klasöre güvendiğinde ve <code>/hooks</code> ile onayladığında çalıştırır; bunu ilk oturumda yap. İlk kullanımda bir sır yazma denemesiyle korumaların çalıştığını gör.</div>
@@ -1245,7 +1246,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Sürüm 3.49.12 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
+    <span>Sürüm 3.50.1 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
   </div>
 </footer>
 

package/kit/tools/antigravity/.agents/hooks.json

@@ -48,7 +48,8 @@
         "hooks": [
           { "type": "command", "command": "node .claude/hooks/guard-secrets.mjs" },
           { "type": "command", "command": "node .claude/hooks/destructive-guard.mjs" },
-          { "type": "command", "command": "node .claude/hooks/package-gate.mjs", "timeout": 30 }
+          { "type": "command", "command": "node .claude/hooks/package-gate.mjs", "timeout": 30 },
+          { "type": "command", "command": "node .claude/hooks/commit-gate.mjs" }
         ]
       }
     ]

package/kit/tools/codex/.codex/hooks.json

@@ -24,7 +24,8 @@
         "hooks": [
           { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/guard-secrets.mjs\"", "commandWindows": "node .claude/hooks/guard-secrets.mjs" },
           { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/destructive-guard.mjs\"", "commandWindows": "node .claude/hooks/destructive-guard.mjs" },
-          { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/package-gate.mjs\"", "commandWindows": "node .claude/hooks/package-gate.mjs", "timeout": 30 }
+          { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/package-gate.mjs\"", "commandWindows": "node .claude/hooks/package-gate.mjs", "timeout": 30 },
+          { "type": "command", "command": "node \"$(git rev-parse --show-toplevel)/.claude/hooks/commit-gate.mjs\"", "commandWindows": "node .claude/hooks/commit-gate.mjs" }
         ]
       }
     ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.49.12",
+  "version": "3.50.1",
   "description": "Vibe coding kit for Claude Code, Codex and Antigravity: rules, commands, guards and project templates.",
   "license": "MIT",
   "type": "module",