enigma-cli 1.31.7 → 1.32.1

package/README.md

@@ -369,6 +369,25 @@ enigma config claude-survey off       # disable again
 enigma config claude-survey off -g    # global (~/.claude/settings.json)
 ```
 
+## Claude workspace trust (default on)
+
+Claude Code asks "Is this a project you trust?" the first time it starts in a
+folder, and in your home directory it asks *every* time - the answer is never
+persisted there. enigma answers it for you, for any path, by recording the trust
+in Claude's own `.claude.json`: the filesystem root (which Claude inherits down
+every directory) plus each workspace you launch in.
+
+This is a security trade-off, and the reason it is a toggle: that prompt is what
+makes you look at unfamiliar code before an agent runs in it.
+
+```bash
+enigma config claude-trust off        # keep Claude's trust prompt
+enigma config claude-trust on         # answer it once and for all (default)
+```
+
+Turning it off stops the blanket, and leaves the folders already trusted alone -
+it never re-asks for projects you accepted yourself.
+
 ## Commit emojis
 
 By default the policy skills make commit subjects carry a leading type emoji

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-07-23T04:41:39+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "d091e8708888d23ee14cdd6c0e71f386861f2252d95360895a31c73db090a689"
 }

package/assets/skills/ciphera-style-policy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ciphera-style-policy
-description: Ciphera code style conventions - mandatory formatting and language idioms for source code (TypeScript-first, applies to every language) - American-English naming, double quotes, string interpolation, length-sorted imports, 4-space indentation, comment/JSDoc format, compact single-line blocks, and code-level anti-patterns (barrel files, external CDN/hosting dependencies). Use whenever writing, refactoring, or reviewing source code.
+description: Ciphera code style conventions - mandatory formatting and language idioms for source code (TypeScript-first, applies to every language) - American-English naming, double quotes, string interpolation, length-sorted imports, one statement per module and a namespace import (`import * as ns`) instead of a long named list from a project module, 4-space indentation, comment/JSDoc format, compact single-line blocks, and code-level anti-patterns (barrel files, external CDN/hosting dependencies). Use whenever writing, refactoring, or reviewing source code.
 ---
 
 # Ciphera Code Style Policy
@@ -60,6 +60,22 @@ const path = `/path/to/${folderName}/file`;
 ## Imports
 
 - Sort imports by line length, shortest first.
+- One statement per module: never import the same module twice in a file (a value import plus a `type` import of the same module is still one statement, with `type` on the members).
+- When you need many symbols from one of the project's own modules, import the module as a NAMESPACE instead of listing them. A named list is fine for a handful; past that the line stops being readable, and every new export widens it again. The namespace also makes each call site say where the symbol comes from.
+- Name the namespace after the module. When that name is already a local variable in the file, pick a distinct one (`conf` for a config module whose values are held in `config` variables, `gateDb` for a `db` module) rather than shadowing it.
+- This applies to modules the project owns (relative paths, path aliases). Standard-library and package imports stay named: their surface is fixed and the ecosystem reads them that way.
+
+```ts
+// Bad: 13 symbols on one line, and it grows with every new export.
+import { readConfig, readGlobalConfig, CONFIG_DEFAULTS, setEnigmaToggle, setEnigmaValue, OUTPUT_STYLES, DASHBOARD_MODES } from "./config";
+
+// Good
+import * as conf from "./config";
+
+const { config } = conf.readConfig();
+if (!conf.OUTPUT_STYLES.includes(style)) return;
+```
+
 - Do not import from external hostings or CDNs; depend on a package name, not a remote URL.
 - For obscure libraries, vendor the needed code into the project utilities instead of adding a fragile dependency.
 

package/assets/skills/ciphera-style-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "ciphera-style-policy",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "provider": "FJRG2007/enigma",
-  "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "updated": "2026-06-26T13:40:52+02:00",
-  "cliVersion": "1.31.7",
-  "sha": "dc9ceb784004b05a0117c464e4bed05946835a04acea282586c0b735ee7c2284"
+  "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
+  "updated": "2026-07-30T15:47:21+02:00",
+  "cliVersion": "1.32.1",
+  "sha": "05dc812da459071110d96ee41c5201b1ee230471d635352415e10ef8b220c267"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
   "updated": "2026-07-16T22:43:53+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "d132f20db08806054d95e58d3d56c2aa7ebc8e6dd24d902b0a0ed9ddfae216c5"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-06-03T14:19:50+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
   "updated": "2026-07-29T01:26:14+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "71ebc71510c8aa54d7925445a7dffc55dbce9eba209fb6a63bae05d119217d79"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-07-16T22:44:02+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "e6dfbc33884000d9d25841bd9c5a84d6558ffd374882cb7b34451eb2cebc2161"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "13d24c217bdb6fe83fe16835d8f5c3d397a9f3338f16876c61ef96e97f34c90a"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-07-27T17:22:17+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "b9046c15fd636057a8e42e199d2eeb47297477f38a0a26a07a7b0bf71d61fcb4"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
   "updated": "2026-07-22T01:41:06+02:00",
-  "cliVersion": "1.31.7",
+  "cliVersion": "1.32.1",
   "sha": "d937df0052d1ec151728a28f6567744d9e7ca0a65d84b4d5c9a697f1e40d704f"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "f070f39baf516eede77a405d1bd5f9cb81d3eb9b2d328366596368410a8e8692",
-  "enigma-linux-arm64": "b72263876d8edec6b17f8b72222cb358f5ee3e618c4984b21e7c22fd5e5d229d",
-  "enigma-linux-x64": "69927df4cbaeb4e5583608e69ab180697fe8fdf55c2166d2dcd4924ce96af1a7",
-  "enigma-win32-x64.exe": "d050c1285846db01b0afc36efb4b5d4061560fe53370ce0179579f5bcd657979"
+  "enigma-darwin-arm64": "36ef9858fe95b1f4ed774ee94afa8f8d76679afa46a4255c73aefd6eefda0649",
+  "enigma-linux-arm64": "3d5f6b79e5cae50cec321e4cbf0f592c18a9f30814d1f44bdecad5be2e860171",
+  "enigma-linux-x64": "4f2669bc370e1a29b9e3b86a269a2349ea1a7534ec953a8acedd2e3ea1fc2c23",
+  "enigma-win32-x64.exe": "4e2b6fd7078e7c0b8b99036534a91d4b8cec9fb64d00ac642a86f4ce272e48b1"
 }

package/dist/guardrails.js

@@ -383,6 +383,38 @@ var BUILTIN_RULES = [
     maxBytes: 4e4,
     message: "This memory file loads into every session in the project, so its cost is paid on every task regardless of relevance. Keep it an INDEX: move each subsystem's detail into its own doc (docs/notes/<topic>.md) and leave one line here saying what the note covers and when to read it. Route new conventions by tier - a file-local syntactic signature becomes a guardrail rule, a domain-scoped rule belongs in the owning skill (loaded on demand), and only a truly universal rule stays in memory. Turn this off with `enigma guardrails disable ctx-memory-budget`.",
     severity: "block"
+  },
+  {
+    id: "ts-import-namespace",
+    label: "Namespace import for a wide module surface",
+    files: ["*.ts", "*.tsx", "*.mts", "*.cts", "*.js", "*.mjs", "*.cjs", "*.jsx"],
+    // Two-form generated/vendored excludes (`**/x/**` misses a root-level dist/). Declaration
+    // files are excluded too: a .d.ts re-declares another module's surface, it has no call sites.
+    excludeFiles: [
+      "*.min.js",
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/_build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "_build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // A count has no regex form, hence maxNamedImports. 9 is the budget: past that the import
+    // line stops being readable, and every new export of the module widens it again. Only the
+    // project's OWN modules are counted - a bare specifier (node builtin, npm package) is a
+    // fixed surface the ecosystem writes as named imports, so counting those would flag
+    // idiomatic code. BLOCK for the ui-no-em-dash reason: a warn exits 0 and never reaches
+    // the model, and the fix is mechanical.
+    maxNamedImports: 9,
+    message: 'Too many named bindings from one module. Import it as a namespace instead - `import * as <ns> from "<module>"`, then call `<ns>.thing()` - so the import stays one short line, each call site says where the symbol comes from, and a new export never widens the import again. The count sums every named import of that module in this file, so splitting the statement in two does not help; name the namespace for the module, and pick a distinct name when the natural one is already a local variable. Keep named imports for a handful of symbols. Mark a deliberate exception with an `enigma:` note on the import line (ciphera-style-policy).',
+    severity: "block",
+    skill: "ciphera-style-policy"
   }
 ];
 var PROJECT_CHECKS = {
@@ -396,6 +428,20 @@ var PROJECT_CHECKS = {
     return !("prisma" in pkg || "@prisma/client" in pkg);
   }
 };
+var NAMED_IMPORT = /^import[ \t]+(?:[\w$]+[ \t]*,[ \t]*)?(?:type[ \t]+)?\{([^}]*)\}[ \t]*from[ \t]*["']([^"']+)["'].*$/gm;
+var INTERNAL_MODULE = /^\.|^#|^[@~]\//;
+function wideNamedImports(content, max) {
+  const per = /* @__PURE__ */ new Map();
+  for (const m of content.matchAll(NAMED_IMPORT)) {
+    const mod = m[2];
+    if (!INTERNAL_MODULE.test(mod)) continue;
+    const entry = per.get(mod) ?? { count: 0, line: content.slice(0, m.index).split("\n").length, allowed: false };
+    entry.count += m[1].split(",").filter((s) => s.trim()).length;
+    if (m[0].includes("enigma:")) entry.allowed = true;
+    per.set(mod, entry);
+  }
+  return [...per].filter(([, v]) => !v.allowed && v.count > max).map(([module, v]) => ({ line: v.line, module, count: v.count }));
+}
 function readPkgDeps(root) {
   try {
     const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
@@ -458,6 +504,10 @@ function checkFile(file, content, projectRoot) {
     if (rule.scope === "file" && rule.maxBytes) {
       const bytes = Buffer.byteLength(content, "utf8");
       if (bytes > rule.maxBytes) out.push({ ...base, message: `${rule.message} (${bytes} bytes, budget ${rule.maxBytes})` });
+    } else if (rule.scope === "file" && rule.maxNamedImports) {
+      for (const w of wideNamedImports(content, rule.maxNamedImports)) {
+        out.push({ ...base, line: w.line, message: `${rule.message} (${w.count} bindings from "${w.module}", budget ${rule.maxNamedImports})` });
+      }
     } else if (rule.scope === "file" && rule.pattern) {
       if (rule.absent) {
         try {
@@ -585,5 +635,6 @@ export {
   loadRules,
   runGuardrailsHook,
   runGuardrailsScan,
-  runGuardrailsScanCli
+  runGuardrailsScanCli,
+  wideNamedImports
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.31.7",
+  "version": "1.32.1",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {