enigma-cli 1.35.8 → 1.35.13

package/assets/registry/utils/registry.json

@@ -0,0 +1,109 @@
+{
+  "registry": "@enigmax/utils",
+  "version": 1,
+  "kind": "utility",
+  "items": [
+    {
+      "name": "cache",
+      "title": "Short-TTL read cache",
+      "description": "Read-through cache with in-flight deduplication, prefix invalidation and optional local/session persistence.",
+      "targets": [
+        "vanilla",
+        "astro",
+        "react"
+      ],
+      "entry": {
+        "vanilla": "@enigmax/utils",
+        "astro": "@enigmax/utils",
+        "react": "@enigmax/utils/react"
+      },
+      "exports": {
+        "vanilla": [
+          "createCache"
+        ],
+        "astro": [
+          "createCache"
+        ],
+        "react": [
+          "useCached"
+        ]
+      },
+      "files": [
+        {
+          "path": "src/core/cache.ts",
+          "dest": "cache/cache.ts",
+          "targets": [
+            "vanilla",
+            "astro",
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/use-cached.ts",
+          "dest": "cache/use-cached.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/cache": "./cache"
+          },
+          "main": true
+        }
+      ],
+      "styles": false,
+      "docs": "docs/notes/primitives.md#cache"
+    },
+    {
+      "name": "password-breach",
+      "title": "Breached-password check",
+      "description": "Ask Have I Been Pwned whether a password has leaked, without sending it anywhere: it is hashed in the browser and only the first five characters of that hash are sent, so the service never learns which password was looked up. Reports a count and throws what it cannot do - what a breach means is the form's decision.",
+      "targets": [
+        "vanilla",
+        "astro",
+        "react"
+      ],
+      "entry": {
+        "vanilla": "@enigmax/utils",
+        "astro": "@enigmax/utils",
+        "react": "@enigmax/utils"
+      },
+      "exports": {
+        "vanilla": [
+          "checkPasswordBreach"
+        ],
+        "astro": [
+          "checkPasswordBreach"
+        ],
+        "react": [
+          "checkPasswordBreach"
+        ]
+      },
+      "files": [
+        {
+          "path": "src/core/cache.ts",
+          "dest": "password-breach/cache.ts",
+          "targets": [
+            "vanilla",
+            "astro",
+            "react"
+          ]
+        },
+        {
+          "path": "src/core/password-breach.ts",
+          "dest": "password-breach/index.ts",
+          "main": true,
+          "targets": [
+            "vanilla",
+            "astro",
+            "react"
+          ],
+          "rewrite": {
+            "@/core/cache": "./cache"
+          }
+        }
+      ],
+      "styles": false,
+      "docs": "docs/notes/primitives.md#password-breach"
+    }
+  ]
+}

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "b35f0bb4a29f2346d9a1b00a4bfee9557a9b6a44116d9e6e59abcd945466dbcb"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules), including the generalization rule that treats a named example as a class to sweep and fix.",
   "updated": "2026-08-02T04:28:51+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "95091678d4e72e3a9b1ef3ad0514e503a2a631f0d134bf772b4a1b3c66881995"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -21,6 +21,13 @@ description: Frontend architecture - reusable components, abstraction thresholds
 
 ---
 
+## Headless Primitives Before Hand-Rolled Interaction
+
+- Interaction logic - looping/draggable rows, momentum, focus traps, virtualized lists, dismiss timers, read caches - is BEHAVIOR, and behavior that has already been measured and tested is a dependency, not a snippet to rewrite. Check the catalogue before writing it: `enigma add` lists it, `enigma add <name>` adds it as a dependency, `enigma add <name> --copy` vendors the source in when it must be edited.
+- These primitives ship NO visual styles. They apply only what the behavior requires (overflow, touch-action, user-select, will-change, transform) and publish their state as `data-*` attributes, so the look stays entirely yours.
+- Do not hand-roll one of them "just for this page". The hand-rolled version is where the measured bugs come back: a duration-driven marquee that accelerates as items are added, a `setPointerCapture` drag that silently stops every link in the row from opening, a hover slowdown that sticks forever after the first tap because touch never fires `pointerleave`.
+- If the catalogue has no primitive for what you need, write it as one (core + adapter + registry entry + test) rather than inline in a page, so the next screen reuses it instead of rewriting it.
+
 ## Component Reuse (Mandatory)
 
 - ALWAYS reuse a single base component and drive its behavior with props; NEVER create separate components for variants of the same element.

package/assets/skills/frontend-policy/skill.json

@@ -3,7 +3,7 @@
   "version": "1.30.1",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.35.8",
-  "sha": "54d8dcec18cf14a69617bbb919e61e329f72eaf0205f2034faef4ea31e9c7544"
+  "updated": "2026-08-13T18:04:26+02:00",
+  "cliVersion": "1.35.13",
+  "sha": "837f62ef43fa4ab46e7e74bb88dc6cb83e877f039565a80696e05345e28eb20d"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-08-04T20:04:42+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "f55f4ed5474d5c6e7fd0804d88ac38fb3c9c3cd863519645d1415c02f4416db7"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "3201b6d41437626eb7bf45648c0d7f8c419dc4de87fbd9d4ca83c5ae3b6b6edf"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.35.8",
+  "cliVersion": "1.35.13",
   "sha": "24928a4c9eed28ebede9f23f746b09a9d3d8176f8fcca61a7780a853fa5bed4e"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "f80c9e61502413425c345c9c47dba54d6e4f3643b29dd5adab2df4faa1862080",
-  "enigma-linux-arm64": "942ffce99f67dbc4c0891d8bcd11cc3d30651b377ed8a45091f2dcc3ee2e9376",
-  "enigma-linux-x64": "27826793783f56800fb48b01a81c1685e56c3f7762ee549ab140ac6a46dae08d",
-  "enigma-win32-x64.exe": "2e028371022a814c2812965b55f90e0165a4afa1ba9afa1f2e09d42ac06a26f2"
+  "enigma-darwin-arm64": "f117d39bb0bc4c83397200387e93b98f754afe392dccc3952b6eda3f7b8100d7",
+  "enigma-linux-arm64": "612d69fbf69e4c5b954c74e74e4cf848fa29fe6f59b040ed46629df1c629e5a0",
+  "enigma-linux-x64": "25b7cd9f1c28b4ed09946d1496446b17cc1a41c42154f4b3fd752c5af971e090",
+  "enigma-win32-x64.exe": "bc95cb8d5ec3dff23af0d845646e0b37b10bda2d3e9b29726440f78dccaa041f"
 }

package/dist/guardrails.js

@@ -141,6 +141,72 @@ var BUILTIN_RULES = [
   // idiomatic and has no detectable signature, and Rust's serde typed deserialization already
   // enforces shape - a rule for either would false-positive. The generic "validate every input"
   // principle for those languages lives in the always-on memory kernel instead.
+  {
+    id: "fe-marquee-duration",
+    label: "Looping row driven by a speed, not a duration",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.css", "*.scss", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "*.min.css",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    ignoreFileCase: true,
+    scope: "file",
+    // Only newly written code: a duration-driven marquee is common in existing
+    // pages, and the rule has to name the one being added, not the backlog.
+    stage: "diff",
+    // A duration named on the same line as the looping row it drives. Requiring
+    // both words keeps every unrelated animation-duration out of the match.
+    pattern: "(marquee|ticker|logo-?wall|infinite-?scroll)[^\\n]*(animation-duration|animationDuration|--duration)|(animation-duration|animationDuration|--duration)[^\\n]*(marquee|ticker|logo-?wall|infinite-?scroll)",
+    absent: "px/s|pixels per second|pixelsPerSecond|\\bspeed\\b|@enigmax/primitives|useMarquee|createMarquee|enigma:allow-marquee-duration",
+    message: "Looping row driven by a duration. A lap is as long as its content, so the speed becomes content/duration and the row runs faster every time an item is added - measured at 45, 67 and 87 px/s for one rail at 10, 15 and 20 items. Take a speed in px/s and derive the duration, or use the primitive that already does: `enigma add marquee` (@enigmax/primitives), which also measures the lap from the DOM instead of computing it. Mark the line `enigma:allow-marquee-duration` when the duration is genuinely the contract.",
+    severity: "warn",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-pointer-capture-drag",
+    label: "Drag bound to window, not setPointerCapture",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    pattern: "\\.setPointerCapture\\s*\\(",
+    absent: "enigma:allow-pointer-capture",
+    message: "setPointerCapture retargets the compatibility mouse events too, so a plain click on a descendant arrives on the capturing element and the descendant's link never opens - a row of nine logo links quietly stops being nine links and nothing in the source looks wrong. Bind pointermove/pointerup/pointercancel to `window` instead, which is all the capture was for: a mousedown already captures the mouse at the OS level, so a release outside the window still arrives. Fine when the element has no interactive descendants (a slider thumb, a resize handle) - mark it `enigma:allow-pointer-capture` there (frontend-policy).",
+    severity: "warn",
+    skill: "frontend-policy"
+  },
   {
     id: "fe-password-input",
     label: "Reusable password input (show/hide)",
@@ -263,6 +329,133 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "validation-policy"
   },
+  {
+    id: "fe-password-reveal-hand-rolled",
+    label: "Password reveal toggled by hand",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    // The ternary that switches a field's type, in either order. Precise enough that
+    // it does not fire on anything else that mentions both words.
+    pattern: `["']password["']\\s*:\\s*["']text["']|["']text["']\\s*:\\s*["']password["']`,
+    absent: "@enigmax/primitives|useInput|createInput|<Input|enigma:allow-password-toggle",
+    message: 'A password reveal written by hand. Three things go wrong here and each has been measured: a `<button>` with no `type="button"` defaults to submit, so looking at your password posts the half-filled form; pressing the button pulls focus out of the field unless `mousedown` is prevented; and assigning `input.type` inside a click handler resets the caret to 0 in Chromium ONE MACROTASK later, so a restore that runs inline silently loses. `enigma add input` (@enigmax/primitives) is that behaviour with a test for each, and brings the generator, the strength meter and the breach check as props you can leave off. Mark the line `enigma:allow-password-toggle` to keep your own.',
+    severity: "warn",
+    skill: "frontend-policy"
+  },
+  {
+    id: "sec-generated-secret-math-random",
+    label: "A secret generated from Math.random",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.mjs", "*.cjs", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // Both orders on one line: the word that says what is being made, and the call
+    // that makes it predictable.
+    pattern: "(?:password|passphrase|secret|token|otp|api[_-]?key|recovery[_-]?code|session[_-]?id)[^\\n]{0,80}Math\\.random|Math\\.random[^\\n]{0,80}(?:password|passphrase|secret|token|otp|api[_-]?key|recovery[_-]?code|session[_-]?id)",
+    absent: "getRandomValues|randomBytes|randomUUID|enigma:allow-insecure-random",
+    message: "A secret built from Math.random. It is a fast PRNG, not a CSPRNG: its state is recoverable from a handful of outputs, so anyone who sees one generated value can predict the next. Use `crypto.getRandomValues` in a browser or `crypto.randomBytes` in Node, and draw each index by REJECTION rather than `% alphabet.length`, which is biased because 2^32 is not a multiple of most alphabet sizes. `enigma add input` (@enigmax/primitives) exports `generatePassword` doing both, and throwing rather than falling back when no CSPRNG is available - a generator that quietly produces predictable secrets is worse than one that refuses, because nothing downstream can tell the difference. Mark the line `enigma:allow-insecure-random` where the value is genuinely not a secret.",
+    severity: "block",
+    skill: "security-policy"
+  },
+  {
+    id: "fe-clipboard-fallback-unchecked",
+    label: "Copy fallback whose result is thrown away",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.mjs", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    // A bare statement: the call is not assigned, returned, or tested. execCommand
+    // returns a boolean saying whether the copy happened, and this shape discards it.
+    pattern: `^[\\t ]*document\\.execCommand\\(["']copy["']\\)\\s*;`,
+    absent: "enigma:allow-unchecked-copy",
+    message: 'The clipboard fallback\'s result is discarded. `document.execCommand("copy")` RETURNS whether the copy happened - it fails silently under a clipboard-guard extension, in a cross-origin frame, and without a user gesture - so a button that flashes a tick after calling it is telling the reader something it never checked, and they find out on paste. Test the return value and show the confirmation only when it is true. While you are there: give the scratch textarea `position: fixed` and `opacity: 0`, because appending a visible one scrolls the page to the bottom on every copy. Mark the line `enigma:allow-unchecked-copy` where the outcome genuinely does not matter (frontend-policy).',
+    severity: "warn",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-relative-time-hand-rolled",
+    label: "Relative time computed by hand",
+    files: ["*.ts", "*.tsx", "*.js", "*.jsx", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    // A millisecond difference divided into units - the shape every hand-rolled
+    // "3 hours ago" has, and one a real formatter never needs.
+    pattern: "(?:Date\\.now\\(\\)|getTime\\(\\))[^\\n]{0,60}-[^\\n]{0,60}\\/\\s*(?:1000|60000|3600000|86400000|1000\\s*\\*)",
+    absent: "@enigmax/utils|RelativeTime|relativeTimeView|relative-time-element|Intl\\.RelativeTimeFormat|date-fns|dayjs|luxon|moment|enigma:allow-manual-relative-time",
+    message: '"3 hours ago" computed from a millisecond difference. Three things this misses: it is English-only, where `Intl.RelativeTimeFormat` speaks the reader\'s language; it renders once and then goes stale, so a page left open says "3 hours ago" tomorrow; and a timestamp with no zone (`2026-08-13 22:41:00` out of a date column) is read as LOCAL time by `new Date()`, which puts every reader away from the server hours out - silently, because a wrong time is still a valid one. `enigma add relative-time` (@enigmax/utils) handles all three and renders the absolute date as a fallback, so a server render and a reader without JavaScript still see a real date. Mark the line `enigma:allow-manual-relative-time` when the arithmetic is the point.',
+    severity: "warn",
+    skill: "frontend-policy"
+  },
   {
     id: "sec-password-breach-check",
     label: "A new password is checked against the breach corpus",
@@ -294,7 +487,7 @@ var BUILTIN_RULES = [
     // it, including a call into a shared hook whose name carries `pwned`/`breach`.
     pattern: `autocomplete=\\{?["']new-password["']`,
     absent: "pwnedpasswords|haveibeenpwned|hibp|pwned|breach|enigma:allow-no-breach-check",
-    message: "A password is created here with no breach check. Length and symbol rules do not stop a password that is already in a credential-stuffing list. Check it against Have I Been Pwned's Pwned Passwords range API - free, no key, and the password never leaves the client: SHA-1 it, uppercase the hex, GET https://api.pwnedpasswords.com/range/<first 5 chars> with `Add-Padding: true`, and look for the remaining 35 characters in the `SUFFIX:COUNT` lines. Debounce it as the user types, abort the in-flight request when the value changes, repeat the check server-side on submit, and fail OPEN if the lookup errors so an outage never blocks a signup. For a flow that genuinely cannot reach it, add an `enigma:allow-no-breach-check` note (security-policy).",
+    message: "A password is created here with no breach check. Length and symbol rules do not stop a password that is already in a credential-stuffing list. Check it against Have I Been Pwned's Pwned Passwords range API - free, no key, and the password never leaves the client: SHA-1 it, uppercase the hex, GET https://api.pwnedpasswords.com/range/<first 5 chars> with `Add-Padding: true`, and look for the remaining 35 characters in the `SUFFIX:COUNT` lines. `enigma add password-breach` (@enigmax/utils) is exactly that call, with the padding header, the decoy entries rejected and the range responses cached. Debounce it as the user types, abort the in-flight request when the value changes, repeat the check server-side on submit, and fail OPEN if the lookup errors so an outage never blocks a signup. For a flow that genuinely cannot reach it, add an `enigma:allow-no-breach-check` note (security-policy).",
     severity: "block",
     skill: "security-policy"
   },
@@ -334,7 +527,7 @@ var BUILTIN_RULES = [
     // of an equality/containment operator.
     pattern: `autocomplete=\\{?["']new-password["']`,
     absent: "userInputs|user_inputs|UserAttributeSimilarity|sameAs(?:Email|Username|Identity)|matchesIdentity|containsIdentity|identityMatch|notIdentity|personalInfo|(?:password|passwd|pwd)[^\\n]{0,60}(?:===|==|!==|\\.includes\\(|\\.indexOf\\(|\\.startsWith\\(|localeCompare)[^\\n]{0,60}(?:email|username|user_?name|handle)|(?:email|username|user_?name|handle)[^\\n]{0,60}(?:===|==|!==|\\.includes\\(|\\.indexOf\\(|\\.startsWith\\(|localeCompare)[^\\n]{0,60}(?:password|passwd|pwd)|enigma:allow-identity-password",
-    message: "A password is created here with nothing stopping it from being the account's own identity. `Fjrg2007` for the user `fjrg2007` is one guess for anyone who knows the email address. Refuse a candidate that equals, contains (4 characters or more), or closely resembles the email, its local part, the username, the display name or the site name - comparing NORMALIZED values on both sides (lowercase, trim, NFKD then strip accents, drop everything that is not a letter or a digit), so `F.J.R.G_2007` and `fjrg2007` are the same string and casing is never a difference. Declare it on the OBJECT schema, since a password field cannot see the email beside it, and run it again on the server where the real identity lives. A strength meter fed `userInputs` scores this badly but is advisory - keep the refusal as its own rule. For a flow with no identity to compare against, add an `enigma:allow-identity-password` note (security-policy, validation-policy).",
+    message: "A password is created here with nothing stopping it from being the account's own identity. `Fjrg2007` for the user `fjrg2007` is one guess for anyone who knows the email address. Refuse a candidate that equals, contains (4 characters or more), or closely resembles the email, its local part, the username, the display name or the site name - comparing NORMALIZED values on both sides (lowercase, trim, NFKD then strip accents, drop everything that is not a letter or a digit), so `F.J.R.G_2007` and `fjrg2007` are the same string and casing is never a difference. Declare it on the OBJECT schema, since a password field cannot see the email beside it, and run it again on the server where the real identity lives. A strength meter fed `userInputs` scores this badly but is advisory - keep the refusal as its own rule; `enigma add input` (@enigmax/primitives) takes `strength={{ userInputs }}` and reports it. For a flow with no identity to compare against, add an `enigma:allow-identity-password` note (security-policy, validation-policy).",
     severity: "block",
     skill: "security-policy"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.35.8",
+  "version": "1.35.13",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {