enigma-cli 1.46.3 → 1.47.0

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "6b8a924cc11b61d4b45b73384aeb095ce622229359b7cc2c6ce4bb0cf3015ed7"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -7,6 +7,6 @@
     "codeGraph"
   ],
   "updated": "2026-08-15T20:49:24+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "95b7202e5659f8d9d6f11ce29e7dc5b01575ba86c78ef948bec4753ccf430155"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-07-30T19:29:19+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "c9724fdbcdbeab99573be3fd44d4cdd97c2a394d99f3c4395f118f17356b00ed"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-07-29T01:18:36+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "9e30ee7d8a1a1e8c6e7f4e043857cd01841c68a427752e45bc0cad9ec5cfa279"
 }

package/assets/skills/frontend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
   "updated": "2026-09-07T04:01:56+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "8bfd675f3a66dbdcaa7e670bc40246adb0c470b93c1d8677338b4092dfa9ada4"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-08-22T09:25:34+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "cb320a6a5fd3279604ad7920b877c1a36e48f4f39aeead1a4c4daa89901d9ce0"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-09-05T02:46:46+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "d64fe3a4a54f27a71e3066875ee949500f170d04da5c548ef605268a12102afb"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "4c2197954135dd3375f32d839238b82a95c0e93e976ddf5a9cbc4a0cf0146e97"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic technical copy - UI microcopy, descriptions, hints, empty/error states, and README/doc prose that informs without over-explaining or restating the obvious, and never uses a typographic dash.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "a5a228a302f50d975a947b9d84676b4c2a4780f2b222f819388cc98d6a12f207"
 }

package/assets/skills/testing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
   "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-08-11T17:10:56+02:00",
-  "cliVersion": "1.46.3",
+  "cliVersion": "1.47.0",
   "sha": "24928a4c9eed28ebede9f23f746b09a9d3d8176f8fcca61a7780a853fa5bed4e"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "167bfd91adeffc9656744baddcac59173bfafc91dfe537c865cc31d93655f283",
-  "enigma-linux-arm64": "a5764ad80cd3b9c678656d950723f2f76282b7f2b698aaa2af6b497fb2df8725",
-  "enigma-linux-x64": "59778479f1166e1ac62eeafedca1c3216dce26a725d2109dd4f0fbe0dc00d8a6",
-  "enigma-win32-x64.exe": "e4a5dde783e47963abda6b09db0475bc2d6a103e9a2ebfaf7b2cd5fc6fe93a39"
+  "enigma-darwin-arm64": "a7fb66c4f1d421d71822eb1179118e59b35fb77062c53d4453b880b7fe78b2da",
+  "enigma-linux-arm64": "3b0fd51bf5f6160215d0a00f4fb9225b4b6551b5a046250ed457310fc10775c1",
+  "enigma-linux-x64": "b4ca6b52c7a752e45fbc3be2fe3a8cf066c5d214dd184d3e7d9a752781604ab3",
+  "enigma-win32-x64.exe": "c95d6ffbe7985e30f5b0ce761eb1a8e5f230a9c2f6f377324275d114bd7da041"
 }

package/bin/download.mjs

@@ -11,9 +11,9 @@
  * Used by bin/postinstall.mjs (at install) and bin/enigma.mjs (lazy, first run when
  * install scripts were skipped). Node builtins only.
  */
-import { dirname } from "node:path";
 import { createHash } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 
 import {
     ARCH,
@@ -21,6 +21,7 @@ import {
     assetName,
     binTargetPath,
     isWindows,
+    legacyBinTargetPath,
     loadChecksums,
     packageVersion,
     platformKeys
@@ -52,6 +53,54 @@ function sidecarPath() {
     return `${binTargetPath()}.sha256`;
 };
 
+/**
+ * Move an existing binary aside instead of deleting it.
+ *
+ * Windows refuses to delete or overwrite an `.exe` that a running process has mapped as an
+ * image, and it DOES allow renaming one: the live processes keep the image they already
+ * mapped, and the next launch picks up the new file. Deleting first - what this did - failed
+ * precisely when an agent session was open, which is most of the time.
+ */
+function retireBinary(target) {
+    if (!existsSync(target)) return;
+    try {
+        renameSync(target, `${target}.old-${Date.now()}`);
+    } catch {
+        // No rename either (a permission problem rather than a mapped image): fall back to the
+        // delete, and let the rename that follows surface whatever is really wrong.
+        try { unlinkSync(target); } catch { /* reported by the caller's rename */ }
+    }
+};
+
+/**
+ * Delete what this version has finished with. Best-effort: a file still mapped by a live
+ * process refuses to go and is left for the next run.
+ *
+ * Deliberately NOT the sibling version directories. A machine can have enigma installed under
+ * two Node versions at two different versions - which is exactly the setup that made the
+ * per-version directory necessary - and an install that deleted its neighbour's binary would
+ * have the two of them take turns re-downloading 96 MB forever. Superseded versions are left
+ * on disk and reclaimed by `enigma resources`, where the user is already deleting things on
+ * purpose.
+ */
+function sweepStaleBinaries(target) {
+    const versionDir = dirname(target);
+    for (const name of safeReaddir(versionDir)) {
+        if (!/\.old-\d+$/.test(name)) continue;
+        try { unlinkSync(join(versionDir, name)); } catch { /* still mapped by a live process */ }
+    }
+    // The pre-1.46.4 location, inside the npm package: dead weight now, and the file npm used
+    // to trip over on upgrade.
+    for (const path of [legacyBinTargetPath(), `${legacyBinTargetPath()}.sha256`]) {
+        try { unlinkSync(path); } catch { /* absent, or still mapped by an older launcher */ }
+    }
+};
+
+/** readdirSync that answers with an empty list instead of throwing on a missing directory. */
+function safeReaddir(dir) {
+    try { return readdirSync(dir); } catch { return []; }
+};
+
 /** The sha256 this package version expects for the host's asset, or null if none is known. */
 function expectedSha() {
     const choice = selectAsset();
@@ -103,19 +152,19 @@ export async function downloadBinary({ log = () => {} } = {}) {
 
     const actual = createHash("sha256").update(buffer).digest("hex");
     if (actual !== choice.sha256) throw new Error(`Checksum mismatch for ${choice.asset}: expected ${choice.sha256}, got ${actual}.`);
-    
+
     const target = binTargetPath();
     mkdirSync(dirname(target), { recursive: true });
     const tmp = `${target}.download-${process.pid}`;
     writeFileSync(tmp, buffer);
     if (!isWindows) chmodSync(tmp, 0o755);
-    // rename is atomic on POSIX; on Windows it fails over an existing file, so drop it first.
-    if (existsSync(target)) try { unlinkSync(target); } catch { /* in use; rename will surface the error */ }
+    retireBinary(target);
     renameSync(tmp, target);
+    sweepStaleBinaries(target);
     // Record the installed sha so installedBinary() can detect a stale binary after an
     // update without re-hashing the whole file on every launch. Best-effort: a missing
     // sidecar just triggers one extra re-download next time.
     try { writeFileSync(sidecarPath(), choice.sha256); } catch { /* sidecar is best-effort */ }
     log(`Installed ${choice.asset} -> ${target}`);
     return target;
-};
+};

package/bin/platform.mjs

@@ -59,9 +59,45 @@ export function assetName(key) {
     return `enigma-${key}${isWindows ? ".exe" : ""}`;
 };
 
-/** On-disk path of the installed binary inside this package's bin/ directory. */
+/** File name of the compiled binary for this host. */
+const binName = () => (isWindows ? "enigma-bin.exe" : "enigma-bin");
+
+/**
+ * Directory the compiled binaries live in, one subdirectory per package version.
+ *
+ * Deliberately OUTSIDE the npm package, and this is the whole point of it. npm copies a
+ * package's directory aside before replacing it, and Windows refuses to copy or delete an
+ * `.exe` that a running process has mapped as an image - so keeping a 96 MB binary in
+ * `<pkg>/bin` made `npm i -g enigma-cli@latest` fail with EBUSY for anyone holding an agent
+ * session open, which on a machine running several is always. Nothing npm touches can hold
+ * the binary any more.
+ *
+ * Per VERSION because a machine can have enigma installed under more than one Node version
+ * (nvm), and a single shared path would have the two installs overwrite each other's binary
+ * and re-download on every launch, each seeing the other's checksum as stale.
+ */
+export function binDir() {
+    return join(process.env.ENIGMA_CONFIG_HOME || os.homedir(), ".enigma", "bin");
+};
+
+/**
+ * On-disk path of the installed binary for THIS package version.
+ *
+ * The version is read defensively: this path is resolved on every launch, and an unreadable
+ * package.json must degrade to one shared directory rather than throw and take the CLI with it.
+ */
 export function binTargetPath() {
-    return join(pkgRoot, "bin", isWindows ? "enigma-bin.exe" : "enigma-bin");
+    let version = "unknown";
+    try { version = packageVersion(); } catch { /* fall back to the shared directory */ }
+    return join(binDir(), version, binName());
+};
+
+/**
+ * Where releases up to 1.46.3 put the binary: inside the package. Kept so a stale copy can be
+ * swept after an upgrade - it is dead weight, and the thing npm used to trip over.
+ */
+export function legacyBinTargetPath() {
+    return join(pkgRoot, "bin", binName());
 };
 
 /** This package's declared version (release tag is `v<version>`). */
@@ -78,4 +114,4 @@ export function loadChecksums() {
     } catch {
         return {};
     }
-};
+};

package/dist/codegraph-hook.js

@@ -538,7 +538,7 @@ var init_codegraph_rank = __esm({
 });
 
 // src/codegraph-extract.ts
-import { execFileSync } from "child_process";
+import { execFileSync as execFileSync2 } from "child_process";
 import { extname, join as join4, relative as relative2, resolve as resolve2 } from "path";
 import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
 function symRules(lang) {
@@ -830,7 +830,7 @@ function extractFile(lang, content) {
 }
 function gitList(root, args) {
   try {
-    return execFileSync("git", ["-C", root, "ls-files", ...args, "-z"], {
+    return execFileSync2("git", ["-C", root, "ls-files", ...args, "-z"], {
       encoding: "utf8",
       maxBuffer: 64 * 1024 * 1024,
       stdio: ["ignore", "pipe", "ignore"],
@@ -2246,6 +2246,24 @@ var init_codegraph_format = __esm({
 
 // src/codegraph-hook.ts
 import { homedir as homedir3 } from "os";
+
+// src/governor.ts
+import { execFileSync } from "child_process";
+import { cpus, totalmem, freemem, setPriority } from "os";
+function priorityValue(priority) {
+  return priority === "idle" ? 19 : 10;
+}
+function deprioritize(child) {
+  if (child.pid === void 0) return false;
+  try {
+    setPriority(child.pid, priorityValue("below-normal"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/codegraph-hook.ts
 import { spawn } from "child_process";
 import { basename as basename2, join as join7, relative as relative3, resolve as resolve4 } from "path";
 
@@ -2400,6 +2418,7 @@ function backgroundIndex(cg, dir) {
   if (cg.isManagedPath(dir) || !claimIndex(dir)) return;
   try {
     const child = spawn(process.execPath, [process.argv[1], "codegraph", "index", dir], { detached: true, stdio: "ignore", windowsHide: true });
+    deprioritize(child);
     child.unref();
   } catch {
   }

package/dist/guardrails.js

@@ -777,6 +777,55 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "frontend-policy"
   },
+  {
+    id: "fe-mutation-without-optimistic",
+    label: "A mutation that leaves the UI waiting",
+    files: ["*.tsx", "*.jsx", "*.vue", "*.svelte"],
+    excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**", "**/dist/**", "dist/**", "**/build/**", "build/**", "**/.next/**", ".next/**", "**/node_modules/**"],
+    scope: "file",
+    // DIFF stage for the same reason as the rule above, and more urgently: the measured
+    // backlog is 116 of 140 mutating files with no optimistic update at all, so an
+    // edit-stage version of this would fire on almost every UI file forever. Against the
+    // lines a turn ADDED there is no backlog - it fires on a handler just written.
+    stage: "diff",
+    fileCheck: "fe-mutation-without-optimistic",
+    message: "This handler sends the mutation and then updates nothing: whatever the user sees has to come back from the server, so the interface sits still for the whole round trip on an action that usually cannot fail in an interesting way. Apply the change to local state FIRST, then send the request, and on failure restore the value you saved and say what failed - a silent revert is worse than the wait. A refetch, a revalidation or a router refresh after the await is the same wait wearing a different name. Mark the line `enigma:allow-server-first` when the response is genuinely required before the UI may change (a payment, a server-assigned identifier, an irreversible action) (frontend-policy).",
+    // Warn, not block: waiting is a defect for a save, a toggle or a delete and correct for
+    // a payment, and nothing in the file separates them. The sibling rule blocks because it
+    // has evidence; this one only has an absence, so it says its piece and gets out of the way.
+    severity: "warn",
+    skill: "frontend-policy"
+  },
+  {
+    id: "perf-unbounded-fanout",
+    label: "Parallel work over a list nobody counted",
+    files: ["*.ts", "*.tsx", "*.mts", "*.cts", "*.js", "*.jsx", "*.mjs", "*.cjs"],
+    excludeFiles: [
+      "*.test.*",
+      "*.spec.*",
+      "**/tests/**",
+      "**/__tests__/**",
+      "**/fixtures/**",
+      "*.min.js",
+      "*.d.ts",
+      "**/dist/**",
+      "**/build/**",
+      "**/node_modules/**",
+      "**/vendor/**",
+      "dist/**",
+      "build/**",
+      "node_modules/**",
+      "vendor/**"
+    ],
+    scope: "file",
+    // DIFF stage: an existing fan-out has been running in production and is somebody's
+    // decision; the one a turn just wrote is the one nobody has counted yet.
+    stage: "diff",
+    fileCheck: "perf-unbounded-fanout",
+    message: "This starts one expensive operation per element of a list whose length nothing here bounds - a process, a socket, a file handle or a database round trip, times however many the glob, the query or the response happened to return. It is fine for the ten items you have in mind and takes the machine down for the fifty thousand it may actually get. Cap the concurrency (a limiter, a `concurrency` option, or process the list in chunks) so the number is a decision instead of an accident, or say why the list is small enough not to need one.",
+    severity: "warn",
+    skill: "core-engineering-policy"
+  },
   {
     id: "fe-textarea-size-bounds",
     label: "Textarea declares a minimum and a maximum size",
@@ -2048,6 +2097,8 @@ function newPasswordAffordanceOnSignIn(content) {
 var FILE_CHECKS = {
   "proc-windows-hide": (content) => missingWindowsHide(content),
   "fe-server-first-mutation": (content) => serverFirstMutation(content),
+  "fe-mutation-without-optimistic": (content) => mutationWithoutOptimisticUpdate(content),
+  "perf-unbounded-fanout": (content) => unboundedFanout(content),
   "fe-textarea-size-bounds": (content) => textareaSizeBounds(content),
   "fe-view-blanked-while-loading": (content) => viewBlankedWhileLoading(content),
   "fe-truncated-value-unreachable": (content) => truncatedValueUnreachable(content),
@@ -2219,6 +2270,45 @@ function serverFirstMutation(content) {
   }
   return out;
 }
+var REVALIDATE_AFTER = /\brouter\.refresh\s*\(|\brevalidatePath\s*\(|\brevalidateTag\s*\(|\binvalidateQueries\s*\(|\binvalidateAll\s*\(|\brefetch\s*\(|\bmutate\s*\(\s*[)"'`]/;
+function mutationWithoutOptimisticUpdate(content) {
+  if (OPTIMISTIC_SIGNAL.test(content)) return [];
+  const lines = content.split("\n");
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || !MUTATING_REQUEST.test(line)) continue;
+    const { start, end } = enclosingBlock(lines, i);
+    const body = lines.slice(start, end + 1);
+    if (body.some((l) => ALLOW_SERVER_FIRST.test(l))) continue;
+    if (body.some((l) => !COMMENT_LINE.test(l) && ENTITY_WRITE.test(l))) continue;
+    const reload = lines.slice(i + 1, end + 1).find((l) => !COMMENT_LINE.test(l) && REVALIDATE_AFTER.test(l));
+    if (reload) out.push({ line: i + 1, detail: `the screen only changes once the server answers: ${reload.trim().slice(0, 80)}` });
+  }
+  return out;
+}
+var PROMISE_FANOUT = /\bPromise\.(all|allSettled)\s*\(/;
+var FANOUT_LITERAL = /\bPromise\.(all|allSettled)\s*\(\s*\[/;
+var FANOUT_MAPPED = /\.\s*map\s*\(/;
+var FANOUT_OVER_OBJECT = /\bObject\.(values|keys|entries)\s*\(/;
+var EXPENSIVE_PER_ITEM = /\b(?:fetch|spawn|spawnSync|exec|execSync|execFile|execFileSync|request)\s*\(|\b(?:readFile|writeFile|readFileSync|writeFileSync|copyFile|rm|mkdir)\s*\(|\.\s*(?:query|findMany|aggregate|createMany|send|upload|download)\s*\(/;
+var CONCURRENCY_BOUND = /\bp-?[Ll]imit\b|\bpMap\b|\bBottleneck\b|\bSemaphore\b|\bconcurrency\b|\bchunk(?:ed|s)?\s*\(|\bbatch(?:ed|es)?\s*\(/;
+var FANOUT_WINDOW = 6;
+function unboundedFanout(content) {
+  if (CONCURRENCY_BOUND.test(content)) return [];
+  const lines = content.split("\n");
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || !PROMISE_FANOUT.test(line) || FANOUT_LITERAL.test(line)) continue;
+    const window = lines.slice(i, Math.min(lines.length, i + FANOUT_WINDOW)).filter((l) => !COMMENT_LINE.test(l));
+    const text = window.join("\n");
+    if (!FANOUT_MAPPED.test(text) || FANOUT_OVER_OBJECT.test(text)) continue;
+    const heavy = EXPENSIVE_PER_ITEM.exec(text);
+    if (heavy) out.push({ line: i + 1, detail: `one ${heavy[0].replace(/[\s(.]/g, "")} per element, and nothing says how many elements there are` });
+  }
+  return out;
+}
 var TEXTAREA = /<textarea\b/;
 var TEXTAREA_LOWER = /\brows\s*=|\brows:\s*\d|min-h-|min-height|minHeight|\bh-\[|\bh-\d|height\s*:\s*\d/;
 var TEXTAREA_UPPER = /max-h-|max-height|maxHeight/;
@@ -3067,6 +3157,7 @@ export {
   loadRules,
   missingPathAlias,
   missingWindowsHide,
+  mutationWithoutOptimisticUpdate,
   newPasswordAffordanceOnSignIn,
   operatorHomePathLeak,
   pageAwaitWithoutBoundary,
@@ -3082,6 +3173,7 @@ export {
   textareaSizeBounds,
   truncatedValueUnreachable,
   twoFactorPasswordPrompt,
+  unboundedFanout,
   unboundedRemoteList,
   viewBlankedWhileLoading,
   wideNamedImports

package/dist/post-edit.js

@@ -578,6 +578,7 @@ __export(guardrails_exports, {
   loadRules: () => loadRules,
   missingPathAlias: () => missingPathAlias,
   missingWindowsHide: () => missingWindowsHide,
+  mutationWithoutOptimisticUpdate: () => mutationWithoutOptimisticUpdate,
   newPasswordAffordanceOnSignIn: () => newPasswordAffordanceOnSignIn,
   operatorHomePathLeak: () => operatorHomePathLeak,
   pageAwaitWithoutBoundary: () => pageAwaitWithoutBoundary,
@@ -593,6 +594,7 @@ __export(guardrails_exports, {
   textareaSizeBounds: () => textareaSizeBounds,
   truncatedValueUnreachable: () => truncatedValueUnreachable,
   twoFactorPasswordPrompt: () => twoFactorPasswordPrompt,
+  unboundedFanout: () => unboundedFanout,
   unboundedRemoteList: () => unboundedRemoteList,
   viewBlankedWhileLoading: () => viewBlankedWhileLoading,
   wideNamedImports: () => wideNamedImports
@@ -736,6 +738,37 @@ function serverFirstMutation(content) {
   }
   return out;
 }
+function mutationWithoutOptimisticUpdate(content) {
+  if (OPTIMISTIC_SIGNAL.test(content)) return [];
+  const lines = content.split("\n");
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || !MUTATING_REQUEST.test(line)) continue;
+    const { start, end } = enclosingBlock(lines, i);
+    const body = lines.slice(start, end + 1);
+    if (body.some((l) => ALLOW_SERVER_FIRST.test(l))) continue;
+    if (body.some((l) => !COMMENT_LINE.test(l) && ENTITY_WRITE.test(l))) continue;
+    const reload = lines.slice(i + 1, end + 1).find((l) => !COMMENT_LINE.test(l) && REVALIDATE_AFTER.test(l));
+    if (reload) out.push({ line: i + 1, detail: `the screen only changes once the server answers: ${reload.trim().slice(0, 80)}` });
+  }
+  return out;
+}
+function unboundedFanout(content) {
+  if (CONCURRENCY_BOUND.test(content)) return [];
+  const lines = content.split("\n");
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (COMMENT_LINE.test(line) || !PROMISE_FANOUT.test(line) || FANOUT_LITERAL.test(line)) continue;
+    const window = lines.slice(i, Math.min(lines.length, i + FANOUT_WINDOW)).filter((l) => !COMMENT_LINE.test(l));
+    const text = window.join("\n");
+    if (!FANOUT_MAPPED.test(text) || FANOUT_OVER_OBJECT.test(text)) continue;
+    const heavy = EXPENSIVE_PER_ITEM.exec(text);
+    if (heavy) out.push({ line: i + 1, detail: `one ${heavy[0].replace(/[\s(.]/g, "")} per element, and nothing says how many elements there are` });
+  }
+  return out;
+}
 function textareaSizeBounds(content) {
   const lower = TEXTAREA_LOWER.test(content);
   const upper = TEXTAREA_UPPER.test(content);
@@ -1462,7 +1495,7 @@ enigma-guardrails: BLOCKED - ${r.blocks.length} convention violation(s):`);
   console.log(`enigma-guardrails: ${r.count} ${all ? "tracked" : "staged"} file(s) checked, no blocking violations.`);
   return 0;
 }
-var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, LIGHTBOX_IMAGE, LIGHTBOX_WHEEL, LIGHTBOX_ZOOM, LIGHTBOX_DIALOG, LIGHTBOX_MITIGATED, VIDEO_ELEMENT, VIDEO_DRIVEN, VIDEO_TIMELINE, VIDEO_CONTROLS, VIDEO_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, INTERNAL_MODULE, globCache, DIFF_HUNK, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
+var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, REVALIDATE_AFTER, PROMISE_FANOUT, FANOUT_LITERAL, FANOUT_MAPPED, FANOUT_OVER_OBJECT, EXPENSIVE_PER_ITEM, CONCURRENCY_BOUND, FANOUT_WINDOW, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, LIGHTBOX_IMAGE, LIGHTBOX_WHEEL, LIGHTBOX_ZOOM, LIGHTBOX_DIALOG, LIGHTBOX_MITIGATED, VIDEO_ELEMENT, VIDEO_DRIVEN, VIDEO_TIMELINE, VIDEO_CONTROLS, VIDEO_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, INTERNAL_MODULE, globCache, DIFF_HUNK, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
 var init_guardrails = __esm({
   "src/guardrails.ts"() {
     "use strict";
@@ -2237,6 +2270,55 @@ var init_guardrails = __esm({
         severity: "block",
         skill: "frontend-policy"
       },
+      {
+        id: "fe-mutation-without-optimistic",
+        label: "A mutation that leaves the UI waiting",
+        files: ["*.tsx", "*.jsx", "*.vue", "*.svelte"],
+        excludeFiles: ["*.test.*", "*.spec.*", "**/tests/**", "**/__tests__/**", "**/dist/**", "dist/**", "**/build/**", "build/**", "**/.next/**", ".next/**", "**/node_modules/**"],
+        scope: "file",
+        // DIFF stage for the same reason as the rule above, and more urgently: the measured
+        // backlog is 116 of 140 mutating files with no optimistic update at all, so an
+        // edit-stage version of this would fire on almost every UI file forever. Against the
+        // lines a turn ADDED there is no backlog - it fires on a handler just written.
+        stage: "diff",
+        fileCheck: "fe-mutation-without-optimistic",
+        message: "This handler sends the mutation and then updates nothing: whatever the user sees has to come back from the server, so the interface sits still for the whole round trip on an action that usually cannot fail in an interesting way. Apply the change to local state FIRST, then send the request, and on failure restore the value you saved and say what failed - a silent revert is worse than the wait. A refetch, a revalidation or a router refresh after the await is the same wait wearing a different name. Mark the line `enigma:allow-server-first` when the response is genuinely required before the UI may change (a payment, a server-assigned identifier, an irreversible action) (frontend-policy).",
+        // Warn, not block: waiting is a defect for a save, a toggle or a delete and correct for
+        // a payment, and nothing in the file separates them. The sibling rule blocks because it
+        // has evidence; this one only has an absence, so it says its piece and gets out of the way.
+        severity: "warn",
+        skill: "frontend-policy"
+      },
+      {
+        id: "perf-unbounded-fanout",
+        label: "Parallel work over a list nobody counted",
+        files: ["*.ts", "*.tsx", "*.mts", "*.cts", "*.js", "*.jsx", "*.mjs", "*.cjs"],
+        excludeFiles: [
+          "*.test.*",
+          "*.spec.*",
+          "**/tests/**",
+          "**/__tests__/**",
+          "**/fixtures/**",
+          "*.min.js",
+          "*.d.ts",
+          "**/dist/**",
+          "**/build/**",
+          "**/node_modules/**",
+          "**/vendor/**",
+          "dist/**",
+          "build/**",
+          "node_modules/**",
+          "vendor/**"
+        ],
+        scope: "file",
+        // DIFF stage: an existing fan-out has been running in production and is somebody's
+        // decision; the one a turn just wrote is the one nobody has counted yet.
+        stage: "diff",
+        fileCheck: "perf-unbounded-fanout",
+        message: "This starts one expensive operation per element of a list whose length nothing here bounds - a process, a socket, a file handle or a database round trip, times however many the glob, the query or the response happened to return. It is fine for the ten items you have in mind and takes the machine down for the fifty thousand it may actually get. Cap the concurrency (a limiter, a `concurrency` option, or process the list in chunks) so the number is a decision instead of an accident, or say why the list is small enough not to need one.",
+        severity: "warn",
+        skill: "core-engineering-policy"
+      },
       {
         id: "fe-textarea-size-bounds",
         label: "Textarea declares a minimum and a maximum size",
@@ -3496,6 +3578,8 @@ var init_guardrails = __esm({
     FILE_CHECKS = {
       "proc-windows-hide": (content) => missingWindowsHide(content),
       "fe-server-first-mutation": (content) => serverFirstMutation(content),
+      "fe-mutation-without-optimistic": (content) => mutationWithoutOptimisticUpdate(content),
+      "perf-unbounded-fanout": (content) => unboundedFanout(content),
       "fe-textarea-size-bounds": (content) => textareaSizeBounds(content),
       "fe-view-blanked-while-loading": (content) => viewBlankedWhileLoading(content),
       "fe-truncated-value-unreachable": (content) => truncatedValueUnreachable(content),
@@ -3545,6 +3629,14 @@ var init_guardrails = __esm({
     RESULT_BINDING = /(?:const|let|var)\s+(\w+)\s*=\s*(?:await\s+)?/;
     BLOCK_LOOKBACK = 120;
     BLOCK_LOOKAHEAD = 200;
+    REVALIDATE_AFTER = /\brouter\.refresh\s*\(|\brevalidatePath\s*\(|\brevalidateTag\s*\(|\binvalidateQueries\s*\(|\binvalidateAll\s*\(|\brefetch\s*\(|\bmutate\s*\(\s*[)"'`]/;
+    PROMISE_FANOUT = /\bPromise\.(all|allSettled)\s*\(/;
+    FANOUT_LITERAL = /\bPromise\.(all|allSettled)\s*\(\s*\[/;
+    FANOUT_MAPPED = /\.\s*map\s*\(/;
+    FANOUT_OVER_OBJECT = /\bObject\.(values|keys|entries)\s*\(/;
+    EXPENSIVE_PER_ITEM = /\b(?:fetch|spawn|spawnSync|exec|execSync|execFile|execFileSync|request)\s*\(|\b(?:readFile|writeFile|readFileSync|writeFileSync|copyFile|rm|mkdir)\s*\(|\.\s*(?:query|findMany|aggregate|createMany|send|upload|download)\s*\(/;
+    CONCURRENCY_BOUND = /\bp-?[Ll]imit\b|\bpMap\b|\bBottleneck\b|\bSemaphore\b|\bconcurrency\b|\bchunk(?:ed|s)?\s*\(|\bbatch(?:ed|es)?\s*\(/;
+    FANOUT_WINDOW = 6;
     TEXTAREA = /<textarea\b/;
     TEXTAREA_LOWER = /\brows\s*=|\brows:\s*\d|min-h-|min-height|minHeight|\bh-\[|\bh-\d|height\s*:\s*\d/;
     TEXTAREA_UPPER = /max-h-|max-height|maxHeight/;
@@ -3646,6 +3738,27 @@ var init_guardrails = __esm({
   }
 });
 
+// src/governor.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { cpus, totalmem, freemem, setPriority } from "os";
+function priorityValue(priority) {
+  return priority === "idle" ? 19 : 10;
+}
+function deprioritize(child) {
+  if (child.pid === void 0) return false;
+  try {
+    setPriority(child.pid, priorityValue("below-normal"));
+    return true;
+  } catch {
+    return false;
+  }
+}
+var init_governor = __esm({
+  "src/governor.ts"() {
+    "use strict";
+  }
+});
+
 // src/repo-keyed-file.ts
 import { dirname as dirname3 } from "path";
 import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, renameSync, rmSync, writeFileSync as writeFileSync4 } from "fs";
@@ -3891,7 +4004,7 @@ var init_codegraph_rank = __esm({
 });
 
 // src/codegraph-extract.ts
-import { execFileSync as execFileSync3 } from "child_process";
+import { execFileSync as execFileSync4 } from "child_process";
 import { extname as extname2, join as join6, relative as relative2, resolve as resolve3 } from "path";
 import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
 function symRules(lang) {
@@ -4183,7 +4296,7 @@ function extractFile(lang, content) {
 }
 function gitList(root, args) {
   try {
-    return execFileSync3("git", ["-C", root, "ls-files", ...args, "-z"], {
+    return execFileSync4("git", ["-C", root, "ls-files", ...args, "-z"], {
       encoding: "utf8",
       maxBuffer: 64 * 1024 * 1024,
       stdio: ["ignore", "pipe", "ignore"],
@@ -5712,6 +5825,7 @@ function backgroundIndex(cg, dir) {
   if (cg.isManagedPath(dir) || !claimIndex(dir)) return;
   try {
     const child = spawn(process.execPath, [process.argv[1], "codegraph", "index", dir], { detached: true, stdio: "ignore", windowsHide: true });
+    deprioritize(child);
     child.unref();
   } catch {
   }
@@ -5794,6 +5908,7 @@ var MIN_PROMPT_CHARS, PROMPT_HITS, STRONG_FLOOR, BROAD_FLOOR, INJECTED_CAP, BLAS
 var init_codegraph_hook = __esm({
   "src/codegraph-hook.ts"() {
     "use strict";
+    init_governor();
     init_repo_keyed_file();
     MIN_PROMPT_CHARS = 12;
     PROMPT_HITS = 3;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.46.3",
+  "version": "1.47.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {