enigma-cli 1.63.6 → 1.64.1

package/dist/post-edit.js

@@ -573,6 +573,44 @@ var init_trim = __esm({
   }
 });
 
+// src/private-terms.ts
+import { join as join5 } from "path";
+import { homedir as homedir2 } from "os";
+import { readFileSync as readFileSync4 } from "fs";
+function readPrivateTerms() {
+  try {
+    const raw = JSON.parse(readFileSync4(join5(process.env.ENIGMA_CONFIG_HOME || homedir2(), ".enigma-guard.json"), "utf8"));
+    if (!Array.isArray(raw.privateTerms)) return [];
+    return raw.privateTerms.filter((t) => typeof t === "string" && t.trim().length >= 3);
+  } catch {
+    return [];
+  }
+}
+function privateTermMatcher(terms) {
+  const anyCase = (ch) => {
+    const lo = ch.toLowerCase(), up = ch.toUpperCase();
+    return lo === up ? ch.replace(/[.*+?^${}()|[\]\\/]/g, "\\$&") : `[${lo}${up}]`;
+  };
+  const parts = terms.map((t) => t.trim().split(/[\s_-]+/).filter(Boolean).map((w) => [...w].map(anyCase).join("")).join("[\\s_-]*")).filter(Boolean);
+  if (!parts.length) return null;
+  return new RegExp(`(?:(?<![\\p{L}\\p{N}])|(?<=\\p{Ll})(?=\\p{Lu}))(?:${parts.join("|")})(?!\\p{Ll})`, "u");
+}
+function hasPrivateTerm(line, re) {
+  return re.test(line.replace(/\b[a-z][a-z0-9+.-]*:\/\/\S+/gi, " "));
+}
+function privateTermLines(text, re) {
+  const out = [];
+  text.split("\n").forEach((line, i) => {
+    if (hasPrivateTerm(line, re)) out.push(i + 1);
+  });
+  return out;
+}
+var init_private_terms = __esm({
+  "src/private-terms.ts"() {
+    "use strict";
+  }
+});
+
 // src/guardrails.ts
 var guardrails_exports = {};
 __export(guardrails_exports, {
@@ -617,9 +655,11 @@ __export(guardrails_exports, {
   pageAwaitWithoutBoundary: () => pageAwaitWithoutBoundary,
   pathJoinedFromInput: () => pathJoinedFromInput,
   poweredByBuzzword: () => poweredByBuzzword,
+  privateTermLeak: () => privateTermLeak,
   purpleGradient: () => purpleGradient,
   queryInLoop: () => queryInLoop,
   radixContentWithoutPortal: () => radixContentWithoutPortal,
+  rawImgOverComponent: () => rawImgOverComponent,
   readLedger: () => readLedger,
   readReplyLedger: () => readReplyLedger,
   recordFindings: () => recordFindings,
@@ -654,11 +694,11 @@ __export(guardrails_exports, {
   viewBlankedWhileLoading: () => viewBlankedWhileLoading,
   wideNamedImports: () => wideNamedImports
 });
-import { homedir as homedir2 } from "os";
+import { homedir as homedir3 } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import { execFileSync as execFileSync2 } from "child_process";
-import { dirname as dirname2, join as join5, resolve as resolve2, sep as sep2 } from "path";
-import { appendFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync4, readdirSync as readdirSync2, writeFileSync as writeFileSync3, statSync as statSync2, existsSync as existsSync4 } from "fs";
+import { dirname as dirname2, join as join6, resolve as resolve2, sep as sep2 } from "path";
+import { appendFileSync, mkdirSync as mkdirSync2, readFileSync as readFileSync5, readdirSync as readdirSync2, writeFileSync as writeFileSync3, statSync as statSync2, existsSync as existsSync4 } from "fs";
 function newPasswordAffordanceOnSignIn(content) {
   if (!CURRENT_PASSWORD.test(content) || NEW_PASSWORD.test(content)) return [];
   const out = [];
@@ -676,7 +716,7 @@ function applyFixes(file, findings, stage2 = "edit") {
   if (!fixable.length) return { fixed: [], remaining: findings };
   let content;
   try {
-    content = readFileSync4(file, "utf8");
+    content = readFileSync5(file, "utf8");
   } catch {
     return { fixed: [], remaining: findings };
   }
@@ -1002,6 +1042,63 @@ function nativeSelectOverPrimitive(content) {
   }
   return [];
 }
+function projectImageComponent(root) {
+  const cached = imageComponentCache.get(root);
+  if (cached !== void 0) return cached;
+  let deps = {};
+  try {
+    deps = JSON.parse(readFileSync5(join6(root, "package.json"), "utf8")).dependencies ?? {};
+  } catch {
+  }
+  let found = null;
+  if ("@enigmax/primitives" in deps) found = "`Image` from @enigmax/primitives (`enigma add image`)";
+  else if ("next" in deps) found = "`Image` from next/image";
+  else if ("astro" in deps) found = "`Image` from astro:assets";
+  else if ("@nuxt/image" in deps) found = "`NuxtImg` from @nuxt/image";
+  else {
+    for (const dir of LOCAL_IMAGE_COMPONENTS) {
+      let names = [];
+      try {
+        names = readdirSync2(join6(root, dir));
+      } catch {
+        continue;
+      }
+      const hit = names.find((n) => /^(?:image|img|picture)\.(?:tsx|jsx|vue|svelte|astro)$/i.test(n));
+      if (hit) {
+        found = `the project's own \`${dir}/${hit}\``;
+        break;
+      }
+    }
+  }
+  imageComponentCache.set(root, found);
+  return found;
+}
+function imgElementAt(lines, start) {
+  const parts = [];
+  for (let i = start; i < lines.length && i < start + 30; i++) {
+    const text = i === start ? lines[i].slice(lines[i].search(RAW_IMG)) : lines[i];
+    parts.push(text);
+    if (/(?<!=)>/.test(text)) break;
+  }
+  return parts.join("\n");
+}
+function rawImgOverComponent(content, file) {
+  const norm = file.replace(/\\/g, "/");
+  if (!RAW_IMG.test(content) || IMAGE_COMPONENT_FILE.test(norm) || DEFINES_IMAGE.test(content)) return [];
+  const root = findProjectRoot(file);
+  const component = root ? projectImageComponent(root) : null;
+  if (!component) return [];
+  const lines = content.split("\n");
+  const hits = [];
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!RAW_IMG.test(line) || COMMENT_LINE.test(line) || allowedAt(lines, i, ALLOW_RAW_IMG)) continue;
+    const element = imgElementAt(lines, i);
+    if (DECORATIVE_IMG.test(element) || ALLOW_RAW_IMG.test(element)) continue;
+    hits.push({ line: i + 1, detail: `this project already has ${component}` });
+  }
+  return hits;
+}
 function handRolledToast(content) {
   if (TOAST_MITIGATED.test(content)) return [];
   if (!TOAST_QUEUE.test(content) || !TOAST_TIMER.test(content)) return [];
@@ -1082,11 +1179,11 @@ function nearestTsconfig(file) {
       return cached;
     }
     seen.push(dir);
-    const candidate = join5(dir, "tsconfig.json");
+    const candidate = join6(dir, "tsconfig.json");
     if (existsSync4(candidate)) {
       let found = null;
       try {
-        found = { dir, text: readFileSync4(candidate, "utf8") };
+        found = { dir, text: readFileSync5(candidate, "utf8") };
       } catch {
         found = null;
       }
@@ -1149,14 +1246,14 @@ function deepRelativeImports(content, file) {
 function missingPathAlias(content, file) {
   if (/["'](?:paths|extends)["']\s*:/.test(content)) return [];
   const dir = dirname2(resolve2(file));
-  const src = ["src", "app", "lib"].find((d) => existsSync4(join5(dir, d)));
+  const src = ["src", "app", "lib"].find((d) => existsSync4(join6(dir, d)));
   if (!src) return [];
   const anchor = content.split("\n").findIndex((l) => /["']compilerOptions["']/.test(l));
   return [{ line: anchor === -1 ? 1 : anchor + 1, detail: `no alias for ./${src}` }];
 }
 function operatorHome() {
   const env = process.platform === "win32" ? process.env.USERPROFILE : process.env.HOME;
-  return env?.trim() || homedir2();
+  return env?.trim() || homedir3();
 }
 function operatorHomePathLeak(content) {
   const re = operatorHomeRegex("i");
@@ -1168,6 +1265,14 @@ function operatorHomePathLeak(content) {
   }
   return out;
 }
+function privateTermLeak(content) {
+  const terms = readPrivateTerms();
+  const key = terms.join("\n");
+  if (privateTermCache?.key !== key) privateTermCache = { key, re: privateTermMatcher(terms) };
+  const re = privateTermCache.re;
+  if (re === null) return [];
+  return privateTermLines(content, re).map((line) => ({ line, detail: "a private term from your list" }));
+}
 function redactOperatorHome(text) {
   const re = operatorHomeRegex("gi");
   return re === null ? text : text.replace(re, "~");
@@ -1540,7 +1645,7 @@ function wideNamedImports(content, max) {
 }
 function readPkgDeps(root) {
   try {
-    const pkg = JSON.parse(readFileSync4(join5(root, "package.json"), "utf8"));
+    const pkg = JSON.parse(readFileSync5(join6(root, "package.json"), "utf8"));
     return { ...pkg.dependencies, ...pkg.devDependencies, ...pkg.optionalDependencies, ...pkg.peerDependencies };
   } catch {
     return null;
@@ -1561,7 +1666,7 @@ function globRe(glob, ignoreCase = false) {
   return re;
 }
 function guardrailsConfigPath() {
-  return process.env.ENIGMA_GUARDRAILS_CONFIG || join5(homedir2(), ".enigma-guardrails.json");
+  return process.env.ENIGMA_GUARDRAILS_CONFIG || join6(homedir3(), ".enigma-guardrails.json");
 }
 function isValidRule(r) {
   const x = r;
@@ -1575,7 +1680,7 @@ function loadRules() {
   let disabled = [];
   let custom = [];
   try {
-    const raw = JSON.parse(readFileSync4(guardrailsConfigPath(), "utf8"));
+    const raw = JSON.parse(readFileSync5(guardrailsConfigPath(), "utf8"));
     if (Array.isArray(raw.disabled)) disabled = raw.disabled.filter((s) => typeof s === "string");
     if (Array.isArray(raw.rules)) custom = raw.rules.filter(isValidRule);
   } catch {
@@ -1586,10 +1691,10 @@ function loadRules() {
 function findProjectRoot(file) {
   let dir = dirname2(resolve2(file));
   for (let i = 0; i < 40; i++) {
-    const isProj = existsSync4(join5(dir, "package.json")) || existsSync4(join5(dir, ".enigma.json"));
+    const isProj = existsSync4(join6(dir, "package.json")) || existsSync4(join6(dir, ".enigma.json"));
     let hasGit = false;
     try {
-      hasGit = statSync2(join5(dir, ".git")).isDirectory();
+      hasGit = statSync2(join6(dir, ".git")).isDirectory();
     } catch {
     }
     if (isProj || hasGit) return dir;
@@ -1655,7 +1760,7 @@ function formatFindings(findings) {
 function checkPath(file, stage2 = "edit") {
   let content;
   try {
-    content = readFileSync4(file, "utf8");
+    content = readFileSync5(file, "utf8");
   } catch {
     return [];
   }
@@ -1693,7 +1798,7 @@ function repairableDiffFindings(file) {
   if (!changed) return [];
   let content;
   try {
-    content = readFileSync4(file, "utf8");
+    content = readFileSync5(file, "utf8");
   } catch {
     return [];
   }
@@ -1707,7 +1812,7 @@ function repairableDiffFindings(file) {
 function runGuardrailsHook(payload) {
   let file;
   try {
-    file = JSON.parse(payload ?? readFileSync4(0, "utf8"))?.tool_input?.file_path;
+    file = JSON.parse(payload ?? readFileSync5(0, "utf8"))?.tool_input?.file_path;
   } catch {
   }
   if (!file || typeof file !== "string") return 0;
@@ -2031,16 +2136,16 @@ function pathJoinedFromInput(content, file) {
   if (!python && /^\s*["']use client["']/m.test(content)) return [];
   if (PATH_CONTAINED.test(content)) return [];
   const input = python ? REQUEST_INPUT_PY : REQUEST_INPUT_JS;
-  const join10 = python ? PATH_JOIN_PY : PATH_JOIN_JS;
+  const join11 = python ? PATH_JOIN_PY : PATH_JOIN_JS;
   const lines = content.split("\n");
   const names = namesFromInput(lines, input);
   const out = [];
   for (let i = 0; i < lines.length; i++) {
     const text = lines[i];
     if (auditSkipLine(text)) continue;
-    join10.lastIndex = 0;
+    join11.lastIndex = 0;
     let m;
-    while (m = join10.exec(text)) {
+    while (m = join11.exec(text)) {
       const parts = (m[1] ?? m[2] ?? "").split(",").slice(1).map((s) => s.trim());
       if (parts.some((p) => input.test(p) || names.has(p) || names.has(p.replace(/^`\$\{(\w+)\}.*`$/, "$1")))) {
         out.push({ line: i + 1, detail: text.trim().slice(0, 120) });
@@ -2359,7 +2464,7 @@ function sparklesIcon(content) {
   return out;
 }
 function ledgerPath() {
-  return process.env.ENIGMA_GUARDRAILS_LOG || join5(homedir2(), ".enigma", "guardrail-log.jsonl");
+  return process.env.ENIGMA_GUARDRAILS_LOG || join6(homedir3(), ".enigma", "guardrail-log.jsonl");
 }
 function ledgerKey(rule, outcome, file, line) {
   return JSON.stringify([rule, outcome, file, line ?? null]);
@@ -2395,7 +2500,7 @@ function recordFindings(findings, outcome, stage2 = "edit") {
     } catch {
     }
     if (size > LEDGER_MAX_BYTES) {
-      const kept = rotateLedger(readFileSync4(path, "utf8"));
+      const kept = rotateLedger(readFileSync5(path, "utf8"));
       writeFileSync3(path, kept.length ? `${kept.join("\n")}
 ` : "");
     }
@@ -2430,7 +2535,7 @@ function rotateLedger(text) {
 function eachLedgerEntry(sinceDays, visit) {
   let text;
   try {
-    text = readFileSync4(ledgerPath(), "utf8");
+    text = readFileSync5(ledgerPath(), "utf8");
   } catch {
     return;
   }
@@ -2500,7 +2605,7 @@ function runGuardrailsScan(all) {
   for (const file of files) {
     let content;
     try {
-      content = readFileSync4(file, "utf8");
+      content = readFileSync5(file, "utf8");
     } catch {
       continue;
     }
@@ -2529,10 +2634,11 @@ enigma-guardrails: BLOCKED - ${r.blocks.length} convention violation(s):`);
   console.log(`enigma-guardrails: ${r.count} ${all ? "tracked" : "staged"} file(s) checked, no blocking violations.`);
   return 0;
 }
-var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, INJECTION_EXCLUDES, WORKFLOW_FILES, UI_CODE_FILES, UI_STYLE_FILES, TELL_EXCLUDES, DB_SCRIPT_EXCLUDES, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, REVALIDATE_AFTER, PROMISE_FANOUT, FANOUT_LITERAL, FANOUT_MAPPED, FANOUT_OVER_OBJECT, EXPENSIVE_PER_ITEM, CONCURRENCY_BOUND, FANOUT_WINDOW, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, LIGHTBOX_IMAGE, LIGHTBOX_WHEEL, LIGHTBOX_ZOOM, LIGHTBOX_DIALOG, LIGHTBOX_MITIGATED, VIDEO_ELEMENT, VIDEO_DRIVEN, VIDEO_TIMELINE, VIDEO_CONTROLS, VIDEO_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, NATIVE_SELECT, NATIVE_SELECT_MAPPED, NATIVE_SELECT_TRIGGER, NATIVE_SELECT_MITIGATED, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, MINIFIED_LINE, CALL_LEAD_JS, CALL_LEAD_PY, CONSTANT_EXPR, SQL_DML, SQL_VALUE_POSITION, SQL_PLACEHOLDER_BUILDER, SQL_SAFE_EXPR, SQL_CALL_JS, SQL_CALL_PY, SHELL_SAFE_EXPR, INSECURE_TLS_JS, INSECURE_TLS_PY, PY_HTTP_CLIENT, LOOPBACK_HINT, TLS_OPERATOR_TOGGLE, CORS_ANY_ORIGIN_JS, CORS_CREDENTIALS_JS, CORS_ANY_ORIGIN_PY, CORS_CREDENTIALS_PY, CORS_WINDOW, PYYAML_IMPORT, PICKLE_FROM_OUTSIDE, RAW_HTML_MARKDOWN, OPT_IN_HTML_MARKDOWN, MARKDOWN_HTML_ON, HTML_SANITIZER, HTML_SINK, RADIX_OVERLAY_MODULE, RADIX_UMBRELLA_PARTS, INTERNAL_MODULE, globCache, DIFF_HUNK, REQUEST_INPUT_JS, REQUEST_INPUT_PY, SSH_HOST_KEY_OFF, ACTION_USES, FULL_SHA, IMAGE_DIGEST, PRIVILEGED_TRIGGER, PR_HEAD_REF, CHECKOUT_SITE, SAME_REPO_GUARD, UNTRUSTED_EVENT_TEXT, SCRIPT_KEY, BLOCK_SCALAR, OPERAND_BEFORE, OPERAND_AFTER, LITERAL_OPERAND, CONFIGURED_SECRET, PRESENTED_CREDENTIAL, COMPUTED_MAC, SECRET_NAMED, NOT_SECRET_NAMED, REMEMBERED_COPY, SLASH_PREFIX_CHECK, DESTINATION_NAME, GENERIC_PARAM_NAME, NAVIGATION_SINK, DESTINATION_HELPER, SIGN_IN_FILE, RESOLVED_ORIGIN_CHECK, COMPLETE_PREFIX_CHECK, REDIRECT_SINK_JS, REDIRECT_SINK_PY, REDIRECT_VALIDATED, OUTBOUND_JS, OUTBOUND_PY, SSRF_GUARDED, DNS_RESOLUTION, PRIVATE_ADDRESS_CHECK, OUTBOUND_CALL, CONNECTION_PINNED, RESPONSE_TYPE_CALL_JS, RESPONSE_TYPE_KEY_JS, RESPONSE_OPENER_JS, RESPONSE_TYPE_KWARG_PY, RESPONSE_OPENER_PY, STORED_FILE_TYPE, RESPONSE_SANDBOXED, PATH_JOIN_JS, PATH_JOIN_PY, PATH_CONTAINED, TW_HUE, TW_STOP, HEX_COLOR, ALLOW_BRAND_GRADIENT, ALLOW_GRADIENT_TEXT, SHIMMER, TW_LEFT_STRIPE, TW_ROUNDED_LEFT, ALLOW_ACCENT_STRIPE, EMOJI, EMOJI_LEAD, EMOJI_ICON, EMOJI_COMMIT_SAMPLE, TERMINAL_MARKUP, ALLOW_EMOJI_ICON, COPY_PROP, POWERED_BY_BUZZWORD, ALLOW_POWERED_BY, CHAT_RESIDUE, CHAT_LINK, ALLOW_CHAT_RESIDUE, AI_VOCABULARY, SEAMLESS_LITERAL, ALLOW_AI_VOCABULARY, REQUEST_SERVING, READ_BOUND, ALLOW_UNBOUNDED_READ, ALLOW_SELECT_STAR, ORM_READ_CALL, ROW_LOOP, ALLOW_QUERY_IN_LOOP, FIXED_CANVAS_FILE, TW_DECORATION, EMAIL_MARKUP, TW_WIDTH_GUARD, ALLOW_FIXED_WIDTH, TW_VIEWPORT_HEIGHT, DYNAMIC_VIEWPORT, ALLOW_VIEWPORT_HEIGHT, SPARKLES_IMPORT, SPARKLES_NAME, ALLOW_SPARKLES, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
+var COMMENT_LINE, SKELETON_GUARD_SRC, SKELETON_SIGNAL_SRC, INJECTION_EXCLUDES, WORKFLOW_FILES, UI_CODE_FILES, UI_STYLE_FILES, TELL_EXCLUDES, DB_SCRIPT_EXCLUDES, BUILTIN_RULES, PROJECT_CHECKS, CURRENT_PASSWORD, NEW_PASSWORD, NEW_PASSWORD_PROP, NOT_A_JSX_PROP, FILE_CHECKS, FIXERS, SPAWNERS, MUTATING_REQUEST, ENTITY_WRITE, OPTIMISTIC_SIGNAL, ALLOW_SERVER_FIRST, RESULT_BINDING, BLOCK_LOOKBACK, BLOCK_LOOKAHEAD, REVALIDATE_AFTER, PROMISE_FANOUT, FANOUT_LITERAL, FANOUT_MAPPED, FANOUT_OVER_OBJECT, EXPENSIVE_PER_ITEM, CONCURRENCY_BOUND, FANOUT_WINDOW, TEXTAREA, TEXTAREA_LOWER, TEXTAREA_UPPER, TEXTAREA_FIXED, TEXTAREA_AUTOSIZE, VIEW_GUARD, LOADING_NAME, LOADING_VALUE, VIEW_GUARD_LOADING, VIEW_CHROME_HEADING, VIEW_CHROME_TEXT, VIEW_BODY_LOOKAHEAD, ALLOW_VIEW_SKELETON, SKELETON_GUARD, SKELETON_SIGNAL, REMOTE_COLLECTION_BINDINGS, LIST_BOUNDED, ALLOW_UNBOUNDED_LIST, MENU_HANDLER, MENU_POINT, MENU_STATE, MENU_MITIGATED, SELECT_RANGE_KEY, SELECT_ADD_KEY, SELECT_STATE, SELECT_MITIGATED, COLOR_MATHS, COLOR_DRAG, COLOR_MEASURE, COLOR_STATE, COLOR_MITIGATED, LIGHTBOX_IMAGE, LIGHTBOX_WHEEL, LIGHTBOX_ZOOM, LIGHTBOX_DIALOG, LIGHTBOX_MITIGATED, VIDEO_ELEMENT, VIDEO_DRIVEN, VIDEO_TIMELINE, VIDEO_CONTROLS, VIDEO_MITIGATED, TWOFA_SUBJECT, TWOFA_ENROLL, TWOFA_PASSWORD, TWOFA_MITIGATED, TWOFA_WINDOW, LISTBOX_ROLE, LISTBOX_OPEN, LISTBOX_OPTIONS, LISTBOX_MITIGATED, NATIVE_SELECT, NATIVE_SELECT_MAPPED, NATIVE_SELECT_TRIGGER, NATIVE_SELECT_MITIGATED, RAW_IMG, ALLOW_RAW_IMG, DECORATIVE_IMG, IMAGE_COMPONENT_FILE, DEFINES_IMAGE, LOCAL_IMAGE_COMPONENTS, imageComponentCache, TOAST_QUEUE, TOAST_TIMER, TOAST_MITIGATED, PALETTE_SHORTCUT, PALETTE_MODIFIER, PALETTE_OPEN, PALETTE_FILTER, PALETTE_MITIGATED, CLIP_ONE_LINE, DYNAMIC_CHILD, VALUE_REACHABLE, WRAPPER_LOOKBACK, ALLOW_CLIPPED_VALUE, CLIPPED_SIMPLE_VALUE, NOT_TEXT_BINDING, ASYNC_ROUTE, SERVER_DATA_AWAIT, STREAM_BOUNDARY, ALLOW_BLOCKING_PAGE, LOADING_BOUNDARY_FILE, SPECIFIER, MODULE_EXT, JS_EXT, tsconfigCache, NAMED_IMPORT, GENERIC_ACCOUNTS, privateTermCache, MINIFIED_LINE, CALL_LEAD_JS, CALL_LEAD_PY, CONSTANT_EXPR, SQL_DML, SQL_VALUE_POSITION, SQL_PLACEHOLDER_BUILDER, SQL_SAFE_EXPR, SQL_CALL_JS, SQL_CALL_PY, SHELL_SAFE_EXPR, INSECURE_TLS_JS, INSECURE_TLS_PY, PY_HTTP_CLIENT, LOOPBACK_HINT, TLS_OPERATOR_TOGGLE, CORS_ANY_ORIGIN_JS, CORS_CREDENTIALS_JS, CORS_ANY_ORIGIN_PY, CORS_CREDENTIALS_PY, CORS_WINDOW, PYYAML_IMPORT, PICKLE_FROM_OUTSIDE, RAW_HTML_MARKDOWN, OPT_IN_HTML_MARKDOWN, MARKDOWN_HTML_ON, HTML_SANITIZER, HTML_SINK, RADIX_OVERLAY_MODULE, RADIX_UMBRELLA_PARTS, INTERNAL_MODULE, globCache, DIFF_HUNK, REQUEST_INPUT_JS, REQUEST_INPUT_PY, SSH_HOST_KEY_OFF, ACTION_USES, FULL_SHA, IMAGE_DIGEST, PRIVILEGED_TRIGGER, PR_HEAD_REF, CHECKOUT_SITE, SAME_REPO_GUARD, UNTRUSTED_EVENT_TEXT, SCRIPT_KEY, BLOCK_SCALAR, OPERAND_BEFORE, OPERAND_AFTER, LITERAL_OPERAND, CONFIGURED_SECRET, PRESENTED_CREDENTIAL, COMPUTED_MAC, SECRET_NAMED, NOT_SECRET_NAMED, REMEMBERED_COPY, SLASH_PREFIX_CHECK, DESTINATION_NAME, GENERIC_PARAM_NAME, NAVIGATION_SINK, DESTINATION_HELPER, SIGN_IN_FILE, RESOLVED_ORIGIN_CHECK, COMPLETE_PREFIX_CHECK, REDIRECT_SINK_JS, REDIRECT_SINK_PY, REDIRECT_VALIDATED, OUTBOUND_JS, OUTBOUND_PY, SSRF_GUARDED, DNS_RESOLUTION, PRIVATE_ADDRESS_CHECK, OUTBOUND_CALL, CONNECTION_PINNED, RESPONSE_TYPE_CALL_JS, RESPONSE_TYPE_KEY_JS, RESPONSE_OPENER_JS, RESPONSE_TYPE_KWARG_PY, RESPONSE_OPENER_PY, STORED_FILE_TYPE, RESPONSE_SANDBOXED, PATH_JOIN_JS, PATH_JOIN_PY, PATH_CONTAINED, TW_HUE, TW_STOP, HEX_COLOR, ALLOW_BRAND_GRADIENT, ALLOW_GRADIENT_TEXT, SHIMMER, TW_LEFT_STRIPE, TW_ROUNDED_LEFT, ALLOW_ACCENT_STRIPE, EMOJI, EMOJI_LEAD, EMOJI_ICON, EMOJI_COMMIT_SAMPLE, TERMINAL_MARKUP, ALLOW_EMOJI_ICON, COPY_PROP, POWERED_BY_BUZZWORD, ALLOW_POWERED_BY, CHAT_RESIDUE, CHAT_LINK, ALLOW_CHAT_RESIDUE, AI_VOCABULARY, SEAMLESS_LITERAL, ALLOW_AI_VOCABULARY, REQUEST_SERVING, READ_BOUND, ALLOW_UNBOUNDED_READ, ALLOW_SELECT_STAR, ORM_READ_CALL, ROW_LOOP, ALLOW_QUERY_IN_LOOP, FIXED_CANVAS_FILE, TW_DECORATION, EMAIL_MARKUP, TW_WIDTH_GUARD, ALLOW_FIXED_WIDTH, TW_VIEWPORT_HEIGHT, DYNAMIC_VIEWPORT, ALLOW_VIEWPORT_HEIGHT, SPARKLES_IMPORT, SPARKLES_NAME, ALLOW_SPARKLES, LEDGER_MAX_BYTES, LEDGER_KEEP, LEDGER_KEEP_REPLY, grEntry, isGrEntry;
 var init_guardrails = __esm({
   "src/guardrails.ts"() {
     "use strict";
+    init_private_terms();
     COMMENT_LINE = /^\s*(\/\/|#|\*|--|<!--|\{?\/\*)/;
     SKELETON_GUARD_SRC = "\\bif\\s*\\(\\s*(isLoading|isPending|isFetching|loading|pending)\\s*\\)\\s*return\\s+(null\\b|<\\s*\\w*(Spinner|Loader|Loading|CircularProgress)\\b)";
     SKELETON_SIGNAL_SRC = "skeleton|animate-pulse|shimmer|Suspense|ContentLoader|content-loader|<\\s*Placeholder";
@@ -3937,6 +4043,35 @@ var init_guardrails = __esm({
         severity: "block",
         skill: "frontend-policy"
       },
+      {
+        id: "fe-raw-img-over-component",
+        label: "A project with an image component uses it",
+        files: ["*.tsx", "*.jsx", "*.vue", "*.svelte", "*.astro"],
+        excludeFiles: [
+          "*.test.*",
+          "*.spec.*",
+          "**/tests/**",
+          "**/__tests__/**",
+          "**/fixtures/**",
+          "*.stories.*",
+          "**/dist/**",
+          "**/build/**",
+          "**/node_modules/**",
+          "**/vendor/**",
+          "**/emails/**",
+          "dist/**",
+          "build/**",
+          "node_modules/**",
+          "vendor/**",
+          "emails/**"
+        ],
+        scope: "file",
+        stage: "diff",
+        fileCheck: "fe-raw-img-over-component",
+        message: "A raw <img> in a project that already has an image component. Every content image goes through ONE component, so loading, sizing, alt text, lazy decoding and the lightbox stay the same everywhere and a fix lands once; an <img> per page is a second, drifting copy of it. Use the component named here. Mark the line `enigma:allow-raw-img` where the element must stay raw - an email template, a tracking pixel, or markup the component cannot render (frontend-policy).",
+        severity: "block",
+        skill: "frontend-policy"
+      },
       {
         id: "fe-toast-hand-rolled",
         label: "Toasts come from the primitive",
@@ -4747,6 +4882,35 @@ var init_guardrails = __esm({
         severity: "block",
         skill: "security-policy"
       },
+      {
+        id: "sec-private-term",
+        label: "Real people's data stays out of the repository",
+        files: ["**"],
+        excludeFiles: [
+          "**/node_modules/**",
+          "**/dist/**",
+          "**/build/**",
+          "**/vendor/**",
+          "**/.next/**",
+          "node_modules/**",
+          "dist/**",
+          "build/**",
+          "vendor/**",
+          "*.lock",
+          "*.lockb",
+          "package-lock.json",
+          "*.min.js",
+          "*.map"
+        ],
+        scope: "file",
+        // DIFF stage like sec-operator-env-leak: it fires on the line being added, the moment
+        // before the value reaches the history for good, and never on an old file it did not write.
+        stage: "diff",
+        fileCheck: "sec-private-term",
+        message: "This line carries one of your private terms - the real name, handle, server or community name of you or of the people you serve (the list in ~/.enigma-guard.json, `enigma config guard-private-terms`). Real data never goes into a tracked file, and tests, fixtures, examples and docs use ANONYMOUS data: invent the values (`Player One`, `alice@example.test`, `Test Server`) and, when a real log or payload shape matters, reproduce the shape with invented values instead of pasting the capture. Being shown a real value to work with is permission to use it, never to publish it (security-policy, testing-policy).",
+        severity: "block",
+        skill: "security-policy"
+      },
       // The injection class. Every one but sec-unsafe-deserialization is DIFF stage for the reason the
       // stage exists: each has a measured backlog in real repositories (the counts are in guardrails.md),
       // so at the edit stage it would block unrelated edits to a file that already carried the shape.
@@ -5216,7 +5380,7 @@ var init_guardrails = __esm({
       "ts-relational-no-prisma": (root) => {
         const pkg = readPkgDeps(root);
         if (!pkg) return false;
-        const hasTs = "typescript" in pkg || existsSync4(join5(root, "tsconfig.json"));
+        const hasTs = "typescript" in pkg || existsSync4(join6(root, "tsconfig.json"));
         if (!hasTs) return false;
         const relational = ["typeorm", "sequelize", "knex", "drizzle-orm", "pg", "mysql", "mysql2", "better-sqlite3", "@mikro-orm/core"];
         if (!relational.some((d) => d in pkg)) return false;
@@ -5241,6 +5405,7 @@ var init_guardrails = __esm({
       "ts-alias-deep-relative": (content, file) => deepRelativeImports(content, file),
       "ts-alias-paths": (content, file) => missingPathAlias(content, file),
       "sec-operator-env-leak": (content) => operatorHomePathLeak(content),
+      "sec-private-term": (content) => privateTermLeak(content),
       "fe-new-password-affordance-on-signin": (content) => newPasswordAffordanceOnSignIn(content),
       "fe-context-menu-hand-rolled": (content) => handRolledContextMenu(content),
       "fe-selection-hand-rolled": (content) => handRolledSelection(content),
@@ -5250,6 +5415,7 @@ var init_guardrails = __esm({
       "sec-2fa-reauth-prompt": (content) => twoFactorPasswordPrompt(content),
       "fe-select-hand-rolled": (content) => handRolledSelect(content),
       "fe-native-select-over-primitive": (content) => nativeSelectOverPrimitive(content),
+      "fe-raw-img-over-component": (content, file) => rawImgOverComponent(content, file),
       "fe-toast-hand-rolled": (content) => handRolledToast(content),
       "fe-palette-hand-rolled": (content) => handRolledPalette(content),
       "sec-sql-built-from-values": (content, file) => sqlBuiltFromValues(content, file),
@@ -5387,6 +5553,13 @@ var init_guardrails = __esm({
     NATIVE_SELECT_MAPPED = /<option\b|\.map\(/;
     NATIVE_SELECT_TRIGGER = /@enigmax\/primitives/;
     NATIVE_SELECT_MITIGATED = /enigma:allow-native-select|SelectRoot|useSelectContext/;
+    RAW_IMG = /<img\b/;
+    ALLOW_RAW_IMG = /enigma:allow-raw-img/;
+    DECORATIVE_IMG = /alt=(?:""|''|\{["']{2}\})|\.svg\b|\b(?:logo|icon|flag|favicon|sprite)/i;
+    IMAGE_COMPONENT_FILE = /(?:^|\/)(?:image|img|picture)\.(?:tsx|jsx|vue|svelte|astro)$/i;
+    DEFINES_IMAGE = /\b(?:function|const|class)\s+(?:Image|Img|Picture)\b/;
+    LOCAL_IMAGE_COMPONENTS = ["src/components", "components", "src/components/ui", "components/ui", "src/lib/components", "app/components"];
+    imageComponentCache = /* @__PURE__ */ new Map();
     TOAST_QUEUE = /\bset(?:Toasts?|Snackbars?)\b|\btoasts\.(?:map|filter|slice)\b|\btoastQueue\b/;
     TOAST_TIMER = /setTimeout\(/;
     TOAST_MITIGATED = /@enigmax\/primitives|createNotifications|useNotifications|<Toaster|ToastT\b|ToasterProps\b|["']sonner["']|react-hot-toast|react-toastify|notistack|@radix-ui|@mui\/material|@chakra-ui|@mantine|antd|enigma:allow-hand-rolled-toast/;
@@ -5588,10 +5761,10 @@ var init_governor = __esm({
 
 // src/repo-keyed-file.ts
 import { dirname as dirname3 } from "path";
-import { mkdirSync as mkdirSync3, readFileSync as readFileSync5, renameSync, rmSync, writeFileSync as writeFileSync4 } from "fs";
+import { mkdirSync as mkdirSync3, readFileSync as readFileSync6, renameSync, rmSync, writeFileSync as writeFileSync4 } from "fs";
 function readRepoKeyedFile(path, version) {
   try {
-    const parsed = JSON.parse(readFileSync5(path, "utf8"));
+    const parsed = JSON.parse(readFileSync6(path, "utf8"));
     if (!parsed || parsed.version !== version || typeof parsed.repos !== "object" || parsed.repos === null) return {};
     return parsed.repos;
   } catch {
@@ -6031,8 +6204,8 @@ var init_codegraph_extract_docs = __esm({
 
 // src/codegraph-extract.ts
 import { execFileSync as execFileSync4 } from "child_process";
-import { extname as extname2, join as join6, relative as relative2, resolve as resolve3 } from "path";
-import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync6, statSync as statSync3 } from "fs";
+import { extname as extname2, join as join7, relative as relative2, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, readdirSync as readdirSync3, readFileSync as readFileSync7, statSync as statSync3 } from "fs";
 function isCodeLang(lang) {
   return !DOC_LANGS.has(lang);
 }
@@ -6349,7 +6522,7 @@ function gitList(root, args) {
 function gitSourceFiles(root) {
   const out = gitList(root, ["--cached", "--others", "--exclude-standard"]);
   if (out === null) return null;
-  const nested = existsSync5(join6(root, ".gitmodules")) ? gitList(root, ["--recurse-submodules"]) : null;
+  const nested = existsSync5(join7(root, ".gitmodules")) ? gitList(root, ["--recurse-submodules"]) : null;
   const code = [];
   const docs = [];
   const seen = /* @__PURE__ */ new Set();
@@ -6359,7 +6532,7 @@ function gitSourceFiles(root) {
     seen.add(rel);
     if (!LANG_BY_EXT[extname2(rel).toLowerCase()]) continue;
     if (rel.split("/").some((seg) => seg.startsWith(".") || IGNORE_DIRS.has(seg))) continue;
-    (isDocPath(rel) ? docs : code).push(join6(root, rel));
+    (isDocPath(rel) ? docs : code).push(join7(root, rel));
   }
   return [...code, ...pickDocs(root, docs, MAX_FILES - code.length)];
 }
@@ -6380,11 +6553,11 @@ function walk(root) {
     for (const e of entries) {
       if (code.length >= MAX_FILES || ++visited >= MAX_ENTRIES) break;
       if (e.isDirectory()) {
-        if (!e.name.startsWith(".") && !IGNORE_DIRS.has(e.name)) queue.push(join6(queue[head], e.name));
+        if (!e.name.startsWith(".") && !IGNORE_DIRS.has(e.name)) queue.push(join7(queue[head], e.name));
         continue;
       }
       if (!e.isFile() || !LANG_BY_EXT[extname2(e.name).toLowerCase()]) continue;
-      (isDocPath(e.name) ? docs : code).push(join6(queue[head], e.name));
+      (isDocPath(e.name) ? docs : code).push(join7(queue[head], e.name));
     }
   }
   const ordered = [...code, ...pickDocs(root, docs, MAX_FILES - code.length)];
@@ -6414,7 +6587,7 @@ function scanFiles(rootDir) {
     }
     let content;
     try {
-      content = readFileSync6(abs, "utf8");
+      content = readFileSync7(abs, "utf8");
     } catch {
       continue;
     }
@@ -6540,25 +6713,25 @@ __export(codegraph_exports, {
   scanFiles: () => scanFiles,
   searchGraph: () => searchGraph
 });
-import { homedir as homedir3 } from "os";
+import { homedir as homedir4 } from "os";
 import { createHash as createHash2 } from "crypto";
-import { basename as basename2, join as join7, resolve as resolve4 } from "path";
-import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync7, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
+import { basename as basename2, join as join8, resolve as resolve4 } from "path";
+import { existsSync as existsSync6, mkdirSync as mkdirSync4, readFileSync as readFileSync8, rmSync as rmSync2, writeFileSync as writeFileSync5 } from "fs";
 function storeDir() {
-  return process.env.ENIGMA_CODEGRAPH_DIR || join7(homedir3(), ".enigma", "codegraph");
+  return process.env.ENIGMA_CODEGRAPH_DIR || join8(homedir4(), ".enigma", "codegraph");
 }
 function projectsFile() {
-  return join7(storeDir(), "projects.json");
+  return join8(storeDir(), "projects.json");
 }
 function graphFile(id) {
-  return join7(storeDir(), `${id}.json`);
+  return join8(storeDir(), `${id}.json`);
 }
 function bodyIndexFile(id) {
-  return join7(storeDir(), `${id}.bodies.json`);
+  return join8(storeDir(), `${id}.bodies.json`);
 }
 function readJsonSafe(file, fallback) {
   try {
-    return existsSync6(file) ? JSON.parse(readFileSync7(file, "utf8")) : fallback;
+    return existsSync6(file) ? JSON.parse(readFileSync8(file, "utf8")) : fallback;
   } catch {
     return fallback;
   }
@@ -6587,7 +6760,7 @@ function orders(all, byLang) {
 }
 function goModulePath(root) {
   try {
-    return /^\s*module\s+(\S+)/m.exec(readFileSync7(join7(root, "go.mod"), "utf8"))?.[1] ?? null;
+    return /^\s*module\s+(\S+)/m.exec(readFileSync8(join8(root, "go.mod"), "utf8"))?.[1] ?? null;
   } catch {
     return null;
   }
@@ -6605,7 +6778,7 @@ function createImportResolver(root, known) {
     return null;
   };
   const relative4 = (fromRel, spec, lang) => {
-    const abs = resolve4(join7(root, fromRel), "..", spec);
+    const abs = resolve4(join8(root, fromRel), "..", spec);
     return verifyModule(relPath(root, abs), known, lang);
   };
   return (fromRel, lang, spec) => {
@@ -6782,7 +6955,7 @@ function buildEdges(root, files, importEdges, resolveImport) {
   for (const f of files) {
     let content = "";
     try {
-      content = readFileSync7(join7(root, f.path), "utf8");
+      content = readFileSync8(join8(root, f.path), "utf8");
     } catch {
       continue;
     }
@@ -6849,7 +7022,7 @@ function topTokens(text, limit) {
   return [...m.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).slice(0, limit);
 }
 function isManagedPath(dir) {
-  const managed = resolve4(join7(enigmaHome(), ".enigma"));
+  const managed = resolve4(join8(enigmaHome(), ".enigma"));
   return dir === managed || dir.startsWith(managed + (dir.includes("\\") ? "\\" : "/"));
 }
 function indexProject(rootDir) {
@@ -6918,14 +7091,14 @@ function covering(all, dir) {
 }
 function projectRootOf(dir) {
   const start = resolve4(dir);
-  if (ROOT_MARKERS.some((marker) => existsSync6(join7(start, marker)))) return start;
-  const home = resolve4(homedir3());
+  if (ROOT_MARKERS.some((marker) => existsSync6(join8(start, marker)))) return start;
+  const home = resolve4(homedir4());
   let current = start;
   for (let up = 0; up < MAX_ROOT_WALK; up++) {
     const parent = resolve4(current, "..");
     if (parent === current || parent === home) break;
     current = parent;
-    if (existsSync6(join7(current, ".git"))) return current;
+    if (existsSync6(join8(current, ".git"))) return current;
   }
   return start;
 }
@@ -7127,8 +7300,8 @@ __export(codegraph_query_exports, {
   isCleanDrift: () => isCleanDrift,
   resolveSymbolNodes: () => resolveSymbolNodes
 });
-import { join as join8 } from "path";
-import { readFileSync as readFileSync8 } from "fs";
+import { join as join9 } from "path";
+import { readFileSync as readFileSync9 } from "fs";
 function load(opts) {
   const graph = loadFreshGraph(opts.project, opts.refresh ?? true);
   if (!graph) return null;
@@ -7156,7 +7329,7 @@ function savingsFor(nodes, paths) {
 }
 function sliceSpan(root, path, from, to) {
   try {
-    const lines = readFileSync8(join8(root, path), "utf8").split("\n");
+    const lines = readFileSync9(join9(root, path), "utf8").split("\n");
     const start = Math.max(1, from);
     const end = Math.min(lines.length, to);
     const slice = lines.slice(start - 1, end);
@@ -7510,7 +7683,7 @@ function codeGraphGrep(pattern, opts = {}) {
   for (const file of files) {
     let text;
     try {
-      text = readFileSync8(join8(loaded.graph.root, file.path), "utf8");
+      text = readFileSync9(join9(loaded.graph.root, file.path), "utf8");
     } catch {
       truncatedFiles++;
       continue;
@@ -8065,10 +8238,10 @@ var codegraph_hook_exports = {};
 __export(codegraph_hook_exports, {
   runCodeGraphHook: () => runCodeGraphHook
 });
-import { homedir as homedir4 } from "os";
+import { homedir as homedir5 } from "os";
 import { spawn } from "child_process";
-import { basename as basename3, join as join9, relative as relative3, resolve as resolve5 } from "path";
-import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync9, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
+import { basename as basename3, join as join10, relative as relative3, resolve as resolve5 } from "path";
+import { existsSync as existsSync7, mkdirSync as mkdirSync5, readFileSync as readFileSync10, statSync as statSync4, writeFileSync as writeFileSync6 } from "fs";
 function parsePayload(raw) {
   try {
     return JSON.parse(raw);
@@ -8083,15 +8256,15 @@ function emit(event, additionalContext) {
   process.stdout.write(JSON.stringify({ hookSpecificOutput: { hookEventName: event, additionalContext } }));
 }
 function stateDir() {
-  return join9(process.env.ENIGMA_CODEGRAPH_DIR || join9(homedir4(), ".enigma", "codegraph"), "sessions");
+  return join10(process.env.ENIGMA_CODEGRAPH_DIR || join10(homedir5(), ".enigma", "codegraph"), "sessions");
 }
 function stateFile(dir, sessionId) {
   const key = `${dir}|${sessionId}`.replace(/[^A-Za-z0-9]/g, "").slice(-40) || "default";
-  return join9(stateDir(), `${key}.json`);
+  return join10(stateDir(), `${key}.json`);
 }
 function readState(dir, sessionId) {
   try {
-    const parsed = JSON.parse(readFileSync9(stateFile(dir, sessionId), "utf8"));
+    const parsed = JSON.parse(readFileSync10(stateFile(dir, sessionId), "utf8"));
     return { injected: Array.isArray(parsed.injected) ? parsed.injected : [], dirty: parsed.dirty === true };
   } catch {
     return { injected: [], dirty: false };
@@ -8113,8 +8286,8 @@ function projectRoot(cg, project, fallback) {
 }
 function writeStatuslineSnapshot(root, symbols, stale) {
   try {
-    const dir = process.env.ENIGMA_CODEGRAPH_DIR || join9(homedir4(), ".enigma", "codegraph");
-    const target = join9(dir, "statusline.json");
+    const dir = process.env.ENIGMA_CODEGRAPH_DIR || join10(homedir5(), ".enigma", "codegraph");
+    const target = join10(dir, "statusline.json");
     const repos = readRepoKeyedFile(target, STATUSLINE_SNAPSHOT_VERSION);
     repos[root] = { root, symbols, stale, at: Date.now() };
     writeRepoKeyedFile(target, STATUSLINE_SNAPSHOT_VERSION, repos, (s) => s.at);
@@ -8158,7 +8331,7 @@ function coveringProject(cg, dir) {
 }
 function indexMarkerFile(dir) {
   const key = dir.replace(/[^A-Za-z0-9]/g, "").slice(-40) || "default";
-  return join9(stateDir(), `indexing-${key}`);
+  return join10(stateDir(), `indexing-${key}`);
 }
 function claimIndex(dir) {
   const file = indexMarkerFile(dir);
@@ -8325,20 +8498,20 @@ async function runLintStep(payload) {
   }
   const file = input?.file_path;
   if (!file || !LINTABLE.test(file)) return 0;
-  const { join: join10 } = await import("path");
-  const { homedir: homedir5 } = await import("os");
+  const { join: join11 } = await import("path");
+  const { homedir: homedir6 } = await import("os");
   const { createRequire } = await import("module");
-  const { readFileSync: readFileSync10, writeFileSync: writeFileSync7 } = await import("fs");
-  const dir = process.env.ENIGMA_LINT_DIR || join10(homedir5(), ".enigma", "linter");
+  const { readFileSync: readFileSync11, writeFileSync: writeFileSync7 } = await import("fs");
+  const dir = process.env.ENIGMA_LINT_DIR || join11(homedir6(), ".enigma", "linter");
   let linter;
   try {
-    linter = createRequire(join10(dir, "noop.js"))("@enigmax/linter");
+    linter = createRequire(join11(dir, "noop.js"))("@enigmax/linter");
   } catch {
     return 0;
   }
   let text;
   try {
-    text = readFileSync10(file, "utf8");
+    text = readFileSync11(file, "utf8");
   } catch {
     return 0;
   }