enigma-cli 1.35.8 → 1.35.10

package/README.md

@@ -2,7 +2,7 @@
 
 Everything you need to work with a coding agent, in one command. `enigma`
 installs a shared set of engineering **policy skills** into the agents you
-actually use (Claude Code, OpenAI Codex, opencode) and sets up portable **git
+actually use (Claude Code, OpenAI Codex, opencode, Kimi Code) and sets up portable **git
 security hooks** that block secrets, `.env` files, and dependency dirs from being
 committed.
 
@@ -47,7 +47,7 @@ the [GitHub CLI](https://cli.github.com), [Bun](https://bun.sh) and [Warp](https
 |--|--|
 | <a href="https://nodejs.org"><img src="https://img.shields.io/badge/Node.js-339933?style=for-the-badge&logo=nodedotjs&logoColor=white" alt="Node.js"/></a> | `>= 18`, ships with `npm` - installs and runs the `enigma` CLI |
 | <a href="https://git-scm.com"><img src="https://img.shields.io/badge/Git-F05032?style=for-the-badge&logo=git&logoColor=white" alt="Git"/></a> | powers the security hooks and the commit guard |
-| <img src="https://img.shields.io/badge/Coding%20agent-555555?style=for-the-badge&logo=claude&logoColor=white" alt="Coding agent"/> | at least one of [Claude Code](https://claude.com/claude-code), [OpenAI Codex](https://github.com/openai/codex) or [opencode](https://opencode.ai) - the skills need a home |
+| <img src="https://img.shields.io/badge/Coding%20agent-555555?style=for-the-badge&logo=claude&logoColor=white" alt="Coding agent"/> | at least one of [Claude Code](https://claude.com/claude-code), [OpenAI Codex](https://github.com/openai/codex), [opencode](https://opencode.ai) or [Kimi Code](https://www.kimi.com/code) - the skills need a home |
 
 ### Recommended
 
@@ -73,7 +73,7 @@ enigma guard [--all]   Run the commit guard: staged files, --all for all tracked
                        CI). --json emits one document; exits 1 on findings, 2 if it
                        could not run at all
 enigma config [k v]    Show or set runtime toggles (e.g. config commit-emoji off)
-enigma <tool> [acct]   Launch claude | codex | opencode with an account
+enigma <tool> [acct]   Launch claude | codex | opencode | kimi with an account
                        (resolution: explicit > active profile > tool active);
                        auto-syncs deployed skills first
 enigma account ...     Manage per-tool accounts (list/add/use/login/remove)
@@ -128,7 +128,7 @@ push,pr,ci` and `enigma gate init` work in an image without it.
 
 Skills are authored once and deployed to every selected agent (no per-agent
 duplication). `enigma install` auto-detects which agents are installed (CLI on
-`PATH` or a config dir like `~/.claude`, `~/.codex`, `~/.config/opencode`) and
+`PATH` or a config dir like `~/.claude`, `~/.codex`, `~/.config/opencode`, `~/.kimi-code`) and
 preselects them; `--all` targets every supported agent.
 
 | Agent       | Scope  | Skills                        | Memory file                    |
@@ -309,9 +309,10 @@ your **company** Claude Code account and your **personal** one - keeping each
 fully isolated and switching between them without ever logging out. Each account
 has its own credentials, session, and history, so client work never mixes with
 personal projects. Supported tools: **Claude Code** (`CLAUDE_CONFIG_DIR`),
-**OpenAI Codex** (`CODEX_HOME`) and **OpenCode** (a private `XDG_DATA_HOME` /
+**OpenAI Codex** (`CODEX_HOME`), **OpenCode** (a private `XDG_DATA_HOME` /
 `XDG_CONFIG_HOME` pair per managed account; its default account keeps your real
-environment untouched).
+environment untouched) and **Kimi Code** (`KIMI_CODE_HOME`, which relocates its
+whole data root - credentials, sessions, skills and `AGENTS.md`).
 
 > This is for legitimate, professional account separation (one account per
 > employer/context, as many organizations require). It is **not** a way to evade
@@ -338,9 +339,9 @@ enigma account rename work corp   # rename an account (its config dir moves)
 enigma account remove work        # delete an account and its config dir
 ```
 
-Your existing `~/.claude` / `~/.codex` / opencode setup is always available as
+Your existing `~/.claude` / `~/.codex` / `~/.kimi-code` / opencode setup is always available as
 each tool's built-in `default` account (never deleted). New accounts live under
-`~/.enigma/<tool>/<name>/`. Bare `claude` / `codex` / `opencode` commands keep
+`~/.enigma/<tool>/<name>/`. Bare `claude` / `codex` / `opencode` / `kimi` commands keep
 using your real environment as before.
 
 Managed accounts inherit your enigma setup automatically: because the tool reads
@@ -372,7 +373,7 @@ enigma profile use none                 # deactivate
 
 From the hub TUI (`enigma`), the **Accounts** panel lists every tool's accounts -
 with the signed-in identity (email for Claude/Codex, connected providers for
-OpenCode) - and lets you **add** (`a`), set active (`enter`), **connect**/log in
+OpenCode and Kimi Code) - and lets you **add** (`a`), set active (`enter`), **connect**/log in
 (`c`), rename (`r`), or remove (`d`). Adding first asks **which tool** with a
 searchable selector (type to filter, like opencode's model picker), then the
 account name, then offers to connect right away. The **Profiles** panel manages
@@ -647,7 +648,7 @@ session transcripts (`~/.claude/projects/.../*.jsonl`) and reports:
 - **Breakdowns** by model, by project, **by account** (every Claude login - default and
   managed accounts, not just `~/.claude`), and a **recent sessions** table.
 - A **provider coverage** line: only Claude Code keeps a readable local usage store, so
-  Codex and OpenCode are shown as unavailable (no local token store) rather than faked. The
+  Codex, OpenCode and Kimi Code are shown as unavailable (no local token store) rather than faked. The
   session/weekly windows are Claude-specific (they come from Anthropic's rate-limit headers).
 - A **current 5-hour block** computed locally from transcript timestamps: tokens + cost
   used in the open window, the **burn rate** (tokens/min) and a projected end-of-window
@@ -672,7 +673,7 @@ Honesty note: cost is an **estimate** (Anthropic does not record per-message cos
 transcript; real spend is billed by Anthropic). Token counts and prompt-cache reads are
 measured facts. enigma deliberately does **not** attribute savings to skills or to
 token-efficient output - a transcript has no counterfactual baseline, so any such figure
-would be invented. Only Claude Code is read today; Codex/OpenCode use absent or
+would be invented. Only Claude Code is read today; Codex/OpenCode/Kimi Code use absent or
 undocumented local session stores and are not guessed.
 
 #### Manage accounts & profiles from the dashboard

package/assets/registry/primitives/registry.json

@@ -0,0 +1,46 @@
+{
+  "registry": "@enigmax/primitives",
+  "version": 1,
+  "kind": "primitive",
+  "items": [
+    {
+      "name": "marquee",
+      "title": "Draggable infinite marquee",
+      "description": "Looping row that takes a speed in px/s, measures its own lap, and can be grabbed and thrown without swallowing the clicks on its items.",
+      "targets": ["vanilla", "astro", "react"],
+      "entry": {
+        "vanilla": "@enigmax/primitives",
+        "astro": "@enigmax/primitives",
+        "react": "@enigmax/primitives/react"
+      },
+      "exports": {
+        "vanilla": ["createMarquee"],
+        "astro": ["createMarquee"],
+        "react": ["useMarquee"]
+      },
+      "files": [
+        {
+          "path": "src/core/marquee.ts",
+          "dest": "marquee.ts",
+          "targets": ["vanilla", "astro", "react"]
+        },
+        {
+          "path": "src/react/use-marquee.ts",
+          "dest": "use-marquee.ts",
+          "targets": ["react"],
+          "rewrite": { "@/core/marquee": "./marquee" }
+        }
+      ],
+      "styles": false,
+      "themeHooks": [
+        "[data-enigma-marquee]",
+        "[data-enigma-marquee][data-dragging]",
+        "[data-enigma-marquee][data-hovering]",
+        "[data-enigma-marquee][data-reduced-motion=true]",
+        "[data-enigma-marquee-track]",
+        "[data-enigma-marquee-copy]"
+      ],
+      "docs": "docs/notes/primitives.md#marquee"
+    }
+  ]
+}

package/assets/registry/utils/registry.json

@@ -0,0 +1,69 @@
+{
+  "registry": "@enigmax/utils",
+  "version": 1,
+  "kind": "utility",
+  "items": [
+    {
+      "name": "cache",
+      "title": "Short-TTL read cache",
+      "description": "Read-through cache with in-flight deduplication, prefix invalidation and optional local/session persistence.",
+      "targets": ["vanilla", "astro", "react"],
+      "entry": {
+        "vanilla": "@enigmax/utils",
+        "astro": "@enigmax/utils",
+        "react": "@enigmax/utils/react"
+      },
+      "exports": {
+        "vanilla": ["createCache"],
+        "astro": ["createCache"],
+        "react": ["useCached"]
+      },
+      "files": [
+        {
+          "path": "src/core/cache.ts",
+          "dest": "cache.ts",
+          "targets": ["vanilla", "astro", "react"]
+        },
+        {
+          "path": "src/react/use-cached.ts",
+          "dest": "use-cached.ts",
+          "targets": ["react"],
+          "rewrite": { "@/core/cache": "./cache" }
+        }
+      ],
+      "styles": false,
+      "docs": "docs/notes/primitives.md#cache"
+    },
+    {
+      "name": "notifications",
+      "title": "Notification queue",
+      "description": "Ordering, dedupe by key, sticky errors and dismiss timers that hold instead of running while the tab is hidden. No rendering.",
+      "targets": ["vanilla", "astro", "react"],
+      "entry": {
+        "vanilla": "@enigmax/utils",
+        "astro": "@enigmax/utils",
+        "react": "@enigmax/utils/react"
+      },
+      "exports": {
+        "vanilla": ["createNotifications"],
+        "astro": ["createNotifications"],
+        "react": ["useNotifications"]
+      },
+      "files": [
+        {
+          "path": "src/core/notifications.ts",
+          "dest": "notifications.ts",
+          "targets": ["vanilla", "astro", "react"]
+        },
+        {
+          "path": "src/react/use-notifications.ts",
+          "dest": "use-notifications.ts",
+          "targets": ["react"],
+          "rewrite": { "@/core/notifications": "./notifications" }
+        }
+      ],
+      "styles": false,
+      "docs": "docs/notes/primitives.md#notifications"
+    }
+  ]
+}

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "b35f0bb4a29f2346d9a1b00a4bfee9557a9b6a44116d9e6e59abcd945466dbcb"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules), including the generalization rule that treats a named example as a class to sweep and fix.",
   "updated": "2026-08-02T04:28:51+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "95091678d4e72e3a9b1ef3ad0514e503a2a631f0d134bf772b4a1b3c66881995"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -21,6 +21,13 @@ description: Frontend architecture - reusable components, abstraction thresholds
 
 ---
 
+## Headless Primitives Before Hand-Rolled Interaction
+
+- Interaction logic - looping/draggable rows, momentum, focus traps, virtualized lists, dismiss timers, read caches - is BEHAVIOR, and behavior that has already been measured and tested is a dependency, not a snippet to rewrite. Check the catalogue before writing it: `enigma add` lists it, `enigma add <name>` adds it as a dependency, `enigma add <name> --copy` vendors the source in when it must be edited.
+- These primitives ship NO visual styles. They apply only what the behavior requires (overflow, touch-action, user-select, will-change, transform) and publish their state as `data-*` attributes, so the look stays entirely yours.
+- Do not hand-roll one of them "just for this page". The hand-rolled version is where the measured bugs come back: a duration-driven marquee that accelerates as items are added, a `setPointerCapture` drag that silently stops every link in the row from opening, a hover slowdown that sticks forever after the first tap because touch never fires `pointerleave`.
+- If the catalogue has no primitive for what you need, write it as one (core + adapter + registry entry + test) rather than inline in a page, so the next screen reuses it instead of rewriting it.
+
 ## Component Reuse (Mandatory)
 
 - ALWAYS reuse a single base component and drive its behavior with props; NEVER create separate components for variants of the same element.

package/assets/skills/frontend-policy/skill.json

@@ -3,7 +3,7 @@
   "version": "1.30.1",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.35.8",
-  "sha": "54d8dcec18cf14a69617bbb919e61e329f72eaf0205f2034faef4ea31e9c7544"
+  "updated": "2026-08-13T18:04:26+02:00",
+  "cliVersion": "1.35.10",
+  "sha": "837f62ef43fa4ab46e7e74bb88dc6cb83e877f039565a80696e05345e28eb20d"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-08-04T20:04:42+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "f55f4ed5474d5c6e7fd0804d88ac38fb3c9c3cd863519645d1415c02f4416db7"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "3201b6d41437626eb7bf45648c0d7f8c419dc4de87fbd9d4ca83c5ae3b6b6edf"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.10",
   "sha": "24928a4c9eed28ebede9f23f746b09a9d3d8176f8fcca61a7780a853fa5bed4e"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "f80c9e61502413425c345c9c47dba54d6e4f3643b29dd5adab2df4faa1862080",
-  "enigma-linux-arm64": "942ffce99f67dbc4c0891d8bcd11cc3d30651b377ed8a45091f2dcc3ee2e9376",
-  "enigma-linux-x64": "27826793783f56800fb48b01a81c1685e56c3f7762ee549ab140ac6a46dae08d",
-  "enigma-win32-x64.exe": "2e028371022a814c2812965b55f90e0165a4afa1ba9afa1f2e09d42ac06a26f2"
+  "enigma-darwin-arm64": "728e35d28b2e8726b1db2994b17157c39c5caa370dd83c2848f58ca3c4a6d99c",
+  "enigma-linux-arm64": "494ceda44c8cb913384dba6c38738aeba43662ce4a1a7128925539f26af81690",
+  "enigma-linux-x64": "40bfdc690fd443d48d1657799b67e17ec5e704159cd48a19f3a0aa9767d06091",
+  "enigma-win32-x64.exe": "e9538f2f23c8e777cc2d55e472c99a6c5f9a173028ebe2341e89ede68ff78803"
 }

package/dist/guardrails.js

@@ -141,6 +141,72 @@ var BUILTIN_RULES = [
   // idiomatic and has no detectable signature, and Rust's serde typed deserialization already
   // enforces shape - a rule for either would false-positive. The generic "validate every input"
   // principle for those languages lives in the always-on memory kernel instead.
+  {
+    id: "fe-marquee-duration",
+    label: "Looping row driven by a speed, not a duration",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.css", "*.scss", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "*.min.css",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    ignoreFileCase: true,
+    scope: "file",
+    // Only newly written code: a duration-driven marquee is common in existing
+    // pages, and the rule has to name the one being added, not the backlog.
+    stage: "diff",
+    // A duration named on the same line as the looping row it drives. Requiring
+    // both words keeps every unrelated animation-duration out of the match.
+    pattern: "(marquee|ticker|logo-?wall|infinite-?scroll)[^\\n]*(animation-duration|animationDuration|--duration)|(animation-duration|animationDuration|--duration)[^\\n]*(marquee|ticker|logo-?wall|infinite-?scroll)",
+    absent: "px/s|pixels per second|pixelsPerSecond|\\bspeed\\b|@enigmax/primitives|useMarquee|createMarquee|enigma:allow-marquee-duration",
+    message: "Looping row driven by a duration. A lap is as long as its content, so the speed becomes content/duration and the row runs faster every time an item is added - measured at 45, 67 and 87 px/s for one rail at 10, 15 and 20 items. Take a speed in px/s and derive the duration, or use the primitive that already does: `enigma add marquee` (@enigmax/primitives), which also measures the lap from the DOM instead of computing it. Mark the line `enigma:allow-marquee-duration` when the duration is genuinely the contract.",
+    severity: "warn",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-pointer-capture-drag",
+    label: "Drag bound to window, not setPointerCapture",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    pattern: "\\.setPointerCapture\\s*\\(",
+    absent: "enigma:allow-pointer-capture",
+    message: "setPointerCapture retargets the compatibility mouse events too, so a plain click on a descendant arrives on the capturing element and the descendant's link never opens - a row of nine logo links quietly stops being nine links and nothing in the source looks wrong. Bind pointermove/pointerup/pointercancel to `window` instead, which is all the capture was for: a mousedown already captures the mouse at the OS level, so a release outside the window still arrives. Fine when the element has no interactive descendants (a slider thumb, a resize handle) - mark it `enigma:allow-pointer-capture` there (frontend-policy).",
+    severity: "warn",
+    skill: "frontend-policy"
+  },
   {
     id: "fe-password-input",
     label: "Reusable password input (show/hide)",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.35.8",
+  "version": "1.35.10",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {