enigma-cli

Everything you need to work with a coding agent, in one command. enigma installs a shared set of engineering policy skills into the agents you actually use (Claude Code, OpenAI Codex, opencode) and sets up portable git security hooks that block secrets, .env files, and dependency dirs from being committed.

Install

One command, no global install, no prompts - deploy the skills to every supported agent at user level:

npx enigma-cli@latest install --all --yes

Or install the command and pick interactively:

npm install -g enigma-cli      # provides the `enigma` command
enigma                         # interactive hub: pick what to set up

That first install is the only one you ever need to run by hand: afterwards, launching a tool through enigma (e.g. enigma claude) auto-syncs the deployed skills and memory with the installed package version (see Auto-sync).

Commands

enigma                 Interactive menu: choose features to set up
enigma install         Install/update agent skills
enigma security        Set up git security hooks in the current repo
enigma guard [--all]   Run the commit guard (staged files, or all tracked)
enigma config [k v]    Show or set runtime toggles (e.g. config commit-emoji off)
enigma claude [acct]   Launch Claude Code using an account (active if omitted);
                       auto-syncs deployed skills first
enigma account ...     Manage Claude Code accounts (list/add/use/login/remove)
enigma seal            Maintenance: (re)compute skill content hashes
enigma check           Integrity gate: verify skills are well-formed and sealed
enigma help | version

Agent skills

Skills are authored once and deployed to every selected agent (no per-agent duplication). enigma install auto-detects which agents are installed (CLI on PATH or a config dir like ~/.claude, ~/.codex, ~/.config/opencode) and preselects them; --all targets every supported agent.

(--local installs into the current project instead.)

Auto-sync on launch

After the first enigma install, you never need to run it again: whenever you launch a tool through enigma (enigma claude, enigma account run work), enigma first compares the deployed skills/memory against the installed package version and silently refreshes anything that changed (new skills, updated versions, removed skills, memory-file edits). On by default; opt out with:

enigma config auto-sync off

Auto-sync is deliberately conservative:

• It only touches agents/scopes that already have a deployment - it never performs a first install (that stays your explicit enigma install).
• Skills you modified locally are never overwritten (same rule as --keep-modified).
• The memory file (CLAUDE.md / AGENTS.md) is only rewritten when it is byte-identical to what enigma last wrote (tracked in ~/.enigma/state.json) - a file you authored or edited is never touched.
• A sync failure never blocks the launch; the tool starts anyway.

Git security hooks

enigma security drops a portable, dependency-free commit guard into any repo: it copies guard.mjs into the repo's .githooks/, writes a cross-platform pre-commit shim and a toggle config, and points core.hooksPath at it. Commit .githooks/ so the team inherits it. Because it runs on git commit, it also covers commits made through the GitHub CLI (gh).

On every commit the guard, OS-agnostically:

• Blocks committed secrets (API keys, tokens, private keys).
• Blocks .env / .env.local (allows *.example / *.sample / *.template).
• Blocks dependency/cache dirs (node_modules, __pycache__, virtualenvs).
• Warns on generated dirs (dist, build, .next, coverage), log/OS-junk files, and files over 5 MB.

Each protection is individually toggleable (saved to .githooks/enigma-guard.json). Bypass once with git commit --no-verify.

Multiple Claude Code accounts

Work across separate workflows with different Claude Code accounts/profiles - for example your company Claude Code account and your personal one - keeping each fully isolated and switching between them without ever logging out. Each profile has its own credentials, session, and history, so client work never mixes with personal projects.

This is for legitimate, professional account separation (one account per employer/context, as many organizations require). It is not a way to evade usage limits or Anthropic's terms - each account still authenticates as itself and is subject to its own limits. Use the account that each piece of work belongs to.

Claude Code reads its credentials and session from the directory in CLAUDE_CONFIG_DIR (default ~/.claude), so each profile just needs its own directory. Rather than hand-editing per-shell aliases, enigma launches Claude for you with that variable set - the same command on macOS, Linux and Windows.

enigma account add work --login   # create 'work' and run /login to authenticate
enigma account add personal       # create 'personal' (log in later)
enigma account list               # show all accounts (active one marked *)
enigma claude work                # run Claude Code as 'work'
enigma account use personal       # make 'personal' the active account
enigma claude                     # run the active account
enigma claude work -- --version   # forward args after -- to Claude
enigma account remove work        # delete an account and its config dir

Your existing ~/.claude is always available as the built-in default account (it is never deleted). New accounts live under ~/.enigma/<tool>/<name>/. A bare claude command keeps using ~/.claude as before.

From the hub TUI (enigma), the Accounts panel lists accounts - showing the tool (e.g. Claude Code) and the signed-in email for each - and lets you add (a), set active (enter), connect/log in (c), or remove (d). Adding prompts for a name and then offers to connect right away. Connecting closes the hub, runs the tool's own login flow (for Claude: it launches and you run /login), then reopens the hub. enigma account list shows the same details, and enigma account add <name> does the same from the CLI.

The mechanism is tool-agnostic by design: only Claude Code is wired up today, but the same per-account-config-dir approach extends to other agents (e.g. Codex via CODEX_HOME). Target another tool with --tool <name> on account commands.

GitHub CLI telemetry (default off)

If the GitHub CLI (gh) is installed, enigma install disables its usage telemetry (gh config set telemetry disabled). This is pure privacy upside - telemetry is usage analytics only (command, flags, OS/version, device ids) and no gh feature depends on it - and it also avoids a known Windows bug where the detached gh send-telemetry subprocess spawns tzutil.exe without hiding its window, flashing a terminal on gh invocations (cli/cli#13354). Re-enable any time:

enigma config gh-telemetry on     # restore gh's default
enigma config gh-telemetry off    # disable again

Commit emojis

By default the policy skills make commit subjects carry a leading type emoji (one per subject, e.g. for feat/fix); code, prose, and PR text stay emoji-free. The convention and its type-to-emoji map live in the git-policy skill. Opt out per repo or globally:

enigma config commit-emoji off       # disable (writes .enigma.json)
enigma config commit-emoji on        # re-enable
enigma config commit-emoji off -g    # global (~/.enigma.json)

Precedence: built-in default (on) -> ~/.enigma.json -> repo .enigma.json.

Parallel sub-agents

The memory file always tells agents to break long or complex tasks into smaller subtasks and complete them incrementally. The parallel part - delegating independent subtasks to sub-agents that run at the same time to finish faster - is opt-in, because spawning sub-agents multiplies token cost:

enigma config parallel-subagents on        # add the parallel section to the memory file
enigma config parallel-subagents off       # remove it (default)
enigma config parallel-subagents on -g      # global (~/.enigma.json)

This toggle edits the deployed agent memory file (adds or removes the section), so restart Claude Code / Codex / OpenCode after changing it for the new session to pick it up. Subtask decomposition itself is always on and is never removed.

Token-efficient output

Optionally compress the agent's chat prose to cut output tokens while keeping full technical accuracy. Chosen at install or via config; off by default:

enigma config output-style lite     # professional terse (drop filler, keep grammar)
enigma config output-style full     # shorter, drops articles and uses fragments
enigma config output-style ultra    # telegraphic, maximum compression
enigma config output-style off      # back to full prose (default)
enigma install --output-style lite  # set it during install

on/off also work (on = full). Like the toggle above it edits the memory file, so restart your agent after changing it. Code, comments, commits, and PRs stay normal, the agent reverts to full prose for security warnings and other safety-critical replies, and the level is switchable mid-session by asking ("be more terse", "ultra", "normal mode").

Claude Code's status bar shows an [ENIGMA] badge at all times; while the mode is active it appends the level ([ENIGMA:FULL], [ENIGMA:LITE], [ENIGMA:ULTRA]). enigma wires this into settings.json during enigma install, only when you have no status line configured (it never replaces your own). If you upgraded the package, re-run enigma install once to wire it.

License

Apache-2.0.