enigma-cli 1.31.3 → 1.31.5

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-07-23T04:41:39+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "d091e8708888d23ee14cdd6c0e71f386861f2252d95360895a31c73db090a689"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-06-26T13:40:52+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "dc9ceb784004b05a0117c464e4bed05946835a04acea282586c0b735ee7c2284"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
   "updated": "2026-07-16T22:43:53+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "d132f20db08806054d95e58d3d56c2aa7ebc8e6dd24d902b0a0ed9ddfae216c5"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-06-03T14:19:50+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: frontend-policy
-description: Frontend architecture - reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals the current state - form saves, toggles, filters, reorders - not just saves), client-side caching (localStorage/sessionStorage to avoid redundant server calls and survive rate limits), instant first paint (render the shell immediately, load data async via the API, show skeletons - never block render on data), perceived performance and responsiveness (instant interaction feedback, prefetch on intent, debounce/throttle, cancel stale requests, avoid request waterfalls, lazy-load heavy widgets), large-list rendering (virtualized infinite scroll vs pagination, skeletons, progressive/parallel loading, short-TTL caching), optimistic UI with rollback, visual restraint (never a card inside a card, borders only where they carry information, spacing and background tone before chrome), icon actions (repeated row/card actions like copy, edit, rename, remove, download, refresh are icon-only buttons carrying aria-label plus title, never a text label), responsive/adaptive layout (fluid units, breakpoints, no overlap or horizontal overflow, viewport meta, touch targets), AI chat/assistant/agent interfaces (use Vercel's AI Elements registry for message threads, streaming, reasoning and tool-call panels, prompt inputs - never hand-roll chat UI in React), and periodic React code-health audits (react-doctor). Use when building or changing UI components, client state, forms/save flows, data fetching/caching, lists that show lots of data, loading states, dashboards/panels, layout/responsiveness, making the UI feel fast, building a chat/AI/agent/LLM interface, or any frontend structure.
+description: Frontend architecture - reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals the current state - form saves, toggles, filters, reorders - not just saves; dirty means the values DIFFER from the loaded snapshot, not that the user touched the field, so a value edited and put back leaves Save disabled), client-side caching (localStorage/sessionStorage to avoid redundant server calls and survive rate limits), instant first paint (render the shell immediately, load data async via the API, show skeletons - never block render on data), perceived performance and responsiveness (instant interaction feedback, prefetch on intent, debounce/throttle, cancel stale requests, avoid request waterfalls, lazy-load heavy widgets), large-list rendering (virtualized infinite scroll vs pagination, skeletons, progressive/parallel loading, short-TTL caching), optimistic UI with rollback, visual restraint (never a card inside a card, borders only where they carry information, spacing and background tone before chrome), icon actions (repeated row/card actions like copy, edit, rename, remove, download, refresh are icon-only buttons carrying aria-label plus title, never a text label), responsive/adaptive layout (fluid units, breakpoints, no overlap or horizontal overflow, viewport meta, touch targets), AI chat/assistant/agent interfaces (use Vercel's AI Elements registry for message threads, streaming, reasoning and tool-call panels, prompt inputs - never hand-roll chat UI in React), and periodic React code-health audits (react-doctor). Use when building or changing UI components, client state, forms/save flows, data fetching/caching, lists that show lots of data, loading states, dashboards/panels, layout/responsiveness, making the UI feel fast, building a chat/AI/agent/LLM interface, or any frontend structure.
 ---
 
 # Frontend Architecture Policy
@@ -161,6 +161,12 @@ The general rule: before running any operation, check whether its result would e
 
 - Track the saved snapshot when the form/settings loads or after a successful save; compute dirtiness by comparing the edited values against it.
   - Example: a value goes x -> z -> back to x before saving. The net change is zero - the form is NOT dirty, and Save must send nothing to the backend.
+- **Dirty means different, not touched.** Recompute the comparison on every change. Never raise a `dirty` flag from an onChange/onInput handler: a flag set by interaction stays raised after the user types a character and deletes it again, which is the exact case this rule exists for.
+- **Valid is not dirty.** A Save gated only on validity ("the name is not empty", "there are no errors") still fires a no-op on a form nobody edited. Both conditions have to hold: the values differ AND they are valid.
+- **Normalize before comparing**, using the same rules the field itself applies: trim surrounding whitespace, and case-fold only where the value is case-insensitive (a username usually is, a display name is not). Leading whitespace is not an edit; a different letter case may be.
+- **A disabled Save must say why.** Keep it visible and disabled rather than hidden, and put the reason within reach (a `title` or one line of helper text, "No changes to save"), so the form does not read as broken. Never leave it looking enabled while it silently does nothing.
+- On load the form is not dirty, so Save starts disabled; after a successful save the snapshot becomes the saved values and Save returns to disabled.
+- **Autosave, blur-save and inline edits obey the same check.** On blur or after the debounce, compare against the snapshot and send nothing when the value came back to where it started.
 - When the form is not dirty, Save must never hit the network. Two acceptable UX options:
   - Preferred: disable / neutralize the Save button while the edited values equal the snapshot, so there is nothing to submit until a real change exists.
   - Or keep Save enabled but short-circuit on click: show the normal "saved" confirmation instantly and send NO request. Never open a spinner or fire a call for a no-op.

package/assets/skills/frontend-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "frontend-policy",
-  "version": "1.19.0",
+  "version": "1.20.0",
   "provider": "FJRG2007/enigma",
-  "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals current state, not just form saves), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.31.3",
-  "sha": "9f36e32b0a0c31c48d05b26b50112e12014739ad9002ff3a68c8f639ddd44476"
+  "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
+  "updated": "2026-07-29T01:26:14+02:00",
+  "cliVersion": "1.31.5",
+  "sha": "71ebc71510c8aa54d7925445a7dffc55dbce9eba209fb6a63bae05d119217d79"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-07-16T22:44:02+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "e6dfbc33884000d9d25841bd9c5a84d6558ffd374882cb7b34451eb2cebc2161"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "13d24c217bdb6fe83fe16835d8f5c3d397a9f3338f16876c61ef96e97f34c90a"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-07-27T17:22:17+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "b9046c15fd636057a8e42e199d2eeb47297477f38a0a26a07a7b0bf71d61fcb4"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
   "updated": "2026-07-22T01:41:06+02:00",
-  "cliVersion": "1.31.3",
+  "cliVersion": "1.31.5",
   "sha": "d937df0052d1ec151728a28f6567744d9e7ca0a65d84b4d5c9a697f1e40d704f"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "5947b36a698c19cba84bc42fd8690b1e9acabc9c288c8fdf20b1595a88f01a98",
-  "enigma-linux-arm64": "e13a8a57b2fbb45bc916f5c6299fa735c7093ddaa34204c96a44a22f04326385",
-  "enigma-linux-x64": "a821a20a6cf05c104859b7a3f4a838cce8be01dafb5da1dcf85853a21c184f79",
-  "enigma-win32-x64.exe": "4d84edbc1e8ab7703ed9e8a0f3f226051493ae8fa351b613da8891dd9b206b35"
+  "enigma-darwin-arm64": "8706843ef8eb3bb58cabb4ecfefd4b5759fa046fe63d241ba59774dd398a2fd7",
+  "enigma-linux-arm64": "d077e465d985310d0d774d7593ce7354c887e30774925883b38b83bf9c274c51",
+  "enigma-linux-x64": "e1fd9298a22e93a61ea01e30755f5295c34c005a5a1a6afad3cd887fbf342795",
+  "enigma-win32-x64.exe": "30a76b1f92915b34123b5e3fd438d388bf932eb6e25f6d633c53e5458c0a191a"
 }

package/bin/enigma.mjs

@@ -15,36 +15,23 @@
  * here, since its own __dirname lives in Bun's virtual filesystem.
  */
 
-import { spawn } from "node:child_process";
-import { existsSync, readFileSync } from "node:fs";
-import { join } from "node:path";
 import os from "node:os";
-import { ARCH, PLATFORM, packageVersion, pkgRoot } from "./platform.mjs";
+import { join } from "node:path";
+import { existsSync } from "node:fs";
+import { spawn } from "node:child_process";
 import { downloadBinary, installedBinary } from "./download.mjs";
+import { ARCH, PLATFORM, packageVersion, pkgRoot } from "./platform.mjs";
 
 /**
  * Fast path: an agent status bar (e.g. Claude Code's statusLine) calls `enigma
- * statusline` on every refresh. Handle it here in the lightweight Node launcher -
- * reading .enigma.json directly - so it never resolves or spawns the Bun binary.
- * Always prints `[ENIGMA]` (amber); when token-efficient output is active it appends
- * the level, e.g. `[ENIGMA:FULL]`.
+ * statusline` on every refresh. Handle it here in the lightweight Node launcher so
+ * it never resolves or spawns the Bun binary. The renderer is imported lazily, so
+ * every other command pays nothing for it.
  */
-function readOutputStyle() {
-    let style = "off";
-    // Mirror config.ts precedence: global (~/.enigma.json) then local (cwd), nearest wins.
-    for (const dir of [os.homedir(), process.cwd()]) {
-        try {
-            const raw = JSON.parse(readFileSync(join(dir, ".enigma.json"), "utf8"));
-            if (raw && typeof raw.outputStyle === "string") style = raw.outputStyle;
-        } catch { /* missing/invalid .enigma.json - ignore */ }
-    }
-    return style;
-};
 if (process.argv[2] === "statusline") {
     try {
-        const style = readOutputStyle();
-        const label = (!style || style === "off") ? "ENIGMA" : `ENIGMA:${style.toUpperCase()}`;
-        process.stdout.write(process.env.NO_COLOR ? `[${label}]` : `\x1b[38;5;172m[${label}]\x1b[0m`);
+        const { printStatusline } = await import("./statusline.mjs");
+        printStatusline();
     } catch { /* a status bar must never error */ }
     process.exit(0);
 }

package/bin/statusline.mjs

@@ -0,0 +1,323 @@
+#!/usr/bin/env node
+/**
+ * Status bar renderer for agent status lines (Claude Code's `statusLine`).
+ *
+ * Lives on the launcher's fast path (bin/enigma.mjs), so it stays dependency-free
+ * and never resolves the Bun binary: a status bar re-runs on every refresh, and
+ * cold-starting a ~260 MB binary each time is not an option. That constraint is
+ * also why gate progress arrives through a small snapshot file the daemon writes
+ * instead of the gate's SQLite database, which only the Bun runtime can open.
+ *
+ * Both inputs are optional: the session JSON the agent pipes on stdin, and the
+ * gate snapshot. Output is one line at rest, two while a gate run is active.
+ *
+ * Nothing here may throw. A status bar that errors displays the error until the
+ * next refresh, so every reader is guarded and every field is treated as absent
+ * until proven otherwise.
+ */
+
+import os from "node:os";
+import { join } from "node:path";
+import { readFileSync } from "node:fs";
+
+/** Snapshot schema this renderer understands; a newer file is ignored, not guessed at. */
+const SNAPSHOT_VERSION = 1;
+
+/** Spinner frames, advanced once per second (the status bar's fastest refresh). */
+const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
+
+const BAR_FILLED = "▰";
+const BAR_EMPTY = "▱";
+
+/**
+ * 256-color SGR codes. The status/state colors use the low indices so they follow
+ * the terminal's own palette, but greys are pinned to the greyscale ramp: index 8
+ * ("bright black") is rendered near-black by many terminals, which makes secondary
+ * text vanish on a dark background. 245 matches the weight of the harness's own
+ * hint text; `track` is a step quieter, since an empty meter cell is a background
+ * rail rather than something to read.
+ */
+const COLORS = { red: 1, green: 2, yellow: 3, blue: 4, cyan: 6, dim: 245, track: 240, amber: 172 };
+
+/** Built at runtime so no raw control byte ever lives in this source file. */
+const ESC = String.fromCharCode(27);
+
+/** Matches any SGR sequence, so styled text can be measured by visible width. */
+const SGR = new RegExp(`${ESC}\\[[0-9;]*m`, "g");
+
+/**
+ * How a step status paints its cell in the pipeline bar. `pulse` marks the
+ * states that animate, so a parked or working run is visibly alive.
+ */
+const STEP_STYLES = {
+    completed: { color: "green", glyph: BAR_FILLED },
+    running: { color: "blue", glyph: BAR_FILLED },
+    fixing: { color: "cyan", glyph: BAR_FILLED },
+    fix_review: { color: "yellow", glyph: BAR_FILLED, pulse: true },
+    awaiting_approval: { color: "yellow", glyph: BAR_FILLED, pulse: true },
+    failed: { color: "red", glyph: BAR_FILLED },
+    skipped: { color: "dim", glyph: BAR_FILLED },
+    pending: { color: "track", glyph: BAR_EMPTY }
+};
+
+/** Step statuses that mean the pipeline is working or parked rather than settled. */
+const ACTIVE_STEP_STATUSES = new Set(["running", "fixing", "fix_review", "awaiting_approval"]);
+
+/** Run statuses worth showing; a settled run leaves the status bar alone. */
+const ACTIVE_RUN_STATUSES = new Set(["pending", "running"]);
+
+/**
+ * Parses JSON, tolerating a leading UTF-8 BOM. Windows tooling emits one freely,
+ * and every reader here fails silently by design, so a BOM would otherwise show
+ * up as an inexplicably blank status bar.
+ */
+function parseJson(text) {
+    return JSON.parse(text.charCodeAt(0) === 0xFEFF ? text.slice(1) : text);
+}
+
+/** Wraps text in a 256-color SGR sequence, or returns it unchanged without color. */
+function paint(text, color, color256) {
+    if (!color256) return text;
+    return `${ESC}[38;5;${COLORS[color] ?? COLORS.dim}m${text}${ESC}[0m`;
+}
+
+/** Dims a string to the secondary palette entry. */
+function dim(text, color256) {
+    return paint(text, "dim", color256);
+}
+
+/** Visible width of a string, ignoring SGR sequences. */
+function width(text) {
+    return text.replace(SGR, "").length;
+}
+
+/**
+ * Joins parts with a separator, dropping the lowest-priority parts (those latest
+ * in the list with `optional: true`) until the line fits `max` columns. Required
+ * parts are never dropped; an over-long line is truncated as a last resort.
+ */
+function fit(parts, sep, max) {
+    const kept = parts.filter((p) => p && p.text);
+    while (kept.length > 1) {
+        const line = kept.map((p) => p.text).join(sep);
+        if (width(line) <= max) return line;
+        const victim = kept.map((p, i) => (p.optional ? i : -1)).filter((i) => i !== -1).pop();
+        if (victim === undefined) break;
+        kept.splice(victim, 1);
+    }
+    const line = kept.map((p) => p.text).join(sep);
+    return width(line) <= max ? line : `${line.slice(0, Math.max(0, max - 1))}…`;
+}
+
+/** Renders an n-cell meter, e.g. context window usage. */
+function meter(fraction, cells, color, color256) {
+    const filled = Math.max(0, Math.min(cells, Math.round(fraction * cells)));
+    return paint(BAR_FILLED.repeat(filled), color, color256)
+        + paint(BAR_EMPTY.repeat(cells - filled), "track", color256);
+}
+
+/** Colors a context percentage by pressure: green under 70, yellow under 90, red beyond. */
+function pressureColor(pct) {
+    if (pct >= 90) return "red";
+    if (pct >= 70) return "yellow";
+    return "green";
+}
+
+/** Compact elapsed time: "42s", "7m12s", "2h05m". */
+function formatElapsed(seconds) {
+    const s = Math.max(0, Math.floor(seconds));
+    if (s < 60) return `${s}s`;
+    const m = Math.floor(s / 60);
+    if (m < 60) return `${m}m${String(s % 60).padStart(2, "0")}s`;
+    return `${Math.floor(m / 60)}h${String(m % 60).padStart(2, "0")}m`;
+}
+
+/**
+ * Reads the token-efficient output level from .enigma.json, mirroring config.ts
+ * precedence: global (~/.enigma.json) then local (cwd), nearest wins.
+ */
+function readOutputStyle() {
+    let style = "off";
+    for (const dir of [os.homedir(), process.cwd()]) {
+        try {
+            const raw = parseJson(readFileSync(join(dir, ".enigma.json"), "utf8"));
+            if (raw && typeof raw.outputStyle === "string") style = raw.outputStyle;
+        } catch { /* missing/invalid .enigma.json - ignore */ }
+    }
+    return style;
+}
+
+/** The [ENIGMA] badge, carrying the active token-efficient level when one is set. */
+function badge(color256) {
+    const style = readOutputStyle();
+    const label = (!style || style === "off") ? "ENIGMA" : `ENIGMA:${style.toUpperCase()}`;
+    return paint(`[${label}]`, "amber", color256);
+}
+
+/** Path to the snapshot the gate daemon writes, mirroring gate/paths.ts. */
+export function snapshotPath() {
+    const root = process.env.ENIGMA_GATE_HOME || join(os.homedir(), ".enigma", "gate");
+    return join(root, "statusline.json");
+}
+
+/** Reports whether a process is alive, used to discard a snapshot from a dead daemon. */
+function pidAlive(pid) {
+    if (!Number.isInteger(pid) || pid <= 0) return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    } catch (err) {
+        // EPERM means the process exists but belongs to another user.
+        return err && err.code === "EPERM";
+    }
+}
+
+/**
+ * Loads the gate snapshot for `cwd`, or null when there is nothing to show.
+ * Rejects a snapshot that is for another repository, from an unknown schema
+ * version, already settled, or left behind by a daemon that is no longer running.
+ */
+export function readSnapshot(cwd, path = snapshotPath()) {
+    let snap;
+    try {
+        snap = parseJson(readFileSync(path, "utf8"));
+    } catch {
+        return null;
+    }
+    if (!snap || snap.version !== SNAPSHOT_VERSION) return null;
+    if (!ACTIVE_RUN_STATUSES.has(snap.status)) return null;
+    if (!Array.isArray(snap.steps) || snap.steps.length === 0) return null;
+    if (typeof snap.repoPath !== "string" || !isInside(cwd, snap.repoPath)) return null;
+    if (!pidAlive(snap.pid)) return null;
+    return snap;
+}
+
+/** Reports whether `cwd` is the repo root or a directory beneath it. */
+function isInside(cwd, root) {
+    const a = String(cwd || "").replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+    const b = root.replace(/\\/g, "/").replace(/\/+$/, "").toLowerCase();
+    return a === b || a.startsWith(`${b}/`);
+}
+
+/**
+ * Renders the base line: the enigma badge, model, project, context meter and
+ * session cost. Everything after the badge is optional and drops away on a
+ * narrow terminal, in reverse order of usefulness.
+ */
+function renderBase(session, columns, color256) {
+    const model = session?.model?.display_name;
+    const dir = session?.workspace?.current_dir || session?.cwd;
+    const project = typeof dir === "string" ? dir.replace(/\\/g, "/").split("/").filter(Boolean).pop() : null;
+    const pct = session?.context_window?.used_percentage;
+    const cost = session?.cost?.total_cost_usd;
+
+    const parts = [{ text: badge(color256) }];
+    if (model) parts.push({ text: paint(model, "cyan", color256), optional: true });
+    if (project) parts.push({ text: dim(project, color256), optional: true });
+    if (typeof pct === "number") {
+        const rounded = Math.round(pct);
+        parts.push({
+            text: `${meter(rounded / 100, 8, pressureColor(rounded), color256)} ${dim(`${rounded}%`, color256)}`,
+            optional: true
+        });
+    }
+    if (typeof cost === "number" && cost > 0) {
+        parts.push({ text: dim(`$${cost.toFixed(2)}`, color256), optional: true });
+    }
+    return fit(parts, "  ", columns);
+}
+
+/**
+ * Renders the gate line: a spinner, one bar cell per pipeline step, the step
+ * count, the active step with its elapsed time, and the PR once one exists.
+ *
+ * The bar doubles as the legend - cell N is step N - so the whole pipeline fits
+ * one line. The active cell alternates glyph each frame, which is what makes a
+ * long step visibly still working rather than hung.
+ */
+function renderGate(snap, columns, frame, nowSec, color256) {
+    const steps = snap.steps.filter((s) => s && typeof s.name === "string");
+    const done = steps.filter((s) => s.status === "completed" || s.status === "skipped").length;
+    const active = steps.find((s) => ACTIVE_STEP_STATUSES.has(s.status));
+    const failed = steps.find((s) => s.status === "failed");
+    const current = active ?? failed;
+
+    const cells = steps.map((s) => {
+        const style = STEP_STYLES[s.status] ?? STEP_STYLES.pending;
+        const glyph = style.pulse && frame % 2 === 1 ? BAR_EMPTY : style.glyph;
+        return paint(glyph, style.color, color256);
+    }).join("");
+
+    // The spinner turns only while a step is actually working; a failed run holds
+    // a red marker instead, so a stalled pipeline never looks like a busy one.
+    const spinner = active
+        ? paint(SPINNER[frame % SPINNER.length], snap.awaiting ? "yellow" : "blue", color256)
+        : paint(BAR_FILLED, failed ? "red" : "dim", color256);
+
+    let labelColor = "blue";
+    if (snap.awaiting) labelColor = "yellow";
+    else if (!active && failed) labelColor = "red";
+    const label = snap.awaiting ? "needs you" : (current ? current.name : snap.status);
+    // A negative age means the snapshot and this process disagree about the clock.
+    // Dropping the segment is honest; a confident "0s" is not.
+    const started = current?.startedAt ?? snap.startedAt;
+    const age = typeof started === "number" ? nowSec - started : -1;
+    const elapsed = age >= 0 ? formatElapsed(age) : null;
+
+    const parts = [
+        { text: `${spinner} ${dim("gate", color256)}` },
+        { text: cells },
+        { text: dim(`${done}/${steps.length}`, color256) },
+        { text: paint(label, labelColor, color256) }
+    ];
+    if (elapsed) parts.push({ text: dim(elapsed, color256), optional: true });
+    if (typeof snap.branch === "string" && snap.branch) {
+        parts.push({ text: dim(snap.branch, color256), optional: true });
+    }
+    if (typeof snap.prUrl === "string") {
+        const num = snap.prUrl.match(/\/(\d+)(?:\/)?$/);
+        if (num) parts.push({ text: dim(`PR #${num[1]}`, color256), optional: true });
+    }
+    return fit(parts, "  ", columns);
+}
+
+/**
+ * Builds the full status bar. `frame` drives the animation and is derived from
+ * wall-clock seconds by the caller, so consecutive refreshes advance it without
+ * this module holding any state.
+ */
+export function render({ session, snapshot, columns = 80, frame = 0, nowSec = 0, color256 = true }) {
+    const lines = [renderBase(session, columns, color256)];
+    if (snapshot) lines.push(renderGate(snapshot, columns, frame, nowSec, color256));
+    return lines.join("\n");
+}
+
+/** Reads the piped session JSON, or null when nothing is piped in. */
+function readSession() {
+    if (process.stdin.isTTY) return null;
+    try {
+        return parseJson(readFileSync(0, "utf8"));
+    } catch {
+        return null;
+    }
+}
+
+/** Entry point for `enigma statusline`. Prints the bar and never throws. */
+export function printStatusline() {
+    try {
+        const session = readSession();
+        const cwd = session?.workspace?.current_dir || session?.cwd || process.cwd();
+        const columns = Number(process.env.COLUMNS) || 80;
+        const nowSec = Math.floor(Date.now() / 1000);
+        process.stdout.write(render({
+            session,
+            snapshot: readSnapshot(cwd),
+            columns,
+            frame: nowSec,
+            nowSec,
+            color256: !process.env.NO_COLOR
+        }));
+    } catch {
+        // A status bar must never error or emit noise.
+    }
+}

package/dist/guardrails.js

@@ -336,6 +336,17 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "technical-writing-policy"
   },
+  // NOTE: there is deliberately no "Save button with no dirty check" rule, even though
+  // no-op detection is one of frontend-policy's headline rules. It has no file-local
+  // signature that survives measurement. The dirtiness normally lives in a parent, a store
+  // or a form library, so its absence from THIS file proves nothing; the policy explicitly
+  // allows an enabled Save that short-circuits on click, so a missing `disabled` is not
+  // evidence of the defect either; and the same markup is correct on a create form, which
+  // has nothing to compare against. Measured on the corpus: 2 save buttons in 108
+  // form-capable files (no signal), and the interaction-based dirty flag that WOULD be a
+  // precise signature (a dirty/hasChanges flag assigned a literal true) returned 0 real
+  // hits and 2 false ones, a CLI tracking whether it had rewritten a config file. A rule
+  // here would fire on correct code, so it stays guidance in frontend-policy.
   // NOTE: there is deliberately no "card inside a card" or "border with no information"
   // rule, even though both are named in frontend-policy. They are RELATIONAL defects: a
   // container is redundant only relative to the ancestor it sits in and the spacing around

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.31.3",
+  "version": "1.31.5",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {