tillerhand 3.49.4 → 3.49.6

package/.claude/hooks/destructive-guard.mjs

@@ -265,18 +265,20 @@ const ENV_NAMES = ['.env', '.env.local', '.env.production', '.env.development',
 // Glob match (* ? [..] [!..]) by dynamic programming, not a regex: no throw on an unclosed [ (bash reads it as a
 // plain [) and no backtracking blow-up on ********. Case-insensitive, like the Windows file system.
 export function globMatch(glob, name) {
+  // Only plain bracket sets ([nm], [!x]) are parsed. A range, class, equivalence class, collating symbol, escape,
+  // nested or empty set ([a-z], [[:alpha:]], [[=n=]], [[.n.]], []n]) counts as a match: asked, never guessed
+  for (let i = glob.indexOf('['); i > -1; i = glob.indexOf('[', i + 1)) {
+    const end = glob.indexOf(']', i + 1);
+    if (end > -1 && !/^[!^]?[\w.]+$/.test(glob.slice(i + 1, end))) return true;
+  }
   const tokens = [];
   for (let i = 0; i < glob.length; i++) {
-    const c = glob[i];
-    let end = c === '[' ? glob.indexOf(']', i + 2) : -1;
-    // [[:alpha:]]: the class's own ] does not close the set
-    if (end > -1 && glob.slice(i + 1, end).includes('[:')) end = glob.indexOf(']', end + 1);
+    const c = glob[i], end = c === '[' ? glob.indexOf(']', i + 1) : -1;
     if (c === '*') { if (tokens.at(-1) !== '*') tokens.push('*'); }
     else if (c === '?') tokens.push((x) => true);
     else if (end > -1) {
       const body = glob.slice(i + 1, end).toLowerCase(), neg = /^[!^]/.test(body), set = neg ? body.slice(1) : body;
-      // A range (a-z), a POSIX class ([:alpha:]) or an escape is not parsed: it counts as any character (asked)
-      tokens.push(/[-\\]|\[:/.test(set) ? () => true : (x) => set.includes(x) !== neg);
+      tokens.push((x) => set.includes(x) !== neg);
       i = end;
     } else tokens.push((x) => x === c.toLowerCase());
   }

package/.claude/hooks/preview.mjs

@@ -9,7 +9,7 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawn, spawnSync } from 'node:child_process';
-import { approvedCommands, approvalNeeded, isApproved } from './gate.mjs';
+import { approvedCommands, approvalNeeded, isApproved, unknownCommandKeys, readAgents } from './gate.mjs';
 import { findRoot, isMain } from './shared.mjs';
 
 const CLI = 'npx -y @playwright/cli@0.1.22';
@@ -56,7 +56,7 @@ export async function preview(root, task) {
   const url = command('preview'), dev = command('dev');
   if (!url) return fail('AGENTS.md → Commands has no `preview:` line, or it is empty. Add it (example: `preview:     http://localhost:3000`) or produce the evidence by hand in this task.');
   if (!LOCAL.test(url)) return fail(`the preview address must be local (http://localhost:<port>, 127.0.0.1 or [::1]). Now: ${url}`);
-  if (!isApproved(root, list)) return { code: 1, text: `Preview · ${approvalNeeded(list)}` };
+  if (!isApproved(root, list)) return { code: 1, text: `Preview · ${approvalNeeded(list, unknownCommandKeys(readAgents(root)))}` };
   const dir = `.previews/${String(task || 'latest').replace(/[^\w-]/g, '-')}`;
   // A linked folder from the repo would send the files elsewhere
   for (const d of ['.previews', dir]) {

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.4-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.6-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/README.tr.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.4-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.6-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/kit/CHANGELOG.md

@@ -3,6 +3,16 @@
 The kit version is in `kit/VERSION`. To update a project, run `/kit-update` in it.
 Items with an "Adapt by hand" note concern files owned by the project; the update does not touch them.
 
+## [3.49.6] - 2026-10-30
+
+### Fixed
+- `/preview` before the command approval names the `## Commands` keys the gate does not read (`deploy:`…), like the gate run and the approval prompt already do.
+
+## [3.49.5] - 2026-10-30
+
+### Security
+- A `.env` glob with an equivalence class or collating symbol (`cat .e[[=n=]]v`, `.e[[.n.]]v`) is asked. The glob check now parses only plain bracket sets (`[nm]`, `[!x]`); any other bracket form counts as a match and asks, instead of being guessed.
+
 ## [3.49.4] - 2026-10-30
 
 ### Security

package/kit/VERSION

@@ -1 +1 @@
-3.49.4
+3.49.6

package/kit/guide.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.4</b> Starter kit for Claude Code · MIT</span>
+      <span class="pill"><b>v3.49.6</b> Starter kit for Claude Code · MIT</span>
       <h1>The AI builds.<br><em>You steer.</em></h1>
       <p class="sub">TillerHand takes a product from idea to production and maintenance with Claude Code. At every important decision the AI gives you the options, its recommendation and the cost of each option. An expert board reviews the work, and guardrails stop mistakes before they happen.</p>
       <div class="setup">
@@ -1241,7 +1241,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Version 3.49.4 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
+    <span>Version 3.49.6 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
   </div>
 </footer>
 

package/kit/guide.tr.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.4</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.49.6</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="setup">
@@ -1245,7 +1245,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Sürüm 3.49.4 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
+    <span>Sürüm 3.49.6 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
   </div>
 </footer>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.49.4",
+  "version": "3.49.6",
   "description": "Vibe coding kit for Claude Code, Codex and Antigravity: rules, commands, guards and project templates.",
   "license": "MIT",
   "type": "module",