enigma-cli

Everything you need to work with a coding agent, in one command. enigma installs a shared set of engineering policy skills into the agents you actually use (Claude Code, OpenAI Codex, opencode) and sets up portable git security hooks that block secrets, .env files, and dependency dirs from being committed.

Install

npm install -g enigma-cli      # provides the `enigma` command
enigma                         # interactive: pick what to set up

Or run once without installing: npx enigma-cli.

Commands

enigma                 Interactive menu: choose features to set up
enigma install         Install/update agent skills
enigma security        Set up git security hooks in the current repo
enigma guard [--all]   Run the commit guard (staged files, or all tracked)
enigma config [k v]    Show or set runtime toggles (e.g. config commit-emoji off)
enigma claude [acct]   Launch Claude Code using an account (active if omitted)
enigma account ...     Manage Claude Code accounts (list/add/use/login/remove)
enigma seal            Maintenance: (re)compute skill content hashes
enigma check           Integrity gate: verify skills are well-formed and sealed
enigma help | version

Agent skills

Skills are authored once and deployed to every selected agent (no per-agent duplication). enigma install auto-detects which agents are installed (CLI on PATH or a config dir like ~/.claude, ~/.codex, ~/.config/opencode) and preselects them; --all targets every supported agent.

(--local installs into the current project instead.)

Git security hooks

enigma security drops a portable, dependency-free commit guard into any repo: it copies guard.mjs into the repo's .githooks/, writes a cross-platform pre-commit shim and a toggle config, and points core.hooksPath at it. Commit .githooks/ so the team inherits it. Because it runs on git commit, it also covers commits made through the GitHub CLI (gh).

On every commit the guard, OS-agnostically:

• Blocks committed secrets (API keys, tokens, private keys).
• Blocks .env / .env.local (allows *.example / *.sample / *.template).
• Blocks dependency/cache dirs (node_modules, __pycache__, virtualenvs).
• Warns on generated dirs (dist, build, .next, coverage), log/OS-junk files, and files over 5 MB.

Each protection is individually toggleable (saved to .githooks/enigma-guard.json). Bypass once with git commit --no-verify.

Multiple Claude Code accounts

Work across separate workflows with different Claude Code accounts/profiles - for example your company Claude Code account and your personal one - keeping each fully isolated and switching between them without ever logging out. Each profile has its own credentials, session, and history, so client work never mixes with personal projects.

This is for legitimate, professional account separation (one account per employer/context, as many organizations require). It is not a way to evade usage limits or Anthropic's terms - each account still authenticates as itself and is subject to its own limits. Use the account that each piece of work belongs to.

Claude Code reads its credentials and session from the directory in CLAUDE_CONFIG_DIR (default ~/.claude), so each profile just needs its own directory. Rather than hand-editing per-shell aliases, enigma launches Claude for you with that variable set - the same command on macOS, Linux and Windows.

enigma account add work --login   # create 'work' and run /login to authenticate
enigma account add personal       # create 'personal' (log in later)
enigma account list               # show all accounts (active one marked *)
enigma claude work                # run Claude Code as 'work'
enigma account use personal       # make 'personal' the active account
enigma claude                     # run the active account
enigma claude work -- --version   # forward args after -- to Claude
enigma account remove work        # delete an account and its config dir

Your existing ~/.claude is always available as the built-in default account (it is never deleted). New accounts live under ~/.enigma/<tool>/<name>/. A bare claude command keeps using ~/.claude as before.

From the hub TUI (enigma), the Accounts panel lists accounts - showing the tool (e.g. Claude Code) and the signed-in email for each - and lets you add (a), set active (enter), connect/log in (c), or remove (d). Adding prompts for a name and then offers to connect right away. Connecting closes the hub, runs the tool's own login flow (for Claude: it launches and you run /login), then reopens the hub. enigma account list shows the same details, and enigma account add <name> does the same from the CLI.

The mechanism is tool-agnostic by design: only Claude Code is wired up today, but the same per-account-config-dir approach extends to other agents (e.g. Codex via CODEX_HOME). Target another tool with --tool <name> on account commands.

Commit emojis

By default the policy skills make commit subjects carry a leading type emoji (one per subject, e.g. for feat/fix); code, prose, and PR text stay emoji-free. The convention and its type-to-emoji map live in the git-policy skill. Opt out per repo or globally:

enigma config commit-emoji off       # disable (writes .enigma.json)
enigma config commit-emoji on        # re-enable
enigma config commit-emoji off -g    # global (~/.enigma.json)

Precedence: built-in default (on) -> ~/.enigma.json -> repo .enigma.json.

Parallel sub-agents

The memory file always tells agents to break long or complex tasks into smaller subtasks and complete them incrementally. The parallel part - delegating independent subtasks to sub-agents that run at the same time to finish faster - is opt-in, because spawning sub-agents multiplies token cost:

enigma config parallel-subagents on        # add the parallel section to the memory file
enigma config parallel-subagents off       # remove it (default)
enigma config parallel-subagents on -g      # global (~/.enigma.json)

This toggle edits the deployed agent memory file (adds or removes the section), so restart Claude Code / Codex / OpenCode after changing it for the new session to pick it up. Subtask decomposition itself is always on and is never removed.

Token-efficient output

Optionally compress the agent's chat prose to cut output tokens while keeping full technical accuracy (inspired by caveman). Chosen at install or via config; off by default:

enigma config output-style lite     # professional terse (drop filler, keep grammar)
enigma config output-style full     # caveman-style fragments
enigma config output-style ultra    # telegraphic, maximum compression
enigma config output-style off      # back to full prose (default)
enigma install --output-style lite  # set it during install

on/off also work (on = full, caveman's default). Like the toggle above it edits the memory file, so restart your agent after changing it. Code, comments, commits, and PRs stay normal, the agent reverts to full prose for security warnings and other safety-critical replies, and the level is switchable mid-session by asking ("be more terse", "ultra", "normal mode").

License

Apache-2.0.