enigma-cli 1.33.7 → 1.34.0

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "b35f0bb4a29f2346d9a1b00a4bfee9557a9b6a44116d9e6e59abcd945466dbcb"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules), including the generalization rule that treats a named example as a class to sweep and fix.",
   "updated": "2026-08-02T04:28:51+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "95091678d4e72e3a9b1ef3ad0514e503a2a631f0d134bf772b4a1b3c66881995"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "f4ccf51286027c97c8402f3bac6c894e05a84cba2de014463cb3a83be17537d4"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -288,6 +288,19 @@ Where this lives and when it runs:
 
 ---
 
+## A Textarea Is Bounded At Both Ends
+
+A textarea is the only input the user can resize, so it is the only one whose size can break a layout after the page has rendered. Give every textarea a floor and a ceiling; the `fe-textarea-size-bounds` guardrail blocks a new one that has neither.
+
+- Floor: `rows` (or a `min-height`) so it never collapses to a line and a half. A bare `<textarea>` defaults to about two rows and can be dragged smaller than the text it holds.
+- Ceiling: a `max-height`, so dragging the handle cannot push the rest of the page off the screen. Past the ceiling the textarea scrolls its own content; the page does not grow.
+- Prefer `resize: vertical` over free resize: horizontal dragging escapes the column and breaks a form grid that everything else respects. `resize: none` is acceptable only when the size is genuinely fixed, and it removes an affordance the user expects, so do not reach for it first.
+- An autosizing textarea (`field-sizing: content`, a `scrollHeight` assignment, an autosize package) MUST carry the ceiling: growing with content is exactly the case where a long paste otherwise pushes the submit button out of reach.
+- Put the bounds on the shared Textarea component or one base rule, not on each usage. A per-usage fix is one component away from being forgotten, and the rule is cleared by any bound in the file precisely so the base fix is the one that scales.
+- The exceptions, and they are real: a surface that owns its viewport (a full-page editor, a code or log pane sized to its container) and any case the design deliberately calls otherwise. Mark that line `enigma:allow-unbounded-textarea` so the intent is recorded rather than re-litigated.
+
+---
+
 ## Sign-In, Sign-Up and Recovery Screens
 
 Auth is the first screen a user meets and the one most often shipped half-built. Treat the four screens as one flow: sign in, sign up, forgot password, set a new password. The server-side rules (token lifetime, rate limits, what an answer may reveal) are owned by security-policy; what follows is the UI half.
@@ -425,10 +438,15 @@ Never render an unbounded or large dataset in one shot (no fetch-everything then
 
 ## Optimistic UI & Rollback
 
-- Use optimistic UI updates when the operation is safe and likely to succeed.
-- Always implement rollback handling for failed operations.
-- Reconcile optimistic state with the server response; never leave the UI in a divergent state.
-- Keep the optimistic update and any client cache consistent with each other.
+For a reversible user action, optimistic is the DEFAULT and not an enhancement to add later. The order is: apply the change to local state, then send the request, then reconcile - never request, await, and only then touch the UI.
+
+- The defect has a name and a shape: a handler that awaits the mutation and updates state afterwards (`await fetch(...)` then `setItems(prev => prev.filter(...))`, or `await api.patch(...)` then a refetch). The user pays the whole round trip for an action whose outcome was never in doubt. The `fe-server-first-mutation` guardrail catches the clearest form of this on the lines a change adds; the rest is on you, because the rule cannot see a handler that hides the wait behind a parent refetch (`await onChanged()`, `await load()`, `router.refresh()`) - that is the same defect and it is the most common one.
+- Which actions: toggle a flag, remove a row, rename, reorder, mark read, add a tag, favourite, vote - anything the client can compute the result of. Optimistic is wrong when only the server knows the outcome: a payment or charge, a server-assigned identifier the UI must display, a uniqueness check, a long job whose result IS the response, anything irreversible.
+- Rollback is part of the feature, not a follow-up. Capture the previous value BEFORE mutating (`const previous = items`), restore it on failure, and say what failed - a silent revert reads as a UI bug and is worse than the wait. Do not roll back a value the user has since edited: reconcile against the server's response rather than blindly restoring.
+- Reconcile optimistic state with the server response; never leave the UI in a divergent state, and keep the optimistic update and any client cache consistent with each other (invalidate or patch the cache, do not leave a stale list beside a fresh one).
+- Where a delete is reversible, the optimistic update plus an Undo affordance replaces the confirmation prompt entirely (see Destructive & Irreversible Actions).
+- Guard against the double-apply: an in-flight mutation that the user triggers again must not stack two optimistic updates, and a re-render must not re-apply one.
+- With a data layer that owns this (TanStack Query `onMutate` + `onError` rollback + `onSettled` invalidate, SWR `optimisticData` + `rollbackOnError`, React `useOptimistic`), use it instead of hand-rolling local state - it already solves the cache reconciliation.
 - Surface failures to the user clearly without exposing internal error details (see validation-policy).
 
 ---

package/assets/skills/frontend-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "frontend-policy",
-  "version": "1.25.0",
+  "version": "1.27.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.33.7",
-  "sha": "6c04c2bf01f5d46d75f032fa93f5ec92244f327fb6f266de46ed448ce50a0a99"
+  "updated": "2026-08-02T22:52:54+02:00",
+  "cliVersion": "1.34.0",
+  "sha": "6c4b973c41ca7c12e1839a4fba76f26ede4e04a57567392687ca61e7f6687d9b"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-07-16T22:44:02+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "e6dfbc33884000d9d25841bd9c5a84d6558ffd374882cb7b34451eb2cebc2161"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "3201b6d41437626eb7bf45648c0d7f8c419dc4de87fbd9d4ca83c5ae3b6b6edf"
 }

package/assets/skills/skill-creator/assets/eval_review.html

@@ -26,7 +26,7 @@
     tr:nth-child(even) td { background: #faf9f5; }
     tr:hover td { background: #f3f1ea; }
     .section-header td { background: #e8e6dc; font-family: 'Poppins', sans-serif; font-weight: 500; font-size: 0.8rem; color: #141413; text-transform: uppercase; letter-spacing: 0.05em; }
-    .query-input { width: 100%; padding: 0.4rem; border: 1px solid #e8e6dc; border-radius: 4px; font-size: 0.875rem; font-family: 'Lora', Georgia, serif; resize: vertical; min-height: 60px; }
+    .query-input { width: 100%; padding: 0.4rem; border: 1px solid #e8e6dc; border-radius: 4px; font-size: 0.875rem; font-family: 'Lora', Georgia, serif; resize: vertical; min-height: 60px; max-height: 40vh; }
     .query-input:focus { outline: none; border-color: #d97757; box-shadow: 0 0 0 2px rgba(217,119,87,0.15); }
     .toggle { position: relative; display: inline-block; width: 44px; height: 24px; }
     .toggle input { opacity: 0; width: 0; height: 0; }

package/assets/skills/skill-creator/eval-viewer/viewer.html

@@ -239,6 +239,7 @@
     .feedback-textarea {
       width: 100%;
       min-height: 100px;
+      max-height: 50vh;
       padding: 0.75rem;
       border: 1px solid var(--border);
       border-radius: 4px;

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-02T19:58:42+02:00",
-  "cliVersion": "1.33.7",
-  "sha": "34fc27f140ad425eff742d319b3179f861f70edc966a2cd96d1cd6b91717b766"
+  "cliVersion": "1.34.0",
+  "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-01T17:44:16+02:00",
-  "cliVersion": "1.33.7",
+  "cliVersion": "1.34.0",
   "sha": "225e1e26f4a49fac70714b1bebc104ea42143203cc8fcc9e3330b29f05b6e025"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "527b4fd317dd95669889d9e474a1f0dbd926f3dfe69865eaff8f6254fe971256",
-  "enigma-linux-arm64": "ed239f141d8628719494ca4563db886a880dbdf3f0f2456bfe0efe77c3918dc6",
-  "enigma-linux-x64": "24950b825b7427d9651cf42c85ed29667fbf8309135c7b5bc1fe4811c5f91f99",
-  "enigma-win32-x64.exe": "332cc818638fdb0fb94a651af2cfe49da3b1bde40bd151f42624108f4fb374e2"
+  "enigma-darwin-arm64": "1b0fdfa47b7dce341360391ffa8e3d78f061779312cb3ac7d8a42f92016faf18",
+  "enigma-linux-arm64": "17b52af9adcbea9bed91cbaae68658aaffa561bfc60b95dd159b481074e23faa",
+  "enigma-linux-x64": "702089b4919a13b954b60aa38b96ae5f10091ea13511cf56b135fb589d2d9857",
+  "enigma-win32-x64.exe": "ff51dfc714136f661ad798180a2b31c87f24dffe56714ce4b782fe22d6eb1ec4"
 }

package/dist/guardrails.js

@@ -5,7 +5,7 @@ import { homedir } from "os";
 import { fileURLToPath } from "url";
 import { execFileSync } from "child_process";
 import { dirname, join, resolve, sep } from "path";
-import { readFileSync, writeFileSync, statSync, existsSync } from "fs";
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync, statSync, existsSync } from "fs";
 var COMMENT_LINE = /^\s*(\/\/|#|\*|--|<!--|\{?\/\*)/;
 var BUILTIN_RULES = [
   {
@@ -428,6 +428,39 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "frontend-policy"
   },
+  {
+    id: "fe-server-first-mutation",
+    label: "Optimistic update for a reversible mutation",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte"],
+    excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**", "**/dist/**", "dist/**", "**/build/**", "build/**", "**/.next/**", ".next/**", "**/node_modules/**"],
+    scope: "file",
+    // DIFF stage, and that is the whole reason this rule can exist. Measured over 2762 UI files
+    // of real product repositories, 116 of the 140 files that mutate anything hold no optimistic
+    // update at all - a legacy backlog an edit-stage rule would fire on forever, which is how a
+    // gate teaches people to ignore it. Against the lines a turn ADDED there is no backlog: it
+    // fires only on a mutation the agent just wrote.
+    stage: "diff",
+    fileCheck: "fe-server-first-mutation",
+    message: "This mutation waits for the server before it touches the UI: the row is only dropped (or the flag only flipped) after the request resolves, so the interface freezes for the whole round trip on an action that cannot really fail in an interesting way. Apply the change to local state FIRST, then send the request, and on failure restore the value you saved and say what failed - a silent revert is worse than the wait. Where the delete is reversible, prefer acting immediately with an Undo affordance over a confirmation prompt. Mark the line `enigma:allow-server-first` when the server's response is genuinely required before the UI may change (a payment, a server-assigned identifier, an irreversible action) (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-textarea-size-bounds",
+    label: "Textarea declares a minimum and a maximum size",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.html", "*.htm"],
+    excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**", "**/dist/**", "dist/**", "**/build/**", "build/**", "**/.next/**", ".next/**", "**/node_modules/**"],
+    scope: "file",
+    // DIFF stage, for the reason the measurement gave: 17 corpus textarea sites carry no upper
+    // bound, so an edit-stage rule would report a project's existing forms on every unrelated
+    // edit to the same file. Against the lines a change adds there is no backlog, and the rule
+    // can be as strict as the convention actually is.
+    stage: "diff",
+    fileCheck: "fe-textarea-size-bounds",
+    message: "A textarea is the only input the user can resize, so it is the only one that can break a layout after it has rendered. Give it both bounds: `rows` (or a min-height) so it never collapses below a usable size, and a max-height so dragging it - or letting it grow with its content - cannot push the page apart. Prefer `resize: vertical` so the column width survives, and put the bounds on the shared Textarea component rather than on each usage. Mark the line `enigma:allow-unbounded-textarea` when the surface owns its viewport (a full-page editor, a code surface) or the design calls for something else (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
   {
     id: "fe-ai-elements-chat",
     label: "AI chat UI via AI Elements",
@@ -1196,6 +1229,8 @@ var PROJECT_CHECKS = {
 };
 var FILE_CHECKS = {
   "proc-windows-hide": (content) => missingWindowsHide(content),
+  "fe-server-first-mutation": (content) => serverFirstMutation(content),
+  "fe-textarea-size-bounds": (content) => textareaSizeBounds(content),
   "ts-import-extension": (content, file) => extensionImports(content, file),
   "ts-alias-deep-relative": (content, file) => deepRelativeImports(content, file),
   "ts-alias-paths": (content, file) => missingPathAlias(content, file)
@@ -1269,6 +1304,94 @@ function missingWindowsHide(content) {
   }
   return out;
 }
+var MUTATING_REQUEST = /method:\s*["'`](POST|PUT|PATCH|DELETE)|\b(?:axios|api|\$fetch|http|client)\.(?:post|put|patch|delete)\s*\(/i;
+var ENTITY_WRITE = /\bset[A-Z]\w*\s*\(\s*(?:\(?\w+\)?\s*=>\s*)?[\w.]*\.(?:filter|map|slice|concat)\s*\(|\bset[A-Z]\w*\s*\(\s*!/;
+var OPTIMISTIC_SIGNAL = /useOptimistic|onMutate|optimisticData|setQueryData|rollbackOnError|\brollback\s*[(:]|\brevert\s*[(:]|previous[A-Z_]/;
+var ALLOW_SERVER_FIRST = /enigma:allow-server-first/;
+var RESULT_BINDING = /(?:const|let|var)\s+(\w+)\s*=\s*(?:await\s+)?/;
+var BLOCK_LOOKBACK = 120;
+var BLOCK_LOOKAHEAD = 200;
+function enclosingBlock(lines, index) {
+  let depth = 0;
+  let start = index;
+  let foundStart = false;
+  for (let i = index; i >= 0 && index - i < BLOCK_LOOKBACK && !foundStart; i--) {
+    const line = lines[i];
+    for (let c = line.length - 1; c >= 0; c--) {
+      if (line[c] === "}") depth++;
+      else if (line[c] === "{") {
+        if (depth === 0) {
+          start = i;
+          foundStart = true;
+          break;
+        }
+        depth--;
+      }
+    }
+  }
+  depth = 0;
+  let end = index;
+  let foundEnd = false;
+  for (let i = start; i < lines.length && i - start < BLOCK_LOOKAHEAD && !foundEnd; i++) {
+    for (const ch of lines[i]) {
+      if (ch === "{") depth++;
+      else if (ch === "}") {
+        depth--;
+        if (depth === 0) {
+          end = i;
+          foundEnd = true;
+          break;
+        }
+      }
+    }
+  }
+  return { start, end: Math.max(end, index) };
+}
+function serverFirstMutation(content) {
+  if (OPTIMISTIC_SIGNAL.test(content)) return [];
+  const lines = content.split("\n");
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || !MUTATING_REQUEST.test(line)) continue;
+    const { start, end } = enclosingBlock(lines, i);
+    if (lines.slice(start, end + 1).some((l) => ALLOW_SERVER_FIRST.test(l))) continue;
+    if (lines.slice(start, i).some((l) => ENTITY_WRITE.test(l))) continue;
+    let binding = "";
+    for (let b = i; b >= Math.max(0, i - 4) && !binding; b--) binding = RESULT_BINDING.exec(lines[b])?.[1] ?? "";
+    const uses = binding ? new RegExp(`\\b${binding}\\b`) : null;
+    const write = lines.slice(i + 1, end + 1).find((l) => {
+      if (COMMENT_LINE.test(l)) return false;
+      const at = ENTITY_WRITE.exec(l);
+      if (!at) return false;
+      return !uses?.test(l.slice(at.index));
+    });
+    if (write) out.push({ line: i + 1, detail: `the UI is only updated after the request resolves: ${write.trim().slice(0, 80)}` });
+  }
+  return out;
+}
+var TEXTAREA = /<textarea\b/;
+var TEXTAREA_LOWER = /\brows\s*=|\brows:\s*\d|min-h-|min-height|minHeight|\bh-\[|\bh-\d|height\s*:\s*\d/;
+var TEXTAREA_UPPER = /max-h-|max-height|maxHeight/;
+var TEXTAREA_FIXED = /resize-none|resize\s*:\s*none/;
+var TEXTAREA_AUTOSIZE = /field-?sizing|scrollHeight|autosize|auto-size|TextareaAutosize|textarea-autosize/i;
+function textareaSizeBounds(content) {
+  const lower = TEXTAREA_LOWER.test(content);
+  const upper = TEXTAREA_UPPER.test(content);
+  const fixed = TEXTAREA_FIXED.test(content) && !TEXTAREA_AUTOSIZE.test(content);
+  if (lower && (upper || fixed)) return [];
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line) || !TEXTAREA.test(line)) continue;
+    const missing = [];
+    if (!lower) missing.push("no minimum size: no rows, min-height or fixed height");
+    if (!upper && !fixed) missing.push("no maximum size: no max-height, and it can be dragged or grows with its content");
+    if (missing.length) out.push({ line: i + 1, detail: missing.join("; ") });
+  }
+  return out;
+}
 var SPECIFIER = /^[ \t]*(?:import|export)\b[^;]*?\bfrom\s*["']([^"']+)["']|^[ \t]*import\s*["']([^"']+)["']|\bimport\(\s*["']([^"']+)["']|\brequire\(\s*["']([^"']+)["']/gm;
 var MODULE_EXT = /\.(ts|tsx|mts|cts|js|jsx|mjs|cjs)$/i;
 var JS_EXT = /\.(js|jsx|mjs|cjs)$/i;
@@ -1382,6 +1505,16 @@ function globToRegExp(glob, ignoreCase = false) {
   const body = esc.replace(/\*\*/g, " ").replace(/\*/g, "[^/]*").replace(/ /g, ".*").replace(/\?/g, "[^/]");
   return new RegExp(glob.includes("/") ? `^${body}$` : `(^|/)${body}$`, ignoreCase ? "i" : "");
 }
+var globCache = /* @__PURE__ */ new Map();
+function globRe(glob, ignoreCase = false) {
+  const key = `${ignoreCase ? "i" : "s"}:${glob}`;
+  let re = globCache.get(key);
+  if (!re) {
+    re = globToRegExp(glob, ignoreCase);
+    globCache.set(key, re);
+  }
+  return re;
+}
 function guardrailsConfigPath() {
   return process.env.ENIGMA_GUARDRAILS_CONFIG || join(homedir(), ".enigma-guardrails.json");
 }
@@ -1421,12 +1554,13 @@ function findProjectRoot(file) {
   }
   return null;
 }
-function checkFile(file, content, projectRoot) {
+function checkFile(file, content, projectRoot, stage = "edit", rules = loadRules()) {
   const norm = file.replace(/\\/g, "/");
   const out = [];
-  for (const rule of loadRules()) {
-    if (!rule.files.some((g) => globToRegExp(g, rule.ignoreFileCase).test(norm))) continue;
-    if (rule.excludeFiles?.some((g) => globToRegExp(g, rule.ignoreFileCase).test(norm))) continue;
+  for (const rule of rules) {
+    if (stage === "edit" && rule.stage === "diff") continue;
+    if (!rule.files.some((g) => globRe(g, rule.ignoreFileCase).test(norm))) continue;
+    if (rule.excludeFiles?.some((g) => globRe(g, rule.ignoreFileCase).test(norm))) continue;
     const base = { ruleId: rule.id, severity: rule.severity, file: norm, message: rule.message, skill: rule.skill };
     if (rule.scope === "file" && rule.maxBytes) {
       const bytes = Buffer.byteLength(content, "utf8");
@@ -1473,7 +1607,7 @@ function formatFindings(findings) {
     return `${tag} ${f.file}${loc} (${f.ruleId})${skill}: ${f.message}`;
   }).join("\n");
 }
-function checkPath(file) {
+function checkPath(file, stage = "edit") {
   let content;
   try {
     content = readFileSync(file, "utf8");
@@ -1481,7 +1615,7 @@ function checkPath(file) {
     return [];
   }
   if (content.includes("\0")) return [];
-  return checkFile(file, content, findProjectRoot(file));
+  return checkFile(file, content, findProjectRoot(file), stage);
 }
 function runGuardrailsHook(payload) {
   let file;
@@ -1496,9 +1630,12 @@ function runGuardrailsHook(payload) {
   if (fixed.length) process.stdout.write(`enigma guardrails (fixed)
 ${fixed.map((f) => `${f.file}:${f.line} (${f.ruleId})`).join("\n")}
 `);
+  recordFindings(fixed, "fixed");
   if (!findings.length) return 0;
   const warns = findings.filter((f) => f.severity === "warn");
   const blocks = findings.filter((f) => f.severity === "block");
+  recordFindings(warns, "warned");
+  recordFindings(blocks, "blocked");
   if (warns.length) process.stdout.write(`enigma guardrails (suggestions)
 ${formatFindings(warns)}
 `);
@@ -1511,6 +1648,97 @@ Fix the above before continuing.
   }
   return 0;
 }
+var LEDGER_MAX_BYTES = 512 * 1024;
+var LEDGER_KEEP = 2e3;
+function ledgerPath() {
+  return process.env.ENIGMA_GUARDRAILS_LOG || join(homedir(), ".enigma", "guardrail-log.jsonl");
+}
+function ledgerKey(rule, outcome, file, line) {
+  return JSON.stringify([rule, outcome, file, line ?? null]);
+}
+function recordedToday(day) {
+  const seen = /* @__PURE__ */ new Set();
+  eachLedgerEntry(1, (e) => {
+    if (e.at.slice(0, 10) === day) seen.add(ledgerKey(e.rule, e.outcome, e.file, e.line));
+  });
+  return seen;
+}
+function recordFindings(findings, outcome, stage = "edit") {
+  if (!findings.length) return;
+  const at = (/* @__PURE__ */ new Date()).toISOString();
+  const seen = stage === "diff" || outcome !== "blocked" ? recordedToday(at.slice(0, 10)) : null;
+  const rows = [];
+  for (const f of findings) {
+    if (seen) {
+      const key = ledgerKey(f.ruleId, outcome, f.file, f.line);
+      if (seen.has(key)) continue;
+      seen.add(key);
+    }
+    rows.push(JSON.stringify({ at, rule: f.ruleId, severity: f.severity, outcome, stage, file: f.file, line: f.line }));
+  }
+  if (!rows.length) return;
+  const path = ledgerPath();
+  try {
+    mkdirSync(dirname(path), { recursive: true });
+    let size = 0;
+    try {
+      size = statSync(path).size;
+    } catch {
+    }
+    if (size > LEDGER_MAX_BYTES) {
+      const kept = readFileSync(path, "utf8").split("\n").filter(Boolean).slice(-LEDGER_KEEP);
+      writeFileSync(path, `${kept.join("\n")}
+`);
+    }
+    appendFileSync(path, `${rows.join("\n")}
+`);
+  } catch {
+  }
+}
+function eachLedgerEntry(sinceDays, visit) {
+  let text;
+  try {
+    text = readFileSync(ledgerPath(), "utf8");
+  } catch {
+    return;
+  }
+  const cutoff = sinceDays > 0 ? Date.now() - sinceDays * 864e5 : 0;
+  for (const line of text.split("\n")) {
+    if (!line.trim()) continue;
+    try {
+      const entry = JSON.parse(line);
+      if (typeof entry?.rule !== "string") continue;
+      if (cutoff && Date.parse(entry.at) < cutoff) continue;
+      visit(entry);
+    } catch {
+    }
+  }
+}
+function readLedger(sinceDays = 0) {
+  const out = [];
+  eachLedgerEntry(sinceDays, (entry) => out.push(entry));
+  return out;
+}
+function countLedger(sinceDays = 0) {
+  let count = 0;
+  eachLedgerEntry(sinceDays, () => {
+    count++;
+  });
+  return count;
+}
+function summarizeLedger(entries) {
+  const by = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const row = by.get(e.rule) || { rule: e.rule, total: 0, blocked: 0, warned: 0, fixed: 0, last: e.at };
+    row.total++;
+    if (e.outcome === "blocked") row.blocked++;
+    else if (e.outcome === "warned") row.warned++;
+    else row.fixed++;
+    if (e.at > row.last) row.last = e.at;
+    by.set(e.rule, row);
+  }
+  return [...by.values()].sort((a, b) => b.total - a.total || a.rule.localeCompare(b.rule));
+}
 function gitFiles(all) {
   const out = execFileSync("git", all ? ["ls-files"] : ["diff", "--cached", "--name-only", "--diff-filter=ACM"], { encoding: "utf8", windowsHide: true });
   return out.split("\n").map((s) => s.trim()).filter(Boolean);
@@ -1570,6 +1798,7 @@ export {
   applyFixes,
   checkFile,
   checkPath,
+  countLedger,
   deepRelativeImports,
   extensionImports,
   findProjectRoot,
@@ -1577,8 +1806,13 @@ export {
   loadRules,
   missingPathAlias,
   missingWindowsHide,
+  readLedger,
+  recordFindings,
   runGuardrailsHook,
   runGuardrailsScan,
   runGuardrailsScanCli,
+  serverFirstMutation,
+  summarizeLedger,
+  textareaSizeBounds,
   wideNamedImports
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.33.7",
+  "version": "1.34.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {