enigma-cli 1.15.0 → 1.15.2

package/README.md

@@ -97,6 +97,43 @@ SKILLS section lists every skill; unchecking one discards it) or with
 future installs, updates and auto-syncs until you restore it with
 `enigma skills restore <name>`.
 
+## Slash commands
+
+`enigma install` also deploys reusable slash commands to every selected agent (a
+full install only - `--skills-only` / `--memory-only` skip them). Each command is
+authored once and copied verbatim to the agent's command directory, where the file
+name becomes the command.
+
+| Agent       | Scope  | Command directory               |
+| ----------- | ------ | ------------------------------- |
+| Claude Code | global | `~/.claude/commands/`           |
+| opencode    | global | `~/.config/opencode/command/`   |
+| OpenAI Codex| global | `~/.codex/prompts/`             |
+
+(`--local` installs into the project's `.claude/commands/` and `.opencode/command/`.
+Codex has no project-local prompt directory, so it only receives commands at global
+scope.)
+
+Commands are enigma-managed: if a same-named command already exists and is not
+enigma's, **it is replaced** so enigma's command always wins the name. A command you
+have not changed is left untouched; auto-sync keeps it current on every launch.
+
+### `/improve <area>`
+
+Improve a focused area of the current project. Supported areas:
+
+| Invocation                       | What it does                                        |
+| -------------------------------- | --------------------------------------------------- |
+| `/improve ui` or `/improve frontend` | Visual design, components, accessibility, responsiveness (same workflow) |
+| `/improve security`              | Secrets, authz, input validation, OWASP, dependency audit |
+| `/improve performance`           | Profile hot paths, queries/indexes, caching, bundle/render |
+| `/improve seo`                   | Metadata, semantic HTML, structured data, crawlability, Core Web Vitals |
+
+It detects the project stack first, reuses existing code, applies the smallest
+change, follows any matching policy skill, and verifies with the project's
+build/lint/test before reporting. With no area (or an unknown one) it lists the
+supported areas and stops.
+
 ## Auto-sync on launch
 
 After the first `enigma install`, you never need to run it again: whenever you

package/assets/commands/improve.md

@@ -0,0 +1,81 @@
+---
+description: Improve a focused area of the current project - ui/frontend, security, performance, or seo. Usage: /improve <area>.
+argument-hint: ui | frontend | security | performance | seo
+---
+
+# /improve
+
+Improve the requested area of THIS project. The area to improve is: **$ARGUMENTS**
+
+## Resolve the target area
+
+Map `$ARGUMENTS` (case-insensitive, ignore surrounding whitespace) to exactly one workflow:
+
+- `ui` or `frontend` -> Frontend & UI workflow (both aliases produce the same workflow).
+- `security` -> Security workflow.
+- `performance` (also `perf`) -> Performance workflow.
+- `seo` -> SEO workflow.
+
+If `$ARGUMENTS` is empty or does not match one of the areas above, do NOT guess: print the supported areas (`ui|frontend`, `security`, `performance`, `seo`) and stop.
+
+## Ground rules (every area)
+
+- Work only on the current project/repository. Detect the stack first (framework, language, build tool, package manager) before proposing changes.
+- Reuse existing code, components, and utilities before adding new ones; never duplicate logic.
+- Make the smallest change that achieves the improvement. Do not rewrite working code without a concrete reason.
+- Apply changes incrementally and keep them reviewable; explain each change briefly.
+- Never trade away security, accessibility, or correctness to gain another goal.
+- If a matching policy or skill is available in this environment, follow it (for example a frontend, security, backend, validation, or dependency policy).
+- After editing, run the project's build, lint, and test commands when they exist and report the results. Do not claim success without verification.
+
+## Workflows
+
+### ui | frontend
+
+Improve the visual design and frontend quality of the project.
+
+1. Map the UI surface: entry points, shared components, design tokens/theme, and the routes or screens that matter most.
+2. Visual design: establish or tighten a deliberate palette, typography scale, spacing, and layout rhythm. Remove templated, default-looking choices in favor of an intentional, consistent identity.
+3. Components: extract repeated markup into reusable components only when reuse or complexity justifies it; align props and naming with the existing codebase.
+4. States and feedback: cover loading, empty, error, and success states; add optimistic UI with rollback where it improves perceived speed.
+5. Accessibility: semantic elements, labels, focus order, keyboard navigation, and sufficient contrast.
+6. Responsiveness: verify the layout across small, medium, and large breakpoints.
+7. Apply the available frontend and frontend-design guidance if present.
+
+### security
+
+Harden the project against the common, high-impact risks.
+
+1. Secrets: find hardcoded credentials, tokens, or keys; move them to environment/secret storage and document the change. Never print secret values.
+2. Authentication and authorization: enforce least privilege; check that every privileged path verifies identity and permissions.
+3. Input handling: validate and sanitize all external input (request bodies, query params, CLI args, file/3rd-party payloads) at trust boundaries with a schema validator.
+4. OWASP Top 10: review for injection, broken access control, SSRF, insecure deserialization, and similar classes relevant to the stack.
+5. Transport and crypto: enforce TLS, use vetted crypto primitives, avoid weak/deprecated algorithms.
+6. Dependencies: run the ecosystem audit (for example `npm audit`, `pip-audit`) and flag known-vulnerable packages.
+7. Logging: ensure logs never leak secrets or PII; never expose internal errors to clients.
+8. Apply the available security and validation guidance if present.
+
+### performance
+
+Improve runtime and perceived performance with evidence, not guesses.
+
+1. Measure first: identify the actual hot paths (profiling, slow queries, large bundles, slow renders). Do not optimize blindly.
+2. Backend: eliminate N+1 queries, add indexes where justified, batch redundant calls, and add caching with correct invalidation.
+3. Frontend: reduce bundle size (code splitting, tree shaking), avoid unnecessary re-renders, lazy-load heavy assets, and cache client-side where safe.
+4. Data and I/O: remove redundant computation and round-trips; stream or paginate large payloads.
+5. Verify: re-measure after each change and report the before/after difference.
+
+### seo
+
+Improve search-engine visibility and crawlability.
+
+1. Metadata: per-page title and meta description, canonical URLs, and Open Graph / Twitter card tags.
+2. Semantic HTML: correct heading hierarchy, landmark elements, and descriptive link text.
+3. Structured data: add relevant JSON-LD schema for the content type.
+4. Crawlability: provide a sitemap and robots configuration; ensure important content is server-rendered or otherwise indexable.
+5. Performance for SEO: address Core Web Vitals (LCP, CLS, INP) since they affect ranking; coordinate with the performance workflow when needed.
+6. Accessibility overlaps with SEO (alt text, language attributes) - apply those too.
+
+## Output
+
+Report concisely: the resolved area, the files changed, what improved and why, the verification results (build/lint/test), and any follow-ups you could not safely automate.

package/assets/skills/anti-overengineering-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Minimal-code discipline - YAGNI ladder, deletion over addition, no unrequested abstractions, and the enigma: shortcut-marking convention; intensity via the minimal-code setting.",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "297c5d9a0573a319a6f8476f5b1da8cb93e6f3297f13b76ac25d91ce10c7b523"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/SKILL.md

@@ -39,7 +39,8 @@ description: Backend/API architecture - controller-service-repository layering,
 - Merge requests when possible; coalesce concurrent identical work.
 - Avoid N+1 queries; batch data access (delegate query specifics to database-expert).
 - Return only the fields the client needs; avoid overfetching.
-- Paginate large collections (prefer keyset/seek pagination per database-expert).
+- Paginate large collections (prefer keyset/seek pagination per database-expert); expose a cursor-based endpoint so the client can do virtualized infinite scroll or pagination (frontend-policy).
+- Do not block a whole response on one slow aggregate. Split independent data into separate endpoints, or fetch the parts in parallel server-side and return/stream each as it is ready, so the client can render progressively instead of waiting on the slowest query.
 
 ---
 

package/assets/skills/backend-policy/skill.json

@@ -1,8 +1,8 @@
 {
   "name": "backend-policy",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization, server-side caching (Redis), and Zod boundary validation.",
-  "cliVersion": "1.15.0",
-  "sha": "c442bc9e39a7710cb709ef2abb8d15ecd8aa16ed4f5c8af92b7af6877401cba4"
+  "cliVersion": "1.15.2",
+  "sha": "a46c3cd00aa5f47adb1e7907f1d2bc6f5562f7a272890dee9b1121976ac04ae1"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.1",
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "74f638aec13e8c93257fe1ad604c28b07e9a7c456796a4ceefcc99217d9e7039"
 }

package/assets/skills/code-review-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.8.0",
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "54144f87e477c4b1c004abf2268d9294778e1e96e634bb837b4b1717aa1b7b16"
 }

package/assets/skills/database-expert/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-design/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: frontend-design
+description: Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one. Helps with aesthetic direction, typography, and making choices that don't read as templated defaults.
+---
+
+# Frontend Design
+
+Approach this as the design lead at a small studio known for giving every client a visual identity that could not be mistaken for anyone else's. This client has already rejected proposals that felt templated, and is paying for a distinctive point of view: make deliberate, opinionated choices about palette, typography, and layout that are specific to this brief, and take one real aesthetic risk you can justify.
+
+## Ground it in the subject
+
+If the brief does not pin down what the product or subject is, pin it yourself before designing: name one concrete subject, its audience, and the page's single job, and state your choice. If there's any information in your memory about the human's preferences, context about what they're building, or designs you've made before – use that as a hint. The subject's own world, its materials, instruments, artifacts, and vernacular, is where distinctive choices come from. Build with the brief's real content and subject matter throughout.
+
+## Design principles
+
+For web designs, the hero is a thesis. Open with the most characteristic thing in the subject's world, in whatever form makes sense for it: a headline, an image, an animation, a live demo, an interactive moment. Be deliberate with your choice: a big number with a small label, supporting stats, and a gradient accent is the template answer, only use if that's truly the best option.
+
+Typography carries the personality of the page. Pair the display and body faces deliberately, not the same families you would reach for on any other project, and set a clear type scale with intentional weights, widths, and spacing. Make the type treatment itself a memorable part of the design, not a neutral delivery vehicle for the content.
+
+Structure is information. Structural devices, numbering, eyebrows, dividers, labels, should encode something true about the content, not decorate it. Many generic designs use numbered markers (01 / 02 / 03), but that's only appropriate if the content actually is a sequence - like a real process or a typed timeline where order carries information the reader needs. Question if choices like numbered markers actually make sense before incorporating them.
+
+Leverage motion deliberately. Think about where and if animation can serve the subject: a page-load sequence, a scroll-triggered reveal, hover micro-interactions, ambient atmosphere. An orchestrated moment usually lands harder than scattered effects; choose what the direction calls for. However, sometimes less is more, and extra animation contributes to the feeling that the design is AI-generated.
+
+Match complexity to the vision. Maximalist directions need elaborate execution; minimal directions need precision in spacing, type, and detail. Elegance is executing the chosen vision well.
+
+Consider written content carefully. Often a design brief may not contain real content, and it's up to you to come up with copy. Copy can make a design feel as templated as the design itself. See the below section on writing for more guidance.
+
+## Process: brainstorm, explore, plan, critique, build, critique again
+
+For calibration: AI-generated design right now clusters around three looks: (1) a warm cream background (near #F4F1EA) with a high-contrast serif display and a terracotta accent; (2) a near-black background with a single bright acid-green or vermilion accent; (3) a broadsheet-style layout with hairline rules, zero border-radius, and dense newspaper-like columns. All three are legitimate for some briefs, but they are defaults rather than choices, and they appear regardless of subject. Where the brief pins down a visual direction, follow it exactly — the brief's own words always win, including when it asks for one of these looks. Where it leaves an axis free, don't spend that freedom on one of these defaults. Just like a human designer who's hired, there's often a careful balance between doing what you're good at and taking each project as a chance to experiment and learn.
+
+Work in two passes. First, brainstorm a short design plan based on the human's design brief: create a compact token system with color, type, layout, and signature. Color: describe the palette as 4–6 named hex values. Type: the typefaces for 2+ roles (a characterful display face that's used with restraint, a complementary body face, and a utility face for captions or data if needed). Layout: a layout concept, using one-sentence prose descriptions and ASCII wireframes to ideate and compare. Signature: the single unique element this page will be remembered by that embodies the brief in an appropriate way.
+
+Then review that plan against the brief before building: if any part of it reads like the generic default you would produce for any similar page (work through a similar prompt to see if you arrive somewhere similar) rather than a choice made for this specific brief — revise that part, say what you changed and why. Only after you've confirmed the relative uniqueness of your design plan should you start to write the code, following the revised plan exactly and deriving every color and type decision from it.
+
+When writing the code, be careful of structuring your CSS selector specificities. It's easy to generate CSS classes that cancel each other out (especially with a type-based selector like .section and a element-based selector like .cta). This can happen often with paddings/margins between sections.
+
+Try to do a lot of this planning and iteration in your thinking, and only show ideas to the user when you have higher confidence it'll delight them.
+
+## Restraint and self-critique
+
+Spend your boldness in one place. Let the signature element be the one memorable thing, keep everything around it quiet and disciplined, and cut any decoration that does not serve the brief. Not taking a risk can be a risk itself! Build to a quality floor without announcing it: responsive down to mobile, visible keyboard focus, reduced motion respected. Critique your own work as you build, taking screenshots if your environment supports it – a picture is worth 1000 tokens. Consider Chanel's advice: before leaving the house, take a look in the mirror and remove one accessory. Human creators have memory and always try to do something new, so if you have a space to quickly jot down notes about what you've tried, it can help you in future passes.
+
+## More on writing in design
+
+Words appear in a design for one reason: to make it easier to understand, and therefore easier to use. They are design material, not decoration. Bring the same intentionality to copy that you would bring to spacing and color. Before writing anything, ask what the design needs to say, and how it can best be said to help the person navigate the experience.
+
+Write from the end user's side of the screen. Name things by what people control and recognize, never by how the system is built. A person manages notifications, not webhook config. Describe what something does in plain terms rather than selling it. Being specific is always better than being clever.
+
+Use active voice as default. A control should say exactly what happens when it's used: "Save changes," not "Submit." An action keeps the same name through the whole flow, so the button that says "Publish" produces a toast that says "Published." The vocabulary of an interface is the signposting for someone navigating the product. Cohesion and consistency are how people learn their way around.
+
+Treat failure and emptiness as moments for direction, not mood. Explain what went wrong and how to fix it, in the interface's voice rather than a person's. Errors don't apologize, and they are never vague about what happened. An empty screen is an invitation to act.
+
+Keep the register conversational and tuned: plain verbs, sentence case, no filler, with tone matched to the brand and the audience. Let each element do exactly one job. A label labels, an example demonstrates, and nothing quietly does double duty.

package/assets/skills/frontend-design/skill.json

@@ -0,0 +1,8 @@
+{
+  "name": "frontend-design",
+  "version": "1.0.0",
+  "provider": "FJRG2007/enigma",
+  "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
+  "cliVersion": "1.15.2",
+  "sha": "431645565aec8a4ab4cd17247139f78c377a9bcfcfc4ee1d6f252199c332d86f"
+}

package/assets/skills/frontend-policy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: frontend-policy
-description: Frontend architecture - reusable components, abstraction thresholds, state management, no-op save detection (skip mutations when the edited state equals the saved state), client-side caching (localStorage/sessionStorage to avoid redundant server calls and survive rate limits), optimistic UI with rollback, and periodic React code-health audits (react-doctor). Use when building or changing UI components, client state, forms/save flows, data fetching/caching, auditing React code, or any frontend structure.
+description: Frontend architecture - reusable components, abstraction thresholds, state management, no-op save detection (skip mutations when the edited state equals the saved state), client-side caching (localStorage/sessionStorage to avoid redundant server calls and survive rate limits), large-list rendering (virtualized infinite scroll vs pagination, skeletons, progressive/parallel loading, short-TTL caching), optimistic UI with rollback, and periodic React code-health audits (react-doctor). Use when building or changing UI components, client state, forms/save flows, data fetching/caching, lists that show lots of data, loading states, or any frontend structure.
 ---
 
 # Frontend Architecture Policy
@@ -125,6 +125,33 @@ Cache on the client to avoid redundant server round-trips and to keep the app us
 
 ---
 
+## Large Lists & Progressive Loading
+
+Never render an unbounded or large dataset in one shot (no fetch-everything then map over thousands of rows). Lists of products, feeds, search results, logs, etc. must load incrementally and keep the rendered DOM bounded.
+
+### Choose a load strategy per case
+
+- Infinite scroll (default for feeds, large or unknown-size sets, and exploratory browsing): fetch one page at a time as the user nears the end, using keyset/cursor paging (per backend-policy / database-expert), not offset for deep lists.
+  - It MUST be virtualized/windowed once the list grows: render only the viewport plus a small buffer and recycle offscreen rows so a long session (a user scrolling for an hour) does not accumulate thousands of nodes and lag. Drop far-offscreen items from the DOM and restore them on scroll-back, preserving scroll position (the TikTok model: only a handful of items live in the DOM at once).
+  - Only start dropping/recycling once there is genuinely a lot rendered or the context demands it; do not over-engineer it for a small list.
+- Pagination (when users need to jump to or deep-link a specific page, the set is bounded, totals/position matter, or results must be SEO-indexable): classic page controls backed by efficient server paging.
+- Pick whichever fits; do not infinite-scroll a 30-row admin table or paginate a social feed. A short, bounded list needs neither - just render it (anti-overengineering-policy).
+
+### Skeletons while loading
+
+- Show skeleton placeholders that mirror the final layout while data loads, not bare spinners for content areas, and reserve the space so content does not shift in (avoid layout shift / CLS).
+- Empty and error states are still handled explicitly for every async view (see Accessibility & Resilience).
+
+### Progressive / parallel rendering
+
+- Never block the whole view on one slow aggregate request. Fetch independent sections in parallel and render each the moment its own data arrives (per-section skeletons; streaming/Suspense where the framework supports it), so the page becomes useful incrementally instead of waiting on the slowest query. Splitting the server work is owned by backend-policy.
+
+### Short-TTL caching for fetched pages
+
+- Cache fetched lists/pages briefly so quick navigations, the back button, and tab switches do not refetch. Tune the TTL to how fast the data changes - on the order of ~30s for typical lists, longer for stable catalogs, near-zero for fast-moving or correctness-critical data. Use the Client-Side Caching rules above (explicit TTL, stale-while-revalidate, invalidate on mutation, never serve stale money/security/correctness reads).
+
+---
+
 ## Optimistic UI & Rollback
 
 - Use optimistic UI updates when the operation is safe and likely to succeed.

package/assets/skills/frontend-policy/skill.json

@@ -1,8 +1,8 @@
 {
   "name": "frontend-policy",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "provider": "FJRG2007/enigma",
-  "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op save detection, and optimistic UI with rollback.",
-  "cliVersion": "1.15.0",
-  "sha": "3766096616a9177ce66685bfaaaef66f7e8ceb62e2a6542e83dee713b9d1b56f"
+  "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op save detection, large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), and optimistic UI with rollback.",
+  "cliVersion": "1.15.2",
+  "sha": "26962db5a8b607e95098a6d88977aee59a10bd14e03afe97245f2b013fd21a9a"
 }

package/assets/skills/git-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "73a978ef11f4def067f9252fc3e2e6aa737a08b6d58ad8a2a45cbcd4b02813f6"
 }

package/assets/skills/security-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
-  "cliVersion": "1.15.0",
+  "cliVersion": "1.15.2",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }