tillerhand 3.49.3 → 3.49.5

package/.claude/hooks/destructive-guard.mjs

@@ -265,9 +265,15 @@ const ENV_NAMES = ['.env', '.env.local', '.env.production', '.env.development',
 // Glob match (* ? [..] [!..]) by dynamic programming, not a regex: no throw on an unclosed [ (bash reads it as a
 // plain [) and no backtracking blow-up on ********. Case-insensitive, like the Windows file system.
 export function globMatch(glob, name) {
+  // Only plain bracket sets ([nm], [!x]) are parsed. A range, class, equivalence class, collating symbol, escape,
+  // nested or empty set ([a-z], [[:alpha:]], [[=n=]], [[.n.]], []n]) counts as a match: asked, never guessed
+  for (let i = glob.indexOf('['); i > -1; i = glob.indexOf('[', i + 1)) {
+    const end = glob.indexOf(']', i + 1);
+    if (end > -1 && !/^[!^]?[\w.]+$/.test(glob.slice(i + 1, end))) return true;
+  }
   const tokens = [];
   for (let i = 0; i < glob.length; i++) {
-    const c = glob[i], end = c === '[' ? glob.indexOf(']', i + 2) : -1;
+    const c = glob[i], end = c === '[' ? glob.indexOf(']', i + 1) : -1;
     if (c === '*') { if (tokens.at(-1) !== '*') tokens.push('*'); }
     else if (c === '?') tokens.push((x) => true);
     else if (end > -1) {

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.3-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.5-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/README.tr.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.3-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.5-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/kit/CHANGELOG.md

@@ -3,6 +3,16 @@
 The kit version is in `kit/VERSION`. To update a project, run `/kit-update` in it.
 Items with an "Adapt by hand" note concern files owned by the project; the update does not touch them.
 
+## [3.49.5] - 2026-10-30
+
+### Security
+- A `.env` glob with an equivalence class or collating symbol (`cat .e[[=n=]]v`, `.e[[.n.]]v`) is asked. The glob check now parses only plain bracket sets (`[nm]`, `[!x]`); any other bracket form counts as a match and asks, instead of being guessed.
+
+## [3.49.4] - 2026-10-30
+
+### Security
+- A `.env` glob with a bracket range or POSIX class (`cat .e[a-z]v`, `.e[[:alpha:]]v`, `.env.[a-z]*`) is asked. The 3.49.3 glob matcher read `[a-z]` as the three characters `a`, `-`, `z`, so the read went through unasked.
+
 ## [3.49.3] - 2026-10-30
 
 ### Security

package/kit/VERSION

@@ -1 +1 @@
-3.49.3
+3.49.5

package/kit/guide.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.3</b> Starter kit for Claude Code · MIT</span>
+      <span class="pill"><b>v3.49.5</b> Starter kit for Claude Code · MIT</span>
       <h1>The AI builds.<br><em>You steer.</em></h1>
       <p class="sub">TillerHand takes a product from idea to production and maintenance with Claude Code. At every important decision the AI gives you the options, its recommendation and the cost of each option. An expert board reviews the work, and guardrails stop mistakes before they happen.</p>
       <div class="setup">
@@ -1241,7 +1241,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Version 3.49.3 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
+    <span>Version 3.49.5 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
   </div>
 </footer>
 

package/kit/guide.tr.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.3</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.49.5</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="setup">
@@ -1245,7 +1245,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Sürüm 3.49.3 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
+    <span>Sürüm 3.49.5 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
   </div>
 </footer>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.49.3",
+  "version": "3.49.5",
   "description": "Vibe coding kit for Claude Code, Codex and Antigravity: rules, commands, guards and project templates.",
   "license": "MIT",
   "type": "module",