• ✓Security hardening release. Closes fifteen findings from a deep, adversarially-verified audit (no criticals). Recommended upgrade for all users; no feature changes, no config migration.
• ✓Relay pairing enforced locally. The daemon re-verifies pairing at the Rust layer before acting on any privileged message (CWE-306/862); the pairing-code attempt limit can no longer be reset by reconnecting (CWE-307).
• ✓Windows credential storage locked down. Secret files and the daemon capability token get an owner-only ACL at creation, and the daemon pipe verifies the connecting client's identity (CWE-732 / CWE-284).
• ✓Sandbox deny-by-default. An active sandbox denies read access to credential directories and scrubs secret env; strict mode denies outbound network; the macOS seatbelt profile is consolidated (CWE-522 / 668 / 1059).
• ✓Remote MCP bounded & SSRF-guarded. Response and line sizes are capped (CWE-400) and MCP URLs are checked against their resolved IP, refusing private/link-local/metadata ranges by default (CWE-918).
• ✓Additional hardening. Owner-only secret and run directories (CWE-732/367), a normalization-hardened command reviewer (CWE-697), and an allowlisted /perf argument (CWE-77).
• ✓Seven platforms. macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.

• ✓Sessions connect reliably. Fixed a daemon crash that dropped sessions on connect (early eof) — the provider runtime is shut down off the async worker. An older daemon can no longer shadow a newer build (build-timestamp recency guard).
• ✓Text selection copies from the right place. Drag-to-copy now starts exactly at your cursor even when lines above it wrap, with correct wide/emoji-character handling.
• ✓xAI / Grok refresh + Live Search. grok targets grok-4.3, retired ids removed, grok-build-0.1 added, and Grok Live Search via the x_search Responses-API tool (ANVIL_XAI_LIVE_SEARCH=1).
• ✓Sandbox policy gate. sandbox.require = strict | preferred | off with real macOS sandbox-exec seatbelt enforcement; the active backend shows in anvil daemon status.
• ✓AskUserQuestion over the daemon. Questions fan out over the relay so a daemon-attached or web viewer can answer, with an opt-in idle timeout.
• ✓Partial output preserved. A sub-agent that streams text then hits a rate limit keeps its partial work with an [incomplete response] marker; the failure is still reported.
• ✓Terminal hygiene & paste. The terminal is restored on every exit (quit, Ctrl+C, panic); large pastes land once, verified on local and daemon paths.
• ✓Daemon-leak fixed. Autostart is suppressed under test/headless, the singleton PID lock is atomic, an idle orphan self-exits, and anvil daemon reap clears runaway daemons.

• ✓Voice entry. /voice or Ctrl+E for live in-terminal dictation — words transcribe into the input box as you speak. Toggle on/off, Ctrl+C interrupts, type while recording. Cloud (your key) by default, or a local whisper.cpp backend.
• ✓Remote MCP servers. Streamable HTTP/SSE transport (not just local stdio) with anvil mcp login <server> browser OAuth + per-server tokens.
• ✓Whisper.cpp setup step. The wizard now offers an optional whisper.cpp install (next to QMD) for offline, no-key voice — installs the binary, downloads a model, wires your config. Cloud stays the default.
• ✓Shared action spinner. The model-turn animation now appears for every action with a label: Thinking, Recording, Transcribing, Running command, Loading, Searching, Authenticating.
• ✓Claude-Code parity. Inline !-bash, /config key=value, /permissions denial reasons, autoMode.classifyAllShell, org model allow/deny, skill-frontmatter casing, MEMORY.md compaction reminder, structured-output loop guard, mouse-click pass-through.
• ✓Security. sandbox.credentials blocks commands (inline shell included) from reading credential files or dumping secret env; destructive-command guards flag hard resets, force-cleans, and infra destroy.
• ✓Login lands in Anvil. anvil login runs the loopback OAuth flow then launches straight into Anvil; the callback listener ignores stray connections instead of aborting.
• ✓Fixes. Per-turn memory injection no longer floods context; voice capture fully silenced (no TUI corruption); Linux peer-credential checks; guaranteed release checksums.
• ✓Seven platforms — macOS ARM64/Intel, Linux x86_64/ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.

• ✓Memory browser (Phases 1–4). /memory browse in the TUI + a web memory console with an SVG graph of the [[link]] web; full management — create, edit, forget, and re-scope entries between global and per-workspace — from the browser.
• ✓/local-control. Serves the same web console locally over loopback (every remote-control feature + the memory browser), pairing-PIN gated, no cloud round-trip.
• ✓Relevance-filtered memory + stranded-import fix. Identity/process tiers always inject; project/reference memories are surfaced per-turn, filtered to the message, so the prompt stays lean. Memory now merges the global + per-workspace stores.
• ✓Web viewer ↔ TUI parity. Conversation-on-pair, input history, correct cost chip, and the full rail (model, version+build, permissions, semantic/procedural/reflective, self-improve, QMD); context bar = current window with a live block countdown.
• ✓Reliability. 10-minute streaming timeout (not 60s); OS proxy auto-detect off by default; mid-stream cuts re-run the turn; daemon version handshake respawns a stale anvild.
• ✓TUI. Esc cancels + recalls the message for edit/resend; navigable queued-message view; timestamps default to [YYYY.MM.DD.HH:MM], on by default; conversation replays on --continue/--resume.
• ✓Self-improvement + security. Workflow/process reviewer captures how a session went; dedup/upsert stops near-duplicate memories; hardened daemon/askpass sockets + the routine approval gate.
• ✓Seven platforms — macOS ARM64/Intel, Linux x86_64/ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64. Every binary SHA256-verified.

• ✓Durable daemon sessions (D.1–D.4, #841–#844). Session execution moves out of the TUI into anvild — close the TUI and the session keeps running; reopen or attach from elsewhere and reattach to the same live session; crash and restart the daemon and it replays from the journal. Multi-client attach with peer-attach/detach events.
• ✓Named, multi-tab sessions + same-cwd auto-resume (#911). Session manifest gains name + last_active_at_ns; /session list|rename|kill|new|open|load|close mapped onto TUI tabs with per-tab daemon routing. Reopen Anvil in a directory with a live session and it reattaches.
• ✓Relay bridge — attach from the browser (#914, #917, #919–#921). A browser viewer pairs to a live daemon session over a passage WebSocket. #917 (P0) fixed a daemon tool-dispatch name-drift; #919 viewer UX; #920 /permissions over the relay; #921 ring recorder so resume carries the conversation.
• ✓Performance (#898–#900). One shared reqwest::Client ends per-call TLS handshakes; read-only tools in a batch fan out across worker threads (mutating tools still gated sequentially); grep_search walks-and-searches simultaneously, respects .gitignore, skips binaries.
• ✓The big modularization — 31 crates (#867, #873–#896). anvil-cli split into four crates; thirteen crates extracted from runtime (vault, journal, permissions, oauth, hooks, mcp, memory, curator, search, relay, reflection, skill-chain-exec, routines). runtime shrank ~70K→~57.7K lines.
• ✓Daemon hardening — P0 fixes (#902–#917, #827). Real provider runtime wired into the daemon; attach forwarder connected; correct PID file; /heal checks process liveness; auto-compaction actually compacts; anvild downgrade-prevention.
• ✓3,926 tests passing, zero failures. Latent shared-state test races serialized. IPC gained a dual-transport abstraction (Unix sockets + Windows named pipes) so the daemon runs natively on all seven platforms.
• ✓Seven platforms — every binary SHA256-verified.

• ✓F1 — Signed skill provenance. Every skill carries a signed provenance.jsonl ledger keyed by an ed25519 keypair; the verifier walks the chain on every load, a break surfaces as a P0 in /skill why. Trust-on-first-use pins an imported skill's pubkey. New anvil skill why|pubkey|verify.
• ✓F4 — Anti-skills (negative learning). The curator records failure modes as AntiPattern memory entries with their own retrieval-order block; anti-skills annotate rather than block, with a “you tried something similar and it scored N% worse” footnote.
• ✓F6 — Event-triggered routines. anvild routines accept FileWatch / Webhook / Process / Log triggers in addition to cron. Webhook listener is axum 0.8, localhost-only by default.
• ✓F3 — Curator A/B evaluation. New skills run an A/B pass against a held-out batch; winners promote, losers go to the anti-skill pool. Additive, escalate-only — a worse candidate can't replace a better incumbent.
• ✓F2 — Cross-machine memory federation. x25519 key agreement, HKDF-SHA256, AES-256-GCM (fresh nonce per call), ed25519 signatures, trust-on-first-use peer pinning. anvil memory sync|peer add|peer list.
• ✓Forge screensaver. Video-driven two-phase animation baked once into a 665 KB gzipped cell-grid bundle compiled into the binary — no ffmpeg at build or run time.
• ✓3,061 tests passing, 0 failing (+139 across the arc). Three parallel-test flakes pinned to a serial token.
• ✓Seven platforms — every binary SHA256-verified.

• ✓chore: regenerate Cargo.lock + man/anvil.1 for v2.2.19
• ✓release: v2.2.19 — bump version + finalize release notes
• ✓feat(wizard): #768 move anvild install prompt into wizard alt-screen
• ✓feat(wizard): #767b Ctrl+B Back keybind on Choice + Confirm modals
• ✓fix(tui/vs): #769 add ⌥/Alt+drag selection hint to vertical-split rail
• ✓fix(modal): #767a ConfirmModal adaptive height — long body no longer hides buttons
• ✓fix(daemon): #766 follow-up — spawn_detached execs anvild not anvil
• ✓feat(daemon): #766 anvild as separate process name across 7 platforms
• ✓feat(install): #751 locale-aware installers (sh + ps1)
• ✓task #764 (v2.2.20): extend OAuth keepalive to Gemini (refresh) + Copilot (monitor+alert)
• ✓feat(daemon): #763 OAuth keepalive observability + Heartbeat events
• ✓fix(tui): #757 wrap-aware scroll prevents text from disappearing under input
• ✓feat(daemon): #761 anvild as single source-of-truth for OAuth refresh
• ✓fix(startup): #762 share startup hooks across --resume, --continue, run_repl
• ✓fix(health): #745 self-heal false-positives on OAuth + completions
• ✓fix(resume): #760 enter REPL after --resume instead of exiting to shell
• ✓fix(session): #758 use $ANVIL_CONFIG_HOME/sessions/ instead of CWD-relative
• ✓v2.2.19 #750: detect system locale at startup
• ✓man(anvil.1): regenerate from clap_mangen + tail on every release (task #752)
• ✓i18n: wire 42 new locales into SUPPORTED_LANGUAGES
• ✓i18n: add 42 new locales (EU official + non-EU European + major world)
• ✓i18n(v2.2.19): wire top-10 slash command output through t!() (task #754)
• ✓refactor(tui/clipboard): factor osc52_encode out of write_clipboard (#748)
• ✓feat(tui/clipboard): copy/paste/select always work alongside mouse capture (#748)
• ✓i18n: translate 12 fallback locales for v2.2.19 TUI chrome (ru/ko/id/it/nb/nl/pl/pt-BR/sv/tr/uk/vi)
• ✓i18n: add TUI layout keys to 12 remaining locale YAMLs (English fallback)
• ✓i18n: wire TUI layouts (classic, vertical_split, three_pane, journal) through t!()
• ✓feat(memory/L6): /reflect emits pattern recap + appends to daily summary (#735 RED)
• ✓fix(runtime/routines): switch proposal tests to tempfile to kill flake (#741)
• ✓feat(release): wire step-gates into release.sh + Phase 6 SSH hardening (#730)
• ✓feat(memory/L4): /memory show procedural consolidates goals + skills + cron (#734)
• ✓docs(anvilhub): Apache flushpackets=on spec for SSE token stream (#740)
• ✓docs(anvilhub): publisher-standing pre-check + ANVILHUB_BACKEND_URL (#738)
• ✓fix(memory/L3): /memory promote gains --target + nominated_at/source provenance (#733)
• ✓test(memory/L2): regression tests for /memory prune episodic trash-bin (#732)
• ✓fix(memory/L2): wire /memory prune episodic dispatch arm (#732 follow-up)
• ✓fix(memory/L7): drop stray #732 episodic match arm referencing missing fn (#736 follow-up)
• ✓fix(memory/L7): file-cache path discovery + /memory show cache + dry-run prune (#736)
• ✓i18n(v2.2.19): wire Tier-2 NATIVE_NAMES rows in wizard + Configure picker (#710)
• ✓feat(memory/L1): /memory layer 1 renders live working snapshot (#731)
• ✓feat(prompt-section): iter_by_kind() extension method (#731 prep)
• ✓i18n(v2.2.19): Tier-2 finisher — nl/sv/nb/uk + SUPPORTED extend (#710)
• ✓docs(v2.2.19): AnvilHub /build page spec + BuildClient component (#674 #675)
• ✓docs(parity): file-path corrections appendix from implementing agents (#713)
• ✓docs(memory): I.1 audit — 7-layer architecture status (#712)
• ✓i18n(v2.2.19): Tier-2 part 2 — id + pl + vi locales (#710)
• ✓fix(worktree): preserve original-CWD MCP config across EnterWorktree (#728)
• ✓i18n(v2.2.19): Tier-2 partial — it + ko + tr locales (#710 partial)
• ✓fix(branch): preserve session origin across EnterWorktree boundary (#724)
• ✓feat(worktree): capture original_dir + original_sessions_dir at EnterWorktree (#728 prep)
• ✓fix(plugins/watcher): skip non-.md changes + exclude build dirs to prevent FD exhaustion (#726)
• ✓test(security/mcp): regression tests for permissions.allow gate (#717 part 4)
• ✓fix(mcp): disk-bind unsupported image MIME types instead of aborting (#725)
• ✓fix(security/mcp): consult permissions.allow before prompter (#717 part 3)
• ✓fix(theme): don't reset theme on first /rename invocation (#727)
• ✓fix(security/mcp): parse permissions.allow into PermissionsConfig (#717 part 2)
• ✓fix(tools/read): fall back to text/image alternate path on mime-mismatch (#723)
• ✓fix(security/mcp): add PermissionAllowList matcher for permissions.allow (#717 part 1)
• ✓fix(tui): self-heal glyph corruption in long sessions via periodic full-redraw (#718)
• ✓fix(api): 15s timeout on side-channel calls to prevent 75s startup hang (#722)
• ✓fix(tui): spinner/elapsed-time wake independently of input events (#716)
• ✓fix(session): preserve model field on --resume (#721)
• ✓fix(skills): recursion guard for context:fork invocations (#720)
• ✓fix(mcp): pagination for tools/list + resources/list + prompts/list (#715)
• ✓fix(security/bash): enforce permission rules on bare env-var assignments (#719)
• ✓docs(parity): CC v2.1.144-146 audit + 15 FILE-AS-TASK specs (#713)
• ✓feat(i18n/A6): wizard language picker + Configure menu picker (#645)
• ✓docs(v2.2.19): no-deferrals — fold all stretch items into hero arcs (#704)
• ✓feat(i18n/A5): --lang CLI flag + boot-time set_locale + pt-BR in SUPPORTED + drift gate test (#645)
• ✓docs(v2.2.19): master tracker + 6 supporting design docs (#704)
• ✓test(ssh-webui): end-to-end integration tests for /ssh relay round-trip (#706 phase 3)
• ✓i18n(v2.2.19): translate Tier-1 locales (es, zh-CN, fr, pt-BR, ru, ja, de) from en.yml seed (#645)
• ✓feat(/ssh webui phase 1): backend relay events + anvil-cli dispatch (#706)
• ✓i18n(v2.2.19): extract wizard + TUI core + cmd_static + cmd_ai strings → en.yml (#645)
• ✓release(scripts): add Phase 7 X announcement, renumber verify to Phase 9 (#659)

Web Viewer Parity + Mouse Capture Default-OFF + Autocompact Hardening:

• ✓Autocompact threshold now uses the context window (64K–200K+), not the output cap — sessions on long-context models run far longer before compaction (#697)
• ✓Mouse capture default-OFF on all platforms — restores terminal copy-paste for users who hadn't opted in (#696 P4)
• ✓/tab new/rename/switch + Ctrl+T in TUI + relay; per-tab routing for concurrent sessions (#696)
• ✓Web viewer default layout = vertical_split + tabs, matching TUI default
• ✓Relay: default-allow forwarding, slash completion, cost_type chip, collapsible tool cards, MemorySnapshot broadcast
• ✓Bracketed paste in textarea modals — multi-line paste works in /mcp builder and wizard fields (#685)
• ✓Alt-screen raw-mode restore fix — keyboard no longer stops working after inline-op cancel (#688)
• ✓MemorySnapshot uses layouts::common helpers for rail parity (#695)
• ✓PermissionPrompt end-to-end round-trip regression test (#677)
• ✓Release pipeline Phase 6 hardened against set -e silent-exit (#654)

Setup Wizard Rewrite, Autonomous Reflection, Sandbox Detonation, Source Viewer:

• ✓Setup wizard rewritten as a single continuous in-TUI alt-screen session — 9 modal steps from Welcome through to first prompt, no stdin prompts, no screen flicker (#642)
• ✓Autonomous reflection loop: StuckDetector catches ToolLoop / Thrashing / InferenceStall / Oscillation patterns and injects strategy-switch reminders before the next inference call (#636)
• ✓anvil-sandbox-runner binary ships with every release — detonates hub package installCmd in an OS sandbox and shows you the diff before anything touches your machine (#570)
• ✓AnvilHub source viewer end-to-end: all 558 packages have synthesized source archives + GitHub-style file browser with Shiki syntax highlighting and IndexedDB cache (#528)
• ✓Skill-chain builder — /builder React Flow canvas + /my-chains + anvil:// deep-link install; SKILL.md extended with inputs:/outputs: slots (#529)
• ✓TUI region-targeted partial repaints — DirtyRegions extended with per-area bits; photosensitivity gate preserved (no full-screen Clear without DirtyRegions::ALL) (#622/#629)
• ✓Reactive compaction: providers detect context-overflow errors, compact to half remaining, and retry the same turn without losing user input (#564)
• ✓HookEvent::Stop fires at end-of-turn when no tool_use; block decisions inject reason as synthetic user-text message (#566)
• ✓/rewind slash command with TUI picker and “Summarize up to here” force-compaction action (#557)
• ✓Rail keybinds wired (g/d/s/a/Ctrl+R) + drift test that asserts every advertised key has a handler (#634)
• ✓Session auto-titling: derive_title_from_first_message now actually fires on first user message (#580)
• ✓Tests: runtime 1106, anvil-cli 717, commands 235, api 330 — all green. Slash-command spec count 119; rail-keybinds drift gate added.

• ✓release: Anvil v2.2.16
• ✓chore: drop stale .claude/worktrees agent dirs from index
• ✓release(v2.2.16): hand-written release notes
• ✓test(v2.2.16): update layout_live_switch baselines for new default
• ✓prep(v2.2.16): bump version + flip default layout + wizard highlight
• ✓tui(classic): inline 7-layer MEMORY block above input (#607)
• ✓tui(paste): keystroke-burst detection for drag-and-drop (#604 Part C)
• ✓cli(cancel): wiremock integration test for Ctrl+C stream abort (#606)
• ✓cli(cancel): tokio::select! aborts blocking HTTP read on Ctrl+C (#605)
• ✓tui(paste): submit-time path detection + long-paste placeholder (#604)
• ✓runtime+cli(cancel): DefaultRuntimeClient honors set_cancel_token across all 7 providers
• ✓tui(vertical-split): close tool-call boxes, gate banner, style markdown, 2-decimal cost (#602)
• ✓runtime+tui(paste): first-class ContentBlock::Document for PDF + Office docs (#601)
• ✓tui(paste): consolidated handler + file-path detection, mouse capture OFF (#599)
• ✓feat(runtime): prefer anvilhub /api/version, fall back to GitHub
• ✓docs: clarify commit attribution for d219e18 / ccde10b
• ✓tui(vertical-split): commit #596 deliverables that the linter stripped from prior commit
• ✓tui(vertical-split): split-anchor rail, fold QMD into MEMORY, update banner (#596)
• ✓oauth: strict RFC 6749 token-exchange parser + startup validator (#595, BUG-14)
• ✓tui(vertical-split): rail owns all chrome, deck has input only (#594, BUG-13)
• ✓tui(vertical-split): rail sections — uppercase headers, cross-tab status aggregates, agent tab-binding (#588 polish)
• ✓tui(layouts): wizard + slugs + /layout --global + live preview page bumped to 8 variants (#588)
• ✓tui(three-pane): delete vim modal — always-on input, standard handler (#588, BUG-8)
• ✓tui(layouts): build real rail+deck vertical_split renderer matching mockup (#588)
• ✓tui(layouts): rename vertical_split renderer to classic + add TuiLayoutKind::Classic (#588)
• ✓tui(layouts): move layout from AnvilTui to Tab (per-tab layout state) (#588)
• ✓fix(model): async fetch_all_configured_models with timeout + Ctrl+C cancel (#BUG-7)
• ✓fix(tui): wire slash command completion popup into all 6 layouts (#BUG-6)
• ✓fix(tui): request redraw on every keystroke so input renders live across all layouts (#BUG-5)
• ✓feat(tui): make three-pane Insert mode discoverable with framed hint + ghost input (#BUG-4)
• ✓fix(tui): three-pane uses Constraint::Fill for CONTEXT band (#BUG-4)
• ✓fix(oauth): poll background callback channel each frame so login completes without requiring a keypress
• ✓fix(journal): clear header/input rows before draw to prevent stale-cell ghosting and add bg_primary to header
• ✓fix(api): 5xx errors name configured provider/gateway, not hardcoded Anthropic URL (#568, CC-143-B)
• ✓fix(session): title heuristic skips bare URL as first message (#563, CC-142-B)
• ✓fix(tui): welcome banner names active provider, not hardcoded Anthropic (#562, CC-141-B)
• ✓feat(mcp): ANVIL_MCP_TOOL_TIMEOUT env to override per-request fetch timeout (#559, CC-141-B)
• ✓feat(tui): spinner color warm green→amber→red on elapsed time (#558, CC-141-F)
• ✓fix(tools): Read offset accepts string forms with whitespace/+ prefix (#555, CC-140-B)
• ✓chore(docs): file task #579 — migrate wizard.rs prompts to in-TUI modal
• ✓feat(tui): intercept /login and /provider login to open TUI modal (#578)
• ✓feat(tui): wire ProviderLoginModal key handler and OAuth listener (#578)
• ✓feat(tui): add ProviderLoginModal for in-TUI OAuth/API-key flows (#578)
• ✓fix(tui): clear terminal on /layout switch to drop stale cells (#bug-3)
• ✓fix(tui): force full repaint after inline OAuth/setup flows (#bug-2)
• ✓fix(vault): retry up to 3 times + pre-fill /vault unlock on failure (#bug-1)
• ✓tui(layouts): wire /layout command, set_layout(), intro toast + live-switch tests (v2.2.16 Step 3E)
• ✓tui(layouts): land Step 3 — layout renderers, dispatch, DirtyRegions widening (v2.2.16)
• ✓tui(layouts): land LayoutSnapshot extraction + golden baseline (v2.2.16 step 1)
• ✓tui(layouts): config schema + /layout slash command (8 axes) + wizard step (v2.2.16 step 2)
• ✓security(oauth): lenient scopes deserializer prevents auth lockout (#565, CC-143-B)
• ✓v2.2.16: verification gate, /hub status (all 8 axes), /plugin update REVOKED guard
• ✓v2.2.16: HubPackage verified-badge structs + require_verified config (AnvilHub F3)
• ✓release: prepend ~/.cargo/bin to PATH (brew-Rust shadowing fix, #534)
• ✓docs(v2.2.15): clear public README narrative — 35 providers, /cursor, /model

• ✓docs(v2.2.15): clear public README narrative — 35 providers, /cursor, /model
• ✓release(v2.2.15): bump workspace + release notes
• ✓v2.2.15: /model handler — atomic cross-provider switch + ambiguous-name guard
• ✓v2.2.15: /model TAB completion — provider-prefixed unified list
• ✓v2.2.15: cross-provider unified model list (fetch_all_configured_models)
• ✓v2.2.15: /cursor handler — all 6 subcommands end-to-end
• ✓v2.2.15: /cursor spec registration with full subcommand tree
• ✓v2.2.15: SlashCommand::Cursor variant + 6 subcommand enum
• ✓Release notes for v2.2.14
• ✓fix(bedrock): add crate_env_lock to three env-touching tests to prevent parallel flake
• ✓test(bedrock): SigV4 compliance tests against Python-verified vectors
• ✓feat(gemini-oauth): Google Code Assist OAuth provider replacing Antigravity OpenAI-compat stub
• ✓feat(cursor): Cursor Cloud Agents provider — real API replacing broken OpenAI-compat stub
• ✓Expand provider catalog from 5 to 35 providers across the open-source ecosystem
• ✓Phase 6.5g: OTel events verified, ProviderRewriter Debug derive, cleanup
• ✓Phase 6.5b-f: /memory clean slash command + dispatch + integration tests
• ✓Phase 6.5a: MemoryRewriter trait + MockRewriter + RewriteResult schema
• ✓Phase 6.3 follow-up: --include-sessions fails loud on missing provider
• ✓Phase 6.3e: --include-sessions flag + integration tests
• ✓Phase 6.3b-d: sessions composer wiring + nominations subdir + OTel
• ✓Phase 6.3a: SessionSummarizer trait + MockSummarizer + SummarizedSession schema
• ✓Phase 6 follow-up: return real conflict_count from run_settings_import
• ✓Phase 6 integration: orchestrate all 5 pipelines in run_import_pipeline_headless
• ✓Phase 6.4c: full report generator + OTel event wiring
• ✓Phase 6.4a: wizard migration step + skip flag
• ✓Phase 6.1c: dispatch handler wiring + serial test isolation fixes
• ✓Phase 6.1b: instructions discovery + ANVIL.md merge semantics
• ✓Phase 6.1a: memory entry discovery + translation
• ✓Phase 6.2c: plugin manifest translation (with Phase 5.1 skills/agents fields)
• ✓Phase 6.2b: skills import (disabled by default, collision handling)
• ✓Phase 6.2a: settings.json schema translation + conflict staging
• ✓Phase 6.0: Migration foundation (ImportArtifact, manifest, staging machinery)
• ✓Phase 5.4g: Rewrite parallel-tab dispatch test to use Barrier
• ✓Phase 5.4f: Inherit SandboxConfig through subagent spawn
• ✓Phase 5.4e: serialize auto_tune cache-mutation tests to fix workspace race
• ✓Phase 5.4d: pin defect #11 resolution in fetch_ollama_models_for_cache doc
• ✓Phase 5.4a/b: HOOKS.md + SANDBOX-MODES.md research documentation
• ✓feat(#8): wire CommandCacheManager into glob_search and grep_search
• ✓feat(#9): wire CommandCacheManager into WebFetch/WebSearch (5-min/1-hr TTL)
• ✓fix(#514): serialize TRACEPARENT env tests to eliminate workspace-parallel race
• ✓fix(#4,#5): plugin manifest skills/agents fields + skill root discovery
• ✓Phase 5.2a/b/c: ResultBlock schema, 45-tool formatter, subcommand vocab consts
• ✓Phase 5.1a CC-BUG-3/4: Thread parent permission_mode into spawned subagents
• ✓Phase 5.3 #19: wire mcp_tool hook entries from settings.json (Stream B)
• ✓Phase 5.3 #21: propagate TRACEPARENT to plugin tool subprocesses
• ✓Phase 5.3 #16: document permission decision chain and pin order invariant
• ✓Phase 5.3 #15: extend Gate 3 sync-LLM lint with 4 new blocked patterns
• ✓Phase 5.1a #20 #22: TeamDelegate delegations in agents-live + parent_agent_id
• ✓Phase 5.1a #1: Wire EgressPolicy::is_allowed into web_ops + automation_ops
• ✓Phase 5.0.5: Unify slash command dispatch (4 sites → 1)
• ✓Phase 5.0: Bidirectional drift, menu-handler smoke, sync-LLM lint
• ✓Fix Anvil OAuth Max-plan 429: missing claude-code beta header + identity preamble
• ✓Wire DailyStore L2 episodic summaries into SystemPromptBuilder
• ✓Wire egress allowlist into settings.json + /memory show policy view
• ✓Serialize all ANVIL_CONFIG_HOME-mutating tests via #[serial(anvil_config_home)]
• ✓docs: overnight session summary for 2026-05-13
• ✓Phase 4.4 follow-up: update memory_show_nominations test for new banner phrasing
• ✓Phase 4.5: L1 — SYSTEM_PROMPT_DYNAMIC_BOUNDARY consumer for prompt-cache split
• ✓Phase 4.4: alias deprecations (file-cache, cmd-cache, history-archive, nominations)
• ✓Phase 4.3: L4 — /goal web_available audit (decision documented)
• ✓Phase 4.2: L7 — file-cache + cmd-cache size caps + LRU eviction
• ✓Phase 4.1: L2 — 90-day history retention with trash-bin + dry-run
• ✓Phase 3.7: L2 — fix /memory why daily-reconciliation help text
• ✓Phase 3.6: L5 — zero-injection integration test [SECURITY]
• ✓Phase 3.5: L7 — is_l5_path sentinel gates cache store/lookup [SECURITY]
• ✓Phase 3.4: L6 — PermissionEffect {Allow,Deny,Prompt} enum
• ✓Phase 3.3: L5 — wire classify_learning into nomination-emit (ANVIL_L5_AUTOROUTE) [SECURITY]
• ✓Phase 3.2: L3 — anvil-semantic QMD collection + nominated_from frontmatter
• ✓Phase 3.1: L3 — /memory promote writes ANVIL.md + atomic rename
• ✓Phase 2.8: spec + subcommand updates for /memory tier vocabulary
• ✓Phase 2.7: L7 — unified cache tier (file/cmd/qmd sub-views)
• ✓Phase 2.6: L6 — policy tier (grants + auto-deny + reviewer + egress)
• ✓Phase 2.5: L5 — identity tier (labels/keys + locked-state counts)
• ✓Phase 2.4: L4 — procedural tier (goals + skills + cron + routines stub)
• ✓Phase 2.3: L3 — semantic --pending recast (nominations alias)
• ✓Phase 2.2: L2 — episodic tier + daily sub-view
• ✓Phase 2.1: L1 — /memory why + show working introspects WorkingMemorySnapshot
• ✓/model picker reads live provider /models APIs, not static registry
• ✓Fix /model switch to atomically swap routing + prompt identity + chrome
• ✓Populate missing /cmd subcommand pickers + add drift-prevention test
• ✓Fix /model autocomplete regression — live provider-aware completions
• ✓Add missing /ollama spec + strengthen variant<->spec drift test
• ✓Wire /file-cache and /cmd-cache slash commands to real handlers (#490, L7)
• ✓Wire env::current_dir() into PermissionMemory load (#489 follow-up)
• ✓Wire PermissionMemory into the permission gate (#489, L6)
• ✓Update remaining test fixtures for Vec<PromptSection> migration
• ✓Flip system_prompt storage to Vec<PromptSection> end-to-end (Phase C+D of #486)
• ✓SystemPromptBuilder::build() returns Vec<PromptSection> (Phase B of #486)
• ✓Add PromptSection and WorkingMemorySnapshot types (Phase A of #486)
• ✓Fix /changelog freezing the TUI
• ✓Embed release notes into the binary
• ✓v2.2.14 Phase 1: retrieval-order block + 3 synthesis defect fixes + TUI placeholder
• ✓docs(research): seven-layer memory architecture + v2.2.14 arc plan
• ✓release(v2.2.14): bump workspace + release notes + README catchup
• ✓v2.2.14 BUG-fix: tab-2 missing Thinking + lost prompt + Apple Terminal Enter
• ✓v2.2.14 BUG-fix-real: render arbitration + instrumentation
• ✓v2.2.14 BUG-fix: tab-2 input echo missing while tab-1 streams
• ✓v2.2.14 TUI-2 (deep): true per-tab non-blocking turn waits
• ✓chore: fix anvil-cli test-target build + cross-module env-var test race
• ✓v2.2.14 TUI-3: queue user messages typed while a turn is streaming
• ✓v2.2.14 CC-DRIFT bundle: B4 agent panic, B6 compact usage, B8 mcp test
• ✓v2.2.14 TUI-2: cut in-flight wait latency from 80ms to 20ms
• ✓v2.2.14 CC-DRIFT-B5: OTEL TRACEPARENT propagation
• ✓v2.2.14 TUI-1: Ctrl+C cancels mid-flight streaming
• ✓v2.2.14 #474: rewire /ollama slash commands (W4-merge regression)
• ✓docs: record v2.2.14 audit verdicts for 4 VERIFY items
• ✓docs: mark CC-136-F2 SHIPPED in parity table
• ✓v2.2.14 CC-136-F2: autoMode.hard_deny short-circuit (#465)
• ✓v2.2.14 CC-139-F1: cross-session agent view via anvil agents subcommand (#462)
• ✓v2.2.14 CC-139-F5: transcript view nav keys (?, {, }, v) (#460)
• ✓v2.2.14 CC-136-B6 SECURITY: ReadOnly cannot be bypassed by env or Edit (#467)
• ✓v2.2.14 CC-139-B5 SECURITY: safe wildcard match primitive for tool allow-rules (#469)
• ✓v2.2.14 CC-136-B5 VERIFY: --resume/--continue on underscore paths (#466)
• ✓v2.2.14 CC-139-F16: subagent OTel headers (#461)
• ✓v2.2.14 CC-139-F4: /plugin details <name> with inventory + token cost (#459)
• ✓v2.2.14 CC-139-F3: /scroll-speed slash command + live mouse-wheel tuning (#458)
• ✓v2.2.14 CC-139-F2: unify /goal — auto-link active session on /goal new (#457)
• ✓v2.2.14 CC-133-F1: worktree.baseRef setting + apply at worktree-create (#463)
• ✓v2.2.14 W15b: wire auto-promote engine into read/bash + main.rs install (#394)
• ✓v2.2.14 W11: wire file-fingerprint cache into read/write/edit + system prompt (#390)
• ✓v2.2.14: hook args[] exec form + continueOnBlock for PostToolUse (#453, #454)
• ✓v2.2.14 CC-132-F1/CC-133-F4/CC-139-F8: per-session env propagation
• ✓v2.2.14 CC-132-F2: ANVIL_DISABLE_ALTERNATE_SCREEN env opt-out
• ✓.anvil-release.toml: fix WP path + pm2 process name drift

• ✓FreeBSD x86_64 + NetBSD x86_64 binaries — first-ever BSD support. Every binary SHA256-verified and signed by the release pipeline; paired .sha256 manifests served at anvilhub.culpur.net/sha256/.
• ✓Windows x86_64 is back. The v2.2.12 hold is fixed: ssh-agent auth is now #[cfg(unix)]-gated with a clean Windows stub. The rest of the SSH driver (key-file, password, kbd-interactive) works on Windows exactly as on Unix.
• ✓Seven platforms total — macOS ARM64, macOS Intel, Linux x86_64, Linux ARM64, Windows x86_64, FreeBSD x86_64, NetBSD x86_64.
• ✓Release pipeline hardening. Removed the | tail -1 mask that hid the v2.2.12 Windows build failure. Build errors now hard-fail instead of silently producing partial releases.
• ✓Routines foundation on disk. New crates/runtime/src/routines/ module with schedule grammar (duration, interval, cron, ISO timestamp), output archive with [SILENT] early-stop, and SHA-256 input-hash packet schema. 63 new tests. v2.2.14 daemon ships on top.
• ✓FreeBSD ARM64 and OpenBSD x86_64 are not in this release — the Rust toolchain does not publish a precompiled standard library for either target. Both are queued for v2.2.14.

• ✓v2.2.12: parallel inference, tool-call cards, SSH tabs, scrollback fix
• ✓v2.2.12 Bug3-C3: per-tab parallel inference via JoinHandle spawn
• ✓T5-Ssh-F: wire /ssh end-to-end + add integration test with in-process russh server
• ✓v2.2.12 T5-Ssh-E: modal SSH connection form overlay
• ✓v2.2.12 T5-Ssh-D: render vt100 SSH tab + forward keys + Ctrl+B escape
• ✓v2.2.12 T5-Ssh-D-checkpoint: SshTabState + async/sync bridge + key encoder
• ✓v2.2.12 T5-Ssh-C: vault HostCredential schema for SSH aliases
• ✓v2.2.12 T5-Ssh-B: russh driver + 4-method auth chain
• ✓v2.2.12 T5-Ssh-A: SlashCommand::Ssh — parser for embedded SSH client
• ✓v2.2.12 T4-O: hot-reload ANVIL.md / MEMORY.md when they change on disk
• ✓v2.2.12 T4-M: /doctor release — pre-flight self-check for the release pipeline
• ✓v2.2.12 T4-L: mark interrupted turns visibly when partial response preserved
• ✓fix(release): require RELEASE-NOTES-<TAG>.md or hard-fail; never ship empty body
• ✓v2.2.12 T4-K: auto-show diff summary after file-modifying turns
• ✓v2.2.12 T4-N: /clear wipes the TUI's visible state, adds --all for workspace
• ✓v2.2.12 T3-I: /fork uses Arc-shared snapshots when log unchanged
• ✓v2.2.12 T3-H/T3-Exit-UX/T3-J: session friendly names + resume-by-name + exit banner
• ✓v2.2.12 T1-#400: TUI accepts live typing while a turn is in flight
• ✓v2.2.12 T1-A/B/C/D: harden release pipeline against the v2.2.11 incidents
• ✓v2.2.12 T2-G: introduce RedrawScheduler for the TUI
• ✓fix(release): stop globally rewriting every version mention in public README

The release where the agent learned to know itself, the operator learned to shape it, and ten core surfaces landed in one cut.

• ✓release(v2.2.11): self-awareness — agent knows its own version, model, and provider in every turn
• ✓feat(prompt): system prompt now references current Anvil version + loaded model + provider
• ✓W1 hook events: full catch-up with CC parity — PreToolUse, PostToolUse, UserPromptSubmit, SessionStart, SessionEnd, PreCompact, Notification
• ✓W2 effort slider: /effort low|medium|high — tune reasoning depth per turn, persisted per session
• ✓W3 goal persistence: per-session goals survive /clear and reconnect, surfaced in status line
• ✓W4 named profiles: save and switch (provider, model, effort, output style) tuples by name
• ✓W5 published JSON schema: settings.json fully typed, IDE-completable, anvilhub.culpur.net/schema/settings.json
• ✓W6 OpenTelemetry events: OTEL_EXPORTER_OTLP_ENDPOINT support, permission_decision + tool_call + token_usage spans
• ✓W7 custom output styles: define your own /output-style names in settings, ship them as plugins
• ✓W8 reviewer-agent approval gate: optional second-agent review before file writes — configurable threshold
• ✓W9 anvil mcp-server mode: run Anvil itself as an MCP server — expose agents and tools to any MCP client
• ✓W10 requirements.toml admin policy floor: enforce minimum versions, required plugins, denied domains org-wide
• ✓feat(skills): rename CLAUDE.md → ANVIL.md across user-facing strings + anvil-md-curator skill
• ✓fix(build): rerun build.rs when current branch ref changes (GIT_SHA stayed stale on rebuild)
• ✓fix(w3): goals slash command implementation, not stub — persistence, completion tracking, status line
• ✓fix(w1): hook events were declared but unwired; tests added covering all 7 event types end-to-end
• ✓fix(w6): OTel permission_decision span unwired; W5 schema tightening for required fields

• ✓release(v2.2.10): TUI usability patch — wrap, native-select, tool-result summaries
• ✓fix(tui): wrap long lines, restore native selection, give tool results meaning
• ✓fix(release): regenerate sha256 manifests every build + verify-before-release
• ✓fix(release): correct repo target on gh release calls

• ✓release(v2.2.9): wave 2 — OAuth paste-code, alwaysLoad MCP, plugin zip/URL + version bump
• ✓feat(v2.2.9): CC parity catch-up v2.1.118 → v2.1.131

• ✓See commit history for details

• ✓docs(v2.2.8): release notes + rollback runbook
• ✓fix(cli): remove unused format_suggestions import; bump workspace to v2.2.8
• ✓feat(v2.2.8): integrate F1 /agent compose + F3 skill-eval CLI + F5 loader forward-compat + F6 embed bundled plugins
• ✓feat(config): add output_style axis — /output-style precise|condensed (v2.2.8)
• ✓feat(skills): bundle terse skill — token-economy mode with Auto-Clarity
• ✓feat(commands): trait-based agent composition engine (Anvil v2.2.8)
• ✓Add three-arm skill evaluation harness (skill_evals module)
• ✓feat(commands): add YAML front-matter trigger keywords to skill system
• ✓feat(cli): /model warning + Ctrl+U/Ctrl+Y readline kill-yank + PAI survey
• ✓fix(agents): correct module path in Bug #83 Part B subagent inheritance test
• ✓fix(api): make HTTP request timeout configurable via ANVIL_API_TIMEOUT_MS (Bug #84)
• ✓test(permissions,file_ops,agents): document DangerFullAccess stability invariants (Bug #83)
• ✓fix(api): add 5-minute dead-air timeout to OpenAI-compat stream (Bug #82)
• ✓fix(api): use max(Retry-After, backoff) on 429 retries (Bug #81)
• ✓feat(sandbox): Claude-Code-style permission modes with on-the-fly switching
• ✓feat(ollama): honor ANVIL_OLLAMA_NUM_CTX / ANVIL_CONTEXT_SIZE for context window
• ✓fix(runtime): don't fail turn when Ollama returns empty stream after tool result
• ✓docs(readme): update for v2.2.8 — badges, Windows binary name, new commands
• ✓docs: Anvil v2.2.8 release-complete report

• ✓release: Anvil v2.2.7
• ✓test(runtime): fix parallel-test races for v2.2.7 release gate
• ✓fix(installer): close e2e test blockers B-1/B-2 + shell completion T9
• ✓fix(hub): use CARGO_PKG_VERSION for install-telemetry client string
• ✓security: fix 3 pre-release blockers in v2.2.7 installers
• ✓docs: add v2.2.7 release notes
• ✓feat(setup): curated Ollama model menu with explicit per-model confirmation
• ✓feat(installer): add cross-OS installers + anvil check/upgrade/uninstall for v2.2.7
• ✓feat(tui): add in-TUI scrollback ring buffer + compile fix for share command
• ✓fix(cross-platform): replace Unix-only env lookups with portable alternatives
• ✓fix(ollama): add multi-format tool-call parser and fail-loud warnings

Web Config, AnvilHub Installer, Deep Autocomplete — full browser parity with TUI:

• ✓17 web config panels: providers, vault, notifications, SSH, Docker/K8s, memory, and more
• ✓Full Status Line editor in browser: 36 widgets, 16 presets, drag-and-drop, live preview
• ✓AnvilHub installer: search, install, restart prompt — vault-gated, telemetry-tracked
• ✓Deep hierarchical autocomplete: /vault store <Tab> → 21 credential types
• ✓8 previously-broken TUI handlers now working: /mcp, /plugins, /session, /daily, and more
• ✓New commands: /tab, /fork, /share, /audit, /restart
• ✓Self-respawn on macOS/Linux after plugin installs

Intelligent Memory System — 6-tier architecture, self-improving knowledge base:

• ✓Sensitivity classifier: auto-routes credentials to vault, infra to encrypted memory
• ✓Knowledge nominations: AI discovers patterns, users review and promote to CLAUDE.md
• ✓Private project memory: AES-256-GCM encrypted infrastructure details
• ✓Daily summaries: auto-generated task reconciliation, flags forgotten items
• ✓558 AnvilHub packages: 512 skills across 30 categories

Security Hardening + Optimization — 17 audit findings fixed, zero warnings:

• ✓Constant-time HMAC verification, plugin command injection prevention
• ✓Path traversal protection, cryptographic session IDs
• ✓110 functions made const fn, redundant clones eliminated
• ✓main.rs modularized into 3 focused modules
• ✓RC widget: live client count with connect/disconnect signals
• ✓Zero compiler warnings, 428 tests, 0 failures

Six Major Features — interactive editor, productivity, MCP, history, plugins, agents:

• ✓Interactive Status Line Editor — full TUI editor with 6 sub-screens + WebUI drag-and-drop visual editor
• ✓37 widgets, 16 presets (8 emoji-rich themes), per-widget category colors
• ✓Code Productivity Dashboard — live git diff tracking, /productivity command
• ✓MCP Server Manager — /mcp command, live McpStatus widget
• ✓Session History Browser — /history-archive stats with model breakdown
• ✓Plugin System UI — web viewer management panel with config toggles
• ✓Agent Panel Expansion — web viewer agent management buttons

Customizable Widget-Based Status Line — 8 presets for different workflows:

• ✓Widget-based status line system — 28 widget types, dynamic rendering
• ✓8 presets: default, minimal, developer, token-heavy, git-heavy, compact, cost-focused, streamer
• ✓/configure statusline command with full tab completion
• ✓Web viewer config panel gains Status Line preset selector
• ✓Dynamic footer height — 2-line presets maximize content area

URL rendering fix, context-aware vault, CI/CD automation:

• ✓URL rendering fix — terminal hyperlinks render correctly across all providers
• ✓Context-aware vault — vault auto-selects credentials based on active project context
• ✓CI/CD automation — /cicd command scaffolds pipelines for GitHub Actions and GitLab CI

Typed Credential Vault — the vault is now the single source of truth for ALL sensitive data:

• ✓Typed credential entries — name, type, value, tags, created_at, rotated_at
• ✓Vault covers API keys, SSH keys, TLS certs, tokens, and environment secrets in one place
• ✓/vault add — interactive typed credential entry with category selection
• ✓/vault rotate — rotate any credential in-place, preserving audit history
• ✓/vault export — encrypted vault export for backup and migration
• ✓/vault inject — load vault secrets into shell env for any subprocess
• ✓Audit trail v2 — every vault access logged with timestamp, operation, and credential type

Browser configuration panel, Gemini provider, slash command execution in web viewer:

• ✓Browser-based visual configuration panel
• ✓Google Gemini as 5th provider
• ✓Slash commands execute from web viewer
• ✓30+ commands with subcommand completions

Focus view, context warnings, stalled stream recovery — 6 improvements:

• ✓Edition 2024 mode — optimized session defaults and provider routing for 2024-era models
• ✓Focus view — /focus hides sidebars and agent panels for distraction-free single-pane mode
• ✓Context-low warning — proactive alert before auto-compaction fires when context nears capacity
• ✓Stalled stream handling — detects and recovers from stuck token streams without losing the response
• ✓WebFetch cleanup — improved HTML-to-text extraction, strips nav, footer, and cookie banners automatically
• ✓/loop and /proactive — new slash commands for recurring prompt loops and proactive agent nudges

Credential scanner, egress control, conversation branching — 16 new features:

• ✓Credential auto-detection — scans env vars, dotfiles, SSH keys, TLS certs, auto-vaults provider keys
• ✓Network egress control — configurable domain allowlist, default: AI provider APIs only
• ✓Signed session transcripts — HMAC-SHA256 audit trail in ~/.anvil/audit/
• ✓Conversation branching — /fork to snapshot and branch conversations
• ✓Markdown session export — /export md with code blocks and token summary
• ✓Clickable URLs — OSC 8 hyperlinks in system messages
• ✓Remote control browser auto-open — /remote-control launches browser automatically
• ✓Expanded cost tracking — OpenAI, xAI, Ollama pricing alongside Anthropic
• ✓Inline image rendering — iTerm2/Kitty graphics protocol support
• ✓Smart context compaction — preserves 6 recent messages, code blocks, file paths
• ✓Tool output redaction logging — secrets redacted and logged to audit trail
• ✓SSH key and TLS certificate vault storage — /vault ssh and /vault certs

8 commits: 827d941..fb33055

Live streaming, remote control, and thinking mode:

• ✓Live streaming responses — real-time token-by-token rendering in the TUI
• ✓Remote control — type /remote-control to share your session via browser WebSocket
• ✓Web viewer at passage.culpur.net/viewer for real-time session observation
• ✓Thinking mode — visible reasoning indicator with /think toggle
• ✓Background turn execution — TUI stays responsive during API calls via scoped threads
• ✓WebSocket relay infrastructure — secure pairing with 6-digit codes, multi-client support
• ✓Cross-platform release pipeline — automated builds for macOS, Linux, and Windows

5 commits: 30bf569..2108c93

Security-first release — encrypted vault, file sandbox, modular architecture:

• ✓AES-256-GCM encrypted credential vault with Argon2id KDF — all API keys encrypted at rest
• ✓Setup wizard vault password step — credentials encrypted before touching disk
• ✓Session-based vault unlock — one password prompt per session, KEK zeroed on exit
• ✓Automatic migration from plaintext credentials.json to encrypted vault
• ✓File write sandbox — writes blocked outside project root (PermissionDenied)
• ✓Project root detection via .git, Cargo.toml, package.json markers
• ✓Native Ollama /api/chat with NDJSON streaming and think: true/false
• ✓Multi-line input — footer expands 1-5 lines dynamically with word-wrap
• ✓Ctrl+C clear input / double-tap exit (CC parity)
• ✓Codebase modularized — main.rs 15,756 → 4,770 lines, 134 module files
• ✓Content filter: modern OpenAI key formats (sk-proj-*, sk-svcacct-*)
• ✓Clippy warnings: 470 → 0, strict compilation mode
• ✓394 tests passing, zero unsafe code

11 commits: aeeeff2..4bb283f

Full CC 2.1.94 parity — 3 commits:

• ✓Permission memory — persistent tool approval decisions per project
• ✓Content filtering / prompt injection defense
• ✓Configurable keybindings via ~/.anvil/keybindings.json
• ✓Agent SendMessage / Continue for multi-turn agent conversations
• ✓Worktree isolation for agents — git worktree per agent
• ✓/fast mode toggle — lower token budget for quick responses
• ✓Rich slash command help with examples
• ✓Clipboard image paste support
• ✓Background agent desktop notifications
• ✓/review-pr — AI-powered pull request review
• ✓First-run setup wizard with 5-step provider configuration

3 commits: dc1d81a..6ce5d4d