install & update
enigma install
Install or update the policy skills, memory and slash commands into the agents you select. Auto-detects installed agents; --all targets every supported one, --local installs into the current project instead of user level.
enigma update
Fetch the latest skills from GitHub (no package release needed), sync every deployment, and self-update the enigma-cli package. The new version’s skills, memory and commands are deployed at the end of the same run, so one enigma update leaves the CLI and the policies on the same release.
Launch a tool
Run a coding agent through enigma so it gets your skills, memory and managed settings. Resolution order: explicit account > active profile > the tool’s active account. Flags after the tool name are passed to it.
enigma claude # launch Claude Code (default account)
enigma claude work # a named account
enigma claude --resume <id> # flags go to the toolaccounts & profiles
Several logins per tool without logging out, each in its own config dir. A profile pins one account per tool and drives every launch.
enigma account <list|add|use|login|rename|remove|provider|sessions|transfer>
Manage tool accounts. Defaults to Claude Code; target another with --tool <name>.
Reuse a session (no re-login)
The same Anthropic login stored in two config dirs (a managed account and a pack context, say) can drift apart: Claude rotates the OAuth refresh token on every refresh and invalidates the previous one, so whichever dir refreshes last keeps working and the other is silently signed out. Instead of re-running /login, reuse the live session - copy it into the signed-out account (its refresh token is all Claude Code needs). Claude only.
enigma account sessions # list reusable logins (accounts + pack contexts)
enigma account transfer work # pull the freshest live session into 'work'
enigma account transfer work pack:helio # or from a specific sourcePacks do this automatically: enigma helio keeps its context and the managed account it seeds from on one shared session (freshest token wins on launch, and any refresh is copied back on exit), so enigma claude and the pack never fight. It is also available in the dashboard Accounts tab (“Reuse session” on a signed-out Claude account).
provider points a Claude Code account at another Anthropic-compatible backend (e.g. MiniMax) instead of the default - the default account always stays on Anthropic. Configurable here, in the dashboard Accounts tab, and the TUI (p on an account). The API key is stored encrypted.
enigma account provider work --preset minimax --token <key> # a built-in preset
enigma account provider work --base https://host/anthropic --model my-model --token <key>
enigma account provider work # show the current override
enigma account provider work --clear # back to Anthropicenigma profile <list|add|use|set|unset|rename|remove>
Group one account per tool under a profile. use none deactivates.
skills
List skills and choose where each one deploys. A skill can be off everywhere (discarded) or off for one agent only - keep a skill for Claude Code but not opencode.
enigma skills <list|disable|enable> [agent]
No agent argument is the global on/off; with an agent it scopes to that agent.
autoskills
Detect the project’s tech stack and install the matching community skills, kept separate from the policy skills. See Autoskills for detail.
enigma autoskills [path]
Scans packages, config files, file types and gems; installs the matched, hash-verified skills into the project. --dry-run previews; -a <agent> limits targets.
design
Reverse-engineer a design system from a live site, a local project or a git repo into DESIGN.md and an agent skill. See Design extraction for detail.
enigma handoff <save|show|status|clear>
Keep a one-page handoff for this project so the context can be cleared; the next session receives it once and continues. Agents write it through /handoff.
enigma relay [--agent claude|codex|opencode|kimi] [--max N] <task>
Run a long task as a chain of fresh headless sessions that hand off to each other, until one reports STATUS: done.
enigma design <url|path|git-url>
Writes <name>-design/ with DESIGN.md, SKILL.md, references, tokens and fonts, packs it as a .skill archive and installs the skill into each detected agent (-l for this project, --no-install to skip). --ultra adds screenshots, motion, layout and hover states through a local Chrome, Edge, Chromium or Brave.
recall
Local, searchable memory of your coding sessions, built from your own transcripts and exposed to agents over MCP. Off by default. See Recall for detail.
enigma recall <status|sync|search|list|show|timeline|sessions|context|enrich|prune|clear>
sync reads transcripts into the store; search (hybrid keyword+vector)/list/show/timeline/sessions/context query it; enrich runs optional LLM enrichment; prune bounds it; clear wipes it. Reads only your own local logs.
codegraph
enigma’s native codebase memory / code graph (structural code intelligence), exposed to your agents over MCP - no external tool. On by default. See Codebase memory for detail.
enigma codegraph <status|index|projects|arch|search>
index [path] builds the graph for a project; projects lists indexed projects; arch [project] prints the architecture; search <name> finds symbols by name. Turning the tools on and off is enigma config code-graph on|off, like every other setting - add -l to scope it to this project.
enigma codegraph <ask|callers|callees|skeleton|map|report|grep|graph|check>
Read the graph to answer a question. ask ranks the symbols and files a task concerns (--source inlines the code); callers/callees walk dependencies (--depth N for the full blast radius); skeleton prints one file’s signatures without its bodies; map orients you in an unfamiliar repo; report prints the one page a session starts with (functional areas, their key symbols and docs, the project’s notes); grep returns every hit grouped by enclosing symbol; graph cuts a drawable slice of nodes and edges around a focus (--scope files for the import graph, --depth N to widen it, --dot for Graphviz); check reports drift and exits non-zero when the graph is stale.
Shared flags: --in <path> narrows to a subtree, --limit N caps results, --project <name> picks a graph, --json prints the raw result, --no-refresh skips the pre-query re-index. A flag with a missing or invalid value is a usage error rather than a silent fallback; pass a pattern that starts with a dash after --.
pack
Marketplace of optional, isolated harness packs: Helio for bug bounty, Orion for broken flows, speed and scale. Each runs in its own agent context, so its skills and commands never load into your normal agent. See Packs for detail.
enigma pack <list|install|remove|update|setup|use|run>
install <id> fetches a pack; enigma <id> [account] (e.g. enigma helio, enigma orion) launches its isolated agent, seeded with the chosen/pinned/active login; use <id> <account|-> pins which account seeds the pack; setup <id> registers a pack’s script MCP servers (Helio’s need Python; Orion’s browser is wired on launch); update/remove keep or delete it.
ssh
Save each server once (host, user, key or encrypted password, jump host, port forwards) and reach it with a short alias. See SSH connections for detail.
enigma ssh <alias|name> | <list|add|edit|remove|info|tunnel|forward>
enigma ssh <alias|name> connects (both are unique connect keys; --name sets the second); add/edit save credentials - a stored password is auto-filled with no extra tools (enigma acts as OpenSSH’s SSH_ASKPASS). Tunnels are standalone, bound to a server: enigma ssh tunnel add <name> <server> <spec>, then start/stop <name> bring the background ssh -N up and down, enigma ssh tunnels lists them with live status, edit/rm re-point or delete. info shows a connection; remove deletes one.
security & guard
A portable, dependency-free commit guard that blocks secrets, .env files and dependency dirs. Set it up once per repo and the whole team inherits it.
enigma security
Install the git security hooks into the current repo.
enigma guard [--all]
Run the commit guard over staged files, or --all for every tracked file.
compress
Shrink JSON, logs or text to fewer tokens, reversibly (the original is cached and recoverable via its hash). Reads a file or stdin.
enigma compress [file]
--retrieve <hash> restores an original, --stats shows cumulative savings, --clear wipes all dashboard data, --type forces the content type.
enigma mcp
Run the context-compression MCP server over stdio (used by the agents when compress is on).
guardrails
Enforce project conventions via a post-edit hook that feeds violations back to the agent, plus a turn-end sweep over the lines a change added. On by default. See Convention guardrails for detail.
enigma guardrails [cmd]
No argument lists the rules; check <file> runs them against a file; stats [days] reports which rules the agent keeps breaking, and whether it was stopped or the code shipped anyway, plus a separate table for how often a reply broke the output-style level; disable/enable <id> toggles a built-in; remove <id> drops a custom rule. Toggle the feature with enigma config guardrails on|off.
trim
Remove the blank line agents leave at the end of a file. On by default: it runs after each agent edit and, at commit time, over the staged files, re-staging what it fixed.
enigma trim [--all]
No argument fixes the staged files and re-stages them; --all sweeps every tracked file, which is how you clean a repo retroactively. A file is only changed when it has real content followed by one or more blank lines at the end, so an empty file, a file of only blank lines, and a last line with no closing newline are all left alone. A staged file that also has unstaged edits is fixed on disk but not re-staged, so git add never pulls unrelated work into the commit.
ci-watch
Tells your agent when the GitHub Actions run its push triggered has failed, with the failing log attached. On by default; needs the gh CLI. See CI failure notifier for detail.
enigma config ci-watch off
No standalone command - it runs as a background process plus a hook, both wired automatically. Toggle it with enigma config ci-watch on|off.
verify
Check that work reported as finished actually is. Runs automatically at turn end (on by default). See Verified completion for detail.
enigma verify [cmd]
No argument checks the current change for evidence of unfinished work, sweeps its added lines for convention violations, and runs the configured verification command; --all sweeps every tracked file; parity <source> <target> compares a codebase against a port or clone of it and reports what was never carried over. Exits non-zero when something is unfinished, so it doubles as a CI check.
api
Serve your local Claude Code over an OpenAI-compatible HTTP API - all of its tools, skills, MCP and sessions, reachable from any OpenAI client library. Loopback-only. See Local API for detail.
enigma api
Endpoints under /v1 (chat/completions, messages, models, sessions). --port <n> overrides the port (else the apiPort config, default 8000); --api-key <k> (or ENIGMA_API_KEY) gates every /v1 route; --tool <t> selects the backing agent; --account/--profile/--pack set the context; --rotation <strategy> spreads requests across accounts (off, round-robin, least-used, fill-first, random). Ctrl+C to stop.
dashboard
A browser control panel for all of enigma - accounts, skills, settings, system cleanup - that also shows real Claude usage and measured savings. Loopback-only by default: nothing leaves your machine.
enigma dashboard
Alias enigma dash. Runs while open by default; enigma config dashboard always keeps a lightweight background daemon. stop shuts down whichever one is serving - a background daemon has no terminal to Ctrl+C.
On a server
With no browser to open (a host reached over SSH), enigma dashboard prints the tunnel command instead of failing. This is the recommended way in: the port stays on loopback and SSH already authenticates whoever reaches it.
ssh -N -L 24282:127.0.0.1:24282 user@host # then open http://localhost:24282It also offers to expose the dashboard on the network - just this once, or always (dashboard-bind: lan). Because the dashboard can run agents with your credentials, kill processes and rewrite config, exposing it always requires a token: a non-loopback bind refuses to start without one, and every /v1-style /api/* request must carry it.
enigma dashboard --expose
Bind every interface for this run without persisting it, minting a token if needed. enigma config dashboard-bind lan makes it stick; custom + dashboard-bind-address pins one interface (e.g. a Tailscale IP). dashboard token prints the token, --new rotates it and kills every link already handed out.
The printed link carries the token as a URL fragment (http://host:24282/#token=...). A fragment is never sent to the server, so unlike a query string it cannot land in an access log or a Referer header; the page moves it into sessionStorage and strips it from the address bar. Treat that link as a password.
Exposing a dashboard directly to the public internet is not a supported setup - prefer the SSH tunnel or a private network (Tailscale), and put TLS in front of it if it must cross one.
gate
An experimental AI quality gate that validates a branch through a review/test/docs/lint/push/PR/CI pipeline in a disposable worktree before it reaches your push target. On by default; turn it off with enigma config gate off (add -l for this project only). See Quality gate for detail.
enigma gate <init|status|runs|rerun|doctor|eject|daemon|axi>
Enable it with enigma config gate on, then enigma gate init in a repo. init sets up the gate (and the gate git remote); status/runs inspect runs; rerun re-runs the branch; doctor diagnoses; eject removes it; axi is the machine interface the /gate skill drives.
kill & resources
Free what a machine is holding: a port a dead dev server still owns, a process that will not close, Docker Desktop, or WSL’s vmmemWSL sitting on several GB of RAM.
enigma kill <target...>
A plain number is a port, so enigma kill 3000 kills whatever is listening there; :3000 and port 3000 say it explicitly, and pid 1234 kills one process by id. A name kills every process running under it (.exe optional; a partial name only when it matches one program) - unless it matches more than 5, since a name that broad is usually a whole fleet of unrelated dev tooling rather than the one thing meant; name one by pid instead, or repeat the command with --yes/-y to kill them all. docker quits Docker Desktop and shuts its WSL backend down, wsl runs wsl --shutdown so vmmemWSL gives its memory back. Several targets at once are fine. Typing the command is the confirmation, but system processes, enigma itself and its shell are always refused.
enigma resources [action]
No argument prints the snapshot: memory in use, whether WSL and Docker are up, the top processes by memory and every listening port with its owner. The actions (wsl, docker, free-port <port>, kill <pid>) are the long form of enigma kill. The same view is a tab in the dashboard and in the TUI, where each action confirms before it runs.
add
enigma add [name...]
Add headless components and utilities to the project as a dependency, with its own package manager. No name lists the catalogue; --copy vendors the source instead. See Components.
config
enigma config [key value]
No argument opens the settings menu; config <key> <value> sets one (-l for this project only, -g for every project). See Configuration for every key.
shim, doctor & statusline
enigma shim [on|off]
Launch each installed agent under its own name (claude, not enigma claude) through a shell function, so terminals that detect the agent from the typed command keep doing so. No argument shows what your profile holds.
enigma doctor [hooks]
Time every hook wired into Claude Code (settings files and enabled plugins) and name the slow one behind a hook timed out message.
enigma statusline
Render the agent status bar: badge, model, context, cost and live gate progress. Wired by enigma install; you rarely run it by hand.
branches & completion
enigma branches [tidy]
Report working branches that are finished; tidy removes the ones the default branch already contains, locally and on the remote.
enigma completion [shell]
Print a completion script for bash, zsh, fish or PowerShell; install it wherever your shell reads completions.
fix-path & issue
enigma fix-path [tool]
Find a tool installed but not on PATH and make enigma <tool> (and the bare command) launch it.
enigma issue [bug|feature]
Open a prefilled GitHub issue with your environment autocompleted.