enigma-cli 1.16.9 → 1.16.11

package/README.md

@@ -511,7 +511,7 @@ the rest is shown as state, never invented savings), a **Check & update** button
 skills and the dashboard UI in place; a CLI bump still needs `enigma update` in a terminal),
 and the **Skills** subpage to view/edit/enable/disable/remove skills and check for updates.
 
-### Measuring proxy (experimental, opt-in, Claude Code only)
+### Proxy (experimental, opt-in, Claude Code only)
 
 `enigma config proxy on` makes `enigma claude` route Claude Code through a local loopback
 proxy that forwards every request verbatim to Anthropic and streams the response straight
@@ -522,6 +522,31 @@ and falls back to a direct launch if it can't start. It applies only to launches
 `enigma claude` (it injects `ANTHROPIC_BASE_URL` for that process only) and only to Claude
 Code. Leave it off until you've confirmed it works for your setup.
 
+### Secret protection (commit guard + prompt guard)
+
+enigma's commit guard already blocks committed secrets, `.env` files and dependency dirs.
+You can now tailor it **granularly** - and not just for git:
+
+- **Granular file rules.** On top of the built-in protections, add your own **blocked
+  paths** (extra globs to refuse, e.g. `secrets/*.json`), **excluded paths** (an allowlist
+  the guard never flags, e.g. `tests/fixtures/**`), and **custom secret patterns** (extra
+  regexes). Edit them visually in the dashboard **Enigma Settings** panel or the terminal
+  UI (`enigma config`), or from the CLI:
+  `enigma config guard-block-paths add "secrets/*.json"`,
+  `enigma config guard-allow-paths add "tests/fixtures/**"`,
+  `enigma config guard-secret-patterns add "mycorp_[a-z0-9]{32}"` (and `... remove <entry>`,
+  or the key alone to list). Defaults are unchanged; these only refine them. They live in
+  `~/.enigma-guard.json` and a repo can override per-`.githooks/enigma-guard.json`.
+
+- **Prompt secret guard (opt-in, off by default, Claude Code only).** Turn on
+  `enigma config prompt-secret-guard on` and `enigma claude` routes through the local proxy,
+  scanning each outgoing chat message for credentials **before they reach the model**. On a
+  hit it either **redacts** the secret (default - replaces it with `[REDACTED: ...]` so the
+  key never leaves your machine but the turn still works) or **rejects** the whole request
+  (`enigma config prompt-secret-mode reject` - nothing reaches Claude). It uses the same
+  patterns as the commit guard plus your custom ones. The dashboard's **Enigma Systems**
+  panel shows the guard's state and how many prompts it has actually redacted/rejected.
+
 You can also configure enigma **from the dashboard itself**: the **Enigma Settings** panel
 exposes the same options as the terminal UI (`enigma config`), editable in the browser.
 Writes apply immediately at global scope; memory-affecting toggles prompt for an agent
@@ -536,20 +561,52 @@ The time figure is likewise an estimate: it converts saved input tokens into sav
 prefill time at a default model speed. Override it with `enigma config token-speed
 <tokens-per-second>` (0 restores the default rate).
 
-#### Real tool-usage stats (opt-in)
+#### Claude usage (opt-in)
+
+`enigma config usage-stats on` unlocks a full **Usage** view - in the dashboard (its own
+tab) **and** the terminal UI (a "Claude usage" entry) - that reads your own Claude Code
+session transcripts (`~/.claude/projects/.../*.jsonl`) and reports:
+
+- **Estimated cost** in USD from a per-model price table (Opus/Sonnet/Haiku, incl. cache
+  read/write rates), plus measured input/output/cache tokens.
+- **Breakdowns** by model, by project and a **recent sessions** table.
+- A **current 5-hour block** computed locally from transcript timestamps: tokens + cost
+  used in the open window, the **burn rate** (tokens/min) and a projected end-of-window
+  total. (No Anthropic API is called - this is reconstructed from your local logs.)
+- The **same usage windows Claude Code shows** as gauges: **Current session**, **Weekly -
+  All models**, and **Weekly - Sonnet only**, each with its reset time. The **% used**
+  needs your plan limit, which you set on the card (dashboard) or with
+  `enigma config plan-weekly-limit <tokens>` / `plan-session-limit` / `plan-weekly-sonnet-limit`;
+  the weekly reset day/time is `enigma config plan-weekly-reset "mon 11:00"`. Until a limit
+  is set the card honestly shows tokens used instead of a fabricated percentage.
+
+It is read-only and loopback-only; nothing is sent anywhere. Off by default because it
+reads your session logs, which are broader than enigma's own compression data.
+
+Honesty note: cost is an **estimate** (Anthropic does not record per-message cost in the
+transcript; real spend is billed by Anthropic). Token counts and prompt-cache reads are
+measured facts. enigma deliberately does **not** attribute savings to skills or to
+token-efficient output - a transcript has no counterfactual baseline, so any such figure
+would be invented. Only Claude Code is read today; Codex/OpenCode use absent or
+undocumented local session stores and are not guessed.
 
-`enigma config usage-stats on` adds a **Real Tool Usage** panel that reads your own
-Claude Code session transcripts (`~/.claude/projects/.../*.jsonl`) to report **measured**
-token consumption and the **real prompt-cache savings** the tool already achieved -
-input/output tokens, cache reads, per-model breakdown. It is read-only and loopback-only;
-nothing is sent anywhere. It is off by default because it reads your session logs, which
-are broader than enigma's own compression data.
+#### Manage accounts & profiles from the dashboard
 
-Honesty note: this reports only what the transcripts actually record. It deliberately does
-**not** attribute savings to skills or to token-efficient output, because a transcript has
-no counterfactual baseline (what a session would have cost *without* them), so any such
-figure would be invented. Only Claude Code is read today; Codex/OpenCode use absent or
-undocumented local session stores and are not guessed.
+The dashboard **Accounts** tab does everything the terminal UI does: switch the active
+account, add / rename / remove managed accounts, and create profiles that pin one account
+per tool. Logging an account **in** still happens in a terminal (the browser cannot host a
+tool's interactive login), so the panel shows the exact command to run, e.g.
+`enigma claude work`.
+
+#### Export / import your config
+
+The **Settings** tab has **Export config** and **Import config**. Export downloads a
+single JSON bundle - your `.enigma.json`, the commit-guard config, and your account/profile
+**structure** (names + tool->account mappings). It is **secret-free**: no auth tokens or
+credentials are ever included, so the file is safe to move between machines or commit.
+Importing recreates the structure (seeding fresh account dirs); you then log each account
+in per machine. Both use the browser's native file dialogs, so you always choose where to
+save or which file to import.
 
 ### As an MCP server
 

package/assets/skills/anti-overengineering-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Minimal-code discipline - YAGNI ladder, deletion over addition, no unrequested abstractions, and the enigma: shortcut-marking convention; intensity via the minimal-code setting.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "3469a7e554b63a5ae3b1a4a127a0765d760649511fa9dfa9cdbcb04b4431fd64"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization, server-side caching (Redis), and Zod boundary validation.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "a46c3cd00aa5f47adb1e7907f1d2bc6f5562f7a272890dee9b1121976ac04ae1"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.1",
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "74f638aec13e8c93257fe1ad604c28b07e9a7c456796a4ceefcc99217d9e7039"
 }

package/assets/skills/code-review-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.9.0",
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "82d246faa4770248a36f143926fbf06bd3ffc082959014184548b57193770fab"
 }

package/assets/skills/database-expert/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-design/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "431645565aec8a4ab4cd17247139f78c377a9bcfcfc4ee1d6f252199c332d86f"
 }

package/assets/skills/frontend-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op save detection, large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), and optimistic UI with rollback.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "26962db5a8b607e95098a6d88977aee59a10bd14e03afe97245f2b013fd21a9a"
 }

package/assets/skills/git-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.3.0",
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "73a978ef11f4def067f9252fc3e2e6aa737a08b6d58ad8a2a45cbcd4b02813f6"
 }

package/assets/skills/security-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/skill-creator/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "699586cce82ec0a5458288b598ee7e5ebdddb3dfcf19db354d8bc5e85e47c1c7"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.1.0",
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "6e3facba307eb2b55cefbab2e4b2a346a2b82f93c3ef47e11ebeb78c3c9453a8"
 }

package/assets/skills/testing-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.2.0",
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -3,6 +3,6 @@
   "version": "1.0.0",
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
-  "cliVersion": "1.16.9",
+  "cliVersion": "1.16.11",
   "sha": "a33622a2f810ee4cea39824cb1a7ca34b355a917d4224025df50d77dd74f0b3a"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "a2a9b9cac713c7b2f9249911eb3ce7d6afd29ffb8e16e6bbdb2b7ae80ff2fbcc",
-  "enigma-linux-arm64": "e4bbae4e11a389b154dc8dfb43df67a95742358c701b1cfad34bd8434c87b662",
-  "enigma-linux-x64": "ebc03113055e80d0f94086efe7eaceab741fb68a213850b6acb36e57dd5d39fc",
-  "enigma-win32-x64.exe": "706aca29dbd34bc0e440c75a14ae8095c3c16bc3e63609971702b2e52d9d9bf0"
+  "enigma-darwin-arm64": "f7d39c32e4926805ef7dde8d174aa1c7f3dc2069aa6ac9741f85870fc0e8c353",
+  "enigma-linux-arm64": "102508b39676df657ce526d1ba0bb2ffe0702347edb706aa97d7ef582b83a562",
+  "enigma-linux-x64": "1052d1a3dcacd3f8ff80b72e1ecdbe10fdc4942c2c599ad0ee30c94e9eca4f0a",
+  "enigma-win32-x64.exe": "cf2e588774255fef0e7bc29b19af6cf5c5afe5b3cf29fe36d4fec3a990f78732"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.16.9",
+  "version": "1.16.11",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {