enigma-cli 1.33.6 → 1.34.0

package/dist/guardrails.js

@@ -4,8 +4,8 @@
 import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { execFileSync } from "child_process";
-import { dirname, join, resolve } from "path";
-import { readFileSync, writeFileSync, statSync, existsSync } from "fs";
+import { dirname, join, resolve, sep } from "path";
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync, statSync, existsSync } from "fs";
 var COMMENT_LINE = /^\s*(\/\/|#|\*|--|<!--|\{?\/\*)/;
 var BUILTIN_RULES = [
   {
@@ -419,8 +419,46 @@ var BUILTIN_RULES = [
     // precision (a multi-line block is not matched: precision > recall).
     pattern: "\\bif\\s*\\(\\s*(isLoading|isPending|isFetching|loading|pending)\\s*\\)\\s*return\\s+(null\\b|<\\s*\\w*(Spinner|Loader|Loading|CircularProgress)\\b)",
     absent: "skeleton|animate-pulse|shimmer|Suspense|ContentLoader|content-loader|<\\s*Placeholder",
-    message: "Component returns nothing (or only a spinner) while data loads, so the page stays blank until the fetch resolves. Render the shell/layout on first paint and show skeleton placeholders shaped like the final content (reserve their space to avoid layout shift) while data loads async via the API (frontend-policy).",
-    severity: "warn",
+    message: "Component returns nothing (or only a spinner) while data loads, so the whole page stays blank until the fetch resolves. Render the shell on first paint - nav, headings, card frames, table chrome, filters, and any value you already hold - and skeleton ONLY the region whose data is missing, shaped like the real content with its space reserved so nothing shifts when it lands. A region that does not depend on this request is not loading and must render now (frontend-policy).",
+    // BLOCK, changed from warn: this is the rule for the defect users keep reporting (a page
+    // that renders nothing until its data arrives), and as a warn it exited 0 - printed to
+    // stdout and never fed back to the model, which is precisely why the model kept writing
+    // it. Same reasoning as ui-no-em-dash. The pattern is a terse one-line guard cleared by
+    // any placeholder signal in the file, so there is no legacy backlog to flag.
+    severity: "block",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-server-first-mutation",
+    label: "Optimistic update for a reversible mutation",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte"],
+    excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**", "**/dist/**", "dist/**", "**/build/**", "build/**", "**/.next/**", ".next/**", "**/node_modules/**"],
+    scope: "file",
+    // DIFF stage, and that is the whole reason this rule can exist. Measured over 2762 UI files
+    // of real product repositories, 116 of the 140 files that mutate anything hold no optimistic
+    // update at all - a legacy backlog an edit-stage rule would fire on forever, which is how a
+    // gate teaches people to ignore it. Against the lines a turn ADDED there is no backlog: it
+    // fires only on a mutation the agent just wrote.
+    stage: "diff",
+    fileCheck: "fe-server-first-mutation",
+    message: "This mutation waits for the server before it touches the UI: the row is only dropped (or the flag only flipped) after the request resolves, so the interface freezes for the whole round trip on an action that cannot really fail in an interesting way. Apply the change to local state FIRST, then send the request, and on failure restore the value you saved and say what failed - a silent revert is worse than the wait. Where the delete is reversible, prefer acting immediately with an Undo affordance over a confirmation prompt. Mark the line `enigma:allow-server-first` when the server's response is genuinely required before the UI may change (a payment, a server-assigned identifier, an irreversible action) (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-textarea-size-bounds",
+    label: "Textarea declares a minimum and a maximum size",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.html", "*.htm"],
+    excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**", "**/dist/**", "dist/**", "**/build/**", "build/**", "**/.next/**", ".next/**", "**/node_modules/**"],
+    scope: "file",
+    // DIFF stage, for the reason the measurement gave: 17 corpus textarea sites carry no upper
+    // bound, so an edit-stage rule would report a project's existing forms on every unrelated
+    // edit to the same file. Against the lines a change adds there is no backlog, and the rule
+    // can be as strict as the convention actually is.
+    stage: "diff",
+    fileCheck: "fe-textarea-size-bounds",
+    message: "A textarea is the only input the user can resize, so it is the only one that can break a layout after it has rendered. Give it both bounds: `rows` (or a min-height) so it never collapses below a usable size, and a max-height so dragging it - or letting it grow with its content - cannot push the page apart. Prefer `resize: vertical` so the column width survives, and put the bounds on the shared Textarea component rather than on each usage. Mark the line `enigma:allow-unbounded-textarea` when the surface owns its viewport (a full-page editor, a code surface) or the design calls for something else (frontend-policy).",
+    severity: "block",
     skill: "frontend-policy"
   },
   {
@@ -628,6 +666,21 @@ var BUILTIN_RULES = [
   // precise signature (a dirty/hasChanges flag assigned a literal true) returned 0 real
   // hits and 2 false ones, a CLI tracking whether it had rewritten a config file. A rule
   // here would fire on correct code, so it stays guidance in frontend-policy.
+  // NOTE: there is deliberately no rule for "a server component awaits its data before it
+  // returns markup". It is the other half of the blank-first-paint complaint, but the shape
+  // (`export default async function Page()` with an awaited value and no Suspense boundary) is
+  // ALSO how a correct statically-generated page is written - the corpus's one match is a docs
+  // page awaiting its MDX at build time, where there is no runtime wait to hide. Whether the
+  // await costs the user anything depends on where the page renders and whether the data is
+  // static, and none of that is in the file. It stays in frontend-policy's Instant First Paint.
+  // NOTE: there is deliberately no rule for "a fixed-length one-time code submits itself when
+  // the last digit lands". The selector would be precise (`autocomplete="one-time-code"`, the
+  // same marker sec-password-breach-check keys on), but the DEFECT has no file-local form: the
+  // submit normally lives in a parent, a form library or a mutation hook, so its absence from
+  // the field's file proves nothing, and the three guards that make auto-submit safe (once per
+  // distinct complete value, no re-fire after a failure, no auto-retry on 429) are behaviour a
+  // regex cannot read at all. It stays in frontend-policy's auth section, with the attempt-cap
+  // half in security-policy.
   // NOTE: there is deliberately no "card inside a card" or "border with no information"
   // rule, even though both are named in frontend-policy. They are RELATIONAL defects: a
   // container is redundant only relative to the ancestor it sits in and the spacing around
@@ -697,6 +750,170 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "ciphera-style-policy"
   },
+  {
+    id: "fe-icon-shrink",
+    label: "An icon does not shrink to make room for text",
+    files: ["*.css", "*.scss", "*.html", "*.htm", "*.astro", "*.vue", "*.svelte", "*.tsx", "*.jsx"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/stories/**",
+      "*.stories.*",
+      "*.min.css",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // `flex-shrink: 1` is the default, so in a row of icon plus text the browser takes width
+    // from BOTH when the text runs long - and the icon, having no content to reflow, is simply
+    // squashed. An explicit width/height does not protect it (that is the base size, not the
+    // minimum) and an <svg> scales with its viewBox rather than clipping, so it deforms
+    // silently instead of overflowing visibly.
+    // Two gateable shapes, one per styling model. (a) A STYLESHEET rule sizing an svg/img on
+    // one line: the size bound (<= 64px) is what makes it an ICON rather than a picture -
+    // a hero image at 640px SHOULD shrink with the viewport, and pinning it would be the
+    // wrong fix. (b) A UTILITY-CLASS line carrying a flex container, an icon element and an
+    // icon size class together; the flex requirement is what keeps this off the rest of the
+    // markup, and it is why a multi-line JSX icon is out of reach by construction (the same
+    // accepted recall loss as fe-icon-action-button). Case-SENSITIVE so `[A-Z]\w*` means a
+    // component tag (<ExternalLink>, <Avatar>) and not every lowercase element.
+    pattern: "^(?!.*enigma:)(?:(?=.*\\bflex\\b)(?=.*<(?:svg|img|[A-Z][A-Za-z0-9]*)\\b).*\\b(?:h-\\d(?:\\.\\d)?[ \\t]+w-\\d(?:\\.\\d)?|w-\\d(?:\\.\\d)?[ \\t]+h-\\d(?:\\.\\d)?|size-\\d(?:\\.\\d)?)\\b|[^{}/]*\\b(?:svg|img)[ \\t]*(?:,[^{}]*)?\\{[^}]*\\bwidth:[ \\t]*(?:[1-9]|[1-5]\\d|6[0-4])px)",
+    flags: "",
+    // A file that already pins an icon anywhere is treated as having made the decision. This
+    // is deliberately leaky (one guarded rule clears the file) because the fix that scales is
+    // a single base rule - `svg { flex-shrink: 0 }` - not a repetition per selector, and a
+    // rule that kept firing after that fix would train the model to ignore it.
+    absent: "flex-shrink:\\s*0|\\bshrink-0\\b|\\bflex-none\\b|flex:\\s*(?:none|0 0)|enigma:allow-shrinking-icon",
+    message: "Icon sized but not pinned. `flex-shrink: 1` is the default, so when the text beside it runs long the browser takes width from the ICON too - and having no content to reflow, a 14px glyph ends up rendered 4px wide next to a long name. The explicit width/height does not prevent it: that is the base size, not the minimum, and an svg scales with its viewBox instead of clipping, so it deforms silently. Give anything with a fixed intrinsic size - icon, avatar, badge, status dot, spinner - `flex-shrink: 0` (Tailwind `shrink-0`), and let the TEXT be what truncates. Set it once where the icons are defined (`svg { flex-shrink: 0 }` in the base stylesheet, or inside the shared Icon component) rather than per row. Mark a deliberate exception with an `enigma:` note on the line or `enigma:allow-shrinking-icon` in the file (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
+  // TYPESCRIPT MODULE GRAPH. Three rules that keep a TS project's imports stable as it grows:
+  // the project declares an alias, deep climbs go through it, and no specifier carries a build
+  // artifact's extension. All three are decided against the project's tsconfig rather than the
+  // edited line, which is why each is a coded check (see the module-graph block below).
+  {
+    id: "ts-alias-paths",
+    label: "TypeScript project declares a path alias",
+    // The exact basename only: the split configs a bundler generates (tsconfig.node.json,
+    // tsconfig.app.json) exist to compile one config file and have no source tree to alias.
+    files: ["tsconfig.json"],
+    excludeFiles: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/vendor/**",
+      "node_modules/**",
+      "dist/**",
+      "build/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    fileCheck: "ts-alias-paths",
+    message: 'This TypeScript project declares no path alias. Add one - `"baseUrl": "."` plus `"paths": { "@/*": ["./src/*"] }` - and import through it (`@/services/user`) instead of counting directories. A relative chain encodes where the importing file happens to sit, so moving either file rewrites specifiers that had nothing to do with the change; an alias is stable under both. Bundlers, tsx and Bun resolve it from tsconfig with no extra config; for Jest add moduleNameMapper. If this config is not the project\'s source config, mark it with an `enigma:` note (ciphera-style-policy).',
+    severity: "block",
+    skill: "ciphera-style-policy"
+  },
+  {
+    id: "ts-alias-deep-relative",
+    label: "Deep relative import goes through the path alias",
+    files: ["*.ts", "*.tsx", "*.mts", "*.cts"],
+    // Tests are excluded on purpose: a runner that has not been told about the alias (Jest
+    // without moduleNameMapper) cannot resolve it, so the import that is right in src is not
+    // automatically right in a test file. Same two-form generated/vendored excludes as above.
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/_build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "_build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // Fires only when the project HAS an alias covering the target: the climb on its own is
+    // correct code in a project with none, and a target outside the aliased root cannot be
+    // written any other way. Measured over the corpus: every project that declares an alias
+    // already uses it everywhere, so this is a scaffolding guard, not a backlog.
+    fileCheck: "ts-alias-deep-relative",
+    message: "Deep relative import in a project that declares a path alias. Write it through the alias instead: the chain of `../` names the directory the importing file sits in today, so moving either file breaks specifiers that had nothing to do with the change, and a reader has to count directories to see what is being imported. Keep `./sibling` and `../` for a file in the same or the parent folder - the alias is for anything further. Mark a deliberate exception with an `enigma:` note on the line (ciphera-style-policy).",
+    severity: "block",
+    skill: "ciphera-style-policy"
+  },
+  {
+    id: "ts-import-extension",
+    label: "No file extension in a module specifier",
+    files: ["*.ts", "*.tsx"],
+    // .mts/.cts are out of scope by construction: those extensions exist to pin a file to
+    // Node's dual-module resolution, where the specifier extension is mandatory.
+    excludeFiles: [
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/_build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "_build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // Only under bundler/preserve resolution, and only when no such file actually exists -
+    // see extensionImports for why both guards are what keep this at zero false positives.
+    fileCheck: "ts-import-extension",
+    message: 'File extension in a module specifier. Under `"moduleResolution": "bundler"` the resolver finds the source file on its own, so an extension only pins the import to a build artifact - `.js` names a file that does not exist in the source tree, and `.ts` needs allowImportingTsExtensions and breaks the moment the project emits. Drop it and let the resolver do the work. If this project has to emit for Node\'s own ESM resolution instead, that is a tsconfig decision (`"module": "nodenext"`), and there the extension is required - make it once in tsconfig rather than per import (backend-policy, ciphera-style-policy).',
+    severity: "block",
+    skill: "ciphera-style-policy"
+  },
+  {
+    id: "ts-legacy-module-resolution",
+    label: "Modern TypeScript module resolution and target",
+    files: ["tsconfig.json", "tsconfig.*.json"],
+    excludeFiles: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/vendor/**",
+      "node_modules/**",
+      "dist/**",
+      "build/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // `node`/`node10` is TypeScript's own legacy resolver: it predates package.json "exports",
+    // so a modern dependency resolves to the wrong entry point or not at all. A pre-ES2017
+    // target is the same class of decision - it downlevels async/await itself. Both are
+    // single, unambiguous values, which is what makes this a pattern rule rather than a
+    // check; a project that genuinely needs ES5 output marks the line.
+    // THE TARGET BOUND IS DELIBERATELY LOWER THAN THE ADVICE. backend-policy asks for es2022,
+    // but `"target": "es2017"` is what create-next-app still ships and what several stock
+    // configs default to, and in a Next app SWC compiles the output anyway so the value
+    // barely matters - blocking the ecosystem's own template is how a rule teaches people to
+    // ignore it. The skill persuades toward es2022; the gate only stops what is unambiguous.
+    pattern: `^(?!.*enigma:).*(?:["']moduleResolution["']\\s*:\\s*["']node(?:10)?["']|["']target["']\\s*:\\s*["']es(?:3|5|6|2015|2016)["'])`,
+    message: 'Legacy TypeScript configuration. `"moduleResolution": "node"` is the pre-2022 resolver: it ignores a package\'s `exports` map, so a modern dependency resolves to the wrong entry point or not at all, and a pre-ES2017 target downlevels async/await itself. For a backend built by a bundler or run by tsx/Bun use `"module": "esnext"` with `"moduleResolution": "bundler"`; for one emitted by tsc for Node\'s own loader use `"module": "nodenext"` (and then specifiers DO carry `.js`). Pair either with `"target": "es2022"` and `"strict": true`. Mark a deliberate legacy target with an `enigma:` note on the line (backend-policy).',
+    severity: "block",
+    skill: "backend-policy"
+  },
   {
     id: "proc-windows-hide",
     label: "Spawned process must not pop a console window",
@@ -1011,7 +1228,12 @@ var PROJECT_CHECKS = {
   }
 };
 var FILE_CHECKS = {
-  "proc-windows-hide": (content) => missingWindowsHide(content)
+  "proc-windows-hide": (content) => missingWindowsHide(content),
+  "fe-server-first-mutation": (content) => serverFirstMutation(content),
+  "fe-textarea-size-bounds": (content) => textareaSizeBounds(content),
+  "ts-import-extension": (content, file) => extensionImports(content, file),
+  "ts-alias-deep-relative": (content, file) => deepRelativeImports(content, file),
+  "ts-alias-paths": (content, file) => missingPathAlias(content, file)
 };
 var FIXERS = {
   "fe-name-input-capitalize": (line, file) => {
@@ -1082,6 +1304,180 @@ function missingWindowsHide(content) {
   }
   return out;
 }
+var MUTATING_REQUEST = /method:\s*["'`](POST|PUT|PATCH|DELETE)|\b(?:axios|api|\$fetch|http|client)\.(?:post|put|patch|delete)\s*\(/i;
+var ENTITY_WRITE = /\bset[A-Z]\w*\s*\(\s*(?:\(?\w+\)?\s*=>\s*)?[\w.]*\.(?:filter|map|slice|concat)\s*\(|\bset[A-Z]\w*\s*\(\s*!/;
+var OPTIMISTIC_SIGNAL = /useOptimistic|onMutate|optimisticData|setQueryData|rollbackOnError|\brollback\s*[(:]|\brevert\s*[(:]|previous[A-Z_]/;
+var ALLOW_SERVER_FIRST = /enigma:allow-server-first/;
+var RESULT_BINDING = /(?:const|let|var)\s+(\w+)\s*=\s*(?:await\s+)?/;
+var BLOCK_LOOKBACK = 120;
+var BLOCK_LOOKAHEAD = 200;
+function enclosingBlock(lines, index) {
+  let depth = 0;
+  let start = index;
+  let foundStart = false;
+  for (let i = index; i >= 0 && index - i < BLOCK_LOOKBACK && !foundStart; i--) {
+    const line = lines[i];
+    for (let c = line.length - 1; c >= 0; c--) {
+      if (line[c] === "}") depth++;
+      else if (line[c] === "{") {
+        if (depth === 0) {
+          start = i;
+          foundStart = true;
+          break;
+        }
+        depth--;
+      }
+    }
+  }
+  depth = 0;
+  let end = index;
+  let foundEnd = false;
+  for (let i = start; i < lines.length && i - start < BLOCK_LOOKAHEAD && !foundEnd; i++) {
+    for (const ch of lines[i]) {
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth === 0) {
+          end = i;
+          foundEnd = true;
+          break;
+        }
+      }
+    }
+  }
+  return { start, end: Math.max(end, index) };
+}
+function serverFirstMutation(content) {
+  if (OPTIMISTIC_SIGNAL.test(content)) return [];
+  const lines = content.split("\n");
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || !MUTATING_REQUEST.test(line)) continue;
+    const { start, end } = enclosingBlock(lines, i);
+    if (lines.slice(start, end + 1).some((l) => ALLOW_SERVER_FIRST.test(l))) continue;
+    if (lines.slice(start, i).some((l) => ENTITY_WRITE.test(l))) continue;
+    let binding = "";
+    for (let b = i; b >= Math.max(0, i - 4) && !binding; b--) binding = RESULT_BINDING.exec(lines[b])?.[1] ?? "";
+    const uses = binding ? new RegExp(`\\b${binding}\\b`) : null;
+    const write = lines.slice(i + 1, end + 1).find((l) => {
+      if (COMMENT_LINE.test(l)) return false;
+      const at = ENTITY_WRITE.exec(l);
+      if (!at) return false;
+      return !uses?.test(l.slice(at.index));
+    });
+    if (write) out.push({ line: i + 1, detail: `the UI is only updated after the request resolves: ${write.trim().slice(0, 80)}` });
+  }
+  return out;
+}
+var TEXTAREA = /<textarea\b/;
+var TEXTAREA_LOWER = /\brows\s*=|\brows:\s*\d|min-h-|min-height|minHeight|\bh-\[|\bh-\d|height\s*:\s*\d/;
+var TEXTAREA_UPPER = /max-h-|max-height|maxHeight/;
+var TEXTAREA_FIXED = /resize-none|resize\s*:\s*none/;
+var TEXTAREA_AUTOSIZE = /field-?sizing|scrollHeight|autosize|auto-size|TextareaAutosize|textarea-autosize/i;
+function textareaSizeBounds(content) {
+  const lower = TEXTAREA_LOWER.test(content);
+  const upper = TEXTAREA_UPPER.test(content);
+  const fixed = TEXTAREA_FIXED.test(content) && !TEXTAREA_AUTOSIZE.test(content);
+  if (lower && (upper || fixed)) return [];
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line) || !TEXTAREA.test(line)) continue;
+    const missing = [];
+    if (!lower) missing.push("no minimum size: no rows, min-height or fixed height");
+    if (!upper && !fixed) missing.push("no maximum size: no max-height, and it can be dragged or grows with its content");
+    if (missing.length) out.push({ line: i + 1, detail: missing.join("; ") });
+  }
+  return out;
+}
+var SPECIFIER = /^[ \t]*(?:import|export)\b[^;]*?\bfrom\s*["']([^"']+)["']|^[ \t]*import\s*["']([^"']+)["']|\bimport\(\s*["']([^"']+)["']|\brequire\(\s*["']([^"']+)["']/gm;
+var MODULE_EXT = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/i;
+var JS_EXT = /\.(js|jsx|mjs|cjs)$/i;
+var tsconfigCache = /* @__PURE__ */ new Map();
+function nearestTsconfig(file) {
+  let dir = dirname(resolve(file));
+  const seen = [];
+  for (let i = 0; i < 20; i++) {
+    const cached = tsconfigCache.get(dir);
+    if (cached !== void 0) {
+      for (const d of seen) tsconfigCache.set(d, cached);
+      return cached;
+    }
+    seen.push(dir);
+    const candidate = join(dir, "tsconfig.json");
+    if (existsSync(candidate)) {
+      let found = null;
+      try {
+        found = { dir, text: readFileSync(candidate, "utf8") };
+      } catch {
+        found = null;
+      }
+      for (const d of seen) tsconfigCache.set(d, found);
+      return found;
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  for (const d of seen) tsconfigCache.set(d, null);
+  return null;
+}
+function pathAlias(cfg) {
+  const m = /["']([^"']+)\/\*["']\s*:\s*\[\s*["']([^"']+)\/\*["']/.exec(cfg.text);
+  if (!m) return null;
+  const baseUrl = /["']baseUrl["']\s*:\s*["']([^"']+)["']/.exec(cfg.text)?.[1] ?? ".";
+  return { prefix: m[1], root: resolve(cfg.dir, baseUrl, m[2]) };
+}
+function specifiers(content) {
+  const lines = content.split("\n");
+  const out = [];
+  for (const m of content.matchAll(SPECIFIER)) {
+    const spec = m[1] ?? m[2] ?? m[3] ?? m[4];
+    if (!spec) continue;
+    const line = content.slice(0, m.index).split("\n").length;
+    const text = lines[line - 1] ?? "";
+    if (COMMENT_LINE.test(text) || text.includes("enigma:")) continue;
+    out.push({ spec, line });
+  }
+  return out;
+}
+function extensionImports(content, file) {
+  const cfg = nearestTsconfig(file);
+  if (!cfg || !/["']module(?:Resolution)?["']\s*:\s*["'](?:bundler|preserve)["']/i.test(cfg.text)) return [];
+  const dir = dirname(resolve(file));
+  const out = [];
+  for (const { spec, line } of specifiers(content)) {
+    if (!/^\.\.?\//.test(spec) || !MODULE_EXT.test(spec)) continue;
+    if (JS_EXT.test(spec) && existsSync(resolve(dir, spec))) continue;
+    out.push({ line, detail: `"${spec}" -> "${spec.replace(MODULE_EXT, "")}"` });
+  }
+  return out;
+}
+function deepRelativeImports(content, file) {
+  const cfg = nearestTsconfig(file);
+  const alias = cfg && pathAlias(cfg);
+  if (!alias) return [];
+  const dir = dirname(resolve(file));
+  const out = [];
+  for (const { spec, line } of specifiers(content)) {
+    if (!/^(?:\.\.\/){2,}/.test(spec)) continue;
+    const target = resolve(dir, spec);
+    const rel = target.slice(alias.root.length + 1).replace(/\\/g, "/");
+    if (!target.startsWith(`${alias.root}${sep}`) || !rel) continue;
+    out.push({ line, detail: `"${spec}" -> "${alias.prefix}/${rel}"` });
+  }
+  return out;
+}
+function missingPathAlias(content, file) {
+  if (/["'](?:paths|extends)["']\s*:/.test(content)) return [];
+  const dir = dirname(resolve(file));
+  const src = ["src", "app", "lib"].find((d) => existsSync(join(dir, d)));
+  if (!src) return [];
+  const anchor = content.split("\n").findIndex((l) => /["']compilerOptions["']/.test(l));
+  return [{ line: anchor === -1 ? 1 : anchor + 1, detail: `no alias for ./${src}` }];
+}
 var NAMED_IMPORT = /^import[ \t]+(?:[\w$]+[ \t]*,[ \t]*)?(?:type[ \t]+)?\{([^}]*)\}[ \t]*from[ \t]*["']([^"']+)["'].*$/gm;
 var INTERNAL_MODULE = /^\.|^#|^[@~]\//;
 function wideNamedImports(content, max) {
@@ -1109,6 +1505,16 @@ function globToRegExp(glob, ignoreCase = false) {
   const body = esc.replace(/\*\*/g, " ").replace(/\*/g, "[^/]*").replace(/ /g, ".*").replace(/\?/g, "[^/]");
   return new RegExp(glob.includes("/") ? `^${body}$` : `(^|/)${body}$`, ignoreCase ? "i" : "");
 }
+var globCache = /* @__PURE__ */ new Map();
+function globRe(glob, ignoreCase = false) {
+  const key = `${ignoreCase ? "i" : "s"}:${glob}`;
+  let re = globCache.get(key);
+  if (!re) {
+    re = globToRegExp(glob, ignoreCase);
+    globCache.set(key, re);
+  }
+  return re;
+}
 function guardrailsConfigPath() {
   return process.env.ENIGMA_GUARDRAILS_CONFIG || join(homedir(), ".enigma-guardrails.json");
 }
@@ -1148,12 +1554,13 @@ function findProjectRoot(file) {
   }
   return null;
 }
-function checkFile(file, content, projectRoot) {
+function checkFile(file, content, projectRoot, stage = "edit", rules = loadRules()) {
   const norm = file.replace(/\\/g, "/");
   const out = [];
-  for (const rule of loadRules()) {
-    if (!rule.files.some((g) => globToRegExp(g, rule.ignoreFileCase).test(norm))) continue;
-    if (rule.excludeFiles?.some((g) => globToRegExp(g, rule.ignoreFileCase).test(norm))) continue;
+  for (const rule of rules) {
+    if (stage === "edit" && rule.stage === "diff") continue;
+    if (!rule.files.some((g) => globRe(g, rule.ignoreFileCase).test(norm))) continue;
+    if (rule.excludeFiles?.some((g) => globRe(g, rule.ignoreFileCase).test(norm))) continue;
     const base = { ruleId: rule.id, severity: rule.severity, file: norm, message: rule.message, skill: rule.skill };
     if (rule.scope === "file" && rule.maxBytes) {
       const bytes = Buffer.byteLength(content, "utf8");
@@ -1164,7 +1571,7 @@ function checkFile(file, content, projectRoot) {
       }
     } else if (rule.scope === "file" && rule.fileCheck) {
       const check = FILE_CHECKS[rule.fileCheck];
-      for (const hit of check ? check(content) : []) {
+      for (const hit of check ? check(content, file) : []) {
         out.push({ ...base, line: hit.line, message: `${rule.message} (${hit.detail})` });
       }
     } else if (rule.scope === "file" && rule.pattern) {
@@ -1200,7 +1607,7 @@ function formatFindings(findings) {
     return `${tag} ${f.file}${loc} (${f.ruleId})${skill}: ${f.message}`;
   }).join("\n");
 }
-function checkPath(file) {
+function checkPath(file, stage = "edit") {
   let content;
   try {
     content = readFileSync(file, "utf8");
@@ -1208,7 +1615,7 @@ function checkPath(file) {
     return [];
   }
   if (content.includes("\0")) return [];
-  return checkFile(file, content, findProjectRoot(file));
+  return checkFile(file, content, findProjectRoot(file), stage);
 }
 function runGuardrailsHook(payload) {
   let file;
@@ -1223,9 +1630,12 @@ function runGuardrailsHook(payload) {
   if (fixed.length) process.stdout.write(`enigma guardrails (fixed)
 ${fixed.map((f) => `${f.file}:${f.line} (${f.ruleId})`).join("\n")}
 `);
+  recordFindings(fixed, "fixed");
   if (!findings.length) return 0;
   const warns = findings.filter((f) => f.severity === "warn");
   const blocks = findings.filter((f) => f.severity === "block");
+  recordFindings(warns, "warned");
+  recordFindings(blocks, "blocked");
   if (warns.length) process.stdout.write(`enigma guardrails (suggestions)
 ${formatFindings(warns)}
 `);
@@ -1238,6 +1648,97 @@ Fix the above before continuing.
   }
   return 0;
 }
+var LEDGER_MAX_BYTES = 512 * 1024;
+var LEDGER_KEEP = 2e3;
+function ledgerPath() {
+  return process.env.ENIGMA_GUARDRAILS_LOG || join(homedir(), ".enigma", "guardrail-log.jsonl");
+}
+function ledgerKey(rule, outcome, file, line) {
+  return JSON.stringify([rule, outcome, file, line ?? null]);
+}
+function recordedToday(day) {
+  const seen = /* @__PURE__ */ new Set();
+  eachLedgerEntry(1, (e) => {
+    if (e.at.slice(0, 10) === day) seen.add(ledgerKey(e.rule, e.outcome, e.file, e.line));
+  });
+  return seen;
+}
+function recordFindings(findings, outcome, stage = "edit") {
+  if (!findings.length) return;
+  const at = (/* @__PURE__ */ new Date()).toISOString();
+  const seen = stage === "diff" || outcome !== "blocked" ? recordedToday(at.slice(0, 10)) : null;
+  const rows = [];
+  for (const f of findings) {
+    if (seen) {
+      const key = ledgerKey(f.ruleId, outcome, f.file, f.line);
+      if (seen.has(key)) continue;
+      seen.add(key);
+    }
+    rows.push(JSON.stringify({ at, rule: f.ruleId, severity: f.severity, outcome, stage, file: f.file, line: f.line }));
+  }
+  if (!rows.length) return;
+  const path = ledgerPath();
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    let size = 0;
+    try {
+      size = statSync(path).size;
+    } catch {
+    }
+    if (size > LEDGER_MAX_BYTES) {
+      const kept = readFileSync(path, "utf8").split("\n").filter(Boolean).slice(-LEDGER_KEEP);
+      writeFileSync(path, `${kept.join("\n")}
+`);
+    }
+    appendFileSync(path, `${rows.join("\n")}
+`);
+  } catch {
+  }
+}
+function eachLedgerEntry(sinceDays, visit) {
+  let text;
+  try {
+    text = readFileSync(ledgerPath(), "utf8");
+  } catch {
+    return;
+  }
+  const cutoff = sinceDays > 0 ? Date.now() - sinceDays * 864e5 : 0;
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (typeof entry?.rule !== "string") continue;
+      if (cutoff && Date.parse(entry.at) < cutoff) continue;
+      visit(entry);
+    } catch {
+    }
+  }
+}
+function readLedger(sinceDays = 0) {
+  const out = [];
+  eachLedgerEntry(sinceDays, (entry) => out.push(entry));
+  return out;
+}
+function countLedger(sinceDays = 0) {
+  let count = 0;
+  eachLedgerEntry(sinceDays, () => {
+    count++;
+  });
+  return count;
+}
+function summarizeLedger(entries) {
+  const by = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const row = by.get(e.rule) || { rule: e.rule, total: 0, blocked: 0, warned: 0, fixed: 0, last: e.at };
+    row.total++;
+    if (e.outcome === "blocked") row.blocked++;
+    else if (e.outcome === "warned") row.warned++;
+    else row.fixed++;
+    if (e.at > row.last) row.last = e.at;
+    by.set(e.rule, row);
+  }
+  return [...by.values()].sort((a, b) => b.total - a.total || a.rule.localeCompare(b.rule));
+}
 function gitFiles(all) {
   const out = execFileSync("git", all ? ["ls-files"] : ["diff", "--cached", "--name-only", "--diff-filter=ACM"], { encoding: "utf8", windowsHide: true });
   return out.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -1297,12 +1798,21 @@ export {
   applyFixes,
   checkFile,
   checkPath,
+  countLedger,
+  deepRelativeImports,
+  extensionImports,
   findProjectRoot,
   formatFindings,
   loadRules,
+  missingPathAlias,
   missingWindowsHide,
+  readLedger,
+  recordFindings,
   runGuardrailsHook,
   runGuardrailsScan,
   runGuardrailsScanCli,
+  serverFirstMutation,
+  summarizeLedger,
+  textareaSizeBounds,
   wideNamedImports
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.33.6",
+  "version": "1.34.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {