enigma-cli 1.38.0 → 1.40.1

package/assets/registry/primitives/registry.json

@@ -454,6 +454,13 @@
             "react"
           ]
         },
+        {
+          "path": "src/react/slot.tsx",
+          "dest": "button/slot.tsx",
+          "targets": [
+            "react"
+          ]
+        },
         {
           "path": "src/react/button.tsx",
           "dest": "button/index.tsx",
@@ -464,7 +471,8 @@
           "rewrite": {
             "@/core/button": "./button",
             "@/react/use-button": "./use-button",
-            "@/react/link": "./link"
+            "@/react/link": "./link",
+            "@/react/slot": "./slot"
           }
         }
       ],
@@ -617,6 +625,13 @@
             "react"
           ]
         },
+        {
+          "path": "src/core/keys.ts",
+          "dest": "select/keys.ts",
+          "targets": [
+            "react"
+          ]
+        },
         {
           "path": "src/core/select.ts",
           "dest": "select/select.ts",
@@ -624,7 +639,8 @@
             "react"
           ],
           "rewrite": {
-            "@/core/search": "./search-core"
+            "@/core/search": "./search-core",
+            "@/core/keys": "./keys"
           }
         },
         {
@@ -668,6 +684,7 @@
           "rewrite": {
             "@/core/select": "./select",
             "@/core/palette": "./rows",
+            "@/core/search": "./search-core",
             "@/react/slot": "./slot",
             "@/react/select/styles": "./styles",
             "@/react/select/context": "./context"
@@ -719,6 +736,212 @@
         "css"
       ]
     },
+    {
+      "name": "context-menu",
+      "title": "Context menu",
+      "description": "A right-click menu with the desktop's behaviour: submenus that open on a beat of hovering and survive a diagonal pointer, icons, a second line, shortcuts printed on the right, checkable and radio rows, separators and captions, destructive rows in red, an optional heading naming what it acts on, a filter once a level is long, a long level rendered a window at a time, and a submenu fetched on demand and cached. Opens at the pointer, on a long press, and on Shift+F10. A menu with no rows does not open at all. It brings its own theme - an unstyled popup is transparent text over the page rather than a plain-looking control.",
+      "targets": [
+        "react"
+      ],
+      "entry": {
+        "react": "@enigmax/primitives/react/context-menu"
+      },
+      "exports": {
+        "react": [
+          "ContextMenu",
+          "useContextMenuContext",
+          "createContextMenu"
+        ]
+      },
+      "files": [
+        {
+          "path": "src/core/search.ts",
+          "dest": "context-menu/search-core.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/core/keys.ts",
+          "dest": "context-menu/keys.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/core/context-menu.ts",
+          "dest": "context-menu/context-menu.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/search": "./search-core",
+            "@/core/keys": "./keys"
+          }
+        },
+        {
+          "path": "src/react/slot.tsx",
+          "dest": "context-menu/slot.tsx",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/react/context-menu/styles.ts",
+          "dest": "context-menu/styles.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "recipes/context-menu/styles.css",
+          "dest": "context-menu/styles.css",
+          "targets": [
+            "react"
+          ],
+          "style": "css"
+        },
+        {
+          "path": "src/react/context-menu/context.ts",
+          "dest": "context-menu/context.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/context-menu": "./context-menu"
+          }
+        },
+        {
+          "path": "src/react/context-menu/root.tsx",
+          "dest": "context-menu/root.tsx",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/context-menu": "./context-menu",
+            "@/core/search": "./search-core",
+            "@/core/keys": "./keys",
+            "@/react/slot": "./slot",
+            "@/react/context-menu/styles": "./styles",
+            "@/react/context-menu/context": "./context"
+          }
+        },
+        {
+          "path": "src/react/context-menu/index.tsx",
+          "dest": "context-menu/index.tsx",
+          "main": true,
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/react/context-menu/root": "./root",
+            "@/react/context-menu/context": "./context",
+            "@/react/context-menu/styles": "./styles",
+            "@/core/context-menu": "./context-menu",
+            "@/core/keys": "./keys"
+          }
+        }
+      ],
+      "styles": true,
+      "themeHooks": [
+        "[data-enigma-menu-trigger]",
+        "[data-enigma-menu-panel]",
+        "[data-enigma-menu-panel][data-placed]",
+        "[data-enigma-menu-title]",
+        "[data-enigma-menu-search]",
+        "[data-enigma-menu-list]",
+        "[data-enigma-menu-item]",
+        "[data-enigma-menu-item][data-active]",
+        "[data-enigma-menu-item][data-disabled]",
+        "[data-enigma-menu-item][data-destructive]",
+        "[data-enigma-menu-item][data-submenu]",
+        "[data-enigma-menu-item-label]",
+        "[data-enigma-menu-item-description]",
+        "[data-enigma-menu-icon]",
+        "[data-enigma-menu-shortcut]",
+        "[data-enigma-menu-arrow]",
+        "[data-enigma-menu-check]",
+        "[data-enigma-menu-separator]",
+        "[data-enigma-menu-label]",
+        "[data-enigma-menu-status]",
+        "[data-enigma-menu-status][data-error]"
+      ],
+      "docs": "docs/notes/primitives.md#context-menu",
+      "recipes": [
+        "css"
+      ]
+    },
+    {
+      "name": "selection",
+      "title": "Selection list",
+      "description": "The file-manager selection model as a headless list: a plain click replaces, Ctrl toggles, Shift takes the range from the anchor, Ctrl+Shift adds that range, Ctrl+A takes everything and Escape drops it, with a rubber band over empty space and arrow keys that move a cursor and extend with Shift. Delete, F2, Enter, copy, cut and paste are reported as commands rather than performed. Every binding can be rebound, removed one at a time, or turned off altogether, and a binding of your own is matched and reported the same way. Ships no styles: state arrives as data attributes.",
+      "targets": [
+        "react"
+      ],
+      "entry": {
+        "react": "@enigmax/primitives/react/selection"
+      },
+      "exports": {
+        "react": [
+          "SelectionList",
+          "useSelection",
+          "createSelection"
+        ]
+      },
+      "files": [
+        {
+          "path": "src/core/keys.ts",
+          "dest": "selection/keys.ts",
+          "targets": [
+            "react"
+          ]
+        },
+        {
+          "path": "src/core/selection.ts",
+          "dest": "selection/selection.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/keys": "./keys"
+          }
+        },
+        {
+          "path": "src/react/selection/use-selection.ts",
+          "dest": "selection/use-selection.ts",
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/core/selection": "./selection"
+          }
+        },
+        {
+          "path": "src/react/selection/index.tsx",
+          "dest": "selection/index.tsx",
+          "main": true,
+          "targets": [
+            "react"
+          ],
+          "rewrite": {
+            "@/react/selection/use-selection": "./use-selection",
+            "@/core/selection": "./selection",
+            "@/core/keys": "./keys"
+          }
+        }
+      ],
+      "styles": false,
+      "themeHooks": [
+        "[data-enigma-selection-list]",
+        "[data-enigma-selection-item]",
+        "[data-enigma-selection-item][data-selected]",
+        "[data-enigma-selection-item][data-cursor]",
+        "[data-enigma-selection-item][data-disabled]",
+        "[data-enigma-selection-marquee]",
+        "[data-enigma-selection-empty]"
+      ],
+      "docs": "docs/notes/primitives.md#selection"
+    },
     {
       "name": "flags",
       "title": "Country flags",

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "6b8a924cc11b61d4b45b73384aeb095ce622229359b7cc2c6ce4bb0cf3015ed7"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -7,6 +7,6 @@
     "codeGraph"
   ],
   "updated": "2026-08-15T20:49:24+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "95b7202e5659f8d9d6f11ce29e7dc5b01575ba86c78ef948bec4753ccf430155"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/SKILL.md

@@ -26,6 +26,7 @@ description: Frontend architecture - reusable components, abstraction thresholds
 - Interaction logic - looping/draggable rows, momentum, focus traps, virtualized lists, dismiss timers, read caches - is BEHAVIOR, and behavior that has already been measured and tested is a dependency, not a snippet to rewrite. Check the catalogue before writing it: `enigma add` lists it and `enigma add <name>` adds it as a DEPENDENCY, which is how you use these - the package keeps getting fixes and a dependency is how they reach the project. `--copy` vendors the source and freezes it at that version; reach for it to EDIT a component, never as the normal way to add one.
 - These primitives ship NO visual styles. They apply only what the behavior requires (overflow, touch-action, user-select, will-change, transform) and publish their state as `data-*` attributes, so the look stays entirely yours.
 - Do not hand-roll one of them "just for this page". The hand-rolled version is where the measured bugs come back: a duration-driven marquee that accelerates as items are added, a `setPointerCapture` drag that silently stops every link in the row from opening, a hover slowdown that sticks forever after the first tap because touch never fires `pointerleave`.
+- Two of them are worth naming because their hand-rolled versions are near-misses of behavior everyone already knows, and the `fe-context-menu-hand-rolled` and `fe-selection-hand-rolled` guardrails block both. A RIGHT-CLICK MENU (`enigma add context-menu`) is never the panel: it is the release of the opening press choosing whatever row it landed on, a submenu that closes while the pointer crosses a sibling to reach it (the way out goes over them, so closing on the first crossing makes a nested menu unreachable), a panel that opens off the edge of the window instead of flipping, no Escape, no arrows, no Shift+F10, and a menu left behind when the page scrolls - plus shortcuts printed for the reader's platform and a menu that refuses to open when it has nothing to show. A LIST SELECTION (`enigma add selection`) is Explorer's model: Shift+click measures from the ANCHOR every time (measuring from the last click leaves a trail of rows as it is dragged), Ctrl toggles instead of replacing, Ctrl+Shift adds the range, a range steps over a row it may not select, and Ctrl+A, Escape and the arrow keys exist at all - with every shortcut rebindable or removable, and delete/rename/open reported as commands rather than performed.
 - If the catalogue has no primitive for what you need, write it as one (core + adapter + registry entry + test) rather than inline in a page, so the next screen reuses it instead of rewriting it.
 
 ## Component Reuse (Mandatory)

package/assets/skills/frontend-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "frontend-policy",
-  "version": "1.30.1",
+  "version": "1.31.0",
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
-  "updated": "2026-08-31T23:36:34+02:00",
-  "cliVersion": "1.38.0",
-  "sha": "6c770bfac691fed382bbffe7bc99ed79cd13ab04e2392b7a87cfa5259b6de73d"
+  "updated": "2026-09-01T21:30:38+02:00",
+  "cliVersion": "1.40.1",
+  "sha": "c18c746f8c29c591685b81cabbaada43996640bc830181c28b8560e904934bc2"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-08-22T09:25:34+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "cb320a6a5fd3279604ad7920b877c1a36e48f4f39aeead1a4c4daa89901d9ce0"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "0270c33d2b4559e831aec794c188d293d26fc17e2a8064a967d716ceb3a7bab6"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "a5a228a302f50d975a947b9d84676b4c2a4780f2b222f819388cc98d6a12f207"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.38.0",
+  "cliVersion": "1.40.1",
   "sha": "24928a4c9eed28ebede9f23f746b09a9d3d8176f8fcca61a7780a853fa5bed4e"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "03f72bfb88eea2935151ba910314287abfcbe76142a56d285e434aec58663d2a",
-  "enigma-linux-arm64": "04734b5323d8067f2da25136710f8dff9de872b79ebbad980edd5f46f3816404",
-  "enigma-linux-x64": "0762263fe9e04b133d913e78be0ff09cb3c798267012e4f89119c53f1064d7ae",
-  "enigma-win32-x64.exe": "bc3256a25f3f793f6d074359fcc9768a137c71f067a5f5c4db30a0124f8a9bba"
+  "enigma-darwin-arm64": "d99532b31c6c8f2f3fc553be1fcb82944909a34e39aa7612aad3fc9f85da82b2",
+  "enigma-linux-arm64": "024a6a3e68814301e4aad40aafca834ab96fb386fd6b74d30bd14e4fcf5d344a",
+  "enigma-linux-x64": "6c66ee2647df7d119ef86a0ac2ea70d8de0b2d1e8c387f9a5e306a29fa60a73c",
+  "enigma-win32-x64.exe": "337ce56e7fcabaf536f71b7cf1f8b6155413d97918d3e5b1b4263a66b94d600f"
 }

package/dist/guardrails.js

@@ -980,6 +980,62 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "frontend-policy"
   },
+  {
+    id: "fe-context-menu-hand-rolled",
+    label: "Right-click menus come from the primitive",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.ts", "*.js"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.min.js",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // DIFF stage: a hand-rolled menu is one of the things a codebase already has, and the
+    // rule has to name the one being written now rather than the backlog.
+    stage: "diff",
+    fileCheck: "fe-context-menu-hand-rolled",
+    message: "A right-click menu written by hand. What is missing is never the panel, it is the long tail nobody writes on the first pass: the release of the press that OPENED the menu choosing whatever row it landed on, a submenu that closes while the pointer crosses a sibling to reach it (the way out of a submenu goes over them, so closing on the first crossing makes a nested menu unreachable), a panel that opens off the bottom or the right of the window instead of flipping, no Escape, no arrow keys, no Shift+F10 for anyone without a mouse, and a menu left behind when the page scrolls. `enigma add context-menu` (@enigmax/primitives) is all of that with a test each, plus shortcuts printed for the reader's platform, checkable rows, destructive rows, a filter once a level is long and submenus fetched on demand and cached - and it refuses to open at all when there is nothing to show. When the menu genuinely has to be your own, add an `enigma:allow-hand-rolled-menu` note to the file (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-selection-hand-rolled",
+    label: "List selection comes from the primitive",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.ts", "*.js"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.min.js",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    fileCheck: "fe-selection-hand-rolled",
+    message: "A file-manager selection written by hand. Everyone already knows these rules from Explorer and Finder, which is exactly why the near-miss is so visible: a Shift+click measured from the last CLICK instead of the anchor leaves a trail of rows behind as it is dragged, a Ctrl+click that replaces instead of toggling throws the selection away, a range walks straight over a row that was not selectable, and the arrow keys, Ctrl+A and Escape usually never arrive at all. `enigma add selection` (@enigmax/primitives) is the whole model - anchor and cursor, Ctrl, Shift, Ctrl+Shift, select-all, invert, a rubber band, and arrow keys that extend from the anchor - with every shortcut rebindable, removable one at a time, or off altogether, and delete/rename/open reported as commands rather than performed. It ships no styles: `[data-selected]` and `[data-cursor]` are yours. When the model genuinely has to be your own, add an `enigma:allow-hand-rolled-selection` note to the file (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
   {
     id: "fe-icon-action-button",
     label: "Repeated actions are icon buttons, not text labels",
@@ -1776,7 +1832,9 @@ var FILE_CHECKS = {
   "ts-alias-deep-relative": (content, file) => deepRelativeImports(content, file),
   "ts-alias-paths": (content, file) => missingPathAlias(content, file),
   "sec-operator-env-leak": (content) => operatorHomePathLeak(content),
-  "fe-new-password-affordance-on-signin": (content) => newPasswordAffordanceOnSignIn(content)
+  "fe-new-password-affordance-on-signin": (content) => newPasswordAffordanceOnSignIn(content),
+  "fe-context-menu-hand-rolled": (content) => handRolledContextMenu(content),
+  "fe-selection-hand-rolled": (content) => handRolledSelection(content)
 };
 var FIXERS = {
   "fe-name-input-capitalize": (line, file) => {
@@ -2033,6 +2091,38 @@ function unboundedRemoteList(content) {
   }
   return out;
 }
+var MENU_HANDLER = /onContextMenu|addEventListener\(\s*["'`]contextmenu["'`]|@contextmenu|on:contextmenu/;
+var MENU_POINT = /\bclient[XY]\b|\bpage[XY]\b/;
+var MENU_STATE = /\bset(?:ContextMenu|Menu(?:Pos|Position|Point|Anchor|Coords|Origin|At)?)\b|\bmenu(?:Pos|Position|Point|Anchor|Coords)\s*[:=]/i;
+var MENU_MITIGATED = /@enigmax\/primitives|createContextMenu|useContextMenuContext|<ContextMenu|ContextMenu\.|radix-ui|@headlessui|@szhsin\/react-menu|primereact|@mui\/material|antd|enigma:allow-hand-rolled-menu/;
+function handRolledContextMenu(content) {
+  if (MENU_MITIGATED.test(content)) return [];
+  if (!MENU_HANDLER.test(content) || !MENU_POINT.test(content) || !MENU_STATE.test(content)) return [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line)) continue;
+    if (!MENU_HANDLER.test(line)) continue;
+    return [{ line: i + 1, detail: "a contextmenu handler, pointer coordinates and the state holding them" }];
+  }
+  return [];
+}
+var SELECT_RANGE_KEY = /\bshiftKey\b/;
+var SELECT_ADD_KEY = /\bctrlKey\b|\bmetaKey\b/;
+var SELECT_STATE = /\bset(?:Selected|Selection|SelectedIds|SelectedRows|Checked)\b|\bselected(?:Ids|Rows|Keys|Items)\b/;
+var SELECT_MITIGATED = /@enigmax\/primitives|createSelection|useSelection|<SelectionList|enigma:allow-hand-rolled-selection/;
+function handRolledSelection(content) {
+  if (SELECT_MITIGATED.test(content)) return [];
+  if (!SELECT_RANGE_KEY.test(content) || !SELECT_ADD_KEY.test(content) || !SELECT_STATE.test(content)) return [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line)) continue;
+    if (!SELECT_RANGE_KEY.test(line)) continue;
+    return [{ line: i + 1, detail: "Shift and Ctrl over a set of selected ids" }];
+  }
+  return [];
+}
 var CLIP_ONE_LINE = /\btruncate\b|\btext-ellipsis\b|text-overflow\s*:\s*ellipsis/;
 var DYNAMIC_CHILD = /(?<![=!<>-])>\s*\{(?![#/:@])/;
 var VALUE_REACHABLE = /\btitle\s*=|aria-label\s*=|<\s*Tooltip|TooltipTrigger|data-tooltip|hoverCard|HoverCard/i;
@@ -2610,6 +2700,8 @@ export {
   extensionImports,
   findProjectRoot,
   formatFindings,
+  handRolledContextMenu,
+  handRolledSelection,
   loadRules,
   missingPathAlias,
   missingWindowsHide,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.38.0",
+  "version": "1.40.1",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {