enigma-cli 1.30.4 → 1.30.5

package/assets/memory/AGENTS.md

@@ -31,12 +31,24 @@
 - End files with exactly one trailing newline and no trailing whitespace.
 - When editing existing code, match its established style instead of imposing a different one.
 
+### Engineering Defaults (Always-On)
+
+Non-negotiable, language-agnostic defaults - apply them by default without being asked, using the stack's idiomatic tool. They restate the cores of validation-policy, backend-policy and frontend-policy so they hold even when a skill does not load.
+
+- Validate EVERY external input (request body, query, params, event payload, form field, CLI arg, webhook/message) against an explicit schema before use - Zod (TS/JS), Pydantic (Python), the language's equivalent elsewhere. Never consume an unvalidated shape or leave it open-ended. When the input is a tagged/event union, validate the discriminant AND that specific variant's body, with the expected fields typed.
+- Frontend forms: validate in real time against the same schema, and use optimistic UI with rollback on failure for user-facing mutations.
+- Cache reads on the client (localStorage/sessionStorage, or the data layer's cache) with a short TTL (~30s or more) to avoid redundant queries and survive rate limits; invalidate on write.
+- Build reusable, composable components instead of duplicating UI - e.g. a single Input that renders a show/hide toggle when the type is password. Reuse before writing new.
+- Never use the browser's native `alert`/`confirm`/`prompt` - use a dialog/modal component that matches the page design.
+
 ### Task Execution (Always-On)
 
-- For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next.
-- Map the dependencies between subtasks before starting, and do only the decomposition the task genuinely needs - never over-decompose simple work.
-- For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked.
-- Never declare a task complete while any unit is pending, stubbed, or unverified. Before saying "done": reconcile counts against the inventory, build/typecheck the whole artifact, and grep for TODO/stub markers you introduced. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
+- A message that bundles several asks, questions, or items is a MULTI-PART task - even if it is just two, three, or four things. Before doing anything, extract EVERY distinct ask into an explicit list (the runtime's todo system when it has one, else a written checklist) and treat the request as unfinished until every item on that list is addressed. Never answer the first ask and drop, summarize away, or postpone the rest. When you present a plan, execute the whole plan - do not stop after listing it.
+- For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next. Map the dependencies between subtasks first, and do only the decomposition the task genuinely needs - never over-decompose simple work.
+- For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked. This is the task-completion-policy skill; load it for any task that spans many files/items or bundles several asks.
+- "Pending", "pendiente", "TODO", "left as a follow-up", "next step: ...", or "you can do X yourself" is NOT an acceptable way to end a turn for work you are able to perform now. Do that work in this same turn. The only reasons to stop short are a genuine blocker - missing credentials or access, an irreversible or destructive choice, a business decision, or something the user explicitly approved deferring - and then you must name the blocker explicitly, never leave the item silently unfinished.
+- Do not stop early because a task is long, tedious, or the context is filling up. Keep going until every enumerated item is finished or truly blocked. If work is genuinely paused, the checklist holds the remaining items - on resume, re-read it FIRST and continue from it; never reconstruct progress from memory, that is where items get dropped.
+- Never declare a task complete while any item is pending, stubbed, or unverified. Before saying "done": reconcile against the checklist, build/typecheck the whole artifact, and grep for TODO/stub markers you introduced. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
 - Never offload doable work to the user: "you can adjust/refresh X yourself" in a final report is a hidden deferral. If you can execute the action, do it before reporting; hand off only what genuinely requires the user (credentials, irreversible/destructive choices, business decisions) or what they explicitly approved deferring.
 
 <!-- enigma:parallel-subagents:start -->

package/assets/memory/CLAUDE.md

@@ -31,12 +31,24 @@
 - End files with exactly one trailing newline and no trailing whitespace.
 - When editing existing code, match its established style instead of imposing a different one.
 
+### Engineering Defaults (Always-On)
+
+Non-negotiable, language-agnostic defaults - apply them by default without being asked, using the stack's idiomatic tool. They restate the cores of validation-policy, backend-policy and frontend-policy so they hold even when a skill does not load.
+
+- Validate EVERY external input (request body, query, params, event payload, form field, CLI arg, webhook/message) against an explicit schema before use - Zod (TS/JS), Pydantic (Python), the language's equivalent elsewhere. Never consume an unvalidated shape or leave it open-ended. When the input is a tagged/event union, validate the discriminant AND that specific variant's body, with the expected fields typed.
+- Frontend forms: validate in real time against the same schema, and use optimistic UI with rollback on failure for user-facing mutations.
+- Cache reads on the client (localStorage/sessionStorage, or the data layer's cache) with a short TTL (~30s or more) to avoid redundant queries and survive rate limits; invalidate on write.
+- Build reusable, composable components instead of duplicating UI - e.g. a single Input that renders a show/hide toggle when the type is password. Reuse before writing new.
+- Never use the browser's native `alert`/`confirm`/`prompt` - use a dialog/modal component that matches the page design.
+
 ### Task Execution (Always-On)
 
-- For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next.
-- Map the dependencies between subtasks before starting, and do only the decomposition the task genuinely needs - never over-decompose simple work.
-- For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked.
-- Never declare a task complete while any unit is pending, stubbed, or unverified. Before saying "done": reconcile counts against the inventory, build/typecheck the whole artifact, and grep for TODO/stub markers you introduced. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
+- A message that bundles several asks, questions, or items is a MULTI-PART task - even if it is just two, three, or four things. Before doing anything, extract EVERY distinct ask into an explicit list (the runtime's todo system when it has one, else a written checklist) and treat the request as unfinished until every item on that list is addressed. Never answer the first ask and drop, summarize away, or postpone the rest. When you present a plan, execute the whole plan - do not stop after listing it.
+- For long or complex tasks - or any task you judge to warrant it - break the work into smaller, well-scoped subtasks and complete them incrementally, validating each subtask before moving to the next. Map the dependencies between subtasks first, and do only the decomposition the task genuinely needs - never over-decompose simple work.
+- For multi-item work (ports, migrations, batch changes), enumerate the FULL inventory of work units with deterministic commands before implementing, persist it as a checklist (file or todo system), and mark a unit done only after verifying it - never because a similar unit worked. This is the task-completion-policy skill; load it for any task that spans many files/items or bundles several asks.
+- "Pending", "pendiente", "TODO", "left as a follow-up", "next step: ...", or "you can do X yourself" is NOT an acceptable way to end a turn for work you are able to perform now. Do that work in this same turn. The only reasons to stop short are a genuine blocker - missing credentials or access, an irreversible or destructive choice, a business decision, or something the user explicitly approved deferring - and then you must name the blocker explicitly, never leave the item silently unfinished.
+- Do not stop early because a task is long, tedious, or the context is filling up. Keep going until every enumerated item is finished or truly blocked. If work is genuinely paused, the checklist holds the remaining items - on resume, re-read it FIRST and continue from it; never reconstruct progress from memory, that is where items get dropped.
+- Never declare a task complete while any item is pending, stubbed, or unverified. Before saying "done": reconcile against the checklist, build/typecheck the whole artifact, and grep for TODO/stub markers you introduced. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
 - Never offload doable work to the user: "you can adjust/refresh X yourself" in a final report is a hidden deferral. If you can execute the action, do it before reporting; hand off only what genuinely requires the user (credentials, irreversible/destructive choices, business decisions) or what they explicitly approved deferring.
 
 <!-- enigma:parallel-subagents:start -->

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization, server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-06-16T12:06:06+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "a46c3cd00aa5f47adb1e7907f1d2bc6f5562f7a272890dee9b1121976ac04ae1"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-06-26T13:40:52+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "dc9ceb784004b05a0117c464e4bed05946835a04acea282586c0b735ee7c2284"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
   "updated": "2026-07-16T22:43:53+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "d132f20db08806054d95e58d3d56c2aa7ebc8e6dd24d902b0a0ed9ddfae216c5"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-06-03T14:19:50+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-06-25T15:51:43-04:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "fb78be3233bf9caa67d1f522c19831542b23f47e440b02211b5a950c898318b9"
 }

package/assets/skills/frontend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op save detection, large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), and optimistic UI with rollback.",
   "updated": "2026-06-26T13:57:02+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "41cb938c9022efcdadc3056417cc7d442511adee40b09a141f11bb5fd9d56514"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-07-16T22:44:02+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "e6dfbc33884000d9d25841bd9c5a84d6558ffd374882cb7b34451eb2cebc2161"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-06-16T16:39:13+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "699586cce82ec0a5458288b598ee7e5ebdddb3dfcf19db354d8bc5e85e47c1c7"
 }

package/assets/skills/task-completion-policy/SKILL.md

@@ -8,6 +8,7 @@ description: Exhaustive completion discipline for long, complex, or multi-item t
 ## Activation Scope
 
 - Apply to any task with more than a handful of work units: 1:1 ports, language/framework migrations, repo-wide refactors, "implement all X", multi-feature builds, large integrations.
+- Also apply when a single user message bundles multiple distinct asks or questions, even just two, three, or four of them: enumerate every ask up front and cover all of them. Answering the first and silently dropping, postponing, or leaving the rest "pending" is exactly the failure this policy exists to prevent.
 - Owns inventory, coverage tracking, and completion claims. Subtask decomposition lives in core-engineering-policy; per-change review lives in code-review-policy; test strategy lives in testing-policy.
 
 ---

package/assets/skills/task-completion-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "task-completion-policy",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-06-10T22:11:09+02:00",
-  "cliVersion": "1.30.4",
-  "sha": "6e3facba307eb2b55cefbab2e4b2a346a2b82f93c3ef47e11ebeb78c3c9453a8"
+  "cliVersion": "1.30.5",
+  "sha": "feaf44a9b3ab9676c8ebd3c2a799f156d28419998f5a5355250fe95a28cd5a01"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious.",
   "updated": "2026-06-26T14:09:06+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "e750988b8de51d8a69be621673dceca5413ebad7e1a48e40acd18aad526d9928"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
   "updated": "2026-06-25T18:21:50-04:00",
-  "cliVersion": "1.30.4",
+  "cliVersion": "1.30.5",
   "sha": "50349f5b3c55cc337f828dd510c163550614832acb28714871210a7c115a1501"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "cffde287e26a9e1c37f656180ac7fb51e4bba3f2163688678ceae4e7fe7eb6d1",
-  "enigma-linux-arm64": "b2bf20035d7ed5fa8592e5bef50dd5b32c1c400d80636c38ccae547ce2eb05c8",
-  "enigma-linux-x64": "66962b8368b820611a63e7275f2b9cdd468020aba658cde0f5b126833519be01",
-  "enigma-win32-x64.exe": "0c44610724181b0246120134293eb1a2507d266a07b210ef58598504c4a2875f"
+  "enigma-darwin-arm64": "f9d771e9f5230cef78d37f428db4f9fd0d5eba50157665153656d5ea15753a0c",
+  "enigma-linux-arm64": "b823ffa1f2059dda5ff80559228268ecde03c69ff64240282cb4421caf635509",
+  "enigma-linux-x64": "08a0fdb81242947331fb98a2d7f361bdfdd19616fcc6233b830092dbd4444557",
+  "enigma-win32-x64.exe": "f59e9668e991f82eb1aeb00237c607a7a81df75fd8f57a3cf7d97c48e7ee70b0"
 }

package/bin/enigma.mjs

@@ -78,6 +78,7 @@ try {
 const env = { ...process.env };
 env.ENIGMA_ASSETS_DIR = join(pkgRoot, "assets");
 env.ENIGMA_GUARD_PATH = join(pkgRoot, "dist", "guard.js");
+env.ENIGMA_GUARDRAILS_PATH = join(pkgRoot, "dist", "guardrails.js");
 try {
     env.ENIGMA_VERSION = packageVersion();
 } catch { /* version is best-effort */ }

package/dist/guardrails.js

@@ -0,0 +1,305 @@
+#!/usr/bin/env node
+
+// src/guardrails.ts
+import { homedir } from "os";
+import { fileURLToPath } from "url";
+import { execFileSync } from "child_process";
+import { readFileSync, statSync, existsSync } from "fs";
+import { dirname, join, resolve } from "path";
+var COMMENT_LINE = /^\s*(\/\/|#|\*|--|<!--|\{?\/\*)/;
+var BUILTIN_RULES = [
+  {
+    id: "db-uuid-pk",
+    label: "UUID primary keys",
+    // Basename globs (no slash) match at any depth, including the repo root; the dir
+    // globs additionally catch non-standard extensions under those folders.
+    files: ["*.prisma", "*.sql", "*.entity.ts", "**/migrations/**", "**/entities/**", "**/models/**"],
+    scope: "file",
+    // Matches only explicit auto-increment identity signals across engines/ORMs.
+    // Deliberately does NOT match a plain `INTEGER PRIMARY KEY` (valid in many cases,
+    // and used on purpose by enigma's own recall SQLite store).
+    pattern: `\\b(?:BIG|SMALL)?SERIAL\\b|\\bAUTO_INCREMENT\\b|\\bIDENTITY\\s*\\(|\\bGENERATED\\s+(?:ALWAYS|BY\\s+DEFAULT)\\s+AS\\s+IDENTITY\\b|@default\\(autoincrement\\(\\)\\)|@PrimaryGeneratedColumn\\(\\s*(?:\\)|["']increment["'])`,
+    flags: "i",
+    message: "Use UUID primary keys, never auto-increment / SERIAL / IDENTITY / AUTO_INCREMENT (database-expert). Generate a UUID (prefer UUIDv7 or ULID) at the application layer or via a database uuid default.",
+    severity: "block",
+    skill: "database-expert"
+  },
+  {
+    id: "db-ts-orm-prisma",
+    label: "Prisma as the default ORM (TypeScript)",
+    files: ["package.json", "*.sql", "schema.ts", "ormconfig.*", "data-source.ts", "knexfile.*", "drizzle.config.*"],
+    scope: "project",
+    check: "ts-relational-no-prisma",
+    message: "This is a TypeScript project on a relational datastore without Prisma. Prefer Prisma as the default ORM for new TypeScript work (database-expert).",
+    severity: "warn",
+    skill: "database-expert"
+  },
+  {
+    id: "be-validate-input-ts",
+    label: "Validate request input (TypeScript)",
+    files: ["*.ts", "*.js", "*.mts", "*.cts"],
+    excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**"],
+    scope: "file",
+    // Fires only on ASSIGNING the request BODY to a variable (where validation belongs) with
+    // no schema-validation signal in the file. Deliberately NOT req.query/req.params (single
+    // scalars, usually validated inline) and NOT a body passed as a bare arg (e.g. to a logger)
+    // - real-world scanning showed those are the false-positive sources. The absent set is BROAD
+    // (every common validator) so any validated file is skipped: precision over recall.
+    pattern: "=\\s*req\\.body\\b|=\\s*(await\\s+)?request\\.json\\(\\)|=\\s*ctx\\.request\\.body\\b|=\\s*await\\s+c\\.req\\.json\\(",
+    absent: "z\\.|\\.parse\\(|\\.safeParse\\(|\\.validate\\(|\\.assert\\(|valibot|\\byup\\b|\\bjoi\\b|\\bJoi\\b|\\bajv\\b|superstruct|typebox|@sinclair|arktype|io-ts|runtypes|@Body\\(|class-validator|express-validator|zodResolver|Type\\.Object|checkSchema|celebrate",
+    message: "Reads request input without validating it. Parse every input through a schema (Zod, or valibot/yup/...) - never trust an unvalidated shape. For a tagged/event union, validate the discriminant AND that variant's body (validation-policy, backend-policy).",
+    severity: "warn",
+    skill: "validation-policy"
+  },
+  {
+    id: "be-validate-input-py",
+    label: "Validate request input (Python)",
+    files: ["*.py"],
+    excludeFiles: ["test_*.py", "*_test.py", "conftest.py", "**/tests/**"],
+    scope: "file",
+    // Assigns the request body to a variable with no schema-validation signal. request.data is
+    // intentionally omitted (raw-bytes reads - webhook HMAC, proxying - are not schema surfaces).
+    // The absent set is broad to skip any validated file (Pydantic, marshmallow, Django forms, ...).
+    pattern: "=\\s*request\\.get_json\\(|=\\s*(await\\s+)?request\\.json\\b|=\\s*request\\.form\\b|=\\s*request\\.POST\\b",
+    absent: "BaseModel|pydantic|marshmallow|serializers|TypeAdapter|field_validator|@validator|model_validate|is_valid\\(|forms\\.|ModelForm|cerberus|voluptuous|jsonschema|@dataclass|\\.load\\(|Schema\\(",
+    message: "Reads the raw request body without a schema. Validate with Pydantic (BaseModel / model_validate) - or the stack's validator - and discriminate the payload by its type/event (validation-policy, backend-policy).",
+    severity: "warn",
+    skill: "validation-policy"
+  },
+  // NOTE: no Go/Rust input-validation rule. Go's manual validation (`if in.X == ""`) is
+  // idiomatic and has no detectable signature, and Rust's serde typed deserialization already
+  // enforces shape - a rule for either would false-positive. The generic "validate every input"
+  // principle for those languages lives in the always-on memory kernel instead.
+  {
+    id: "fe-password-input",
+    label: "Reusable password input (show/hide)",
+    files: ["*.tsx", "*.jsx"],
+    scope: "file",
+    // A raw lowercase <input type="password"> (not a component) with no show/hide toggle in the
+    // file. flags:"" = case-sensitive so a capitalized <Input> component is NOT matched; a
+    // literal type="password" only, so a dynamic type={visible?...} toggle is not matched either.
+    pattern: `<input\\b[^>]*type=["']password["']`,
+    flags: "",
+    absent: "showPassword|setShowPassword|togglePassword|revealPassword|passwordVisible|isPasswordVisible|showPw|hidePassword",
+    message: 'Raw <input type="password">: use the shared reusable Input component (which renders a show/hide toggle for passwords) instead of a bare input, or add the toggle (frontend-policy).',
+    severity: "warn",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-no-native-dialog",
+    label: "No native browser dialogs",
+    files: ["*.tsx", "*.jsx", "*.ts", "*.js", "*.mts", "*.cts", "*.vue", "*.svelte", "*.astro"],
+    excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**"],
+    scope: "file",
+    // window.(alert|confirm|prompt)( is unambiguously the native dialog (window is browser-only,
+    // so no false positive in a Node file). Bare alert/confirm/prompt is matched ONLY with a
+    // string-literal arg - native dialogs take a string, while CLI libs (clack/inquirer) and
+    // custom design-system dialogs take a {config} object, and an AI `prompt` value is a string
+    // that is passed, not called with a string literal. flags:"" is case-sensitive so a
+    // capitalized custom <Alert>/Confirm() is not matched; (?<![.\w]) excludes method calls.
+    pattern: `\\bwindow\\.(alert|confirm|prompt)\\s*\\(|(?<![.\\w])(alert|confirm|prompt)\\s*\\(\\s*["']`,
+    flags: "",
+    message: "Native browser dialog (alert/confirm/prompt) - use a dialog/modal component that matches the page design instead of the browser's built-in (frontend-policy).",
+    severity: "warn",
+    skill: "frontend-policy"
+  }
+];
+var PROJECT_CHECKS = {
+  "ts-relational-no-prisma": (root) => {
+    const pkg = readPkgDeps(root);
+    if (!pkg) return false;
+    const hasTs = "typescript" in pkg || existsSync(join(root, "tsconfig.json"));
+    if (!hasTs) return false;
+    const relational = ["typeorm", "sequelize", "knex", "drizzle-orm", "pg", "mysql", "mysql2", "better-sqlite3", "@mikro-orm/core"];
+    if (!relational.some((d) => d in pkg)) return false;
+    return !("prisma" in pkg || "@prisma/client" in pkg);
+  }
+};
+function readPkgDeps(root) {
+  try {
+    const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
+    return { ...pkg.dependencies, ...pkg.devDependencies, ...pkg.optionalDependencies, ...pkg.peerDependencies };
+  } catch {
+    return null;
+  }
+}
+function globToRegExp(glob) {
+  const esc = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const body = esc.replace(/\*\*/g, " ").replace(/\*/g, "[^/]*").replace(/ /g, ".*").replace(/\?/g, "[^/]");
+  return new RegExp(glob.includes("/") ? `^${body}$` : `(^|/)${body}$`);
+}
+function guardrailsConfigPath() {
+  return process.env.ENIGMA_GUARDRAILS_CONFIG || join(homedir(), ".enigma-guardrails.json");
+}
+function isValidRule(r) {
+  const x = r;
+  if (!x || typeof x.id !== "string" || !Array.isArray(x.files) || typeof x.message !== "string") return false;
+  if (x.severity !== "block" && x.severity !== "warn") return false;
+  if (x.scope === "file") return typeof x.pattern === "string";
+  if (x.scope === "project") return typeof x.check === "string";
+  return false;
+}
+function loadRules() {
+  let disabled = [];
+  let custom = [];
+  try {
+    const raw = JSON.parse(readFileSync(guardrailsConfigPath(), "utf8"));
+    if (Array.isArray(raw.disabled)) disabled = raw.disabled.filter((s) => typeof s === "string");
+    if (Array.isArray(raw.rules)) custom = raw.rules.filter(isValidRule);
+  } catch {
+  }
+  const off = new Set(disabled);
+  return [...BUILTIN_RULES.filter((r) => !off.has(r.id)), ...custom];
+}
+function findProjectRoot(file) {
+  let dir = dirname(resolve(file));
+  for (let i = 0; i < 40; i++) {
+    const isProj = existsSync(join(dir, "package.json")) || existsSync(join(dir, ".enigma.json"));
+    let hasGit = false;
+    try {
+      hasGit = statSync(join(dir, ".git")).isDirectory();
+    } catch {
+    }
+    if (isProj || hasGit) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  return null;
+}
+function checkFile(file, content, projectRoot) {
+  const norm = file.replace(/\\/g, "/");
+  const out = [];
+  for (const rule of loadRules()) {
+    if (!rule.files.some((g) => globToRegExp(g).test(norm))) continue;
+    if (rule.excludeFiles?.some((g) => globToRegExp(g).test(norm))) continue;
+    const base = { ruleId: rule.id, severity: rule.severity, file: norm, message: rule.message, skill: rule.skill };
+    if (rule.scope === "file" && rule.pattern) {
+      if (rule.absent) {
+        try {
+          if (new RegExp(rule.absent, "i").test(content)) continue;
+        } catch {
+        }
+      }
+      let re;
+      try {
+        re = new RegExp(rule.pattern, (rule.flags ?? "i").replace(/g/g, ""));
+      } catch {
+        continue;
+      }
+      const lines = content.split("\n");
+      for (let i = 0; i < lines.length; i++) {
+        if (COMMENT_LINE.test(lines[i])) continue;
+        if (re.test(lines[i])) out.push({ ...base, line: i + 1 });
+      }
+    } else if (rule.scope === "project" && rule.check && projectRoot) {
+      const check = PROJECT_CHECKS[rule.check];
+      if (check && check(projectRoot)) out.push({ ...base });
+    }
+  }
+  return out;
+}
+function formatFindings(findings) {
+  return findings.map((f) => {
+    const tag = f.severity === "block" ? "MUST FIX" : "SUGGESTED";
+    const loc = f.line ? `:${f.line}` : "";
+    const skill = f.skill ? ` [${f.skill}]` : "";
+    return `${tag} ${f.file}${loc} (${f.ruleId})${skill}: ${f.message}`;
+  }).join("\n");
+}
+function checkPath(file) {
+  let content;
+  try {
+    content = readFileSync(file, "utf8");
+  } catch {
+    return [];
+  }
+  if (content.includes("\0")) return [];
+  return checkFile(file, content, findProjectRoot(file));
+}
+function runGuardrailsHook(payload) {
+  let file;
+  try {
+    file = JSON.parse(payload ?? readFileSync(0, "utf8"))?.tool_input?.file_path;
+  } catch {
+  }
+  if (!file || typeof file !== "string") return 0;
+  const findings = checkPath(file);
+  if (!findings.length) return 0;
+  const warns = findings.filter((f) => f.severity === "warn");
+  const blocks = findings.filter((f) => f.severity === "block");
+  if (warns.length) process.stdout.write(`enigma guardrails (suggestions)
+${formatFindings(warns)}
+`);
+  if (blocks.length) {
+    process.stderr.write(`enigma guardrails
+${formatFindings(blocks)}
+Fix the above before continuing.
+`);
+    return 2;
+  }
+  return 0;
+}
+function gitFiles(all) {
+  const out = execFileSync("git", all ? ["ls-files"] : ["diff", "--cached", "--name-only", "--diff-filter=ACM"], { encoding: "utf8" });
+  return out.split("\n").map((s) => s.trim()).filter(Boolean);
+}
+function runGuardrailsScan(all) {
+  let files;
+  try {
+    files = gitFiles(all);
+  } catch {
+    return { ok: true, blocks: [], warns: [], count: 0, notRepo: true };
+  }
+  const root = process.cwd();
+  const blocks = [];
+  const warns = [];
+  for (const file of files) {
+    let content;
+    try {
+      content = readFileSync(file, "utf8");
+    } catch {
+      continue;
+    }
+    if (content.includes("\0")) continue;
+    for (const f of checkFile(file, content, root)) (f.severity === "block" ? blocks : warns).push(f);
+  }
+  return { ok: blocks.length === 0, blocks, warns, count: files.length };
+}
+function runGuardrailsScanCli(all) {
+  const r = runGuardrailsScan(all);
+  if (r.notRepo) {
+    console.error("enigma-guardrails: not a git repository; nothing to check.");
+    return 0;
+  }
+  if (r.warns.length) {
+    console.error(`enigma-guardrails: ${r.warns.length} suggestion(s):`);
+    for (const w of r.warns) console.error(`  ! ${formatFindings([w])}`);
+  }
+  if (r.blocks.length) {
+    console.error(`
+enigma-guardrails: BLOCKED - ${r.blocks.length} convention violation(s):`);
+    for (const b of r.blocks) console.error(`  x ${formatFindings([b])}`);
+    console.error("\nTo bypass intentionally for one commit: git commit --no-verify");
+    return 1;
+  }
+  console.log(`enigma-guardrails: ${r.count} ${all ? "tracked" : "staged"} file(s) checked, no blocking violations.`);
+  return 0;
+}
+var grEntry = process.argv[1] ?? "";
+var isGrEntry = /(^|[\\/])guardrails\.[mc]?[jt]s$/.test(grEntry);
+if (isGrEntry && fileURLToPath(import.meta.url) === grEntry) {
+  process.exit(runGuardrailsScanCli(process.argv.includes("--all")));
+}
+export {
+  BUILTIN_RULES,
+  PROJECT_CHECKS,
+  checkFile,
+  checkPath,
+  findProjectRoot,
+  formatFindings,
+  loadRules,
+  runGuardrailsHook,
+  runGuardrailsScan,
+  runGuardrailsScanCli
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.30.4",
+  "version": "1.30.5",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {
@@ -17,7 +17,8 @@
     "seal": "tsx src/bin/enigma.ts seal",
     "check": "tsx src/bin/enigma.ts check",
     "guard": "tsx src/guard.ts --all",
-    "verify": "npm run typecheck && npm run check && npm run guard",
+    "guardrails": "tsx src/guardrails.ts --all",
+    "verify": "npm run typecheck && npm run check && npm run guard && npm run guardrails",
     "prepublishOnly": "npm run verify && npm run build",
     "postinstall": "node bin/postinstall.mjs"
   },