enigma-memory 0.1.17 → 0.1.22

package/docs/developer-ecosystem.md

@@ -8,25 +8,27 @@ For most developers, start with the installed CLI before reading the SDK interna
 
 ```sh
 npm install -g enigma-memory
-enigma init
-enigma setup --client auto --connect-installed --overwrite
-enigma drive health
-enigma status
-enigma remember --text-file ./memory.txt
-enigma search --query "project context"
-enigma context --query "project context" --optimize
+PASSPHRASE_FILE="$HOME/.enigma/passphrase"
+test -s "$PASSPHRASE_FILE" || { printf '%s\n' 'Create the protected passphrase file before setup.' >&2; exit 1; }
+enigma init --passphrase-file "$PASSPHRASE_FILE"
+enigma setup --passphrase-file "$PASSPHRASE_FILE" --client auto --connect-installed --overwrite
+enigma drive health --passphrase-file "$PASSPHRASE_FILE"
+enigma status --passphrase-file "$PASSPHRASE_FILE"
+enigma remember --passphrase-file "$PASSPHRASE_FILE" --text-file ./memory.txt
+enigma search --passphrase-file "$PASSPHRASE_FILE" --query "project context"
+enigma context --passphrase-file "$PASSPHRASE_FILE" --query "project context" --optimize
 enigma verify --export ./.enigma/export.json
 ```
 
-`enigma init` creates the local `.enigma` workspace, bundle, and proof artifacts with no provider or cloud credentials. `enigma setup --client auto --connect-installed --overwrite` configures the drive and writes the `mcpServers.enigma` entry into every installed/config-present client it detects, skipping clients that are not installed; preview with `--dry-run` first. `enigma drive health` reports a SMART-style memory-drive health packet (freshness, duplicate rate, tombstone backlog, stale derived artifacts, receipt coverage, connector health) from local metadata only; it is part of the Memory Drive surface in this release, and `enigma status` plus `enigma doctor` cover local passport counts, roots, and connector readiness in every build. Neither setup command prints raw memory plaintext. Treat provider-native memory as non-canonical cache only; the local Enigma vault is canonical.
+`enigma init` creates an encrypted local `.enigma` workspace, bundle, and proof artifacts with no provider or cloud credentials; it requires a local passphrase through `ENIGMA_PASSPHRASE` or `--passphrase-file`. `enigma setup --passphrase-file "$HOME/.enigma/passphrase" --client auto --connect-installed --overwrite` configures the drive and writes the `mcpServers.enigma` entry into every installed/config-present client it detects, skipping clients that are not installed; preview with `--dry-run` first. Never place the passphrase itself in shell arguments.
 
 Optional public test-drive loop:
 
 ```sh
-npx --yes --package enigma-memory enigma test-drive --overwrite
+npx --yes --package enigma-memory enigma test-drive --insecure-dev --overwrite
 ```
 
-`enigma test-drive --overwrite` is zero-credential, local-only, and public-safe by default. It does not call external providers, contact hosted Enigma SaaS, require OpenAI/Anthropic/Cloudflare credentials, create accounts, or write third-party client configs.
+`enigma test-drive --insecure-dev --overwrite` is an **INSECURE, EVALUATION-ONLY** disposable local exercise. It does not call external providers, contact hosted Enigma SaaS, require provider/cloud credentials, create accounts, or write third-party client configs, but its unencrypted keyring has no at-rest confidentiality and must not hold normal data.
 
 ## Copyable starting points
 
@@ -54,8 +56,8 @@ The example app prints ids, counts, roots, and verification status only. It does
 The CI example installs Node 24, installs `enigma-memory` into a disposable npm project, exposes the package benchmark script, then runs:
 
 ```sh
-npx enigma test-drive --overwrite
-npx enigma setup --overwrite
+npx enigma test-drive --insecure-dev --overwrite # INSECURE, EVALUATION ONLY
+npx enigma setup --passphrase-file ./.enigma/passphrase --overwrite
 npx enigma doctor
 npm run benchmark:memory-suite -- --out benchmark-report.json
 ```
@@ -119,7 +121,7 @@ This path is intentionally copyable: npm install, run a local test drive, genera
 
 ## MCP client loop
 
-The same installed package can be used by Claude Desktop, Cursor, Kimi Code, or any generic MCP client. The smooth path is still one local setup plus a dry-run connector preview: `enigma setup --overwrite`, then `enigma connect claude-desktop --dry-run` or the matching client id. Remove `--dry-run` only when you explicitly want Enigma to write that client config. Manual snippets remain useful when a client needs a copied entry; replace the bundle path with the local path from your setup output, and restart the client.
+The same installed package can be used by Claude Desktop, Cursor, Kimi Code, or any generic MCP client. The smooth path is one encrypted local setup plus a dry-run connector preview: securely create `./.enigma/passphrase`, run `enigma setup --passphrase-file ./.enigma/passphrase --overwrite`, then `enigma connect claude-desktop --dry-run` or the matching client id. Remove `--dry-run` only when you explicitly want Enigma to write that client config. Manual snippets remain useful when a client needs a copied entry; replace the bundle path with the local path from your setup output, and restart the client.
 
 Claude Desktop: