enigma-cli 1.37.2 → 1.38.0

package/assets/commands/gate.md

@@ -123,12 +123,26 @@ What follows from that:
   `/gate off`: `-l` for this project, `-g` only when the user says every project -
   a bare `enigma config` writes the GLOBAL file. Report the change and its scope;
   it is the user's strictness you are lowering.
-- **Propose `--skip test,document` on a throwaway diff** (a typo, a comment, a
-  version bump) and let the user decide. Skipping them means no test evidence was
-  gathered and no docs were checked, so it is their call - unless they already
-  asked for speed, in which case skip and say so. Either way, always report which
-  steps were skipped, so the user knows what was and was not validated.
-- **Never skip `review`.** It is the only step that justifies the gate.
+- **Sizing the run is YOUR job, not a question.** Pick the shape from the change in
+  front of you, run it, and report which steps were skipped. Asking the user which
+  phases to skip spends a turn on a decision you are better placed to make: you know
+  what the diff touches and what you already verified. `--quick` (`-q`) is the shape
+  below in one flag - it drops `test` and `document` and nothing else.
+
+  | The change | Run |
+  | --- | --- |
+  | A typo, a comment, a version bump, generated output | `--quick` |
+  | Styles, copy, markup - no new logic | `--quick` |
+  | Code whose suite you ALREADY ran green this session, over these commits | `--quick`, and name the suite in your report |
+  | New behaviour, a fix with no test run yet, anything touching auth, money, data loss or a public API | the full run |
+
+  The gate also right-sizes itself: a diff with no executable file in it skips `test`
+  and `document` on its own, so a docs-only change needs no flag from you.
+- **What you already verified is evidence, and it does not stop being evidence
+  because a pipeline is running.** Re-running a suite you watched pass ten minutes
+  ago buys nothing but minutes. Skip it and say what you ran and what it reported.
+- **Never skip `review`.** It is the only step that justifies the gate, and a quick
+  run is still a gated one.
 - **`test` costs a full pass even when `commands.test` is set.** The step runs its
   evidence agent when the test command is empty *or* the run supplied intent, and
   `--intent` is mandatory, so a configured command makes the step thorough, not
@@ -147,13 +161,16 @@ model while review keeps the strong one.
 1. Start the run. It blocks until the first decision point or the end:
    ```sh
    enigma gate axi run --intent "<what the user set out to accomplish>"
+   enigma gate axi run --intent "..." --quick   # small, or already tested: no test/document
    ```
    `axi run` and every `axi respond` block synchronously - review, test, and CI
    can each take several minutes, so a single call may not return for a while.
    That is normal; allow a long timeout and do not cancel or re-issue it. To
    check progress, use `enigma gate axi status` from a separate call. When status
    shows `awaiting_agent: parked <duration>`, the run is parked at a gate waiting
-   for your `axi respond`.
+   for your `axi respond`. When it shows `blocked_on_user: <action>`, the run is
+   waiting on the USER, not on you or on the pipeline - say so instead of reporting
+   it as still running.
 2. If the output contains a `gate:` object, the pipeline is waiting on you. Read
    its `findings` table. Each finding has an `action`:
    - `auto-fix` - mechanical, low-risk; authorize on your own judgment with
@@ -186,9 +203,23 @@ model while review keeps the strong one.
    has the pipeline apply the fix and re-review.
 3. Repeat step 2 until the output has an `outcome:` instead of a `gate:`:
    - `checks-passed` - validated and CI green, PR not merged yet. You are done
-     driving. Tell the user the PR is ready and ask them to review and merge it
-     (link in the `help` line). The gate keeps monitoring the PR in the
-     background; do not poll for the merge.
+     driving. Tell the user the PR is ready AND that the run is now waiting on them
+     to merge it - the `ci` step stays `running` until they do, so reporting "still
+     running" leaves them waiting on a pipeline that is waiting on them. Link the PR
+     (in the `help` line) and stop polling for the merge.
+
+     If the user has already told you to merge it ("mergealo", "metelo en main",
+     "merge it when CI passes"), that is the one case where you merge:
+     ```sh
+     enigma gate axi merge                 # squash by default
+     enigma gate axi merge --method merge  # or merge, or rebase
+     ```
+     It refuses a PR with failing or unfinished checks unless you pass `--force`,
+     and it waits for the run to close. You can also ask for it up front with
+     `enigma gate axi run --intent "..." --merge`, which merges as soon as CI is
+     green - but a run that hands back at a gate first needs `--merge` on the
+     `axi respond` that reaches CI-green too, since that is the call that gets
+     there. Never merge unless the user asked.
    - `passed` - cleared the gate and the PR was merged or closed. On the default
      branch this is the normal ending: no PR is opened and CI monitoring is
      skipped, so the run finishes here once the push lands.

package/assets/memory/AGENTS.md

@@ -104,7 +104,7 @@ Prose to the user is compressed at level **{{output-level}}**. It shapes the ANS
 - Those are the only exits and each has to be NAMED. Asking is not one of them: the gate being on is already the decision, so "tell me if you want me to launch it" ends a turn on a question with one answer. Ending unvalidated and silent is worse. `enigma verify` denies the stop both ways - on a message that reports the gate as skipped, and on commits no run ever saw.
 - On the default branch the pipeline opens no PR and pushes straight to it. That is intended; report it as the outcome instead of waiting for a PR link.
 - If the repo is not initialized yet (`enigma gate axi` says so), run `enigma gate init` yourself, then proceed - a setup step you can perform, never a reason to stop or ask. If `enigma gate` misbehaves, `enigma gate doctor` reports why.
-- Drive it through the `/gate` workflow (`enigma gate axi run --intent "<what the user set out to accomplish>"`). A gate it hands back carries `fix_policy`, the user's standing answer to who decides: under `assisted` (the default) escalate only what contradicts the request, undoes a deliberate decision, changes agreed behavior, or needs a very large change, and fix the rest yourself; under `ask` put every finding to the user first; under `auto` settle them all yourself. Do NOT pass `--yes` (the setting is how the user grants it) and do NOT merge the PR yourself - on `checks-passed`, leave it ready for the user to review and merge.
+- Drive it through the `/gate` workflow (`enigma gate axi run --intent "<what the user set out to accomplish>"`). A gate it hands back carries `fix_policy`, the user's standing answer to who decides: under `assisted` (the default) escalate only what contradicts the request, undoes a deliberate decision, changes agreed behavior, or needs a very large change, and fix the rest yourself; under `ask` put every finding to the user first; under `auto` settle them all yourself. Do NOT pass `--yes` (the setting is how the user grants it). `checks-passed` means the run waits on the USER to merge: report that, not "still running", and merge (`axi merge`) only if asked.
 - While a run is active never edit code to fix a finding; the pipeline owns the fixes (respond with `--action fix`). Full reference: the gate skill / `/gate`.
 <!-- enigma:gate:end -->
 

package/assets/memory/CLAUDE.md

@@ -104,7 +104,7 @@ Prose to the user is compressed at level **{{output-level}}**. It shapes the ANS
 - Those are the only exits and each has to be NAMED. Asking is not one of them: the gate being on is already the decision, so "tell me if you want me to launch it" ends a turn on a question with one answer. Ending unvalidated and silent is worse. `enigma verify` denies the stop both ways - on a message that reports the gate as skipped, and on commits no run ever saw.
 - On the default branch the pipeline opens no PR and pushes straight to it. That is intended; report it as the outcome instead of waiting for a PR link.
 - If the repo is not initialized yet (`enigma gate axi` says so), run `enigma gate init` yourself, then proceed - a setup step you can perform, never a reason to stop or ask. If `enigma gate` misbehaves, `enigma gate doctor` reports why.
-- Drive it through the `/gate` workflow (`enigma gate axi run --intent "<what the user set out to accomplish>"`). A gate it hands back carries `fix_policy`, the user's standing answer to who decides: under `assisted` (the default) escalate only what contradicts the request, undoes a deliberate decision, changes agreed behavior, or needs a very large change, and fix the rest yourself; under `ask` put every finding to the user first; under `auto` settle them all yourself. Do NOT pass `--yes` (the setting is how the user grants it) and do NOT merge the PR yourself - on `checks-passed`, leave it ready for the user to review and merge.
+- Drive it through the `/gate` workflow (`enigma gate axi run --intent "<what the user set out to accomplish>"`). A gate it hands back carries `fix_policy`, the user's standing answer to who decides: under `assisted` (the default) escalate only what contradicts the request, undoes a deliberate decision, changes agreed behavior, or needs a very large change, and fix the rest yourself; under `ask` put every finding to the user first; under `auto` settle them all yourself. Do NOT pass `--yes` (the setting is how the user grants it). `checks-passed` means the run waits on the USER to merge: report that, not "still running", and merge (`axi merge`) only if asked.
 - While a run is active never edit code to fix a finding; the pipeline owns the fixes (respond with `--action fix`). Full reference: the gate skill / `/gate`.
 <!-- enigma:gate:end -->
 

package/assets/registry/primitives/registry.json

@@ -585,6 +585,140 @@
         "css"
       ]
     },
+    {
+      "name": "select",
+      "title": "Select",
+      "description": "A listbox that replaces the native select: icons and a second line on an option, rows that cannot be chosen, one value or many with removable tags, groups, a filter that appears on its own once the list is long enough (fuzzy with Fuse.js, plain without it), typeahead and the full keyboard, a hidden field so a plain form still posts it, and a long list rendered a window at a time. It brings its own theme - an unstyled popup is transparent text over the page rather than a plain-looking control.",
+      "targets": [
+        "react"
+      ],
+      "entry": {
+        "react": "@enigmax/primitives/react/select"
+      },
+      "exports": {
+        "react": [
+          "Select",
+          "useSelectContext",
+          "createSelect"
+        ]
+      },
+      "files": [
+        {
+          "path": "src/core/search.ts",
+          "dest": "select/search-core.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/core/palette.ts",
+          "dest": "select/rows.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/core/select.ts",
+          "dest": "select/select.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/search": "./search-core"
+          }
+        },
+        {
+          "path": "src/react/slot.tsx",
+          "dest": "select/slot.tsx",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/select/styles.ts",
+          "dest": "select/styles.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "recipes/select/styles.css",
+          "dest": "select/styles.css",
+          "targets": [
+            "react"
+          ],
+          "style": "css"
+        },
+        {
+          "path": "src/react/select/context.ts",
+          "dest": "select/context.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/select": "./select"
+          }
+        },
+        {
+          "path": "src/react/select/root.tsx",
+          "dest": "select/root.tsx",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/select": "./select",
+            "@/core/palette": "./rows",
+            "@/react/slot": "./slot",
+            "@/react/select/styles": "./styles",
+            "@/react/select/context": "./context"
+          }
+        },
+        {
+          "path": "src/react/select/index.tsx",
+          "dest": "select/index.tsx",
+          "main": true,
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/react/select/root": "./root",
+            "@/react/select/context": "./context",
+            "@/react/select/styles": "./styles",
+            "@/core/select": "./select"
+          }
+        }
+      ],
+      "styles": true,
+      "themeHooks": [
+        "[data-enigma-select-root]",
+        "[data-enigma-select-trigger]",
+        "[data-enigma-select-trigger][data-open]",
+        "[data-enigma-select-value][data-placeholder]",
+        "[data-enigma-select-tag]",
+        "[data-enigma-select-tag-remove]",
+        "[data-enigma-select-indicator]",
+        "[data-enigma-select-caret]",
+        "[data-enigma-select-clear]",
+        "[data-enigma-select-content]",
+        "[data-enigma-select-content][data-side=top]",
+        "[data-enigma-select-search]",
+        "[data-enigma-select-list]",
+        "[data-enigma-select-group-label]",
+        "[data-enigma-select-option]",
+        "[data-enigma-select-option][data-active]",
+        "[data-enigma-select-option][data-selected]",
+        "[data-enigma-select-option][data-disabled]",
+        "[data-enigma-select-option-label]",
+        "[data-enigma-select-option-description]",
+        "[data-enigma-select-icon]",
+        "[data-enigma-select-check]",
+        "[data-enigma-select-empty]"
+      ],
+      "docs": "docs/notes/primitives.md#select",
+      "recipes": [
+        "css"
+      ]
+    },
     {
       "name": "flags",
       "title": "Country flags",
@@ -711,16 +845,17 @@
     {
       "name": "toast",
       "title": "Toast",
-      "description": "The notification queue with a renderer on top: stacking, swipe to dismiss, a pointer that stops the clock, and a toast that is still on screen while it animates out. Ships the Ember theme, which is a stylesheet you own.",
+      "description": "The notification queue with a renderer on top: the newest toast in front, the older ones stacked behind it and fanning out when the pointer arrives, swipe to dismiss, a pointer that stops the clock, and a toast that is still on screen while it animates out. It brings its own theme - a toast at the edge of the screen is the one component a forgotten stylesheet ruins rather than merely undresses.",
       "targets": [
         "react"
       ],
       "entry": {
-        "react": "@enigmax/primitives/react"
+        "react": "@enigmax/primitives/react/toast"
       },
       "exports": {
         "react": [
           "Toaster",
+          "toast",
           "useNotifications"
         ]
       },
@@ -743,16 +878,60 @@
           }
         },
         {
-          "path": "src/react/toaster.tsx",
-          "dest": "toast/index.tsx",
-          "main": true,
+          "path": "src/react/toast/types.ts",
+          "dest": "toast/vendor/types.ts",
           "targets": [
             "react"
-          ],
-          "rewrite": {
-            "@/core/notifications": "./notifications",
-            "@/react/use-notifications": "./use-notifications"
-          }
+          ]
+        },
+        {
+          "path": "src/react/toast/hooks.ts",
+          "dest": "toast/vendor/hooks.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/toast/cn.ts",
+          "dest": "toast/vendor/cn.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/toast/assets.tsx",
+          "dest": "toast/vendor/assets.tsx",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/toast/state.ts",
+          "dest": "toast/vendor/state.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/toast/styles.ts",
+          "dest": "toast/vendor/styles.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/toast/index.tsx",
+          "dest": "toast/vendor/index.tsx",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/toast/NOTICE",
+          "dest": "toast/vendor/NOTICE",
+          "targets": [
+            "react"
+          ]
         },
         {
           "path": "recipes/toast/styles.css",
@@ -763,30 +942,38 @@
           "style": "css"
         },
         {
-          "path": "recipes/toast/tailwind.tsx",
-          "dest": "toast/AppToaster.tsx",
+          "path": "src/react/toaster.tsx",
+          "dest": "toast/index.tsx",
+          "main": true,
           "targets": [
             "react"
           ],
-          "style": "tailwind",
           "rewrite": {
-            "@enigmax/utils/react": "./index"
+            "@/react/toast/styles": "./vendor/styles",
+            "@/react/toast/state": "./vendor/state",
+            "@/react/toast/index": "./vendor/index",
+            "@/react/toast/types": "./vendor/types",
+            "@/react/use-notifications": "./use-notifications",
+            "@/core/notifications": "./notifications"
           }
         }
       ],
-      "styles": false,
+      "styles": true,
       "themeHooks": [
-        "[data-enigma-toaster]",
-        "[data-enigma-toaster][data-position]",
-        "[data-enigma-toast]",
-        "[data-enigma-toast][data-tone=error]",
-        "[data-enigma-toast][data-state=leaving]",
-        "[data-enigma-toast][data-swiping]",
-        "[data-enigma-toast][data-front]",
-        "[data-enigma-toast-title]",
-        "[data-enigma-toast-body]",
-        "[data-enigma-toast-action]",
-        "[data-enigma-toast-close]"
+        "[data-toastcmp-toaster]",
+        "[data-toastcmp-toaster][data-theme]",
+        "[data-toastcmp-toaster][data-lifted]",
+        "[data-toastcmp-toast]",
+        "[data-toastcmp-toast][data-type=error]",
+        "[data-toastcmp-toast][data-front]",
+        "[data-toastcmp-toast][data-mounted]",
+        "[data-toastcmp-toast][data-removed]",
+        "[data-toastcmp-toast][data-swiping]",
+        "[data-title]",
+        "[data-description]",
+        "[data-button]",
+        "[data-close-button]",
+        "[data-icon]"
       ],
       "docs": "docs/notes/primitives.md#toast",
       "recipes": [

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "6b8a924cc11b61d4b45b73384aeb095ce622229359b7cc2c6ce4bb0cf3015ed7"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -7,6 +7,6 @@
     "codeGraph"
   ],
   "updated": "2026-08-15T20:49:24+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "95b7202e5659f8d9d6f11ce29e7dc5b01575ba86c78ef948bec4753ccf430155"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -286,6 +286,7 @@ A text input is not generic. What it holds decides the keyboard a phone opens, w
 - Phone: `type="tel"`, `inputmode="tel"`, `autocomplete="tel"`. Numeric code: `inputmode="numeric"`, `autocomplete="one-time-code"`.
 - Free prose (bio, message, description): `autocapitalize="sentences"` with spellcheck left on.
 - Set `enterkeyhint` where the key does something specific (`search`, `send`, `done`), and mark the search field `type="search"`.
+- `type="search"` brings a clear cross that only WebKit draws. Kill it (`::-webkit-search-cancel-button { appearance: none; }`) in the shared stylesheet and render your own clear button if you want one: left in, Safari and Chrome users get two crosses side by side and everyone else gets one, which is a control that exists on some machines and not others.
 
 Where this lives and when it runs:
 

package/assets/skills/frontend-policy/skill.json

@@ -3,7 +3,7 @@
   "version": "1.30.1",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-08-31T19:24:18+02:00",
-  "cliVersion": "1.37.2",
-  "sha": "13689bf1abc873fa4dd4241658b0552ab96870cca4e091aa2f89831051bcc616"
+  "updated": "2026-08-31T23:36:34+02:00",
+  "cliVersion": "1.38.0",
+  "sha": "6c770bfac691fed382bbffe7bc99ed79cd13ab04e2392b7a87cfa5259b6de73d"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-08-22T09:25:34+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "cb320a6a5fd3279604ad7920b877c1a36e48f4f39aeead1a4c4daa89901d9ce0"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "0270c33d2b4559e831aec794c188d293d26fc17e2a8064a967d716ceb3a7bab6"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "a5a228a302f50d975a947b9d84676b4c2a4780f2b222f819388cc98d6a12f207"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.37.2",
+  "cliVersion": "1.38.0",
   "sha": "24928a4c9eed28ebede9f23f746b09a9d3d8176f8fcca61a7780a853fa5bed4e"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "3c011a7265b40a1a8e80dd198ffa2d422752df227732f4de28a4c88a25839596",
-  "enigma-linux-arm64": "714224e6bd93a8505a79e029b28cc9edb5d8925171ff7050e4a03b61830da9eb",
-  "enigma-linux-x64": "933e61c9bd8ecd1b86b61bbe149d00f33bb39fe6b00f73b1d4791b95d225f67c",
-  "enigma-win32-x64.exe": "769b6604325109f844e1ce8f61d0725dc654fca9e4e338f2fc39174d11605680"
+  "enigma-darwin-arm64": "03f72bfb88eea2935151ba910314287abfcbe76142a56d285e434aec58663d2a",
+  "enigma-linux-arm64": "04734b5323d8067f2da25136710f8dff9de872b79ebbad980edd5f46f3816404",
+  "enigma-linux-x64": "0762263fe9e04b133d913e78be0ff09cb3c798267012e4f89119c53f1064d7ae",
+  "enigma-win32-x64.exe": "bc3256a25f3f793f6d074359fcc9768a137c71f067a5f5c4db30a0124f8a9bba"
 }

package/bin/statusline.mjs

@@ -322,16 +322,25 @@ function renderGate(snap, columns, frame, nowSec, color256) {
         return paint(glyph, style.color, color256);
     }).join("");
 
-    // The spinner turns only while a step is actually working; a failed run holds
-    // a red marker instead, so a stalled pipeline never looks like a busy one.
-    const spinner = active
-        ? paint(SPINNER[frame % SPINNER.length], snap.awaiting ? "yellow" : "blue", color256)
-        : paint(BAR_FILLED, failed ? "red" : "dim", color256);
+    // What the run is waiting on that only the user can do (merging the PR once CI
+    // is green). The step stays `running` throughout, so without this the bar spins
+    // over a step that is idle and nothing ever says the wait is on the user.
+    const blocked = typeof snap.blocked === "string" && snap.blocked !== "" ? snap.blocked : null;
+
+    // The spinner turns only while a step is actually working; a failed run holds a
+    // red marker instead, and a run waiting on the user a yellow one, so a stalled
+    // pipeline never looks like a busy one.
+    let spinner;
+    if (blocked) spinner = paint(BAR_FILLED, "yellow", color256);
+    else if (active) spinner = paint(SPINNER[frame % SPINNER.length], snap.awaiting ? "yellow" : "blue", color256);
+    else spinner = paint(BAR_FILLED, failed ? "red" : "dim", color256);
 
     let labelColor = "blue";
-    if (snap.awaiting) labelColor = "yellow";
+    if (blocked || snap.awaiting) labelColor = "yellow";
     else if (!active && failed) labelColor = "red";
-    const label = snap.awaiting ? "needs you" : (current ? current.name : snap.status);
+    let label = current ? current.name : snap.status;
+    if (blocked) label = `needs you: ${blocked}`;
+    else if (snap.awaiting) label = "needs you";
     // A negative age means the snapshot and this process disagree about the clock.
     // Dropping the segment is honest; a confident "0s" is not.
     const started = current?.startedAt ?? snap.startedAt;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.37.2",
+  "version": "1.38.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {