enigma-cli 1.32.0 → 1.32.2

package/assets/memory/AGENTS.md

@@ -14,6 +14,7 @@
 - anti-overengineering-policy: writing or refactoring implementation code, or any "be lazy"/"simplify"/over-engineering request - the YAGNI ladder and minimal-code discipline.
 - anti-overengineering-review: on-demand "what can we delete"/audit/over-engineering review or an enigma: debt-marker ledger - lists cuts, applies nothing.
 - backend-policy, frontend-policy, database-expert, validation-policy: server, client, persistence, and input-validation work.
+- email-policy: sending or templating email from the server - React Email instead of hand-written HTML, plain-text alternative, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
 - testing-policy, code-review-policy, debugging-policy, git-policy: tests and test-suite layout (structured subfolders, never a flat tests/ dump), pre-delivery review, debugging, and commits/PRs.

package/assets/memory/CLAUDE.md

@@ -14,6 +14,7 @@
 - anti-overengineering-policy: writing or refactoring implementation code, or any "be lazy"/"simplify"/over-engineering request - the YAGNI ladder and minimal-code discipline.
 - anti-overengineering-review: on-demand "what can we delete"/audit/over-engineering review or an enigma: debt-marker ledger - lists cuts, applies nothing.
 - backend-policy, frontend-policy, database-expert, validation-policy: server, client, persistence, and input-validation work.
+- email-policy: sending or templating email from the server - React Email instead of hand-written HTML, plain-text alternative, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
 - testing-policy, code-review-policy, debugging-policy, git-policy: tests and test-suite layout (structured subfolders, never a flat tests/ dump), pre-delivery review, debugging, and commits/PRs.

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-07-23T04:41:39+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "d091e8708888d23ee14cdd6c0e71f386861f2252d95360895a31c73db090a689"
 }

package/assets/skills/ciphera-style-policy/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: ciphera-style-policy
-description: Ciphera code style conventions - mandatory formatting and language idioms for source code (TypeScript-first, applies to every language) - American-English naming, double quotes, string interpolation, length-sorted imports, 4-space indentation, comment/JSDoc format, compact single-line blocks, and code-level anti-patterns (barrel files, external CDN/hosting dependencies). Use whenever writing, refactoring, or reviewing source code.
+description: Ciphera code style conventions - mandatory formatting and language idioms for source code (TypeScript-first, applies to every language) - American-English naming, double quotes, string interpolation, length-sorted imports, one statement per module and a namespace import (`import * as ns`) instead of a long named list from a project module, 4-space indentation, comment/JSDoc format, compact single-line blocks, and code-level anti-patterns (barrel files, external CDN/hosting dependencies). Use whenever writing, refactoring, or reviewing source code.
 ---
 
 # Ciphera Code Style Policy
@@ -60,6 +60,22 @@ const path = `/path/to/${folderName}/file`;
 ## Imports
 
 - Sort imports by line length, shortest first.
+- One statement per module: never import the same module twice in a file (a value import plus a `type` import of the same module is still one statement, with `type` on the members).
+- When you need many symbols from one of the project's own modules, import the module as a NAMESPACE instead of listing them. A named list is fine for a handful; past that the line stops being readable, and every new export widens it again. The namespace also makes each call site say where the symbol comes from.
+- Name the namespace after the module. When that name is already a local variable in the file, pick a distinct one (`conf` for a config module whose values are held in `config` variables, `gateDb` for a `db` module) rather than shadowing it.
+- This applies to modules the project owns (relative paths, path aliases). Standard-library and package imports stay named: their surface is fixed and the ecosystem reads them that way.
+
+```ts
+// Bad: 13 symbols on one line, and it grows with every new export.
+import { readConfig, readGlobalConfig, CONFIG_DEFAULTS, setEnigmaToggle, setEnigmaValue, OUTPUT_STYLES, DASHBOARD_MODES } from "./config";
+
+// Good
+import * as conf from "./config";
+
+const { config } = conf.readConfig();
+if (!conf.OUTPUT_STYLES.includes(style)) return;
+```
+
 - Do not import from external hostings or CDNs; depend on a package name, not a remote URL.
 - For obscure libraries, vendor the needed code into the project utilities instead of adding a fragile dependency.
 

package/assets/skills/ciphera-style-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "ciphera-style-policy",
-  "version": "1.1.2",
+  "version": "1.2.0",
   "provider": "FJRG2007/enigma",
-  "description": "Ciphera code style conventions (formatting, naming, imports, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
-  "updated": "2026-06-26T13:40:52+02:00",
-  "cliVersion": "1.32.0",
-  "sha": "dc9ceb784004b05a0117c464e4bed05946835a04acea282586c0b735ee7c2284"
+  "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
+  "updated": "2026-07-30T15:48:04+02:00",
+  "cliVersion": "1.32.2",
+  "sha": "05dc812da459071110d96ee41c5201b1ee230471d635352415e10ef8b220c267"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "3d3bbe0602d5bbb4afe37648fe3c2fa39376b1bcbac5d8c441f01fad1e866ed0"
 }

package/assets/skills/core-engineering-policy/SKILL.md

@@ -33,6 +33,7 @@ description: Highest-authority engineering rules - priority hierarchy, modular a
   - Any dependency added/upgraded/removed/audited, or package manifest/lockfile change -> dependency-policy.
   - Any UI, client state, data fetching, or client caching -> frontend-policy.
   - Any API endpoint, service, controller, or server request flow -> backend-policy.
+  - Any email sent or templated from the server (verification, password reset, receipts, alerts, digests) or any email-provider integration -> email-policy.
   - Any new or changed code that needs verification, or any test file created/moved/renamed or a test suite scaffolded/restructured -> testing-policy.
   - Any source code written, refactored, or reviewed (formatting, naming, language idioms) -> ciphera-style-policy.
   - Any implementation code being written or refactored, or any "be lazy"/"simplify"/over-engineering request -> anti-overengineering-policy.
@@ -83,6 +84,7 @@ This core policy owns orchestration, architecture, and the global rules. Each co
 - validation-policy: strict frontend + backend schema validation (Zod), schema consistency, client-facing error handling.
 - frontend-policy: frontend structure, reusable components, abstraction threshold, client-side caching, optimistic UI and rollback.
 - backend-policy: API/service architecture, controller-service-repository layering, API/request optimization, server-side caching (Redis).
+- email-policy: transactional and notification email - React Email templating instead of hand-written HTML, server-side rendering, a single send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).
 - testing-policy: test strategy, coverage gates, deterministic tests, test/regression-first discipline, and test-suite layout (structure by type and domain, mirrored source paths, file naming, fixture/helper/factory placement).
 - code-review-policy: self-review before delivery, review dimensions, change-quality gates.
 - debugging-policy: reproduce-isolate-fix methodology and root-cause discipline.

package/assets/skills/core-engineering-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "core-engineering-policy",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules).",
-  "updated": "2026-07-16T22:43:53+02:00",
-  "cliVersion": "1.32.0",
-  "sha": "d132f20db08806054d95e58d3d56c2aa7ebc8e6dd24d902b0a0ed9ddfae216c5"
+  "updated": "2026-07-30T19:29:19+02:00",
+  "cliVersion": "1.32.2",
+  "sha": "6a881d8589926fa7f48058314fd26d7042fd2ac82f1c87a6c11ffb54d1fda22b"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-06-03T14:19:50+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "2883bcecb3202683ae6f81b073c3d6a9cec9c55029e011bdd06ba7ac3537297e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "14b0064c8b33a0dc85e51464b05005cf5801c756b1101789a6924b9548420f6b"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/SKILL.md

@@ -0,0 +1,95 @@
+---
+name: email-policy
+description: Transactional and notification email - build templates with React Email (react.email) instead of hand-written HTML tables or string concatenation, render them server-side, send through the provider SDK behind a single send module, and apply deliverability (SPF/DKIM/DMARC, bounce and complaint suppression, unsubscribe headers), plain-text alternatives, idempotent background sending, and link safety. Use when sending, templating, styling, previewing, or testing any email from a backend, API route, cron job, worker, or CLI - signup and verification, password reset, receipts, alerts, digests, or any provider integration (Resend, Postmark, SendGrid, AWS SES, Mailgun, Nodemailer/SMTP).
+---
+
+# Email Policy (Transactional & Notification Mail)
+
+## Activation Scope
+
+- Apply whenever code sends an email or builds an email body: verification, password reset, invites, receipts, alerts, digests, notifications, or any email-provider integration.
+- Owns templating, rendering, sending, and deliverability. Layering, retries, and queues stay with backend-policy; secrets, tokens, and link safety with security-policy; recipient and payload schemas with validation-policy; package choice with dependency-policy.
+
+---
+
+## Never Hand-Write Email HTML
+
+Email clients are roughly two decades behind browsers: the Outlook desktop engine renders with Word, Gmail rewrites and strips `<style>`, external CSS never loads, and flexbox/grid are unavailable. HTML assembled by hand or from template strings looks correct in a browser preview and breaks in the actual inbox - and string-concatenated user values in markup are an injection surface.
+
+- Do NOT: build bodies with template literals or Handlebars-into-tables, copy a random table skeleton off a blog, or reuse an app React component as an email.
+- Do NOT judge an email by a browser screenshot - a browser is the one client that renders everything.
+- DO: use a compiler that targets email HTML. In JavaScript/TypeScript that is React Email.
+
+---
+
+## React Email (default for JS/TS)
+
+https://react.email - MIT, maintained by the Resend team. React components that compile to email-safe HTML, tested across Gmail, Apple Mail, Outlook, Yahoo! Mail, HEY, and Superhuman.
+
+### Packages
+
+- `@react-email/components` - the component set (peer: React 18 or 19): `Html`, `Head`, `Body`, `Container`, `Section`, `Row`, `Column`, `Heading`, `Text`, `Link`, `Button`, `Img`, `Hr`, `Preview`, `Font`, `Markdown`, `CodeBlock`, `CodeInline`, `Tailwind`.
+- `@react-email/render` - the runtime renderer: `render()`, `pretty()`, `toPlainText()`. This is the only piece production needs, so it belongs in `dependencies`.
+- `react-email` - the local preview server (`email dev`, bin `email`) that also re-exports `render`. It pulls in esbuild, socket.io, tailwindcss, prismjs, and chokidar: keep it a **devDependency**. Do not add it to production dependencies just to import `render` (dependency-policy, anti-overengineering-policy).
+
+### Render, then send
+
+```tsx
+import { render } from "@react-email/render";
+import { WelcomeEmail } from "@/emails/welcome";
+
+const html = await render(<WelcomeEmail name={user.name} verifyUrl={url} />);
+const text = await render(<WelcomeEmail name={user.name} verifyUrl={url} />, { plainText: true });
+```
+
+- `render()` is asynchronous - await it. Options: `plainText`, `pretty`, `htmlToTextOptions`. `toPlainText(html)` converts an already-rendered body, and `data-skip-in-text="true"` drops an element from the text version only.
+- Templates live in one folder (`emails/`), one file per template, props typed. They are ordinary React components, so the reuse rules in frontend-policy apply: one shared layout/branding wrapper composed by every template, never a copied header per email.
+- Style with the `<Tailwind>` wrapper when the project already uses Tailwind, otherwise inline `style` props. Never link an external stylesheet or a CDN webfont - clients strip or block them (use `<Font>` with a fallback stack).
+- Always include `<Preview>`; without it the inbox preview line shows whatever stray text comes first.
+- Host images on an absolute HTTPS URL and always set `alt` - most clients block images by default, so an email whose meaning lives only in an image arrives empty.
+- Preview with `email dev` (or a rendered fixture) before shipping.
+
+### Boundaries
+
+- Non-React backends: use MJML or the provider's own template system, under the same doctrine - never hand-rolled tables.
+- Marketing and campaign email belongs in the marketing platform, not in application code. This policy covers transactional and notification mail.
+
+---
+
+## Sending
+
+- One module owns sending (e.g. `lib/email/send.ts`): it takes `{to, subject, template, props}`, renders HTML plus text, calls the provider, and returns a typed result. Feature code never imports the provider SDK directly - that keeps the provider swappable and concentrates logging, suppression, and idempotency in one place (backend-policy).
+- Prefer the provider's official SDK or HTTP API over raw SMTP when one exists; React Email documents integrations for Resend, Postmark, SendGrid, AWS SES, Mailgun, MailerSend, Plunk, Scaleway, Azure Communication Email, and Nodemailer.
+- API keys come from the environment or a secret store, server-side only - never in a client bundle, never committed (security-policy).
+- Always send HTML **and** a plain-text alternative. Text-only clients, accessibility tooling, and spam filters all read it.
+- Validate the recipient address and the template payload against a schema before rendering (validation-policy).
+- Never block the user's response on the provider. Enqueue the send and return; a slow or failing mail provider must not fail the request. Where the project has no queue, send after the response with a timeout and log the failure instead of propagating it - unless the email IS the operation the user asked for.
+- Make sends idempotent: derive a key from the event (user id + template + event id) so a retried job or a double-submitted request does not send twice, and pass the provider's idempotency key when it offers one. Retries are bounded with backoff (backend-policy).
+
+---
+
+## Content & Link Safety
+
+- Never put a password, a secret, an API key, a full session token, or sensitive personal data in an email body. Mail sits in plaintext in most mailboxes and is forwarded freely. Send a short-lived, single-use link instead, and expire it on use.
+- Build action links from a server-side base URL constant, never from the request `Host` header - header poisoning turns a password-reset email into account takeover.
+- Validate any redirect or callback target against an allowlist before embedding it.
+- React escapes text by default; the remaining risks are attributes and raw HTML. Validate every `href`/`src` against an `http`/`https` scheme allowlist, and never feed unsanitized user input to `<Markdown>` or a dangerouslySetInnerHTML equivalent (security-policy).
+
+---
+
+## Deliverability
+
+- Send from a verified domain with SPF, DKIM, and DMARC configured. An unauthenticated domain lands in spam no matter how good the content is.
+- Use a real, monitored `Reply-To`. Avoid `noreply@` for mail a human may reasonably answer.
+- Consume the provider's bounce and complaint webhooks: suppress hard bounces and spam complaints permanently in your own store, and check that suppression list before every send. Ignoring it burns domain reputation for every other email you send.
+- Any bulk or recurring email (digest, newsletter, activity summary) needs a working unsubscribe: `List-Unsubscribe` and `List-Unsubscribe-Post` headers plus a visible link, honored immediately and without a login. Genuine transactional mail (receipt, password reset, security alert) is exempt - do not use that exemption to smuggle marketing.
+- Respect the provider's rate limits and daily quota; queue and pace bulk sends rather than bursting into a 429.
+- Do not enable open/click tracking by default. It is a privacy decision with GDPR/RGPD consequences, not a sensible default.
+
+---
+
+## Testing & Observability
+
+- Test templates by rendering them, not by sending: assert on the rendered HTML and text (subject line, required links present, no unresolved placeholder, correct locale). Deterministic and offline (testing-policy).
+- Never send real mail from tests or local development. Use the provider's sandbox or test key, or a local catcher (Mailpit, Mailhog, Ethereal).
+- Log every attempt with template id, provider message id, and outcome - never the body, the token, or the link. Alert on bounce and complaint rates, not just on send errors.

package/assets/skills/email-policy/skill.json

@@ -0,0 +1,9 @@
+{
+  "name": "email-policy",
+  "version": "1.0.0",
+  "provider": "FJRG2007/enigma",
+  "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
+  "updated": "2026-07-30T19:29:19+02:00",
+  "cliVersion": "1.32.2",
+  "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
+}

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -123,6 +123,30 @@ Build every UI to adapt to the viewport; never assume a desktop width. A layout
 
 ---
 
+## Persistent Chrome Stays Put (Sidebars, Nav, Panels)
+
+Navigation and any other persistent chrome must stay where the user left it while the CONTENT scrolls. A sidebar that scrolls up and off the top with the page is one of the most common generated-layout defects, and it makes a long page unnavigable: the user has to scroll back up to reach any other link.
+
+- Put the scroll on the content, not on the page. The reliable shape is a viewport-height shell whose sidebar and main are siblings, each owning its own overflow: `position: sticky` with a `top` offset (simplest - the sidebar stays in the grid and needs no width duplication), or a `position: fixed` sidebar with matching padding on the content. Tailwind's `sticky top-0` / `h-screen sticky` do the same thing.
+- **Pinning alone is not enough, and this is the part that gets missed.** `position: sticky` only pins the element's TOP edge: as soon as the sidebar's own content is taller than the viewport, the rest keeps scrolling away with the page and the last entries can never be reached. A pinned sidebar therefore needs BOTH a height bounded by the viewport (`max-height: calc(100vh - <header height>)`, or `h-screen`) AND its own `overflow-y: auto`. A sidebar with a content-sized height (`height: max-content`, `fit-content`, or none at all) plus `overflow: visible` is the broken pattern, even though it looks correct until the list grows.
+- Add `overscroll-behavior: contain` to the sidebar's scroll container so reaching its end does not start scrolling the page behind it.
+- Undo it where the layout stacks. At the mobile breakpoint the sidebar usually returns to normal flow (`position: static`), and the viewport height cap has to be lifted with it (`max-height: none; overflow-y: visible`) or it turns into a small scrolling box inside the page.
+- The same rule covers a sticky header, toolbar, filter rail or side panel: pinned, bounded, and independently scrollable. Keep pinned chrome shallow - it eats vertical space on small screens, so collapse it into a drawer or a top bar there rather than pinning it over half the viewport.
+- Verify by scrolling to the BOTTOM of a long page and confirming the sidebar is still on screen with its last entry reachable. Mechanically: the sidebar's `getBoundingClientRect().top` stays at its offset as the page scrolls, and `scrollHeight <= clientHeight` holds for it, or it can scroll itself.
+
+---
+
+## Links In Copy Are Links
+
+When UI copy names a destination - a URL, a doc page, a dashboard, a settings screen, an external service - make it reachable from where it is written. Printing a bare URL as plain text in a hint, description, empty state or error message leaves the user to select and copy it by hand, which is exactly the work the interface exists to remove.
+
+- A URL inside a sentence becomes an inline anchor on the words that name it, not a raw address dropped mid-paragraph: "Leave empty to use the [deployment default](https://example.com)" reads better than repeating the URL. Show the bare address only when the exact value is the information (a host to whitelist, an endpoint to paste elsewhere) - and then pair it with a copy button rather than expecting a manual selection.
+- External links carry `target="_blank"` with `rel="noopener noreferrer"`, and say where they go when the destination is not obvious from the text. In-app destinations use the router, never a full page reload.
+- Choose the affordance by weight, not by habit: an inline anchor for a reference inside a sentence, a button for the primary action of a panel or empty state ("Open dashboard"), an icon button where it repeats per row (Icon Actions above). A whole sentence is never a link - link the noun.
+- The same applies to anything else with a natural affordance: a file path gets a copy button, an email gets `mailto:`, a referenced setting gets a link to that settings screen. If the copy tells the user to go somewhere, take them there.
+
+---
+
 ## Text That Does Not Fit (Variable-Length Content)
 
 Every string is variable-length; the value on screen during development is one sample. Text escaping its card or colliding with a neighbour is the most common layout defect, it is invisible until the content changes, and it is the responsibility of whoever writes the layout - not something to be pointed out afterwards.

package/assets/skills/frontend-policy/skill.json

@@ -3,7 +3,7 @@
   "version": "1.20.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll/pagination, virtualization, skeletons, progressive loading), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-07-29T01:26:14+02:00",
-  "cliVersion": "1.32.0",
-  "sha": "71ebc71510c8aa54d7925445a7dffc55dbce9eba209fb6a63bae05d119217d79"
+  "updated": "2026-07-30T19:29:05+02:00",
+  "cliVersion": "1.32.2",
+  "sha": "a9750bd74505373aea8d9265515fc3b7f0fddf3e822d9e046248223e24ff96af"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-07-16T22:44:02+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "e6dfbc33884000d9d25841bd9c5a84d6558ffd374882cb7b34451eb2cebc2161"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), OWASP Top 10, transport/crypto baseline, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "9971e9d9127397d0152e89d24aad3191e2935e55a8483db7fd15f5d4d7a60e7a"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "13d24c217bdb6fe83fe16835d8f5c3d397a9f3338f16876c61ef96e97f34c90a"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-07-27T17:22:17+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "b9046c15fd636057a8e42e199d2eeb47297477f38a0a26a07a7b0bf71d61fcb4"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, schema consistency, and safe client-facing error handling.",
   "updated": "2026-07-22T01:41:06+02:00",
-  "cliVersion": "1.32.0",
+  "cliVersion": "1.32.2",
   "sha": "d937df0052d1ec151728a28f6567744d9e7ca0a65d84b4d5c9a697f1e40d704f"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "e02be8e4157bc08e1f94a0338f80a115882fc0b602bebec04f95f37a655e4552",
-  "enigma-linux-arm64": "bc09113c799df15e38b7a099b90005af85f1512ae01bd3ca48377848fed35f2a",
-  "enigma-linux-x64": "71b614fd2e2d871678fba0aa01539ce1e552606b9003b503596c133cdd158094",
-  "enigma-win32-x64.exe": "45ab42b970cebead6f411ea15b933b94cbfe1c885263c5a10f1a91112342afe9"
+  "enigma-darwin-arm64": "8221580f5a8bb0a1b9400c88d52765573cde4185501310b8b6bbd6f257cb604b",
+  "enigma-linux-arm64": "492da75deb97e22217255d6477097450c23392cabd90e21c6ad5edf152b650d1",
+  "enigma-linux-x64": "2f60fc015b2933523b211a8df4cacef015be6c2141535f4fbc3ca99bdc341c4d",
+  "enigma-win32-x64.exe": "556cf44c2ce5fc7a55872078069f24a5fc30adea90259637f5e9e7baed43794a"
 }

package/bin/enigma.mjs

@@ -66,6 +66,7 @@ const env = { ...process.env };
 env.ENIGMA_ASSETS_DIR = join(pkgRoot, "assets");
 env.ENIGMA_GUARD_PATH = join(pkgRoot, "dist", "guard.js");
 env.ENIGMA_GUARDRAILS_PATH = join(pkgRoot, "dist", "guardrails.js");
+env.ENIGMA_TRIM_PATH = join(pkgRoot, "dist", "trim.js");
 try {
     env.ENIGMA_VERSION = packageVersion();
 } catch { /* version is best-effort */ }

package/dist/guardrails.js

@@ -199,6 +199,20 @@ var BUILTIN_RULES = [
     severity: "warn",
     skill: "frontend-policy"
   },
+  // NOTE: there is deliberately no "a pinned sidebar needs its own scroll" rule, and no
+  // "a URL in UI copy must be a link" rule, though both conventions were asked for. Neither
+  // has a file-local signature this engine can read.
+  //   - The sidebar defect is a RELATION between three declarations (pinned + height bound +
+  //     overflow) that real stylesheets spread over several lines of one block, which a
+  //     line-based scan cannot correlate; the Tailwind one-line form would be the exception,
+  //     and the corpus (this repo, apps/web, references/repos) holds exactly two real
+  //     sidebars, neither of them Tailwind - zero measured true positives, which is the same
+  //     evidence that got the no-op-save rule rejected. It is also not a defect until the
+  //     sidebar's content outgrows the viewport, so a rule would flag correct short ones.
+  //   - The link one cannot tell COPY from DATA: a URL in a string is far more often an API
+  //     endpoint, a default, or a docs reference in a comment than a piece of UI text, and
+  //     nothing in the string says which. Both live in frontend-policy instead (Persistent
+  //     Chrome Stays Put, Links In Copy Are Links).
   // NOTE: there is deliberately no "truncating flex item needs min-w-0" rule. It was written
   // and then removed after measuring it in a browser: per CSS Flexbox 4.5 a flex item's
   // automatic minimum size only applies while its computed overflow is visible, and Tailwind's
@@ -383,6 +397,72 @@ var BUILTIN_RULES = [
     maxBytes: 4e4,
     message: "This memory file loads into every session in the project, so its cost is paid on every task regardless of relevance. Keep it an INDEX: move each subsystem's detail into its own doc (docs/notes/<topic>.md) and leave one line here saying what the note covers and when to read it. Route new conventions by tier - a file-local syntactic signature becomes a guardrail rule, a domain-scoped rule belongs in the owning skill (loaded on demand), and only a truly universal rule stays in memory. Turn this off with `enigma guardrails disable ctx-memory-budget`.",
     severity: "block"
+  },
+  {
+    id: "ts-import-namespace",
+    label: "Namespace import for a wide module surface",
+    files: ["*.ts", "*.tsx", "*.mts", "*.cts", "*.js", "*.mjs", "*.cjs", "*.jsx"],
+    // Two-form generated/vendored excludes (`**/x/**` misses a root-level dist/). Declaration
+    // files are excluded too: a .d.ts re-declares another module's surface, it has no call sites.
+    excludeFiles: [
+      "*.min.js",
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/_build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "_build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // A count has no regex form, hence maxNamedImports. 9 is the budget: past that the import
+    // line stops being readable, and every new export of the module widens it again. Only the
+    // project's OWN modules are counted - a bare specifier (node builtin, npm package) is a
+    // fixed surface the ecosystem writes as named imports, so counting those would flag
+    // idiomatic code. BLOCK for the ui-no-em-dash reason: a warn exits 0 and never reaches
+    // the model, and the fix is mechanical.
+    maxNamedImports: 9,
+    message: 'Too many named bindings from one module. Import it as a namespace instead - `import * as <ns> from "<module>"`, then call `<ns>.thing()` - so the import stays one short line, each call site says where the symbol comes from, and a new export never widens the import again. The count sums every named import of that module in this file, so splitting the statement in two does not help; name the namespace for the module, and pick a distinct name when the natural one is already a local variable. Keep named imports for a handful of symbols. Mark a deliberate exception with an `enigma:` note on the import line (ciphera-style-policy).',
+    severity: "block",
+    skill: "ciphera-style-policy"
+  },
+  {
+    id: "proc-windows-hide",
+    label: "Spawned process must not pop a console window",
+    files: ["*.ts", "*.tsx", "*.mts", "*.cts", "*.js", "*.mjs", "*.cjs", "*.jsx"],
+    // Tests run in a terminal that already has a console, so a flashing window is not a
+    // defect there. Same two-form generated/vendored excludes as the rules above.
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.min.js",
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/_build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "_build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // A call spanning several lines has no line-regex form, hence a coded check (see
+    // missingWindowsHide for the three shapes it deliberately leaves alone). BLOCK for the
+    // ui-no-em-dash reason: a warn exits 0 and never reaches the model, the symptom is
+    // invisible to whoever writes the code on macOS or Linux, and the fix is one key.
+    fileCheck: "proc-windows-hide",
+    message: "Process spawned without windowsHide. On Windows a console child started by a process that has no console of its own - a daemon, an editor hook, a detached background task - pops a real console window on screen and closes it again, which reads as something crashing. Add `windowsHide: true` to the options object; it is inert on macOS and Linux, and inert on Windows when the parent already has a console, so it is safe on every call that is not deliberately opening a terminal for the user. For one that IS (a login flow that must show a terminal), mark the call with an `enigma:` note.",
+    severity: "block"
   }
 ];
 var PROJECT_CHECKS = {
@@ -396,6 +476,55 @@ var PROJECT_CHECKS = {
     return !("prisma" in pkg || "@prisma/client" in pkg);
   }
 };
+var FILE_CHECKS = {
+  "proc-windows-hide": (content) => missingWindowsHide(content)
+};
+var SPAWNERS = /* @__PURE__ */ new Set(["spawn", "spawnSync", "exec", "execSync", "execFile", "execFileSync"]);
+function spawnerBindings(content) {
+  const names = /* @__PURE__ */ new Set();
+  const stmt = /(?:import|(?:const|let|var))\s*\{([^}]*)\}\s*(?:from\s*|=\s*require\(\s*)["'](?:node:)?child_process["']/g;
+  for (const m of content.matchAll(stmt)) {
+    for (const part of m[1].split(",")) {
+      const [orig, alias] = part.trim().split(/\s+as\s+/).map((s) => s.trim());
+      if (orig && SPAWNERS.has(orig)) names.add(alias || orig);
+    }
+  }
+  return [...names];
+}
+function missingWindowsHide(content) {
+  const names = spawnerBindings(content);
+  if (names.length === 0) return [];
+  const out = [];
+  const call = new RegExp(`(?<![.\\w$])(${names.join("|")})\\s*\\(`, "g");
+  for (const m of content.matchAll(call)) {
+    let i = m.index + m[0].length;
+    for (let depth = 1; i < content.length && depth > 0; i++) {
+      if (content[i] === "(") depth++;
+      else if (content[i] === ")") depth--;
+    }
+    const eol = content.indexOf("\n", i);
+    const text = content.slice(m.index, eol === -1 ? content.length : eol);
+    if (/windowsHide|enigma:|"inherit"|'inherit'/.test(text)) continue;
+    if (!text.includes("{")) continue;
+    if (/\{[^{}]*\.\.\.[A-Za-z_$]/.test(text)) continue;
+    out.push({ line: content.slice(0, m.index).split("\n").length, detail: m[1] });
+  }
+  return out;
+}
+var NAMED_IMPORT = /^import[ \t]+(?:[\w$]+[ \t]*,[ \t]*)?(?:type[ \t]+)?\{([^}]*)\}[ \t]*from[ \t]*["']([^"']+)["'].*$/gm;
+var INTERNAL_MODULE = /^\.|^#|^[@~]\//;
+function wideNamedImports(content, max) {
+  const per = /* @__PURE__ */ new Map();
+  for (const m of content.matchAll(NAMED_IMPORT)) {
+    const mod = m[2];
+    if (!INTERNAL_MODULE.test(mod)) continue;
+    const entry = per.get(mod) ?? { count: 0, line: content.slice(0, m.index).split("\n").length, allowed: false };
+    entry.count += m[1].split(",").filter((s) => s.trim()).length;
+    if (m[0].includes("enigma:")) entry.allowed = true;
+    per.set(mod, entry);
+  }
+  return [...per].filter(([, v]) => !v.allowed && v.count > max).map(([module, v]) => ({ line: v.line, module, count: v.count }));
+}
 function readPkgDeps(root) {
   try {
     const pkg = JSON.parse(readFileSync(join(root, "package.json"), "utf8"));
@@ -458,6 +587,15 @@ function checkFile(file, content, projectRoot) {
     if (rule.scope === "file" && rule.maxBytes) {
       const bytes = Buffer.byteLength(content, "utf8");
       if (bytes > rule.maxBytes) out.push({ ...base, message: `${rule.message} (${bytes} bytes, budget ${rule.maxBytes})` });
+    } else if (rule.scope === "file" && rule.maxNamedImports) {
+      for (const w of wideNamedImports(content, rule.maxNamedImports)) {
+        out.push({ ...base, line: w.line, message: `${rule.message} (${w.count} bindings from "${w.module}", budget ${rule.maxNamedImports})` });
+      }
+    } else if (rule.scope === "file" && rule.fileCheck) {
+      const check = FILE_CHECKS[rule.fileCheck];
+      for (const hit of check ? check(content) : []) {
+        out.push({ ...base, line: hit.line, message: `${rule.message} (${hit.detail})` });
+      }
     } else if (rule.scope === "file" && rule.pattern) {
       if (rule.absent) {
         try {
@@ -525,7 +663,7 @@ Fix the above before continuing.
   return 0;
 }
 function gitFiles(all) {
-  const out = execFileSync("git", all ? ["ls-files"] : ["diff", "--cached", "--name-only", "--diff-filter=ACM"], { encoding: "utf8" });
+  const out = execFileSync("git", all ? ["ls-files"] : ["diff", "--cached", "--name-only", "--diff-filter=ACM"], { encoding: "utf8", windowsHide: true });
   return out.split("\n").map((s) => s.trim()).filter(Boolean);
 }
 function runGuardrailsScan(all) {
@@ -577,13 +715,16 @@ if (isGrEntry && fileURLToPath(import.meta.url) === grEntry) {
 }
 export {
   BUILTIN_RULES,
+  FILE_CHECKS,
   PROJECT_CHECKS,
   checkFile,
   checkPath,
   findProjectRoot,
   formatFindings,
   loadRules,
+  missingWindowsHide,
   runGuardrailsHook,
   runGuardrailsScan,
-  runGuardrailsScanCli
+  runGuardrailsScanCli,
+  wideNamedImports
 };

package/dist/trim.js

@@ -0,0 +1,212 @@
+#!/usr/bin/env node
+
+// src/trim.ts
+import { readFileSync } from "fs";
+import { fileURLToPath } from "url";
+import { extname, join } from "path";
+import { open, stat } from "fs/promises";
+import { execFileSync } from "child_process";
+var TAIL_BYTES = 4096;
+var MAX_TAIL = 1024 * 1024;
+var CONCURRENCY = 32;
+var SKIP_EXT = /* @__PURE__ */ new Set([
+  ".patch",
+  ".diff",
+  ".snap",
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".avif",
+  ".ico",
+  ".bmp",
+  ".tiff",
+  ".pdf",
+  ".zip",
+  ".gz",
+  ".tgz",
+  ".bz2",
+  ".xz",
+  ".7z",
+  ".rar",
+  ".jar",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".otf",
+  ".eot",
+  ".mp3",
+  ".mp4",
+  ".wav",
+  ".ogg",
+  ".webm",
+  ".mov",
+  ".avi",
+  ".exe",
+  ".dll",
+  ".so",
+  ".dylib",
+  ".bin",
+  ".wasm",
+  ".node",
+  ".class",
+  ".pyc",
+  ".db",
+  ".sqlite",
+  ".sqlite3",
+  ".lock"
+]);
+var SKIP_DIR = /(^|\/)(__snapshots__|fixtures|testdata|golden|node_modules|\.git|vendor|third_party|third-party|dist|build|coverage|\.next|\.venv)(\/|$)/;
+function readIgnoreGlobs(root) {
+  try {
+    const raw = JSON.parse(readFileSync(join(root, ".githooks", "enigma-trim.json"), "utf8"));
+    return Array.isArray(raw.ignore) ? raw.ignore.filter((g) => typeof g === "string") : [];
+  } catch {
+    return [];
+  }
+}
+function globToRegExp(glob) {
+  const esc = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+  const body = esc.replace(/\*\*/g, " ").replace(/\*/g, "[^/]*").replace(/ /g, ".*").replace(/\?/g, "[^/]");
+  return new RegExp(glob.includes("/") ? `^${body}$` : `(^|/)${body}$`);
+}
+var BLANK_LINE = /^[ \t\r]*$/;
+function isSkipped(file) {
+  const norm = file.replace(/\\/g, "/");
+  return SKIP_DIR.test(norm) || SKIP_EXT.has(extname(norm).toLowerCase());
+}
+function trailingBlankBytes(tail, atStart) {
+  const lines = tail.split("\n");
+  if (lines.pop() !== "") return 0;
+  let bytes = 0;
+  for (let i = lines.length - 1; i >= 0; i--) {
+    const line = lines[i];
+    if (!BLANK_LINE.test(line)) return bytes;
+    bytes += line.length + 1;
+  }
+  return atStart ? 0 : -1;
+}
+async function trimFile(file) {
+  if (isSkipped(file)) return false;
+  let handle;
+  try {
+    const info = await stat(file);
+    if (!info.isFile() || info.size === 0) return false;
+    handle = await open(file, "r+");
+    let want = TAIL_BYTES;
+    for (; ; ) {
+      const length = Math.min(want, info.size);
+      const position = info.size - length;
+      const buf = Buffer.allocUnsafe(length);
+      const { bytesRead } = await handle.read(buf, 0, length, position);
+      const tail = buf.subarray(0, bytesRead);
+      if (tail.includes(0)) return false;
+      const cut = trailingBlankBytes(tail.toString("latin1"), position === 0);
+      if (cut === 0) return false;
+      if (cut > 0) {
+        await handle.truncate(info.size - cut);
+        return true;
+      }
+      if (position === 0 || want >= MAX_TAIL) return false;
+      want *= 2;
+    }
+  } catch {
+    return false;
+  } finally {
+    await handle?.close().catch(() => {
+    });
+  }
+}
+async function trimAll(files, task = trimFile) {
+  const changed = [];
+  let next = 0;
+  const worker = async () => {
+    for (let i = next++; i < files.length; i = next++) {
+      if (await task(files[i])) changed.push(files[i]);
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(CONCURRENCY, files.length) }, worker));
+  return changed;
+}
+function gitLines(args) {
+  try {
+    const out = execFileSync("git", args, { encoding: "utf8", maxBuffer: 64 * 1024 * 1024, windowsHide: true });
+    return out.split("\0").map((s) => s.trim()).filter(Boolean);
+  } catch {
+    return [];
+  }
+}
+function repoRoot() {
+  try {
+    return execFileSync("git", ["rev-parse", "--show-toplevel"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], windowsHide: true }).trim() || null;
+  } catch {
+    return null;
+  }
+}
+function stage(files) {
+  for (let i = 0; i < files.length; i += 500) {
+    try {
+      execFileSync("git", ["add", "--", ...files.slice(i, i + 500)], { stdio: "ignore", windowsHide: true });
+    } catch {
+    }
+  }
+}
+async function runTrimScan(all) {
+  const root = repoRoot();
+  if (root === null) return { changed: [], unstaged: [], count: 0, notRepo: true };
+  const listed = all ? gitLines(["ls-files", "-z"]) : gitLines(["diff", "--cached", "--name-only", "--diff-filter=ACM", "-z"]);
+  const ignore = readIgnoreGlobs(root).map(globToRegExp);
+  const files = ignore.length ? listed.filter((f) => !ignore.some((re) => re.test(f))) : listed;
+  if (files.length === 0) return { changed: [], unstaged: [], count: 0 };
+  const dirty = all ? /* @__PURE__ */ new Set() : new Set(gitLines(["diff", "--name-only", "-z"]));
+  const changed = await trimAll(files);
+  const unstaged = changed.filter((f) => dirty.has(f));
+  const restage = changed.filter((f) => !dirty.has(f));
+  if (!all && restage.length) stage(restage);
+  return { changed, unstaged, count: files.length };
+}
+async function runTrimHook(payload) {
+  try {
+    const file = JSON.parse(payload || "{}")?.tool_input?.file_path;
+    if (typeof file === "string" && file) await trimFile(file);
+  } catch {
+  }
+  return 0;
+}
+async function runTrimScanCli(all) {
+  const r = await runTrimScan(all);
+  if (r.notRepo) {
+    console.error("enigma-trim: not a git repository; nothing to do.");
+    return 0;
+  }
+  if (r.changed.length === 0) {
+    console.log(`enigma-trim: ${r.count} ${all ? "tracked" : "staged"} file(s) checked, no trailing blank lines.`);
+    return 0;
+  }
+  const staged = r.changed.length - r.unstaged.length;
+  console.log(`enigma-trim: removed a trailing blank line from ${r.changed.length} file(s)${all ? "" : `, ${staged} re-staged`}.`);
+  for (const f of r.changed.slice(0, 20)) console.log(`  - ${f}`);
+  if (r.changed.length > 20) console.log(`  ... and ${r.changed.length - 20} more`);
+  if (r.unstaged.length) {
+    console.log(`
+enigma-trim: ${r.unstaged.length} file(s) were fixed on disk but NOT re-staged, because they also`);
+    console.log("hold unstaged edits and `git add` would have pulled those into this commit:");
+    for (const f of r.unstaged) console.log(`  ! ${f}`);
+  }
+  return 0;
+}
+var trimEntry = process.argv[1] ?? "";
+var isTrimEntry = /(^|[\\/])trim\.[mc]?[jt]s$/.test(trimEntry);
+if (isTrimEntry && fileURLToPath(import.meta.url) === trimEntry) {
+  void runTrimScanCli(process.argv.includes("--all")).then((code) => process.exit(code));
+}
+export {
+  isSkipped,
+  readIgnoreGlobs,
+  runTrimHook,
+  runTrimScan,
+  runTrimScanCli,
+  trailingBlankBytes,
+  trimFile
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.32.0",
+  "version": "1.32.2",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {
@@ -20,7 +20,8 @@
     "guardrails": "tsx src/guardrails.ts --all",
     "verify": "npm run typecheck && npm run check && npm run guard && npm run guardrails",
     "prepublishOnly": "npm run verify && npm run build",
-    "postinstall": "node bin/postinstall.mjs"
+    "postinstall": "node bin/postinstall.mjs",
+    "trim": "tsx src/trim.ts --all"
   },
   "files": [
     "bin",