Ask more than one model. Watch what it spends. Let it use secrets it never sees.
Your models, your credentials, your machine — one binary, no account, no telemetry.
Download • AnvilHub • Changelog • Product Page
Anvil is a terminal-native AI workbench that treats models as interchangeable parts you own, not as a service you rent.
Most assistants give you one model behind one vendor's pipe. Anvil gives you 35 providers, a 143-command surface, and the machinery to make several models argue with each other, to price every turn before you spend it, and to hand a credential to a tool without ever showing it to the model.
It runs as a single binary on seven platforms, needs no account, and sends no telemetry. Point it at cloud APIs with your own keys, or at a local Ollama and never leave the machine.
Three problems the single-vendor model can't solve:
One model's answer looks the same whether it's right or wrong. There's no second opinion, no visible disagreement, nothing to tell you the confident paragraph you just read is the one case it gets wrong. Anvil's answer is /consult — ask a panel, then look at where they diverge.
Spend is invisible until the invoice. Per-token pricing drifts, providers differ by 50×, and most tools show you a number after the money is gone — or quietly show $0.00 because they couldn't price the call. Anvil prices each turn against a live registry, refuses before the provider call when a cap would break, and says "unknown" rather than lying with a zero.
Secrets get pasted into prompts. Every key you type into a chat box is a key that model saw, that vendor logged, and that transcript now contains. Anvil detects credentials at the boundary, vaults them, and replaces them with a handle it resolves only when a tool actually runs.
| 🧠 Ask more than one | /consult puts one question to a panel of models simultaneously — each through its own client and its own key — and reports agreement, divergence, and what the minority saw that the others missed. /relay hands one problem down a chain in order, each model seeing the real transcript before it, redacted at every vendor boundary. Neither will fake it: a consult of one is not a consult. |
| 💰 See the money first | Every turn priced against a live pricing registry and booked per seat. A budget cap refuses before the provider call, not after. An unpriced turn reports its total as unknown — never as $0. /cost aggregates daily, weekly, monthly, yearly, by provider. |
| 🔐 Use a secret without seeing it | Typed credential vault — AES-256-GCM envelope encryption, Argon2id key derivation. Pasted credentials are detected at ingest, moved into the vault, and replaced with a {{vault:label}} handle the host resolves only at tool-run time. A loan to another seat supplies the label, never the value. |
| 🛡 Refuse at the point of effect | Per-principal capabilities, workspace scoping, and a permission gate enforced where the action happens — not where it's requested. Sandbox policy floor (strict/preferred/off) with real macOS seatbelt enforcement, an egress allowlist, and a tamper-evident audit log verifiable with anvil audit verify. |
| 👤 Know who did what | Actions are attributed to the seat that took them, not to "the session". A peer's message is labelled as the peer's. Roles carry real scope, and a viewer-role seat gets a disabled composer rather than a hidden button. |
| 🌐 Run it anywhere you look | The same session in the terminal, a browser, or a phone — full slash-command surface on every one, not a read-only mirror. /local-control serves the whole console over loopback with no cloud round-trip. |
| 🧭 Give it a memory and a map | A seven-layer memory system you can browse, edit, and re-scope, with [[links]] between entries. /mindmap renders your thinking as a force-directed graph you can drive from the terminal or the browser. |
| 🤖 A team, not a tool | /team delegates to parallel sub-agents; /chain runs multi-step chains end-to-end. Specialists are filed into 12 squads (security, infra, compliance, quality, delivery, build, legal, finance, healthcare, education, busops, research) — and an unstaffed squad refuses rather than quietly running a general-purpose agent instead. |
| 🧮 Expertise that costs nothing until used | A real agent library is dozens of specialists. Naming them all to the model is thousands of tokens of roster on every turn, spent before any work happens — and it grows as you add agents. Anvil shows the model twelve squad names and a one-line brief (~300 tokens, fixed) and resolves the concrete specialist host-side. The model asks for a capability; individual agent slugs never enter its context. Add a hundred agents and the per-turn cost does not move. |
| 📡 Every machine you own | /fleet sends one task to every eligible Anvil on your account and collects the answers, routing by --capability so a job lands on a host that can actually run it. It reports what was sent, what refused, and who was never eligible — no silent partial fan-out. |
| 🔌 Extend it, then share it | MCP client with local and remote transports (Streamable HTTP/SSE, browser OAuth). Build a skill, plugin, theme or agent locally, sync it up as a private draft, review it, then publish to the AnvilHub marketplace under your own identity — nothing leaves your machine until you say so. Install or remove capabilities on any claimed Anvil from the web: applied live when it is online, queued when it is asleep. |
Ask a panel instead of an oracle:
> /consult which of these two migration plans is safer?
CONSENSUS 3 of 4 seats agree plan B is safer
DIVERGENCE 1 seat dissents on the rollback window
THE DISSENT asked gpt-5.6 directly — it flagged a 40-minute
window where both schemas are live, which the
majority did not model
/consult will refuse a panel of one — that isn't a consult, and it says so.
Hand one problem down a chain:
> /relay draft it, then review it, then harden it
claude-opus-5 → gpt-5.6 → grok-4.5
Each model sees the real transcript of the work before it, redacted at every vendor boundary.
Know the price before you pay it:
> /budget set 5.00/day
> /cost
today $1.84 anthropic $1.20 · openai $0.61 · ollama $0.00
1 turn unpriced — total is a LOWER BOUND, not $0
The cap refuses the next call before it goes out, not after the money is gone.
Ask for a capability, not a name. This — and nothing more — is what the model is told about your agent library:
Delegate by capability; the host picks the specialist:
security — offensive testing, vulnerability assessment, auth/crypto review, incident response
infra — kubernetes, virtualization, networking, proxies, linux administration, CI/CD
compliance — NIST, FISMA, PCI-DSS, STIG, GDPR, governance and audit evidence
quality — code review, test authoring, QA strategy, defect triage
delivery — planning, coordination, release management, operations, technical writing
build — frontend, backend, APIs, databases, data modelling — writing the product itself
legal — contract review, privacy law, IP and licensing, employment terms, contract drafting
finance — financial analysis, budgets and forecasts, bookkeeping, tax, procurement and TCO
healthcare — clinical documentation and coding, HIPAA, medical writing, revenue cycle
education — curriculum and objectives, assessment and rubrics, course design, academic editing
busops — process mapping and SOPs, HR practice, executive briefing and decision memos
research — market research, literature review, fact-checking, turning analysis into a decision
No slugs, no counts. Ask for security testing and the host resolves the actual specialist from the full roster and loads it for that job. Install another fifty agents — or a whole thirteenth squad from the marketplace, which is routable with no Anvil release — and this block does not grow by one line.
Send one task to every machine you own:
> /fleet --capability docker rebuild and push the base image
2 host(s) selected, 2 skipped: laptop — does not have the `docker`
capability; bench-02 — last reported 4210s ago (limit 300s)
Sent to 2 host(s): build-01, build-02
Results arrive as each host finishes; run /fleet again to collect them.
It names who was skipped and why. A fan-out that reports only its successes is indistinguishable from one that quietly lost half the fleet.
Use a key you never expose:
> deploy with the staging token
[screened] credential detected and vaulted as {{vault:staging_token}}
[tool] curl -H "Authorization: Bearer {{vault:staging_token}}" …
resolved at run time — the model never saw the value
- Developers who don't trust one model — and want a second and third opinion on the answer that matters, with the disagreement shown rather than averaged away
- Anyone paying for tokens — who wants the cap enforced before the call and an honest "unknown" instead of a fake
$0 - Consultants and contractors juggling client credentials, who need isolation between projects and a vault the assistant can use but never read
- Privacy-conscious and air-gapped users — no account, no telemetry, local Ollama, and a binary that works with the network off
- Teams who need actions attributed to a person, roles that actually restrict, and a shared session that doesn't mean shared credentials
- Regulated environments — a separate FIPS build exists with its own, deliberately narrower capability set
Start a session in the terminal. Finish it on your phone.
you@workstation:~$ anvil
> /remote-control
Remote control active — open the pairing URL on any device
Pairing code: 847291
Open the URL, enter the six-digit code, and you're driving the same live session — not a read-only mirror.
- Full bidirectional control — type, run commands, manage tabs from any device
- The whole command surface — every slash command, with deep autocomplete, on web and mobile
- Real-time streaming — responses token-by-token in the browser
- Configure from the browser — swap providers, change models, manage credentials
- PIN-paired and encrypted, with automatic reconnection
Or run /local-control and get the identical console bound to loopback — no relay, no cloud, nothing leaves the machine.
v2.2.32 gave your Anvil a crew. v2.2.33 lets you see what the crew did — point at what should change, keep its secrets where they belong, and schedule the whole thing.
Every run records what it changed. A run snapshots its workspace before it starts and records what it added, changed, deleted or renamed, with line counts. The room line says "— 1 file, +3", the Team board shows the badge, and the change opens file by file in the viewer. Large repositories are fine: a git work tree is only stat'ed, content is read for files that were dirty or that changed, and a clean file's before-side comes from git. Tokens, booked price and wall time travel with every result, and the new Runs page on the instance and the org lists every run — orders, routines, reviews, Canvas edits — with who asked, who approved, what changed and what it cost, with CSV export and an audit drawer.
Projects: your files and your git, through the relay. The viewer's Files tab browses the instance's workspace, each bot's workspace, named workspaces and any repository the host can fetch — private repositories included, with the host's own credentials. Tree, file with highlighting, diffs (worktree vs HEAD, commit vs commit, unified or side by side), the commit list. Open a run's changeset, comment on a line, and Send to bot: the bot that made the change gets a follow-up order and its reply is the next version. Nothing is read by AnvilHub — every byte comes from the host over the relay, screened and capped, and the daemon's own state directory is never served.
Canvas: publish, point, step back, preview. A run publishes a page, document, diagram or component with publish_artifact; the host renders and sanitises it and AnvilHub keeps every version. Draw a region on the artifact and write what should change: the order carries the region, the nearest elements and the files, goes to the bot that published it, and the next version appears with its changeset. Compare any two versions with a divider and an opacity slider; Step back restores any version from the snapshot the host keeps at publish time. Live preview runs the app in the workspace on the host (Vite, Next, Expo web, or static files) in a phone, tablet or desktop frame through the relay — nothing exposed on the host's network, the tunnel is your session, idle-closed.
Credentials: in your vault, never on the hub. Add a credential on the instance card and it is sealed in your browser to the instance's own key before it leaves; AnvilHub keeps the name, the kind and a fingerprint, and forgets the sealed blob the moment the host acknowledges it. The host unseals, checks the fingerprint and banks the value in its secure store. Runs use it as {{vault:NAME}}, resolved inside tool arguments and exported to the shell, never written into files. Scope a credential to bots or routines and a bot outside the scope gets the same refusal as a missing entry.
Routines join the team. A routine now runs as a fleet task: it appears on the Team board with a ⏰ badge, can hand off, and answers its own permission prompts — the owner's schedule is the approval, while chat orders still park for a person. Manage routines from the card, from chat (bot: routines, bot: schedule reviewer every day at 09:00: …, bot: run <name>) or the TUI. The release is a chain: a built-in release routine kicks off sbom → build → verify → approval → publish → surfaces, each step a bot with only the commands it needs, each handing to the next on its own. The publish step is on the policy's never automatic list — no rule and no schedule can grant it, only a person.
Team bundles. Publish your team as a bundle: bots with prompts, routines, and the credentials it needs by name only — a value anywhere in a bundle is refused by the registry. Install a bundle with a dry-run plan first; missing credentials appear as wanted rows ready to add. 143 commands.
The hub never holds a secret it can open. Rendered artifacts are sanitised on the host and again on the hub; the preview tunnel binds to the loopback only and admits a granted identity only.
v2.2.31 put your Anvil in the room. v2.2.32 lets it act — and gives it a team.
Orders, within a ceiling. do … in the room is an order. The bot answers "on it", runs the task as a real session with real tools, and posts the result back. Every task carries who asked, which workspace, and a ceiling the host enforces; a run that reaches a tool its ceiling refuses stops, files a request, and waits for a decision instead of guessing.
A team of bots. The instance is the orchestrator. Its bots — each with a name, a role, a squad, a model, a ceiling and its own chat identity — do the work and post their results as themselves. do as reviewer: … assigns by name; a plain order lets the orchestrator pick a squad. Bots hand work to each other (HANDOFF docs: why), the orchestrator reports when a chain ends, and lendable bots serve other instances in your organisation.
Managed from three doors. /bot in the terminal and the viewers, bot: verbs in the room, and the Team panel on the instance card all read and write the same team files on the host. The Team board shows what every bot is doing and for whom.
Approvals by policy. Order ceiling, who may decide, auto-approve for operators inside the workspace, per-path rules, and one-time decisions from the room — every policy decision audited with the rule that made it.
Templates, routines, honesty. Create a bot from an installed agent or squad member with safe upgrades; @bot run <name> kicks a routine and its output lands in the room; a room reply shaped like tool output from a tool-less turn is replaced by a plain refusal. 143 commands.
A bot admits its orchestrator only on a verified device; borrowing a bot across instances needs both attached to the same organisation.
v2.2.30 let a team share one Anvil. v2.2.31 gives that team a room — and puts your Anvil in it as someone you can talk to by name.
Org chat, end to end encrypted. Every organization gets a room. It is real Matrix, encrypted in your browser and decrypted in your browser; the server stores ciphertext and refuses plaintext into an encrypted room. Each browser is a named device you can see and revoke, and returning to one reuses its device instead of minting a new one every visit. The roster shows who is actually there, drawn from org membership rather than guessed.
Your Anvil is in the room. Address it by name — "Maverick", or whatever your instance is called — and it answers. Its persona lives with your instance and can be edited; new instances start from a sensible default. When it stays quiet it says why: not addressed, no persona configured, or its own message echoing back. The reason is recorded and never contains the text of your message.
One binary, still. The daemon that runs your sessions now lives inside the anvil binary you already download. Nothing extra to fetch, no change to brew install — the background service and the CLI are one file reached under two names. This closes a real gap: on some installs the background service was running a binary that did not contain the chat subsystem at all, so the bot could never start, and every log line still looked healthy.
Setup, shortened. The first-run wizard is four screens. Permission mode is asked at the door with the tradeoff stated plainly instead of assumed, anvil pair exists (the command the connected-setup screen had been telling people to run), language drives the whole wizard, and the model catalogue is one curated list rather than four that disagreed.
Security. Plan mode is enforced — eight tools now go through the gate, proven by deliberately breaking each one. Pasted and dropped secrets are caught in more shapes: JSON-shaped credentials were invisible to screening, and dropping a file into the conversation was never screened at all. Inbound chat messages are screened on the same boundary as everything else. anvil init no longer scaffolds a full-access default.
Direct messages and sub-rooms are not in this release — org rooms only. The bot is not yet addressable from the TUI with /chat. FIPS builds ship without org chat by design.
v2.2.30 stops treating one model's answer as the answer — and stops treating "the session" as the thing that acted.
Ask more than one. /consult puts the same question to a panel of models at once, each through its own client and its own key, then reports where they agree, where they diverge, and asks the minority what it saw that the others missed. It never picks a winner for you. /relay takes the other shape: one problem handed down a chain of models in order, each seeing the real transcript of the work before it, redacted at every vendor boundary. Neither will fake it — a consult of one is not a consult, and a single model working alone is a normal turn, not a relay.
Somebody did that, and Anvil knows who. Every action now carries a verified identity: a subject, a display name, an org, a role, an explicit capability set, a workspace scope, and a credential scope. Actions are attributed to the principal that took them rather than to the session — a peer's message is labelled as the peer's, and tool calls name the principal that caused them on the durable record, not just in the live view. Permissions are enforced at the point of effect, so a role that cannot write cannot write, whichever surface it is sitting at. Nothing is unrestricted by omission: an empty scope grants nothing, and whole-machine reach is a flag somebody had to set on purpose.
Say no, then offer a door. When a scoped principal is refused, it can ask for a one-time or a permanent increase instead of simply failing; the request reaches AnvilHub and the decision comes back to the running session. /scope shows what is pending.
Work as an organization. Organizations, membership, invitations and roles live on AnvilHub. Roles are authored, not chosen from a fixed list — an admin can define one with its own capabilities and workspace scope, while the seeded roles stay immutable. A seat limit is checked when an invitation is accepted, not only when it is sent, because an org four-fifths full can otherwise issue twenty invitations that were each legal the moment they were raised. Joining an org grants other people access; it never transfers ownership, which stays with one person. Credentials can be lent between people: a loan carries the vault label, never the value, names the lender in the audit line, and expires in minutes — and the borrower can use it without reading it and cannot lend it onward.
A team whose expertise costs nothing until it is used. A host with a real agent library carries dozens of specialists, and the obvious approach — tell the model about all of them — spends thousands of tokens of roster on every single turn, before any work happens, and gets worse as the library grows. Anvil inverts it: the model sees twelve squad names and a one-line brief each, about 300 tokens, and that cost is fixed. It asks for a capability; the host resolves the concrete specialist from the full roster and loads only what the job needs. Individual agent slugs never enter model context. Add a hundred agents and the per-turn cost does not move.
Run every Anvil from one place. Claim a deployment from the web and manage it there — give it a name and a persona, choose its primary agent, watch its live status. Install and remove skills, plugins and agents on a claimed Anvil, applied live when it is online and queued when it is asleep. Build a capability locally, sync it up as a private draft, review it, then publish it to the marketplace under your own identity — nothing leaves your machine until you say so. And /fleet reaches past one machine: it sends a task to every eligible Anvil on your account, routes by capability so the work lands somewhere that can actually run it, and reports what was sent, what refused, and who was never eligible — never a silent partial fan-out.
Spend you can see before you pay it. Every turn is priced against a live pricing registry and booked per principal, and a budget cap now refuses before the provider call rather than reporting the overspend afterwards. When a turn cannot be priced, Anvil says the total is unknown instead of quietly calling it zero.
Use a secret without seeing it. Credentials pasted into a session are detected, moved into the vault, and replaced with a handle the host resolves only when a tool actually runs — so Anvil can use a secret it never reads.
The command registry is now 143 commands, all discoverable and runnable from the web and mobile viewers, not just the terminal.
v2.2.28 makes the whole web viewer worth looking at. The force-directed mind map from 2.2.27 keeps its layout and behavior, but now it sits on a lit stage — nodes glow in their own color, curved/dashed/dotted links pop, and a sparse ambient starfield (with the occasional shooting star) drifts behind the graph. The conversation is no longer a flat terminal dump: your turns and Anvil's render as distinct message cards, fenced code becomes its own glowing panel with a language chip, inline code and bold render properly, and long context collapses to a single chip you can expand. The seven-layer memory readout in the rail is now interactive — click any layer to open the memory browser, every stored memory a card with a colored type badge. Settings moved out of the scroll into their own floating window. And the atmosphere isn't web-only: a new /atmosphere on|off command carries the same starfield behind the terminal conversation, mind map, and memory (on by default). Everything here lives in the viewer's presentation layer — no engine, protocol, or crypto changes — so it's identical in commercial and FIPS builds.
v2.2.27 gives Anvil a living, visual map of your thinking. Run /mindmap (alias /mm) to open a daily-thoughts map — a collapsible outline you drive from the terminal, and a full interactive graph you drive from the web viewer (local-control and remote-control alike). The web canvas is force-directed: nodes are aware of each other and repel so they never overlap, you drag any node and its neighbors move out of the way, zoom has no lower limit so the whole map stays in view (and the wheel zooms about the cursor), and a click shows a node's full notes. Colorize nodes, pick link styles, attach images, and view a day/week/month/year of interconnections. Opt in and the map learns what Anvil learns: today's memories mirror into a tidy collapsible branch (tagged by type, tasks marked open/closed), a separate Memory Graph view projects your whole memory system as a color-coded graph with its [[links]], and thought suggestions reach into QMD + memories. Also new: an opt-in live-session overlay that shows a calm "live session in browser" screen on the terminal while a web session drives it, with the full conversation intact when you wake it. Everything above is off by default and toggled in /configure.
v2.2.25 is a focused security patch that closes fifteen findings from a deep, adversarially-verified audit of the codebase (no criticals). It strengthens the relay pairing model (the daemon now re-verifies pairing at the Rust layer before acting on any privileged message — CWE-306/862 — and the pairing-code attempt limit can no longer be reset by reconnecting, CWE-307), locks down Windows credential storage (owner-only ACLs on secret files + the daemon capability token, and a client-identity check on the named pipe — CWE-732/284), and hardens the sandbox (deny-by-default read access to credential directories + secret-env scrubbing, network-deny under sandbox.require = strict, and a consolidated macOS seatbelt profile — CWE-522/668/1059). The remote-MCP transport is now bounded (response and line size caps, CWE-400) and SSRF-guarded (URLs checked against their resolved IP, refusing private/link-local/metadata ranges by default, CWE-918). Rounding it out: owner-only secret and run directories (CWE-732/367), a normalization-hardened command reviewer (CWE-697), and an allowlisted /perf argument (CWE-77). No feature changes, no config migration; behavior with sandbox.require = off (the default) is byte-for-byte unchanged. Recommended upgrade for every user.
v2.2.24 makes sessions connect reliably and brings xAI up to date. A daemon crash that dropped sessions the instant you connected (early eof) is fixed — the provider runtime is now shut down off the async worker, and an older daemon can no longer shadow a newer build. Text selection copies from exactly where your cursor is, even when lines above it wrap. xAI/Grok is refreshed: grok targets grok-4.3, retired ids are gone, grok-build-0.1 is available, and Grok's Live Search is supported through an isolated Responses-API path. A new sandbox policy gate (sandbox.require = strict | preferred | off) with real macOS seatbelt enforcement lets you set an isolation floor. AskUserQuestion is answerable over the daemon (with an opt-in idle timeout), a sub-agent's partial output is preserved when a stream fails, and the terminal is restored cleanly on every exit. Underneath: a daemon-leak fix (atomic singleton, orphan/idle self-exit, and a new anvil daemon reap) that stops runaway background processes.
v2.2.23 lets you talk to Anvil and reaches remote MCP servers. Start voice entry with /voice or Ctrl+E and your words are transcribed into the input box live, in short chunks, as you speak — toggle on/off, Ctrl+C interrupts, and you can keep typing while recording. Transcription runs through your own OpenAI-compatible key, or a local whisper.cpp backend (offline, no key) that the setup wizard can install for you. Anvil's MCP client gained a full remote transport — Streamable HTTP/SSE, not just local stdio — with anvil mcp login <server> browser OAuth (PKCE, RFC 8414 discovery) and per-server refreshable tokens. It also closes a wide Claude-Code parity gap: inline !-bash, /config key=value, /permissions denial reasons, autoMode.classifyAllShell, org model allow/deny, a MEMORY.md compaction reminder, and a shared action spinner that labels every action (Thinking, Recording, Transcribing, Running command, Searching, Authenticating). Security hardened with sandbox.credentials (blocks commands from reading credential files or dumping secret env) and destructive-command guards; anvil login runs the OAuth flow then launches straight into Anvil; and routines gained a self-contained email delivery path with a machine-bound system-secret store.
v2.2.22 makes your persistent memory browsable, manageable, and relevant. A new in-TUI memory browser (/memory browse) and a web memory console — with an SVG graph of the [[link]] web — let you filter, read, and now create, edit, forget, and re-scope memories directly. /local-control serves that same console locally over loopback, no cloud round-trip. Memory injection became smart: identity and learned-process tiers stay pinned while project/reference memories are surfaced per-turn, filtered to your message, so the prompt stays lean as the store grows. The web viewer reached full parity with the TUI (cost, conversation-on-pair, input history, every rail field, live context + block countdown). Underneath: a 10-minute streaming timeout, OS-proxy auto-detect off by default, a daemon version handshake, a workflow/process self-improvement reviewer, and a security-hardening pass.
v2.2.21 is the largest single-release reshape since v2.0. Session execution moves out of the TUI and into the anvild daemon — close your terminal and the session keeps running; reopen anywhere and reattach. A browser can pair to a live session over an encrypted relay and drive it. Underneath, the biggest modularization pass in project history split the codebase into 31 focused crates, three of the planned performance wins landed, and a cluster of P0 daemon bugs were found and fixed under live verification. FreeBSD x86_64 and NetBSD x86_64 now ship as prebuilt binaries.
Session execution now lives in anvild, not the TUI process. The session protocol contract (SessionRequest / SessionEvent) defines the on-wire types; a SessionActor hosts the conversation inside the daemon; the TUI is repointed as a thin viewer over a Unix socket. Close the TUI — the session keeps running. Reopen it, or attach from elsewhere, and you reattach to the same live session. Crash the daemon, restart it, and the session replays from the journal. Multi-client attach means more than one viewer can watch the same session, with peer-attach / peer-detach events.
Daemon sessions became first-class and human-addressable. The session manifest gained a name and last_active_at_ns; a Rename IPC verb carries it on the wire. The TUI drives the full lifecycle — /session list|rename|kill over one-shot IPC, then /session new|open|load|close mapped onto TUI tabs with per-tab daemon routing. The capstone is same-cwd auto-resume: reopen Anvil in a directory that already has a live daemon session and it reattaches instead of starting cold.
anvil routined relay start pairs a browser viewer to a live daemon session over a passage WebSocket and auto-opens it; pairing returns a full PIN. #917 (P0) fixed a daemon-side tool-dispatch name-drift bug where every tool fell through to a stub — daemon-hosted sessions now execute real tools. #919 adds viewer UX (input echo, thinking spinner, live context). #920 wires /permissions end-to-end over the relay. #921 adds a ring recorder so resume/replay carries the actual conversation — a viewer pairing mid-session sees history, not a blank pane.
A shared reqwest::Client across the workspace ends the per-call TLS handshake + DNS lookup and keeps HTTP/2 connections warm (#898). Read-only tools now run in parallel: when the model requests two or more read-only tools in one batch (read_file, grep_search, glob_search, web fetches), they fan out across worker threads and merge back in original order; mutating tools still run sequentially through the permission gate (#899). grep_search is now gitignore-aware and streams — it walks and searches simultaneously, respects .gitignore, and skips binaries, so it no longer drowns in node_modules/ or target/ (#900).
anvil-cli was split into anvil-ollama, anvil-mcp-builder, anvil-tui, and anvil-wizard. Thirteen crates were extracted from runtime across two rounds — anvil-vault, anvil-journal, anvil-permissions, anvil-oauth, anvil-hooks, anvil-mcp, anvil-memory, anvil-curator, anvil-search, anvil-relay, anvil-reflection, anvil-skill-chain-exec, anvil-routines — with intermediate crates breaking the dependency cycles. runtime shrank from roughly 70K to about 57.7K lines; the workspace now has 31 crates. Supporting work: an anvil-e2e integration-test crate and compile-time locale-key drift detection.
The daemon execution path was load-bearing for the first time, and live verification surfaced a cluster of P0s — every one fixed: wiring the real provider runtime into the daemon (#905), connecting the attach forwarder task (#906, with an e2e gate in #910), binding REPL session I/O to the long-lived runtime (#903), reading the correct PID file (#904), and a /heal probe that checks actual process liveness (#902). Auto-compaction now actually compacts (#913). And the security P0: anvild binary downgrade-prevention (#827).
3,926 tests passing, zero failures. Several latent shared-state test races (process-global locale, env-var, and atomic flags that only flaked under specific parallel scheduling) were tracked down and serialized. IPC gained a dual-transport abstraction (Unix sockets + Windows named pipes) so the daemon runs natively on all seven platforms.
v2.2.21 is a drop-in upgrade from v2.2.20. Config, vault, and session formats are forward-compatible — no migration steps required. The daemon-default execution path is opt-in for now: sessions run in-process unless you pass anvil --daemon. If you have stale anvild processes from binaries you've moved or trashed, kill them before upgrading — anvil --update refuses to run while stale daemons are alive and prints the exact PIDs.
Seven platforms, SHA256-verified, single binary, no runtime required.
# Homebrew (macOS & Linux)
brew install culpur/anvil/anvil
# Or download directly
curl -fsSL https://anvilhub.culpur.net/install.sh | bash| Platform | Download |
|---|---|
| macOS ARM (M1/M2/M3/M4) | anvil-aarch64-apple-darwin |
| macOS Intel | anvil-x86_64-apple-darwin |
| Linux x86_64 | anvil-x86_64-unknown-linux-gnu |
| Linux ARM64 | anvil-aarch64-unknown-linux-gnu |
| Windows x86_64 | anvil-x86_64-pc-windows-gnu.exe |
| FreeBSD x86_64 | anvil-x86_64-unknown-freebsd |
| NetBSD x86_64 | anvil-x86_64-unknown-netbsd |
No account. No sign-in. Download, run, configure your providers.
| Provider | Models | Auth |
|---|---|---|
| Anthropic | claude-opus-4-7, claude-sonnet-4-6, claude-haiku-4-5 | OAuth (Max plan supported) or API Key |
| OpenAI | GPT-5, o3, o4-mini | API Key |
| OpenAI Codex | codex-mini | API Key |
| Google Gemini OAuth + Antigravity | Gemini 2.5 Pro, Gemini 2.5 Flash, Gemini 2.0 Flash Thinking | Code Assist OAuth (PKCE) |
| AWS Bedrock | Anthropic Claude family, Llama, Mistral, Titan | manual SigV4 (no AWS SDK) |
| Cursor Cloud Agents | claude-4-sonnet-thinking, sonnet-4, sonnet-3-7-thinking | API Key + GitHub repo binding |
| GitHub Copilot | gpt-5, gpt-5-mini, gpt-4.1, gpt-4o, sonnet-4, opus-4.5 | Device flow |
| Azure OpenAI | (deployment-name based) | API Key + api-version |
| xAI | Grok-4, Grok-4-mini, Grok-3 | API Key |
| Ollama (recommended) | Llama, Qwen, Mistral, DeepSeek, Gemma, GPT-OSS | Local — no key needed |
| Ollama Cloud | kimi-k2.6:cloud, gpt-oss:120b-cloud | ed25519 device key (via local daemon) |
| Groq | Llama 3.3 70B, Mixtral, DeepSeek R1 | API Key |
| Fireworks AI | Llama 3.1/3.2 family, Mixtral, DeepSeek | API Key |
| Mistral | Mistral Large, Codestral, Mixtral | API Key |
| Perplexity | sonar, sonar-pro, sonar-reasoning | API Key |
| DeepSeek | deepseek-chat, deepseek-coder, deepseek-r1 | API Key |
| Together AI | Llama, Qwen, Mistral, Mixtral, DeepSeek | API Key |
| DeepInfra | Llama, Qwen, DeepSeek, Mistral | API Key |
| Cerebras | Llama 3.1/3.3, Qwen | API Key |
| NVIDIA NIM | Llama 3.x, Nemotron family | API Key |
| HuggingFace | Inference-API hosted models | API Token |
| Moonshot AI | Kimi K2, moonshot-v1 | API Key |
| Nebius | Llama, Qwen, DeepSeek | API Key |
| Scaleway | Llama, Mistral | API Key |
| STACKIT | Llama 3.1 | API Key |
| Baseten | Llama, Qwen, DeepSeek | API Key |
| Cortecs | Llama, Qwen, Mistral | API Key |
| 302.AI | OpenAI-compatible aggregator | API Key |
| ZAI | OpenAI-compatible aggregator | API Key |
| OpenRouter | 200+ models from every major provider | API Key |
| LMStudio | local OpenAI-compatible server | Local — no key needed |
| Chutes | OpenAI-compatible aggregator | API Key |
| MiniMax | minimax-text, abab models | API Key |
Configure priority chains. Automatic failover when one hits a rate limit. Per-provider budgets. Cost tracking per session. Zero-cost local inference with Ollama or LMStudio. No IDE spoofing, no scraped credentials. Every provider implementation either uses a documented public API or identifies as Anvil honestly in headers.
anvil # Start interactive session
/remote-control # Share via browser
/model claude-opus-4-7 # Switch model
/provider anthropic # Switch provider
/vault add # Store a credential
/ssh myserver # Open SSH tab
/productivity # Session stats
/mcp list # MCP server status
/fork experiment # Branch the conversation
/focus # Distraction-free mode
/export md # Export as Markdown143 slash commands (including the /cursor command tree and /memory clean / /cursor stream / anvil agents cross-session monitor). 35 AI providers. 45 built-in tools. MCP integration. Per-tab parallel inference. SSH tabs. Tool-call cards with Ctrl+O expand. Multi-tab sessions. Git integration. Code productivity dashboard. Session history search. 37-widget configurable status line with 16 presets. Vim keybindings. Focus view. File sandbox with permission modes. 7-language i18n. AnvilHub marketplace for skills, plugins, agents, and themes. Web UI with full configuration parity. First-run setup wizard. CC→Anvil migration (anvil import claude-code). anvil(1) manpage. All of it optional. None of it required.
Feature list is in the changelog below and anvilhub.culpur.net/about. The feature list isn't the story. The freedom is.
| 🏠 Product Page | culpur.net/anvil |
| 📦 Marketplace | anvilhub.culpur.net |
| 📖 Full Changelog | anvilhub.culpur.net/about |
| 💬 Issues | github.com/culpur/anvil/issues |
Copyright (c) 2024-2026 Culpur Defense Inc. All rights reserved.
Canvas, Projects and the Vault: See What Your Crew Did.
- ✓ Changesets on every run — a run snapshots its workspace and records what it added, changed, deleted or renamed with line counts; the room line, the Team board badge and the viewer all show it, and a git work tree is stat'ed rather than read so large repositories still record a one-line edit.
- ✓ Runs timeline with cost — tokens, booked price and wall time travel with every result; the Runs page on the instance and the org lists orders, routines, reviews and Canvas edits with who asked, who approved, what changed and what it cost, with CSV export and an audit drawer.
- ✓ Projects through the relay — the viewer's Files tab browses instance, bot and named workspaces and any repository the host can fetch, with tree, highlighting, worktree/commit diffs and the commit list; review a run's changeset, comment on a line and send it back to the bot that made the change. Nothing is read by AnvilHub and the daemon's state directory is never served.
- ✓ Canvas —
publish_artifactrenders and sanitises on the host and AnvilHub keeps every version; edit by drawing a region and saying what should change, compare two versions with a divider and opacity slider, and step back to any version from the host's own snapshot. - ✓ Live preview — run the workspace app (Vite, Next, Expo web, static) in a phone, tablet or desktop frame through the relay; loopback only, admits a granted identity only, idle-closed.
- ✓ Credentials in the vault — sealed in the browser to the instance's key, the hub keeps only name, kind and fingerprint and forgets the blob on acknowledgement; the host banks the value and runs use
{{vault:NAME}}, scopable to bots or routines and never written into files. - ✓ Routines as fleet tasks — routines run on the Team board with a ⏰ badge, hand off, and answer their own prompts from the owner's schedule; managed from the card, chat verbs and the TUI.
- ✓ The release is a chain — a built-in
releaseroutine runs sbom → build → verify → approval → publish → surfaces, each step a bot with only the commands it needs; the publish step is never automatic and only a person can grant it. - ✓ Team bundles — publish a team as a bundle with bots, routines and credentials by name only; a value anywhere in a bundle is refused by the registry, and installing shows a dry-run plan with wanted credentials.
- ✓ Fixed — a run with no workspace no longer executes in the daemon's state directory; daemon-hosted sessions resolve relative paths in the session's own directory; a one-shot run is no longer reported done at its first sentence; cross-signing pins the orchestrator with a real key query,
anvild identity check-device-keysnames a server/store mismatch andrepair-device-keysfixes it without a reset; a second daemon on the same home can no longer start. 143 commands.
Bots and Teams: Your Anvil Has a Crew.
- ✓ Orders within a ceiling —
do …in the room runs a real session on the host and posts the result back; every task carries who asked, the workspace and a ceiling the host enforces, and a refused tool parks the run for a one-time approval instead of guessing. - ✓ A team of bots with their own identities — the instance orchestrates; bots have a name, role, squad, model, ceiling and a Matrix identity minted by AnvilHub; they hear only their orchestrator and post results as themselves.
- ✓ Assignment and hand-offs —
do as <bot>:,ask <bot> to,/fleet … as <bot>, routinebot =; bots hand work to siblings and the orchestrator reports the end of a chain; lendable bots serve other instances in the org. - ✓ Managed from chat, terminal and card —
bot:verbs with hub-decided authority,/bot, the instance card's Team editor, the Team board per instance and per organisation. - ✓ Approval policy — order ceiling, deciders, auto-approve, per-path rules, chat decisions; every policy decision audited.
- ✓ Templates and routines — bots from installed agents and squad bundles with safe upgrades;
@bot run <name>from the room; results land in the room without terminal noise. 143 commands.
Your Team Has a Voice in the Room.
- ✓ Org chat, end to end encrypted — every organization gets a room; real Matrix, encrypted in the browser and decrypted in the browser, with the server storing only ciphertext
- ✓ Your Anvil is in the room — address it by name and it answers, with a persona you control; when it stays quiet it records why, and the reason never contains your message
- ✓ Devices you can see and revoke — each browser is a named device, and returning to one reuses it instead of minting a new identity every visit
- ✓ One binary — the daemon that runs your sessions now lives inside the
anvilbinary you already download; nothing extra to fetch, and no install where the background service silently lacked the chat subsystem - ✓ Four-screen setup — the first-run wizard asks the questions that matter: permission mode at the door with the tradeoff stated plainly, language driving the whole wizard, and one curated model catalogue instead of four that disagreed
- ✓ Plan mode enforced — eight tools that could write while plan mode was on now go through the gate, each proven by deliberately breaking it
- ✓ Wider secret screening — JSON-shaped credentials were invisible to screening, and a file dropped into the conversation was never screened at all; both are caught now, as are inbound chat messages
Ask More Than One.
- ✓
/consult— ask a panel of models the same question at once, each through its own client and key; reports agreement and divergence instead of picking a winner, and asks the minority what it saw - ✓
/relay— hand one problem down a chain of models in order, each seeing the real transcript of the work before it, redacted at every vendor boundary - ✓ Honest refusals — a consult of one is not a consult; a single model working alone is a normal turn, not a relay
- ✓ Priced turns — every turn priced against a live pricing registry and booked per seat; an unpriced turn reports its total as unknown, never as $0
- ✓ Budget cap that refuses first — the cap is enforced before the provider call, not reported after the spend
- ✓ Use a secret without seeing it — pasted credentials are detected, vaulted, and replaced with a handle the host resolves only at tool-run time; a loan supplies the label, never the value
- ✓ 143 commands — the full registry is discoverable and runnable from the web and mobile viewers, not only the terminal
Manage Your Anvil.
- ✓ AnvilHub is now mission control — claim a deployment and manage it from the web: give it a name and persona, pick its primary agent, and see its live status.
- ✓ Install & remove capabilities from the marketplace — add or remove skills, plugins, and agents on a claimed Anvil straight from AnvilHub — applied live when it's online, queued when it's asleep.
- ✓ Build → sync → publish — build a capability locally, sync it up as a private draft, review it, then publish it to the marketplace in one click. Your Anvil packs and uploads it under your identity; nothing leaves until you say so.
- ✓ Starter chain templates — the chain builder ships curated templates wired from real store skills, so you compose from a working chain instead of a blank canvas.
- ✓ Latest models, out of the box — refreshed defaults and aliases to the current flagships: Claude Opus 5, plus GPT-5.6, Grok 4.5, and Gemini 3.6 Flash. The
/modelpicker already live-fetches every provider, so you always see the newest. - ✓ Leaner first run — the setup wizard no longer installs external dependencies; Anvil's native memory, voice, and media subsystems are the default, and QMD detection is silent. Prefer a guided setup?
anvil setup --web.
The Vivid Viewer.
- ✓ Mind map, lit up — nodes glow in their own color, curved/dashed/dotted links pop, and a sparse ambient starfield (with occasional shooting stars) drifts behind the graph.
- ✓ A conversation worth reading — distinct message cards, fenced code as glowing panels with a language chip, real inline
codeand bold, and long context collapsed to an expandable chip. - ✓ Browse memory by layer — the seven-layer rail readout is interactive; click a layer to open the memory browser, every memory a card with a colored type badge.
- ✓ Settings in a window — Configuration is a floating window (pinned header, clean scroll, aligned fields) instead of scrolling inline.
- ✓
/atmosphere on|off— the same starfield behind the terminal conversation, mind map, and memory; on by default, toggled by command. - ✓ One visual language — rail, header, bars, composer, and top bar all share the glass-and-glow look; nothing moved.
- ✓ Presentation-layer only — no engine, protocol, or crypto changes, so the viewer is identical in commercial and FIPS builds.
The Mind Map Release.
- ✓
/mindmap(alias/mm) — a daily-thoughts mind map, rendered as a collapsible outline in the TUI and a full interactive graph in the web viewer. One shared document; edits and captures sync live between the terminal and the web. - ✓ Force-directed web canvas — nodes repel so they never overlap; free-drag a node and neighbors move aside; +/−/fit zoom with no lower limit (whole map always in view) and cursor-anchored wheel zoom; click a node for its full notes.
- ✓ Style & time — colorize nodes, choose link line-types, attach images, and view a day / week / month / year of interconnections.
- ✓ Learns what Anvil learns (opt-in) — today's memories mirror into a collapsible "memories" branch (tagged by type, tasks open/closed); a separate read-only Memory Graph view projects the whole memory system, grouped by kind with its
[[links]]; thought suggestions reach into QMD + memories. - ✓ Live-session overlay (opt-in) — when a web client drives the session, the terminal can show a calm "live session in browser" screen with live context/token counts; the full conversation is intact when you wake it.
- ✓ Remote & local viewers unified — the AnvilHub remote-control viewer serves the same mind map and features as local-control.
- ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64 (MSVC), FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The Convergence Release.
- ✓ Learns your recurring workflows — when you repeat the same multi-step workflow across sessions, Anvil offers to capture it as a reusable skill; run
/skills captureto draft one from your exemplar (or--neverto dismiss). - ✓ Corporate TLS proxies out of the box —
ANVIL_TLS_TRUST=systemtrusts your OS system trust store, so TLS-inspecting proxies (Zscaler, Palo Alto, etc.) with a locally-installed MITM CA just work. - ✓ Audit log (opt-in, on by default) — a tamper-evident log of security-relevant actions, verifiable with
anvil audit verify; disable withANVIL_AUDIT=off. - ✓ Build & supply-chain hardening — every binary built with explicit anti-exploitation flags, each release ships a CycloneDX SBOM, and a
cargo denypolicy gates licenses, sources, and advisories — converged from the regulated edition into every build. - ✓ Windows OAuth fixed — browser sign-in on Windows now completes reliably (PKCE via
OsRng, single browser launch,dirs_nexthome resolution); the Windows asset is the MSVC wizard-fix build.
The Security Hardening Release.
- ✓ Fifteen audit findings closed — a deep, adversarially-verified security review (2 High, 6 Medium, 6 Low, 1 Info; no criticals). Recommended upgrade for all users; no feature changes, no config migration.
- ✓ Relay pairing enforced locally — the daemon re-verifies pairing at the Rust layer before acting on any privileged message (CWE-306/862); the pairing-code attempt limit can no longer be reset by reconnecting (CWE-307).
- ✓ Windows credential storage locked down — secret files and the daemon capability token get an owner-only ACL bound at creation, and the daemon named pipe verifies the connecting client's identity (CWE-732 / CWE-284).
- ✓ Sandbox deny-by-default — an active sandbox denies read access to credential directories and scrubs secret env;
sandbox.require = strictdenies outbound network; the macOS seatbelt profile is consolidated to one canonical implementation (CWE-522 / 668 / 1059). - ✓ Remote MCP bounded & SSRF-guarded — HTTP/SSE body and stdio line sizes are capped (CWE-400), and MCP URLs are checked against their resolved IP, refusing private/link-local/metadata ranges by default with an
ssrfAllowlistopt-in (CWE-918). - ✓ Additional hardening — owner-only secret and run directories (CWE-732/367), a normalization-hardened command reviewer (CWE-697), and an allowlisted
/perfargument (CWE-77). Behavior withsandbox.require = off(the default) is byte-for-byte unchanged. - ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The Stability & xAI Release.
- ✓ Sessions connect reliably — fixed a daemon crash that dropped sessions on connect (
early eof); the provider runtime is now shut down off the async worker so sessions start, run, and tear down cleanly. An older daemon can no longer shadow a newer build (build-timestamp recency guard). - ✓ Text selection copies from the right place — drag-to-copy now starts exactly at your cursor even when lines above it wrap, with correct wide/emoji-character handling.
- ✓ xAI / Grok refresh + Live Search —
groktargets grok-4.3, retired ids removed, grok-build-0.1 added, and Grok Live Search via thex_searchResponses-API tool (ANVIL_XAI_LIVE_SEARCH=1). - ✓ Sandbox policy gate —
sandbox.require = strict | preferred | offwith real macOSsandbox-execseatbelt enforcement; the active backend shows inanvil daemon status. - ✓ AskUserQuestion over the daemon — questions fan out over the relay so a daemon-attached or web viewer can answer, with an opt-in idle timeout. Sub-agent partial output is preserved with an
[incomplete response]marker when a stream fails. - ✓ Terminal hygiene, paste, and the daemon-leak fix — the terminal is restored on every exit (quit, Ctrl+C, panic); large pastes land once. Autostart is suppressed under test/headless, the singleton PID lock is atomic, an idle orphan self-exits, and
anvil daemon reapclears runaway daemons. - ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The Voice & Reach Release.
- ✓ Voice entry —
/voiceorCtrl+Efor live in-terminal dictation; words transcribe into the input box as you speak. Toggle on/off,Ctrl+Cinterrupts, type while recording. Cloud (your key) by default, or a local whisper.cpp backend the wizard can install. - ✓ Remote MCP servers — Streamable HTTP/SSE transport (not just local stdio) with
anvil mcp login <server>browser OAuth (PKCE, RFC 8414 discovery) + per-server refreshable tokens. - ✓ Claude-Code parity — inline
!-bash,/config key=value,/permissionsdenial reasons,autoMode.classifyAllShell, org model allow/deny, MEMORY.md compaction reminder, and a shared action spinner that labels every action. - ✓ Security & login —
sandbox.credentialsblocks commands from reading credential files or dumping secret env; destructive-command guards flag hard resets and force-cleans;anvil loginruns the OAuth flow then launches straight into Anvil. - ✓ Routine email delivery — a self-contained email path with a machine-bound system-secret store.
- ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The Memory Release.
- ✓ Memory browser + web console — a new in-TUI memory browser (
/memory browse) and a web memory console with an SVG graph of the[[link]]web let you filter, read, and create, edit, forget, and re-scope memories directly./local-controlserves that console locally over loopback. - ✓ Smart memory injection — identity and learned-process tiers stay pinned while project/reference memories are surfaced per-turn, filtered to your message, so the prompt stays lean as the store grows.
- ✓ Web viewer parity — the browser viewer reached full parity with the TUI (cost, conversation-on-pair, input history, every rail field, live context + block countdown).
- ✓ Underneath — a 10-minute streaming timeout, OS-proxy auto-detect off by default, a daemon version handshake, a workflow/process self-improvement reviewer, and a security-hardening pass.
- ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
Durable Daemon Sessions, the Relay Bridge, and the Big Modularization.
- ✓ Durable daemon sessions (D.1–D.4, #841–#844) — session execution moves out of the TUI into
anvild.SessionRequest/SessionEventdefine the on-wire contract; aSessionActorhosts the conversation in the daemon; the TUI is a thin viewer over a Unix socket. Close the TUI and the session keeps running; reopen or attach from elsewhere and reattach to the same live session; crash and restart the daemon and the session replays from the journal. Multi-client attach with peer-attach / peer-detach events. - ✓ Named, multi-tab sessions + same-cwd auto-resume (#911) — the session manifest gains
name+last_active_at_ns; aRenameIPC verb carries it./session list|rename|killover one-shot IPC;/session new|open|load|closemapped onto TUI tabs with per-tab daemon routing. Reopen Anvil in a directory with a live daemon session and it reattaches instead of starting cold. - ✓ Relay bridge — attach from the browser (#914, #917, #919–#921) —
anvil routined relay startpairs a browser viewer to a live session over a passage WebSocket and auto-opens it. #917 (P0) fixed a daemon tool-dispatch name-drift bug where every tool hit a stub. #919 viewer UX (input echo, thinking spinner, live context). #920/permissionsend-to-end over the relay. #921 ring recorder so resume/replay carries the actual conversation. - ✓ Performance: shared HTTP client + parallel tools + gitignore search (#898, #899, #900) — one shared
reqwest::Clientends per-call TLS handshakes (#898); read-only tools in a batch fan out across worker threads and merge in original order, mutating tools still gated sequentially (#899);grep_searchwalks-and-searches simultaneously, respects.gitignore, and skips binaries (#900). - ✓ The big modularization — 31 crates (#867, #873–#896) —
anvil-clisplit intoanvil-ollama/anvil-mcp-builder/anvil-tui/anvil-wizard; thirteen crates extracted fromruntime(anvil-vault,anvil-journal,anvil-permissions,anvil-oauth,anvil-hooks,anvil-mcp,anvil-memory,anvil-curator,anvil-search,anvil-relay,anvil-reflection,anvil-skill-chain-exec,anvil-routines) with intermediate crates breaking cycles.runtimeshrank ~70K → ~57.7K lines; workspace now 31 crates. Plus ananvil-e2etest crate and compile-time locale-key drift detection. - ✓ Daemon hardening — P0 fixes (#902–#917, #827) — wire the real provider runtime into the daemon (#905); connect the attach forwarder task (#906, e2e gate #910); bind REPL session I/O to the long-lived runtime (#903); read the correct PID file (#904);
/healchecks actual process liveness (#902); auto-compaction now actually compacts (#913); anvild binary downgrade-prevention (#827, P0 security). - ✓ 3,926 tests passing, zero failures — latent shared-state test races (process-global locale, env-var, atomic flags) tracked down and serialized. IPC gained a dual-transport abstraction (Unix sockets + Windows named pipes) so the daemon runs natively on all seven platforms.
- ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
Signed Provenance, Anti-Skills, Event Routines, A/B Curator, Memory Federation + Forge Screensaver.
- ✓ F1 — Signed skill provenance — every skill carries a signed
provenance.jsonlledger keyed by an ed25519 keypair at~/.anvil/keys/skill_signing.ed25519(0600). The verifier walks the ledger from genesis on every load; a broken chain surfaces as a P0 in/skill why <name>. Trust-on-first-use pins an imported skill's pubkey. Newanvil skill why|pubkey|verify. - ✓ F4 — Anti-skills (negative learning) — the curator records failure modes as
MemoryType::AntiPatternentries with their own retrieval-order block. Anti-skills annotate rather than block; the proposal flow shows a "you tried something similar on YYYY-MM-DD and it scored N% worse" footnote. - ✓ F6 — Event-triggered routines — anvild routines accept FileWatch / Webhook / Process / Log triggers in addition to cron. Webhook listener is axum 0.8, localhost-only by default.
tick_routines()pulled out as a pure function; four integration tests cover fire/GC/Ask/re-arm. - ✓ F3 — Curator A/B evaluation — new skills run an A/B pass against a held-out batch; winners promote, losers go to the anti-skill pool. Additive, escalate-only: a worse candidate cannot replace a better incumbent. Surfaced in
REPORT.md+run.json(ab_decisions). - ✓ F2 — Cross-machine memory federation — x25519 key agreement, HKDF-SHA256 derivation, AES-256-GCM (fresh nonce per call), ed25519 signatures, trust-on-first-use peer pinning.
anvil memory sync|peer add|peer list. - ✓ Forge screensaver — video-driven two-phase animation; the source mp4 is baked once into a 665 KB gzipped cell-grid bundle
include_bytes!-d into the binary, no ffmpeg at build or run time. Falls back to overlay-only if the asset is missing. - ✓ 3,061 tests passing, 0 failing — up from 2,922 at the start of the arc (+139). Three
crates/commands/parallel-test flakes pinned to aserial_test::serialtoken. - ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
18 Languages. Memory Cohesion Complete. The Web-Based MCP Builder.
- ✓ Internationalization — 18 locales — the TUI, wizard, slash-command output, and remote-control viewer all flow through
rust-i18nv4 in Rust and the newviewer.locales.jsruntime in the browser. Tier-1 ships English, Spanish, Simplified Chinese, French, Brazilian Portuguese, Russian, Japanese, German — 264 keys each. Tier-2 adds Korean, Italian, Turkish, Vietnamese, Polish, Indonesian, Dutch, Swedish, Norwegian Bokmål, Ukrainian. Locale selection persists to~/.anvil/config.json, falls back to$LANGon first launch, applies immediately to every wizard step./configuremenu has a Language Picker submenu rendering native scripts (한국어, Русский, 中文). Viewer ships 176 fully-wired keys covering chrome plusvault.*andconfig.*panels; live re-render walker on locale switch with no page reload. - ✓ Seven-layer memory — all GREEN — the 2026-05-21 cohesion audit found Layer 3 (Semantic), Layer 6 (Reflective), and Layer 7 (Cache) still partial. v2.2.19 closes all three. Layer 3:
/memory promote <nomination-id>now actually persists nominated facts to disk — the v2.2.14 stub flipped a status flag without ever callingMemoryManager::save(). Full chain writes the fact and appends provenance comments before marking the nomination accepted. New--target <file>flag. Layer 7: file-cache path-discovery bug fixed;memory_budgetno longer checks a path that doesn’t exist in the project-scoped layout./memory show cacheenumerates file-cache, command-cache, and QMD-cache stats./memory prune cache --dry-runwalks bothFileCacheManagerandCommandCacheManager. Layers 1, 2, 4:/memory layer 1renders a live snapshot viaPromptSectionsExt::iter_by_kind()./memory show episodicunifies daily summaries, history archives, workspace sessions./memory prune episodicadds TTL retention with a trash-bin safety net./memory show proceduralconsolidates GoalManager + skills + CronManager. - ✓ AnvilHub
/buildpage +anvil-mcp-buildermicro-service — the v2.2.18/mcp builderTUI wizard now has a web counterpart. Three endpoints:POST /api/builder/spec(LLM-generated spec from free-text, SSE-streamed),POST /api/builder/generate(turns spec into a base64 tarball — Node.js, TypeScript, or Python templates),POST /api/builder/sandbox(extracts the tarball and runsanvil-sandbox-runnernetwork-cut). Operator OAuth token loaded from the Anvil vault at startup, never from.env. Sandbox endpoint gated on publisher standing — user must be in theanvilhub-publishersAuthentik group OR have at least one HubPackage published. 5-minute Map cache; falls closed on backend error. - ✓ MCP pagination (CC v2.1.144-B6 / v2.1.146-B2) — MCP client now consumes the full
nextCursor/has_morepagination chain fortools/list,resources/list,resources/templates/list,prompts/list. Previously MCP servers with paginated responses had everything beyond page 1 silently dropped. - ✓ Spinner/elapsed-time freeze fix (CC v2.1.145-B3) — TUI render queue wakes from a wall-clock timer in addition to input events. After terminal refocus or resize, the spinner and elapsed-time display no longer freeze until next keypress. New
RedrawReason::TerminalStructuralroutes Resize/FocusGained/FocusLost through the soft draw path (no ANSI clear flash, per the photosensitivity rule from v2.2.17). - ✓ MCP
permissions.allowhonored (CC community #61077 SECURITY) —permissions.allowrules with patterns likemcp__server__toolormcp__server__*are now consulted at MCP tool dispatch time. Previously the allowlist was loaded but the MCP dispatch path bypassed it and always prompted. - ✓ Bash env-var permission bypass (CC v2.1.145-B1 SECURITY) — Bash patterns of the form
KEY=VALUE commandare decomposed and the command portion checked against the allowlist. - ✓ Skill fork-context recursion guard (CC v2.1.145-B4) — a skill cannot transitively invoke itself; recursion check uses the full skill ancestry chain.
- ✓ Resume session model preservation (CC community #61068) —
anvil --resumerestores the model that was active when the session was saved, not the global default. - ✓ CC parity P2 sweep — API startup 15s timeout for side-channel calls (#722), mime-type magic-number fallback in
Read(#723),/branchhistory recovery post-EnterWorktree viaworktree_ops::original_sessions_dir()(#724), MCP image fallback for unsupported MIME — saves to~/.anvil/mcp-images/<sha256>.<ext>(#725), skill watcher FD exhaustion prevention — excludestarget/,node_modules/,.git/,dist/,build/,.cache/,.next/,__pycache__/(#726), theme color reset on first/session renamefixed (#727), EnterWorktree MCP config preservation via snapshot beforeset_current_dir(#728). - ✓
anvildseparate process name across 7 platforms (#766) — the background OAuth-refresh + routines daemon now runs asanvild, notanvil daemon foreground. Newanvild_path_from(anvil_binary)helper rewrites the binary path used by every supervisor unit — macOS LaunchAgent, Linux user-systemd, FreeBSD/NetBSD rc.d, Windows Task Scheduler — plus the in-TUIdaemon::spawn_detachedfallback.ps -ef | grep daemonnow showsanvild.install.shandinstall.ps1create theanvildsymlink (Unix) or hardlink (Windows NTFS) alongside the main binary. - ✓ Wizard P0 bundle — Ollama modal clipping, daemon prompt alt-screen, vertical-split hint (#767, #768, #769) —
ConfirmModalheight now derived from body wrap so Yes/No buttons stay visible regardless of body length; newCtrl+BBack keybind. The “Install anvild as background service?” prompt moved into the alt-screen as Step 8 of 9 (no more drop-to-CLI mid-wizard). New 1-line hint above BUILD section in the rail bottom group:⌥+drag deck onlyon macOS,Alt+drag deck onlyon Linux/Windows/BSD. i18n keys added across all 18 locales. - ✓ Release-pipeline step-gates (#714, #730) —
scripts/release.shnow wraps every phase instep "PN: <description>"+ok "PN"/fail "PN"markers. Newscripts/release-helpers/step-gates.shprovides primitives + JSON status persistence + an EXIT-trap silent-exit detector. Closes the v2.2.18 Phase 6 silent-exit class.scripts/test-release-gates.shruns release.sh in--dry-runand asserts every expected phase fires START + terminal marker exactly once. - ✓ Net +50 tests across the workspace — i18n drift gate + picker invariant + 8 locale-load; +9 episodic / +6 promote / +6 cache / +5 working / +3 procedural for memory cohesion; +35 across all 15 CC-parity fixes; +7 publisher-standing tests in the new micro-service.
- ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The Web Viewer Lands. Autocompact Gets Honest. Mouse Capture Off by Default.
- ✓ Web viewer — full TUI parity (#680, #681, #683, #692, #695, #696) —
passagerelay and AnvilHub viewer get a tab-routing rewrite matching the TUI’s per-tab architecture./tab new,/tab rename,/tab switch,Ctrl+T. Per-tabuser_messageandslash_resultrouting (no more cross-tab leakage). Default layoutvertical_split + tabs. Cost-type chip (OAuth / local / cloud) instead of fabricated dollar figures. Cached + broadcastMemorySnapshotso the memory rail populates on reconnect.SessionMetacarriescontext_maxandbuild_sha. Default-allow forwarding for unhandled viewer messages. Collapsible tool cards. Always-visible slash bar withCmd+Kpalette. - ✓ Autocompact threshold fix (#697 CRITICAL) —
maybe_auto_compactwas measuring againstmax_output_tokens(8K–16K) instead ofcontext_window(64K–200K+). Sessions on long-context models were compacting at roughly 6K input tokens. Now readssession.context_windowand ignoresmax_output_tokensentirely. New OTel spananvil.autocompact.thresholdemitscontext_window,used_tokens,threshold_pct,triggered./compact whyprints the full threshold calculation. - ✓ Mouse capture default OFF (#696 P4) — mouse capture disabled by default on all platforms, restoring terminal copy-paste (Cmd+C / Ctrl+Shift+C / Ctrl+C) for users who hadn’t opted in. One-time first-run toast shows
/config mouse_capture trueand--mouse.mouse_capture_default_off_regressiontest asserts the default at the type level. - ✓ Bracketed paste in textarea modals (#685) — multi-line paste now works inside
/mcp builderand other wizard textareas. Wirestui::paste::handle_pasteinto the textarea event loop with - ✓ Per-tab relay routing (#696) —
relay::user_messageandrelay::slash_resultroute to activeTab.idrather than broadcasting. Concurrent inference in two tabs no longer leaks between them. - ✓ OAuth / local / cloud cost label (#696 P1) — TUI status footer shows a semantic cost-type chip instead of a fabricated dollar amount for providers where per-token cost is not knowable.
- ✓
MemorySnapshotrail parity (#695) — vertical-split rail useslayouts::commonhelpers instead of a hand-rolled draw path. Same fidelity as the classic inline view. - ✓ Alt-screen raw mode restore (#688) —
restore_alt_screenre-enables raw mode on return from inline operations. Was the root cause of “keyboard stops working after/mcp buildercancel” in v2.2.17. - ✓
FORCE_FULL_REDRAWconsumption (#688) — consumed insidehandle_repl_command_tuiso the blank-screen-after-cancel regression cannot recur. - ✓ Mouse capture + alt-screen pairing (#688) — mouse capture state is paired with alt-screen state. Enabling mouse capture outside the alt-screen no longer leaves the terminal inconsistent after exit.
- ✓ Force full redraw after inline-op restore (#687) — any inline operation that restores the alt-screen forces a full redraw. Eliminates partial-frame artifacts.
- ✓ Textarea keybinds corrected (#686) —
Entersubmits,Ctrl+Ninserts a newline. Previously inverted. - ✓
/mcp builderlong-description textarea (#684) — long-description field is now a multi-line textarea modal instead of a single-line input. - ✓ PermissionPrompt round-trip regression test (#677) — end-to-end test fires a tool call that requires a permission prompt, verifies the prompt renders, sends the approval, asserts the turn completes. Guards permission-prompt state from desyncing with the turn loop.
- ✓ Release-pipeline Phase 6 silent-exit guard (#654) —
scripts/release.shPhase 6 wraps every SSH hop in an explicit|| { echo "Phase 6 SSH failed"; exit 1; }guard. Previously a failed remote call could terminate the script with exit 0, leaving subsequent surface updates unrun. - ✓ anvil-release MCP host targeting fix (#698 CRITICAL) — release automation was routing service-restart operations at a decommissioned target after
#655; the host mapping is corrected so deploys reach the node actually serving traffic. - ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The Setup Wizard, Reflection, Sandboxing, and the Source Viewer.
- ✓ New first-run wizard — welcome card → nine modal steps → vault unlock → main TUI, all in one alt-screen. Per-step descriptions explain why each question is asked. OAuth waits poll on 100 ms and stream the elapsed counter live. Step 9 is CC migration in-modal. Brighter grey font for modal text.
- ✓ Autonomous reflection loop — stuck-detector switches strategy and writes a multi-attempt scratchpad when a turn loops without progress.
- ✓
anvil-sandbox-runnercompanion binary — hub-install detonation runs in an isolated binary, shipped alongsideanvilon all seven platforms. - ✓ AnvilHub source viewer — every one of the 558 HubPackages has a viewable source archive; 547 packages got synthesized
Documentationtabs from DB columns. - ✓ Vertical-split rail-stays-painted fix (#648) — ratatui
swap_bufferscontract violation in the#574region-gated repaint surfaced as blank/garbage rails after wizard exit. All three layouts now always paint every region every frame. - ✓ TUI flash eliminated on Gnome Terminal/alacritty (#622, #629) — full-screen
Clear()is now gated onDirtyRegions::ALLandcommit_pending_redrawno longer routesTextDeltathroughterminal.clear(). Photosensitivity hazard during streaming output resolved. - ✓ Wizard mouse-capture default OFF (#623) — native text selection now works cross-platform. Banner is no longer Mac-only.
- ✓
/agent compose+/agent traitsrewired (#624) — no moreprintln!corrupting the alt-screen. 23 BUG sites fixed in the broader println audit (#626), with#![deny(clippy::print_stdout, clippy::print_stderr)]on every TUI-touching file and a regression test to block future drift. - ✓ In-TUI ConfirmModal + PasswordModal — vault unlock for returning users is now a modal in the existing alt-screen, not a CLI prompt; ConfirmModal supports two-button destructive-action confirmation.
- ✓ Vertical-split Shift+drag deck-only selection (#625) — rail no longer comes along when you select conversation text.
- ✓ Vertical-split rail keybinds wired (#634) — g / d / s / a / Ctrl+R now work in the rail, with a drift gate to keep them wired.
- ✓ Reactive compaction sizes from actual overflow (#564) — summary-size budget is now seeded from the real overflow delta, not a fixed guess.
- ✓
ANVIL_STOP_HOOK_BLOCK_CAP(#566) — caps Stop-hook blocking to prevent infinite-loop runaway if a hook mis-fires. - ✓ Session auto-titling wired (#580) —
derive_title_from_first_message()now actually drives the trigger. - ✓ Hook PWD refresh after worktree switch (#561) — PWD-relative hooks no longer go stale when
EnterWorktreeruns. - ✓ Welcome banner names active provider for 3P users (#562) — no more hardcoded Anthropic when you're on Groq/Bedrock/etc.
- ✓
release-surfaces.yamlenforcement gate (#614) — one manifest is the single source of truth for every public surface;scripts/verify-release-surfaces.shis the gate. - ✓ AnvilHub
/sha256/2.2.17.txtpublished — out-of-band checksum manifest for primary-source SHA256 verification. - ✓
install.sh+install.ps1rebuilt — live versions onanvilhub.culpur.netupdated to the proper/api/version-aware variants. Fixes thetag_nameregex breakage (#619) and the hardcodedwindows-msvcWindows target (#612). - ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The TUI Layout System. Eight live-switchable layout variants on a per-tab TuiLayoutConfig. New default: Vertical Split + Tabs.
- ✓ TUI Layout System — four layout architectures (Vertical Split / Classic / Three-Pane / Journal) × tabs/no-tabs = eight variants, every one a real renderer. Per-tab
TuiLayoutConfig./layout list,/layout <alias>,/layout <alias> --global(writes to~/.anvil/config.json),/layout reset. State-machine contract enforced by integration tests; shared session state (log, input, model) survives the switch; terminal clear on switch so previous cells don't bleed. - ✓ New default: Vertical Split + Tabs — persistent left rail (sessions, agents, tools, MEMORY, gate state) next to a swappable right deck. Rail owns all chrome (banner, status, model, cost); deck has input only. Mouse-draggable split anchor. Migration-safe: users with an explicit
tui_layoutsetting keep their value; only upgraders without the key see the change, plus a one-time intro toast. - ✓ Wizard step 7 highlight — first-run setup wizard now defaults to Vertical Split (option
[1]); Classic moves to[2]. New installs that just press Enter land on the rail+deck view. - ✓ Slash-completion popup wired into all renderers — completion works regardless of which layout is active. Every render path also redraws on every keystroke so input is live.
- ✓ Three-pane Insert discoverability — framed hint + ghost input makes the always-on input legible; CONTEXT band uses
Constraint::Fillso it actually fills available height. Vim modal removed — typing always edits the input. - ✓ Paste handling rebuild — consolidated paste handler routes terminal bracketed paste, OSC52, and drag-and-drop file paths. Mouse capture is off by default so native terminal copy works.
ContentBlock::Documentis wired end-to-end for PDF and Office docs — dropping a.pdfattaches it as a document block to the next request. Long-paste placeholder collapses multi-KB pastes to a[Pasted N chars]token in history. Keystroke-burst detection converts drag-and-drop on terminals without OSC52 into a single paste. - ✓ Ctrl+C mid-stream cancel across all 7 providers —
DefaultRuntimeClienthonors the cancel token in every provider implementation.tokio::select!wraps the blocking HTTP read so the connection actually closes when the token fires. New wiremock integration test covers the cancel path end-to-end. - ✓ Vertical-split rail polish — uppercase section headers, cross-tab status aggregates, tool-call boxes close cleanly, markdown styled, cost rendered to 2 decimals, QMD folded into MEMORY, agent tab-binding, split-anchor draggable.
- ✓ AnvilHub verification gate —
/hub statusships all 8 axes,HubPackagecarries verified-badge structs,require_verifiedconfig gate,/plugin update REVOKEDguard, update probe prefers anvilhub/api/versionand falls back to GitHub Releases. - ✓ TUI correctness long tail —
/vault unlockretries up to 3 times and pre-fills the prompt on failure; welcome banner names the active provider, not hardcoded Anthropic; session-title heuristic skips a bare URL as first message; 5xx errors name the configured provider/gateway; spinner color warms warm-green→amber→red on elapsed time;Readoffset accepts string forms with whitespace/+prefix;ANVIL_MCP_TOOL_TIMEOUTenv override per request; asyncfetch_all_configured_modelswith timeout + Ctrl+C cancel; strict RFC 6749 token-exchange parser + startup validator; lenient scopes deserializer prevents OAuth lockout;ProviderLoginModalfor in-TUI OAuth/API-key flows; layout-switch terminal clear prevents stale-cell ghosting. - ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
The largest release in Anvil's history. 121 commits over v2.2.13. Supersedes the corrupted v2.2.14 tag (never published).
- ✓ Provider catalog 5 → 31 — AWS Bedrock (manual SigV4, no AWS SDK), Google Gemini OAuth + Antigravity (Code Assist OAuth with honest Anvil identification — not VS Code spoofing), GitHub Copilot (device flow), Azure OpenAI (deployment-name + api-version), Cursor Cloud Agents (repo-bound), plus 24 OpenAI-compatible providers: Groq, Fireworks, Mistral, Perplexity, DeepSeek, Together AI, DeepInfra, Cerebras, NVIDIA NIM, HuggingFace, Moonshot, Nebius, Scaleway, STACKIT, Baseten, Cortecs, 302.AI, ZAI, OpenRouter, LMStudio, Chutes, MiniMax, OpenCode, OpenCode-Go.
- ✓
/cursorfirst-class command tree — six TAB-completable subcommands (launch,list,get,cancel,artifacts,stream) for Cursor's public Cloud Agents API. Repo-bound by design —git remote get-url originis mandatory. - ✓
/modelcross-provider unified picker — one TAB-completable list across every configured provider, provider-prefixed (anthropic/claude-4.5-sonnet,groq/llama-3.3-70b,cursor/claude-4-sonnet-thinking). Atomic switch updates routing + system prompt identity + TUI chrome together. Live-fetched from each provider's/modelsendpoint; static registry is fallback only. - ✓ Memory Cohesion Arc — the seven-layer memory system from v2.2.5 (Sensory / Working / Episodic / Semantic / Procedural / Reflective / Long-term) cohesion-tested end-to-end. Retrieval-order block in system prompt,
WorkingMemorySnapshotasVec<PromptSection>,PermissionMemorywired into permission gate,/file-cachereal handler, egress allowlist in settings +/policy view,/memory whyinjecting daily summaries. - ✓ Capability Cohesion Arc — every Anvil capability now meets an 8-axis contract (definition / registration / completion / handler / dispatch / rendering / permission gate / OTel + tests). Build-time drift gate enforces it. Slash dispatch unified at one site. Stub messages banned.
- ✓ CC→Anvil migration —
anvil import claude-codebrings prior assistant work forward verbatim with provenance frontmatter. Memory entries getimported_fromstamps. Project instruction files merged without clobbering. Settings get conflict detection. Skills get collision handling. Past sessions (up to ~1,800 JSONL, ~1 GB) optionally summarized into daily records. The day-2 commandanvil memory cleanrewrites entries through a configurable LLM and detects duplicate meanings via Jaccard similarity. First-run wizard offers migration as opt-in. - ✓ CC parity catch-up v2.1.132 → v2.1.139 — 17 features + 7 security/verify items:
ANVIL_PROJECT_DIR/ANVIL_SESSION_ID/ANVIL_DISABLE_ALTERNATE_SCREEN/ANVIL_EFFORTenv propagation, transcript view nav, cross-sessionanvil agentslive monitor,worktree.baseRef,autoMode.hard_denyshort-circuit, hookcontinueOnBlock, hook argsstring[]exec form,/scroll-speedwith live preview,anvil plugin details, subagent OTel headers with parent-agent-id, plus security gates on--resume/--continueunderscore paths, plan-mode + Edit allow rule write blocking, MCP content-block result visibility,Skill(name *)wildcard delimiter check, settings hot-reload on symlinks, stream-idle false-fire elimination, multi-image paste correctness. - ✓ Token economy + reliability — file-fingerprint cache wired into
read_file/write_file/edit_file/system prompt (shipped dormant in v2.2.11). Command-output cache wired intoglob_searchandgrep_search. WebFetch + WebSearch get 5-min and 1-hour TTL caches. Skill-chaining engine depth-3 wired (suggestion engine; executor lands in v2.2.16). Auto-promote engine for/memorynotes active. - ✓ Honesty contract codified — test-suite-enforced contracts: no silent deferral, 8-axis capability contract, CC-only naming, changelog preservation (historical entries byte-immutable), migration instinct (bring everything verbatim-with-flag), live-model-list (not registry), atomic provider/model switch.
- ✓ Seven platforms — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.
v2.2.14 was tagged internally but never published as binaries due to a release-pipeline incident. All v2.2.14 work is included in v2.2.15 above (Memory Cohesion Arc, Capability Cohesion Arc, CC parity v2.1.132-139, per-tab parallel inference fixes, file-fingerprint cache wiring, auto-promote engine).
Windows is back, BSD joins, routines on disk — seven platforms now.
- ✓ FreeBSD x86_64 + NetBSD x86_64 binaries — first-ever BSD support. Every binary SHA256-verified and signed by the release pipeline, with paired
.sha256manifests at anvilhub.culpur.net/sha256/. - ✓ Windows x86_64 is back — the v2.2.12 hold is fixed. ssh-agent auth is now
#[cfg(unix)]-gated with a clean Windows stub. The rest of the SSH driver (key-file, password, kbd-interactive) works on Windows exactly as on Unix. - ✓ Seven platforms total — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64.
- ✓ Release pipeline hardening — build errors now hard-fail instead of silently producing partial releases (the v2.2.12 incident where the Windows build failed silently and a stale artifact was published).
- ✓ Routines foundation on disk — schedule grammar (duration, interval, cron, ISO timestamp), output archive with
[SILENT]early-stop, and SHA-256 input-hash packet schema. 63 new tests. The v2.2.14 daemon ships on top. - ✓ FreeBSD ARM64 and OpenBSD x86_64 are not in this release — the Rust toolchain does not publish a precompiled standard library for either target. Both are queued for v2.2.14.
- ✓ 1,146 workspace tests passing across every crate. Zero failures. Zero warnings.
Parallel and Transparent — the app gets out of your way.
- ✓ Per-tab parallel inference — each tab owns its own
Arc<Mutex<ConversationRuntime>>and runs turns on dedicated worker threads; fire prompts in multiple tabs simultaneously - ✓ Mid-turn TUI responsiveness — Ctrl+T, F2/F3,
/ssh, and cross-tab submit all respond immediately during streaming; the app is interactive throughout a turn - ✓ Tool-call cards — every Glob/Grep/Read/Write/Edit/Bash/WebSearch/MCP call renders a bordered card with actual input (pattern, path, command) the moment it fires; Ctrl+O expands to full JSON + result
- ✓ SSH tabs —
/ssh hostopens a modal connection form with russh backend, vt100 rendering, Ctrl+B prefix keys; connections saved as vaultHostCredentialaliases - ✓ Tab bar markers —
*(unread),⚠(pending permission),×(clickable close); terminal-friendly navigation (F2/F3/Ctrl+arrow/Alt+digit/click) - ✓ Session continuity —
anvil --continuehonors saved model from.meta.jsonsidecar; Ollama sessions reconnect without credential errors; exit prints resume commands - ✓ Scrollback fix — HISTORICAL VIEW was showing only 1–4 chars per assistant line; pending text growth now invalidates cached scrollback line vectors
- ✓
/quitno longer deadlocks — self-recursive mutex inrecord_dailyfixed - ✓ First-run setup wizard — mouse capture, theme, permission mode opt-ins on first launch;
anvil setup/anvil --first-runto reconfigure - ✓ anvil(1) manpage ships with Homebrew installs
- ✓
/clearclears workspace context across all tabs, not just the active one - ✓ Release pipeline hardening — tag-vs-HEAD pre-flight, build-from-tag, php-lint guard, changelog.json render-time injection on AnvilHub
- ✓ 318 tests passing, ~22 MB binary
Outweigh-them-all release — self-awareness plus ten core surfaces in one cut.
- ✓ System prompt now leads with "You are Anvil v2.2.11" and references the currently loaded model + provider in every turn — no more hallucinating a different identity
- ✓ W1 hook events: PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, PreCompact, Notification — full CC parity
- ✓ W2 effort slider:
/effort low|medium|high— tune reasoning depth per turn, persisted per session - ✓ W3 goal persistence: per-session goals survive
/clearand reconnect, surfaced in status line - ✓ W4 named profiles: save and switch (provider, model, effort, output style) tuples by name
- ✓ W5 published JSON schema:
settings.jsonfully typed, IDE-completable, served atanvilhub.culpur.net/schema/settings.json - ✓ W6 OpenTelemetry events:
OTEL_EXPORTER_OTLP_ENDPOINTsupport, permission_decision + tool_call + token_usage spans - ✓ W7 custom output styles: define your own
/output-stylenames in settings, ship them as plugins - ✓ W8 reviewer-agent approval gate: optional second-agent review before file writes, configurable threshold
- ✓ W9 anvil mcp-server mode: run Anvil itself as an MCP server — expose agents and tools to any MCP client
- ✓ W10 requirements.toml admin policy floor: enforce minimum versions, required plugins, denied domains org-wide
- ✓ Rename
CLAUDE.md→ANVIL.mdacross user-facing strings + the anvil-md-curator skill - ✓ Build-time fix:
cargo:rerun-if-changednow watches the actual ref file, not just.git/HEAD— GIT_SHA stays current across rebuilds
TUI usability patch.
- ✓ TUI: long lines wrap instead of right-truncating
- ✓ TUI: native terminal selection restored (Shift-drag works again)
- ✓ TUI: tool-result summaries now actually summarize
- ✓ Release pipeline: regenerate sha256 manifests every build + verify-before-release
- ✓ Release pipeline: fix repo target on
gh releasecalls
Claude Code parity catch-up.
- ✓ Claude Code parity:
--print/--agenthonor frontmatter, plugin prune, scroll snap - ✓ Subagent summaries,
/mcptool count, API 400 error surfacing - ✓ OTEL env vars, MCP reconnect summary, worktree HEAD detection
- ✓ Spinner red on errors, theme refresh, env vars (
DISABLE_UPDATES,HIDE_CWD,EFFORT,AI_AGENT) - ✓ Long URL clickability,
/cleartab title cleanup, editor handoff hardening
PAI-inspired composition, learning, and robustness.
- ✓
/agent compose <traits...> "<task>"— trait-based agent composition engine, 30-trait catalogue (expertise × personality × approach), dimension-conflicts hard-error by default. Adapted from Miessler'sPersonal_AI_Infrastructure. - ✓ Skill front-matter
triggerswith suggest-not-auto UX — three bundled reference skills (security-audit,code-review,terse). Never auto-inject (prompt-injection vector); user confirms via/skill load <name>. - ✓ Prompt-type hooks — plugin lifecycle hooks can now inject a string into the next model turn with
{tool_name}/{cwd}/{date}/{model}interpolation. Backward-compatible with bare-string command hooks. - ✓
anvil skill-eval— three-arm evaluation harness (__baseline__/__terse__/<skill>) with honest caveats baked into every report. Adapted fromcaveman. - ✓
/output-style precise|condensed— user-selectable global response style. Precise (default) preserves full sentences; condensed activates the bundledterseskill. Never auto-applies condensed — Auto-Clarity rules still fire for security / irreversible / multi-step / consent contexts even when condensed. - ✓ Plugin loader is forward-compatible — a single bad manifest no longer crashes the entire binary.
PluginLoadDiagnosticsurfaces per-plugin warnings on stderr. - ✓ Bundled plugins are now embedded in the binary via
include_dir— Homebrew users' bundled plugins are visible; developers' installed binaries no longer depend on their live source tree. - ✓ Claude-Code-parity bug fixes: 429
Retry-Afterminimum; 5-min stream dead-air timeout; configurable request timeout (ANVIL_API_TIMEOUT_MS);/modelwarns on mid-conversation switch; DangerFullAccess stability invariants. - ✓ 756 tests passing.
Cross-OS installers, anvil upgrade, shell completions, curated Ollama menu, Windows fixes, release-pipeline hardening.
- ✓
install.sh(macOS/Linux) andinstall.ps1(Windows) with SHA256 verification from anvilhub.culpur.net with GitHub fallback — aborts on dual failure, no unverified binary ever lands - ✓
anvil upgrade,anvil --check,anvil --setup,anvil --uninstall— full lifecycle from the binary itself - ✓ Shell completions for bash, zsh, fish, and PowerShell — all 143 slash commands, subcommands, flags, provider and model names
- ✓ First-run wizard: curated Ollama model menu — Llama 3.x, Qwen 3 / 2.5-Coder, Mistral Nemo, Gemma 3, Phi 4, Code Llama, Codestral, per-model confirmation
- ✓ TUI scrollback + text selection via Shift-drag pass-through to the terminal emulator
- ✓ Windows: correct
HOME/PATH/PATHEXThandling,.exeon respawn, cmd.exe-aware install detection - ✓ QMD cross-platform discovery — no more hard-coded Unix socket paths
- ✓ Ollama tool-use: multi-format parser (Anthropic, OpenAI, XML, JSON-fence, natural language) with fail-loud on ambiguity
- ✓ Remote-control 503 fixed — relay WebSocket process declaration corrected
- ✓ Release pipeline: per-binary embedded-version audit gate — makes the v2.2.6 Windows-exe-labeled-as-2.2.1 class of bug impossible
- ✓ 618 tests passing, zero warnings
Command Parity, Deep Autocomplete, Web Config, AnvilHub Installer.
- ✓ 17 web config panels — vault, notifications, SSH, Docker/K8s, memory, and more
- ✓ Full Status Line editor in browser — 36 widgets, 16 presets, drag-and-drop, live preview
- ✓ AnvilHub installer — search, install, restart prompt — vault-gated, telemetry-tracked
- ✓ Deep hierarchical autocomplete —
/vault store <Tab>→ 21 credential types - ✓ 8 previously-broken TUI handlers now working —
/mcp,/plugins,/session,/daily, and more - ✓ New commands —
/tab,/fork,/share,/audit,/restart - ✓ Self-respawn on macOS/Linux after plugin installs
Intelligent Memory System — six major features.
- ✓ Interactive Status Line Editor — full TUI editor with 6 sub-screens + WebUI drag-and-drop visual editor
- ✓ 37 widgets, 16 presets (8 emoji-rich themes), per-widget category colors
- ✓ Code Productivity Dashboard — live git diff tracking,
/productivitycommand - ✓ MCP Server Manager —
/mcpcommand, live McpStatus widget - ✓ Session History Browser —
/history-archive statswith model breakdown - ✓ Plugin System UI — web viewer management panel with config toggles
- ✓ Agent Panel Expansion — web viewer agent management buttons
Security Hardening + Optimization — 17 audit findings fixed.
- ✓ Constant-time HMAC verification, plugin command injection prevention
- ✓ Path traversal protection, cryptographic session IDs
- ✓ 110 functions made const fn, zero compiler warnings
- ✓ RC widget: live client count with connect/disconnect signals
Six Major Features — interactive editor, productivity, MCP, history, plugins, agents.
- ✓ Interactive Status Line Editor — 37 widgets, 16 presets, visual editor
- ✓ Code Productivity Dashboard — live git diff tracking
- ✓ MCP Server Manager, Session History Browser, Plugin UI, Agent Panel
Customizable Widget-Based Status Line — 8 presets for different workflows.
- ✓ Widget-based status line system — 28 widget types, dynamic rendering
- ✓ 8 presets: default, minimal, developer, token-heavy, git-heavy, compact, cost-focused, streamer
- ✓
/configure statuslinecommand with full tab completion - ✓ Web viewer config panel gains Status Line preset selector
- ✓ Dynamic footer height — 2-line presets maximize content area
URL rendering fix, context-aware vault, CI/CD automation.
- ✓ URL rendering fix — terminal hyperlinks render correctly across all providers
- ✓ Context-aware vault — vault auto-selects credentials based on active project context
- ✓ CI/CD automation —
/cicdcommand scaffolds pipelines for GitHub Actions and GitLab CI
Typed Credential Vault — the vault is now the single source of truth for ALL sensitive data.
- ✓ Typed credential entries —
name,type,value,tags,created_at,rotated_at - ✓ Vault covers API keys, SSH keys, TLS certs, tokens, and environment secrets
- ✓
/vault add— interactive typed credential entry with category selection - ✓
/vault rotate— rotate any credential in-place, preserving audit history - ✓
/vault export— encrypted vault export for backup and migration - ✓
/vault inject— load vault secrets into shell env for any subprocess - ✓ Audit trail v2 — every vault access logged with timestamp, operation, and credential type
Browser configuration panel, Gemini provider, slash command execution in web viewer.
- ✓ Browser-based visual configuration panel
- ✓ Google Gemini as 5th provider
- ✓ Slash commands execute from web viewer
- ✓ 30+ commands with subcommand completions
Edition 2024, dependency modernization, Claude Code parity.
- ✓ Focus view —
/focushides sidebars and agent panels for distraction-free mode - ✓ Context-low warning — proactive alert before auto-compaction fires
- ✓ Stalled stream handling — detects and recovers from stuck token streams
- ✓
/loopand/proactive— recurring prompt loops and proactive agent nudges
Credential scanner, egress control, conversation branching — 16 new features.
- ✓ Credential auto-detection — scans env vars, dotfiles, SSH keys, TLS certs
- ✓ Network egress control — configurable domain allowlist
- ✓ Signed session transcripts — HMAC-SHA256 audit trail
- ✓ Conversation branching —
/forkto snapshot and branch - ✓ Markdown session export —
/export mdwith code blocks - ✓ Remote control browser auto-open
- ✓ Expanded cost tracking — OpenAI, xAI, Ollama pricing
- ✓ Smart context compaction — preserves recent messages and code blocks
Live streaming responses, thinking status indicator, remote control.
- ✓ Live streaming responses — real-time token-by-token rendering
- ✓ Remote control —
/remote-controlto share sessions via browser - ✓ Thinking mode —
/thinkenables extended reasoning
Encrypted vault, file sandbox, modular architecture — security-first release.
Full Claude Code Parity — multi-agent system, TUI tabs, context management.
Multi-agent system — 7 agent types with task orchestration.
VS Code extension, 21 new features, credential vault, 86 commands.
Internationalization — 7 languages, 20 features.
Cross-compilation CI pipeline — 5-platform builds, theme system, QMD documentation.
Initial release. Terminal-native AI coding assistant with credential vault and TUI.
Built by Culpur Defense • AnvilHub • Product Page