enigma-cli 1.36.1 → 1.36.3

package/README.md

@@ -334,7 +334,7 @@ enigma claude work                # run Claude Code as 'work'
 enigma codex acme                 # run Codex as 'acme'
 enigma account use personal       # make 'personal' the active account
 enigma claude                     # run the resolved account (profile > active)
-enigma claude work -- --version   # forward args after -- to the tool
+enigma claude work --resume <id>  # flags after the tool go to the tool
 enigma account rename work corp   # rename an account (its config dir moves)
 enigma account remove work        # delete an account and its config dir
 ```

package/assets/memory/AGENTS.md

@@ -27,8 +27,9 @@
 - Respond in the user's language; write all code, comments, identifiers, and documentation in English.
 - No emojis in responses, code, or docs. Use ASCII punctuation: "-" not the long dash, "->" not the arrow. The sole exception is the commit-subject type emoji from git-policy (default on; disable with `enigma config commit-emoji off`).
 - Treat all external input as untrusted; never expose secrets or hardcode credentials.
-- When removing leaked or sensitive data the user asked to delete, the remediation commit/PR/branch must NOT name the leaked values or flag the security motive (that signposts where to look and re-leaks the values permanently) - use a neutral, mundane message and the `🔒 security` type is forbidden for it; offer history-rewrite vs. discreet-removal first. This carve-out is ONLY for that case; every other commit stays normal and descriptive (see git-policy).
+- Remediating leaked data the user asked to delete: the commit/PR/branch must NOT name the values or flag the security motive (that signposts where to look and re-leaks them permanently) - neutral, mundane message, `🔒 security` type forbidden; offer history-rewrite vs. discreet-removal first. ONLY that case; every other commit stays normal and descriptive (see git-policy).
 - A value you cannot source is not a value you may write. An email, a version, an id, a URL, a price, a name, a field of an API - if it did not come from the user, the code, a command you ran, or a document you read, you do not have it: ask for it, or leave it out and say which. A well-formed guess is the dangerous kind, because it reads as fact and nobody re-checks it. Fixture and mock data is the exception, and it has to look like fixture data.
+- The mirror rule: a value you WERE given is permission to use it, never to publish it - a domain, host, IP, a path with your OS account name, or an email ships as a placeholder unless the user asked for that exact value.
 - Reuse existing code before writing new code; do not duplicate logic.
 - End files with exactly one trailing newline and no trailing whitespace.
 - When editing existing code, match its established style instead of imposing a different one.
@@ -290,10 +291,6 @@ When documentation is unclear:
 
 # Security Rules
 
-- Treat all external input as untrusted.
-- Never expose secrets.
-- Never hardcode credentials.
-- Validate all tool inputs.
 - Restrict permissions using least privilege principles.
 - Sandbox dangerous execution paths whenever possible.
 
@@ -332,7 +329,6 @@ Never:
 - Assume undocumented behavior
 - Overengineer simple systems
 - Mix unrelated responsibilities
-- Duplicate business logic
 - Store unnecessary derived data
 - Introduce hidden magic behavior
 - Create tightly coupled agent systems

package/assets/memory/CLAUDE.md

@@ -27,8 +27,9 @@
 - Respond in the user's language; write all code, comments, identifiers, and documentation in English.
 - No emojis in responses, code, or docs. Use ASCII punctuation: "-" not the long dash, "->" not the arrow. The sole exception is the commit-subject type emoji from git-policy (default on; disable with `enigma config commit-emoji off`).
 - Treat all external input as untrusted; never expose secrets or hardcode credentials.
-- When removing leaked or sensitive data the user asked to delete, the remediation commit/PR/branch must NOT name the leaked values or flag the security motive (that signposts where to look and re-leaks the values permanently) - use a neutral, mundane message and the `🔒 security` type is forbidden for it; offer history-rewrite vs. discreet-removal first. This carve-out is ONLY for that case; every other commit stays normal and descriptive (see git-policy).
+- Remediating leaked data the user asked to delete: the commit/PR/branch must NOT name the values or flag the security motive (that signposts where to look and re-leaks them permanently) - neutral, mundane message, `🔒 security` type forbidden; offer history-rewrite vs. discreet-removal first. ONLY that case; every other commit stays normal and descriptive (see git-policy).
 - A value you cannot source is not a value you may write. An email, a version, an id, a URL, a price, a name, a field of an API - if it did not come from the user, the code, a command you ran, or a document you read, you do not have it: ask for it, or leave it out and say which. A well-formed guess is the dangerous kind, because it reads as fact and nobody re-checks it. Fixture and mock data is the exception, and it has to look like fixture data.
+- The mirror rule: a value you WERE given is permission to use it, never to publish it - a domain, host, IP, a path with your OS account name, or an email ships as a placeholder unless the user asked for that exact value.
 - Reuse existing code before writing new code; do not duplicate logic.
 - End files with exactly one trailing newline and no trailing whitespace.
 - When editing existing code, match its established style instead of imposing a different one.
@@ -290,10 +291,6 @@ When documentation is unclear:
 
 # Security Rules
 
-- Treat all external input as untrusted.
-- Never expose secrets.
-- Never hardcode credentials.
-- Validate all tool inputs.
 - Restrict permissions using least privilege principles.
 - Sandbox dangerous execution paths whenever possible.
 
@@ -332,7 +329,6 @@ Never:
 - Assume undocumented behavior
 - Overengineer simple systems
 - Mix unrelated responsibilities
-- Duplicate business logic
 - Store unnecessary derived data
 - Introduce hidden magic behavior
 - Create tightly coupled agent systems

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/SKILL.md

@@ -27,7 +27,7 @@ Before declaring a change complete, verify:
 1. The change does exactly what was asked - no more, no less.
 2. The full diff was re-read; no debug code, stray logs, commented-out blocks, or TODOs left behind.
 3. Only relevant files are touched; unrelated changes are removed.
-4. No secrets, credentials, or sensitive data are included.
+4. No secrets, credentials, or sensitive data are included - and no operator-environment values either (deployment domains and URLs, host names, IPs, absolute local paths with the OS username, personal emails), in the code, docs, fixtures, commit message, or PR text (per security-policy and git-policy).
 5. Existing patterns, naming, and structure are followed (per core-engineering-policy).
 6. Tests exist and pass for the changed behavior (per testing-policy).
 7. The change covers the whole class the request implied, not only the example the user named (per core-engineering-policy's Generalization Rule) - or states which siblings were deliberately left and why.
@@ -38,7 +38,7 @@ Before declaring a change complete, verify:
 
 Evaluate every change across these dimensions, in priority order:
 
-1. Security: untrusted input, injection, authz/authn, secret exposure, least privilege.
+1. Security: untrusted input, injection, authz/authn, secret and operator-environment exposure, least privilege.
 2. Correctness: logic, edge cases, error/failure paths, concurrency, off-by-one, null handling.
 3. Data integrity: transactions, consistency, and the database-expert rules when persistence is involved.
 4. Reuse & architecture: duplication, single responsibility, fit with existing modules.

package/assets/skills/code-review-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "code-review-policy",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
-  "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.36.1",
-  "sha": "b35f0bb4a29f2346d9a1b00a4bfee9557a9b6a44116d9e6e59abcd945466dbcb"
+  "updated": "2026-08-19T12:37:59+02:00",
+  "cliVersion": "1.36.3",
+  "sha": "6b8a924cc11b61d4b45b73384aeb095ce622229359b7cc2c6ce4bb0cf3015ed7"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -7,6 +7,6 @@
     "codeGraph"
   ],
   "updated": "2026-08-15T20:49:24+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "95b7202e5659f8d9d6f11ce29e7dc5b01575ba86c78ef948bec4753ccf430155"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
   "updated": "2026-08-13T18:04:26+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "837f62ef43fa4ab46e7e74bb88dc6cb83e877f039565a80696e05345e28eb20d"
 }

package/assets/skills/git-policy/SKILL.md

@@ -128,6 +128,42 @@ When the user asks for a human co-author, the trailer is `Co-authored-by: Name <
 
 ---
 
+## Public Surface Hygiene (Never Publish the Operator's Environment)
+
+A commit message, a branch name, a PR title, body, or comment, and a reviewer note are
+permanent, public, and indexed. Treat everything you write there - and everything the diff
+itself carries - as readable by anyone, forever.
+
+Unless the user explicitly asked for that exact value to be published, none of this belongs
+in a commit, branch, PR, or the code and docs the change adds:
+
+- Deployment domains, subdomains, URLs, host names, server IPs, ports, or the name of the
+  machine something runs on.
+- Absolute local paths that expose an account or a machine (`C:\Users\<name>\...`,
+  `/home/<name>/...`, `/Users/<name>/...`), the OS username, or the machine name.
+- Personal or internal email addresses, account handles, customer or company names, and
+  content from private trackers.
+- Internal infrastructure detail a reviewer does not need: how the operator reaches
+  production, what is installed on their laptop, which host holds the live data.
+
+Where the value came from does not matter. A URL the user pasted so you could fix a bug, a
+path printed by a command you ran, a hostname read from a local `.env` - being given it is
+permission to USE it, never permission to publish it.
+
+Write a placeholder instead (`example.com`, `your-domain.tld`, `<project-root>`, `$HOME`), a
+relative path, or the name of the config key that holds the value rather than its contents.
+Keep explanations generic: "not reproducible in this environment" instead of naming the
+operator's host and how it is reached. When the real value is genuinely required and was not
+given to you, ask for it.
+
+Before committing and before opening a PR, re-read the message, the branch name, and the
+diff for these classes specifically. Catching it here costs one edit; catching it after a
+push costs the remediation below. The `sec-operator-env-leak` guardrail blocks the one form
+of this that has an exact signature (this machine's own home directory reaching a tracked
+file); everything else on the list is yours to catch.
+
+---
+
 ## Removing Leaked or Sensitive Data (Discreet-Commit Carve-Out)
 
 Applies ONLY when remediating sensitive data the user wants removed from a repository - a
@@ -261,4 +297,5 @@ Before creating a commit or PR:
 - Verify only relevant files are included
 - Ensure no debug or temporary code is committed
 - Ensure no secrets or sensitive data are included
+- Ensure no operator-environment values leaked in (deployment domains, host names, IPs, absolute local paths with the OS username, personal emails) - in the diff, the message, the branch name, and the PR text
 - Ensure the change aligns with repository architecture

package/assets/skills/git-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "git-policy",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
-  "updated": "2026-08-04T20:04:42+02:00",
-  "cliVersion": "1.36.1",
-  "sha": "f55f4ed5474d5c6e7fd0804d88ac38fb3c9c3cd863519645d1415c02f4416db7"
+  "updated": "2026-08-19T12:37:59+02:00",
+  "cliVersion": "1.36.3",
+  "sha": "a29889e7c0ac872f39b03d2f17a5b52d503a26eb1a9b5f4d8e369fa79fef432e"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/SKILL.md

@@ -24,6 +24,13 @@ description: Application and AI-agent security - secrets management, authenticat
 - Assume any secret that touches the repo, a log, or an error message is compromised and must be rotated.
 - Scope secrets to the narrowest environment and lifetime possible; prefer short-lived, rotatable credentials over long-lived static ones.
 
+### The Operator's Environment Is Sensitive By Default
+
+- Deployment domains and URLs, host names, server IPs and ports, absolute local paths carrying an OS username, machine names, and personal or internal email addresses are not secrets in the cryptographic sense, but publishing them hands an attacker the target list and the operator's identity. Treat them as sensitive by default.
+- Being given one of these values to work with is not permission to write it into source, comments, docs, tests, fixtures, error strings, telemetry, commit messages, or PR text. Read it from configuration and ship a placeholder; the real value stays in the local gitignored config that already holds it.
+- Never echo an absolute path from the developer machine into anything the product emits - logs, user-facing error messages, generated docs, or committed snapshots and fixtures. Log a project-relative path.
+- Publish a real value only when the user explicitly asks for that value to be published. If one is genuinely required and you were not given it, ask.
+
 ---
 
 ## Authentication & Authorization

package/assets/skills/security-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "security-policy",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
-  "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.36.1",
-  "sha": "3201b6d41437626eb7bf45648c0d7f8c419dc4de87fbd9d4ca83c5ae3b6b6edf"
+  "updated": "2026-08-19T12:37:59+02:00",
+  "cliVersion": "1.36.3",
+  "sha": "0270c33d2b4559e831aec794c188d293d26fc17e2a8064a967d716ceb3a7bab6"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/SKILL.md

@@ -59,6 +59,11 @@ microcopy - the reader shouldn't have to study it.
 - Errors say what went wrong and how to fix it, in the interface's voice - never vague,
   never an apology, never a raw stack trace or internal error to the user.
 - Be realistic, not aspirational: describe what it actually does today, not the roadmap.
+- Examples use placeholders, never the operator's real environment: `example.com`,
+  `your-domain.tld`, `<project-root>`, `user@example.com`, a relative path. A domain, host,
+  IP, or `C:\Users\<name>\...` path that reached you through the chat or a local file does
+  not belong in a README, a code sample, a comment, or a UI string unless the user asked for
+  that exact value (security-policy, git-policy).
 - READMEs: assume a competent reader. Explain what is non-obvious or load-bearing (how to
   run it, the one surprising constraint, why a choice was made) and skip what the audience
   already knows or can infer from the code. Lead with the point; cut the throat-clearing.

package/assets/skills/technical-writing-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "technical-writing-policy",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
-  "updated": "2026-07-28T20:30:23+02:00",
-  "cliVersion": "1.36.1",
-  "sha": "a4b792103eb1f9dad93b9d70ea79dc18fe9cbbc318facf5adb47ae5907d842f9"
+  "updated": "2026-08-19T12:37:59+02:00",
+  "cliVersion": "1.36.3",
+  "sha": "a5a228a302f50d975a947b9d84676b4c2a4780f2b222f819388cc98d6a12f207"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.36.1",
+  "cliVersion": "1.36.3",
   "sha": "24928a4c9eed28ebede9f23f746b09a9d3d8176f8fcca61a7780a853fa5bed4e"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "0e4d41497453d6ebb763c702c74bf7e677a342b95e6b296cde43f5c3e7b41014",
-  "enigma-linux-arm64": "aac1877888fc489f64f6b65522752325c1efedb22a8c1c4ad17883e3f3a2b5dc",
-  "enigma-linux-x64": "7843cf8ab39fa180ca69479a490bd2b4cb99845697e0fb398779bd630fda750d",
-  "enigma-win32-x64.exe": "7608d8bc9c86110945bae369382a5a9acde585d718f6e46f459ea1a3648c5af0"
+  "enigma-darwin-arm64": "e04c1e18259597043f3a1b72e55c76a1b42ec2a57682ac885dab4e60f96b4811",
+  "enigma-linux-arm64": "d3a4feb08ec4b3dc1e226f2246bb00c7e34796136679cb78223efc8a951dc9e0",
+  "enigma-linux-x64": "47a4f27ff197103075bdfc3d33bb7846dab5fd2c0ac642c863d3acd0662c9250",
+  "enigma-win32-x64.exe": "c8aea6b00dc86a473b3293b35b2cf468e6d6d9101ba534dbeab3dc42d54c9563"
 }

package/dist/guardrails.js

@@ -1061,6 +1061,13 @@ var BUILTIN_RULES = [
   // distinct complete value, no re-fire after a failure, no auto-retry on 429) are behaviour a
   // regex cannot read at all. It stays in frontend-policy's auth section, with the attempt-cap
   // half in security-policy.
+  // NOTE: sec-operator-env-leak covers the operator's HOME PATH and nothing else, though the
+  // policy it serves also names deployment domains, host names, server IPs and internal email
+  // addresses. Those have no exact signature: the domain a project deploys to is legitimately
+  // in its own code, and a rule keyed on "a URL that is not example.com" would flag most of
+  // every codebase. The home path is different - the string can be compared against the actual
+  // machine, so the check is exact rather than heuristic. The rest stays in security-policy and
+  // git-policy, where a reader can weigh it.
   // NOTE: there is deliberately no "card inside a card" or "border with no information"
   // rule, even though both are named in frontend-policy. They are RELATIONAL defects: a
   // container is redundant only relative to the ancestor it sits in and the spacing around
@@ -1602,6 +1609,40 @@ var BUILTIN_RULES = [
     message: "Credential endpoint with no rate limiting. Login, registration, password reset and every 2FA/OTP verification are guessing surfaces: limit them BY IP (blunt, stops the broad sweep) AND BY ACCOUNT or identifier (stops the slow distributed attack the IP limit misses), count failures rather than requests, back off exponentially, and answer 429 with Retry-After. Keep the accounting server-side and identical for an unknown account, so the limiter itself does not become an account-existence oracle. If the limit is enforced upstream (gateway, middleware, WAF), note it in the file with an `enigma:allow-unlimited-auth` marker (security-policy, backend-policy).",
     severity: "block",
     skill: "security-policy"
+  },
+  {
+    id: "sec-operator-env-leak",
+    label: "Do not publish the operator's own environment",
+    // Every text file a change touches: the leak lands in source and comments, but just as
+    // often in a README, a snapshot, a config, or a log somebody committed by accident.
+    files: ["**"],
+    excludeFiles: [
+      "**/node_modules/**",
+      "**/dist/**",
+      "**/build/**",
+      "**/vendor/**",
+      "**/.next/**",
+      "node_modules/**",
+      "dist/**",
+      "build/**",
+      "vendor/**",
+      "*.lock",
+      "*.lockb",
+      "package-lock.json",
+      "*.min.js",
+      "*.map"
+    ],
+    scope: "file",
+    // DIFF stage, for the reason the stage exists: a machine's own paths are all over the
+    // logs and scratch files a long-lived repository already carries, and a rule that
+    // reports those on an unrelated edit gets switched off within a day. Here it can only
+    // fire on a line the current change ADDED - which is exactly the moment to catch it,
+    // because after the push the value is in the history for good.
+    stage: "diff",
+    fileCheck: "sec-operator-env-leak",
+    message: "This line carries THIS machine's home directory into a tracked file. A path with the OS account name in it publishes who you are and how your machine is laid out, and a commit keeps it forever - the same class as a deployment domain, a host name, a server IP or an internal email address, none of which belong in code, comments, docs, examples, fixtures, or a committed log. Write a placeholder (`<project-root>`, `$HOME`, `%USERPROFILE%`) or a repository-relative path, and keep the real value in the local gitignored config that already holds it. Being handed a path or a URL to work with is permission to USE it, never permission to publish it - only an explicit request to put that value in the file is (security-policy, git-policy).",
+    severity: "block",
+    skill: "security-policy"
   }
 ];
 var PROJECT_CHECKS = {
@@ -1624,7 +1665,8 @@ var FILE_CHECKS = {
   "fe-page-await-no-boundary": (content, file) => pageAwaitWithoutBoundary(content, file),
   "ts-import-extension": (content, file) => extensionImports(content, file),
   "ts-alias-deep-relative": (content, file) => deepRelativeImports(content, file),
-  "ts-alias-paths": (content, file) => missingPathAlias(content, file)
+  "ts-alias-paths": (content, file) => missingPathAlias(content, file),
+  "sec-operator-env-leak": (content) => operatorHomePathLeak(content)
 };
 var FIXERS = {
   "fe-name-input-capitalize": (line, file) => {
@@ -1983,6 +2025,33 @@ function missingPathAlias(content, file) {
   return [{ line: anchor === -1 ? 1 : anchor + 1, detail: `no alias for ./${src}` }];
 }
 var NAMED_IMPORT = /^import[ \t]+(?:[\w$]+[ \t]*,[ \t]*)?(?:type[ \t]+)?\{([^}]*)\}[ \t]*from[ \t]*["']([^"']+)["'].*$/gm;
+var GENERIC_ACCOUNTS = /* @__PURE__ */ new Set(["runner", "root", "ubuntu", "debian", "vagrant", "node", "user", "users", "developer", "ec2-user", "codespace", "gitpod", "jenkins", "circleci", "travis", "docker", "app"]);
+function operatorHome() {
+  const env = process.platform === "win32" ? process.env.USERPROFILE : process.env.HOME;
+  return env?.trim() || homedir();
+}
+function operatorHomePathLeak(content) {
+  const home = operatorHome();
+  if (!home || home.length < 6) return [];
+  const account = home.replace(/[\\/]+$/, "").split(/[\\/]/).pop() || "";
+  if (!account || GENERIC_ACCOUNTS.has(account.toLowerCase())) return [];
+  const forms = [home];
+  const drive = /^([A-Za-z]):[\\/](.*)$/.exec(home);
+  if (drive) forms.push(`/${drive[1].toLowerCase()}/${drive[2]}`);
+  const alt = forms.map((f) => f.split(/[\\/]/).map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\\\/]")).join("|");
+  let re;
+  try {
+    re = new RegExp(`(?:${alt})(?![A-Za-z0-9_-]|\\.[A-Za-z0-9_-])`, "i");
+  } catch {
+    return [];
+  }
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (re.test(lines[i])) out.push({ line: i + 1, detail: "the path resolves to this machine's home directory" });
+  }
+  return out;
+}
 var INTERNAL_MODULE = /^\.|^#|^[@~]\//;
 function wideNamedImports(content, max) {
   const per = /* @__PURE__ */ new Map();
@@ -2392,6 +2461,7 @@ export {
   loadRules,
   missingPathAlias,
   missingWindowsHide,
+  operatorHomePathLeak,
   pageAwaitWithoutBoundary,
   readLedger,
   readReplyLedger,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.36.1",
+  "version": "1.36.3",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {