Commands

The enigma command reference. Run enigma help for the same list in your terminal.

install & update

enigma install

Install or update the policy skills, memory and slash commands into the agents you select. Auto-detects installed agents; --all targets every supported one, --local installs into the current project instead of user level.

$ enigma install --all --yes

enigma update

Fetch the latest skills from GitHub (no package release needed), sync every deployment, and self-update the enigma-cli package. The new version’s skills, memory and commands are deployed at the end of the same run, so one enigma update leaves the CLI and the policies on the same release.

$ enigma update

Launch a tool

Run a coding agent through enigma so it gets your skills, memory and managed settings. Resolution order: explicit account > active profile > the tool’s active account. Pass args to the tool after --.

enigma claude              # launch Claude Code (default account)
enigma claude work         # a named account
enigma codex -- --version  # forward args to the tool

accounts & profiles

Several logins per tool without logging out, each in its own config dir. A profile pins one account per tool and drives every launch.

enigma account <list|add|use|login|rename|remove|provider|sessions|transfer>

Manage tool accounts. Defaults to Claude Code; target another with --tool <name>.

$ enigma account add work --login
$ enigma account use work --tool codex

Reuse a session (no re-login)

The same Anthropic login stored in two config dirs (a managed account and a pack context, say) can drift apart: Claude rotates the OAuth refresh token on every refresh and invalidates the previous one, so whichever dir refreshes last keeps working and the other is silently signed out. Instead of re-running /login, reuse the live session - copy it into the signed-out account (its refresh token is all Claude Code needs). Claude only.

enigma account sessions                     # list reusable logins (accounts + pack contexts)
enigma account transfer work                # pull the freshest live session into 'work'
enigma account transfer work pack:helio     # or from a specific source

Packs do this automatically: enigma helio keeps its context and the managed account it seeds from on one shared session (freshest token wins on launch, and any refresh is copied back on exit), so enigma claude and the pack never fight. It is also available in the dashboard Accounts tab (“Reuse session” on a signed-out Claude account).

provider points a Claude Code account at another Anthropic-compatible backend (e.g. MiniMax) instead of the default - the default account always stays on Anthropic. Configurable here, in the dashboard Accounts tab, and the TUI (p on an account). The API key is stored encrypted.

enigma account provider work --preset minimax --token <key>   # a built-in preset
enigma account provider work --base https://host/anthropic --model my-model --token <key>
enigma account provider work            # show the current override
enigma account provider work --clear    # back to Anthropic

enigma profile <list|add|use|set|unset|rename|remove>

Group one account per tool under a profile. use none deactivates.

$ enigma profile add work
$ enigma profile set work claude acme
$ enigma profile use work

skills

List skills and choose where each one deploys. A skill can be off everywhere (discarded) or off for one agent only - keep a skill for Claude Code but not opencode.

enigma skills <list|disable|enable> [agent]

No agent argument is the global on/off; with an agent it scopes to that agent.

$ enigma skills list
$ enigma skills disable testing-policy opencode
$ enigma skills enable testing-policy opencode

autoskills

Detect the project’s tech stack and install the matching community skills, kept separate from the policy skills. See Autoskills for detail.

enigma autoskills [path]

Scans packages, config files, file types and gems; installs the matched, hash-verified skills into the project. --dry-run previews; -a <agent> limits targets.

$ enigma autoskills
$ enigma autoskills --dry-run

recall

Local, searchable memory of your coding sessions, built from your own transcripts and exposed to agents over MCP. Off by default. See Recall for detail.

enigma recall <status|sync|search|list|show|timeline|sessions|context|enrich|prune|clear>

sync reads transcripts into the store; search (hybrid keyword+vector)/list/show/timeline/sessions/context query it; enrich runs optional LLM enrichment; prune bounds it; clear wipes it. Reads only your own local logs.

$ enigma config recall on
$ enigma recall sync
$ enigma recall search auth refresh
$ enigma recall timeline 42
$ enigma recall prune 5000

codegraph

enigma’s native codebase memory / code graph (structural code intelligence), exposed to your agents over MCP - no external tool. Off by default. See Codebase memory for detail.

enigma codegraph <status|on|off|index|projects|arch|search>

on/off toggle the tools; index [path] builds the graph for a project; projects lists indexed projects; arch [project] prints the architecture; search <name> finds symbols by name.

$ enigma config code-graph on
$ enigma codegraph index
$ enigma codegraph projects
$ enigma codegraph arch
$ enigma codegraph search Handler

pack

Marketplace of optional, isolated harness packs (e.g. Helio for bug bounty). Each runs in its own agent context, so its skills and commands never load into your normal agent. See Packs for detail.

enigma pack <list|install|remove|update|setup|use|run>

install <id> fetches a pack; enigma <id> [account] (e.g. enigma helio) launches its isolated agent, seeded with the chosen/pinned/active login; use <id> <account|-> pins which account seeds the pack; setup <id> registers the pack’s MCP servers (needs Python); update/remove keep or delete it.

$ enigma pack list
$ enigma pack install helio
$ enigma helio
$ enigma helio work
$ enigma pack use helio work
$ enigma pack setup helio

ssh

Save each server once (host, user, key or encrypted password, jump host, port forwards) and reach it with a short alias. See SSH connections for detail.

enigma ssh <alias|name> | <list|add|edit|remove|info|tunnel|forward>

enigma ssh <alias|name> connects (both are unique connect keys; --name sets the second); add/edit save credentials - a stored password is auto-filled with no extra tools (enigma acts as OpenSSH’s SSH_ASKPASS). Tunnels are standalone, bound to a server: enigma ssh tunnel add <name> <server> <spec>, then start/stop <name> bring the background ssh -N up and down, enigma ssh tunnels lists them with live status, edit/rm re-point or delete. info shows a connection; remove deletes one.

$ enigma ssh add lirio-0 --name lirio-prod --host 192.168.1.138 --user fjrg2007 --password
$ enigma ssh lirio-0
$ enigma ssh tunnel db 9090:5432
$ enigma ssh forward add db 9090:5432 pg
$ enigma ssh tunnel pg

security & guard

A portable, dependency-free commit guard that blocks secrets, .env files and dependency dirs. Set it up once per repo and the whole team inherits it.

enigma security

Install the git security hooks into the current repo.

$ enigma security

enigma guard [--all]

Run the commit guard over staged files, or --all for every tracked file.

$ enigma guard --all

compress

Shrink JSON, logs or text to fewer tokens, reversibly (the original is cached and recoverable via its hash). Reads a file or stdin.

enigma compress [file]

--retrieve <hash> restores an original, --stats shows cumulative savings, --clear wipes all dashboard data, --type forces the content type.

$ cat big.json | enigma compress
$ enigma compress --stats

enigma mcp

Run the context-compression MCP server over stdio (used by the agents when compress is on).

guardrails

Enforce project conventions via a post-edit hook that feeds violations back to the agent, plus a turn-end sweep over the lines a change added. On by default. See Convention guardrails for detail.

enigma guardrails [cmd]

No argument lists the rules; check <file> runs them against a file; stats [days] reports which rules the agent keeps breaking, and whether it was stopped or the code shipped anyway, plus a separate table for how often a reply broke the output-style level; disable/enable <id> toggles a built-in; remove <id> drops a custom rule. Toggle the feature with enigma config guardrails on|off.

$ enigma guardrails
$ enigma guardrails check db/schema.sql
$ enigma guardrails stats 30
$ enigma guardrails disable db-uuid-pk
$ enigma config guardrails off

trim

Remove the blank line agents leave at the end of a file. On by default: it runs after each agent edit and, at commit time, over the staged files, re-staging what it fixed.

enigma trim [--all]

No argument fixes the staged files and re-stages them; --all sweeps every tracked file, which is how you clean a repo retroactively. A file is only changed when it has real content followed by one or more blank lines at the end, so an empty file, a file of only blank lines, and a last line with no closing newline are all left alone. A staged file that also has unstaged edits is fixed on disk but not re-staged, so git add never pulls unrelated work into the commit.

$ enigma trim
$ enigma trim --all
$ enigma config trim off

verify

Check that work reported as finished actually is. Runs automatically at turn end (on by default). See Verified completion for detail.

enigma verify [cmd]

No argument checks the current change for evidence of unfinished work, sweeps its added lines for convention violations, and runs the configured verification command; --all sweeps every tracked file; parity <source> <target> compares a codebase against a port or clone of it and reports what was never carried over. Exits non-zero when something is unfinished, so it doubles as a CI check.

$ enigma verify
$ enigma verify --all
$ enigma verify parity ../original .
$ enigma config verify-command "npm test"
$ enigma config verify off

api

Serve your local Claude Code over an OpenAI-compatible HTTP API - all of its tools, skills, MCP and sessions, reachable from any OpenAI client library. Loopback-only. See Local API for detail.

enigma api

Endpoints under /v1 (chat/completions, messages, models, sessions). --port <n> overrides the port (else the apiPort config, default 8000); --api-key <k> (or ENIGMA_API_KEY) gates every /v1 route; --tool <t> selects the backing agent. Ctrl+C to stop.

$ enigma api
$ enigma api --port 8080
$ enigma api --api-key mysecret

dashboard

A browser control panel for all of enigma - accounts, skills, settings, system cleanup - that also shows real Claude usage and measured savings. Loopback-only by default: nothing leaves your machine.

enigma dashboard

Alias enigma dash. Runs while open by default; enigma config dashboard always keeps a lightweight background daemon. stop shuts down whichever one is serving - a background daemon has no terminal to Ctrl+C.

$ enigma dashboard
$ enigma dashboard stop

On a server

With no browser to open (a host reached over SSH), enigma dashboard prints the tunnel command instead of failing. This is the recommended way in: the port stays on loopback and SSH already authenticates whoever reaches it.

ssh -N -L 24282:127.0.0.1:24282 user@host   # then open http://localhost:24282

It also offers to expose the dashboard on the network - just this once, or always (dashboard-bind: lan). Because the dashboard can run agents with your credentials, kill processes and rewrite config, exposing it always requires a token: a non-loopback bind refuses to start without one, and every /v1-style /api/* request must carry it.

enigma dashboard --expose

Bind every interface for this run without persisting it, minting a token if needed. enigma config dashboard-bind lan makes it stick; custom + dashboard-bind-address pins one interface (e.g. a Tailscale IP). dashboard token prints the token, --new rotates it and kills every link already handed out.

$ enigma dashboard --expose
$ enigma dashboard token --new

The printed link carries the token as a URL fragment (http://host:24282/#token=...). A fragment is never sent to the server, so unlike a query string it cannot land in an access log or a Referer header; the page moves it into sessionStorage and strips it from the address bar. Treat that link as a password.

Exposing a dashboard directly to the public internet is not a supported setup - prefer the SSH tunnel or a private network (Tailscale), and put TLS in front of it if it must cross one.

gate

An experimental AI quality gate that validates a branch through a review/test/docs/lint/push/PR/CI pipeline in a disposable worktree before it reaches your push target. On by default; turn it off with enigma config gate off (add -l for this project only). See Quality gate for detail.

enigma gate <init|status|runs|rerun|doctor|eject|daemon|axi>

Enable it with enigma config gate on, then enigma gate init in a repo. init sets up the gate (and the gate git remote); status/runs inspect runs; rerun re-runs the branch; doctor diagnoses; eject removes it; axi is the machine interface the /gate skill drives.

$ enigma config gate on
$ enigma gate init
$ enigma gate status

fix-path & issue

enigma fix-path [tool]

Find a tool installed but not on PATH and make enigma <tool> (and the bare command) launch it.

$ enigma fix-path claude

enigma issue [bug|feature]

Open a prefilled GitHub issue with your environment autocompleted.

$ enigma issue bug