enigma-cli 1.16.1 → 1.16.3

package/assets/skills/anti-overengineering-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Minimal-code discipline - YAGNI ladder, deletion over addition, no unrequested abstractions, and the enigma: shortcut-marking convention; intensity via the minimal-code setting.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "3469a7e554b63a5ae3b1a4a127a0765d760649511fa9dfa9cdbcb04b4431fd64"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization, server-side caching (Redis), and Zod boundary validation.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "a46c3cd00aa5f47adb1e7907f1d2bc6f5562f7a272890dee9b1121976ac04ae1"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.1",
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "74f638aec13e8c93257fe1ad604c28b07e9a7c456796a4ceefcc99217d9e7039"
 }

package/assets/skills/code-review-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.9.0",
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "82d246faa4770248a36f143926fbf06bd3ffc082959014184548b57193770fab"
 }

package/assets/skills/database-expert/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-design/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "431645565aec8a4ab4cd17247139f78c377a9bcfcfc4ee1d6f252199c332d86f"
 }

package/assets/skills/frontend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op save detection, large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), and optimistic UI with rollback.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "26962db5a8b607e95098a6d88977aee59a10bd14e03afe97245f2b013fd21a9a"
 }

package/assets/skills/git-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "73a978ef11f4def067f9252fc3e2e6aa737a08b6d58ad8a2a45cbcd4b02813f6"
 }

package/assets/skills/security-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/skill-creator/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "699586cce82ec0a5458288b598ee7e5ebdddb3dfcf19db354d8bc5e85e47c1c7"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "6e3facba307eb2b55cefbab2e4b2a346a2b82f93c3ef47e11ebeb78c3c9453a8"
 }

package/assets/skills/testing-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.2.0",
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
-  "cliVersion": "1.16.1",
+  "cliVersion": "1.16.3",
   "sha": "a33622a2f810ee4cea39824cb1a7ca34b355a917d4224025df50d77dd74f0b3a"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "a1cfdf042903fb2822712a8e549fe35d05823ba289d6d99dd4c6782f81b1ba56",
-  "enigma-linux-arm64": "bf1c210c762ada33fb8d086631d6e9e394bae80fdb3acb6c802ef8d4049e5563",
-  "enigma-linux-x64": "7e069c734be9fde0bca67bb6544ad5c806486e7340e884dcd21ac9420870388a",
-  "enigma-win32-x64.exe": "3cad4ebce00154283ca82fbbaa40de5e374dbff5140ca9fae83651bb493d06ab"
+  "enigma-darwin-arm64": "2a3f446515dde107ccdf92d0ff75decf81682a7793db65acbaeabfc823269d52",
+  "enigma-linux-arm64": "d211de605cd49db07eda9fb611a2b8b9b998058416a49b67bd8aa331b5f9c4f9",
+  "enigma-linux-x64": "5badb7fb1b84ab4ffccad8463c82414e4d70bef8e3ed6c5c81890b51cdc8db38",
+  "enigma-win32-x64.exe": "f4097f0501be0413837c15e0cd9091b9e6dcd90a18ce16082133036bda0e9661"
 }

package/bin/download.mjs

@@ -13,7 +13,7 @@
  */
 import { dirname } from "node:path";
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 
 import {
     ARCH,
@@ -47,10 +47,36 @@ function assetUrl(asset) {
     return url;
 };
 
-/** Returns the installed binary path if already present, else null. */
+/** Sidecar recording the sha256 of the currently-installed binary (next to the binary). */
+function sidecarPath() {
+    return `${binTargetPath()}.sha256`;
+};
+
+/** The sha256 this package version expects for the host's asset, or null if none is known. */
+function expectedSha() {
+    const choice = selectAsset();
+    return choice ? choice.sha256 : null;
+};
+
+/**
+ * Returns the installed binary path only if it is present AND matches the sha256 this
+ * package version expects (recorded in the sidecar at download time). Returns null when
+ * the binary is missing, has no sidecar, or the sidecar does not match - i.e. it is stale
+ * after a package update - so the caller re-downloads the correct one. This is what makes
+ * `npm install -g enigma-cli@latest` actually swap a binary that npm left in place (the
+ * binary is not in the tarball; npm does not track or remove it on update). When there are
+ * no checksums (a source checkout / workspace install), trust whatever binary is present.
+ */
 export function installedBinary() {
     const target = binTargetPath();
-    return existsSync(target) ? target : null;
+    if (!existsSync(target)) return null;
+    const expected = expectedSha();
+    if (!expected) return target;
+    try {
+        return readFileSync(sidecarPath(), "utf8").trim() === expected ? target : null;
+    } catch {
+        return null;
+    }
 };
 
 /**
@@ -86,6 +112,10 @@ export async function downloadBinary({ log = () => {} } = {}) {
     // rename is atomic on POSIX; on Windows it fails over an existing file, so drop it first.
     if (existsSync(target)) try { unlinkSync(target); } catch { /* in use; rename will surface the error */ }
     renameSync(tmp, target);
+    // Record the installed sha so installedBinary() can detect a stale binary after an
+    // update without re-hashing the whole file on every launch. Best-effort: a missing
+    // sidecar just triggers one extra re-download next time.
+    try { writeFileSync(sidecarPath(), choice.sha256); } catch { /* sidecar is best-effort */ }
     log(`Installed ${choice.asset} -> ${target}`);
     return target;
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.16.1",
+  "version": "1.16.3",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {