tillerhand 3.49.9 → 3.49.10

package/.claude/hooks/package-gate.mjs

@@ -26,9 +26,20 @@ const POPULAR = {
 
 // Case-insensitive (the Windows shell is); npm's install aliases (in, ins, isntall, it…) count as install
 const COMMANDS = [
-  [/^(npm|pnpm|bun)\s+(i|in|ins|inst|insta|instal|install|isnt|isnta|isntal|isntall|it|add)\b/i, 'npm'], [/^yarn\s+(global\s+)?add\b/i, 'npm'], [/^npx\s+expo\s+install\b/i, 'npm'],
-  [/^uv\s+(add|pip\s+install)\b/i, 'pypi'], [/^(python3?\s+-m\s+)?pip3?\s+install\b/i, 'pypi'], [/^poetry\s+add\b/i, 'pypi'],
+  [/^(npm|pnpm|bun)\s+(i|in|ins|inst|insta|instal|install|isnt|isnta|isntal|isntall|it|add)\b/i, 'npm'], [/^yarn\s+(global\s+)?add\b/i, 'npm'], [/^(npx\s+)?expo\s+install\b/i, 'npm'],
+  // create/init <name> downloads and runs create-<name>; deno takes npm:<name> specifiers
+  [/^(npm|pnpm|yarn|bun)\s+(create|init)\b/i, 'npm', 'create'], [/^deno\s+(add|install|run|x)\b/i, 'npm', 'deno'],
+  [/^uv\s+(add|pip\s+install|tool\s+install)\b/i, 'pypi'], [/^((python[\d.]*|py)(\s+-\d[\d.]*)?\s+-m\s+)?pip[\d.]*(\s+-\S+)*\s+install\b/i, 'pypi'],
+  [/^(poetry|pdm)\s+add\b|^(pipenv|pipx)\s+install\b/i, 'pypi'],
 ];
+// create-vite for vite, @scope/create for @scope, @scope/create-x for @scope/x (npm's own mapping)
+function createName(arg) {
+  const n = npmName(arg);
+  if (!n) return null;
+  if (!n.startsWith('@')) return `create-${n}`;
+  const [scope, rest] = n.split('/');
+  return rest ? `${scope}/create-${rest}` : `${scope}/create`;
+}
 
 // Download-and-run: the first positional is the package (the rest are its arguments), or the values of the package flags.
 // local: the runner uses a bin the project already has before downloading (npx, npm exec, bunx); pnpm/yarn dlx always download.
@@ -72,6 +83,7 @@ function execArgs(args, eco, positional) {
 // Also timeout/nice/stdbuf, shell keywords (then, do, else, !) and combined shell flags (bash -lc).
 const WRAPPER = /^(?:\(|\{|!\s*|[A-Za-z_]\w*=\S*\s+|(?:sudo|env|time|nohup|exec|command|xargs|corepack|call|start|then|do|else|ionice|stdbuf)\s+|timeout\s+(?:-\S+\s+)*\S+\s+|nice\s+(?:-n\s*\S+\s+|-\d+\s+)?|(?:bash|sh|zsh|dash|cmd|pwsh|powershell)(?:\.exe)?\s+(?:-\w*c|\/c|\/k|-Command)\s+["']?)/i;
 const SUBCOMMAND = /^(install|i|add|exec|x|dlx|tool|pip|run|global)$/;
+const VALUE_FLAG = /^(--prefix|-C|--dir|--cwd|--workspace|--filter|--registry|--cache|--userconfig)$/i;
 export function normalize(part) {
   let s = part.trim(), prev;
   do { prev = s; s = s.replace(WRAPPER, '').trim(); } while (s !== prev);
@@ -81,7 +93,10 @@ export function normalize(part) {
   const t = s.split(/\s+/);
   if (/^(npm|pnpm|yarn|bun|uv)$/i.test(t[0])) {
     let i = 1;
-    while (i < t.length && t[i].startsWith('-')) i += !t[i].includes('=') && t[i + 1] && !t[i + 1].startsWith('-') && !SUBCOMMAND.test(t[i + 1]) ? 2 : 1;
+    // A flag known to take a value always skips it (npm --prefix x i: x is a folder, not the exec subcommand)
+    while (i < t.length && t[i].startsWith('-')) i += VALUE_FLAG.test(t[i]) || (!t[i].includes('=') && t[i + 1] && !t[i + 1].startsWith('-') && !SUBCOMMAND.test(t[i + 1])) ? 2 : 1;
+    // yarn workspace <name> add x: the workspace name is not the subcommand
+    if (/^yarn$/i.test(t[0]) && /^workspace$/i.test(t[i] ?? '')) i += 2;
     s = [t[0], ...t.slice(i)].join(' ');
   }
   return s;
@@ -124,6 +139,15 @@ export function findPackages(command) {
       }
       continue;
     }
+    if (match[2] === 'create') {
+      const name = createName(args.find((a) => !a.startsWith('-')) ?? '');
+      if (name) result.push({ eco, name });
+      continue;
+    }
+    if (match[2] === 'deno') {
+      for (const a of args) if (/^npm:/i.test(a)) { const name = npmName(a.slice(4)); if (name) result.push({ eco, name }); }
+      continue;
+    }
     for (let i = 0; i < args.length; i++) {
       const a = args[i];
       if (a.startsWith('-')) {

package/README.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.9-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Version" src="https://img.shields.io/badge/version-3.49.10-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="License: MIT" src="https://img.shields.io/badge/license-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-ready-d97757?style=flat-square">
   <img alt="Also Codex and Antigravity" src="https://img.shields.io/badge/also-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/README.tr.md

@@ -6,7 +6,7 @@
 </p>
 
 <p align="center">
-  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.9-2a78d6?style=flat-square"></a>
+  <a href="kit/CHANGELOG.md"><img alt="Sürüm" src="https://img.shields.io/badge/s%C3%BCr%C3%BCm-3.49.10-2a78d6?style=flat-square"></a>
   <a href="LICENSE"><img alt="Lisans: MIT" src="https://img.shields.io/badge/lisans-MIT-2a78d6?style=flat-square"></a>
   <img alt="Claude Code" src="https://img.shields.io/badge/Claude%20Code-haz%C4%B1r-d97757?style=flat-square">
   <img alt="Codex ve Antigravity" src="https://img.shields.io/badge/ayr%C4%B1ca-Codex%20%C2%B7%20Antigravity-5b6577?style=flat-square">

package/kit/CHANGELOG.md

@@ -3,6 +3,12 @@
 The kit version is in `kit/VERSION`. To update a project, run `/kit-update` in it.
 Items with an "Adapt by hand" note concern files owned by the project; the update does not touch them.
 
+## [3.49.10] - 2026-10-30
+
+### Security
+- **The package gate checks more install commands:** `npm create <x>` / `npm init <x>` (and the pnpm, yarn, bun versions) check the `create-<x>` package they download and run; `pipx install`, `uv tool install`, `pdm add`, `pipenv install`, a bare `expo install` and Deno `npm:` specifiers are checked too.
+- Flags before the subcommand no longer hide the package: `npm --prefix x i`, `pnpm -C x add`, `yarn --cwd x add`, `yarn workspace web add`, `pip --quiet install`, `py -m pip install`, `python3.12 -m pip install`.
+
 ## [3.49.9] - 2026-10-30
 
 ### Security

package/kit/VERSION

@@ -1 +1 @@
-3.49.9
+3.49.10

package/kit/guide.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.9</b> Starter kit for Claude Code · MIT</span>
+      <span class="pill"><b>v3.49.10</b> Starter kit for Claude Code · MIT</span>
       <h1>The AI builds.<br><em>You steer.</em></h1>
       <p class="sub">TillerHand takes a product from idea to production and maintenance with Claude Code. At every important decision the AI gives you the options, its recommendation and the cost of each option. An expert board reviews the work, and guardrails stop mistakes before they happen.</p>
       <div class="setup">
@@ -1241,7 +1241,7 @@ Next: G-013 password reset · pending decision: email service</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Version 3.49.9 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
+    <span>Version 3.49.10 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT license</a> · The KVKK section is a checklist, not legal advice.</span>
   </div>
 </footer>
 

package/kit/guide.tr.html

@@ -361,7 +361,7 @@ footer .container { display: flex; flex-wrap: wrap; gap: 16px; justify-content:
 <section class="hero">
   <div class="container">
     <div>
-      <span class="pill"><b>v3.49.9</b> Claude Code için başlangıç kiti · MIT</span>
+      <span class="pill"><b>v3.49.10</b> Claude Code için başlangıç kiti · MIT</span>
       <h1>Kodu AI yazar.<br><em>Dümen sende.</em></h1>
       <p class="sub">TillerHand, Claude Code ile bir ürünü fikirden canlıya ve bakıma kadar götürür. Her önemli kararda AI sana seçenekleri, önerisini ve her seçeneğin bedelini sunar. Bir uzman kurulu işi denetler, korumalar hatayı daha olmadan durdurur.</p>
       <div class="setup">
@@ -1245,7 +1245,7 @@ Sıradaki: G-013 şifre sıfırlama · bekleyen karar: e-posta servisi</pre>
 <footer>
   <div class="container">
     <a class="brand" href="#top" style="font-size:16px"><svg class="mark" style="width:22px;height:22px"><use href="#mark"/></svg>TillerHand</a>
-    <span>Sürüm 3.49.9 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
+    <span>Sürüm 3.49.10 · <a href="https://github.com/burakdogrul/TillerHand">GitHub</a> · <a href="https://github.com/burakdogrul/TillerHand/blob/main/LICENSE">MIT lisansı</a> · KVKK bölümü kontrol listesidir, hukuki görüş değildir.</span>
   </div>
 </footer>
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tillerhand",
-  "version": "3.49.9",
+  "version": "3.49.10",
   "description": "Vibe coding kit for Claude Code, Codex and Antigravity: rules, commands, guards and project templates.",
   "license": "MIT",
   "type": "module",