enigma-cli 1.57.2 → 1.59.0

package/README.md

@@ -88,6 +88,9 @@ enigma verify          Check that work reported as finished actually is: scans t
                        exits 1 on findings, 2 when the check could not run. Also runs at turn
                        end, where it additionally checks the reply itself against your
                        output-style level
+enigma design <src>    Reverse-engineer a design system from a URL, a project folder or a git
+                       repo into DESIGN.md and an agent skill installed for your agents
+                       (--ultra: screenshots, motion and hover states via a local Chrome/Edge)
 enigma mcp             Run the context-compression MCP server over stdio
 enigma dashboard|dash  Open the local dashboard (manage enigma; see savings) in your browser (http://enigma,
                        or http://localhost:24282 if :80/hosts is unavailable)

package/assets/commands/gate.md

@@ -131,6 +131,7 @@ What follows from that:
 
   | The change | Run |
   | --- | --- |
+  | Up to `gate-trivial-lines` changed lines (20 by default) in at most 3 files, no sensitive path (auth, dependencies, CI, migrations, env) and no binary | none: `axi run` declines it with `skipped: true` - push the commit as is, without a branch or PR made just for it. `--full` only when the user asked for a full validation |
   | A typo, a comment, a version bump, generated output | `--quick` |
   | Styles, copy, markup - no new logic | `--quick` |
   | Code whose suite you ALREADY ran green this session, over these commits | `--quick`, and name the suite in your report |

package/assets/memory/AGENTS.md

@@ -67,7 +67,7 @@ Non-negotiable, language-agnostic defaults - apply them by default without being
 - Never declare a task complete while any item is pending, stubbed, or unverified. Before saying "done": reconcile against the checklist, build/typecheck the whole artifact, and run `enigma verify` - it checks what you actually produced for unfinished work and runs the project's verification command. For a port, clone, or migration also run `enigma verify parity <source> <target>`, which reports any module that was never carried over. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
 - Implement what was asked at the difficulty it actually has. Never quietly substitute a simplified stand-in because the real thing is tedious or hard - no regex where a real parser is required, no hardcoded special case where the general logic was asked for, no empty module, no "equivalent for now". If a faithful implementation is genuinely impossible here, say so explicitly and say why; downgrading it silently and then reporting success is the single worst outcome.
 - Never offload doable work to the user: "you can adjust/refresh X yourself" in a final report is a hidden deferral. If you can execute the action, do it before reporting; hand off only what genuinely requires the user (credentials, irreversible/destructive choices, business decisions) or what they explicitly approved deferring.
-- A reply that reports work opens with its verdict, first word `Ready`, `Not ready` or `Blocked` in the user's language ("Listo", "No listo", "Bloqueado"), plus the one-line reason; then only the evidence that matters. A yes/no question is answered yes or no first. "Abbreviate", or a repeated question, means shorter, never longer.
+- A work report opens with where each item stands, several as a table (done / missing X / in CI / ~60%), then only the evidence that matters. Estimate time as agent wall-clock from comparable runs, never human-team weeks. A yes/no question is answered yes or no first. "Abbreviate", or a repeated question, means shorter, never longer.
 
 <!-- enigma:parallel-subagents:start -->
 - When subtasks are genuinely independent and your runtime can spawn sub-agents (parallel task or sub-agent tools), delegate them to sub-agents that run in parallel to finish faster, then reconcile their results into a coherent whole. If the runtime has no sub-agent support, execute the subtasks sequentially.
@@ -108,7 +108,7 @@ Prose to the user is compressed at level **{{output-level}}**. It shapes the ANS
 ### AI Quality Gate (Automatic)
 
 - The AI quality gate is active. When you finish a code task and the changes are committed, drive the gate yourself before reporting the work done - on WHATEVER branch the work is on, the default branch included. The user should not have to ask for it.
-- Skip automatic driving only when: the user told you to skip or bypass it, the repo's `.enigma.json` sets `gate: false`, there is nothing committed to validate, or `axi run` refuses the branch as protected (`gate-protected-branches`) - then say so and leave the work unvalidated rather than switching branches on your own. The user's skip is final for that work: do not run it anyway, do not re-offer next turn. To stop it for good the user runs `/gate off` (this project) or `enigma config gate off -g` (everywhere); offer that instead of silently skipping it.
+- Skip automatic driving only when: the user told you to skip or bypass it, the repo's `.enigma.json` sets `gate: false`, there is nothing committed to validate, `axi run` refuses the branch as protected (`gate-protected-branches`), or it declines a trivial change (`gate-trivial-lines`: push that as is, no branch or PR for it) - say so and leave the work unvalidated rather than switching branches on your own. The user's skip is final for that work: do not run it anyway, do not re-offer next turn. To stop it for good the user runs `/gate off` (this project) or `enigma config gate off -g` (everywhere); offer that instead of silently skipping it.
 - Those are the only exits and each has to be NAMED. Asking is not one of them: the gate being on is already the decision, so "tell me if you want me to launch it" ends a turn on a question with one answer. Ending unvalidated and silent is worse. `enigma verify` denies the stop both ways - on a message that reports the gate as skipped, and on commits no run ever saw.
 - On the default branch the pipeline opens no PR and pushes straight to it. That is intended; report it as the outcome instead of waiting for a PR link.
 - If the repo is not initialized yet (`enigma gate axi` says so), run `enigma gate init` yourself, then proceed - a setup step you can perform, never a reason to stop or ask. If `enigma gate` misbehaves, `enigma gate doctor` reports why.

package/assets/memory/CLAUDE.md

@@ -67,7 +67,7 @@ Non-negotiable, language-agnostic defaults - apply them by default without being
 - Never declare a task complete while any item is pending, stubbed, or unverified. Before saying "done": reconcile against the checklist, build/typecheck the whole artifact, and run `enigma verify` - it checks what you actually produced for unfinished work and runs the project's verification command. For a port, clone, or migration also run `enigma verify parity <source> <target>`, which reports any module that was never carried over. If anything remains, say exactly what remains instead of rounding up to "done". Never silently skip or stub an item - record it with a reason and report it.
 - Implement what was asked at the difficulty it actually has. Never quietly substitute a simplified stand-in because the real thing is tedious or hard - no regex where a real parser is required, no hardcoded special case where the general logic was asked for, no empty module, no "equivalent for now". If a faithful implementation is genuinely impossible here, say so explicitly and say why; downgrading it silently and then reporting success is the single worst outcome.
 - Never offload doable work to the user: "you can adjust/refresh X yourself" in a final report is a hidden deferral. If you can execute the action, do it before reporting; hand off only what genuinely requires the user (credentials, irreversible/destructive choices, business decisions) or what they explicitly approved deferring.
-- A reply that reports work opens with its verdict, first word `Ready`, `Not ready` or `Blocked` in the user's language ("Listo", "No listo", "Bloqueado"), plus the one-line reason; then only the evidence that matters. A yes/no question is answered yes or no first. "Abbreviate", or a repeated question, means shorter, never longer.
+- A work report opens with where each item stands, several as a table (done / missing X / in CI / ~60%), then only the evidence that matters. Estimate time as agent wall-clock from comparable runs, never human-team weeks. A yes/no question is answered yes or no first. "Abbreviate", or a repeated question, means shorter, never longer.
 
 <!-- enigma:parallel-subagents:start -->
 - When subtasks are genuinely independent and your runtime can spawn sub-agents (parallel task or sub-agent tools), delegate them to sub-agents that run in parallel to finish faster, then reconcile their results into a coherent whole. If the runtime has no sub-agent support, execute the subtasks sequentially.
@@ -108,7 +108,7 @@ Prose to the user is compressed at level **{{output-level}}**. It shapes the ANS
 ### AI Quality Gate (Automatic)
 
 - The AI quality gate is active. When you finish a code task and the changes are committed, drive the gate yourself before reporting the work done - on WHATEVER branch the work is on, the default branch included. The user should not have to ask for it.
-- Skip automatic driving only when: the user told you to skip or bypass it, the repo's `.enigma.json` sets `gate: false`, there is nothing committed to validate, or `axi run` refuses the branch as protected (`gate-protected-branches`) - then say so and leave the work unvalidated rather than switching branches on your own. The user's skip is final for that work: do not run it anyway, do not re-offer next turn. To stop it for good the user runs `/gate off` (this project) or `enigma config gate off -g` (everywhere); offer that instead of silently skipping it.
+- Skip automatic driving only when: the user told you to skip or bypass it, the repo's `.enigma.json` sets `gate: false`, there is nothing committed to validate, `axi run` refuses the branch as protected (`gate-protected-branches`), or it declines a trivial change (`gate-trivial-lines`: push that as is, no branch or PR for it) - say so and leave the work unvalidated rather than switching branches on your own. The user's skip is final for that work: do not run it anyway, do not re-offer next turn. To stop it for good the user runs `/gate off` (this project) or `enigma config gate off -g` (everywhere); offer that instead of silently skipping it.
 - Those are the only exits and each has to be NAMED. Asking is not one of them: the gate being on is already the decision, so "tell me if you want me to launch it" ends a turn on a question with one answer. Ending unvalidated and silent is worse. `enigma verify` denies the stop both ways - on a message that reports the gate as skipped, and on commits no run ever saw.
 - On the default branch the pipeline opens no PR and pushes straight to it. That is intended; report it as the outcome instead of waiting for a PR link.
 - If the repo is not initialized yet (`enigma gate axi` says so), run `enigma gate init` yourself, then proceed - a setup step you can perform, never a reason to stop or ask. If `enigma gate` misbehaves, `enigma gate doctor` reports why.

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "6b8a924cc11b61d4b45b73384aeb095ce622229359b7cc2c6ce4bb0cf3015ed7"
 }

package/assets/skills/core-engineering-policy/skill.json

@@ -7,6 +7,6 @@
     "codeGraph"
   ],
   "updated": "2026-08-15T20:49:24+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "95b7202e5659f8d9d6f11ce29e7dc5b01575ba86c78ef948bec4753ccf430155"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "648c7ae3d95d5a033f4955a87613e20b40b265bfcc24d41a5732d415abe778f9"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "5d532c2dc467f960ff800c5cd7021db09911599347959cd04481f2054abd9baa"
 }

package/assets/skills/frontend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
   "updated": "2026-10-02T12:11:30+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "2571746934548e64ee30348bbf29b1d971d3afa0a7b32277b137150bf8803f90"
 }

package/assets/skills/git-policy/SKILL.md

@@ -32,6 +32,7 @@ description: Commit, branch, and pull request standards - conventional commits,
 - When in ANY doubt that a branch still holds unmerged, unreleased, or otherwise relevant commits, do NOT delete it - ask the user first. Leaving a stale branch is cheap; losing a branch that held unique work is not.
 - Never delete a protected or long-lived branch (the default branch, release/*, or any branch the repo marks as protected) unless the user explicitly asks.
 - Prune deleted upstreams periodically with `git fetch --prune` so gone remote branches stop lingering locally.
+- Where enigma is installed, clean up with `enigma branches tidy` right after your branch lands instead of deleting by hand: it proves containment by content (squash merges included), clears idle worktrees, merged gate-mirror branches and stale tracking refs, and records every tip so `git branch <name> <sha>` restores it. It also runs on its own after agent turns, at most hourly per repository; a manual run is for the branch you just finished.
 
 ---
 

package/assets/skills/git-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "git-policy",
-  "version": "1.6.0",
+  "version": "1.7.0",
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
-  "updated": "2026-10-02T14:54:11+02:00",
-  "cliVersion": "1.57.2",
-  "sha": "c6ffef058397ac22310053af1f96d768c36eb8761336258cfef2b97cff3fb0e9"
+  "updated": "2026-10-05T14:00:39+02:00",
+  "cliVersion": "1.59.0",
+  "sha": "3863620f77993eff848d52da383cabb658a14a370f4a977929e60af216eb6d8d"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege, object- and role-level checks), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10 with vetted helpers for SSRF, redirects and uploads, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "544359122f127cccedfe469232da915b04f7f4aa4795297281bd4bc9cd07d371"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-10-02T12:38:13+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "ee8447d5ca9e5d77e0a338d1e762c30e1527ded4665c10ddf21f2c4c9ce3f2d5"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic copy for UI, landing/sales, SEO, email and docs - the user's outcome instead of the mechanism, no full enumerations or \"powered by\" lineage, none of the recognizable AI-writing tells, and never a typographic dash.",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "e32623f37f1bf90fa611968ca8b216e3381771254b6af7c81a953c17a8889ddb"
 }

package/assets/skills/testing-policy/SKILL.md

@@ -39,6 +39,7 @@ description: Test strategy (test pyramid), coverage gates, deterministic tests,
 - Test edge cases: empty, null, max size, invalid input, concurrency, and timezone/locale where relevant.
 - Test public behavior and contracts, not private implementation details.
 - For input handling, assert that invalid input is rejected as defined in validation-policy.
+- A UI, flow or load-speed change is checked in a real browser before it is called done, when the `chrome-devtools` MCP tools are available (enigma registers them; `enigma config browser`): open the page, do what the user will do, then read the console and failed network requests, and run a performance trace or Lighthouse audit for speed claims. A passing unit test does not show that a button works, a page renders, or a view loads fast.
 
 ---
 

package/assets/skills/testing-policy/skill.json

@@ -3,7 +3,7 @@
   "version": "1.2.0",
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
-  "updated": "2026-06-16T17:11:49+02:00",
-  "cliVersion": "1.57.2",
-  "sha": "3bdf591057b760f674fb2b1425f63acb426cda2c4f042e1a74c5a5d3807df664"
+  "updated": "2026-10-04T06:11:13+02:00",
+  "cliVersion": "1.59.0",
+  "sha": "5dd665ba23faf604db1a89421c5d9d9a03a489c5784d1da8b90f57b09f95d1ca"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-10-02T19:07:57+02:00",
-  "cliVersion": "1.57.2",
+  "cliVersion": "1.59.0",
   "sha": "7b39ded6b82cb7a8424aea7b8d59a293791205d57e7272ff63d9fa558772ecb1"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "a74a93de9dca9df4e91a71b679c2152a0abc6ada699990f9528d1764144fb1b7",
-  "enigma-linux-arm64": "6f996233da43d811ffcffb6554c610995268d24ca4ad1d72fa54a3f34ebe09ce",
-  "enigma-linux-x64": "a5b2c5ea2e4e402f30a0e6a84c8d810efe719060f152601c9c80b27252f1553f",
-  "enigma-win32-x64.exe": "72841174cff65ccbfd28bead7853bb7d4bdcfcfc56df71bcac3dff565478cb28"
+  "enigma-darwin-arm64": "b016a81c010e74529d555402587bf822e22bc795fd259a28f9bee500be832c41",
+  "enigma-linux-arm64": "e35acc9e3aff4a733ab6934e1a85ca9b4321924e9a1eed1eaba72399813402a0",
+  "enigma-linux-x64": "ca58a5d868932cf8b2396d1f8224dd2c2e35e1d393d29d14db4bdb5c6d1485f9",
+  "enigma-win32-x64.exe": "30b56be7260c965b8adc39a3617defb0bff88c1b6e9f4cdd081b306311c58a18"
 }

package/dist/ci-watch.js

@@ -56,6 +56,8 @@ var CONFIG_DEFAULTS = {
   selfAudit: true,
   compress: false,
   codeGraph: true,
+  browser: true,
+  browserHeadless: true,
   gate: true,
   dashboard: "off",
   tokenPrice: 0,
@@ -73,6 +75,9 @@ var CONFIG_DEFAULTS = {
   promptSecretMode: "redact",
   resourceCap: 60,
   lowMemoryCap: 80,
+  gateTrivialLines: 20,
+  subagentLimit: 4,
+  compactWindow: 4e5,
   planSessionLimit: 0,
   planWeeklyLimit: 0,
   planWeeklySonnetLimit: 0,

package/dist/codegraph-hook.js

@@ -282,6 +282,8 @@ var init_config = __esm({
       selfAudit: true,
       compress: false,
       codeGraph: true,
+      browser: true,
+      browserHeadless: true,
       gate: true,
       dashboard: "off",
       tokenPrice: 0,
@@ -299,6 +301,9 @@ var init_config = __esm({
       promptSecretMode: "redact",
       resourceCap: 60,
       lowMemoryCap: 80,
+      gateTrivialLines: 20,
+      subagentLimit: 4,
+      compactWindow: 4e5,
       planSessionLimit: 0,
       planWeeklyLimit: 0,
       planWeeklySonnetLimit: 0,

package/dist/guardrails.js

@@ -3350,26 +3350,33 @@ function operatorHome() {
   return env?.trim() || homedir();
 }
 function operatorHomePathLeak(content) {
+  const re = operatorHomeRegex("i");
+  if (re === null) return [];
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (re.test(lines[i])) out.push({ line: i + 1, detail: "the path resolves to this machine's home directory" });
+  }
+  return out;
+}
+function redactOperatorHome(text) {
+  const re = operatorHomeRegex("gi");
+  return re === null ? text : text.replace(re, "~");
+}
+function operatorHomeRegex(flags) {
   const home = operatorHome();
-  if (!home || home.length < 6) return [];
+  if (!home || home.length < 6) return null;
   const account = home.replace(/[\\/]+$/, "").split(/[\\/]/).pop() || "";
-  if (!account || GENERIC_ACCOUNTS.has(account.toLowerCase())) return [];
+  if (!account || GENERIC_ACCOUNTS.has(account.toLowerCase())) return null;
   const forms = [home];
   const drive = /^([A-Za-z]):[\\/](.*)$/.exec(home);
   if (drive) forms.push(`/${drive[1].toLowerCase()}/${drive[2]}`);
   const alt = forms.map((f) => f.split(/[\\/]/).map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\\\/]")).join("|");
-  let re;
   try {
-    re = new RegExp(`(?:${alt})(?![A-Za-z0-9_-]|\\.[A-Za-z0-9_-])`, "i");
+    return new RegExp(`(?:${alt})(?![A-Za-z0-9_-]|\\.[A-Za-z0-9_-])`, flags);
   } catch {
-    return [];
-  }
-  const out = [];
-  const lines = content.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    if (re.test(lines[i])) out.push({ line: i + 1, detail: "the path resolves to this machine's home directory" });
+    return null;
   }
-  return out;
 }
 function readStringLiteral(src, start, python) {
   let i = start;
@@ -4818,6 +4825,7 @@ export {
   readLedger,
   readReplyLedger,
   recordFindings,
+  redactOperatorHome,
   redirectFromInput,
   redirectPrefixCheck,
   remoteCollectionNames,

package/dist/post-edit.js

@@ -282,6 +282,8 @@ var init_config = __esm({
       selfAudit: true,
       compress: false,
       codeGraph: true,
+      browser: true,
+      browserHeadless: true,
       gate: true,
       dashboard: "off",
       tokenPrice: 0,
@@ -299,6 +301,9 @@ var init_config = __esm({
       promptSecretMode: "redact",
       resourceCap: 60,
       lowMemoryCap: 80,
+      gateTrivialLines: 20,
+      subagentLimit: 4,
+      compactWindow: 4e5,
       planSessionLimit: 0,
       planWeeklyLimit: 0,
       planWeeklySonnetLimit: 0,
@@ -605,6 +610,7 @@ __export(guardrails_exports, {
   readLedger: () => readLedger,
   readReplyLedger: () => readReplyLedger,
   recordFindings: () => recordFindings,
+  redactOperatorHome: () => redactOperatorHome,
   redirectFromInput: () => redirectFromInput,
   redirectPrefixCheck: () => redirectPrefixCheck,
   remoteCollectionNames: () => remoteCollectionNames,
@@ -1137,26 +1143,33 @@ function operatorHome() {
   return env?.trim() || homedir2();
 }
 function operatorHomePathLeak(content) {
+  const re = operatorHomeRegex("i");
+  if (re === null) return [];
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    if (re.test(lines[i])) out.push({ line: i + 1, detail: "the path resolves to this machine's home directory" });
+  }
+  return out;
+}
+function redactOperatorHome(text) {
+  const re = operatorHomeRegex("gi");
+  return re === null ? text : text.replace(re, "~");
+}
+function operatorHomeRegex(flags) {
   const home = operatorHome();
-  if (!home || home.length < 6) return [];
+  if (!home || home.length < 6) return null;
   const account = home.replace(/[\\/]+$/, "").split(/[\\/]/).pop() || "";
-  if (!account || GENERIC_ACCOUNTS.has(account.toLowerCase())) return [];
+  if (!account || GENERIC_ACCOUNTS.has(account.toLowerCase())) return null;
   const forms = [home];
   const drive = /^([A-Za-z]):[\\/](.*)$/.exec(home);
   if (drive) forms.push(`/${drive[1].toLowerCase()}/${drive[2]}`);
   const alt = forms.map((f) => f.split(/[\\/]/).map((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("[\\\\/]")).join("|");
-  let re;
   try {
-    re = new RegExp(`(?:${alt})(?![A-Za-z0-9_-]|\\.[A-Za-z0-9_-])`, "i");
+    return new RegExp(`(?:${alt})(?![A-Za-z0-9_-]|\\.[A-Za-z0-9_-])`, flags);
   } catch {
-    return [];
-  }
-  const out = [];
-  const lines = content.split("\n");
-  for (let i = 0; i < lines.length; i++) {
-    if (re.test(lines[i])) out.push({ line: i + 1, detail: "the path resolves to this machine's home directory" });
+    return null;
   }
-  return out;
 }
 function readStringLiteral(src, start, python) {
   let i = start;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.57.2",
+  "version": "1.59.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {