enigma-cli 1.43.0 → 1.45.0

package/dist/guardrails.js

@@ -177,6 +177,42 @@ var BUILTIN_RULES = [
     severity: "warn",
     skill: "frontend-policy"
   },
+  {
+    id: "fe-scroll-chaining",
+    label: "A scroll region contains its own scroll",
+    files: ["*.css", "*.scss", "*.less", "*.tsx", "*.jsx", "*.astro", "*.vue", "*.svelte"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "*.stories.*",
+      "*.min.js",
+      "*.min.css",
+      "**/tests/**",
+      "tests/**",
+      "**/__tests__/**",
+      "__tests__/**",
+      "**/dist/**",
+      "dist/**",
+      "**/build/**",
+      "build/**",
+      "**/node_modules/**",
+      "node_modules/**",
+      "**/vendor/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    // A VERTICAL scroll container, in CSS or in Tailwind. `overflow-x` is left alone: a wide
+    // table scrolling sideways chains into nothing anybody notices, and including it doubled
+    // the rule's noise for no defect.
+    pattern: "overflow(-y)?\\s*:\\s*(auto|scroll)|\\boverflow-y-(auto|scroll)\\b",
+    // Any mention anywhere in the file, in either spelling, and the file has clearly thought
+    // about it - one declaration usually covers the pane the rule is about.
+    absent: "overscroll-behavior|\\boverscroll-(y-)?(contain|none|auto)\\b|enigma:allow-scroll-chaining",
+    message: "This file makes something scroll but never mentions overscroll-behavior, so its scroll CHAINS: the wheel reaches the end of this box and keeps going into whatever is behind it. In a two-pane view - a list beside the record, a tree beside the editor, a thread beside the conversation - that is the reading pane dragging the list along with it, which is the single most-missed part of a multi-pane layout because it only shows up once content is long enough to reach an end. Add `overscroll-behavior: contain` (Tailwind `overscroll-contain`) to the scroll container, and check the other two halves while you are there: the shell is the viewport (`height: 100dvh; overflow: hidden`) and each pane carries `min-height: 0`, or the pane grows instead of scrolling and the page scrolls in its place. Deliberate - a page-level scroller, or an effect that must reach the browser - mark it `enigma:allow-scroll-chaining` (frontend-policy).",
+    severity: "warn",
+    skill: "frontend-policy"
+  },
   {
     id: "fe-pointer-capture-drag",
     label: "Drag bound to window, not setPointerCapture",
@@ -1063,6 +1099,60 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "frontend-policy"
   },
+  {
+    id: "fe-lightbox-hand-rolled",
+    label: "Image viewers come from the primitive",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.ts", "*.js"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.min.js",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    fileCheck: "fe-lightbox-hand-rolled",
+    message: "A lightbox written by hand: a picture in a dialog, a wheel that scales it, and a zoom kept as state. The tail is long and always the same. A wheel listener is PASSIVE by default, so every notch zooms the image and scrolls the article behind the backdrop with it. Scaling around the frame's centre slides whatever was under the pointer away from it, so zooming into a face means hunting for it again. Nothing bounds the pan, so a drag strands the picture off screen with no way back but closing. The dialog is left in the page rather than portalled, and the first ancestor with `overflow: hidden` clips it. Escape does not close it, the body still scrolls under it, and focus never returns to the image it was opened from. `enigma add image` (@enigmax/primitives) is `<Image>`: a press enlarges it and the wheel zooms around the cursor by default, with a drag to pan, a pinch on touch and the keyboard driving both - and the arrows, the strip of previews, a download menu and a discard action off until asked for. The viewer is its own chunk, fetched on intent, so a page of images nobody enlarges downloads none of it. Mark the line `enigma:allow-hand-rolled-lightbox` when the viewer genuinely has to be your own (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
+  {
+    id: "fe-video-player-hand-rolled",
+    label: "Video controls come from the primitive",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.ts", "*.js"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.min.js",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    stage: "diff",
+    fileCheck: "fe-video-player-hand-rolled",
+    message: "Controls written by hand over a `<video>`. What follows is the same every time: `play()` returns a promise that REJECTS - no gesture yet, an autoplay policy, no source - and the unhandled rejection leaves the button saying pause over a video that never started; the state is kept in the component instead of read back from the element's own events, so anything else that plays or pauses it (the media keys, picture in picture, the operating system) desynchronises the bar; the scrubber is a div with a click handler rather than a slider a keyboard can drive or a screen reader can read; the buffered ranges are ignored, or read as `buffered.end(0)`, which reports a range nobody is watching; the clock changes width as it passes ten minutes and shoves every control along with it; the shortcuts fire while somebody is typing in a comment box; and fullscreen calls `requestFullscreen` on a container, which iOS Safari does not have at all. `enigma add video` (@enigmax/primitives) is `<Video>`, shaped after Plyr: the same control set and the same shortcuts, the element as the source of truth, and a theme restyled through `data-*` attributes. Mark the line `enigma:allow-hand-rolled-video-player` when the player genuinely has to be your own (frontend-policy).",
+    severity: "block",
+    skill: "frontend-policy"
+  },
   {
     id: "sec-2fa-reauth-prompt",
     label: "A credential just proven is not asked for again",
@@ -1971,6 +2061,8 @@ var FILE_CHECKS = {
   "fe-context-menu-hand-rolled": (content) => handRolledContextMenu(content),
   "fe-selection-hand-rolled": (content) => handRolledSelection(content),
   "fe-color-picker-hand-rolled": (content) => handRolledColorPicker(content),
+  "fe-lightbox-hand-rolled": (content) => handRolledLightbox(content),
+  "fe-video-player-hand-rolled": (content) => handRolledVideoPlayer(content),
   "sec-2fa-reauth-prompt": (content) => twoFactorPasswordPrompt(content),
   "fe-select-hand-rolled": (content) => handRolledSelect(content),
   "fe-toast-hand-rolled": (content) => handRolledToast(content),
@@ -2280,6 +2372,42 @@ function handRolledColorPicker(content) {
   }
   return [];
 }
+var LIGHTBOX_IMAGE = /<img\b|<Image\b|createElement\(\s*["'`]img["'`]/;
+var LIGHTBOX_WHEEL = /onWheel|@wheel|on:wheel|addEventListener\(\s*["'`]wheel["'`]/;
+var LIGHTBOX_ZOOM = /\bset(?:Scale|Zoom)\b|\b(?:scale|zoom)\s*[:=]\s*[0-9(]|scale\(/;
+var LIGHTBOX_DIALOG = /role=["']dialog["']|aria-modal|lightbox|createPortal|["']Escape["']|backdrop/i;
+var LIGHTBOX_MITIGATED = /@enigmax\/primitives|data-enigma-image|ImageViewer\b|yet-another-react-lightbox|react-image-lightbox|photoswipe|medium-zoom|viewerjs|fancybox|lightgallery|react-medium-image-zoom|enigma:allow-hand-rolled-lightbox/i;
+function handRolledLightbox(content) {
+  if (LIGHTBOX_MITIGATED.test(content)) return [];
+  if (!LIGHTBOX_IMAGE.test(content) || !LIGHTBOX_WHEEL.test(content)) return [];
+  if (!LIGHTBOX_ZOOM.test(content) || !LIGHTBOX_DIALOG.test(content)) return [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line)) continue;
+    if (!LIGHTBOX_WHEEL.test(line)) continue;
+    return [{ line: i + 1, detail: "a picture in a dialog, a wheel that scales it, and the zoom it keeps" }];
+  }
+  return [];
+}
+var VIDEO_ELEMENT = /<video\b|createElement\(\s*["'`]video["'`]|HTMLVideoElement/;
+var VIDEO_DRIVEN = /\.play\(\)|\.pause\(\)|\bplaybackRate\b|requestPictureInPicture/;
+var VIDEO_TIMELINE = /\bcurrentTime\b|timeupdate|\.buffered\b/i;
+var VIDEO_CONTROLS = /aria-label=["'](?:Play|Pause|Mute|Seek|Fullscreen)|onClick=\{[^}]*(?:play|pause)|requestFullscreen|toggleFullscreen|isPlaying|setPlaying/i;
+var VIDEO_MITIGATED = /@enigmax\/primitives|data-enigma-video|["'`]plyr|from\s+["'`]plyr|video\.js|videojs|react-player|vidstack|media-chrome|@vime|shaka-player|enigma:allow-hand-rolled-video-player/i;
+function handRolledVideoPlayer(content) {
+  if (VIDEO_MITIGATED.test(content)) return [];
+  if (!VIDEO_ELEMENT.test(content) || !VIDEO_DRIVEN.test(content)) return [];
+  if (!VIDEO_TIMELINE.test(content) || !VIDEO_CONTROLS.test(content)) return [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line)) continue;
+    if (!VIDEO_DRIVEN.test(line)) continue;
+    return [{ line: i + 1, detail: "a video element, its playback driven by code, and a bar of controls over it" }];
+  }
+  return [];
+}
 var TWOFA_SUBJECT = /2fa|two[-_ ]?factor|totp|mfa|authenticator|otpauth/i;
 var TWOFA_ENROLL = /enroll?(?!ed)|set[-_ ]?up|activate(?!d)|enable(?!d)|provision(?!ed)/i;
 var TWOFA_PASSWORD = /type=["']password["']|\bpassword\s*[:=]|\bpassword\b\s*[,)]|currentPassword|current_password/i;
@@ -2930,10 +3058,12 @@ export {
   formatFindings,
   handRolledColorPicker,
   handRolledContextMenu,
+  handRolledLightbox,
   handRolledPalette,
   handRolledSelect,
   handRolledSelection,
   handRolledToast,
+  handRolledVideoPlayer,
   loadRules,
   missingPathAlias,
   missingWindowsHide,

package/dist/post-edit.js

@@ -569,10 +569,12 @@ __export(guardrails_exports, {
   formatFindings: () => formatFindings,
   handRolledColorPicker: () => handRolledColorPicker,
   handRolledContextMenu: () => handRolledContextMenu,
+  handRolledLightbox: () => handRolledLightbox,
   handRolledPalette: () => handRolledPalette,
   handRolledSelect: () => handRolledSelect,
   handRolledSelection: () => handRolledSelection,
   handRolledToast: () => handRolledToast,
+  handRolledVideoPlayer: () => handRolledVideoPlayer,
   loadRules: () => loadRules,
   missingPathAlias: () => missingPathAlias,
   missingWindowsHide: () => missingWindowsHide,
@@ -845,6 +847,32 @@ function handRolledColorPicker(content) {
   }
   return [];
 }
+function handRolledLightbox(content) {
+  if (LIGHTBOX_MITIGATED.test(content)) return [];
+  if (!LIGHTBOX_IMAGE.test(content) || !LIGHTBOX_WHEEL.test(content)) return [];
+  if (!LIGHTBOX_ZOOM.test(content) || !LIGHTBOX_DIALOG.test(content)) return [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line)) continue;
+    if (!LIGHTBOX_WHEEL.test(line)) continue;
+    return [{ line: i + 1, detail: "a picture in a dialog, a wheel that scales it, and the zoom it keeps" }];
+  }
+  return [];
+}
+function handRolledVideoPlayer(content) {
+  if (VIDEO_MITIGATED.test(content)) return [];
+  if (!VIDEO_ELEMENT.test(content) || !VIDEO_DRIVEN.test(content)) return [];
+  if (!VIDEO_TIMELINE.test(content) || !VIDEO_CONTROLS.test(content)) return [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || /enigma:/.test(line)) continue;
+    if (!VIDEO_DRIVEN.test(line)) continue;
+    return [{ line: i + 1, detail: "a video element, its playback driven by code, and a bar of controls over it" }];
+  }
+  return [];
+}
 function twoFactorPasswordPrompt(content) {
   if (TWOFA_MITIGATED.test(content)) return [];
   if (!TWOFA_SUBJECT.test(content) || !TWOFA_ENROLL.test(content)) return [];
@@ -1434,7 +1462,7 @@ enigma-guardrails: BLOCKED - ${r.blocks.length} convention violation(s):`);
   console.log(`enigma-guardrails: ${r.count} ${all ? "tracked" : "staged"} file(s) checked, no blocking violations.`);
   return 0;
 }
-var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, INTERNAL_MODULE, globCache, DIFF_HUNK, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
+var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, LIGHTBOX_IMAGE, LIGHTBOX_WHEEL, LIGHTBOX_ZOOM, LIGHTBOX_DIALOG, LIGHTBOX_MITIGATED, VIDEO_ELEMENT, VIDEO_DRIVEN, VIDEO_TIMELINE, VIDEO_CONTROLS, VIDEO_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, INTERNAL_MODULE, globCache, DIFF_HUNK, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
 var init_guardrails = __esm({
   "src/guardrails.ts"() {
     "use strict";
@@ -1609,6 +1637,42 @@ var init_guardrails = __esm({
         severity: "warn",
         skill: "frontend-policy"
       },
+      {
+        id: "fe-scroll-chaining",
+        label: "A scroll region contains its own scroll",
+        files: ["*.css", "*.scss", "*.less", "*.tsx", "*.jsx", "*.astro", "*.vue", "*.svelte"],
+        excludeFiles: [
+          "*.test.*",
+          "*.spec.*",
+          "*.stories.*",
+          "*.min.js",
+          "*.min.css",
+          "**/tests/**",
+          "tests/**",
+          "**/__tests__/**",
+          "__tests__/**",
+          "**/dist/**",
+          "dist/**",
+          "**/build/**",
+          "build/**",
+          "**/node_modules/**",
+          "node_modules/**",
+          "**/vendor/**",
+          "vendor/**"
+        ],
+        scope: "file",
+        stage: "diff",
+        // A VERTICAL scroll container, in CSS or in Tailwind. `overflow-x` is left alone: a wide
+        // table scrolling sideways chains into nothing anybody notices, and including it doubled
+        // the rule's noise for no defect.
+        pattern: "overflow(-y)?\\s*:\\s*(auto|scroll)|\\boverflow-y-(auto|scroll)\\b",
+        // Any mention anywhere in the file, in either spelling, and the file has clearly thought
+        // about it - one declaration usually covers the pane the rule is about.
+        absent: "overscroll-behavior|\\boverscroll-(y-)?(contain|none|auto)\\b|enigma:allow-scroll-chaining",
+        message: "This file makes something scroll but never mentions overscroll-behavior, so its scroll CHAINS: the wheel reaches the end of this box and keeps going into whatever is behind it. In a two-pane view - a list beside the record, a tree beside the editor, a thread beside the conversation - that is the reading pane dragging the list along with it, which is the single most-missed part of a multi-pane layout because it only shows up once content is long enough to reach an end. Add `overscroll-behavior: contain` (Tailwind `overscroll-contain`) to the scroll container, and check the other two halves while you are there: the shell is the viewport (`height: 100dvh; overflow: hidden`) and each pane carries `min-height: 0`, or the pane grows instead of scrolling and the page scrolls in its place. Deliberate - a page-level scroller, or an effect that must reach the browser - mark it `enigma:allow-scroll-chaining` (frontend-policy).",
+        severity: "warn",
+        skill: "frontend-policy"
+      },
       {
         id: "fe-pointer-capture-drag",
         label: "Drag bound to window, not setPointerCapture",
@@ -2495,6 +2559,60 @@ var init_guardrails = __esm({
         severity: "block",
         skill: "frontend-policy"
       },
+      {
+        id: "fe-lightbox-hand-rolled",
+        label: "Image viewers come from the primitive",
+        files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.ts", "*.js"],
+        excludeFiles: [
+          "*.test.*",
+          "*.spec.*",
+          "**/tests/**",
+          "**/__tests__/**",
+          "**/fixtures/**",
+          "*.min.js",
+          "**/dist/**",
+          "**/build/**",
+          "**/node_modules/**",
+          "**/vendor/**",
+          "dist/**",
+          "build/**",
+          "node_modules/**",
+          "vendor/**"
+        ],
+        scope: "file",
+        stage: "diff",
+        fileCheck: "fe-lightbox-hand-rolled",
+        message: "A lightbox written by hand: a picture in a dialog, a wheel that scales it, and a zoom kept as state. The tail is long and always the same. A wheel listener is PASSIVE by default, so every notch zooms the image and scrolls the article behind the backdrop with it. Scaling around the frame's centre slides whatever was under the pointer away from it, so zooming into a face means hunting for it again. Nothing bounds the pan, so a drag strands the picture off screen with no way back but closing. The dialog is left in the page rather than portalled, and the first ancestor with `overflow: hidden` clips it. Escape does not close it, the body still scrolls under it, and focus never returns to the image it was opened from. `enigma add image` (@enigmax/primitives) is `<Image>`: a press enlarges it and the wheel zooms around the cursor by default, with a drag to pan, a pinch on touch and the keyboard driving both - and the arrows, the strip of previews, a download menu and a discard action off until asked for. The viewer is its own chunk, fetched on intent, so a page of images nobody enlarges downloads none of it. Mark the line `enigma:allow-hand-rolled-lightbox` when the viewer genuinely has to be your own (frontend-policy).",
+        severity: "block",
+        skill: "frontend-policy"
+      },
+      {
+        id: "fe-video-player-hand-rolled",
+        label: "Video controls come from the primitive",
+        files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.ts", "*.js"],
+        excludeFiles: [
+          "*.test.*",
+          "*.spec.*",
+          "**/tests/**",
+          "**/__tests__/**",
+          "**/fixtures/**",
+          "*.min.js",
+          "**/dist/**",
+          "**/build/**",
+          "**/node_modules/**",
+          "**/vendor/**",
+          "dist/**",
+          "build/**",
+          "node_modules/**",
+          "vendor/**"
+        ],
+        scope: "file",
+        stage: "diff",
+        fileCheck: "fe-video-player-hand-rolled",
+        message: "Controls written by hand over a `<video>`. What follows is the same every time: `play()` returns a promise that REJECTS - no gesture yet, an autoplay policy, no source - and the unhandled rejection leaves the button saying pause over a video that never started; the state is kept in the component instead of read back from the element's own events, so anything else that plays or pauses it (the media keys, picture in picture, the operating system) desynchronises the bar; the scrubber is a div with a click handler rather than a slider a keyboard can drive or a screen reader can read; the buffered ranges are ignored, or read as `buffered.end(0)`, which reports a range nobody is watching; the clock changes width as it passes ten minutes and shoves every control along with it; the shortcuts fire while somebody is typing in a comment box; and fullscreen calls `requestFullscreen` on a container, which iOS Safari does not have at all. `enigma add video` (@enigmax/primitives) is `<Video>`, shaped after Plyr: the same control set and the same shortcuts, the element as the source of truth, and a theme restyled through `data-*` attributes. Mark the line `enigma:allow-hand-rolled-video-player` when the player genuinely has to be your own (frontend-policy).",
+        severity: "block",
+        skill: "frontend-policy"
+      },
       {
         id: "sec-2fa-reauth-prompt",
         label: "A credential just proven is not asked for again",
@@ -3391,6 +3509,8 @@ var init_guardrails = __esm({
       "fe-context-menu-hand-rolled": (content) => handRolledContextMenu(content),
       "fe-selection-hand-rolled": (content) => handRolledSelection(content),
       "fe-color-picker-hand-rolled": (content) => handRolledColorPicker(content),
+      "fe-lightbox-hand-rolled": (content) => handRolledLightbox(content),
+      "fe-video-player-hand-rolled": (content) => handRolledVideoPlayer(content),
       "sec-2fa-reauth-prompt": (content) => twoFactorPasswordPrompt(content),
       "fe-select-hand-rolled": (content) => handRolledSelect(content),
       "fe-toast-hand-rolled": (content) => handRolledToast(content),
@@ -3467,6 +3587,16 @@ var init_guardrails = __esm({
     COLOR_MEASURE = /getBoundingClientRect/;
     COLOR_STATE = /\bset(?:Color|Colour|Hue|Saturation|Lightness|Brightness|Alpha|Opacity)\b|\b(?:hue|saturation)\s*[:=]/i;
     COLOR_MITIGATED = /@enigmax\/primitives|type=["']color["']|react-colorful|react-color|@uiw\/react-color|vue-color|ngx-color|@radix-ui|enigma:allow-hand-rolled-color-picker/;
+    LIGHTBOX_IMAGE = /<img\b|<Image\b|createElement\(\s*["'`]img["'`]/;
+    LIGHTBOX_WHEEL = /onWheel|@wheel|on:wheel|addEventListener\(\s*["'`]wheel["'`]/;
+    LIGHTBOX_ZOOM = /\bset(?:Scale|Zoom)\b|\b(?:scale|zoom)\s*[:=]\s*[0-9(]|scale\(/;
+    LIGHTBOX_DIALOG = /role=["']dialog["']|aria-modal|lightbox|createPortal|["']Escape["']|backdrop/i;
+    LIGHTBOX_MITIGATED = /@enigmax\/primitives|data-enigma-image|ImageViewer\b|yet-another-react-lightbox|react-image-lightbox|photoswipe|medium-zoom|viewerjs|fancybox|lightgallery|react-medium-image-zoom|enigma:allow-hand-rolled-lightbox/i;
+    VIDEO_ELEMENT = /<video\b|createElement\(\s*["'`]video["'`]|HTMLVideoElement/;
+    VIDEO_DRIVEN = /\.play\(\)|\.pause\(\)|\bplaybackRate\b|requestPictureInPicture/;
+    VIDEO_TIMELINE = /\bcurrentTime\b|timeupdate|\.buffered\b/i;
+    VIDEO_CONTROLS = /aria-label=["'](?:Play|Pause|Mute|Seek|Fullscreen)|onClick=\{[^}]*(?:play|pause)|requestFullscreen|toggleFullscreen|isPlaying|setPlaying/i;
+    VIDEO_MITIGATED = /@enigmax\/primitives|data-enigma-video|["'`]plyr|from\s+["'`]plyr|video\.js|videojs|react-player|vidstack|media-chrome|@vime|shaka-player|enigma:allow-hand-rolled-video-player/i;
     TWOFA_SUBJECT = /2fa|two[-_ ]?factor|totp|mfa|authenticator|otpauth/i;
     TWOFA_ENROLL = /enroll?(?!ed)|set[-_ ]?up|activate(?!d)|enable(?!d)|provision(?!ed)/i;
     TWOFA_PASSWORD = /type=["']password["']|\bpassword\s*[:=]|\bpassword\b\s*[,)]|currentPassword|current_password/i;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.43.0",
+  "version": "1.45.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {